joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c31a0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov esi, edx
mov ebp, ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movsxd rdi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movsx rdx, dil
mov ecx, esi
lea ebx, [rax + rdx*2]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [rsi + rsi]
mov edx, 0xfffffffc
sub ecx, ebx
lea ebx, [rbp - 2]
add ebx, ecx
lea ecx, [rbx + rbx*2]
add ecx, ecx
sub edx, ecx
sub edx, eax
cmp edx, dword [rsp + 0x1c0]
jne 0x1400c3228
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.faucet
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp ebx, ebp
jg 0x1400c32f4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0x3c6
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsxd r9, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dil, 0x20
jg 0x1400c3302
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x8b
xor ecx, ecx
lea r8d, [rdx - 0x76]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rax, str.c14a1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c33a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, r8
mov rdi, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov edx, 0x13c
mov r8d, 0x1c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x178
mov r8d, 5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, str.c0a0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret
Function at 0x1400c3550
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rsi, rcx
mov rbx, rdx
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov eax, dword [rsp + 0x34]
lea ebx, [rbx + rbx*2]
lea edx, [rax + rax*8]
add ebx, ebx
movzx edi, dl
imul eax, edx, 0x3f
sub ebx, eax
sub ebx, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x2c7
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, str.harpooner
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsxd r9, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.pince_nez
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
cmp ebx, edi
jg 0x1400c3668
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rax, str.c3a4
mov qword [rsi], rax
lea rax, str.c0a4
mov qword [rsi + 8], rax
mov rax, rsi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400c3960
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r12, dword [rsp + 0xa0]
movsx esi, r8b
lea edi, [rdx + 1]
movzx eax, sil
movzx r15d, dl
movzx ebx, r12b
shl al, 2
lea r8, [0x140001b00]
mov r9, r12
sub bl, al
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x28], rax
add bl, 4
shl dil, 2
add bl, dl
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0xc5
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 2]
mov edx, 0x1b6
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, esi
mov r13d, esi
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp r12d, r15d
jne 0x1400c3a30
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
movsx ecx, bl
lea r8d, [r15 + 9]
mov r14d, eax
mov rax, qword [rsp + 0x90]
lea edx, [r15*4]
movzx ebp, dil
mov ebx, r8d
mov esi, edx
imul eax, r15d
add eax, ecx
lea edi, [r12 - 4]
imul ebx, r12d
imul ebp, ecx
imul esi, r13d
add eax, r15d
sub esi, ebp
add eax, r8d
add esi, edx
add edi, eax
movsx rax, byte [rsp + 0x80]
add esi, r8d
lea ecx, [rax + rax*4]
sub ebx, ecx
shl ebx, 2
sub ebx, edx
add ebx, r15d
add ebx, dword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
lea eax, [r15 + 9]
xor edx, edx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x18], rdx
imul ebp, eax
sub ebp, dword [rsp + 0x88]
lea eax, [r15 - 0x13]
sub ebp, ebx
mov rbx, rcx
sub ebp, edi
sub ebp, r14d
sub ebp, r12d
add ebp, r13d
add ebp, r15d
add ebp, esi
add eax, ebp
mov dword [rcx + 0x10], eax
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x286
lea r8d, [rcx + 8]
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c42d0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbp, qword [rsp + 0x228]
mov dword [rsp + 0x34], r9d
mov r15, r8
mov r13, rdx
movsx ebx, cl
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
or rsi, 0xffffffffffffffff
mov r14d, ebx
mov rdi, rsi
nop dword [rax]
inc rdi
cmp byte [rdi + rbp], 0
jne 0x1400c4320
mov eax, ebx
lea rcx, [rsp + 0x90]
mov edx, 0x104
sub eax, dword [rsp + 0x220]
add edi, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x38], rax
cmp edi, dword [rsp + 0x220]
je 0x1400c4368
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
add ebx, r15d
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
inc rsi
cmp byte [rsi + rbp], 0
jne 0x1400c4374
movzx edx, r14b
movzx eax, r15b
lea ecx, [rdx + 9]
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x38]
imul r13b
sub cl, al
add sil, cl
cmp dl, sil
jl 0x1400c43dd
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov r8d, dword [rsp + 0x34]
lea rcx, [rsp + 0x40]
movzx edx, ax
lea eax, [r12 + rbx*2]
add r8d, 0xfffffff6
shl eax, 2
mov r9, r13
sub eax, r15d
sub eax, r13d
add eax, r14d
add r8d, eax
lea rax, str.lentil
mov qword [rsp + 0x20], rax
call fcn.1400db730
xor eax, eax
lea r8, [0x140001b00]
movsxd r9, edi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
lea r8d, [rcx + 0x1c]
mov edx, 0x27e
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c4440
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, str.c0a1
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
sub bpl, bl
mov rdi, rax
add bpl, 6
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x82
xor ecx, ecx
mov rbx, rax
lea r8d, [rdx - 0x7e]
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [rbx + rbx*4]
lea edx, [rdi + rdi*2]
lea ebx, [rcx + rdx*2]
movsx r12, r14b
movsx r15, bpl
sub ebx, eax
xor r13d, r13d
mov qword [rsp + 0xa0], rax
add ebx, r12d
add ebx, r15d
cmp bpl, bl
je 0x1400c45b6
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], ebx
movsx edi, bpl
mov dword [rsp + 0x30], edi
lea r8, str.c0a1
mov r9d, ebx
mov rdx, rsi
mov ecx, ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, 0x4a
lea r8d, [rdx - 0x38]
xor ecx, ecx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx r10d, r14b
or rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400c4540
mov r8, qword [rsp + 0xb8]
sub al, r13b
mov edx, r10d
xor r13d, r13d
mov r9d, ebx
imul edx, edi
imul edx, dword [rsp + 0xa0]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
imul edx, dword [rsp + 0xb0]
sub edx, dword [r8]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], edi
sub edx, ecx
mov r8, rsi
mov ecx, r10d
add edx, 5
sub al, dl
inc al
movzx eax, al
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edx
lea rdx, str.chard
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
movsx eax, byte [rsp + 0xc0]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebx
movsx r9d, bpl
movsx ecx, r14b
lea r8, str.mallet
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], eax
lea rdx, str.chard
mov dword [rsp + 0x20], ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, qword [rsp + 0xa8]
lea rax, str.cyclone
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c46d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
or rbx, 0xffffffffffffffff
mov ebp, eax
mov rsi, rbx
nop dword [rax]
inc rsi
cmp byte [rdi + rsi], 0
jne 0x1400c4700
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400c4712
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea r8, [0x140001b00]
movsxd r9, esi
mov ecx, eax
movzx eax, bpl
xor edx, edx
imul sil
movzx edi, al
sub dil, bl
xor ebx, ebx
add dil, r14b
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
sub dil, cl
xor ecx, ecx
add dil, 0x20
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], 0x20
movzx ecx, bpl
movsx eax, dil
lea r8, str.neologism
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x20
lea rdx, str.c1ret
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ecx
mov r9d, esi
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r11, [rsp + 0x60]
lea rax, str.c3ret
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400c47e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r14d, r14d
lea r8, str.chess
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], 0x20
mov dword [rsp + 0x30], 0x20
lea r9d, [r14 + 4]
lea rdx, str.runaway
lea ecx, [r14 + 0x20]
mov dword [rsp + 0x28], 0x20
mov edi, eax
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], 0x20
mov r9d, 0x20
mov dword [rsp + 0x30], 4
lea r8, str.chess
lea rdx, str.c0a2
mov ecx, r9d
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r9d, [r14 + 0x1c]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
mov rsi, rax
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.azimuth
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp dil, 0x20
jne 0x1400c492d
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetActiveWindow]
imul eax, edi, 0x10c0
lea r8, [0x140001b00]
add eax, ebx
mov r9d, 0x1c
xor edx, edx
shl eax, 4
xor ecx, ecx
mov qword [rsp + 0x28], r14
imul ebx, ebp, 7
add eax, esi
mov dword [rsp + 0x20], r14d
add ebx, eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
cmp bl, 0x20
jle 0x1400c497c
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp edi, 0x20
jb 0x1400c49b7
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.c0a2
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.c0a3
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400c4d40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x188
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x11e
mov r8d, 0x10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rax, str.mention
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x188
ret

Function at 0x1400c4df0
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
movsx ebx, byte [rsp + 0x178]
mov rsi, qword [rsp + 0x170]
mov edi, edx
mov ebp, ecx
cmp edx, ebx
jle 0x1400c4ea0
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x1c
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, 0x5a
lea r8d, [rdx - 0x56]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
imul ebx, esi
lea eax, [rdi - 8]
add ebx, ebp
add eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400c5360
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
movzx ebp, r8b
movzx ebx, cl
movsxd r12, edx
mov byte [rsp + 0x31], bpl
mov byte [rsp + 0x30], bl
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, ebx
mov r14d, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r13d, ebx
imul r13d, r12d
mov qword [rsp + 0x60], rax
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov edi, r13d
mov r9d, ebp
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x34], ebp
sub edi, ebp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, str.c0a0
mov r8, r12
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, esi
mov rbx, rax
shl ecx, 5
lea eax, [rbp*4]
add eax, ebp
lea r15d, [rcx + 6]
mov dword [rsp + 0x38], ecx
add eax, eax
sub eax, edi
add r15d, eax
movzx eax, r14b
imul r12b
movzx edi, al
sub dil, byte [rsp + 0x60]
sub dil, sil
sub dil, 2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx esi, dil
imul r14d, r12d
imul ebx, r15d
shl r14d, 5
add r14d, ebx
mov qword [rsp + 0x40], rax
sub sil, r14b
sub sil, al
add sil, 8
cmp dil, 8
jl 0x1400c548b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movsx ebx, dil
sub ebx, dword [rsp + 0x38]
sub ebx, r15d
add ebx, dword [rsp + 0x34]
add ebx, r13d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ecx, bl
mov rdx, rax
movzx eax, byte [rsp + 0x31]
add cl, cl
add bl, cl
add r14b, 0x26
add bl, bl
imul r12b
movzx r8d, al
movzx eax, dil
imul byte [rsp + 0x40]
add al, al
sub r8b, al
movzx eax, bpl
shl r8b, 2
shl al, 2
add r8b, bl
add bpl, al
add bpl, bpl
sub r8b, bpl
sub r8b, dl
sub r8b, sil
lea eax, [r15 + r8]
add al, r14b
add al, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x218]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c5a10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x2b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea eax, [rbx + 0x20]
cmp eax, 0x20
jle 0x1400c5b03
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.tyvek
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, str.racer
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x160]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x160]
lea rcx, str.racer
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x267
mov r8d, 0x13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, str.forgery
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rax, str.c2a0
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x2b0
pop rbx
ret
Function at 0x1400c6a80
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ebx, edx
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp ebx, edi
jge 0x1400c6b09
mov edx, 0x284
mov r8d, 0x1b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0xcb
mov r8d, 0x1a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.jiffy
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.cirrus
lea rcx, str.jiffy
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1400c6b2a
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret