joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a5d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rsi, qword [rsp + 0x1d8]
mov r13, qword [rsp + 0x1e0]
mov edi, r9d
mov r12d, edx
cmp dword [rsp + 0x1d0], edx
jg 0x14001a655
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r9, [0x1400ed4d4]
mov qword [rsp + 0x28], rax
lea rax, str.sheet
lea rdx, [0x1400ed4d4]
lea rcx, str.numeracy
mov r8, rbx
mov qword [rsp + 0x20], rax
call fcn.140056fe0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.sweets
lea rcx, [rsp + 0x30]
mov r8d, eax
mov r15d, eax
call fcn.14003da20
mov edx, 0x104
mov ecx, dword [rax + 8]
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x50]
movsd xmm0, qword [rax]
movsd qword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov rdx, rax
mov r14, rax
call fcn.14003e9a0
mov rdx, rsi
xor ecx, ecx
mov ebp, eax
lea ebx, [r14 + 5]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [rsp + 0x20], r14
call fcn.14005e900
lea rdx, str.c3a0
xor ecx, ecx
movsx rdi, al
call fcn.140042120
mov ecx, 0xffff
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.c1a0
mov dword [rsp + 0x34], eax
mov rdx, qword [rsp + 0x30]
call fcn.14005b7e0
call fcn.140043520
sub sil, bl
sub sil, byte [rsp + 0x40]
add sil, 5
add sil, byte [rsp + 0x30]
add sil, r13b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [rbp*4]
sub r13d, edx
lea r9d, [r15 + 5]
lea rcx, str.c3a0
sub r13d, edi
movzx r8d, al
movzx edx, sil
add r13d, r12d
add r9d, r13d
call fcn.1400344f0
mov rax, r14
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001e7b0
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor edi, edi
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x54], 8
mov dword [rsp + 0x58], 0x20
mov qword [rsp + 0x48], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r8d, r8d
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rsp + 0x90], xmm0
call fcn.1400c7a80
mov rbx, rax
call fcn.14008d070
lea r15, str.c0ret
mov ebp, eax
cmp eax, 0x40
je 0x14001e92b
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [0x1400edd8c]
mov rdx, rax
call fcn.14008e700
lea r9d, [rdi + 0x40]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
or rdx, 0xffffffffffffffff
mov r14, rax
inc rdx
cmp byte [rbx + rdx], dil
jne 0x14001e891
mov edi, 0x43
lea rcx, [0x1400edd8c]
mov r8d, 4
sub edi, edx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov r9, rsi
movzx r8d, bl
mov edx, edi
mov rcx, r14
mov byte [rsp + 0x20], al
call fcn.14008be40
lea rdx, str.ocelot
xor r8d, r8d
mov rcx, r15
call fcn.1400a3530
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xa0]
lea rcx, str.ocelot
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rdx, str.c4a1
mov r9, r15
mov rcx, rsi
call fcn.1400b4700
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str.cleric
lea esi, [rbp + 0x40]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], esi
lea r9, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, 0x40
mov dl, 2
mov ecx, eax
mov qword [rsp + 0x20], r15
call fcn.140077270
mov r14d, eax
cmp ebp, 4
jne 0x14001e9a6
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [rsi + 6]
lea ecx, [rsi + rcx*4]
mov r9, rax
mov r8, rbx
lea edx, [r14 + rcx*2]
mov rcx, rdi
mov dword [rsp + 0x20], edx
mov dl, 0x10
call fcn.1400d7a60
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call fcn.140087c50
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14001f390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, qword [rsp + 0x230]
mov r12, qword [rsp + 0x238]
mov rsi, rcx
mov qword [rsp + 0x30], r8
mov r14d, edx
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
mov r15, r9
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
or rdi, 0xffffffffffffffff
mov r13, rax
mov rbx, rdi
nop
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14001f400
imul ebx, r14d
sub ebx, dword [r15 + 0x20]
sub ebx, r12d
sub ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea r8, str.intervenor
movzx edx, ax
mov eax, r13d
lea rcx, [rsp + 0x38]
imul eax, ebx
lea r9d, [rax + rax*2]
add r9d, r9d
call fcn.1400dab70
xor ecx, ecx
mov edx, 0x3b2
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0xec
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rax
cmp r14d, ebx
jg 0x14001f4cb
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r9, rax
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14001f472
movzx eax, r12b
lea r8, [0x1400ed4d4]
imul byte [r15 + 0x28]
movzx ecx, al
movzx eax, r13b
imul cl
mov rcx, r9
movzx edx, al
mov al, 7
imul bl
sub dl, al
mov rax, qword [rsp + 0x30]
add dl, dil
add dl, byte [rax + 8]
add dl, r14b
call fcn.1400816f0
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea r9, str.ride
movzx eax, ax
mov dword [rsp + 0x20], eax
call fcn.1400a4980
lea rcx, str.forgery
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140020e80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r14d, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r13, rax
call fcn.140087c50
mov ebx, 3
mov ebp, ebx
lea r15d, [rax + 0x1e]
mov r12, rax
sub ebp, r14d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, r13d
imul ecx, r12d
lea edx, [rcx + rcx*4]
add edx, edx
sub ebx, edx
mov dword [rsp + 0x68], ebx
cmp r15d, ebp
jae 0x140020f07
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xa0]
lea rcx, str.cymbals
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp r14d, r15d
jne 0x140020f91
movzx eax, r12b
imul bpl
movzx ebx, al
mov al, 0xe
imul r15b
sub bl, al
sub bl, r13b
add bl, 3
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r9, str.tail
imul edx, r14d, 0x1e
imul ecx, ebp, 7
add edx, ecx
mov r8, r13
xor ecx, ecx
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], bl
call fcn.140096c90
call fcn.14009da10
xor eax, eax
lea r8, [0x140001b00]
mov r9d, r15d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x80]
mov rdx, rax
xor r8d, r8d
mov rbx, rax
call fcn.1400890c0
lea ecx, [r14*2]
mov dl, 8
add ecx, r13d
add r14d, ecx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
add r14d, r15d
mov ecx, r14d
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm1
call fcn.1400cd6e0
sub bl, 5
mov edi, eax
movups xmm0, xmmword [rsp + 0x70]
psrldq xmm0, 8
movq rax, xmm0
imul r14b
movzx esi, al
movzx eax, r13b
imul byte [rsp + 0x68]
sub sil, al
add sil, dil
add sil, bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
movsxd rcx, ebp
mov ebx, eax
xor eax, eax
lea r8, [0x1400ed51c]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], r15d
lea rdx, [0x1400ed3f4]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [rsp + 0x80]
add ebp, 0xfffffff9
movzx r8d, bl
mov r9, rax
movzx edx, sil
imul ecx, r14d
sub ecx, edi
add ecx, r12d
add ecx, ebp
mov dword [rsp + 0x28], ecx
mov ecx, 2
mov byte [rsp + 0x20], 0
call fcn.1400971e0
lea rax, str.c1ret
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400272c0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0xd0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r13, str.caterpillar
lea r9, str.legal
mov edx, r14d
mov cl, 0x10
movzx r8d, al
mov qword [rsp + 0x28], r13
mov ebx, eax
mov dword [rsp + 0x20], 8
call fcn.1400aaf40
xor r12d, r12d
lea r8, [0x140001b00]
movzx r9d, bl
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov rbp, rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, str.c0a5
lea rcx, [rsp + 0xa0]
xor r8d, r8d
mov rdx, rax
mov r15, rax
call fcn.140073d50
movzx esi, bl
or rbx, 0xffffffffffffffff
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm0
movsd xmm0, qword [rax + 0x20]
movups xmmword [rsp + 0x88], xmm1
movsd qword [rsp + 0x98], xmm0
cmp r14d, esi
jg 0x14002746a
lea r8d, [r12 + 0x16]
mov edx, 0x14f
xor ecx, ecx
mov qword [rsp + 0x100], rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, rbx
inc rax
cmp byte [rax + rbp], r12b
jne 0x1400273a4
xor ecx, ecx
imul eax, r15d
mov edi, 8
lea r8d, [rcx + 0x17]
mov edx, 0x12a
sub edi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], 8
mov dword [rsp + 0x38], 8
mov eax, esi
mov ecx, 2
mov dword [rsp + 0x30], 8
lea rdx, str.c0a5
mov r9d, r14d
imul eax, dword [rsp + 0x84]
imul eax, r15d
sub ecx, eax
mov r8, r13
mov dword [rsp + 0x28], 0x10
shl ecx, 3
mov dword [rsp + 0x20], r14d
sub ecx, r14d
mov dword [rsp + 0x68], ecx
mov ecx, 0x10
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, edi
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x60]
movsd xmm1, qword [rsp + 0x70]
movsd qword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
call fcn.14007f080
mov rdi, qword [rsp + 0x100]
mov r13, qword [rsp + 0x110]
mov r12, qword [rsp + 0x108]
nop word [rax + rax]
inc rbx
cmp byte [rbx + rbp], 0
jne 0x140027480
imul ebx, r15d
sub esi, ebx
sub esi, dword [rsp + 0x8c]
sub esi, r14d
lea eax, [rsi + 2]
add rsp, 0xd0
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002bee0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
movsx ebp, byte [rsp + 0xb8]
mov esi, ecx
movzx ebx, r9b
mov ecx, ebp
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r14d, esi
mov dword [rsp + 0xa8], ebx
mov rcx, rax
mov qword [rsp + 0x98], rax
movzx eax, byte [rsp + 0xc0]
imul sil
movzx edx, al
movzx eax, bl
imul dl
mov edx, ebx
imul edx, edi
movzx r15d, al
mov byte [rsp + 0xb8], al
sub r14d, edx
mov rdx, rcx
lea rcx, str.cummerbund
call fcn.1400d7da0
cmp bl, sil
jb 0x14002c088
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rdx, [0x1400ed3f4]
movzx r12d, ax
lea rcx, [0x1400ed3f4]
mov r8d, r12d
call fcn.140086d00
lea r8, [0x140001b00]
mov r9d, r14d
mov rdi, rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x1de
lea r8d, [rcx + 0x19]
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
or rbx, 0xffffffffffffffff
movsx rcx, r15b
mov qword [rsp + 0x40], rax
mov rdx, rbx
nop
inc rdx
cmp byte [rdi + rdx], 0
jne 0x14002bfd0
mov r15, qword [rsp + 0xb0]
mov eax, r15d
imul eax, esi
lea eax, [rax + rax*4]
lea ecx, [rcx + rax*2]
add ecx, r12d
add ecx, r14d
sub ecx, edx
mov dword [rsp + 0x48], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov dword [rsp + 0x4c], eax
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14002c003
movsx r12, byte [rsp + 0xb8]
imul r15d, dword [rsp + 0xa0]
mov eax, ebp
imul eax, r12d
imul eax, dword [rsp + 0xc0]
lea ecx, [rax + rax*4]
lea eax, [r14 + r15]
lea edi, [rax + rcx*2]
add edi, esi
sub edi, ebx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, r12d
imul ebp, dword [rsp + 0xc0]
movaps xmm0, xmmword [rsp + 0x40]
lea r8d, [rdi - 2]
movdqa xmmword [rsp + 0x40], xmm0
imul ecx, dword [rsp + 0x98]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
sub ebp, ecx
mov rcx, qword [rsp + 0x30]
sub ebp, dword [rsp + 0xa8]
lea r9d, [rsi + rbp]
call fcn.14007cde0
mov r12, qword [rsp + 0x50]
lea rax, str.c0a0
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002e460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x320
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x310], rax
movzx esi, r8b
mov edi, ecx
cmp r8b, cl
jl 0x14002e4bd
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [0x1400ee230]
mov rdx, rbx
call fcn.1400d7da0
lea rcx, str.satire
xor r9d, r9d
mov r8d, edi
mov edx, edi
call fcn.1400d96e0
lea r14, [0x1400ed3f4]
cmp sil, al
je 0x14002e5be
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.satire
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x1d0]
movzx edx, ax
mov r8d, 0x140
mov dword [rsp + 0x40], edx
xor edx, edx
call fcn.1400e27d0
lea rdx, [rsp + 0x1d0]
lea rcx, str.satire
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [rsp + 0x50], 1
lea r8, [rsp + 0x60]
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x48], rax
lea rdx, str.step_son
mov r9b, 4
movaps xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rsp + 0x80], xmm0
movups xmm1, xmmword [rsp + 0x40]
mov rcx, rbx
movaps xmmword [rsp + 0x70], xmm1
call fcn.1400bc3b0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
movsx rax, sil
mov edx, 0x14
mov esi, edi
lea ecx, [rax + rax*2]
lea r8d, [rdx + 5]
shl ecx, 2
sub esi, ecx
xor ecx, ecx
add esi, esi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, esi
mov rdx, rax
call fcn.14007c6b0
mov rbp, rax
call fcn.1400a2e10
test edi, edi
jg 0x14002e64a
lea rdx, str.boot
xor ecx, ecx
call fcn.140067d40
lea rcx, str.boot
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x68
xor ecx, ecx
lea r8d, [rdx - 0x67]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [rdi + rdi]
lea rcx, str.c1a0
sub dl, bpl
mov r8, r14
mov qword [rsp + 0x20], rcx
add dl, sil
mov r9, rax
mov rcx, rbx
call fcn.1400b3cc0
lea rcx, [rsp + 0x30]
call fcn.140092130
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140032e90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.fanny_pack
mov rdx, rax
mov rsi, rax
call fcn.1400a3b10
lea r8, str.cross_stitch
lea rcx, [rsp + 0x40]
xor edx, edx
movsx rbx, al
call fcn.1400c5b30
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov rdi, rbx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x30], xmm1
imul eax, ebx, 0x78
mov dword [rsp + 0x40], eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
movups xmmword [rsp + 0x90], xmm0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rax
lea r9, str.c0a0
lea r8, str.c1a1
movsd xmm1, qword [rsp + 0x50]
movups xmm0, xmmword [rsp + 0x40]
movsd qword [rsp + 0x80], xmm1
lea rcx, [rsp + 0x70]
mov rdx, rsi
movaps xmmword [rsp + 0x70], xmm0
call fcn.140080df0
lea rdx, str.c2a2
lea rcx, str.cell
movzx ebx, al
call fcn.1400c36b0
mov edx, dword [rsp + 0x30]
movsx rcx, al
add edx, 0xfffffffe
mov eax, ebx
lea r11, [rsp + 0xa0]
add eax, 0xfffffff2
imul edx, esi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
lea r8d, [rdx + rcx*4]
sub r8d, edi
add eax, r8d
mov rsp, r11
pop rdi
ret
Function at 0x14003bb60
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x2e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov r14, r8
mov ebp, edx
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [0x1400ed4d4]
lea r9, str.mustard
mov r8, rcx
mov rdx, rax
mov qword [rsp + 0x20], rcx
mov r15, rax
call fcn.140067ac0
mov rsi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov rdx, rdi
inc rdx
cmp byte [rbx + rdx], 0
jne 0x14003bbd1
lea eax, [rsi*2 + 2]
imul ecx, r15d, 7
sub ecx, eax
mov rax, rdi
sub ecx, dword [r14]
sub ecx, ebp
add edx, ecx
mov dword [rsp + 0x38], edx
inc rax
cmp byte [rbx + rax], 0
jne 0x14003bbf5
sub eax, 2
xor ecx, ecx
mov edx, 0xf1
mov dword [rsp + 0x3c], eax
lea rax, str.c0a2
lea r8d, [rcx + 0x10]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], rax
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x14003bc33
imul eax, dword [r14 + 0x18]
add eax, 2
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rdi
mov qword [rsp + 0x60], rax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14003bc56
movzx eax, byte [r14]
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
lea r9, [rsp + 0x70]
lea rdx, str.scorn
xor r8d, r8d
imul cl
movzx ecx, r15b
shl cl, 2
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
movups xmm0, xmmword [rsp + 0x50]
movsd xmm1, qword [rsp + 0x60]
lea ebp, [rcx + rax]
mov rcx, r12
mov byte [rsp + 0x20], bpl
movaps xmmword [rsp + 0x90], xmm0
movsd qword [rsp + 0xa0], xmm1
call fcn.1400c4440
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], 0
jne 0x14003bcc1
movsx rax, bpl
imul ecx, eax
sub esi, ecx
add esi, 0xfffffffe
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14003bcd6
lea ebx, [rsi + r15]
add ebx, edi
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 8]
mov edx, 0x2ce
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp eax, ebx
jle 0x14003bd19
lea rcx, [rsp + 0xb0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x1c0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.stepson
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x2e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003cb90
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rcx, [0x1400ed3f4]
mov rbp, r8
call fcn.1400c5520
movzx ebx, byte [rsp + 0x68]
mov esi, 0x20
mov rdi, rax
cmp bl, sil
jne 0x14003cc0e
xor eax, eax
lea r8, [0x140001b00]
mov r9d, esi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x1400ed3f4]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [0x1400ed3f4]
call fcn.140080cf0
call fcn.140092f90
call fcn.1400c8d80
movsx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [rsp + 0x70]
lea r8, [0x1400ed3b4]
mov r9, rax
mov rdi, rax
imul ecx, ebp
lea edx, [rcx + rcx*2]
xor ecx, ecx
add edx, edx
sub esi, edx
mov rdx, rbx
mov dword [rsp + 0x20], esi
call fcn.14007dd90
lea rcx, str.wind
call fcn.14006d240
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x30
pop rdi
ret