joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008be40
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
movzx r13d, byte [rsp + 0x230]
mov rdi, rcx
movzx eax, r9b
mov rsi, r9
movzx r14d, r8b
mov byte [rsp + 0x60], r8b
imul dl
movzx ecx, al
movzx eax, dil
mov ebp, edx
imul cl
movzx ecx, al
movzx eax, r13b
imul cl
movzx r12d, al
mov r15d, r12d
sub r15d, edi
add r15d, 9
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x68], rax
cmp ebp, r12d
jge 0x14008bed3
xor ecx, ecx
mov edx, 0x21c
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov ecx, edi
add esi, 0x45
movzx r14d, r14b
mov edx, 0x1d6
mov ebx, eax
imul ecx, ebp
imul ecx, r14d
add esi, ecx
xor ecx, ecx
lea r8d, [rcx + 0xf]
add esi, r12d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx eax, dil
movsxd rdx, r15d
lea r8, str.vixen
imul bpl
movzx ecx, al
movzx eax, dil
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x60]
imul cl
movzx ecx, al
movzx eax, r13b
imul cl
mov ecx, r15d
movzx ebp, al
mov al, 0x46
sub bpl, 2
imul bl
add bpl, al
xor eax, eax
add bpl, byte [rsp + 0x68]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], r14d
movzx ebx, r13b
lea rdx, str.bafflement
movzx edi, bpl
mov dword [rsp + 0x30], ebx
mov r9d, ebx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, 0xfffffff2
imul ebx, r14d
imul ebx, r12d
sub ecx, ebx
sub ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp bpl, al
ja 0x14008c019
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.fisherman
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x3a7
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
mov edx, 0x372
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rax, str.washtub
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008c070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x178
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [0x1400ed830]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x1df
mov r8d, 0x17
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.pantry
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x178
ret

Function at 0x14008c360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ebx, ecx
mov rsi, rdx
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov edi, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, ebx
jbe 0x14008c3ef
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.cupola
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.cupola
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.igloo
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14008c5e0
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, [rsp + 0x60]
movzx r13d, ax
mov edx, 0x104
add r13d, 0xffffffe0
add r13d, r12d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov r15, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, r12d
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
lea r8, [0x140001b00]
mov r9d, r13d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8, str.rambler
lea rdx, str.turret
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0x20
mov dword [rsp + 0x30], r13d
lea r9d, [rax + 1]
lea ecx, [rax + 0x20]
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.USER32.dll_CreateWindowExA]
movzx ecx, bl
shl cl, 3
movzx edx, bpl
add bl, 4
sub dl, cl
sub bpl, 0x5d
add dl, r15b
imul bl
shl dl, 2
sub dl, al
movzx eax, sil
imul dil
sub dl, al
mov al, 0x2a
imul r12b
add al, dl
sub al, r14b
sub al, r15b
add al, r13b
add al, bpl
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14008cce0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, r15d
lea r14d, [rax + 6]
mov rsi, rax
imul edi, eax
movzx ebp, r14b
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
sub edi, 0x9a
mov r12, rax
js 0x14008ce31
xor ecx, ecx
mov edx, 0x316
mov qword [rsp + 0x1a0], rbx
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
add ebx, 0xffffffe4
sub eax, r12d
mov ecx, 0x10
add ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rdx, str.egypt
lea rcx, str.attachment
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
movzx eax, r14b
lea r8, str.debtor
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ecx
lea rdx, str.cottage
mov r9d, ebp
mov ecx, ebp
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rbx, qword [rsp + 0x1a0]
lea eax, [rsi + rsi*4]
lea ecx, [rdi + rax*2]
mov eax, 0xffffffdc
imul ecx, r15d
sub eax, ecx
sub eax, ebp
sub eax, r12d
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14008ce80
Capabilities:
Check for time delay via gettickcount
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov ebp, dword [rsp + 0x1f0]
mov rsi, r9
mov r14d, r8d
mov r15, rdx
mov r12d, ecx
cmp ebp, r8d
jg 0x14008cec7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, r12d
mov ecx, r14d
sub ebx, r15d
mov rdi, rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x24], ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov qword [rsp + 0x58], rax
movzx eax, dil
shl cl, 2
imul bl
movzx r13d, al
sub r13b, cl
inc r13b
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x1c]
mov edx, 0x1a2
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, r15
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov edx, 0x77
lea r8d, [rdx - 0x6a]
xor ecx, ecx
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x38], rax
cmp ebp, r14d
jle 0x14008cf69
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x2a3
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x3b0
lea r8d, [rcx + 0x12]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
or rdi, 0xffffffffffffffff
mov rbx, rax
mov rcx, rdi
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14008cfa0
mov edx, dword [rsp + 0x38]
imul ecx, r12d
imul ecx, ebp
imul edx, dword [rsp + 0x30]
lea eax, [r15 + rdx*2]
add edx, eax
mov rax, qword [rsp + 0x28]
add eax, ecx
lea eax, [rax + rdx*4]
add eax, 5
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
nop dword [rax + rax]
cmp byte [rsi + rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x14008cfe0
movzx eax, r13b
imul r15b
lea ecx, [rax + 3]
movzx eax, bl
add cl, dl
imul byte [rsp + 0x20]
shl cl, 2
sub cl, al
movzx eax, byte [rsp + 0x28]
imul bpl
sub cl, al
movzx eax, byte [rsp + 0x40]
imul byte [rsp + 0x50]
sub cl, al
sub cl, byte [rsp + 0x24]
sub cl, byte [rsp + 0x30]
sub cl, r15b
sub cl, byte [rsp + 0x60]
lea eax, [rcx + rdi]
add al, r12b
add al, r14b
add al, byte [rsp + 0x38]
add al, byte [rsp + 0x48]
add al, byte [rsp + 0x58]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008d330
Capabilities:
Allocate or change rwx memory
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
movzx edi, byte [rsp + 0x180]
mov edx, 0x2e
xor ecx, ecx
lea r8d, [rdx - 0x2d]
mov ebx, r9d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp dil, bl
jge 0x14008d3ac
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx ecx, dil
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x60
xor ecx, ecx
lea r8d, [rdx - 0x47]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x345
mov r8d, 0x1b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x50df
mov r9d, 0x40
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x2cc
mov r8d, 0x14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp bl, dil
ja 0x14008d48c
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rax, [0x1400ed3f4]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
Function at 0x14008d4c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r13, r8
movzx r12d, dl
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
or rbx, 0xffffffffffffffff
mov r15, rax
mov r9, rbx
inc r9
cmp byte [rdi + r9], 0
jne 0x14008d511
add r9b, byte [r13 + 8]
mov ebp, esi
lea r8, [0x140001b00]
movzx r14d, r9b
xor edx, edx
xor ecx, ecx
mov eax, r14d
imul eax, r15d
sub ebp, eax
xor eax, eax
mov qword [rsp + 0x28], rax
movsxd r9, ebp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0x30], rax
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
sub sil, r15b
lea rcx, [rsp + 0x50]
sub sil, byte [rsp + 0x30]
mov edx, 0x104
mov qword [rsp + 0x38], rax
add sil, al
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movsx ecx, r12b
mov qword [rsp + 0x48], rax
cmp ebp, ecx
je 0x14008d5e0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x18f
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx r8, sil
mov rdx, rbx
nop
inc rdx
cmp byte [rdi + rdx], 0
jne 0x14008d600
mov rax, qword [rsp + 0x48]
mov r9, qword [rsp + 0x30]
lea ecx, [rax*4]
mov eax, r14d
sub ecx, r9d
add ecx, ecx
imul eax, r9d
imul eax, ebp
sub ecx, eax
mov rax, qword [rsp + 0x38]
sub ecx, r8d
sub ecx, r15d
add eax, ecx
add edx, eax
movsx rax, r12b
lea ecx, [rdx + rdx*4]
sub ecx, dword [r13 + 0x18]
add ecx, eax
sub ecx, dword [rsp + 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14008d650
lea eax, [r14 + rcx]
add ebx, eax
lea eax, [rbp + 0x1a]
add ebx, r8d
add eax, ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008d6a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov rbx, rax
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
lea eax, [rbx + 4]
add eax, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx r13, dil
lea rdx, str.c0a0
mov r9, r13
mov r8d, 0x40
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.anywhere
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
movzx ebx, r14b
add dil, 0x17
sub bl, r15b
mov rbp, rax
add bl, byte [rsp + 0x28]
add bl, sil
add bl, r12b
add bl, dil
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [r14*8]
imul r15d, esi
imul r15d, dword [rsp + 0x28]
sub r12d, ecx
lea ecx, [rax + r12*2]
movsx rax, bl
add ecx, r14d
shl ecx, 2
sub ecx, r15d
sub ecx, eax
mov eax, dword [rsp + 0x20]
add ecx, r13d
add eax, 0x3ff
add ecx, ebp
add eax, ecx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14008dbd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1b8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
movzx ebx, byte [r9]
mov r15, qword [rsp + 0x218]
mov rbp, rcx
mov ecx, dword [rsp + 0x210]
mov edi, edx
movzx eax, r8b
add bl, cl
mov rsi, rdx
imul edi, ebp
sub edi, eax
add bl, bpl
sub edi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, al
mov r14d, eax
cmp edi, ecx
jle 0x14008dcfb
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x34b
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x1be
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.reamer
movzx ebx, r14b
movsxd rdi, edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400ed7c8]
mov r9d, ebx
mov r8, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x368
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.pool
lea r8, [0x1400ed7c8]
mov qword [rsp + 0x28], rcx
lea rcx, str.mayor
mov r9, rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.1400db980
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1b8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008dd70
Capabilities:
Allocate or change rwx memory
Create thread
Query environment variable
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor edi, edi
mov r12d, eax
mov r13, rax
imul r12d, ebx
shl r12d, 4
cmp r12d, 0x10
jle 0x14008de09
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, str.soup
mov r9d, r12d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rdx, str.medicine
lea rcx, [rsp + 0x60]
sub r9d, r12d
mov r8d, eax
call fcn.1400db100
lea r8, [0x140001b00]
mov r9d, 0x10
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
mov r9d, 0x10
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov r14, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15d, ebx
mov ecx, 0xffff
lea ebp, [rbx - 0x47]
mov rdi, rax
sub r15d, r13d
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ecx, eax
mov ebx, ebp
mov edx, 0x1f7
shl ecx, 4
mov esi, eax
sub ebx, ecx
xor ecx, ecx
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
lea r9d, [rcx + 4]
mov edx, 0x336c
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
sub r12d, esi
lea eax, [r13 - 0x34]
sub r12d, ebp
lea r8, str.neologism
lea rdx, str.shampoo
add r12d, edi
mov r9d, r15d
add r12d, r14d
add r12d, ebx
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], 1
add eax, r12d
mov dword [rsp + 0x30], eax
lea ecx, [rbx + 0x40]
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea r8, [0x140001b00]
movsxd r9, r15d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.joseph
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret