joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a56d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
movsx ebp, cl
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rcx, [rsp + 0x20]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, ebp
sub edx, ebp
add edx, 8
add ebx, edx
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, str.leaver
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx eax, bl
sub al, bpl
add al, dil
add al, bpl
cmp bpl, al
jge 0x1400a576a
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rax, str.ottoman
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1400a57a0
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rdi, rcx
mov ecx, 0xffff
movsx ebx, dl
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [0x1400ed4d4]
mov r8d, ebx
mov rdx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
movzx r9d, al
movzx eax, sil
lea ecx, [r9 + 4]
add ecx, eax
cmp ecx, 9
jg 0x1400a585d
xor edi, edi
lea r8, [0x1400ee310]
lea rdx, [0x1400ed4d4]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 9
mov dword [rsp + 0x28], r9d
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r9d, [rdi + 6]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
lea rax, str.ocelot
add rsp, 0x60
pop rdi
ret
Function at 0x1400a5bc0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r12, rdx
movzx r15d, cl
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, r15d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx r8d, r15b
lea r14d, [rsi + 8]
sub r8b, r12b
mov rbp, rax
add bpl, r8b
add r14b, bpl
cmp bpl, r14b
jge 0x1400a5c2d
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx ebx, r15b
lea rdx, str.c0ret
mov r8d, esi
mov r9d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov edx, 0x58
xor ecx, ecx
lea r8d, [rdx - 0x4a]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x290
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx eax, r14b
cmp edi, eax
jne 0x1400a5cd0
mov edx, 0x83
xor ecx, ecx
lea r8d, [rdx - 0x74]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp bpl, sil
jne 0x1400a5d01
xor ecx, ecx
mov edx, 0x2c4
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x25c
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
shl sil, 2
sub dil, sil
add dil, r15b
add dil, r12b
call qword [sym.imp.USER32.dll_GetActiveWindow]
add dil, 0x2b
je 0x1400a5d53
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x15]
mov edx, 0xe4
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x398
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x385
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400a67b0
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, [0x1400ed3b8]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x28f
mov r8d, 0x10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xfffffe00
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x37
xor ecx, ecx
lea r8d, [rdx - 0x26]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rax, str.c0ret
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
Function at 0x1400a6d80
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov esi, r8d
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x160
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsxd rdi, dword [rsp + 0x78]
mov r15, rax
cmp edi, esi
je 0x1400a6e3c
xor ecx, ecx
mov edx, 0x123
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x189
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x202
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov eax, dword [rsp + 0x70]
lea ebx, [r15 + r15]
imul eax, ebp
sub ebx, eax
sub ebx, edi
add ebx, r14d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r9d, ebx
xor ebx, ebx
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, edi
ja 0x1400a6ec2
lea r8d, [rbx + 0x10]
mov edx, 0x284
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rbx + 5]
mov edx, 0x246
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea r8, [0x140001b00]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
lea rax, [0x1400ed3b8]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400a7b50
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea r12d, [rcx + 0xd]
movsx r14, r8b
mov rbp, rdx
add r12d, edx
mov rdi, rcx
mov r15d, r12d
sub r15d, edx
add r15d, 4
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, 0xffff
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea rcx, str.c2a1
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.c2a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x13]
mov edx, 0x267
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, str.c3a0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0xca
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [rsi + rdi*8]
lea edx, [r12 + 0x1d]
imul r8d, r14d, 0x19
add edx, ecx
add r8d, r15d
mov r9, rax
add r8d, edi
lea eax, [rbx*4]
lea ecx, [rdi - 1]
add r8d, r12d
imul ecx, ebp
imul r8d, edx
sub ecx, r8d
sub ecx, eax
lea eax, [r12 + 0xc2]
sub ecx, r14d
sub ecx, esi
add ecx, r9d
add ecx, r15d
add eax, ecx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x1400a7cd0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ebx, ebx
lea r8, [0x140001b00]
lea r9d, [rbx + 1]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9d, [rbx + 1]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.november
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rax, str.c2ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x180
pop rbx
ret
Function at 0x1400a7d90
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r14, r9
mov rbp, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
test eax, eax
jg 0x1400a7ede
xor ecx, ecx
mov edx, 0x2e2
mov qword [rsp + 0x190], rbx
lea r8d, [rcx + 0x19]
mov qword [rsp + 0x198], rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
mov r8d, 0x140
movzx ecx, al
shl cl, 2
lea ebx, [rcx + rax]
lea rcx, [rsp + 0x20]
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.c2ret
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea rdx, str.gender
lea rcx, str.c2ret
movsx r8d, bl
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x36a
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.gender
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x282
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x190]
movzx eax, sil
add al, al
add sil, al
movzx eax, bpl
add sil, sil
shl al, 2
add bpl, al
sub sil, bpl
sub sil, r15b
sub sil, r14b
lea eax, [rsi + 4]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
mov rbp, qword [rsp + 0x1a0]
add rsp, 0x170
pop r15
pop r14
pop rsi
ret
Function at 0x1400a7f30
Capabilities:
Copy file

Disassembly:
sub rsp, 0x178
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.microlending
lea rcx, str.microlending
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, 0x203
mov r8d, 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov edx, 0x389
mov r8d, 0x16
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x17
lea r8d, [rdx + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, str.microlending
lea rcx, str.c0ret
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.cleric
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, 0x100
mov r8d, 8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x178
ret
Function at 0x1400a8080
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x1a
lea r8d, [rdx - 0xd]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.loafer
movzx ebp, al
mov rbx, rax
shl bpl, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.july
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x29c
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
add sil, 6
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx eax, r14b
movzx ebx, sil
add al, al
sub bl, al
sub bl, 0xe
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
movsx eax, sil
movsx ecx, bpl
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], eax
lea rdx, str.clove
lea r8, str.c0a1
mov r9d, edi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
cmp bpl, bl
jl 0x1400a81ed
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rax, r14
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400a9740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ecx, r8d
mov r14d, r8d
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r13, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea eax, [rbp*4]
mov rdx, rbp
xor ecx, ecx
add eax, ebp
mov dword [rsp + 0xa0], eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x30e
mov rbx, rax
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r15, rax
imul bl
movzx ecx, al
shl cl, 2
lea esi, [rcx + rax]
shl sil, 2
movzx r12d, sil
cmp r14d, r12d
jbe 0x1400a98af
xor ecx, ecx
mov edx, 0x225
mov qword [rsp + 0x90], rdi
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x1e8
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov al, 0xfb
imul sil
movzx edi, al
movzx eax, bpl
movzx ecx, bpl
add cl, cl
shl r15b, 2
sub dil, cl
imul bpl
movzx ebx, al
add dil, 7
sub bl, r15b
add dil, r13b
movzx ecx, bl
shl cl, 2
add bl, cl
sub bl, sil
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x16]
mov edx, 0x2b2
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x25f
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, dword [rsp + 0xa0]
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
movsx ecx, dil
mov dword [rsp + 0x30], ecx
lea rdx, [0x1400ed4d4]
lea r8, str.demur
movsx r9d, bl
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rdi, qword [rsp + 0x90]
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x1400a98d0
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
xor eax, eax
lea r8, [0x140001b00]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x40]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r13d, 0xfffffff9
mov r15, rax
sub r13d, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, 0xfffffff6
mov qword [rsp + 0x60], rax
sub dil, r13b
sub dil, al
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx ebx, dil
lea r12d, [rbx + rax]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
imul ebx, r14d
mov rcx, qword [rsp + 0x60]
mov rbp, rax
mov esi, ebx
sub esi, r15d
mov edx, 0x104
sub esi, r13d
imul ecx, r15d
sub ecx, ebx
sub esi, 0x43
sub ecx, eax
sub ecx, r12d
sub ecx, 0x406
imul ecx, eax
lea eax, [r14 + r14*4]
add ecx, eax
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x70]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx rcx, dil
imul r12d, r13d
imul esi, ebp
mov edx, eax
imul ebx, eax
sub r12d, ebx
lea eax, [r15 + r15*4]
add eax, eax
imul edx, dword [rsp + 0x60]
sub edx, ecx
xor ecx, ecx
sub edx, r13d
lea r8d, [rcx + 0x16]
imul r12d, r14d
lea edi, [rdx + 0x4e]
add r12d, esi
mov edx, 0x15c
sub r12d, eax
add edi, r14d
add r12d, 0x13
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsxd rax, r13d
xor ecx, ecx
mov r9d, dword [rsp + 0x60]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ecx
lea r8, str.c3ret
lea rdx, str.c3ret
mov ecx, 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x361
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.fanny_pack
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret