joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cf240
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x23d
lea r8d, [rcx + 0xb]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movzx ecx, byte [rsp + 0x38]
movzx edx, byte [rsp + 0x38]
add cl, cl
movsxd r8, eax
add dl, cl
add dl, dl
add dl, 2
cmp dl, r8b
je 0x1400cf386
mov qword [rsp + 0x1b0], rbx
lea rcx, str.spite
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400cf2d3
movsx rcx, r8b
imul ebx, ecx, 0xb4
sub ebx, ebp
add ebx, 0x20
add ebx, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx eax, bpl
imul byte [rsp + 0x38]
movzx ecx, al
movzx eax, sil
imul cl
movzx ecx, al
add cl, cl
add al, cl
shl al, 2
add al, 0x3a
movzx ecx, al
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x98
xor ecx, ecx
lea r8d, [rdx - 0x7b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.rambler
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, qword [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x1a
xor ecx, ecx
lea r8d, [rdx - 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x200
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0xa]
mov edx, 0x30d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x111
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
mov rbp, qword [rsp + 0x1b8]
add rsp, 0x1a0
pop rsi
ret
Function at 0x1400cf420
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r15d, r15d
movzx ebx, al
mov r14, rax
neg bl
cmp bl, al
jle 0x1400cf4cd
lea r8d, [r15 + 0x11]
mov edx, 0x1a7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.jellyfish
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea r8, [0x140001b00]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx ebp, ax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, str.c1a2
movsx rdi, bl
mov rsi, rax
movzx ebx, r14b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.tugboat
mov r9, rdi
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x30], ebp
lea r8, str.jellyfish
lea rdx, str.tugboat
mov r9d, 4
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ebp
mov ebx, eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
imul ecx, ebp, 7
sub ecx, r14d
lea r9d, [rsi + 1]
movzx r8d, r14b
sub ecx, 4
add eax, 0xfffffff0
lea edx, [rcx + rcx*4]
lea ecx, [rdi + rdi*8]
imul r9d, r8d
imul r9d, r14d
sub r9d, edx
add r9d, ecx
lea ecx, [r9 + rbx*4]
sub ecx, esi
sub ecx, ebp
add eax, ecx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400cf6c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov edi, dword [r8 + 0x20]
movsxd rbx, edx
mov qword [rsp + 0x38], r8
mov r13, rcx
imul edi, ecx
imul edi, ebx
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12d, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
movsxd r9, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.c0a2
mov r9d, r12d
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor ecx, ecx
mov edx, 0x2b2
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.flare
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x40]
mov edx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [r14*4]
sub edx, esi
lea rcx, [rsp + 0x40]
mov r8d, 0x140
add edx, ebx
lea ebx, [rdi - 4]
mov rbp, rax
add edx, eax
add ebx, edx
xor edx, edx
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.c0a2
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rax, qword [rsp + 0x38]
lea edx, [r15 + r15]
mov eax, dword [rax + 0x28]
sub edx, esi
imul eax, r13d
imul eax, dword [rsp + 0x30]
add eax, 0xfffffff8
lea edx, [rax + rdx*4]
sub edx, ebp
sub edx, ebx
sub edx, r12d
add edx, r14d
cmp edx, dword [rsp + 0x30]
jge 0x1400cf847
xor ecx, ecx
mov edx, 0x2b3
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.agreement
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400cf880
Capabilities:
Copy file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r15, qword [rsp + 0x268]
mov r12d, dword [rsp + 0x260]
mov rbp, rdx
mov r13, rcx
movzx eax, r15b
mov edx, r15d
mov qword [rsp + 0x70], r9
mov dword [rsp + 0x64], r8d
imul r12b
imul edx, r15d
movzx ecx, al
movzx eax, r15b
mov dword [rsp + 0x68], edx
imul cl
movzx ebx, al
movzx eax, byte [rbp + 8]
imul r13b
add bl, al
sub bl, dl
sub bl, r8b
add bl, r9b
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx r14d, bl
mov ecx, r14d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx ecx, r15b
add cl, cl
mov rdi, rax
movzx eax, byte [rbp + 8]
imul r13b
add al, cl
mov ecx, dword [rsp + 0x70]
sub al, r12b
mov byte [rsp + 0x60], al
imul ecx, r13d
imul ecx, dword [rsp + 0x64]
imul ecx, r12d
imul ecx, dword [rbp + 8]
sub ecx, r14d
sub ecx, esi
sub ecx, 7
mov dword [rsp + 0x6c], ecx
imul cl
lea rcx, [rsp + 0x78]
lea ebx, [rax + 4]
add bl, sil
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
lea r8d, [rcx + 0x13]
mov edx, 0xb0
call qword [sym.imp.KERNEL32.dll_FindResourceA]
imul r14d, edi
mov edi, dword [rsp + 0x68]
imul r14d, esi
lea eax, [r14 + r14*8]
lea esi, [r15 + r15]
sub esi, eax
movsx rax, bl
sub esi, eax
sub esi, dword [rsp + 0x70]
add esi, 5
add esi, r13d
add esi, r12d
cmp esi, dword [rsp + 0x64]
jbe 0x1400cfa4b
movsx ecx, byte [rsp + 0x60]
movsxd rbx, dword [rsp + 0x6c]
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
lea r8, str.interview
lea rdx, str.mambo
mov r9d, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rdx, str.c1a2
lea rcx, str.c1a2
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xa0]
lea rcx, str.mambo
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xd]
mov edx, 0x213
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x25a
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.c2a0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.mambo
mov r9d, esi
mov rcx, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.help
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d0cb0
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r8, [0x140001b00]
xor edx, edx
mov r12, rax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x40]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov edi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
xor ecx, ecx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
lea ebp, [r15 + 0x65]
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov esi, r15d
lea r8d, [rcx + 0x17]
sub esi, ebx
mov edx, 0x393
mov r14, rax
add esi, 0x27
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, eax
mov rbx, rax
imul ecx, esi
lea edx, [rcx + rcx*2]
mov ecx, r14d
imul ecx, ebp
imul ecx, ecx, 0xb
lea eax, [rcx + rdx*2]
mov dword [rsp + 0x30], eax
cmp dil, 0x20
je 0x1400d0e3f
xor ecx, ecx
mov edx, 0xb4
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 1]
mov edx, 0x101
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2cd
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.streetcar
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsxd r9, r14d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x1bb
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, ebp
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
shl dil, 5
movzx eax, bl
mov ecx, 0xe
imul sil
sub cl, al
movzx eax, cl
add al, al
add cl, al
mov al, 0xb
add cl, cl
sub cl, dil
imul bpl
add al, cl
sub al, r13b
sub al, r15b
add al, byte [rsp + 0x30]
add al, r14b
add al, r12b
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400d0eb0
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r14, rdx
movzx ebp, cl
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, ebp
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movzx ebx, bpl
sub bl, dil
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x20
dec al
add bl, bl
lea r8d, [rdx - 0x12]
sub r14b, bl
xor ecx, ecx
add r14b, bpl
add r14b, bpl
add r14b, al
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.c4a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rdx, [0x1400ed4fc]
lea rcx, str.c0a3
movsx r8d, r14b
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.c11a3
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400d1a50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ebx, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov rsi, rax
xor eax, eax
mov r9d, ebx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
sub esi, edi
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
add ebx, esi
je 0x1400d1ae2
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.cytoplasm
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400d2250
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ebx, ecx
mov r15, rdx
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov rsi, r9
mov edi, r8d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor r14d, r14d
mov rbp, rax
cmp ebx, edi
jb 0x1400d22c2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx eax, sil
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
imul bl
movzx r12d, al
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov r13, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8, [0x140001b00]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r14d, [rbx + rdi]
add r14d, ebp
cmp edi, ebx
jb 0x1400d235a
xor ecx, ecx
mov edx, 0x2db
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x16]
mov edx, 0x193
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, dword [rsp + 0x1b0]
movsx rcx, r12b
imul ecx, r13d
shl ecx, 3
imul eax, dword [rsp + 0x1b8]
imul eax, ebp
sub eax, ecx
sub eax, edi
sub eax, esi
add eax, ebx
add eax, r15d
add eax, r14d
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400d23b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ebx, edi
mov edx, 0x271
mov r8d, 0x17
xor ecx, ecx
imul ebx, edi
sub ebx, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp edi, ebx
jg case.default.0x1400d246a
xor ecx, ecx
mov eax, ebx
lea r8, str.tugboat
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 7
lea rdx, str.c0ret
mov r9d, ebx
mov ecx, 1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [0x1400ed7c8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x374
mov r8d, 0x11
xor ecx, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
jmp qword [sym.imp.KERNEL32.dll_FindResourceA]
Function at 0x1400d2730
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14d, 0xffffffcc
sub r14d, eax
mov r15, rax
cmp r14d, 0x10
ja 0x1400d2851
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, r15d
sub esi, eax
lea rcx, [rsp + 0x30]
mov edx, 0x104
add esi, 0xb
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x3c0
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, str.tourist
lea rcx, str.rambler
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ebp, ebp
lea r9d, [rbp + 4]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r8, [0x140001b00]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx eax, bl
imul r14b
movzx ecx, al
movzx eax, bl
imul cl
movzx ecx, al
movzx eax, dil
imul sil
movzx edx, al
mov al, 7
shl dl, 2
sub dl, cl
imul r15b
sub dl, 0x10
add dl, al
movzx ecx, dl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [r14 + r14*4]
imul ebp, r15d, 7
xor r8d, r8d
mov edx, 0x14f
xor ecx, ecx
add ebp, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x38d
lea r8d, [rcx + 0x10]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea edi, [rbx + 6]
mov rsi, rax
mov ecx, eax
sub ecx, r14d
add edi, ecx
imul esi, ebx
add esi, 7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
mov edx, 0x1b0
mov ebx, eax
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx eax, sil
sub bpl, 0x11
imul dil
movzx ecx, al
movzx eax, bl
imul cl
movzx ecx, al
mov al, 7
imul r15b
add al, cl
sub al, r14b
add al, bpl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400d2910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x34b
mov r8d, 0xf
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x1b4
mov r8d, 0x12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x170
pop rbx
ret

Function at 0x1400d2b10
Capabilities:
Copy file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r14, qword [rsp + 0x1c0]
movsx edi, r9b
mov rbp, r8
mov ebx, edx
mov rsi, rcx
cmp edx, edi
jbe 0x1400d2b9a
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov edx, 0x36a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp ebx, edi
jne 0x1400d2bca
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0x171
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
cmp ebx, edi
jb 0x1400d2c0a
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.element
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x170
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret