joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400765a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov r12d, dword [rsp + 0x268]
mov r14d, r9d
mov r15, rdx
mov qword [rsp + 0x68], rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, r15d
sub esi, r12d
mov rcx, r15
mov rbx, rax
sub esi, r14d
dec esi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
cmp r14d, esi
jb 0x140076674
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
lea rcx, [0x1400ed8b4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor eax, eax
movsxd rcx, ebp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
lea r8, str.c2a1
lea rdx, str.demur
mov r9d, r12d
mov ecx, r14d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, r15
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x70], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, ebp
mov qword [rsp + 0x98], rax
imul ecx, esi
lea ecx, [rcx + rcx*2]
lea r13d, [r15*4]
lea eax, [rbx - 8]
movzx edi, r15b
mov edx, r13d
imul edx, r14d
sub edx, ecx
add eax, edx
mov dword [rsp + 0x60], eax
movzx eax, bl
imul sil
movzx ecx, al
add cl, cl
add al, cl
add al, al
add al, bpl
add al, al
sub dil, al
sub dil, r14b
add dil, 5
cmp r12d, r14d
jb 0x1400766fd
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov rcx, qword [rsp + 0x68]
movzx edi, dil
mov eax, ebp
lea r8d, [rdi*4]
lea r11d, [r12 + r12]
lea r9d, [rbx + rbx*2]
imul eax, esi
imul eax, eax, 0x78
sub eax, r12d
lea r10d, [rsi*8]
add eax, 0xffffffea
add eax, r8d
add eax, r15d
add eax, r14d
add eax, dword [rsp + 0x60]
add eax, ebx
mov dword [rcx], eax
lea rax, str.c2ret
mov qword [rcx + 8], rax
lea eax, [rbp + 1]
lea ecx, [rax + rax*4]
lea eax, [r14*4]
lea edx, [rax + rcx*2]
mov rcx, qword [rsp + 0x68]
lea rax, [0x1400ed3f4]
mov qword [rcx + 0x18], rax
sub edx, r9d
mov eax, edi
sub edx, dword [rsp + 0x98]
mov qword [rcx + 0x20], r15
imul edi, dword [rsp + 0x78]
imul eax, dword [rsp + 0x70]
imul edi, ebp
add edx, r11d
add edi, edi
add edx, r8d
add edx, r13d
sub r13d, eax
lea eax, [rbx - 0x28]
sub r13d, r11d
sub r11d, edi
add edx, r10d
sub r13d, r14d
add r11d, r9d
mov dword [rcx + 0x10], edx
sub r13d, ebp
add r11d, r15d
sub r13d, esi
add r11d, r14d
add eax, r13d
mov dword [rcx + 0x28], eax
lea eax, [r10 + 0xb]
add eax, r11d
mov dword [rcx + 0x2c], eax
mov rax, rcx
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x240]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400770f0
Capabilities:
Check for time delay via gettickcount
Copy file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbp, rcx
lea r14d, [rcx + 8]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.c1a3
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, ebp
sub edi, r14d
add edi, 0x14
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x4a
lea r8d, [rdx - 0x34]
xor ecx, ecx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
mov qword [rsp + 0x20], rax
test r14d, r14d
jne 0x140077192
lea rdx, str.vietnam
lea rcx, str.c1a3
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rbp*2]
sub ecx, ebx
lea ebx, [rdi - 3]
mov r12d, eax
sub ecx, r15d
sub ecx, r14d
add ecx, r13d
add ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, r12d
sub esi, ebx
cmp edi, ebp
jl 0x140077213
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x148
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea eax, [rdi + 2]
add r12d, 0xd
imul eax, ebp
sub eax, r14d
shl eax, 2
sub eax, dword [rsp + 0x20]
sub eax, r15d
add eax, esi
add eax, r13d
add eax, r12d
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140077270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, qword [rsp + 0x1f0]
movzx esi, dl
mov r14, r9
mov r15d, r8d
mov r13d, ecx
cmp r8d, esi
jae 0x140077301
lea rcx, [0x1400ed3b4]
movzx ebx, dl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400ed3b4]
mov r9d, ebx
mov rcx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x179
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [r14 + 8]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x140077314
shl eax, 2
mov ebp, esi
lea rcx, [rsp + 0x50]
sub ebp, eax
xor edx, edx
mov r8d, 0x140
add ebp, r13d
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp bpl, 2
jb 0x1400773c4
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edx, 0x2b2
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x98
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x15]
mov edx, 0x3a8
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400773c4
imul ebx, dword [r14]
imul esi, r13d
lea eax, [r12 + r12*4]
imul ebx, r15d
add ebx, esi
sub ebx, eax
sub ebx, dword [rsp + 0x20]
sub ebx, ebp
lea eax, [rbx + 7]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400776f0
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
movzx ebx, dl
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12d, ebx
imul ebx, edi
mov r14d, edi
mov esi, r12d
sub r14d, r12d
mov r15d, ebx
mov r13, rax
sub r14d, eax
sub r15d, eax
imul esi, ebp
add esi, edi
sub r14d, ebp
cmp ebp, edi
jb 0x1400777d2
lea rcx, str.caravan
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x1d8
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov eax, ebx
lea r8, [0x140001b00]
imul eax, ebp
sub eax, r14d
xor edx, edx
add eax, r15d
xor ecx, ecx
movsxd r9, eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x117
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
cmp esi, ebp
jle 0x140077804
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0xd2
lea r8d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [r15 + r15*2]
lea eax, [r14 - 0xa]
lea ecx, [rcx*2 + 0x15]
imul ecx, r13d
sub ebx, ecx
sub ebx, edi
sub ebx, ebp
add ebx, esi
add eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140077ea0
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov edi, edx
mov r14d, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, r14d
mov rbx, rax
imul ecx, edi
imul esi, ecx, 0x23
add esi, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0x21a
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [rdi - 7]
lea rcx, [rsp + 0x90]
add eax, r14d
mov edx, 0x104
add ebx, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x170
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx edi, al
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, ebx
jb 0x140077fb3
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.opera
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov eax, esi
lea r8, str.extreme
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea rdx, str.station
mov r9d, ebx
mov ecx, r14d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx edx, byte [rsp + 0x60]
movzx ecx, bl
shl dl, 2
add cl, cl
add bl, cl
add bl, bl
add dl, bl
sub dl, dil
cmp dl, sil
jle 0x140078095
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.station
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x16d
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0x350
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x22
xor ecx, ecx
lea r8d, [rdx - 0x21]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x210]
add rsp, 0x1e0
pop r14
pop rdi
pop rsi
ret
Function at 0x140079580
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
movzx ebx, dl
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea ebp, [rax + rax]
mov r14, rax
cmp bl, bpl
jae 0x1400795c6
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movzx r13d, bl
lea rdx, [0x1400ed4d4]
movsxd r9, ebp
mov r8d, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rdx, [0x1400ed4d4]
lea rcx, [0x1400ed4d4]
mov r8d, ebp
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0x70]
mov edx, 0x104
movsxd r12, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx r15d, bl
or rbx, 0xffffffffffffffff
mov rdx, rax
mov rsi, rbx
nop dword [rax + rax]
inc rsi
cmp byte [rdi + rsi], 0
jne 0x140079620
mov ecx, eax
movsx rax, r12b
imul ecx, edx
sub ecx, eax
lea eax, [r15 - 2]
add ecx, ebp
add eax, ecx
add esi, eax
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140079640
mov ecx, dword [rsp + 0x60]
movsx eax, r12b
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
imul eax, ecx
add eax, edx
lea r8, str.c0a1
mov r9d, ecx
add ebx, eax
movzx eax, sil
imul bl
shl al, 2
sub al, r14b
sub al, dl
lea rdx, str.c3a5
sub al, 0x10
movzx edi, al
movzx eax, al
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8d, [r12 + 0x14]
mov edx, 0x14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], esi
lea r8, str.c0a1
lea rdx, str.medicine
mov r9d, ebp
mov ecx, edi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rax, r14
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140079de0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0xffff
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx edi, ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movzx ecx, dil
shl cl, 2
movzx ebx, bpl
lea edx, [rcx + rdi]
xor ecx, ecx
sub bl, dl
lea r8d, [rcx + 0x12]
mov edx, 0x2e7
sub bl, al
sub bl, 2
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r15, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx ebx, bl
mov r12, rax
cmp edi, ebx
jne 0x140079ecb
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp edi, ebx
jb 0x140079f13
xor ecx, ecx
mov edx, 0x276
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x168
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.c5a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x2e5
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, ebp
imul eax, esi
sub eax, r15d
add eax, 0xfffffffb
add eax, edi
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
cmp bl, dil
jg 0x140079f5e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
shl sil, 2
movzx eax, bpl
sub r12b, 9
imul dil
movzx ecx, al
add cl, cl
add al, cl
sub al, r15b
movzx ecx, al
shl cl, 2
add al, cl
sub al, sil
add al, byte [rsp + 0x38]
add al, r14b
add al, r12b
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140079fc0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x188
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r14, rcx
mov rdi, r8
mov rsi, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
mov rbx, r9
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [rax*2]
mov rbp, rax
add ecx, eax
mov eax, 0x40
add ecx, ecx
sub eax, ecx
cmp eax, 0x40
jae 0x14007a0ef
lea rcx, str.scissors
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, 0x40
lea rdx, str.waitress
mov rcx, rax
mov r8d, r9d
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
or rcx, 0xffffffffffffffff
mov rdx, rcx
inc rdx
cmp byte [rdi + rdx], 0
jne 0x14007a062
movzx eax, sil
imul dl
movzx edx, al
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14007a074
movzx eax, r15b
lea r8, [0x140001b00]
imul cl
add dl, al
mov eax, 8
sub al, bpl
xor ecx, ecx
shl al, 3
add dl, al
xor eax, eax
add dl, r14b
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
movzx r9d, dl
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.c4ret
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0xd]
mov edx, 0xab
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x1c]
mov edx, 0xfb
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x188
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14007a150
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
shl eax, 5
lea r8d, [rcx + 9]
mov ebp, r14d
mov edx, 0x36e
lea esi, [r14 + 0x5c]
sub ebp, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
imul edi, r14d
add edi, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, ebp
xor r15d, r15d
sub ebx, eax
sub ebx, edi
cmp edi, 0x20
ja 0x14007a236
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9d, [r15 + 0x20]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [rbx + 0x81]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx eax, dil
mov ebx, 0x1a
sub bl, r14b
imul bpl
add bl, bl
add bl, al
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 1]
mov edx, 0x175
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.cassock
movsx rbx, bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.dune_buggy
mov r9, rbx
mov rcx, rax
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
lea r8d, [rcx + 8]
mov edx, 0x202
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x102
lea r8d, [rcx + 0xe]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.dune_buggy
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, 0x51
xor ecx, ecx
lea r8d, [rdx - 0x40]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rax, rbx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14007be20
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov esi, edx
mov rdi, r9
lea rcx, str.debtor
mov rbx, rdx
imul esi, r8d
imul edi, r8d
sub esi, r9d
add esi, 6
add edi, 6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x30]
mov r8d, edi
mov rbx, rax
lea rax, [0x1400ed4d4]
mov edx, esi
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.1400db730
cmp esi, edi
jb 0x14007be9a
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rax, rbx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret