joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b16d0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
sub bl, r8b
mov byte [rsp + 0xd8], bl
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r13, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, ebp
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, r12d
mov edi, eax
movzx ebx, bl
mov rsi, rax
imul ecx, r13d
imul edi, r15d
sub edi, ecx
mov ecx, ebp
add edi, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx r9d, byte [rsp + 0xd8]
mov qword [rsp + 0x30], rax
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [rsp + 0xc0]
mov rbp, rax
movzx eax, dil
imul byte [r14 + 8]
movzx r14d, dl
movzx ecx, al
movzx eax, r13b
imul cl
sub r14b, al
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rax + 8]
mov eax, edx
sub ebx, ecx
sub ebx, esi
sub ebx, r13d
sub ebx, edi
add ebx, r15d
imul ecx, esi
imul ecx, edi
add ebx, edx
sub eax, ecx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov r9, qword [rsp + 0x30]
movzx eax, r9b
imul dil
movzx ecx, al
movzx eax, sil
imul cl
movzx edx, al
movzx eax, r12b
imul r15b
movzx ecx, al
movzx eax, r13b
imul cl
movzx ecx, bl
movzx r8d, al
movzx eax, r14b
sub r8b, dl
imul bpl
sub r8b, al
movzx eax, bl
add al, al
add cl, al
shl cl, 2
sub r8b, cl
sub r8b, byte [rsp + 0x68]
sub r8b, bpl
sub r8b, byte [rsp + 0xd0]
mov rax, qword [rsp + 0xc8]
add r14b, 0xc
add r8b, byte [rax]
lea eax, [r9 + r8]
add al, r14b
add al, byte [rsp + 0xc0]
add al, byte [rsp + 0xd8]
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b1930
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, qword [rsp + 0x1d0]
mov esi, ecx
lea ebx, [r9 + rcx]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsx r9, bl
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp bl, 8
jl 0x1400b1a15
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.bafflement
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x258
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
movsx eax, bl
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, rdi
mov dword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b1a40
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, r8
movzx ebx, dl
mov r12, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
xor r9d, r9d
mov rbp, rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test bl, bl
jne 0x1400b1abb
xor ecx, ecx
mov edx, 0x19f
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x8c
xor ecx, ecx
lea r8d, [rdx - 0x76]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx edi, bl
xor r9d, r9d
lea rdx, str.observatory
mov r13d, edi
mov r15d, edi
lea r8, [r9 - 4]
sub r13d, esi
sub r15d, r14d
xor ecx, ecx
add r13d, 0xffffffe9
add r15d, 0xfffffff5
add r13d, ebp
add r15d, esi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov ebx, eax
test r15d, r15d
jg 0x1400b1b0b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
imul ecx, ebp, 0xb
mov edx, edi
lea eax, [rdi + 0xc]
sub edx, ecx
mov ecx, r15d
movzx ebx, bl
sub edx, r13d
sub edx, esi
sub edx, r14d
imul ecx, r13d
add edx, r15d
add eax, edx
mov edx, 0x12
mov dword [r12], eax
lea rax, str.c3ret
lea r8d, [rdx - 4]
mov qword [r12 + 8], rax
lea eax, [rdi*4 + 0xc]
sub ecx, eax
imul eax, esi, 0xb
add ecx, eax
sub ecx, r14d
add ecx, ebx
add ecx, edi
add ecx, ebp
mov dword [r12 + 0x10], ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [r12 + 0x20], rbp
mov qword [r12 + 0x18], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 9]
mov edx, 0x21e
mov qword [r12 + 0x28], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x78]
mov edx, 0xd
mov qword [r12 + 0x30], rax
mov eax, edi
lea r8d, [rdx + 6]
imul eax, r14d
add eax, dword [rcx + 0xc]
xor ecx, ecx
sub eax, r13d
sub eax, esi
sub eax, ebp
add eax, 7
add eax, edi
mov dword [r12 + 0x38], eax
lea eax, [r15*8]
sub ebx, eax
lea eax, [rdi + 0x13]
sub ebx, esi
sub ebx, ebp
sub ebx, r14d
add eax, ebx
mov dword [r12 + 0x3c], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov qword [r12 + 0x40], rax
mov rax, r12
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400b26c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov esi, dword [rsp + 0x208]
mov rax, qword [rsp + 0x210]
mov r13, qword [rsp + 0x200]
xor ebx, ebx
mov r12, r9
mov r14, r8
mov edi, ecx
mov qword [rsp + 0x38], rax
cmp ecx, esi
jbe 0x1400b2736
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx eax, sil
mov ebx, edi
imul dil
mov byte [rsp + 0x30], al
mov eax, r13d
imul eax, esi
sub ebx, eax
sub ebx, dword [r12 + 8]
sub ebx, r14d
add ebx, 4
cmp esi, 0x10
jg 0x1400b2761
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx eax, r14b
mov ebp, edi
imul sil
lea r15d, [rdi + rax]
mov eax, ebx
shl eax, 4
sub ebp, eax
sub ebp, 4
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x40], rax
cmp ebp, ebx
jb 0x1400b280a
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movsx rax, r15b
mov r9d, edi
sub r9d, eax
xor eax, eax
lea r8, [0x140001b00]
sub r9d, dword [r12 + 8]
mov qword [rsp + 0x28], rax
xor edx, edx
sub r9d, r14d
xor ecx, ecx
mov dword [rsp + 0x20], eax
sub r9d, dword [rsp + 0x38]
sub r9d, r13d
sub r9d, ebx
sub r9d, 0x14
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.igloo
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
sub dil, 9
movzx eax, r13b
shl dil, 2
imul sil
movzx ecx, al
movzx eax, r15b
imul bpl
movzx edx, al
movzx eax, r14b
sub dl, cl
imul byte [r12]
add al, dl
add al, dil
sub al, bl
sub al, byte [rsp + 0x38]
sub al, byte [rsp + 0x30]
add al, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b2870
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r15d, cl
mov rsi, r9
mov rbp, r8
mov ecx, r15d
mov rdi, rdx
mov r13d, r15d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x28], rax
mov r10, rbx
inc r10
cmp byte [rdi + r10], 0
jne 0x1400b28b3
imul r10d, dword [rbp + 0xc]
xor ecx, ecx
lea ebp, [rsi + 4]
lea r8d, [rcx + 0x18]
mov edx, 0x223
add r10d, r13d
add ebp, r10d
mov dword [rsp + 0x70], ebp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx r12d, bpl
sub r12b, al
lea rcx, str.hall
mov r14, rax
add r12b, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
movzx ebp, sil
sub bpl, r12b
mov qword [rsp + 0x20], rax
add bpl, 2
add bpl, r15b
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rsi, rax
cmp bpl, r15b
jle 0x1400b2958
xor r8d, r8d
mov edx, 0x359
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, str.wetsuit
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x2b7
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov r10d, eax
nop
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400b2990
mov r9, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r11, qword [rsp + 0x20]
movzx ecx, byte [r9 + 8]
movzx eax, r11b
add cl, cl
imul sil
sub al, cl
imul esi, r14d
sub al, r8b
add al, r15b
sub al, dl
sub al, 5
movzx ecx, al
mov eax, dword [r9 + 0x1c]
shl ecx, 2
imul eax, r8d
add eax, eax
sub esi, eax
dec esi
imul esi, dword [rsp + 0x28]
sub esi, ecx
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400b29e7
imul ebx, r13d
movzx eax, r12b
imul eax, r14d
add esi, ebx
mov rbx, qword [rsp + 0x78]
imul eax, dword [rsp + 0x70]
add esi, eax
movsx rax, bpl
add esi, eax
lea eax, [r8 - 3]
sub esi, r11d
add esi, r10d
add eax, esi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b2a30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov edi, dword [rsp + 0x1c0]
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rbp, rcx
test dil, dil
jle 0x1400b2a93
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, [0x1400ed3b4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rax, qword [rsp + 0x1b0]
or rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400b2aa0
movzx eax, byte [rbx + 8]
sub dil, 2
imul cl
movzx ebx, al
movzx eax, byte [rsp + 0x1b8]
imul byte [rbp + 8]
sub bl, al
add bl, byte [rbp + 0x10]
add bl, r14b
add bl, dil
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
lea r8d, [rcx + 1]
mov edx, 0x12c
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movsx ecx, bl
mov rbp, rax
cmp edi, ecx
ja 0x1400b2afe
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x390
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
cmp bl, dil
je 0x1400b2b2a
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rax, rbp
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b3380
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edi, edi
lea r8, [0x140001b00]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov rbx, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8d, [rdi + 0x16]
mov edx, 0x268
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rdi + 7]
mov edx, 0x31b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test ebx, ebx
jne 0x1400b3445
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea edx, [rdi + 0x40]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x60
lea r8d, [rdx - 0x57]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x298
mov r8d, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, str.c1a0
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rdi
ret
Function at 0x1400b34e0
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov r15, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r14, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [0x140001b00]
movsx ebx, al
xor eax, eax
mov r9d, r15d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, 4
mov rsi, rax
sub edi, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, esi
lea r11d, [rsi + 0xd]
lea ecx, [rax + rax*2]
mov r10, rax
mov r9d, eax
add ecx, ecx
sub r9d, ebp
add r11b, bpl
sub edx, ecx
add r9d, 0xa
movsx rax, r11b
add edx, r14d
lea ecx, [rbx*4 - 1]
lea r8d, [r15 + 9]
add r8d, edx
add r11b, 0xb
imul ecx, esi
add ecx, eax
lea eax, [r15 - 0x62]
sub ecx, r14d
add ecx, ebp
add ecx, r10d
add ecx, r9d
shl r9b, 2
add eax, ecx
add r9b, dil
movzx ecx, r8b
shl cl, 2
lea edx, [rcx + r8]
mov ecx, 5
shl dl, 2
sub cl, dl
imul cl
movzx ecx, al
movzx eax, r9b
add al, al
add r9b, al
movzx eax, bpl
shl al, 3
add r9b, sil
add al, bpl
add r9b, r9b
sub cl, r9b
add al, cl
sub al, r10b
sub al, r14b
add al, r15b
add al, r8b
add al, r11b
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400b3640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
mov ebx, eax
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.runaway
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp bl, 8
jl 0x1400b36c5
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x301
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, str.fahrenheit
movzx edx, al
mov ebx, ebp
imul edx, esi
sub ebx, edx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
movsxd rdi, eax
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.fahrenheit
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x1ec
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x38a
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, str.c5a0
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.1400dc300
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x3cc
lea r8d, [rcx + 1]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x194
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea edx, [rbp*4 + 1]
movsx rcx, dil
lea eax, [rbx + 0xa]
imul edx, esi
sub edx, ecx
sub edx, r14d
add eax, edx
cmp eax, 2
jbe 0x1400b37b7
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, [0x1400edfe8]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400b3b50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
movzx ebx, cl
mov rbp, r9
mov r14d, r8d
sub bl, byte [rsp + 0x2b8]
mov edi, ecx
cmp ecx, 2
jne 0x1400b3b97
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.vein
movzx r8d, bl
mov r9d, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea eax, [rdi + rbp]
lea ebx, [r14 + 0xc]
lea rcx, str.question
add ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.question
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x13]
mov edx, 0x267
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, str.aftershave
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov eax, edi
lea rcx, [rsp + 0x160]
sub eax, ebp
mov edx, 0x104
add eax, 0xfffffff4
add ebx, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov eax, 0xf
sub eax, dword [rsp + 0x2b8]
lea edx, [rdi + rax*4]
add edx, ebx
cmp edx, edi
ja 0x1400b3c88
lea rcx, str.question
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rax, str.c5a5
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400b4600
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
movzx r14d, cl
xor r15d, r15d
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov r9d, r14d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx eax, dil
mov ebp, r14d
lea r8, [0x140001b00]
sub ebp, esi
sub sil, 5
xor edx, edx
imul bl
shl al, 2
xor ecx, ecx
mov qword [rsp + 0x28], r15
add al, r14b
mov dword [rsp + 0x20], r15d
add al, sil
movsx r9, al
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1400b4700
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
or rax, 0xffffffffffffffff
mov rbx, rax
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400b4726
nop
inc rax
cmp byte [r9 + rax], 0
jne 0x1400b4730
imul ebx, eax
imul ebx, ecx
add ebx, 8
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 9]
mov edx, 0x140
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edi, edi
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r8d, [rdi + 9]
mov edx, 0x38f
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [rdi + 8]
mov edx, 0x162
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret