joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d2c30
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r14, r9
mov r15d, r8d
mov rbx, rdx
mov rbp, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rdi, 0xffffffffffffffff
mov r12, rax
mov rsi, rdi
inc rsi
cmp byte [rsi + rbp], 0
jne 0x1400d2c70
imul esi, ebx
mov rbx, qword [rsp + 0x1d0]
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x1400d2c87
imul eax, r15d
add esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rax, rdi
inc rax
cmp byte [r14 + rax], 0
jne 0x1400d2cc5
mov rcx, rdi
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400d2cd2
imul eax, ecx
nop
inc rdi
cmp byte [rdi + rbp], 0
jne 0x1400d2ce0
add eax, r12d
add eax, edi
lea ebx, [rax + rsi*2]
add ebx, r15d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x63
xor ecx, ecx
lea r8d, [rdx - 0x5e]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test bl, bl
jg 0x1400d2de4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x19f
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.c2a1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, 0x8a
xor ecx, ecx
lea r8d, [rdx - 0x77]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.azimuth
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x2be
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x171
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x170
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d32a0
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
movzx r14d, r8b
mov r12, rcx
mov rbx, rdx
mov ebp, r14d
mov edx, 0x104
mov r15d, r14d
imul ebp, ecx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r13, rax
mov al, 0xfb
imul r14b
movzx esi, al
sub sil, byte [rbx + 0x20]
add sil, r12b
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp sil, r14b
je 0x1400d337f
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.cleric
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov al, 0xb
lea r8, [0x140001b00]
imul r13b
lea edx, [rax + rbp]
movzx eax, bl
movzx ecx, dl
shl cl, 2
add dl, cl
xor ecx, ecx
imul dil
add dl, al
mov al, 7
imul sil
add dl, al
sub dl, r14b
xor r14d, r14d
add dl, 4
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
add dl, r12b
movzx r9d, dl
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1400d3382
xor r14d, r14d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
movsx ebx, al
movsxd rax, ebp
movsx edi, sil
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], r15d
lea r8, str.cormorant
lea rdx, str.dimple
mov r9d, ebx
mov ecx, ebp
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov r8, r13
mov rdx, r13
mov rcx, r13
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
movsx rax, sil
lea r8, str.dimple
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], r15d
lea rdx, str.cleric
mov r9d, edi
mov ecx, ebp
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d4340
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rdi, r9
xor r12d, r12d
mov rsi, rdx
mov r9d, ecx
mov ebp, ecx
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
or rbx, 0xffffffffffffffff
mov r15, rax
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1400d43c3
lea eax, [rbp - 2]
xor ecx, ecx
mov edx, 0x395
add eax, edi
lea r8d, [rcx + 3]
add ebx, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 2
sub cl, bl
add cl, cl
sub cl, r14b
add al, cl
add al, r15b
movzx r14d, al
cmp ebp, r14d
je 0x1400d4406
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x1b4
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 6
lea r8d, [rdx + 0xe]
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x6d
xor ecx, ecx
lea r8d, [rdx - 0x5c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2cd
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
mov edx, 0x39a
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
movsx ecx, dil
mov eax, ebx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], ecx
lea rdx, str.mint
mov ecx, ebx
mov r9d, ebp
mov r8, rsi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x185
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.desk
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d4530
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
or r9, 0xffffffffffffffff
mov r11, rax
mov r10, r9
nop dword [rax + rax]
inc r10
cmp byte [rbx + r10], 0
jne 0x1400d4560
movzx eax, dil
imul r10b
movzx ecx, al
movzx eax, sil
imul cl
movzx ecx, al
nop dword [rax]
inc r9
cmp byte [rbx + r9], 0
jne 0x1400d4580
sub r9b, dil
movzx eax, cl
mov edx, 0xfffffffe
imul r9b
sub dl, al
sub dl, r11b
cmp cl, dl
jle 0x1400d45fe
movsx ecx, dl
movsx rax, dl
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
lea r8, str.cytoplasm
mov r9d, r11d
mov rdx, rbx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
mov edx, 0x1b6
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
xor eax, eax
add rsp, 0x60
pop rdi
ret
Function at 0x1400d4f30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
movsxd rdi, dword [rcx + 4]
movzx ebx, byte [rcx + 0x20]
xor esi, esi
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov r9, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [rsi + 0x17]
mov edx, 0x37a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r9d, [rsi + 1]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [rsi + 0x14]
mov edx, 0x2ad
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], 2
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], ebx
lea r8, str.c0a2
lea rdx, [0x1400ed878]
lea ecx, [rsi + 1]
mov r9d, edi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
xor eax, eax
add rsp, 0x60
pop rdi
ret
Function at 0x1400d50b0
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
or rdi, 0xffffffffffffffff
mov rsi, rcx
mov rbx, rdi
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1400d50e5
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
movzx eax, bl
imul r12b
movzx ecx, al
shl cl, 3
lea r14d, [rcx + rax]
mov rcx, rdi
add r14b, r14b
movsx rbp, r14b
nop word [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400d5150
movzx eax, bl
mov edx, 0x19
lea r8d, [rdx + 1]
imul ecx, eax
lea r15d, [rcx + rcx*8]
xor ecx, ecx
sub r15d, ebp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.authority
lea rcx, str.authority
movsx r8d, r14b
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r14d, r14d
lea r8, [0x140001b00]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp bl, r15b
jne 0x1400d5218
inc rdi
cmp byte [rsi + rdi], r14b
jne 0x1400d51c7
imul ebp, r15d
lea rcx, str.c0a3
lea eax, [rbp*8]
add eax, ebp
add eax, eax
sub r12d, eax
add r12d, 4
add edi, r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.authority
mov r9d, edi
mov r8d, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
movzx r9d, bl
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, str.c6ret
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400d5840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r13d, ecx
mov rsi, r8
mov r14d, edx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
mov rbp, r9
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
mov rdi, rbx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400d58a3
imul edi, r14d
mov ecx, r14d
sub edi, dword [rsp + 0x1f8]
add edi, r13d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx eax, ax
mov dword [rsp + 0x30], eax
cmp edi, r14d
je 0x1400d590c
xor eax, eax
lea r8, [0x140001b00]
mov r9, r14
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov eax, dword [rsp + 0x30]
mov rcx, rbx
nop
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400d5910
imul r15d, dword [rsp + 0x38]
movzx edx, byte [rsp + 0x1f0]
imul ecx, r14d
imul r15d, eax
lea eax, [rdi + rdi*2]
add ecx, r15d
lea eax, [rcx + rax*2]
sub eax, dword [rsp + 0x40]
sub eax, dword [rsp + 0x1f8]
add eax, r13d
add edx, eax
nop dword [rax + rax]
inc rbx
cmp byte [rbx + rbp], 0
jne 0x1400d5950
sub edx, ebx
lea eax, [rdx + 5]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x1400d5990
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov ebp, edx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp ebp, 0xa
je 0x1400d59eb
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x13e
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov esi, 2
sub esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r14d, r14d
cmp ebp, esi
jne 0x1400d5a5b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movsxd rbx, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
movsx r9, bl
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], esi
mov r9d, 0xa
mov dword [rsp + 0x30], 0xa
lea r8, str.c4a0
lea rdx, str.major_league
movzx edi, dil
mov ecx, r9d
mov dword [rsp + 0x28], 0xa
mov rbx, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
imul eax, ebx
sub esi, eax
add esi, 5
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, 0x4c
lea r8d, [rdx - 0x35]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
cmp ebp, edi
jae 0x1400d5b1e
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.bafflement
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x30], ebp
lea r8, str.c7a1
lea rdx, str.major_league
mov r9d, 0xa
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400d6b00
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, qword [rsp + 0x1d0]
mov r12, qword [rsp + 0x1e0]
mov rsi, rcx
xor ecx, ecx
movsx ebx, dl
mov edx, 0x1a8
lea r8d, [rcx + 1]
mov qword [rsp + 0x40], r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x330
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx eax, bl
lea rdx, str.vein
imul sil
lea rcx, str.pool
mov r8d, ebx
movzx r14d, al
mov ebp, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15d, ebx
mov ebx, dword [rdi + 8]
imul r15d, esi
imul ebx, r12d
add ebx, r15d
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r13d, r14d
sub r14d, ebx
add r14d, r12d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x48], rax
cmp r14d, r13d
jge 0x1400d6bf7
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rdx, [0x1400ed4fc]
lea rcx, [0x1400ed4fc]
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0x1a5
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x13]
mov edx, 0x1d3
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [0x1400ed4fc]
movsxd rbx, r14d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400ed4b8]
mov r9, rbx
mov rcx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea ebx, [r15 + 3]
lea r8, [0x140001b00]
imul esi, edi
mov ebp, eax
mov rax, qword [rsp + 0x48]
movzx r9d, r13b
xor edx, edx
imul eax, dword [rsp + 0x38]
lea ecx, [rax*2 + 1]
mov rax, qword [rsp + 0x40]
imul ecx, r12d
sub ecx, esi
sub ecx, dword [rax + 0x18]
xor eax, eax
add ecx, r13d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
add ebx, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp ebx, ebp
jne 0x1400d6ca2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.painting
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d6e20
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
movzx ebx, dl
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0xc
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0xff
mov r8d, 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp bl, al
jne 0x1400d6ee7
mov edx, 0x1a9
mov r8d, 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x249
mov r8d, 8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0xa4
mov r8d, 9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x140
pop rbx
ret