joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9af0
Capabilities:
Copy file
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14, r9
mov rdi, r8
mov rbx, rdx
movsxd rbp, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rsi, rax
imul edi, ebx
mov ebx, ebp
sub ebx, edi
sub esi, ebx
add esi, 2
cmp ebx, esi
jae 0x1400a9bcd
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 9]
mov edx, 0x2d3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x51
xor ecx, ecx
lea r8d, [rdx - 0x4b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, [0x1400ed3b8]
lea rcx, [0x1400ed3b8]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.c0a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, r14
movsxd rbx, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rbx
mov r8, rbp
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp ebp, esi
jge 0x1400a9c17
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x280
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a9eb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov ebp, dword [rcx]
mov rdi, r9
mov r14, rdx
sub ebp, r8d
mov rbx, rcx
add ebp, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8, rax
movzx eax, byte [rdi + 4]
imul byte [rbx + 0x20]
mov ebx, dword [rbx + 0x38]
sub ebx, dword [rdi]
movsx rsi, al
lea edi, [r8 + r8*8]
imul ecx, esi, 7
add ecx, ebx
add edi, ecx
add edi, ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp edi, esi
jl 0x1400a9fbb
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
lea r8, str.piracy
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ebp
lea rdx, str.faucet
mov r9d, edi
mov ecx, ebp
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, str.faucet
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400ed8b4]
mov r9d, ebx
mov rcx, rax
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor ecx, ecx
mov edx, 0x197
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp edi, esi
jle case.default.0x1400a9fe4
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
jmp qword [sym.imp.USER32.dll_GetForegroundWindow]
pop rdi
Function at 0x1400aa0f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, rcx
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dil, al
jl 0x1400aa1ac
mov ecx, 0xffff
mov qword [rsp + 0x2d8], rbx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov edx, 0xf8
mov r8d, 0xb
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, str.bank
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.bank
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, qword [rsp + 0x2d8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.observatory
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx eax, dil
cmp esi, eax
jl 0x1400aa207
mov edx, 0x144
mov r8d, 7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor edx, edx
movzx ecx, bpl
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
movsx rax, dil
lea r9d, [rdx + 2]
lea r8, str.c0a5
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
lea rdx, [0x1400ee018]
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x3d9
mov r8d, 0x19
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x1a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2c0]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400aad50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r12d, r12d
mov dword [rsp + 0x3c], 0x20
mov dword [rsp + 0x38], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r14, qword [rsp + 0x38]
shr r14, 0x20
lea r8, [0x140001b00]
xor edx, edx
add r14d, 5
xor ecx, ecx
mov qword [rsp + 0x28], r12
add r14d, eax
mov dword [rsp + 0x20], r12d
movzx eax, r14b
movsxd r9, r14d
shl al, 2
lea esi, [rax + r14]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x40]
mov edx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x150]
mov edx, 0x104
mov r15, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movsx ecx, sil
mov rbp, rax
imul ecx, ebx
sub ecx, r15d
lea ebx, [rdi + 4]
add ebx, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov edi, ebx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.brian
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp r14d, ebx
je 0x1400aae95
lea rdx, str.lake
movsxd r9, eax
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea r8, [0x140001b00]
xor edx, edx
imul ebp, r15d
imul ebp, r14d
lea r9d, [rbp + 0x24]
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400ac150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
mov rbx, rax
add edi, esi
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov edx, eax
movzx eax, bl
imul sil
movzx ecx, al
movzx eax, dil
imul cl
movzx ebx, al
sub bl, dl
movsx ecx, bl
cmp edi, ecx
jge 0x1400ac1a4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp bl, dil
jle 0x1400ac1fe
mov edx, 0x308
mov r8d, 0xd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0xa4
mov r8d, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x109
mov r8d, 0xb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
lea rax, str.ottoman
add rsp, 0x20
pop rdi
ret
Function at 0x1400ac4a0
Capabilities:
Check for time delay via gettickcount
Copy file
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbp, qword [rsp + 0x1b8]
mov rdi, r9
mov rsi, r8
movzx eax, bpl
shl al, 2
lea ebx, [rax + rbp]
add bl, r9b
add bl, cl
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [rdi + rdi]
sub esi, ecx
add esi, eax
movzx eax, bl
cmp esi, eax
jge 0x1400ac5be
xor ecx, ecx
mov edx, 0x2f7
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r8d, r8d
mov edx, 0x1f3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [0x1400ed3b4]
lea rcx, str.brace
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x2bd
lea r8d, [rcx + 0x1d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.c1a3
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x146
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp al, 4
je 0x1400ac5ef
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ac6d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
movzx edi, byte [rsp + 0x1f0]
mov rsi, r9
movzx ebp, r8b
mov ebx, edx
mov r15, rcx
cmp r8b, dil
jge 0x1400ac718
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x74d1
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movsx r13d, dil
mov r12d, ebx
sub r12d, r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsx rdx, dil
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x20], eax
movsx eax, bpl
mov qword [rsp + 0x38], rdx
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400ac780
add eax, edx
add eax, ebx
sub eax, ecx
mov dword [rsp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movsx ecx, bpl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movsx eax, bpl
lea rcx, [rsp + 0x40]
imul eax, ebx
xor edx, edx
mov r8d, 0x140
mov dword [rsp + 0x2c], eax
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, r14d
imul edx, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
sub edx, r12d
add eax, 3
add eax, edx
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov ecx, r13d
mov word [rsp + 0x20], ax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rax, str.legal
mov qword [r15 + 8], rax
mov qword [r15], 0
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400ac813
movzx ecx, byte [rsp + 0x20]
movsx rax, bpl
imul r14d, r12d
inc ecx
imul edi, eax
lea eax, [r14 + r14*2]
mov edx, 0xb2
imul ecx, dword [rsp + 0x30]
sub ecx, edi
sub ecx, eax
mov eax, dword [rsp + 0x24]
sub ecx, dword [rsp + 0x38]
add eax, 0xfffffffb
sub ecx, dword [rsp + 0x2c]
add ecx, ebx
add ecx, dword [rsp + 0x28]
add eax, ecx
xor ecx, ecx
lea r8d, [rcx + 0xb]
mov dword [r15 + 0x10], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [r15 + 0x18], rax
mov rax, r15
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ac8a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
movzx ebp, byte [rsp + 0x208]
mov r13, qword [rsp + 0x200]
mov r14, r9
mov rbx, r8
mov esi, ecx
cmp bpl, cl
je 0x1400ac8fe
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx edi, byte [r13 + 0x18]
movzx eax, r14b
imul byte [rbx]
sub dil, al
add dil, 6
add dil, sil
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
cmp dil, bpl
jge 0x1400ac94b
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.cirrus
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov r15, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x34
xor ecx, ecx
lea r8d, [rdx - 0x32]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp bpl, sil
jle 0x1400aca08
movzx eax, bl
sub r15b, r14b
movsx edx, dil
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], edx
movzx ebx, sil
imul r12b
movzx ecx, al
xor r9d, r9d
mov r8, r14
shl cl, 2
mov rdx, r14
add al, cl
mov rcx, r14
add al, al
sub bl, al
mov rax, qword [rsp + 0x40]
sub bl, byte [r13 + 8]
sub r15b, al
sub bl, al
add r15b, 0xa
add r15b, r12b
sub bl, 2
movsx eax, r15b
add bl, bpl
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
movsx r9, bl
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400acd40
Capabilities:
Copy file
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbp, r8
mov r14, rdx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x2b5
mov r13, rax
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [r14 + rax], 0
jne 0x1400acde1
mov ecx, r12d
sub ecx, eax
mov rax, rbx
inc rax
cmp byte [rax + rbp], 0
jne 0x1400acdf3
sub ecx, eax
mov rax, rbx
inc rax
cmp byte [rsi + rax], 0
jne 0x1400ace01
lea r15d, [rcx + 6]
mov rcx, rbx
add r15d, eax
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400ace14
mov rax, rbx
inc rax
cmp byte [rsi + rax], 0
jne 0x1400ace21
imul ecx, eax
lea eax, [r13*2]
sub ecx, eax
sub ecx, edi
mov rdi, rbx
nop dword [rax]
inc rdi
cmp byte [rdi + rbp], 0
jne 0x1400ace40
lea eax, [r12 + rcx]
mov edx, 0x1a
xor ecx, ecx
lea r8d, [rdx - 9]
add edi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400ace60
imul r13d, dword [rsp + 0x20]
mov ecx, edi
shl r13d, 2
sub r15d, r13d
sub r15d, edi
sub r15d, 5
add ebx, r15d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0xcf
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.dresser
lea rcx, str.believe
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp ebx, edi
jge 0x1400acf1b
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x235
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rax, rsi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400acf50
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ebx, r8d
mov r14, r8
mov rdi, rdx
mov r13, rcx
imul ebx, ecx
mov dword [rsp + 0x38], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea esi, [rdi + r13]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], esi
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.jellyfish
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r15d, [r13 + 0xe]
lea r8, [0x140001b00]
mov dword [rsp + 0x3c], eax
xor eax, eax
add r15d, r14d
mov qword [rsp + 0x28], rax
movsxd r9, esi
xor edx, edx
xor ecx, ecx
add r15d, r12d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov dword [rsp + 0x30], eax
cmp al, byte [rsp + 0x34]
jb 0x1400ad047
xor eax, eax
lea r8, [0x140001b00]
movsxd r9, r15d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.chard
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, edi
mov ecx, r14d
imul eax, dword [rsp + 0x60]
imul ecx, ebp
add ecx, eax
lea eax, [r12 + r12]
sub ecx, eax
lea eax, [r13 + 0xb]
add eax, ecx
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, byte [rsp + 0x30]
movzx ebp, byte [rsp + 0x3c]
imul eax, r12d
add eax, eax
sub eax, ebp
add esi, 0xfffffff7
sub eax, r15d
add eax, ebx
add esi, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp byte [rsp + 0x60], 4
jge 0x1400ad0fc
xor ecx, ecx
mov edx, 0x211
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x80]
lea rcx, str.jellyfish
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, dword [rsp + 0x38]
imul esi, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x30]
imul edi, r13d
lea eax, [r14 + rsi*2]
add eax, dword [rsp + 0x48]
imul eax, r12d
sub edi, eax
movzx eax, cl
sub edi, ebp
sub edi, r14d
sub edi, eax
sub edi, dword [rsp + 0x40]
add edi, dword [rsp + 0x34]
lea eax, [r15 + rdi]
add eax, 0xffffffdd
add eax, ebx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x228]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret