joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140099780
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov esi, r9d
mov rbx, rdx
movzx edi, cl
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx eax, dil
imul bl
movzx edx, al
mov al, 7
imul dl
movzx ebp, al
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp bl, 0x40
je 0x1400997d3
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx ecx, bpl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ebp, ebp
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, str.midwife
lea rcx, str.midwife
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], 0x40
movzx ecx, dil
mov dword [rsp + 0x38], ecx
movzx edx, al
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
lea r8, [0x1400edd8c]
lea rdx, str.c0a0
mov r9d, esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [rbp + 2]
mov edx, 0x34b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rbp + 0x14]
mov edx, 0x2b7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
lea rax, str.mustard
add rsp, 0x60
pop rdi
ret
Function at 0x140099ea0
Capabilities:
Copy file
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov r14, rcx
lea rcx, [rsp + 0x1a0]
mov edx, 0x104
mov ebx, r9d
mov rbp, r8
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x332
mov r8d, 7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x136
mov r8d, 0x15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp ebx, 0x40
je 0x140099f44
mov edx, 0x29b
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x197
mov r8d, 0x11
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x1a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, [0x1400ee40c]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp ebx, 0x40
jg 0x14009a088
mov ecx, 0xffff
mov qword [rsp + 0x2e8], rdi
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov edx, 0x171
mov r8d, 0xe
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movzx ecx, dil
imul ebx, esi
mov edi, 0x10
lea r8, str.cross_stitch
imul ebx, ecx
sub edi, ebx
mov r9d, esi
mov rdx, r14
sub edi, eax
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ecx
mov ecx, esi
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.c7a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r8d, edi
mov rdx, r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, 0x28a
mov r8d, 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x25f
mov r8d, 0x1a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, qword [rsp + 0x2e8]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2c0
pop r14
pop rsi
pop rbp
ret
Function at 0x14009af80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp eax, 4
jne 0x14009b058
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, eax
lea r8, str.c2a0
lea rdx, str.tooth
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0x10
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
lea ecx, [rdi + 0xc]
mov r9d, edi
mov dword [rsp + 0x28], 5
mov dword [rsp + 0x20], 0x87
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [rdi - 2]
mov edx, 0x23e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rdi + 8]
mov edx, 0x124
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea r8d, [rdi - 1]
mov edx, 0x218
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rdi - 1]
mov edx, 0x3b9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov ebx, eax
cmp edi, 5
je 0x14009b08d
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [rdi + rbx]
mov rbx, qword [rsp + 0x70]
add sil, 0x17
add al, bpl
mov rbp, qword [rsp + 0x78]
add al, sil
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14009b0c0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbp, r8
mov edi, ecx
mov edx, 0x35b
mov r8d, 3
xor ecx, ecx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x207
mov r8d, 0x18
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword [rsp + 0x190]
mov ebx, esi
sub ebx, edi
mov rdx, rbp
xor ecx, ecx
sub ebx, eax
shl ebx, 9
imul edi, esi
add ebx, edi
sub ebx, eax
sub ebx, 0x1006
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp bl, 0x14
jne 0x14009b1db
mov edx, 0x330
mov r8d, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rdx, str.howitzer
lea rcx, str.knot
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x40]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x178]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009bf20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
movzx eax, dl
mov edi, ecx
xor ebp, ebp
sub edi, eax
mov esi, ecx
lea r8, [0x140001b00]
movsxd rbx, edi
xor edx, edx
xor ecx, ecx
mov r9, rbx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], edi
lea r8, str.retina
lea rdx, str.dirndl
mov r9d, edi
mov ecx, esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
lea rax, str.c3a2
add rsp, 0x60
pop rdi
ret
Function at 0x14009c700
Capabilities:
Copy file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x198
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
movzx eax, byte [rsp + 0x210]
movzx r12d, byte [rsp + 0x208]
or rbp, 0xffffffffffffffff
mov byte [rsp + 0x60], al
mov rax, qword [rcx + 8]
mov r15d, r9d
mov dword [rsp + 0x64], r8d
mov r14, rdx
mov r13, rcx
mov rbx, rbp
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009c754
movzx eax, r15b
imul byte [rsp + 0x200]
sub bl, al
mov rax, rbp
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x14009c770
sub bl, al
lea rcx, [0x1400ed3f4]
movsx rdi, r12b
movzx esi, bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400ed3f4]
mov r9, rdi
mov r8d, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
movzx esi, byte [rsp + 0x60]
lea edi, [rax - 5]
cmp sil, r15b
jne 0x14009c873
inc rbp
cmp byte [r14 + rbp], 0
jne 0x14009c7b6
imul ebp, dword [r13 + 0x10]
imul eax, eax, 0xe
movzx r8d, bl
mov rdx, r14
mov rcx, r14
sub ebp, eax
sub ebp, dword [rsp + 0x64]
add ebp, edi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov ecx, r15d
movsx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
lea r8d, [rcx + 0xb]
mov edx, 0x9b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
movzx r8d, sil
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r8
mov dword [rsp + 0x38], edi
movsx r10d, r12b
mov dword [rsp + 0x30], r10d
lea r8, str.blinker
lea rdx, [0x1400ed3f4]
movsx ecx, bl
mov r9d, r15d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.cleaner
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x198
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009c8b0
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rsi, rcx
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov rdx, qword [rsi + 0x28]
or rbx, 0xffffffffffffffff
mov edi, eax
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14009c8e6
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
lea r8d, [rcx + 0x1c]
mov edx, 0x3e2
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, dword [rsi + 0x18]
lea ecx, [rdi*8]
sub ebp, ecx
mov r15, rax
add ebp, 2
cmp ebp, 1
jne 0x14009c92f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, bl
cmp edi, ecx
jne 0x14009c970
sub ecx, r12d
add ecx, 0xfffffff8
add ecx, dword [rsi + 0x18]
add ecx, r15d
add ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edx, 0x20a
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp bl, r14b
ja 0x14009c9b1
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 2]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
movzx ecx, byte [rsi + 0x20]
mov rsi, qword [rsp + 0x60]
movzx eax, r14b
imul r12b
add al, dil
mov rdi, qword [rsp + 0x68]
add al, al
sub cl, al
sub cl, bpl
mov rbp, qword [rsp + 0x58]
sub cl, r15b
sub cl, bl
mov rbx, qword [rsp + 0x50]
lea eax, [rcx - 0x13]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x14009c9f0
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov dword [rsp + 0x30], ecx
movsxd rbp, edx
mov esi, ecx
mov dword [rsp + 0x28], ecx
mov r14, rcx
lea rax, str.pressroom
mov r8d, ecx
sub esi, ebp
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r9d, esi
mov qword [rsp + 0x20], rax
call fcn.1400dbba0
xor ecx, ecx
movups xmm1, xmmword [rax + 0x10]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
movsd xmm0, qword [rax + 0x40]
movsd qword [rsp + 0x90], xmm0
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movups xmm1, xmmword [rsp + 0x40]
lea ecx, [rsi + rsi*8]
mov r13, rax
movzx eax, r14b
movzx edx, sil
shl dl, 3
lea r15d, [r14 + r14]
movdqa xmm0, xmm1
psrldq xmm1, 8
sub r15d, ecx
psrldq xmm0, 8
lea r12d, [rdx + rsi]
movd ecx, xmm0
sub r15d, ecx
sub r15d, ebp
movd ecx, xmm1
imul cl
lea ecx, [rax + 1]
movzx eax, r14b
imul cl
add r12d, eax
add r12b, bpl
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
mov r9d, r14d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp r12b, 5
jbe 0x14009cb69
lea rcx, str.lion
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.pressroom
mov r9d, esi
mov rcx, rax
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor ecx, ecx
mov edx, 0x35a
lea r8d, [rcx + 0xe]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, str.mary
lea rcx, str.c2ret
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x120]
mov edx, dword [rsp + 0x60]
lea eax, [r14 + 1]
imul ecx, eax, 0xfffffffa
movsx rax, r12b
imul edx, r15d
add edx, 0x18
imul edx, r13d
sub ecx, edx
add ecx, esi
add eax, ecx
add eax, ebp
mov rbp, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14009cbb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov r11, rsp
sub rsp, 0x1d8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
mov r15, qword [rsp + 0x208]
mov dword [rsp + 0x34], r9d
mov ebx, r8d
mov dword [rsp + 0x30], edx
mov r14, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x80]
mov edx, 0x104
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ebp, byte [r15 + 4]
add bpl, r14b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ecx, bpl
mov r13, rax
cmp ebx, ecx
je 0x14009cce1
mov qword [rsp + 0x1c8], rsi
mov qword [rsp + 0x1c0], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [r15 + 0x18]
mov rbx, rax
add esi, r14d
add esi, eax
add esi, r13d
add esi, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov edi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [rsp + 0x34]
lea r8d, [rax - 0x19]
mov eax, dword [r15 + 8]
shl ecx, 5
lea edx, [rsi + 1]
mov r9, r14
imul eax, dword [rsp + 0x34]
shl eax, 5
dec eax
imul edx, ebx
sub edx, ecx
imul eax, r14d
imul ecx, r12d, 7
add edx, ecx
sub eax, edi
lea rcx, [rsp + 0x38]
sub edx, dword [rsp + 0x30]
sub eax, r12d
sub edx, r13d
sub eax, esi
add edx, dword [r15]
add edx, r14d
add r8d, edx
lea edx, [r13 - 6]
add edx, eax
lea rax, str.brian
mov qword [rsp + 0x20], rax
call fcn.1400db730
mov rdi, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1c8]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, qword [rsp + 0x1a0]
mov r14, qword [rsp + 0x1a8]
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1b8]
mov rbx, qword [rsp + 0x1f0]
cmp bpl, 0x20
mov rbp, qword [rsp + 0x1d0]
je 0x14009cd35
lea rcx, str.sunbeam
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x36c
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1d8
ret
Function at 0x14009cd60
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
movzx esi, cl
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
movsxd r15, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, esi
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx edi, r15b
mov r13, rax
xor edx, edx
xor ecx, ecx
imul sil
sub dil, al
add dil, 3
call qword [sym.imp.KERNEL32.dll_LoadResource]
movzx edx, dil
mov r12, rax
movsx eax, r15b
lea r14d, [r13*2]
add r14d, r13d
mov dword [rsp + 0x30], edx
imul eax, esi
mov dword [rsp + 0x38], eax
mov ecx, r14d
imul eax, esi
imul ecx, esi
sub eax, ecx
mov ecx, edx
mov dword [rsp + 0xf0], eax
imul ecx, r13d
imul ecx, eax
lea eax, [rsi - 5]
imul ecx, esi
add eax, ecx
mov ecx, esi
mov dword [rsp + 0xe8], eax
lea eax, [rdx*4]
sub ecx, eax
lea eax, [rsi - 1]
add eax, ecx
mov dword [rsp + 0xf8], eax
movzx eax, r12b
imul sil
movzx ebp, al
shl bpl, 2
add bpl, 3
add bpl, r13b
add bpl, sil
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, dword [rsp + 0xe8]
mov rbx, rax
lea edx, [r8 + r8*2]
movsx rcx, bpl
lea ecx, [rcx + rdx*2]
mov edx, 0x279
sub ecx, eax
movzx eax, r12b
mov dword [rsp + 0x34], ecx
imul r8b
sub cl, al
movzx eax, dil
mov edi, esi
imul sil
sub cl, al
add sil, 4
add cl, sil
mov byte [rsp + 0xe0], cl
xor ecx, ecx
lea r8d, [rcx + 0x1d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x1d]
mov edx, 0x2aa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, dword [rsp + 0xf0]
mov qword [rsp + 0x40], rax
mov r9d, esi
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsx rcx, r15b
mov r15, qword [rsp + 0x50]
shl ecx, 5
mov qword [rsp + 0x48], rax
movsx edx, bpl
imul edx, ebx
movzx ebx, byte [rsp + 0xe0]
sub edx, ecx
sub edx, esi
add edx, r14d
mov r14d, dword [rsp + 0xe8]
add edx, edi
lea ecx, [r14 - 6]
add ecx, edx
mov dword [rsp + 0xe8], ecx
imul cl
movzx ecx, al
mov al, 0xfc
imul byte [rsp + 0x40]
movzx esi, al
sub sil, cl
add sil, 6
add sil, r15b
add sil, bl
cmp bpl, bl
jle 0x14009cf51
xor ecx, ecx
mov edx, 0x219
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rax, qword [rsp + 0x48]
imul r13d, edi
add eax, eax
sub r12d, eax
movzx eax, sil
lea ecx, [r12 + r12*2]
imul eax, dword [rsp + 0xe8]
add ecx, eax
mov eax, dword [rsp + 0xf8]
sub ecx, r13d
imul eax, r14d
add ecx, eax
movsx rax, bl
add ecx, eax
mov rax, qword [rsp + 0x40]
sub ecx, dword [rsp + 0x34]
inc eax
sub ecx, dword [rsp + 0xf0]
add ecx, dword [rsp + 0x30]
add ecx, dword [rsp + 0x38]
add ecx, r15d
add ecx, dword [rsp + 0x78]
add eax, ecx
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009cfc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r14d, [r12 + 0xa]
add r14b, al
mov rdi, rax
movsx r13d, r14b
mov ebx, r13d
imul ebx, r12d
imul ebx, eax
imul ebx, esi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
mov dword [rsp + 0x70], eax
lea eax, [r12*2 + 2]
sub eax, r13d
add eax, ebx
mov dword [rsp + 0x74], eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, r12d
imul eax, ebx, 7
imul ecx, edi
mov ebp, r12d
lea r15d, [r12 - 0x28]
mov edx, 0x20b
sub ebp, eax
sub ebp, ecx
sub ecx, esi
add r15d, ecx
xor ecx, ecx
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [r12 - 4]
movsx rdi, r14b
lea esi, [rcx + rcx*2]
mov rbx, rax
shl esi, 3
sub esi, edi
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x1b0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rcx, qword [rsp + 0x70]
lea r8, str.star
imul ebx, esi
shr rcx, 0x20
lea eax, [rbx + 0xc]
lea rdx, str.mustard
mov r9d, esi
imul ecx, r15d
imul ecx, ebp
add eax, ecx
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x20
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
mov ecx, r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, str.star
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str.mustard
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret