joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cb7c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov r15, rcx
xor ecx, ecx
mov rbp, r8
mov rsi, rdx
lea r8d, [rcx + 0xc]
mov edx, 0x168
mov r14, r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
or rbx, 0xffffffffffffffff
mov r12, rax
mov rdi, rbx
nop
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400cb800
imul edi, r14d
add edi, r15d
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rbx
mov r13, rax
mov qword [rsp + 0xe8], rax
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400cb824
mov rdx, rbx
inc rdx
cmp byte [rdx + rbp], 0
jne 0x1400cb830
add ecx, eax
mov eax, r12d
add ecx, edx
imul eax, r14d
add eax, 0xd
add eax, ecx
add eax, r15d
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400cb860
imul eax, r15d
add eax, r13d
lea r13d, [r12 - 3]
lea ecx, [rax + r14*2]
mov eax, dword [rsp + 0xe8]
add r13d, ecx
mov ecx, r15d
imul eax, r12d
imul eax, r15d
lea eax, [rax + rax*4]
lea eax, [rax*2 - 3]
mov dword [rsp + 0xd0], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r9, rax
mov qword [rsp + 0x40], rax
cmp edi, r13d
je 0x1400cb8f6
lea rcx, str.overcharge
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov r8, r14
mov rdx, r14
mov rcx, r14
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r9, qword [rsp + 0x40]
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400cb900
movzx eax, r15b
imul cl
movzx r8d, al
movzx eax, r9b
imul byte [rsp + 0xd0]
movzx ecx, al
movzx eax, r14b
imul cl
movzx ecx, al
shl cl, 2
lea edx, [rcx + rax]
movzx eax, r15b
imul r14b
sub al, dl
add r8b, al
sub r8b, r13b
sub r8b, dil
sub r8b, r12b
sub r8b, 0xb
add r8b, byte [rsp + 0x58]
add r8b, r9b
add r8b, byte [rsp + 0xe8]
nop dword [rax]
cmp byte [rbx + rbp + 1], 0
lea rbx, [rbx + 1]
jne 0x1400cb960
lea eax, [rbx + r8]
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400cc140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x28], r8
mov r13d, edx
mov qword [rsp + 0x40], rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.dresser
mov rdi, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov r15d, eax
mov al, 7
lea r12d, [r13 - 0x25]
imul dil
lea ebp, [rax - 0x10]
imul r12d, r15d
add bpl, r13b
mov r14d, r12d
movsx ecx, bpl
sub r14d, ecx
add r14d, ebx
cmp r15d, ecx
je 0x1400cc219
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 4]
mov edx, 0x391
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x9d
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rax
cmp r15d, 7
ja 0x1400cc23a
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x2ff
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea esi, [r13*2 + 4]
movsx rbx, bpl
sub esi, ebx
mov rdi, rax
add esi, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
lea r11d, [r13 - 0x25]
movzx eax, r11b
sub bpl, 0xe
imul r15b
movzx ecx, al
movzx eax, r9b
imul cl
movzx ecx, al
movzx eax, r10b
imul cl
movzx ecx, al
movzx eax, byte [rdx + 8]
imul r13b
sub al, cl
mov rcx, qword [rsp + 0x20]
sub al, cl
add al, bpl
mov rbp, qword [rsp + 0x40]
movzx r8d, al
mov eax, edi
mov qword [rbp], 0
mov qword [rbp + 8], r9
imul eax, esi
imul eax, ecx
lea ecx, [rax*4 + 1]
mov eax, dword [rdx + 8]
add eax, 4
imul ecx, r10d
lea eax, [rax + rax*2]
lea edx, [rcx + rax*4]
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
sub edx, r8d
sub edx, r12d
sub edx, ebx
sub edx, r9d
add edx, r14d
imul eax, r13d
add edx, r13d
lea eax, [rax + rax*2]
sub eax, dword [rsp + 0x20]
mov dword [rbp + 0x10], edx
lea ecx, [r10 + rax*2]
imul eax, r9d, 0x31
lea edx, [rax + rcx*2]
lea eax, [r15 - 3]
sub edx, ebx
add edx, r8d
add edx, edi
add edx, esi
add edx, r14d
add edx, r11d
add eax, edx
mov dword [rbp + 0x14], eax
mov rax, rbp
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400cc6e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r12, r8
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x68], rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
imul ecx, dword [rsi + 0x38], 7
imul r15d, r14d, 0xfffffffa
mov r13, rax
movzx eax, bpl
sub r15d, ecx
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x140
imul r12b
lea edi, [rax + 7]
add r15d, ebp
call fcn.1400e27d0
lea rdx, [rsp + 0xa0]
lea rcx, str.sunbeam
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
movzx eax, bpl
imul byte [rsi + 0x28]
movzx ecx, al
movzx eax, bl
mov rbx, qword [rsp + 0x68]
imul cl
movzx r14d, al
mov al, 7
imul byte [rsp + 0x60]
sub r14b, al
movzx eax, dil
imul r15b
sub al, r14b
add al, 5
add al, r13b
movzx ebp, al
movsx eax, dil
dec eax
imul eax, r13d
add eax, dword [rsi + 0x30]
sub eax, ebp
lea esi, [rbx + rax]
add esi, 0xc
add esi, r15d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0x70]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, r13d
imul ecx, dword [rsp + 0x60]
lea edx, [rcx + rcx*2]
imul ecx, r12d, 7
shl edx, 4
sub ecx, edx
mov edx, 0x28a
sub ecx, r15d
add ecx, ebp
add ecx, ebx
lea ebx, [rsi - 0x10]
add ebx, ecx
xor ecx, ecx
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
movzx ecx, r14b
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0x10
movzx r9d, r14b
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebp
lea r8, str.minion
lea rdx, str.joseph
mov ecx, esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
movzx eax, bl
imul dil
mov rdi, qword [rsp + 0x60]
movzx ecx, al
mov al, pe_nt_image_headers64
imul sil
movzx ebx, al
sub bl, cl
movzx ecx, r13b
add cl, cl
add r13b, cl
movzx ecx, dil
add cl, cl
add r13b, r13b
add bl, r13b
sub bl, cl
add bl, 2
add bl, byte [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0xc]
mov edx, 0x27b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x329
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, [0x1400ed3f4]
movzx r8d, bl
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov rax, rdi
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x248]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ccce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, rdx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.brace
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9d, esi
shl sil, 2
sub r9d, dword [rbp + 0x28]
lea ecx, [rax - 2]
mov r8, rax
add r8b, r8b
sub r9d, edi
add r8b, bl
mov rbx, qword [rsp + 0x50]
add r9d, 2
lea edx, [r9 + r9*4]
add r8b, r8b
add ecx, edx
mov dword [rsp + 0x28], ecx
mov ecx, 0xc
sub ecx, edx
sub ecx, eax
mov dword [rsp + 0x2c], ecx
mov rax, qword [rsp + 0x28]
shr rax, 0x20
sub al, r8b
sub al, sil
mov rsi, qword [rsp + 0x60]
sub al, byte [rbp]
mov rbp, qword [rsp + 0x58]
sub al, dil
sub al, 3
add al, r9b
add rsp, 0x40
pop rdi
ret
Function at 0x1400cd0e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0xd0
mov rbp, qword [rsp + 0x118]
movsxd r15, r8d
mov esi, r15d
imul eax, ebp, 7
sub esi, eax
sub esi, 5
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsxd r14, dword [rsp + 0x110]
cmp r14d, esi
jge 0x1400cd224
lea rcx, str.c0a1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.c0a0
mov r9, r15
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0x40
imul ecx, esi, 7
mov ebx, eax
lea rax, str.drill
add ecx, 4
mov qword [rsp + 0x40], rax
lea rax, str.lion
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x58], rax
lea rax, [0x1400ee018]
mov dword [rsp + 0x6c], 4
mov qword [rsp + 0x60], rax
lea rax, str.azimuth
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, str.c0ret
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
mov qword [rsp + 0x78], rax
lea rax, str.brace
lea r8, str.brush
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0xa0], xmm1
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
lea rcx, [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0x28], rax
movzx edx, bl
movaps xmmword [rsp + 0xc0], xmm1
mov qword [rsp + 0x20], r9
call fcn.1400dae10
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x3c
xor ecx, ecx
lea r8d, [rdx - 0x22]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
cmp esi, r14d
je 0x1400cd29e
lea rcx, str.sweets
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r8, [0x140001b00]
mov r9, r15
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
imul ebx, r12d
imul ebp, r14d
lea r11, [rsp + 0xd0]
lea eax, [rbp*8]
add eax, ebp
mov rbp, qword [r11 + 0x28]
sub ebx, eax
lea eax, [rsi + rsi*4]
mov rsi, qword [r11 + 0x30]
add eax, eax
sub ebx, eax
lea eax, [r15 + 3]
sub ebx, edi
mov rdi, qword [r11 + 0x38]
add eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400cd6e0
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
movzx ebx, dl
mov esi, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, ebx
lea ebp, [rbx + rsi]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
lea r8, [0x140001b00]
mov r9d, ebx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx eax, bl
imul sil
movzx r14d, al
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, rax
cmp esi, ebx
jle 0x1400cd786
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x296
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx edi, ax
cmp ebx, esi
jae 0x1400cd7c8
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
imul ebx, r15d
movsx ecx, r14b
imul eax, ebx, 0x64
sub ecx, eax
movzx eax, dil
sub ecx, eax
lea eax, [rsi - 0xb]
sub ecx, ebp
add eax, ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400cd810
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbp, qword [rsp + 0x1f8]
movzx r15d, dl
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x30], r9d
mov r12, r8
mov rsi, rcx
mov r14d, r15d
cmp r9d, r15d
jle 0x1400cd900
mov rbx, rdi
nop
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1400cd860
movsx rax, byte [rsp + 0x1f0]
sub ebx, eax
mov rax, rdi
sub ebx, r14d
nop word [rax + rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x1400cd880
mov rcx, rbp
add ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.paleontologist
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsxd r9, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x328
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rdi
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400cd937
sub bl, r15b
inc rdi
cmp byte [rdi + rbp], 0
jne 0x1400cd943
movsxd rsi, dword [rsp + 0x30]
mov rcx, rbp
sub bl, dil
movsx rdi, byte [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400ed7c8]
mov rcx, rax
mov r9, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsx r9, bl
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x145
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, [0x1400ed7c8]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x190
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400cd9e0
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x178
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbp, qword [rsp + 0x1e0]
mov r14, r9
mov r15, r8
mov r12, rdx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rsi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
or rbx, 0xffffffffffffffff
mov rdi, rbx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400cda76
mov eax, dword [r15 + 0x20]
imul eax, dword [r12 + 0x30]
add eax, r14d
add edi, eax
nop
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400cda90
imul ebp, r13d
mov rcx, rsi
sub ebp, dword [r15 + 0x18]
lea eax, [r14 + rbp]
add ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x1ce
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
cmp ebx, edi
jl 0x1400cdb0a
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
lea r8d, [rcx + 2]
mov edx, 0x2fd
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x30a
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x3be
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rax, str.c2ret
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ce200
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
or rbx, 0xffffffffffffffff
mov r13, r9
mov rdi, r8
mov r12d, edx
mov r15, rcx
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [r8 + rax], 0
jne 0x1400ce240
mov esi, dword [rcx + 0x38]
lea rcx, [rsp + 0x70]
xor edx, edx
sub esi, eax
mov r8d, 0x140
add esi, 2
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, 0x7b
xor ecx, ecx
lea r8d, [rdx - 0x6e]
mov rbp, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400ce295
mov r14d, dword [r15 + 0x18]
imul eax, ebp
imul ecx, r13d
shl ecx, 3
sub eax, ecx
xor ecx, ecx
add eax, 0xfffffffc
lea r8d, [rcx + 0xa]
imul edx, esi
add eax, dword [r15 + 0x30]
sub r14d, edx
mov edx, 0x170
add eax, r12d
sub r14d, 8
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400ce2e0
imul ebx, dword [r15 + 0x30]
imul ebp, r14d
sub ebx, ebp
sub ebx, dword [rsp + 0x68]
add ebx, 0xfffffff2
add ebx, r13d
add ebx, esi
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx ebp, ax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r15d, eax
cmp r12d, ebx
je 0x1400ce3cd
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor eax, eax
lea r8, [0x1400ed4fc]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x40], rbp
lea rdx, [0x1400ed4fc]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r14d
mov r9d, esi
mov ecx, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor ecx, ecx
mov edx, 0x261
lea r8d, [rcx + 0x1d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rax, str.alley
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400cf030
Capabilities:
Copy file
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r15, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r14, rax
xor ecx, ecx
mov al, 7
lea r8d, [rcx + 0xe]
mov edi, 0xd
mov edx, 0x379
imul r14b
sub dil, al
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
movsxd rsi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x70]
mov edx, 0x104
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r13, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx ebp, sil
test sil, sil
je 0x1400cf1ce
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
movsx rcx, sil
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x30], 4
lea r9d, [rax + 4]
lea r8, [0x1400ed4d4]
mov rdx, rbx
mov ecx, ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x1a5
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rdx, str.chess
lea rcx, str.chess
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0x217
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x249
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor ecx, ecx
lea r8d, [rcx + 0x14]
mov edx, 0x10e
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, str.c4a5
lea rcx, str.colloquia
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0x390
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LockResource]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400cf1d2
movsx rcx, sil
imul eax, r15d
imul ecx, r13d
imul ecx, r12d
lea r8d, [rcx + rcx*4]
movzx ecx, dil
add r8d, r8d
imul ecx, r14d
imul edx, ecx, 0xe
sub r8d, edx
add r8d, 0xfffffff0
add eax, r8d
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret