joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ad160
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r15, qword [rsp + 0x218]
movzx esi, r9b
mov r14d, r8d
movzx ebp, dl
cmp r9b, dl
jg 0x1400ad1d0
xor ecx, ecx
mov edx, 0x1c1
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.mambo
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
movsx rcx, sil
movzx r10d, bpl
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r10d
lea eax, [r10*4]
sub eax, dword [r15]
lea edi, [rcx - 5]
mov ebx, 4
add edi, eax
lea r8, str.c0a0
lea rdx, str.mambo
movsx rax, dil
movsx r9d, dil
sub ebx, eax
sub ebx, ecx
movsx ecx, sil
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ecx
sub ebx, edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
movzx edx, byte [r15 + 8]
movzx eax, sil
movzx ecx, dl
lea r8, [0x140001b00]
shl cl, 2
mov r9d, ebx
mov qword [rsp + 0x28], r12
imul r14b
add dl, cl
movzx ecx, bl
mov dword [rsp + 0x20], r12d
lea esi, [rdx + rax]
shl cl, 2
xor edx, edx
sub sil, cl
xor ecx, ecx
sub sil, dil
add sil, 0x13
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp bpl, dil
jb 0x1400ad312
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor r8d, r8d
mov edx, 0x118
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [r12 + 0x10]
mov edx, 0x206
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
movsx r9, sil
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor eax, eax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ad340
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov edi, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r14d, r14d
lea esi, [rdi + rax]
mov rbp, rax
cmp esi, edi
je 0x1400ad4a5
lea r8, [0x140001b00]
movsxd r9, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, edi
jge 0x1400ad4a5
mov qword [rsp + 0x1c0], rbx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 4
mov rdx, rax
sub cl, bpl
movzx eax, sil
imul cl
lea ecx, [rdi + 0x21]
add cl, cl
lea ebx, [rcx + rax]
sub bl, bpl
add bl, dl
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [r14 + 0x20]
sub edi, ebp
sub edi, 6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.root
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8d, [r14 + 0x20]
lea rdx, [0x1400ed4d4]
lea rcx, str.root
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8d, [r14 + 3]
mov edx, 0x3dd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [r14 + 0x1d]
mov edx, 0x3d5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], 8
movzx eax, bl
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea r8, str.pimple
lea rdx, str.cultivar
mov r9d, edi
mov ecx, esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, qword [rsp + 0x1c0]
lea rax, str.tooth
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400ad5b0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
movsxd rsi, ecx
test ecx, ecx
js 0x1400ad62e
xor eax, eax
lea r8, [0x140001b00]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, str.angle
movzx ebp, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
movsx rbx, sil
lea r14d, [rax + rbx*4]
mov r15, rax
add r14d, ebp
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r13, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, 0xb
mov edx, 0x1bb
xor ecx, ecx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8d, [rdi + 0xc]
mov edx, 0xbf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8d, [rdi + 0x12]
mov edx, 0x283
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea edx, [rdi + 0x59]
lea r8d, [rdi + 2]
xor ecx, ecx
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rdi - 9]
mov edx, 0x20b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [rbx + rbp]
lea ebx, [rsi - 2]
add ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movsxd r12, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea eax, [rbx + 9]
movsx rcx, r12b
add eax, ecx
mov dword [rsp + 0x30], eax
cmp esi, ebx
je 0x1400ad753
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.c1a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea r8d, [rdi + 0xf]
mov edx, 0x37f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
sub dil, byte [rsp + 0x38]
add dil, dil
add dil, r13b
add dil, dil
sub dil, byte [rsp + 0x30]
sub dil, r14b
sub dil, r15b
add al, dil
add al, bpl
add al, byte [rsp + 0x40]
add al, r12b
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400ad7b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r12d, r9d
mov rdi, r8
mov rsi, rdx
mov r13, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx r14d, sil
lea rcx, [rsp + 0x30]
mov ebp, 4
shl r14b, 2
mov edx, 0x104
sub bpl, r14b
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
movzx ecx, bpl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, str.c0a2
movzx ebx, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400ed3f4]
mov r9d, ebx
mov rcx, rax
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
sub sil, 0x18
mov r15d, eax
add sil, al
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
or rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400ad870
movzx eax, r12b
imul cl
xor ecx, ecx
movzx ebx, al
movzx eax, bpl
imul r14b
sub bl, al
sub bl, sil
sub bl, 0x1f
add bl, r15b
add bl, r13b
shl bl, 2
add bl, dl
mov edx, 3
lea r8d, [rdx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp bl, sil
jbe 0x1400ad8ee
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0xe9
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, str.c3a2
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400adc70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, r9
mov rsi, r8
movsxd rbx, edx
mov r15, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
lea r8, [0x140001b00]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ecx, bpl
mov rdx, rax
shl cl, 2
add r14b, r14b
add bpl, cl
movzx eax, dil
shl bpl, 2
imul bl
movzx ecx, al
movzx eax, sil
imul cl
movzx ecx, al
shl al, 2
add cl, al
mov al, 7
imul dl
add al, cl
add al, r14b
add al, bpl
sub bpl, 0x2f
shl al, 2
add al, byte [r15 + 0x10]
add al, bpl
add al, dl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1400addf0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x188
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
add eax, eax
cmp eax, 4
jle 0x1400ade9f
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x112
mov r8d, 0x18
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x337
mov r8d, 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov edx, 0x57
xor ecx, ecx
lea r8d, [rdx - 0x52]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 4]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.c1a2
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rax, [0x1400ed4d4]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x188
ret
Function at 0x1400af400
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xffff
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r13, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r15d, eax
imul ebx, r14d
lea ecx, [rbx + rbx*4]
sub edi, ecx
sub edi, 0xb
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp r15d, r14d
jbe 0x1400af4fd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.c2a3
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx ebx, bpl
shl bl, 3
sub bl, sil
add bl, 7
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx ecx, bl
imul edi, r15d
imul ecx, eax
shl ecx, 2
lea eax, [r14 - 0xa]
sub ecx, edi
sub ecx, ebp
sub ecx, esi
add ecx, r12d
add ecx, r13d
add eax, ecx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400af560
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsx ebx, byte [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, ebx
je 0x1400af601
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xa]
mov edx, 0x2b0
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsx r9, bl
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rdx, str.ottoman
lea rcx, str.ottoman
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, str.course
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x1400af630
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x188
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r14, qword [rsp + 0x1f0]
mov r12d, ecx
mov ecx, 0xffff
mov r13d, r9d
mov rbp, r8
mov rsi, rdx
mov qword [rsp + 0x48], r14
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [0x140001b00]
mov ebx, eax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 2]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, ebx
mov r15, rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rbx, 0xffffffffffffffff
mov rdi, rbx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400af6d4
xor ecx, ecx
imul edi, r12d
mov edx, 0x188
lea r8d, [rcx + 3]
add edi, r15d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2c1
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx r9d, byte [rsp + 0x1f8]
mov r8, qword [rsp + 0x38]
mov r15, rax
movzx eax, r13b
mov ecx, r15d
mov edx, 0xfffffff7
imul byte [r14]
sub al, r9b
mov r14d, 1
sub r14d, dword [rsp + 0x40]
sub al, 6
imul ecx, r8d
add r14d, r14d
add al, r12b
sub edx, ecx
movzx eax, al
sub edx, eax
mov dword [rsp + 0x34], eax
lea eax, [rax + rax*8]
mov dword [rsp + 0x30], edx
sub r14d, eax
sub r14d, r9d
sub r14d, r13d
sub r14d, r8d
sub r14d, edx
sub r14d, dword [rsp + 0x50]
sub r14d, dword [rsp + 0x200]
add r14d, r12d
add r14d, edi
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov rdx, rbx
movzx r8d, ax
nop dword [rax]
inc rdx
cmp byte [rsi + rdx], 0
jne 0x1400af790
lea eax, [rdi*4]
sub r15d, eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x1c]
lea ecx, [rax + r15*2]
lea eax, [r14 + r14*4]
add ecx, eax
movsx rax, byte [rsp + 0x1f8]
sub ecx, eax
sub ecx, dword [rsp + 0x34]
sub ecx, r13d
sub ecx, r8d
sub ecx, dword [rsp + 0x30]
add ecx, r12d
add ecx, dword [rsp + 0x38]
sub ecx, edx
inc rbx
cmp byte [rbx + rbp], 0
jne 0x1400af7d7
sub ecx, ebx
lea eax, [rcx + 0xb]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x188
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b1310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x210
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rdi, rcx
xor ecx, ecx
mov rbp, r8
lea r8d, [rcx + 5]
mov edx, 0x164
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0x140
mov rbx, rax
call fcn.1400e27d0
lea rdx, [rsp + 0xc0]
lea rcx, str.sell
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdx, rdi
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
lea r8d, [rcx + 0xb]
mov edx, 0x321
mov r15, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea edx, [rbp*4]
mov ecx, edi
add edx, ebp
shl edx, 2
sub ecx, edx
mov edx, 0x104
mov dword [rsp + 0xa0], ecx
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x388
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r14d, [rdi*8]
imul ecx, r12d, 7
add ecx, r15d
xor edx, edx
mov r8d, 0x140
lea ecx, [rcx + rcx*4]
mov r13d, eax
sub r14d, ecx
lea rcx, [rsp + 0xc0]
call fcn.1400e27d0
lea rdx, [rsp + 0xc0]
lea rcx, str.c0a2
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [rbx + rbx]
xor ecx, ecx
sub eax, ebp
lea r8d, [rcx + 1]
mov edx, 0x329
add eax, edi
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 0xffff
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov ecx, r15d
lea eax, [rdi + rdi*4]
shl eax, 2
imul ecx, r13d
sub eax, ecx
lea esi, [rbx + rax*4]
mov eax, dword [rsp + 0x50]
add eax, eax
sub esi, eax
add esi, r14d
add esi, ebp
cmp r14b, 2
jb 0x1400b14c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xc0]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x327
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
shl bl, 3
mov al, 7
sub bpl, 0xf
imul r12b
sub bl, al
sub bl, r13b
sub bl, byte [rsp + 0x38]
sub bl, sil
sub bl, r14b
add bl, byte [rsp + 0xa0]
lea eax, [rdi + rbx]
add al, r15b
add al, bpl
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400b1520
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x200
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov esi, r8d
lea ebp, [r8 + 4]
mov edi, 4
mov dword [rsp + 0x30], ebp
lea r14, str.mirror
lea rcx, [rsp + 0x78]
imul esi, edx
sub edi, esi
lea rdx, str.minion
mov r8b, 1
mov r9d, edi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
call fcn.1400dc940
mov rcx, r14
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x50], xmm1
movsd xmm1, qword [rax + 0x30]
movups xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.c4a2
mov r9d, edi
mov rcx, rax
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edx, 0xeb
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x81
xor ecx, ecx
lea r8d, [rdx - 0x78]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
cmp ebp, 1
ja 0x1400b168b
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor r8d, r8d
mov edx, 0x2da
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x3b5
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rsp + 0x50]
lea eax, [rdi + rdi*2]
shl ecx, 4
sub ecx, eax
sub ecx, r14d
lea eax, [rcx*2 + 4]
sub eax, ebx
add eax, esi
add eax, ebp
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret