joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005460]
mov dword [rax], 1
mov rax, qword [0x140005470]
mov dword [rax], 1
mov rax, qword [0x140005480]
mov dword [rax], 1
mov rax, qword [0x1400053e0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001a00
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x1400026d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x14000276a
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x14000274e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002742
cmp qword [rbp - 0x10], 0
je 0x140002742
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002708
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000276b
nop
add rsp, 0x30
pop rbp
ret
Function at 0x100f34890
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100f3489d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100f348ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x100f34895
lea eax, [rcx + 1]
jmp 0x100f348bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100f348ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x100f348b4
sub eax, 3
jb 0x100f348ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x100f3493d
sar eax, 1
movsxd rbp, eax
jb 0x100f34924
jmp 0x100f348fc
add ebx, ebx
jne 0x100f348fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100f34924
inc ecx
add ebx, ebx
jne 0x100f3490a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100f34924
call r11
adc ecx, ecx
add ebx, ebx
jne 0x100f3491d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x100f3490c
add ecx, 2
jmp 0x100f34929
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.100f34852
jmp 0x100f3489d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xf30000]
mov eax, dword [rdi]
or eax, eax
je 0x100f34999
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xf4207c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x100f34949
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x100f34993
mov qword [rbx], rax
add rbx, 8
jmp 0x100f34969
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.100f34a1c], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.100f34a1c
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x100f34a0c
sub rsp, 0xffffffffffffff80
jmp 0x100003330
Function at 0x100ecc7e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100ecc7ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100ecc7fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x100ecc7e5
lea eax, [rcx + 1]
jmp 0x100ecc80b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100ecc81e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x100ecc804
sub eax, 3
jb 0x100ecc83e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x100ecc88d
sar eax, 1
movsxd rbp, eax
jb 0x100ecc874
jmp 0x100ecc84c
add ebx, ebx
jne 0x100ecc84a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100ecc874
inc ecx
add ebx, ebx
jne 0x100ecc85a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100ecc874
call r11
adc ecx, ecx
add ebx, ebx
jne 0x100ecc86d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x100ecc85c
add ecx, 2
jmp 0x100ecc879
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.100ecc7a2
jmp 0x100ecc7ed
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xec8000]
mov eax, dword [rdi]
or eax, eax
je 0x100ecc8e9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xef1080]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x100ecc899
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x100ecc8e3
mov qword [rbx], rax
add rbx, 8
jmp 0x100ecc8b9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.100ecc96c], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.100ecc96c
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x100ecc95c
sub rsp, 0xffffffffffffff80
jmp 0x100003460
Function at 0x1401b0f3c
Capabilities:
Encrypt data using rc6

Disassembly:
xor rsi, 0xffffffffd4ecb99c
add rsi, 0x7ae3cc4
jmp 0x1401b25c8
push rdi
movabs rdi, 0x1cac0a966
xor rdi, 0xffffffffa047fa03
sub rdi, 0xffffffffce91795b
xor rdi, 0xffffffffdaa39a79
sub rdi, 0x3da64cae
add rdi, 0xffffffff9826ad9d
sub rdi, 0x3cf17966
sub rdi, 0x5ee527c4
lea rdi, [rdi + riz]
jmp 0x1401afbaa
mov rax, qword [rsp + rdi]
pop rdi
push r13
movabs r13, 0x11e105e04
xor r13, 0xffffffffdc2a1f3f
xor r13, 0xfffffffffe5eb200
sub r13, 0x634bddaa
sub r13, 0x45d5c0c2
xor r13, 0xfffffffff1a47b22
xor r13, 0x80a070d
add r13, 0x45c7138a
jmp 0x1401afc0f
add r13, 0xffffffffc7dcc09c
jmp 0x1401b2608
push r15
jmp 0x1401afc73
movabs r15, 0x1ba23a569
xor r15, 0xffffffffc61b358e
add r15, 0x6856903c
add r15, 0xffffffff89af22f4
add r15, 0xffffffffdb87bf5b
jmp 0x1401ba72b
add rdi, 0xffffffffb3b5c845
sub rdi, 0x1810dc31
add rdi, 0x78bec4f5
add rdi, 0xffffffffefa9cbb9
lea rdi, [rdi + riz]
jmp 0x1401b120b
xor rdx, 0xffffffffbebdb9e4
xor rdx, 0xffffffffa46e2db3
add rdx, 0xffffffffb6651a66
add rdx, 0x1483bf80
jmp 0x1401b83d5
add r11, 0xffffffff80b7ba3d
add r11, 0x33fce8ff
jmp 0x1401ba19b
xor r12, 0x1552f8b2
add r12, 0x5ff384b0
jmp 0x1401ba271
sub r12, 0xfffffffff1f7f144
xor r12, 0x1bb8d6fa
sub r12, 0x284c40a5
add r12, 0xffffffffdd69b911
sub r12, 0xffffffffb69b598d
jmp 0x1401b26b7
lea r8, [r8 + riz]
jmp 0x1401b4bd8
sub r10d, 0x30c9bfd6
xor r10d, 0xd0d18416
xor r10d, 0x10cc3201
jmp 0x1401b0302
xor r10d, 0xc33407e0
jmp 0x1401b77a2
pop r10
push r11
movabs r11, 0xfffffffef1b353f3
add r11, 0xffffffffab4a860c
sub r11, 0xffffffffce20e32b
jmp 0x1401b8cea
add r12, 0x78c3238d
jmp 0x1401b13ea
xor r15, 0x60539a43
add r15, 0x3964ec27
xor r15, 0x125f12fb
sub r15, 0xffffffffee7da877
add r15, 0x5a3a522e
sub r15, 0xffffffffb87e9d84
sub r15, 0xffffffff853766e2
add r15, 0x79d20579
cmp qword [rax], r15
pop r15
je 0x1401b81e3
push r12
movabs r12, 0xffffffffa0c981d0
add r12, 0xb00a9cc
add r12, 0xffffffffa493c062
xor r12, 0x1b38f423
xor r12, 0x1addfdd2
jmp 0x1401b764a
xor r12, 0xffffffff8cfb634d
xor r12, 0x64da4c7c
add r12, 0xffffffffe5b1e547
sub r12, 0xffffffffd882f01a
add r12, 0x32228db2
sub r12, 0xffffffffdd77e9c4
xor r12, 0x5c493351
sub r12, 0xffffffffc55ad587
add r12, 0x4ba5c976
sub r12, 0xffffffff85278fa9
jmp 0x1401b906d
add r12d, 0x6a2e1d4b
cmp dword [rax + 0xc], r12d
pop r12
jne 0x1401b7ae5
push rsi
movabs rsi, 0x1ff90a3e
jmp 0x1401afa82
add r12, 0x6f58fb6f
xor r12, 0x7aacdaff
add r12, 0x5ee80f5e
jmp 0x1401b09f2
xor r12, 0x4dc5e82
jmp 0x1401b50c7
xor r10, 0x11181f25
sub r10, 0xffffffffe71941f6
sub r10, 0x4ab5a3d3
sub r10, 0x448d2ba6
jmp 0x1401b4b27
xor rdx, 0x30e19b19
add rdx, 0xffffffffea0696cc
int3
xchg esi, eax
invalid
invalid
sub rdx, 0xffffffffd13f6900
xor rdx, 0xffffffffd9968aa3
lea rdx, [rdx + riz]
mov rcx, qword [rsp + rdx]
pop rdx
jmp 0x1401b3d7b
mov rcx, qword [rsp + rdi]
pop rdi
lea rax, [rcx + rax + 2]
jmp 0x1401b7841
add byte [rax - 0x7f], cl
int1
cmp ebp, dword [rax + 0x24]
movsb byte [rdi], byte [rsi]
invalid
invalid
int1
invalid
sahf
invalid
Function at 0x1401ba198
Capabilities:
Encrypt data using rc6

Disassembly:
sub rsi, 0xffffffffcde1076b
add rsi, 0x561bf633
jmp 0x1401b0e6e
lea rsi, [rsi + riz]
mov dword [rsp + rsi], ecx
pop rsi
sub rsp, 0x58
mov dword [rsp + 0x44], 0xb7e15163
jmp 0x1401b93cb
add rsi, 0x1741032
sub rsi, 0x64cfdb4f
jmp 0x1401b0f97
sub rsi, 0xffffffffc3a86148
sub rsi, 0x45ff04c2
jmp 0x1401b0fba
xor rsi, 0xffffffffad68b1a4
jmp 0x1401b0da4
xor rsi, 0xffffffffe574a0ca
add rsi, 0x72834f71
add rsi, 0xffffffffe7b619a4
jmp 0x1401b0f43
add rdi, 0xffffffff83d03e53
jmp 0x1401b9720
xor rdi, 0x8579370
jmp 0x1401b56d4
add rbx, 0xffffffffac9e988e
add rbx, 0xffffffffdbdf43ce
jmp 0x1401b20aa
add rbx, 0x48569037
xor rbx, 0x4e4d4f45
jmp 0x1401b2155
sub rbx, 0xffffffffdcbff2a7
sub rbx, 0x3ed05f51
lea rbx, [rbx + riz]
jmp 0x1401b227c
mov eax, dword [rsp + rbx]
pop rbx
shr eax, 8
push rdx
movabs rdx, 0xffffffff22f55c84
jmp 0x1401b236e
xor rdx, 0x43839199
jmp 0x1401b23a7
sub rdx, 0xffffffffb4de2874
sub rdx, 0xffffffffd42bdb5d
add rdx, 0xffffffffac930f33
sub rdx, 0x3d94af9
xor rdx, 0xffffffff8bff0411
xor rdx, 0xffffffffc071b0dd
xor rdx, 0xffffffffcaa8397e
lea rdx, [rdx + riz]
mov dword [rsp + rdx], eax
pop rdx
push rdx
movabs rdx, 0xfffffffe6b3d915c
add rdx, 0x79e4bb63
jmp 0x1401b2409
jmp fcn.1401b0595
add r12, 0x21b0c326
sub r12, 0xffffffff87de8629
add r12, 0x27f42874
jmp 0x1401b9dd1
lea rdi, [rdi + riz]
jmp 0x1401b57e0
mov qword [rsp + rdi], rdx
pop rdi
push rsi
jmp 0x1401b581d
movabs rsi, 0x7b48029a
sub rsi, 0xffffffff824ce15c
add rsi, 0x63738c7f
xor rsi, 0xffffffffa48781fb
jmp 0x1401b5875
add rsi, 0xffffffffe9d86aee
add rsi, 0xffffffffbb88c327
jmp 0x1401b58db
jmp 0x1401b6a81
sub rdi, 0x452653d7
xor rdi, 0xffffffffe87cbd16
sub rdi, 0xffffffffe1dcbbdd
jmp 0x1401b5c49
jmp 0x1401b5c65
jmp 0x1401b7bbe
add rsi, 0xfffffffffe80cefb
jmp 0x1401b6aa9
jmp 0x1401b6b43
add rsi, 0x482380f8
jmp 0x1401b6c09
add rsi, 0xffffffffb64a2ac7
jmp 0x1401b6cc7
add rsi, 0x6ccaf31f
jmp 0x1401b14dc
add rdi, 0x5e4ce8d4
xor rdi, 0x4fdbd965
add rdi, 0x20310b4b
jmp 0x1401b7bee
sub rdi, 0xffffffffa651dfa5
jmp 0x1401b179a
mov dword [rsp + 0x48], 0x9e3779b9
push rbx
movabs rbx, 0xffffffff950c2801
add rbx, 0x459111b8
jmp 0x1401baad8
movabs rdi, 0x491c4ff2
sub rdi, 0xffffffff89483afa
jmp 0x1401b5bf4
xor rdi, 0xffffffffcfe945d6
xor rdi, 0xfffffffff9f70cfa
jmp 0x1401b973a
jmp 0x1401b983f
jmp 0x1401b1c8d
lea r12, [r12]
mov dword [rsp + r12], eax
jmp 0x1401b9df5
pop r12
jmp 0x1401b9e41
push rbx
movabs rbx, 0x5d80c099
add rbx, 0x1382197a
xor rbx, 0x2bfe04c9
add rbx, 0x2a0bd1b8
jmp 0x1401b2083
push rdi
jmp 0x1401ba1ca
jmp 0x1401b9519
xor rbx, 0xffffffff91cdb450
jmp 0x1401bab03
xor rbx, 0x3560986b
xor rbx, 0x62707b00
jmp 0x1401bad91
sub rbx, 0xffffffffab822bd3
add rbx, 0xffffffff8f41bdb9
jmp 0x1401bae2d
lea rbx, [rbx + riz]
mov eax, dword [rsp + rbx]
pop rbx
shr eax, 0x18
push r12
movabs r12, 0x16c231b7b
sub r12, 0x6f8c0e6b
sub r12, 0x2bbf3a88
xor r12, 0x338a2139
jmp 0x1401baf2c
add r12, 0x7663eca8
add r12, 0xffffffffba4e16af
xor r12, 0xffffffffe76c4a65
sub r12, 0xffffffffb52a229a
jmp 0x1401b569e
Function at 0x140016690
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x14002fb80]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140014290
mov rcx, rax
call fcn.140013a10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x21]
call fcn.1400149fc
mov rcx, rax
call fcn.1400139f8
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002ffe8], rax
lea r9, [rsp + 0x50]
mov r8d, 0x40
mov edx, 8
lea rcx, [0x14002ffe8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [0x140016774]
mov qword [0x14002ffe8], rax
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov edx, 8
lea rcx, [0x14002ffe8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024970
add rsp, 0x60
pop rdi
ret
Function at 0x1400172bc
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14002fb80]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov al, byte [0x14002fb6c]
movsx eax, al
mov dword [rsp + 0x20], eax
call fcn.14001e760
movsx eax, al
mov ecx, dword [rsp + 0x20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x28], eax
call fcn.14001e754
movsx eax, al
imul eax, eax, 7
mov dword [rsp + 0x24], eax
call fcn.14001e750
movsx eax, al
mov ecx, dword [rsp + 0x24]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x28]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14002fb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14002fb68]
movsx ecx, cl
sub eax, ecx
test eax, eax
je 0x140017420
cmp qword [0x14002ffe8], 0
je 0x14001734d
mov qword [rsp + 0x40], 1
jmp 0x140017356
mov qword [rsp + 0x40], 0
cvtsi2sd xmm0, qword [rsp + 0x40]
call fcn.1400214ec
mov dword [rsp + 0x38], eax
mov cl, byte [0x14002fb6c]
movsx ecx, cl
mov dword [rsp + 0x2c], ecx
call fcn.14001e760
movsx eax, al
mov ecx, dword [rsp + 0x2c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
call fcn.14001e754
movsx eax, al
shl eax, 3
mov dword [rsp + 0x30], eax
call fcn.14001e750
movsx eax, al
mov ecx, dword [rsp + 0x30]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14002fb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14002fb68]
movsx ecx, cl
sub eax, ecx
mov ecx, dword [rsp + 0x38]
imul ecx, eax
mov eax, ecx
test eax, eax
je 0x140017420
xor eax, eax
cmp eax, 3
je 0x140017420
lea r9, [rsp + 0x48]
mov r8d, 0x40
mov edx, 8
mov rcx, qword [0x14002ffe8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [0x14002ffe8], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov edx, 8
mov rcx, qword [0x14002ffe8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140024970
add rsp, 0x68
ret
Function at 0x14001c5d4
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x80]
and eax, 0x400000
test eax, eax
je 0x14001c63e
mov rax, qword [rsp + 0x20]
mov al, byte [rax + 0x78]
mov byte [rsp + 4], al
cmp byte [rsp + 4], 0x44
je 0x14001c630
cmp byte [rsp + 4], 0x53
je 0x14001c630
cmp byte [rsp + 4], 0x57
je 0x14001c630
cmp byte [rsp + 4], 0x63
je 0x14001c630
cmp byte [rsp + 4], 0x64
je 0x14001c630
cmp byte [rsp + 4], 0x73
je 0x14001c630
cmp byte [rsp + 4], 0x77
je 0x14001c630
jmp 0x14001c637
xor al, al
jmp 0x14001c717
mov al, 1
jmp 0x14001c717
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax + 0x78]
mov dword [rsp], eax
cmp dword [rsp], 0x2f
jg 0x14001c68d
cmp dword [rsp], 0x2f
je 0x14001c6e9
cmp dword [rsp], 0x22
je 0x14001c6e9
cmp dword [rsp], 0x24
je 0x14001c6b9
cmp dword [rsp], 0x28
je 0x14001c6bd
cmp dword [rsp], 0x29
je 0x14001c6bd
cmp dword [rsp], 0x2a
je 0x14001c6b9
cmp dword [rsp], 0x2b
je 0x14001c6bd
cmp dword [rsp], 0x2e
je 0x14001c6b9
jmp 0x14001c715
cmp dword [rsp], 0x3f
je 0x14001c6bd
cmp dword [rsp], 0x5b
je 0x14001c6b9
cmp dword [rsp], 0x5c
je 0x14001c6b9
cmp dword [rsp], 0x5e
je 0x14001c6b9
cmp dword [rsp], 0x7b
je 0x14001c6bd
cmp dword [rsp], 0x7c
je 0x14001c6b9
cmp dword [rsp], 0x7d
je 0x14001c6bd
jmp 0x14001c715
mov al, 1
jmp 0x14001c717
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x80]
and eax, 0x800000
test eax, eax
je 0x14001c6db
mov dword [rsp + 8], 1
jmp 0x14001c6e3
mov dword [rsp + 8], 0
mov al, byte [rsp + 8]
jmp 0x14001c717
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x80]
and eax, 0x1000000
test eax, eax
je 0x14001c707
mov dword [rsp + 0xc], 1
jmp 0x14001c70f
mov dword [rsp + 0xc], 0
mov al, byte [rsp + 0xc]
jmp 0x14001c717
xor al, al
add rsp, 0x18
ret
Function at 0x1400237dc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x14002fb80]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x28], 0
lea rdx, [rsp + 0x40]
mov ecx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
nop
mov dword [rsp + 0x20], 0
jmp 0x140023827
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov al, byte [0x14002fb6c]
movsx eax, al
mov dword [rsp + 0x2c], eax
call fcn.14001e760
movsx eax, al
mov ecx, dword [rsp + 0x2c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
call fcn.14001e754
movsx eax, al
imul eax, eax, 3
mov dword [rsp + 0x30], eax
call fcn.14001e750
movsx eax, al
mov ecx, dword [rsp + 0x30]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14002fb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14002fb68]
movsx ecx, cl
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.1400214ec
cmp dword [rsp + 0x20], eax
jge 0x1400238e3
mov dword [rsp + 0x24], 0
jmp 0x1400238ae
cmp dword [rsp + 0x24], 0x30
jae 0x1400238de
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x160]
call fcn.140012054
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x160]
jmp 0x1400238e3
jmp 0x14002381d
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140024970
add rsp, 0x158
ret
Function at 0x140024680
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x8395cb5a
call fcn.140024130
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140025598
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400255e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400255e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400255e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400255e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400255e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400255e4
xor al, al
add rsp, 0x28
ret
Function at 0x140003880
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400038ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400038ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400038ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400038ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400038ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400038cc
xor al, al
add rsp, 0x28
ret
Function at 0x7ff71001460
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x7ff71004018]
jne 0x7ff7100147b
rol rcx, 0x10
test cx, 0xffff
jne 0x7ff71001477
ret 0
ror rcx, 0x10
jmp 0x7ff71002228
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x7ff710040e0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x7ff710041d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x7ff710022ad
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x7ff710040e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x7ff710022cf
mov rax, qword [rsp + 0x88]
mov qword [0x7ff710041d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x7ff71004178], rax
mov rax, qword [0x7ff710041d8]
mov qword [0x7ff71004050], rax
mov rax, qword [rsp + 0x90]
mov qword [0x7ff71004160], rax
mov dword [0x7ff71004040], 0xc0000409
mov dword [0x7ff71004044], 1
mov rax, qword [0x7ff71004018]
mov qword [rsp + 0x68], rax
mov rax, qword [0x7ff71004020]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x7ff710031b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret