joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400224dc
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
and dword [0x140053950], 0
mov edx, 1
mov rbx, rcx
mov byte [0x140053940], 1
mov byte [0x140053941], 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 2]
call fcn.140001378
cmp qword [0x140053918], 0
jne 0x140022527
cmp byte [0x140053946], 0
je 0x140022530
cmp dword [0x140053934], 0
jne 0x140022545
xor r9d, r9d
mov edx, 0x111
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret

Function at 0x140022620
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1050
call fcn.140023f50
sub rsp, rax
xor edi, edi
mov rbx, rcx
cmp byte [0x140055968], dil
je 0x1400226f2
cmp word [0x14005596a], di
je 0x1400226f2
mov r8d, 0x800
lea rdx, [rsp + 0x50]
lea rcx, [0x14005596a]
call fcn.140020f88
lea rax, [rsp + 0x1068]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareWinRAR_SFX
lea rax, [rsp + 0x1070]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400226f2
mov rcx, rbx
call fcn.140027cc8
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x1070]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x1070]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x1060]
add rsp, 0x1050
pop rdi
ret

Function at 0x140022704
Capabilities:
Set environment variable

Disassembly:
push rbx
mov eax, 0x2020
call fcn.140023f50
sub rsp, rax
mov rbx, rcx
mov rdx, rcx
lea rcx, str.sfxcmd
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140011b50
mov rbx, rax
test rax, rax
je 0x140022766
movzx ecx, word [rax]
jmp 0x14002274d
add rbx, 2
movzx ecx, word [rbx]
call fcn.140011c88
test al, al
jne 0x140022746
mov rdx, rbx
lea rcx, str.sfxpar
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x2020
pop rbx
ret
Function at 0x14002c3e0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14002c1b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002c1b4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002c1b4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002c1b4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002c1b4
cmp dword [rcx + 0x84], 0xe
jbe 0x14002c1b4
cmp dword [rcx + 0xf8], esi
je 0x14002c1b4
mov ecx, r14d
call fcn.14002c2fc
mov ecx, 2
call fcn.14002f9e8
nop
cmp byte [0x14006c668], 0
jne 0x14002c27e
mov r15d, 1
mov eax, r15d
xchg dword [0x14006c658], eax
test ebx, ebx
jne 0x14002c227
mov rdi, qword [0x140049870]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14006c660]
cmp rcx, rax
je 0x14002c21e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140008900]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14006c798]
jmp 0x14002c233
cmp ebx, r15d
jne 0x14002c239
lea rcx, [0x14006c7b0]
call fcn.14002cd70
nop
test ebx, ebx
jne 0x14002c250
lea rdx, [0x1400385a8]
lea rcx, [0x140038588]
call fcn.14002d0f0
lea rdx, [0x1400385b8]
lea rcx, [0x1400385b0]
call fcn.14002d0f0
movzx eax, byte [0x14006c668]
test esi, esi
cmove eax, r15d
mov byte [0x14006c668], al
jmp 0x14002c27e
mov ecx, 2
call fcn.14002fa48
test esi, esi
jne 0x14002c295
mov ecx, r14d
call fcn.14002c2b0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14002c144
Function at 0x1407a1058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407a11df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407a1089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407a106f
add dl, dl
jne 0x1407a1096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407a10f6
xor eax, eax
add dl, dl
jne 0x1407a10a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407a11ad
add dl, dl
jne 0x1407a10b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407a10c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407a10d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407a10dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407a10ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407a107e
mov eax, 1
add dl, dl
jne 0x1407a1106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407a1113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407a10fb
sub eax, ebx
mov ebx, 1
jne 0x1407a114c
mov ecx, 1
add dl, dl
jne 0x1407a112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407a113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407a1123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407a107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407a1168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407a1175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407a115d
cmp eax, 0x7d00
jae 0x1407a119b
cmp eax, 0x500
jb 0x1407a1196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407a107e
cmp eax, 0x7f
ja 0x1407a119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407a107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407a11d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407a107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov esi, r9d
mov rbp, r8
mov r14, rdx
lea r9, str.OneNoteAppIsRunning
mov r15, rcx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140002660
lea rax, [rsp + 0x40]
mov dword [rsp + 0x34], 4
lea r9d, [rdi + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], edi
lea rdx, str.SoftwareMicrosoftOffice16.0OneNote
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400010c4
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.FlightedVersion
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140002689
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x38], edi
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice16.0OneNote
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14000112d
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.RunningVersion
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x14000117e
mov r9d, esi
mov dword [rsp + 0x20], edi
mov r8, rbp
mov rdx, r14
mov rcx, r15
call qword [sym.imp.OneNoteImp.DLL_WinMainImp]
mov edi, eax
test rbx, rbx
je 0x140001162
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
mov edi, 0x3a9d
jmp 0x14000113a
mov edx, 0xc8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ecx, 0x2e0
cmovne edi, ecx
lea rcx, str.RunningVersion
call fcn.14000269c
jmp 0x14000113a
cmp dword [rsp + 0x38], 4
cmove edi, dword [rsp + 0x30]
jmp 0x1400010b9
Function at 0x14000269c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x40
xor ebx, ebx
mov dword [rsp + 0x60], 4
mov rdi, rcx
mov dword [rsp + 0x58], ebx
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice16.0OneNote
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 1]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002727
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000271c
cmp dword [rsp + 0x68], 4
cmove ebx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14005fe6c
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov dword [rax + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x14005feb4
lea ebx, [rsi + 0xd]
jmp 0x14005ff1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xea
jne 0x14005ff1f
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.14003cffc
lea r8, [rbp + 0x30]
mov rdx, qword [rbp - 0x20]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14005ff11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14005ff1f
mov rdx, qword [rbp - 0x20]
mov rcx, rdi
call fcn.1400033fc
mov ebx, esi
lea rcx, [rbp - 0x20]
call fcn.1400174fc
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140060a48
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400bd0c0], eax
call fcn.140060cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400bd0c0], 0
jne case.default.0x140060a9e
mov ecx, 1
call fcn.140060cf8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
lahf
jns 0x140125eb9
invalid
invalid
Function at 0x180001000
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, r8
mov rdi, rcx
cmp edx, 1
je 0x18000101c
mov eax, 1
jmp 0x18000105e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1800020e4
mov eax, dword [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov dword [rsp + 0x38], 1
xor edx, edx
mov qword [rsp + 0x30], rdi
xor ecx, ecx
mov dword [rsp + 0x28], eax
and qword [rsp + 0x20], 0
call fcn.1800024b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x18000106c
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov dword [rbp + 0x2f], 0x5cc65f37
xor r10d, r10d
mov dword [rbp + 0x33], 0x5cf85f1f
mov r8, rcx
mov dword [rbp + 0x37], 0x5ccd5f16
mov dword [rbp + 0x3b], 0x5cd95f1a
mov dword [rbp + 0x3f], 0x5ccf5f07
mov dword [rbp + 0x43], 0x5cf95f01
mov dword [rbp + 0x47], 0x5cd85f16
mov dword [rbp + 0x4b], 0x5ccf5f05
mov dword [rbp + 0x4f], 0x5caa5f01
mov eax, dword [rbp + 0x2f]
mov byte [rbp + 0x53], r10b
mov al, byte [rbp + 0x53]
test al, al
jne 0x1800010e6
mov ecx, r10d
mov eax, dword [rbp + rcx*4 + 0x2f]
xor eax, 0x5caa5f73
mov dword [rbp + rcx*4 + 0x2f], eax
inc rcx
cmp rcx, 9
jb 0x1800010d0
mov dword [rbp + 0x17], 0x44d75911
mov dword [rbp + 0x1b], 0x65d25230
mov dword [rbp + 0x1f], 0x45c95021
mov dword [rbp + 0x23], 0x73cd4730
mov dword [rbp + 0x27], 0x16bb3527
mov eax, dword [rbp + 0x17]
mov byte [rbp + 0x2b], r10b
mov al, byte [rbp + 0x2b]
test al, al
jne 0x180001130
mov rcx, r10
mov eax, dword [rbp + rcx*4 + 0x17]
xor eax, 0x16bb3555
mov dword [rbp + rcx*4 + 0x17], eax
inc rcx
cmp rcx, 5
jb 0x18000111a
mov qword [rsp + 0x40], r10
lea rax, [rbp + 0x2f]
mov dword [rsp + 0x38], r10d
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], r9d
mov r9, rdx
mov edx, 2
mov qword [rsp + 0x20], rax
call fcn.1800024b0
add rsp, 0x90
pop rbp
ret
Function at 0x1800021f4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x400
mov r11d, edx
lea r9, [rsp]
mov rbx, rcx
xor r8d, r8d
mov r10d, r8d
mov edi, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
sub rdi, 1
jne 0x180002216
mov dword [r9], r10d
inc r8d
add r9, 4
cmp r8d, 0x100
jl 0x18000220e
or r8d, 0xffffffff
mov edx, r8d
test r11d, r11d
je 0x180002271
movsx ecx, byte [rbx]
mov eax, edx
xor rcx, rax
inc rbx
movzx eax, cl
mov ecx, edx
shr ecx, 8
mov edx, dword [rsp + rax*4]
xor edx, ecx
add r11d, r8d
jne 0x180002254
mov rbx, qword [rsp + 0x410]
not edx
mov eax, edx
add rsp, 0x400
pop rdi
ret

Function at 0x180002344
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
movsxd rdx, dword [rsp + 0x38]
xor r11d, r11d
test rdx, rdx
jle 0x18000238f
movsxd rbx, dword [rsp + 0x28]
xor r9d, r9d
mov r10, qword [rsp + 0x30]
mov al, byte [r9 + r8]
lea rcx, [r9 + 1]
xor byte [r10], al
inc r10
lea eax, [r11 + 1]
xor r11d, r11d
cmp rcx, rbx
cmovne r11d, eax
xor r9d, r9d
cmp rcx, rbx
cmovne r9, rcx
sub rdx, 1
jne 0x180002363
mov rbx, qword [rsp + 8]
ret
Function at 0x1800037d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor r13d, r13d
mov r15d, edx
mov rdi, rcx
mov ebx, dword [rax + rcx + 0x88]
mov r12d, dword [rax + rcx + 0x8c]
add rbx, rcx
mov eax, edx
shr eax, 0x10
test ax, ax
jne 0x180003822
movzx eax, r15w
sub eax, dword [rbx + 0x10]
jmp 0x180003882
mov ebp, dword [rbx + 0x20]
mov r14d, r13d
mov esi, dword [rbx + 0x24]
add rbp, rdi
add rsi, rdi
cmp dword [rbx + 0x18], r13d
jbe 0x180003860
mov ecx, dword [rbp]
xor r9d, r9d
add rcx, rdi
xor r8d, r8d
xor edx, edx
call fcn.180003c5c
cmp eax, r15d
je 0x18000387f
add rbp, 4
add rsi, 2
inc r14d
cmp r14d, dword [rbx + 0x18]
jb 0x180003837
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [rsi]
test eax, eax
js 0x180003860
mov ecx, dword [rbx + 0x1c]
add rcx, rdi
movsxd rdx, eax
mov r8d, dword [rcx + rdx*4]
add r8, rdi
cmp r8, rbx
jbe 0x1800038b1
mov rdx, r8
sub rdx, rbx
cmp rdx, r12
jae 0x1800038b1
mov rcx, r8
call fcn.18000399c
mov r8, rax
mov rax, r8
jmp 0x180003862

Function at 0x180003a34
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x20], 0x4b1ffe8e
cmp qword [0x180030040], 0
jne 0x180003aff
mov qword [rsp + 0x38], 0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x28], rax
je 0x180003aff
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x58]
mov r9b, 1
mov r8b, 1
mov edx, eax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
call fcn.180003c5c
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x24], eax
jne 0x180003af0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [0x180030040], rax
jmp 0x180003aff
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
jmp 0x180003a9b
mov rax, qword [0x180030040]
add rsp, 0x58
ret
Function at 0x180003cbc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rdi
mov r11d, 0x57
mov eax, r11d
test rdx, rdx
je 0x180003d73
mov dword [rcx + 0x18], r9d
lea r10d, [r11 - 0x4a]
lea r9, [rcx + 8]
mov qword [rcx], rdx
mov dword [rcx + 0x1c], r8d
mov edi, 0x5a4d
test r9, r9
je 0x180003d0e
cmp r8d, 0x40
jbe 0x180003d0b
mov qword [r9], rdx
movzx eax, word [rdx]
sub ax, di
neg ax
sbb eax, eax
and eax, 0xbe
jmp 0x180003d0e
mov eax, r10d
test eax, eax
jne 0x180003d73
lea r9, [rcx + 0x10]
mov eax, r11d
test r9, r9
je 0x180003d73
xor ecx, ecx
cmp r8d, 0x40
jbe 0x180003d3b
movzx eax, word [rdx]
mov rcx, rdx
sub ax, di
neg ax
sbb eax, eax
and eax, 0xbe
jmp 0x180003d40
mov eax, r10d
xor edx, edx
test eax, eax
jne 0x180003d73
movsxd rcx, dword [rcx + 0x3c]
mov eax, r8d
sub rax, 0x130
cmp rcx, rax
jae 0x180003d70
lea rax, [rcx + rdx]
mov qword [r9], rax
mov ecx, dword [rax]
sub ecx, 0x4550
neg ecx
sbb eax, eax
and eax, 0xbe
jmp 0x180003d73
mov eax, r10d
mov rdi, qword [rsp + 8]
ret

Function at 0x180003d7c
Capabilities:
Enumerate pe sections

Disassembly:
mov r8, qword [rcx + 0x10]
mov r11, rdx
xor ecx, ecx
test r8, r8
je 0x180003dc4
movzx eax, word [r8 + 0x14]
lea rdx, [r8 + 0x18]
add rdx, rax
je 0x180003dc4
movzx r9d, word [r8 + 6]
test r9d, r9d
je 0x180003dc4
add rdx, 8
mov r10d, dword [rdx + 4]
cmp r11, r10
jb 0x180003db9
mov eax, dword [rdx]
add eax, r10d
cmp r11, rax
jb 0x180003dc7
inc ecx
add rdx, 0x28
cmp ecx, r9d
jb 0x180003da6
xor eax, eax
ret
lea rax, [rdx - 8]
ret
Function at 0x180004714
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r14d, r14d
mov rbp, rdx
mov rsi, rcx
mov rax, rdx
lea r15d, [r14 + 1]
cmp byte [rax], 0
je 0x18000474e
add r14d, r15d
add rax, r15
jmp 0x180004741
lea eax, [r14 + r14]
movsxd rbx, eax
lea rcx, [rbx + 2]
call fcn.180001bb0
mov rcx, qword [rsi + 0x10]
mov rdx, r15
mov rdi, rax
call fcn.180001b8c
lea rcx, [rbx + 2]
call fcn.180001bb0
mov qword [rsi + 0x10], rax
test r14d, r14d
jne 0x1800047a5
mov word [rdi], 0x30
mov rdx, rdi
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, r15
mov rcx, rdi
call fcn.180001b8c
mov rax, qword [rsi + 0x10]
jmp 0x180004893
lea rdx, [0x18002f1b4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
movsxd rax, r14d
lea r15, [rbp - 1]
xor r12d, r12d
add r15, rax
jmp 0x180004829
mov al, byte [r15]
sub al, 0x30
cmp al, 9
ja 0x1800047dc
cmp byte [r15], 0
je 0x1800047e2
movzx ebx, byte [r15]
sub ebx, 0x30
jmp 0x1800047ed
cmp byte [r15], 0
jne 0x1800047e6
xor ebx, ebx
jmp 0x1800047ed
movzx ebx, byte [r15]
sub ebx, 0x57
mov edx, r12d
mov rcx, rsi
call fcn.180004bd4
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call fcn.180004aa4
mov r8, rax
mov rdx, rdi
mov rcx, rsi
call fcn.180004c48
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
dec r15
dec r14d
inc r12d
test r14d, r14d
jg 0x1800047c4
mov r8, rdi
xor r9d, r9d
cmp byte [r8], 0
jne 0x180004861
lea ecx, [r9 - 5]
mov byte [r8 + 1], 0
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
add cl, 0x30
mov byte [r8], cl
inc r8
inc r9d
cmp r9d, 0x28
jl 0x180004834
mov rcx, qword [rsi + 0x10]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, 1
mov rcx, rdi
call fcn.180001b8c
mov rdx, qword [rsi + 0x10]
mov rcx, rsi
call fcn.180004d78
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1800049c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
test rdx, rdx
je 0x180004a61
mov dword [rbp - 0x50], 0x215e6add
mov r8d, 0x126c5bed
mov dword [rbp - 0x4c], 0x255a6ed9
mov dword [rbp - 0x48], 0x700d62d5
mov dword [rbp - 0x44], 0x74093f8e
mov dword [rbp - 0x40], r8d
mov eax, dword [rbp - 0x50]
mov byte [rbp - 0x3c], 0
mov al, byte [rbp - 0x3c]
test al, al
jne 0x180004a27
xor ecx, ecx
mov eax, dword [rbp + rcx*4 - 0x50]
xor eax, r8d
mov dword [rbp + rcx*4 - 0x50], eax
inc rcx
cmp rcx, 5
jb 0x180004a13
xor r8d, r8d
lea r9d, [r8 + 0xf]
movzx eax, byte [rdx]
mov rcx, qword [rbx + 0x20]
shr rax, 4
mov al, byte [rbp + rax - 0x50]
mov byte [r8 + rcx], al
lea r8, [r8 + 2]
movzx eax, byte [rdx]
inc rdx
mov rcx, qword [rbx + 0x20]
and eax, 0xf
mov al, byte [rbp + rax - 0x50]
mov byte [rcx + r8 - 1], al
sub r9, 1
jne 0x180004a2e
mov rax, qword [rbx + 0x20]
lea rcx, [rbp - 0x38]
mov byte [rax + 0x1e], 0
call fcn.180004398
mov rdx, qword [rbx + 0x20]
lea rcx, [rbp - 0x38]
call fcn.180004714
mov rcx, qword [rbx + 0x28]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp - 0x38]
call fcn.180004504
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x180004c48
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov rdi, rcx
mov ebp, r15d
mov eax, r15d
mov rsi, r8
mov r14, rdx
mov rcx, rdx
cmp byte [rcx], r15b
je 0x180004c81
inc eax
inc rcx
jmp 0x180004c75
mov ebx, r15d
mov rcx, r8
cmp byte [rcx], r15b
je 0x180004c93
inc ebx
inc rcx
jmp 0x180004c87
mov rcx, qword [rdi + 0x18]
cmp eax, ebx
mov edx, 1
cmovg ebx, eax
call fcn.180001b8c
movsxd rcx, ebx
add rcx, 2
call fcn.180001bb0
mov qword [rdi + 0x18], rax
mov r8, rax
test ebx, ebx
jne 0x180004ccd
mov byte [rax], 0x30
mov rax, qword [rdi + 0x18]
mov byte [rax + 1], r15b
jmp 0x180004d5b
mov al, byte [r14]
test al, al
jne 0x180004cd9
mov eax, r15d
jmp 0x180004cdf
movzx eax, al
sub eax, 0x30
cmp byte [rsi], r15b
jne 0x180004ce9
mov ecx, r15d
jmp 0x180004cef
movzx ecx, byte [rsi]
sub ecx, 0x30
add eax, ebp
add ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp ecx, 9
mov ebp, edx
cmovle ebp, r15d
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
movsxd rax, ecx
mov cl, byte [rax + rdi]
lea rax, [r14 + 1]
mov byte [r8], cl
inc r8
cmp byte [r14], r15b
cmove rax, r14
cmp byte [rsi], r15b
mov r14, rax
lea rax, [rsi + 1]
cmove rax, rsi
mov rsi, rax
mov al, byte [r14]
test al, al
jne 0x180004cd9
cmp byte [rsi], r15b
jne 0x180004cd0
test ebp, ebp
je 0x180004d58
movsxd rax, ebp
mov cl, byte [rax + rdi]
mov byte [r8], cl
inc r8
mov byte [r8], r15b
mov rax, qword [rdi + 0x18]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret