joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015d352
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1401a0e88]
test eax, eax
je 0x14015d3ea
lea rax, [0x1401a0e60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1401a0e90]
mov qword [rbp - 8], rax
jmp 0x14015d3ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14015d3c2
cmp qword [rbp - 0x10], 0
je 0x14015d3c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14015d388
lea rax, [0x1401a0e60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14015d3eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14015d4f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14015d518
mov eax, 0
jmp 0x14015d566
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14015d541
mov eax, 0
jmp 0x14015d566
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14015d561
mov eax, 0
jmp 0x14015d566
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14015d56c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14015d5ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14015d5e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14015d5e1
mov rax, qword [rbp - 8]
jmp 0x14015d5ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14015d5b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180001090
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x168
mov rax, qword [0x18000f040]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rdx, str.e39ef54
lea rcx, str.f2f656e
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1800011e8
mov qword [rsp + 0x160], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov edi, eax
call fcn.180001000
test al, al
je 0x1800011e0
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rbp
mov qword [rsp + 0x180], rsi
xor ebp, ebp
nop
call fcn.180002a88
call fcn.180002a88
call fcn.180002a88
mov ebx, eax
mov eax, 0x68db8bad
imul ebx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x2710
sub ebx, edx
call fcn.180002a88
mov r11d, eax
mov eax, 0x68db8bad
imul r11d
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1388
sub r11d, edx
add r11d, ebx
mov rbx, rbp
movsxd rsi, r11d
je 0x1800011ae
mov ecx, edi
call fcn.180001000
test al, al
je 0x1800011ae
lea rcx, [rsp + 0x40]
call fcn.180001050
call fcn.180002a88
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x3c], ebp
mov dword [rsp + 0x34], ebp
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
inc rbx
cmp rbx, rsi
jb 0x180001158
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call fcn.180001000
test al, al
jne 0x180001100
mov rsi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180002b50
add rsp, 0x168
ret
Function at 0x180001200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18000f040]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [rcx], 0
mov rbx, rcx
je 0x18000122a
mov al, 1
jmp 0x18000133a
lea r9, str.D60B5A0B_51B6_4766_84B9_E6978BD75CAE
lea r8, str.A34383B1_0210_46BB_A97A_74A2D7CF2E04
lea rcx, [0x180010348]
xor edx, edx
call fcn.180001cd0
test al, al
je 0x18000133a
lea rdx, [rbp - 0x28]
lea rcx, [0x180010348]
mov dword [rbp - 0x28], 0x53505357
mov dword [rbp - 0x24], 0x74726174
mov dword [rbp - 0x1c], 0x4253684e
mov dword [rbp - 0x20], 0x45007075
mov word [rbp - 0x17], 0x4878
call fcn.180001ff0
lea rdx, str.adff2
lea rcx, [0x180010348]
mov qword [0x180010320], rax
call fcn.180001ff0
lea rdx, str.b78ec
lea rcx, [0x180010348]
mov qword [0x180010328], rax
call fcn.180001ff0
lea rdx, [rbp - 0x50]
lea rcx, [0x180010348]
mov dword [rbp - 0x50], 0x68747541
mov byte [rbp - 0x33], 0x4e
mov qword [0x180010330], rax
mov dword [rbp - 0x4c], 0x69746e65
mov dword [rbp - 0x48], 0x65746163
mov dword [rbp - 0x44], 0x6563694c
mov dword [rbp - 0x3b], 0x6a694747
mov byte [rbp - 0x3c], 0x6c
mov word [rbp - 0x37], 0x6a58
mov byte [rbp - 0x35], 0x43
mov dword [rbp - 0x40], 0x65736e
call fcn.180001ff0
cmp qword [0x180010320], 0
mov r11, rax
mov qword [0x180010338], rax
mov al, 1
je 0x180001336
cmp qword [0x180010328], 0
je 0x180001336
cmp qword [0x180010330], 0
je 0x180001336
test r11, r11
jne 0x180001338
xor al, al
mov byte [rbx], al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180002b50
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret
Function at 0x1800015b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push r13
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x18000f040]
xor rax, rsp
mov qword [rbp], rax
mov rsi, r8
mov r13, rdx
mov rbx, rcx
test rdx, rdx
je 0x18000181c
test r8, r8
je 0x18000181c
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x110], r15
mov word [rbp - 0x3f], 0x4273
mov dword [rbp - 0x50], 0x6e72656b
mov dword [rbp - 0x4c], 0x32336c65
mov dword [rbp - 0x44], 0x61637600
mov dword [rbp - 0x48], 0x6c6c642e
mov dword [rbp - 0x3d], 0x46445057
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x78]
mov rcx, rax
mov dword [rbp - 0x78], 0x61657243
mov r15, rax
mov dword [rbp - 0x74], 0x69466574
mov word [rbp - 0x70], 0x656c
mov word [rbp - 0x64], 0x4d42
mov dword [rbp - 0x6d], 0x6b797a00
mov byte [rbp - 0x6e], 0x57
mov dword [rbp - 0x69], 0x45445345
mov byte [rbp - 0x65], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800016a0
xor al, al
jmp 0x1800017dd
lea rdx, [rsp + 0x48]
mov rcx, r15
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x118], r14
mov dword [rsp + 0x48], 0x736f6c43
mov dword [rsp + 0x4c], 0x6e614865
mov dword [rsp + 0x54], 0x4f465a6d
mov dword [rsp + 0x59], 0x77655400
mov dword [rsp + 0x50], 0x656c64
mov byte [rsp + 0x58], 0x42
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x68]
mov rcx, r15
mov dword [rsp + 0x68], 0x46746547
mov word [rsp + 0x79], 0x4f51
mov rdi, rax
mov dword [rsp + 0x6c], 0x53656c69
mov word [rsp + 0x7c], 0x4c00
mov word [rsp + 0x70], 0x7a69
mov byte [rsp + 0x7b], 0x51
mov word [rsp + 0x73], 0x7500
mov byte [rsp + 0x72], 0x65
mov word [rsp + 0x76], 0x4754
mov byte [rsp + 0x78], 0x4a
mov byte [rsp + 0x75], 0x49
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov rcx, rbx
call rax
mov r14d, eax
cmp eax, 0xffffffff
je 0x180001813
test eax, eax
je 0x180001813
mov ecx, r14d
mov qword [rsp + 0x120], r12
call fcn.180003004
lea rdx, [rbp - 0x28]
mov rcx, r15
mov dword [rbp - 0x28], 0x64616552
mov dword [rbp - 0x20], 0x55477700
mov dword [rbp - 0x24], 0x656c6946
mov r12, rax
mov word [rbp - 0x18], 0x6b56
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x40]
mov r8d, r14d
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x20], 0
call rax
test eax, eax
jne 0x1800017fe
mov rcx, r12
call fcn.180002fc4
mov rcx, rbx
call rdi
xor al, al
mov r12, qword [rsp + 0x120]
mov r14, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x168]
mov r15, qword [rsp + 0x110]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.180002b50
add rsp, 0x128
pop r13
pop rsi
pop rbx
pop rbp
ret
mov rcx, rbx
call rdi
mov r11d, dword [rsp + 0x40]
mov al, 1
mov dword [rsi], r11d
mov qword [r13], r12
jmp 0x1800017c5
mov rcx, rbx
call rdi
xor al, al
jmp 0x1800017cd
xor al, al
jmp 0x1800017e5
Function at 0x180001960
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push rsi
mov r11d, dword [rdx]
mov r10d, ecx
mov rsi, r8
mov r8d, dword [rdx + 4]
mov r9, rdx
imul r10d, r10d, 0x9e3779b9
test ecx, ecx
je 0x1800019f7
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov edi, ecx
mov ebx, r10d
nop dword [rax]
shr rbx, 0xb
mov eax, r11d
mov ecx, r11d
shl eax, 4
shr ecx, 5
and ebx, 3
xor ecx, eax
mov eax, dword [rsi + rbx*4]
add eax, r10d
add ecx, r11d
add r10d, 0x61c88647
xor ecx, eax
mov ebx, r10d
sub r8d, ecx
mov eax, r8d
mov edx, r8d
shr edx, 5
shl eax, 4
xor edx, eax
mov eax, r10d
and eax, 3
add edx, r8d
mov ecx, dword [rsi + rax*4]
add ecx, r10d
xor edx, ecx
sub r11d, edx
dec rdi
jne 0x180001990
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov dword [r9], r11d
mov dword [r9 + 4], r8d
pop rsi
ret
mov dword [rdx], r11d
mov dword [rdx + 4], r8d
pop rsi
ret

Function at 0x180001b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x98]
sub rsp, 0x198
mov rax, qword [0x18000f040]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, rcx
lea rcx, [rsp + 0x58]
mov rdi, r9
mov r13, r8
mov r12, rdx
mov dword [rsp + 0x58], 0x6c64746e
mov word [rsp + 0x6a], 0x4246
mov dword [rsp + 0x5c], 0x6c642e6c
mov word [rsp + 0x66], 0x794c
mov word [rsp + 0x63], 0x6f55
mov byte [rsp + 0x65], 0x75
mov word [rsp + 0x60], 0x6c
mov byte [rsp + 0x62], 0x43
mov byte [rsp + 0x69], 0x52
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x180001c60
lea rdx, [rsp + 0x30]
mov rcx, rax
mov dword [rsp + 0x30], 0x446c7452
mov dword [rsp + 0x34], 0x6d6f6365
mov dword [rsp + 0x38], 0x73657270
mov dword [rsp + 0x3c], 0x66754273
mov dword [rsp + 0x47], 0x61584861
mov word [rsp + 0x4b], 0x4175
mov byte [rsp + 0x46], 0x71
mov dword [rsp + 0x40], 0x726566
mov byte [rsp + 0x44], 0x4e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180001c64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x180001cac
mov r8d, dword [rdi]
mov ecx, 2
mov r9, rsi
mov rdx, r12
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r13d
call rax
lea rcx, [rbp - 0x7f]
xor edx, edx
mov r8d, 0xff
mov byte [rbp - 0x80], 0
mov ebx, eax
call fcn.1800030d0
lea rdx, [0x18000b360]
lea rcx, [rbp - 0x80]
call fcn.180003504
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.180002b50
add rsp, 0x198
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180002810
Capabilities:
Parse pe header

Disassembly:
push r12
push r13
sub rsp, 0x28
mov r12, qword [rcx + 0x40]
mov eax, 0x5a4d
mov r13, rcx
cmp word [r12], ax
jne 0x180002a0a
mov qword [rsp + 0x50], rsi
movsxd rsi, dword [r12 + 0x3c]
add rsi, r12
cmp dword [rsi], 0x4550
jne 0x180002a05
mov eax, 0x14c
cmp word [rsi + 4], ax
je 0x180002a05
lea rcx, [0x18000b362]
mov qword [rsp + 0x48], rbp
call fcn.180003954
mov edx, dword [rsi + 0x50]
mov rcx, qword [rsi + 0x30]
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
jne 0x1800028aa
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x180002a00
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rbp
mov rdi, rax
test rax, rax
jne 0x1800028e2
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1800029fb
mov qword [rax + 8], rbp
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], r14
xor r14d, r14d
mov r8d, 0x1000
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r14
movzx eax, word [rsi + 0x16]
shr eax, 0xd
lea r9d, [r14 + 4]
and eax, 1
mov dword [rdi + 0x20], eax
mov rax, qword [r13 + 0x30]
mov qword [rdi + 0x28], rax
mov rax, qword [r13 + 0x20]
mov qword [rdi + 0x30], rax
mov rax, qword [r13 + 0x10]
mov qword [rdi + 0x38], rax
mov rax, qword [r13]
mov qword [rdi + 0x40], rax
mov edx, dword [rsi + 0x54]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsi + 0x54]
mov rdx, r12
mov rcx, rax
mov rbx, rax
call fcn.1800031d0
movsxd rax, dword [r12 + 0x3c]
mov r8, rdi
add rax, rbx
mov rdx, rsi
mov qword [rdi], rax
mov qword [rax + 0x30], rbp
mov rcx, qword [r13 + 0x40]
call fcn.180002080
mov rbx, qword [rsp + 0x40]
mov rdx, rbp
sub rdx, qword [rsi + 0x30]
je 0x180002986
mov rcx, rdi
call fcn.180002340
mov dword [rdi + 0x24], eax
jmp 0x18000298d
mov dword [rdi + 0x24], 1
mov rcx, rdi
call fcn.180002470
test eax, eax
je 0x1800029ee
mov rcx, rdi
call fcn.1800021d0
mov rcx, rdi
call fcn.1800022e0
mov r11, qword [rdi]
mov eax, dword [r11 + 0x28]
test eax, eax
je 0x1800029e4
add rax, rbp
cmp dword [rdi + 0x20], r14d
je 0x1800029da
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 1]
call rax
test eax, eax
je 0x1800029ee
mov dword [rdi + 0x1c], 1
mov qword [r13 + 0x50], rdi
jmp 0x1800029f6
mov qword [rdi + 0x48], rax
mov qword [r13 + 0x50], rdi
jmp 0x1800029f6
mov qword [rdi + 0x48], r14
mov qword [r13 + 0x50], rdi
jmp 0x1800029f6
mov rcx, rdi
call fcn.180002750
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x28
pop r13
pop r12
ret
Function at 0x180003e4f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18000f040]
jne 0x180002b6a
rol rcx, 0x10
test cx, 0xffff
jne 0x180002b66
repz ret
ror rcx, 0x10
jmp 0x180003da8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180010430]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180010528]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180003e2d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180010430]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180003e4f
mov rax, qword [rsp + 0x88]
mov qword [0x180010528], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800104c8], rax
mov rax, qword [0x180010528]
mov qword [0x1800103a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800104b0], rax
mov dword [0x180010390], 0xc0000409
mov dword [0x180010394], 1
mov rax, qword [0x18000f040]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000f048]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180010428], eax
mov ecx, 1
call fcn.180007a10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18000b380]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180010428], 0
jne 0x180003ed6
mov ecx, 1
call fcn.180007a10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1800080a8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18000f040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180003a18
xor ebx, ebx
cmp qword [0x1800113e0], rbx
mov rdi, rax
jne 0x1800081bb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180008292
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008292
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1800113e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1800113e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1800113f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180011400], rax
test rax, rax
je 0x1800081b2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1800113f8], rax
jmp 0x1800081c2
mov rax, qword [0x1800113f8]
jmp 0x1800081c9
mov rax, qword [0x1800113f8]
mov r11, qword [0x180011400]
cmp rax, rdi
je 0x180008230
cmp r11, rdi
je 0x180008230
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180011400]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180008230
test rax, rax
je 0x180008230
call rsi
test rax, rax
je 0x18000822a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18000822a
test byte [rsp + 0x40], 1
jne 0x180008230
bts ebp, 0x15
jmp 0x180008270
mov rcx, qword [0x1800113e8]
cmp rcx, rdi
je 0x180008270
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180008270
call rax
mov rbx, rax
test rax, rax
je 0x180008270
mov rcx, qword [0x1800113f0]
cmp rcx, rdi
je 0x180008270
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180008270
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1800113e0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180008292
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180008294
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180002b50
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e6f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14000e721
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14000e79b
mov rdi, r14
mov rcx, rbx
call fcn.14000b490
test rax, rax
jle 0x14000e773
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14002bf50
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000e78b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000e793
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000e735
sub r14, rdi
jmp 0x14000e87f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000e7b2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000e7b4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000e7e6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14002bf50
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000e87c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000e821
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000e85d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140031878
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000e87c
cmp rbp, rax
ja 0x14000e830
test rbp, rbp
je 0x14000e87c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140031878
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140021fb0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
mov ebp, 0xfffd
nop word [rax + rax]
movzx ecx, word [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x140022093
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140022093
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1400220b1
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140022083
cmp word [rax], 0x5c
jne 0x14002207c
lea rdx, [rax + 2]
cmp rdx, rcx
je 0x14002207c
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140022067
movzx ecx, word [rdx]
sub cx, 0x28
cmp cx, 1
jbe 0x140022079
test r8b, 0x10
jne 0x14002207c
movzx ecx, word [rdx]
sub cx, 0x7b
test bp, cx
jne 0x14002207c
mov rax, rdx
add rax, 2
mov qword [rbx], rax
mov rcx, rbx
call fcn.140024230
test edi, edi
jne 0x140021fe0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140023050
int3