joyce8/EMBER2024-capa huggingface dataset:
Function at 0x638094
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
mov eax, 0x20c0
call fcn.006e5e00
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x20d0], rbx
mov rbx, rdx
xor edi, edi
mov dword [rsp + 0x20e0], edi
mov dword [rsp + 0x20e8], 0x1000
lea rax, [rsp + 0x20e8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [0x0085e898]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x638154
mov edx, eax
lea rcx, [rsp + 0x88]
call fcn.0058defc
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.006a49e8
lea r11, [0x00798b08]
mov qword [rsp + 0x40], r11
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.004029b4
lea r11, [0x00798b08]
mov qword [rsp + 0x40], r11
lea rdx, [0x00851010]
lea rcx, [rsp + 0x40]
call fcn.006ab82c
nop
mov eax, dword [rsp + 0x20e8]
mov word [rsp + rax*2 + 0xc0], di
lea r8, [rsp + 0x20e0]
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.004023b4
mov rax, rbx
mov rbx, qword [rsp + 0x20d0]
add rsp, 0x20c0
pop rdi
ret

Function at 0x638190
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [r8 + 0x40]
mov r9, qword [r8 + 0x48]
sub rax, r9
sar rax, 1
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rdx + 0x48]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x63822a
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.0058defc
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.006a49e8
lea r11, [0x00798b08]
mov qword [rsp + 0x38], r11
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.004029b4
lea r11, [0x00798b08]
mov qword [rsp + 0x38], r11
lea rdx, [0x00851010]
lea rcx, [rsp + 0x38]
call fcn.006ab82c
nop
add rsp, 0xb0
pop rbx
ret
Function at 0x6612e8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov eax, edx
mov r9, rcx
test edx, edx
jg 0x66130d
mov rax, rcx
cmp byte [rcx], r8b
je 0x661304
inc rax
cmp byte [rax], r8b
jne 0x6612fc
sub eax, ecx
and eax, 0x3fffffff
jle 0x661330
movzx ecx, byte [r9]
lea rdx, [0x0078df90]
dec eax
movzx edx, byte [rcx + rdx]
mov ecx, r8d
inc r9
shl ecx, 3
xor edx, ecx
xor r8d, edx
test eax, eax
jg 0x66130d
btr r8d, 0x1f
mov eax, r8d
ret

Function at 0x6620e8
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x340
mov r9, qword [0x00866ab8]
mov rdi, rdx
test r9, r9
je 0x66212e
lea r8, [0x007c1184]
lea rdx, [rsp + 0x20]
mov ecx, 0xe6
call fcn.006606d8
jmp 0x6621c0
call fcn.006616d4
mov ecx, 0xe6
test eax, eax
je 0x662182
lea rdx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x130]
call fcn.006617a4
mov rbx, rax
test rax, rax
jne 0x66219f
mov eax, 7
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
lea rdx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0x130]
call fcn.006618e8
jmp 0x662157
lea r8, [0x007c1184]
lea rdx, [rsp + 0x20]
mov r9, rax
mov ecx, 0xe6
call fcn.006606d8
mov rcx, rbx
call fcn.006a5528
cmp byte [rsp + 0x20], 0
lea rax, [rsp + 0x20]
je 0x6621d4
inc rax
cmp byte [rax], 0
jne 0x6621cc
lea rcx, [rsp + 0x20]
mov esi, 0x3fffffff
sub eax, ecx
and rax, rsi
jbe 0x6621f7
lea rcx, [rsp + 0x20]
cmp byte [rcx + rax - 1], 0x5c
jne 0x6621f7
sub rax, 1
jne 0x6621ea
lea r9, [rsp + 0x20]
lea r8, str._setilqs_
mov rdx, rdi
mov ecx, 0xe7
mov byte [rsp + rax + 0x20], 0
call fcn.006606d8
cmp byte [rdi], 0
mov rbx, rdi
je 0x662225
inc rbx
cmp byte [rbx], 0
jne 0x66221d
sub ebx, edi
mov r12d, reloc.WS2_32.dll_sendto
and rbx, rsi
mov esi, r12d
lea rbp, [rbx + rdi]
call fcn.00660748
mov byte [rbp], al
inc rbp
sub esi, 1
jne 0x662237
movzx ecx, byte [rbx + rdi]
movabs rax, 0x842108421084211
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
lea rax, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov al, byte [rcx + rax]
mov byte [rbx + rdi], al
inc rbx
sub r12, 1
jne 0x662247
mov byte [rbx + rdi], r12b
xor eax, eax
jmp 0x662164
Function at 0x662764
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x140
mov edi, 0x104
lea r9, [rsp + 0x30]
mov esi, 0x200
mov r8d, edi
mov dword [rax + 0x18], esi
call fcn.00662648
xor ebp, ebp
cmp eax, ebp
jne 0x66283e
lea rcx, [rsp + 0x30]
call fcn.00662094
mov rbx, rax
cmp rax, rbp
je 0x662845
call fcn.006616d4
mov ecx, ebp
cmp eax, ebp
mov rax, rbp
je 0x6627fb
cmp word [rbx + rax*2], 0x5c
je 0x6627d6
inc rax
inc ecx
cmp rax, rdi
jl 0x6627c3
jmp 0x6627de
movsxd rax, ecx
mov word [rbx + rax*2 + 2], bp
lea r8, [rsp + 0x160]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x662830
cmp byte [rax + rbx], 0x5c
je 0x66280d
inc rax
inc ecx
cmp rax, rdi
jl 0x6627fb
jmp 0x662815
movsxd rax, ecx
mov byte [rax + rbx + 1], bpl
lea r8, [rsp + 0x160]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov rcx, rbx
mov edi, eax
call fcn.006a5528
cmp edi, ebp
je 0x662845
mov esi, dword [rsp + 0x160]
lea r11, [rsp + 0x140]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x69f188
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov byte [rcx + 0xe0], 1
mov rcx, qword [rcx + 0x50]
mov esi, edx
cmp rcx, 0xffffffffffffffff
je 0x69f1c5
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbx + 0x50], 0xffffffffffffffff
mov dword [rbx + 0x88], esi
lea rcx, [rbx + 0x48]
mov byte [rbx + 0xe0], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.00593424
Function at 0x6a23e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x40e8], 0
mov rbx, rcx
je 0x6a24a3
xor r11d, r11d
cmp dword [rcx + 0xbc], r11d
jbe 0x6a24a3
lea r10, [rcx + 0xe0]
nop dword [rax]
movzx eax, byte [r10]
mov r8, qword [rbx + 0x40f8]
mov edx, dword [rbx + 0x40ec]
mov r9d, dword [rbx + 0x40f4]
xor rax, rdx
shr edx, 8
movzx ecx, al
and r9d, 0xfffd
inc r11d
mov eax, dword [r8 + rcx*4]
or r9d, 2
inc r10
xor eax, edx
mov edx, dword [rbx + 0x40f4]
mov dword [rbx + 0x40ec], eax
movzx eax, al
add eax, dword [rbx + 0x40f0]
imul eax, eax, 0x8088405
inc eax
mov ecx, eax
mov dword [rbx + 0x40f0], eax
shr ecx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
mov eax, dword [r8 + rax*4]
xor eax, edx
mov dword [rbx + 0x40f4], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
shr eax, 8
xor byte [r10 - 1], al
cmp r11d, dword [rbx + 0xbc]
jb 0x6a2410
mov r9d, dword [rbx + 0xbc]
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x38]
lea r8, [rbx + 0xe0]
call qword [rbx + reloc.WS2_32.dll_recv]
xor ecx, ecx
or edx, 0xffffffff
cmp eax, dword [rbx + 0xbc]
mov dword [rbx + 0xbc], 0
cmovne ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x6a4504
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x00861b70]
test rcx, rcx
jne 0x6a445b
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x6a4454
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x6a4486
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x6a4450
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x00861b70], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x6a44f9
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x6a44a9
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x00861b70]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x6a44d6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x6a44f9
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x00861b70]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x6a44dd
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x6a43e0
Function at 0x6a709c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.006b319c
nop
cmp dword [0x00861d18], 1
je 0x6a7048
mov dword [0x00861d14], 1
mov byte [0x00861d10], r12b
test ebx, ebx
jne 0x6a7034
mov rcx, qword [0x008bd080]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x6a7021
mov rcx, qword [0x008bd078]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x6a6fc0
call fcn.006abf08
cmp qword [rdi], rax
jne 0x6a6fc0
jmp 0x6a6fa6
cmp rdi, rsi
jb 0x6a7021
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.006abf08
mov qword [rdi], rax
call rbx
mov rcx, qword [0x008bd080]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x008bd078]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x6a6fff
cmp r13, rax
je 0x6a701f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x6a6fa6
lea rdx, [0x00784cb8]
lea rcx, [0x00784ca0]
call fcn.006a6df0
lea rdx, [0x00784cc8]
lea rcx, [0x00784cc0]
call fcn.006a6df0
nop
test r12d, r12d
je 0x6a7057
mov ecx, 8
call fcn.006b309c
test r12d, r12d
jne 0x6a7082
mov dword [0x00861d18], 1
lea ecx, [r12 + 8]
call fcn.006b309c
mov ecx, r15d
call fcn.006a6d84
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x6a6f10

Function at 0x6a70a8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x6a6f10
Function at 0x6a9298
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov eax, 0x5a4d
cmp word [0x00400000], ax
jne 0x6a9321
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x6a92e3
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x6a9331
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x6a92f9
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x6a9331
cmp dword [rax + 0x84], 0xe
ja 0x6a930d
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x6a9331
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x6a9331
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x00400000]
mov ecx, 1
call fcn.006ae3b0
test eax, eax
jne 0x6a9361
cmp dword [0x00861d58], 1
jne 0x6a934d
call fcn.006ae36c
mov ecx, 0x1c
call fcn.006ae144
mov ecx, 0xff
call fcn.006a6dc0
call fcn.006ac1d8
test eax, eax
jne 0x6a938c
cmp dword [0x00861d58], 1
jne 0x6a9378
call fcn.006ae36c
mov ecx, reloc.WS2_32.dll_recv
call fcn.006ae144
mov ecx, 0xff
call fcn.006a6dc0
call fcn.006b31e0
nop
call fcn.006b7044
test eax, eax
jns 0x6a93a5
mov ecx, 0x1b
call fcn.006a6d54
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x008bd068], rax
call fcn.006b6fb0
mov qword [0x00861d50], rax
call fcn.006b6ec0
test eax, eax
jns 0x6a93d0
mov ecx, 8
call fcn.006a6d54
call fcn.006b6bf0
test eax, eax
jns 0x6a93e3
mov ecx, 9
call fcn.006a6d54
mov ecx, 1
call fcn.006a6e60
test eax, eax
je 0x6a93f8
mov ecx, eax
call fcn.006a6d54
call fcn.006b6b94
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.004ac71c
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x6a942f
mov ecx, eax
call fcn.006a709c
call fcn.006a70b4
jmp 0x6a9450
mov eax, edi
jmp 0x6a9459
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.006b7334
add rsp, 0x28
jmp 0x6a9298
Function at 0x6b9d5f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00856110]
jne 0x6ab0ba
rol rcx, 0x10
test cx, 0xffff
jne 0x6ab0b6
repz ret
ror rcx, 0x10
jmp 0x6b9cb8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x008626f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x008627e8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x6b9d3d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x008626f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x6b9d5f
mov rax, qword [rsp + 0x88]
mov qword [0x008627e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00862788], rax
mov rax, qword [0x008627e8]
mov qword [0x00862660], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00862770], rax
mov dword [0x00862650], 0xc0000409
mov dword [0x00862654], 1
mov rax, qword [0x00856110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00856118]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x008626e8], eax
mov ecx, 1
call fcn.006bd8b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00786fa8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x008626e8], 0
jne 0x6b9de6
mov ecx, 1
call fcn.006bd8b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x6bdeb0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.006abf08
xor ebx, ebx
mov rdi, rax
cmp qword [0x00862c30], rbx
jne 0x6bdfb6
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x6be08b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x6be08b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x00787940]
mov rcx, rsi
mov qword [0x00862c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x00862c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x00862c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x00862c50], rax
test rax, rax
je 0x6bdfad
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x00862c48], rax
jmp 0x6bdfbd
mov rax, qword [0x00862c48]
jmp 0x6bdfc4
mov rax, qword [0x00862c48]
mov r11, qword [0x00862c50]
cmp rax, rdi
je 0x6be02c
cmp r11, rdi
je 0x6be02c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x00862c50]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x6be02c
test rax, rax
je 0x6be02c
call rsi
test rax, rax
je 0x6be026
lea rcx, [rsp + 0x88]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x6be026
test byte [rsp + 0x38], 1
jne 0x6be02c
bts ebp, 0x15
jmp 0x6be06a
mov rcx, qword [0x00862c38]
cmp rcx, rdi
je 0x6be06a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x6be06a
call rax
mov rbx, rax
test rax, rax
je 0x6be06a
mov rcx, qword [0x00862c40]
cmp rcx, rdi
je 0x6be06a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x6be06a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x00862c30]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x6be08b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x6be08d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x6c2950
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, byte [rcx + 0x5c]
xor edx, edx
mov r8, rcx
cmp dword [rcx + 0x60], edx
jle 0x6c2999
movzx r10d, r9b
lea r11, [0x00856a20]
nop word [rax + rax]
mov ecx, dword [r8 + 0x288]
inc edx
mov rax, rcx
shl ecx, 8
shr rax, 0x18
xor rax, r10
mov eax, dword [r11 + rax*4]
xor eax, ecx
mov dword [r8 + 0x288], eax
cmp edx, dword [r8 + 0x60]
jl 0x6c2970
mov eax, dword [r8 + 0x5c]
mov byte [rax + r8 + 0x80], 1
movsxd rdx, dword [r8 + 0x60]
mov ecx, edx
sub ecx, 1
je 0x6c2a3d
sub ecx, 1
je 0x6c2a2d
cmp ecx, 1
je 0x6c2a1d
mov byte [rdx + r8 + 0x7c], 1
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
inc dword [r8 + 0x6c]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
inc dword [r8 + 0x6c]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
inc dword [r8 + 0x6c]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
inc dword [r8 + 0x6c]
movzx edx, byte [r8 + 0x60]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
sub dl, 4
mov byte [rcx + rax], dl
inc dword [r8 + 0x6c]
ret
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
inc dword [r8 + 0x6c]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
inc dword [r8 + 0x6c]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
inc dword [r8 + 0x6c]
ret
Function at 0x6d4f50
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx eax, byte [rcx]
mov esi, dword [rdx + 0x58]
movsxd r12, r9d
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test al, al
je 0x6d50ba
mov r13d, dword [rsp + 0x70]
mov r15d, 0x3e
cmp al, 0x5c
jne 0x6d4fd8
movzx eax, byte [rbx + 1]
inc rbx
test al, al
je 0x6d50ba
cmp al, 0x51
jne 0x6d516d
nop dword [rax]
movzx eax, byte [rbx + 1]
inc rbx
test al, al
je 0x6d50ba
cmp al, 0x5c
jne 0x6d4fb0
test al, al
je 0x6d50ba
inc rbx
cmp byte [rbx], 0x45
jne 0x6d4fb0
jmp 0x6d516d
cmp al, 0x5b
jne 0x6d509a
xor edi, edi
movzx eax, byte [rbx + 1]
inc rbx
cmp eax, 0x5c
jne 0x6d5019
cmp byte [rbx + 1], 0x45
lea rcx, [rbx + 1]
jne 0x6d4ffd
mov rbx, rcx
jmp 0x6d4fe2
lea rdx, [0x00788a60]
mov r8d, 3
call fcn.006a5580
test eax, eax
jne 0x6d5027
add rbx, 3
jmp 0x6d4fe2
test edi, edi
jne 0x6d5027
cmp eax, 0x5e
jne 0x6d5027
lea edi, [rax - 0x5d]
jmp 0x6d4fe2
cmp byte [rbx + 1], 0x5d
lea rax, [rbx + 1]
jne 0x6d503b
bt dword [r14 + 0x68], 0x19
cmovae rbx, rax
movzx eax, byte [rbx + 1]
inc rbx
cmp al, 0x5d
je 0x6d516d
nop word [rax + rax]
test al, al
je 0x6d50ba
cmp al, 0x5c
jne 0x6d508b
movzx eax, byte [rbx + 1]
inc rbx
test al, al
je 0x6d50ba
cmp al, 0x51
jne 0x6d508b
nop word [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test al, al
je 0x6d50ba
cmp al, 0x5c
jne 0x6d5070
test al, al
je 0x6d50ba
inc rbx
cmp byte [rbx], 0x45
jne 0x6d5070
mov al, byte [rbx + 1]
inc rbx
cmp al, 0x5d
jne 0x6d5050
jmp 0x6d516d
test r13d, r13d
je 0x6d50da
cmp al, 0x23
jne 0x6d50da
movzx eax, byte [rbx + 1]
inc rbx
test al, al
je 0x6d50ba
cmp al, 0xa
jne 0x6d50a3
test al, al
jne 0x6d516d
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp al, 0x28
jne 0x6d516d
movzx eax, byte [rbx + 1]
cmp al, 0x3f
je 0x6d50fa
cmp al, 0x2a
je 0x6d50fa
inc esi
test rbp, rbp
jne 0x6d516d
cmp esi, r12d
jmp 0x6d516b
add rbx, 2
cmp byte [rbx], 0x50
jne 0x6d5106
inc rbx
movzx ecx, byte [rbx]
cmp cl, 0x3c
jne 0x6d511a
movzx eax, byte [rbx + 1]
cmp al, 0x21
je 0x6d511a
cmp al, 0x3d
jne 0x6d511f
cmp cl, 0x27
jne 0x6d516d
inc esi
test rbp, rbp
jne 0x6d512b
cmp esi, r12d
je 0x6d5180
movzx eax, byte [rbx + 1]
inc rbx
movzx ecx, cl
cmp ecx, 0x3c
mov rdx, rbx
cmove ecx, r15d
cmp eax, ecx
je 0x6d514e
movzx eax, byte [rbx + 1]
inc rbx
cmp eax, ecx
jne 0x6d5143
test rbp, rbp
je 0x6d516d
mov rax, rbx
mov r8, r12
sub rax, rdx
cmp r12, rax
jne 0x6d516d
mov rcx, rbp
call fcn.006a5580
test eax, eax
je 0x6d5180
mov al, byte [rbx + 1]
inc rbx
test al, al
jne 0x6d4f91
jmp 0x6d50ba
mov eax, esi
jmp 0x6d50bd
Function at 0x6df980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov qword [rsp + 0x40], rbp
mov rsi, rcx
mov qword [rsp + 0x48], r13
nop dword [rax]
mov edx, dword [rsi + 0x94]
mov r12d, dword [rsi + 0x58]
mov eax, dword [rsi + 0x44]
sub r12d, dword [rsi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub r12d, edx
cmp edx, ecx
jb 0x6dfa3d
mov rcx, qword [rsi + 0x50]
mov r8d, ebx
lea rdx, [rcx + rbx]
call fcn.006e1610
mov r8d, dword [rsi + 0x74]
mov rax, qword [rsi + 0x68]
sub dword [rsi + 0x98], ebx
sub dword [rsi + 0x94], ebx
sub dword [rsi + 0x84], ebx
lea rdx, [rax + r8*2]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x6dfa00
sub eax, ebx
jmp 0x6dfa02
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x6df9f0
mov rax, qword [rsi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x6dfa30
sub eax, ebx
jmp 0x6dfa32
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x6dfa20
add r12d, ebx
mov rdi, qword [rsi]
cmp dword [rdi + 8], 0
je 0x6dfb15
mov eax, dword [rsi + 0x94]
mov r13d, dword [rsi + 0x9c]
add r13, rax
mov eax, dword [rdi + 8]
add r13, qword [rsi + 0x50]
cmp eax, r12d
mov ebp, eax
cmova ebp, r12d
test ebp, ebp
je 0x6dfabf
sub eax, ebp
mov dword [rdi + 8], eax
mov rax, qword [rdi + 0x28]
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x6dfa92
mov rdx, qword [rdi]
mov ecx, dword [rdi + 0x4c]
mov r8d, ebp
call fcn.006e20f0
mov dword [rdi + 0x4c], eax
jmp 0x6dfaa8
cmp ecx, 2
jne 0x6dfaa8
mov rdx, qword [rdi]
mov ecx, dword [rdi + 0x4c]
mov r8d, ebp
call fcn.006e15c0
mov dword [rdi + 0x4c], eax
mov rdx, qword [rdi]
mov r8d, ebp
mov rcx, r13
call fcn.006e1610
mov r11d, ebp
add qword [rdi], r11
add dword [rdi + 0xc], ebp
add dword [rsi + 0x9c], ebp
mov r9d, dword [rsi + 0x9c]
cmp r9d, 3
jb 0x6dfaff
mov eax, dword [rsi + 0x94]
mov rdx, qword [rsi + 0x50]
mov ecx, dword [rsi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rsi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rsi + 0x7c]
mov dword [rsi + 0x70], r8d
cmp r9d, 0x106
jae 0x6dfb15
mov rax, qword [rsi]
cmp dword [rax + 8], 0
jne 0x6df9a0
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret