joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004b80
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140078010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140004bef
call fcn.140042430
cmp dword [rax], 4
je 0x140004bc0
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400339a0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x140004c20
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140078010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140004c8e
call fcn.140042430
cmp dword [rax], 4
je 0x140004c60
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400339a0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x140004cc0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140078010]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor eax, eax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], rax
mov rdi, rcx
mov dword [rsp + 0x40], 1
nop word [rax + rax]
lea rax, [rsp + 0x38]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x140004d2e
call fcn.140042430
cmp dword [rax], 4
je 0x140004d00
test ebx, ebx
jne 0x140004d36
mov al, 1
jmp 0x140004d93
jns 0x140004d46
call fcn.140042430
cmp dword [rax], 9
jne 0x140004d46
xor al, al
jmp 0x140004d93
mov qword [rsp + 0x270], rsi
lea rsi, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov r9d, 2
mov rdx, rsi
mov rcx, rdi
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jns 0x140004d86
call fcn.140042430
cmp dword [rax], 4
je 0x140004d60
mov rsi, qword [rsp + 0x270]
test ebx, ebx
setg al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400339a0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x1400053d0
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
sub rsp, 0x4f8
mov rax, qword [0x140078010]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rsi, r8
mov dword [rsp + 0x40], 0x80
mov rdi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x1400054c2
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rbx
mov ebx, dword [rsp + 0x40]
cmp ax, 2
je 0x140005433
cmp ax, 0x17
jne 0x1400054ba
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov dword [rsi], eax
mov r8d, 0x401
call fcn.140037d70
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x1400054ba
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400054a0
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call fcn.14001edd0
mov rbx, qword [rsp + 0x4f0]
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.1400339a0
add rsp, 0x4f8
pop rdi
pop rsi
ret
mov rcx, qword [rcx + 8]
jmp 0x1400053d0

Function at 0x140009730
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
mov rsi, qword [rcx + 0x50]
mov eax, 0x7fffffff
cmp r8, rax
mov rdi, r8
mov r14, rdx
mov rbx, rcx
cmova rdi, rax
mov rax, qword [rcx + 0x48]
cmp rax, rsi
jae 0x1400097a1
mov rcx, qword [rcx + 0x30]
sub rsi, rax
lea rdx, [rax + rcx]
mov rcx, r14
cmp rdi, rsi
ja 0x140009788
mov r8, rdi
call fcn.140038130
add qword [rbx + 0x48], rdi
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rsi
call fcn.140038130
add qword [rbx + 0x48], rsi
mov rax, rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test al, al
jne 0x1400097bc
mov rax, 0xffffffffffffffff
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x68], rbp
mov rbp, qword [rbx + 8]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
cmp rdi, 0x1000
jae 0x140009870
mov qword [rsp + 0x20], r15
mov r15, qword [rbx + 0x30]
nop word [rax + rax]
xor r9d, r9d
mov r8d, 0x1000
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rsi, eax
test eax, eax
jns 0x140009816
call fcn.140042430
cmp dword [rax], 4
je 0x1400097f0
mov r15, qword [rsp + 0x20]
test rsi, rsi
jle 0x140009834
mov rdx, qword [rbx + 0x30]
mov rcx, r14
cmp rsi, rdi
jg 0x140009846
mov r8, rsi
call fcn.140038130
mov rbp, qword [rsp + 0x68]
mov rax, rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rdi
call fcn.140038130
mov rbp, qword [rsp + 0x68]
mov rax, rdi
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x50], rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x140009893
call fcn.140042430
cmp dword [rax], 4
je 0x140009870
mov rbp, qword [rsp + 0x68]
mov rax, rbx
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400098b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
jne 0x1400098e9
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rdi, qword [rdi + 8]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x140009915
call fcn.140042430
cmp dword [rax], 4
je 0x1400098f2
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140009930
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
sub rsp, 0x4f8
mov rax, qword [0x140078010]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rsi, r8
mov dword [rsp + 0x40], 0x80
mov rdi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x1400054c2
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rbx
mov ebx, dword [rsp + 0x40]
cmp ax, 2
je 0x140005433
cmp ax, 0x17
jne 0x1400054ba
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov dword [rsi], eax
mov r8d, 0x401
call fcn.140037d70
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x1400054ba
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400054a0
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call fcn.14001edd0
mov rbx, qword [rsp + 0x4f0]
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.1400339a0
add rsp, 0x4f8
pop rdi
pop rsi
ret
mov rcx, qword [rcx + 8]
jmp 0x1400053d0
Function at 0x140011850
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x58
mov rax, qword [0x140078010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x28], rcx
cmp qword [rcx + 0x20], 0x10
lea rsi, [rcx + 8]
mov rbp, rdx
mov byte [rsp + 0x20], 0
mov edi, 2
mov r15d, ebx
mov rdx, rsi
jb 0x140011894
mov rdx, qword [rsi]
lea r8, [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1400118b0
mov r15d, reloc.WS2_32.dll_recv
jmp 0x1400118d4
cmp qword [rsi + 0x18], 0x10
jb 0x1400118ba
mov rsi, qword [rsi]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1400118d9
mov r15d, 4
mov edi, 7
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
lea edx, [r9 + 0x55]
call qword [sym.imp.libcrypto_1_1_x64.dll_X509_get_ext_d2i]
mov r12, rax
test rax, rax
je 0x1400119c5
mov qword [rsp + 0xa0], r13
mov rcx, rax
mov qword [rsp + 0x50], r14
xor r13b, r13b
xor r14b, r14b
call qword [sym.imp.libcrypto_1_1_x64.dll_OPENSSL_sk_num]
mov dword [rsp + 0x24], eax
test eax, eax
jle 0x1400119b8
test r14b, r14b
jne 0x1400119b3
mov edx, ebx
mov rcx, r12
call qword [sym.imp.libcrypto_1_1_x64.dll_OPENSSL_sk_value]
mov rsi, rax
cmp dword [rax], edi
jne 0x14001199d
mov rcx, qword [rax + 8]
call qword [sym.imp.libcrypto_1_1_x64.dll_ASN1_STRING_get0_data]
mov rcx, qword [rsi + 8]
mov rbp, rax
call qword [sym.imp.libcrypto_1_1_x64.dll_ASN1_STRING_length]
movsxd r8, eax
cmp edi, 2
je 0x14001198c
cmp edi, 7
jne 0x14001199d
mov r8, r15
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.1400387d0
test eax, eax
je 0x140011987
mov r8, r15
lea rcx, [rsp + 0x30]
mov rdx, rbp
call fcn.1400387d0
test eax, eax
jne 0x14001199d
mov r13b, 1
jmp 0x14001199d
mov rcx, qword [rsp + 0x28]
mov rdx, rbp
call fcn.1400119f0
movzx r14d, al
inc ebx
cmp ebx, dword [rsp + 0x24]
jl 0x140011920
test r14b, r14b
jne 0x1400119b3
test r13b, r13b
je 0x1400119b8
mov byte [rsp + 0x20], 1
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.libcrypto_1_1_x64.dll_GENERAL_NAMES_free]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400339a0
add rsp, 0x58
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400127f0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
movups xmm0, xmmword [0x14006b8a8]
mov eax, dword [0x14006b8e0]
xor r8d, r8d
cmp dword [0x140078018], 2
mov rbx, rcx
movups xmm1, xmmword [0x14006b8b8]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x14006b8c8]
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x14006b8d8]
movsd qword [rsp + 0x70], xmm0
jl 0x1400129c6
movdqa xmm0, xmmword [0x14006c750]
lea rcx, [r11 - 0x74]
movdqa xmm5, xmmword [0x14006c6f0]
mov eax, 5
movdqa xmm4, xmmword [0x14006c780]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x14006c710]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x30]
movaps xmmword [r11 - 0x38], xmm8
movd xmm8, eax
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14006c730]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14006c730]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x38
jl 0x1400128a0
movaps xmm8, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
cmp r8d, 0x3c
jge 0x140012a05
movsxd rax, r8d
lea r9, [rsp + 0x40]
add r9, rax
mov eax, 0xa0a0a0a1
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x32
xor byte [r9 - 1], al
cmp r8d, 0x3c
jl 0x1400129d1
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140012440
mov rax, rbx
add rsp, 0xb0
pop rbx
ret
Function at 0x14001cc60
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14001cc82
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001ccfc
mov rdi, r14
mov rcx, rbx
call fcn.140020e30
test rax, rax
jle 0x14001ccd4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140038130
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001ccec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14001ccf4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14001cc96
sub r14, rdi
jmp 0x14001cddf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14001cd13
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001cd15
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001cd47
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140038130
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14001cddc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001cd82
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14001cdbd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140042dc4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14001cddc
cmp rbp, rax
ja 0x14001cd90
test rbp, rbp
je 0x14001cddc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140042dc4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140025570
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x140078010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbp, rcx
mov r15, r9
mov rcx, r8
mov rsi, r8
mov rdi, rdx
call fcn.140035bf8
test eax, eax
jne 0x140025704
mov eax, dword [rsi + 0x4c]
cmp eax, 0x7fffffff
je 0x1400256f4
mov rcx, rdi
call qword [sym.imp.libssl_1_1_x64.dll_SSL_new]
mov rcx, rsi
mov rdi, rax
call fcn.140035c00
test rdi, rdi
je 0x140025684
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 1
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor edx, edx
mov ecx, ebp
call qword [sym.imp.libcrypto_1_1_x64.dll_BIO_new_socket]
xor r9d, r9d
mov rcx, rax
mov r14, rax
lea edx, [r9 + 0x66]
lea r8d, [r9 + 1]
call qword [sym.imp.libcrypto_1_1_x64.dll_BIO_ctrl]
mov r8, r14
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.libssl_1_1_x64.dll_SSL_set_bio]
mov r9, qword [rsp + 0x80]
add r9, 8
cmp qword [r9 + 0x18], 0x10
jb 0x140025637
mov r9, qword [r9]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 0x37]
call qword [sym.imp.libssl_1_1_x64.dll_SSL_ctrl]
mov rdx, rdi
mov rcx, r15
call fcn.140011430
cmp al, 1
jne 0x1400256a5
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
lea edx, [r9 + 0x66]
call qword [sym.imp.libcrypto_1_1_x64.dll_BIO_ctrl]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, rdi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400339a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.libssl_1_1_x64.dll_SSL_shutdown]
mov rcx, rsi
call fcn.140035bf8
test eax, eax
jne 0x140025704
mov eax, dword [rsi + 0x4c]
cmp eax, 0x7fffffff
je 0x1400256f4
mov rcx, rdi
call qword [sym.imp.libssl_1_1_x64.dll_SSL_free]
mov rcx, rsi
call fcn.140035c00
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor eax, eax
jmp 0x140025687
dec eax
mov ecx, 6
mov dword [rsi + 0x4c], eax
call fcn.140034e28
int3
mov ecx, 5
call fcn.140034e28
int3

Function at 0x140027370
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400273a4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140027390
ret
Function at 0x140030880
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14003094c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14003094c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140030965
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14003093c
cmp byte [rax], 0x5c
jne 0x140030936
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140030936
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140030922
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140030933
test r8b, 0x10
jne 0x140030936
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140030936
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.14002b9d0
test edi, edi
jne 0x1400308a0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.14002b9c0
int3

Function at 0x140033880
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x140078010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov byte [rsp + 0x30], sil
mov qword [r11 - 0x44], rsi
mov dword [rsp + 0x7c], 0x67452301
mov dword [r11 - 0x38], 0xefcdab89
mov dword [r11 - 0x34], 0x98badcfe
mov dword [r11 - 0x30], 0x10325476
cmp qword [rdx + 0x18], 0x10
jb 0x1400338ea
mov rdx, qword [rdx]
mov r8d, dword [rbx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.140033440
lea rcx, [rsp + 0x30]
call fcn.140033510
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140033780
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140033946
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140033941
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003397d
mov rcx, r8
call fcn.1400339c0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400339a0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400435d4
int3

Function at 0x140034754
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003479e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003479e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003479e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003479e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003479e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400347a0
xor al, al
add rsp, 0x28
ret
Function at 0x14003c680
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14003c4eb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003c4eb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003c4eb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003c4eb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003c4eb
cmp dword [rcx + 0x84], 0xe
jbe 0x14003c4eb
cmp dword [rcx + 0xf8], 0
je 0x14003c4eb
mov ecx, ebx
call fcn.14003c59c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14003c378
nop
cmp dword [rbp + 0x20], 0
je 0x14003c539
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14003c544
int3
xor r8d, r8d
xor edx, edx
jmp 0x14003c47c

Function at 0x140041be8
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov r14, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.14003c120
mov rax, qword [rbp - 0x58]
mov edi, 0xfde9
cmp dword [rax + 0xc], edi
jne 0x140041c33
xor ebx, ebx
cmp byte [rbp - 0x48], bl
je 0x140041c67
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140041c67
call fcn.14004a320
xor ebx, ebx
test eax, eax
jne 0x140041c55
cmp byte [rbp - 0x48], bl
je 0x140041c4e
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
mov edi, 1
jmp 0x140041c67
cmp byte [rbp - 0x48], bl
je 0x140041c65
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
mov edi, ebx
mov r9d, edi
mov qword [rbp - 0x30], rbx
lea r8, [rbp + 0x30]
mov qword [rbp - 0x28], rbx
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x20], rbx
mov rcx, rsi
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
mov byte [rbp - 8], bl
call fcn.14003cf1c
mov esi, eax
test eax, eax
je 0x140041ca3
call fcn.140042430
or edi, 0xffffffff
mov dword [rax], esi
jmp 0x140041cfc
mov r9d, edi
mov qword [rbp - 0x60], rbx
lea r8, [rbp + 0x30]
mov qword [rbp - 0x58], rbx
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x50], rbx
mov rcx, r14
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov byte [rbp - 0x38], bl
call fcn.14003cf1c
mov edi, eax
test eax, eax
je 0x140041cdf
call fcn.140042430
mov dword [rax], edi
or edi, 0xffffffff
jmp 0x140041cee
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x20]
call fcn.14004df9c
mov edi, eax
cmp byte [rbp - 0x38], bl
je 0x140041cfc
mov rcx, qword [rbp - 0x50]
call fcn.140049a4c
cmp byte [rbp - 8], bl
je 0x140041d0a
mov rcx, qword [rbp - 0x20]
call fcn.140049a4c
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140048830
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140048846
mov al, 1
jmp 0x1400488a6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140048857
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400488a4
mov ecx, dword [rcx + 0x18]
nop
call fcn.140052100
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400488a4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400488a4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400488a4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400488a6
xor al, al
add rsp, 0x20
pop rbx
ret