Function at 0x14002e880
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours
Parse credit card information

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r12, r9
mov rdi, r8
mov r15, rdx
mov rsi, rcx
test r8, r8
je 0x14002e8a8
mov qword [rdi], 0
mov r13, qword [rsp + 0xc0]
test r12, r12
je 0x14002e8bd
mov qword [r12], 0
test r13, r13
je 0x14002e8ca
mov qword [r13], 0
test r15, r15
je 0x14002e9b5
mov ebp, dword [0x140045b90]
call sub.KERNEL32.dll_GetCurrentThreadId
mov ebx, 0x10dd
cmp ebp, eax
jne 0x14002e9ba
mov ebx, dword [0x140045bb0]
test ebx, ebx
jne 0x14002e9ba
mov ebx, 6
test rsi, rsi
je 0x14002e9ba
mov rcx, qword [rsi]
test rcx, rcx
je 0x14002e9cd
xor ebx, ebx
xor edx, edx
call fcn.14002f770
mov r14, rax
mov rcx, r15
xor edx, edx
call fcn.14002f770
cmp rax, r14
je 0x14002e9e0
test r12, r12
je 0x14002e93b
mov qword [r12], r14
test r13, r13
je 0x14002e944
mov qword [r13], rax
mov qword [rsp + 0x50], rax
mov ecx, 0x30
call fcn.1400318b4
lea rcx, [r14 - 0x7ff80000]
cmp r14, 0x7ff80001
mov r13d, 0x80000
cmovae r13, rcx
mov r15, rax
lea rax, [r14 + 0x7ff80000]
cmp r14, 0xffffffff80000000
mov rbp, 0xfffffffffff80000
cmovb rbp, rax
movzx eax, byte [r14]
cmp eax, 0xe9
je 0x14002e9f8
cmp eax, 0xff
jne 0x14002ea39
cmp byte [r14 + 1], 0x25
jne 0x14002ea39
movsxd rax, dword [r14 + 2]
add rax, r14
add rax, 6
jmp 0x14002ea03
mov ebx, 0x57
mov eax, ebx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [0x140045bb0], 6
mov qword [0x140045ba8], rsi
jmp 0x14002e9ba
cmp dword [0x140045b88], 0
jne 0x14002f309
xor r12d, r12d
xor r15d, r15d
jmp 0x14002f2a9
movsxd rax, dword [r14 + 1]
add rax, r14
add rax, 5
cmp rax, r14
jae 0x14002ea22
lea rcx, [rax + 0x7ff80000]
cmp rax, 0xffffffff80000000
mov rbp, 0xfffffffffff80000
cmovb rbp, rcx
jmp 0x14002ea39
lea rcx, [rax - 0x7ff80000]
cmp rax, 0x7ff80001
mov r13d, 0x80000
cmovae r13, rcx
mov rax, qword [0x140045bc0]
mov rcx, qword [0x140045bb8]
test rax, rax
jne 0x14002ea5d
test rcx, rcx
je 0x14002ea5d
mov qword [0x140045bc0], rcx
mov rax, rcx
jmp 0x14002ea62
test rax, rax
je 0x14002ea79
mov r12, qword [rax + 0x10]
test r12, r12
je 0x14002ea79
cmp r12, r13
jb 0x14002ea79
cmp r12, rbp
jbe 0x14002eb9a
test rcx, rcx
je 0x14002eaab
mov rax, rcx
jmp 0x14002ea8c
mov rax, qword [rax + 8]
test rax, rax
je 0x14002eaab
mov r12, qword [rax + 0x10]
test r12, r12
je 0x14002ea83
cmp r12, r13
jb 0x14002ea83
cmp r12, rbp
ja 0x14002ea83
mov qword [0x140045bc0], rax
jmp 0x14002eb9a
mov qword [0x140045bc0], 0
mov rcx, r14
and rcx, 0xffffffffffff0000
mov rdx, r13
mov r8, rbp
call fcn.14002dce0
test rax, rax
je 0x14002ecbb
mov qword [0x140045bc0], rax
mov dword [rax], 0x52727464
mov rcx, qword [0x140045bb8]
mov qword [rax + 8], rcx
mov qword [0x140045bb8], rax
mov edx, 0x2a9
xor ecx, ecx
xor r8d, r8d
nop dword [rax]
lea r9, [rax + rcx]
add r9, 0xff60
mov qword [rax + rcx + 0xffa8], r8
lea r8, [rax + rcx + 0xff00]
mov qword [rax + rcx + 0xff48], r9
lea r9, [rax + rcx + 0xfea0]
mov qword [rax + rcx + 0xfee8], r8
lea r8, [rax + rcx + 0xfe40]
mov qword [rax + rcx + 0xfe88], r9
lea r9, [rax + rcx + 0xfde0]
mov qword [rax + rcx + 0xfe28], r8
lea r10, [rax + rcx + 0xfd80]
mov qword [rax + rcx + 0xfdc8], r9
lea r8, [rax + rcx]
add r8, 0xfd20
mov qword [rax + rcx + 0xfd68], r10
add rdx, 0xfffffffffffffff9
add rcx, 0xfffffffffffffd60
cmp rdx, 2
ja 0x14002eb00
lea r12, [rax + rcx]
add r12, 0xffc0
mov qword [rax + 0x10], r12
mov ebx, 8
cmp r12, r13
jb 0x14002ec88
cmp r12, rbp
ja 0x14002ec88
mov rcx, qword [r12 + 0x48]
mov qword [rax + 0x10], rcx
movaps xmm0, xmmword [0x140035ec0]
movups xmmword [r12 + 0x50], xmm0
movups xmmword [r12 + 0x40], xmm0
movups xmmword [r12 + 0x30], xmm0
movups xmmword [r12 + 0x20], xmm0
movups xmmword [r12 + 0x10], xmm0
movups xmmword [r12], xmm0
test rdi, rdi
je 0x14002ebec
mov qword [rdi], r12
mov qword [r12 + 0x40], 0
lea rax, [r12 + 0x1e]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov rcx, r12
mov r8, r14
xor r9d, r9d
call fcn.140030d20
mov rbx, rax
mov rbp, rax
sub rbp, r14
movsxd rax, dword [rsp + 0x34]
add rax, rbp
lea r13, [r12 + rax]
mov ecx, ebp
and cl, 7
shl al, 3
or al, cl
mov byte [r12 + 0x40], al
movzx eax, byte [r14]
lea ecx, [rax - 0xc2]
cmp ecx, 0x3d
mov qword [rsp + 0x40], r15
ja 0x14002ec90
movabs rdx, 0x28040000403
bt rdx, rcx
jb 0x14002f183
cmp rcx, 0x31
je 0x14002ecc8
cmp rcx, 0x3d
jne 0x14002ec90
cmp byte [r14 + 1], 0x25
jne 0x14002ecd3
jmp 0x14002f183
xor r12d, r12d
jmp 0x14002f2a9
add eax, 0xffffffda
cmp eax, 0x3f
ja 0x14002ecd3
movabs rcx, 0xc000000001010101
bt rcx, rax
jae 0x14002ecd3
cmp byte [r14 + 1], 0xff
jne 0x14002ecd3
cmp byte [r14 + 2], 0x25
jne 0x14002ecd3
jmp 0x14002f183
mov ebx, 8
xor r12d, r12d
jmp 0x14002f2a9
cmp byte [r14 + 1], 0xc3
je 0x14002f183
cmp ebp, 4
ja 0x14002f183
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov rcx, r13
mov r8, rbx
xor r9d, r9d
call fcn.140030d20
mov rdx, r13
mov r13, rax
sub rax, rbx
movsxd rcx, dword [rsp + 0x34]
add rcx, rax
add rdx, rcx
mov rbp, r13
sub rbp, r14
mov eax, ebp
and al, 7
mov r8, rdx
mov ecx, edx
sub ecx, r12d
shl cl, 3
or cl, al
mov byte [r12 + 0x41], cl
movzx eax, byte [rbx]
lea ecx, [rax - 0xc2]
cmp ecx, 0x3d
ja 0x14002ed6b
movabs rdx, 0x28040000403
bt rdx, rcx
jb 0x14002f17d
cmp rcx, 0x31
je 0x14002ed94
cmp rcx, 0x3d
jne 0x14002ed6b
cmp byte [rbx + 1], 0x25
je 0x14002f17d
jmp 0x14002ed9e
add eax, 0xffffffda
cmp eax, 0x3f
ja 0x14002ed9e
movabs rcx, 0xc000000001010101
bt rcx, rax
jae 0x14002ed9e
cmp byte [rbx + 1], 0xff
jne 0x14002ed9e
cmp byte [rbx + 2], 0x25
jne 0x14002ed9e
jmp 0x14002f17d
cmp byte [rbx + 1], 0xc3
je 0x14002f17d
cmp ebp, 4
ja 0x14002f17d
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov r15, r8
mov rcx, r8
mov r8, r13
xor r9d, r9d
call fcn.140030d20
mov rbx, rax
sub rax, r13
movsxd rcx, dword [rsp + 0x34]
add rcx, rax
add r15, rcx
mov rbp, rbx
sub rbp, r14
mov eax, ebp
and al, 7
mov r8, r15
mov ecx, r15d
sub ecx, r12d
shl cl, 3
or cl, al
mov byte [r12 + 0x42], cl
movzx eax, byte [r13]
lea ecx, [rax - 0xc2]
cmp ecx, 0x3d
ja 0x14002ee39
movabs rdx, 0x28040000403
bt rdx, rcx
jb 0x14002f180
cmp rcx, 0x31
je 0x14002ee64
cmp rcx, 0x3d
jne 0x14002ee39
cmp byte [r13 + 1], 0x25
jne 0x14002ee6f
jmp 0x14002f180
add eax, 0xffffffda
cmp eax, 0x3f
ja 0x14002ee6f
movabs rcx, 0xc000000001010101
bt rcx, rax
jae 0x14002ee6f
cmp byte [r13 + 1], 0xff
jne 0x14002ee6f
cmp byte [r13 + 2], 0x25
jne 0x14002ee6f
jmp 0x14002f180
cmp byte [r13 + 1], 0xc3
je 0x14002f180
cmp ebp, 4
ja 0x14002f180
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov r15, r8
mov rcx, r8
mov r8, rbx
xor r9d, r9d
call fcn.140030d20
mov r13, rax
sub rax, rbx
movsxd rcx, dword [rsp + 0x34]
add rcx, rax
add r15, rcx
mov rbp, r13
sub rbp, r14
mov eax, ebp
and al, 7
mov r8, r15
mov ecx, r15d
sub ecx, r12d
shl cl, 3
or cl, al
mov byte [r12 + 0x43], cl
movzx eax, byte [rbx]
lea ecx, [rax - 0xc2]
cmp ecx, 0x3d
ja 0x14002ef08
movabs rdx, 0x28040000403
bt rdx, rcx
jb 0x14002f17d
cmp rcx, 0x31
je 0x14002ef32
cmp rcx, 0x3d
jne 0x14002ef08
cmp byte [rbx + 1], 0x25
je 0x14002f17d
jmp 0x14002ef3c
add eax, 0xffffffda
cmp eax, 0x3f
ja 0x14002ef3c
movabs rcx, 0xc000000001010101
bt rcx, rax
jae 0x14002ef3c
cmp byte [rbx + 1], 0xff
jne 0x14002ef3c
cmp byte [rbx + 2], 0x25
je 0x14002f17d
jmp 0x14002ef3c
cmp byte [rbx + 1], 0xc3
je 0x14002f17d
cmp ebp, 4
ja 0x14002f17d
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov r15, r8
mov rcx, r8
mov r8, r13
xor r9d, r9d
call fcn.140030d20
mov rbx, rax
sub rax, r13
movsxd rcx, dword [rsp + 0x34]
add rcx, rax
add r15, rcx
mov rbp, rbx
sub rbp, r14
mov eax, ebp
and al, 7
mov r8, r15
mov ecx, r15d
sub ecx, r12d
shl cl, 3
or cl, al
mov byte [r12 + 0x44], cl
movzx eax, byte [r13]
lea ecx, [rax - 0xc2]
cmp ecx, 0x3d
ja 0x14002efd7
movabs rdx, 0x28040000403
bt rdx, rcx
jb 0x14002f180
cmp rcx, 0x31
je 0x14002f002
cmp rcx, 0x3d
jne 0x14002efd7
cmp byte [r13 + 1], 0x25
jne 0x14002f00d
jmp 0x14002f180
add eax, 0xffffffda
cmp eax, 0x3f
ja 0x14002f00d
movabs rcx, 0xc000000001010101
bt rcx, rax
jae 0x14002f00d
cmp byte [r13 + 1], 0xff
jne 0x14002f00d
cmp byte [r13 + 2], 0x25
jne 0x14002f00d
jmp 0x14002f180
cmp byte [r13 + 1], 0xc3
je 0x14002f180
cmp ebp, 4
ja 0x14002f180
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov r15, r8
mov rcx, r8
mov r8, rbx
xor r9d, r9d
call fcn.140030d20
mov r13, rax
sub rax, rbx
movsxd rcx, dword [rsp + 0x34]
add rcx, rax
add r15, rcx
mov rbp, r13
sub rbp, r14
mov eax, ebp
and al, 7
mov r8, r15
mov ecx, r15d
sub ecx, r12d
shl cl, 3
or cl, al
mov byte [r12 + 0x45], cl
movzx eax, byte [rbx]
lea ecx, [rax - 0xc2]
cmp ecx, 0x3d
ja 0x14002f0a6
movabs rdx, 0x28040000403
bt rdx, rcx
jb 0x14002f17d
cmp rcx, 0x31
je 0x14002f0d0
cmp rcx, 0x3d
jne 0x14002f0a6
cmp byte [rbx + 1], 0x25
je 0x14002f17d
jmp 0x14002f0da
add eax, 0xffffffda
cmp eax, 0x3f
ja 0x14002f0da
movabs rcx, 0xc000000001010101
bt rcx, rax
jae 0x14002f0da
cmp byte [rbx + 1], 0xff
jne 0x14002f0da
cmp byte [rbx + 2], 0x25
je 0x14002f17d
jmp 0x14002f0da
cmp byte [rbx + 1], 0xc3
je 0x14002f17d
cmp ebp, 4
ja 0x14002f17d
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov r15, r8
mov rcx, r8
mov r8, r13
xor r9d, r9d
call fcn.140030d20
mov rbx, rax
sub rax, r13
movsxd rcx, dword [rsp + 0x34]
add rcx, rax
add r15, rcx
mov rbp, rbx
sub rbp, r14
mov eax, ebp
and al, 7
mov r8, r15
mov ecx, r15d
sub ecx, r12d
shl cl, 3
or cl, al
mov byte [r12 + 0x46], cl
movzx eax, byte [r13]
lea ecx, [rax - 0xc2]
cmp ecx, 0x3d
ja 0x14002f31e
movabs rdx, 0x28040000403
bt rdx, rcx
jb 0x14002f180
cmp rcx, 0x31
je 0x14002f34a
cmp rcx, 0x3d
jne 0x14002f31e
cmp byte [r13 + 1], 0x25
je 0x14002f180
jmp 0x14002f355
mov rbx, r13
mov r13, r8
lea r15, [r12 + 0x48]
cmp ebp, 4
ja 0x14002f1c0
mov rcx, rbx
call fcn.14002f8e0
cdqe
add rbx, rax
mov rbp, rbx
sub rbp, r14
test eax, eax
jne 0x14002f188
cmp dword [0x140045b88], 0
je 0x14002f29f
mov ebx, 9
mov r15, qword [rsp + 0x40]
jmp 0x14002f2af
cmp r13, qword [rsp + 0x38]
jbe 0x14002f1c8
int3
sub r13, r12
mov qword [rsp + 0x48], r13
mov byte [r12 + 0x1e], r13b
mov byte [r12 + 0x3e], bpl
lea rcx, [r12 + 0x20]
mov r13d, ebp
mov rdx, r14
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov ebx, 6
cmp ebp, 0x19
ja 0x14002f2a4
mov rax, r14
add rax, r13
mov qword [r12 + 0x48], rax
mov rax, qword [rsp + 0x50]
mov qword [r12 + 0x50], rax
movzx eax, byte [rsp + 0x48]
lea rcx, [r12 + rax]
add rcx, 6
mov word [r12 + rax], 0x25ff
sub r15d, ecx
mov dword [r12 + rax + 2], r15d
mov r8, qword [rsp + 0x38]
cmp rcx, r8
jae 0x14002f240
sub r8, rcx
mov dl, 0xcc
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x34], 0
lea r9, [rsp + 0x34]
mov rcx, r14
mov rdx, r13
mov r8d, 0x40
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
mov r15, qword [rsp + 0x40]
je 0x14002f315
mov dword [r15 + 8], 0
mov qword [r15 + 0x10], rsi
mov qword [r15 + 0x20], r12
mov qword [r15 + 0x18], r14
mov eax, dword [rsp + 0x34]
mov dword [r15 + 0x28], eax
mov rax, qword [0x140045b98]
mov qword [r15], rax
mov qword [0x140045b98], r15
xor ebx, ebx
jmp 0x14002e9ba
mov ebx, 9
mov r15, qword [rsp + 0x40]
mov dword [0x140045bb0], ebx
test r12, r12
je 0x14002f2fc
mov rax, r12
and rax, 0xffffffffffff0000
xorps xmm0, xmm0
movups xmmword [r12 + 0x50], xmm0
movups xmmword [r12 + 0x40], xmm0
movups xmmword [r12 + 0x30], xmm0
movups xmmword [r12 + 0x20], xmm0
movups xmmword [r12 + 0x10], xmm0
movups xmmword [r12], xmm0
mov rcx, qword [rax + 0x10]
mov qword [r12 + 0x48], rcx
mov qword [rax + 0x10], r12
test rdi, rdi
je 0x14002f2fc
mov qword [rdi], 0
test r15, r15
je 0x14002f309
mov rcx, r15
call fcn.1400318f0
mov qword [0x140045ba8], rsi
jmp 0x14002e9ba
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
jmp 0x14002f2a9
add eax, 0xffffffda
cmp eax, 0x3f
ja 0x14002f355
movabs rcx, 0xc000000001010101
bt rcx, rax
jae 0x14002f355
cmp byte [r13 + 1], 0xff
jne 0x14002f355
cmp byte [r13 + 2], 0x25
je 0x14002f180
jmp 0x14002f355
cmp byte [r13 + 1], 0xc3
je 0x14002f180
cmp ebp, 4
ja 0x14002f180
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov r13, r8
mov rcx, r8
mov r8, rbx
xor r9d, r9d
call fcn.140030d20
mov rbp, rax
mov rcx, rax
sub rcx, rbx
movsxd rdx, dword [rsp + 0x34]
add rdx, rcx
add r13, rdx
mov rbx, rax
sub rbp, r14
mov eax, ebp
and al, 7
mov ecx, r13d
sub ecx, r12d
shl cl, 3
or cl, al
mov byte [r12 + 0x47], cl
jmp 0x14002f183