joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400343a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0x88
mov rax, qword [0x14009a040]
xor rax, rsp
mov qword [rbp + 7], rax
mov qword [rbp - 0x49], r9
mov r15, r8
mov r13, rdx
mov r14, rcx
xor esi, esi
mov dword [rbp - 0x51], esi
mov qword [rbp - 0x41], rdx
mov rbx, rdx
lea rax, [r8 - 1]
mov qword [rbp - 0x51], rax
mov r12, rax
sar r12, 1
cmp rdx, r12
jge 0x14003446d
lea rdi, [rbx + rbx]
lea rbx, [rdi + 2]
shl rbx, 5
add rbx, r14
lea rdx, [rbx - 0x20]
lea rcx, [rbp - 0x19]
call fcn.140002cac
or esi, 1
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140002cac
or esi, 2
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x39]
call fcn.140033544
movzx ebx, al
lea rcx, [rbp - 0x39]
call fcn.140002c48
nop
lea rcx, [rbp - 0x19]
call fcn.140002c48
xor rbx, 1
inc rbx
add rbx, rdi
mov rdx, rbx
shl rdx, 5
add rdx, r14
shl r13, 5
lea rcx, [r14 + r13]
call fcn.140009724
mov r13, rbx
cmp rbx, r12
jl 0x1400343f3
mov rdi, rbx
cmp rbx, r12
jne 0x140034497
test r15b, 1
jne 0x140034497
shl r15, 5
lea rdx, [r14 - 0x20]
add rdx, r15
shl rbx, 5
lea rcx, [r14 + rbx]
call fcn.140009724
mov rdi, qword [rbp - 0x51]
lea rbx, [rdi - 1]
mov r12, qword [rbp - 0x49]
mov r13, qword [rbp - 0x41]
sar rbx, 1
cmp r13, rdi
jge 0x1400344f2
mov rdx, r12
lea rcx, [rbp - 0x39]
call fcn.140002cac
or esi, 0x10
or esi, 4
mov dword [rbp - 0x51], esi
mov rdx, rbx
shl rdx, 5
add rdx, r14
lea rcx, [rbp - 0x19]
call fcn.140002cac
or esi, 0x20
or esi, 8
mov dword [rbp - 0x51], esi
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.140033544
test al, al
je 0x1400344f2
mov r15b, 1
jmp 0x1400344f5
xor r15b, r15b
test sil, 8
je 0x140034508
and esi, 0xfffffff7
lea rcx, [rbp - 0x19]
call fcn.140002c48
nop
test sil, 4
je 0x14003451a
and esi, 0xfffffffb
lea rcx, [rbp - 0x39]
call fcn.140002c48
shl rdi, 5
lea rcx, [rdi + r14]
test r15b, r15b
je 0x140034541
mov rdx, rbx
shl rdx, 5
add rdx, r14
call fcn.140009724
mov rdi, rbx
dec rbx
jmp 0x1400344a3
mov rdx, r12
call fcn.140009724
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140075300
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400366d8
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x140036732
mov r11b, 0x23
lea rbx, [0x14007c4e0]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x14003671c
cmp rdx, 2
jb 0x14003671c
cmp byte [r10], r11b
jne 0x14003671c
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x1400366fa
jmp 0x140036773
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x140036773
mov r11b, 0x23
lea rbx, [0x14007c4e0]
cmp dl, r11b
jne 0x140036757
cmp byte [r10], r11b
jne 0x140036757
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x140036745
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x1400368a8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x1400368c8
and qword [r8], 0
lea rdx, [0x14008c23c]
call fcn.140036784
mov rbx, rax
test rax, rax
je 0x1400369b9
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400369b0
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400369b0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400369b0
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400369b0
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x1400369b0
mov rax, qword [0x140148ae8]
test rax, rax
je 0x14003694d
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400369b0
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x14003699d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140148ae8]
test rax, rax
je 0x140036992
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400369b9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1400369ab
mov qword [rsi], rbp
mov rax, rdi
jmp 0x1400369bb
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003946c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov r10d, 4
mov rax, qword [rcx + 0xf0]
mov r9d, r10d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x38]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x14007c4e0]
xor ebx, dword [rax + rcx*4]
sub r9, 1
jne 0x140039498
mov rcx, qword [0x140148ae8]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x1400394d6
movsxd r8, edx
mov ecx, ebx
mov edx, r10d
call fcn.14004a234
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400394e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm2, dword [rcx + 0x108]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x10c]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xf0]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xe8]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x14007c4e0]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x14003954e
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140048ec4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c50], 0
lea rbx, [rcx + 0x5c58]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140048f5d
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x140048f15
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14004b18c
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140037250
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c50]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x140148ad5]
movsxd r8, eax
mov rax, qword [rdi + 0x5c60]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140048f65
mov rcx, rbx
call fcn.140037250
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14004974c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140148ae8]
mov rbx, rcx
and dword [rax + 0x5bb4], 0
test rcx, rcx
je 0x1400497b5
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.1400497c0
lea rdx, [0x14008c254]
mov rcx, rbx
mov rdi, rax
call fcn.140036784
mov rbx, rax
test rax, rax
je 0x1400497b5
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140074ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, rdx
lea rdx, [0x140147680]
cmp qword [0x140147698], 0xf
cmova rdx, qword [0x140147680]
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
mov r8, qword [0x140147690]
test r8, r8
je 0x140074b34
movzx eax, byte [rdx + rcx]
xor rdi, rax
movabs r9, 0x100000001b3
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x140074b17
mov r9, rdi
lea r8, [0x140147680]
lea rdx, [rsp + 0x20]
call fcn.140075234
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140074b5f
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x140074cae
movabs rax, 0x3ffffffffffffff
cmp qword [0x14014a310], rax
jne 0x140074b80
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x14014a308]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x38], 0
mov ecx, 0x40
call fcn.140075320
mov rsi, rax
mov qword [rsp + 0x38], rax
lea rdx, [0x140147680]
lea rcx, [rax + 0x10]
call fcn.140002f68
xor eax, eax
mov qword [rsi + 0x30], rax
mov dword [rsi + 0x38], eax
mov r8, qword [0x14014a310]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140074bd7
cvtsi2ss xmm0, rcx
jmp 0x140074bec
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14014a338]
xorps xmm1, xmm1
test rcx, rcx
js 0x140074c02
cvtsi2ss xmm1, rcx
jmp 0x140074c17
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14014a300]
jbe 0x140074c4a
call fcn.140074f54
lea r8, [rsi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
call fcn.140075234
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov r8, qword [0x14014a310]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x14014a310], r8
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rdx], rsi
mov qword [rcx + 8], rsi
and rdi, qword [0x14014a330]
add rdi, rdi
mov rax, qword [0x14014a318]
mov r8, qword [rax + rdi*8]
cmp r8, qword [0x14014a308]
jne 0x140074c8f
mov qword [rax + rdi*8], rsi
jmp 0x140074ca1
cmp r8, rcx
jne 0x140074c9a
mov qword [rax + rdi*8], rsi
jmp 0x140074ca6
cmp qword [rax + rdi*8 + 8], rdx
jne 0x140074ca6
mov qword [rax + rdi*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x140074cc8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, r8
mov rsi, rdx
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140074cf0
mov rdx, qword [r8]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
cmp qword [r8 + 0x10], rcx
jbe 0x140074d20
movzx eax, byte [rdx + rcx]
xor rbx, rax
movabs r8, 0x100000001b3
imul rbx, r8
inc rcx
cmp rcx, qword [r14 + 0x10]
jb 0x140074d02
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x20]
call fcn.140075234
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140074d46
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x140074eb7
movabs rax, 0x3ffffffffffffff
cmp qword [0x14014a310], rax
jne 0x140074d67
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x14014a308]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x38], 0
mov ecx, 0x40
call fcn.140075320
mov rdi, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
and qword [rax + 0x20], 0
and qword [rax + 0x28], 0
movups xmm0, xmmword [r14]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rax + 0x20], xmm1
and qword [r14 + 0x10], 0
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
xor eax, eax
mov qword [rdi + 0x30], rax
mov dword [rdi + 0x38], eax
mov r8, qword [0x14014a310]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140074de1
cvtsi2ss xmm0, rcx
jmp 0x140074df6
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14014a338]
xorps xmm1, xmm1
test rcx, rcx
js 0x140074e0c
cvtsi2ss xmm1, rcx
jmp 0x140074e21
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14014a300]
jbe 0x140074e54
call fcn.140074f54
lea r8, [rdi + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
call fcn.140075234
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov r8, qword [0x14014a310]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x14014a310], r8
mov qword [rdi], rcx
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rcx + 8], rdi
and rbx, qword [0x14014a330]
add rbx, rbx
mov rax, qword [0x14014a318]
mov r8, qword [rax + rbx*8]
cmp r8, qword [0x14014a308]
jne 0x140074e99
mov qword [rax + rbx*8], rdi
jmp 0x140074eab
cmp r8, rcx
jne 0x140074ea4
mov qword [rax + rbx*8], rdi
jmp 0x140074eb0
cmp qword [rax + rbx*8 + 8], rdx
jne 0x140074eb0
mov qword [rax + rbx*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x1400760a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400760f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400760f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400760f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400760f2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400760f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400760f4
xor al, al
add rsp, 0x28
ret

Function at 0x1400762e0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14007631a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14007631f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140076368
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14007bd50]
cmp byte [rcx + rax], 0
je 0x140076368
dec r8
sub rdx, 1
jne 0x14007634e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140076b2c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400763f8
mov ebx, eax
test eax, eax
jne 0x140076b5c
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140076bbf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140076bb6
test al, 0x10
je 0x140076bb6
bt eax, 0xa
jae 0x140076baf
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140076bd0
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140076bab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140076bab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140076bb6
and dword [rsp + 0x3c], 0
jmp 0x140076bbb
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d52c
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x14000d578
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000d554
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x14000d598
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000d5e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000d5b8
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14000d5fc
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rsi
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000d646
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000d61c
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14000d660
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x14000d6ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000d688
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x14000d6cc
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x20]
mov rsi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov ecx, dword [r15]
mov r9, rsi
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000d722
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000d6f7
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14001a8a4
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 1
mov rbx, r8
mov rdi, rcx
mov rcx, rsi
lea r8, [rax + 8]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x14001a935
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14001a90e
mov rax, qword [rdi + 8]
mov dword [rax], 2
xor al, al
jmp 0x14001a9f9
mov r8, qword [rdi + 0x18]
mov rcx, rsi
mov rdx, qword [rdi + 0x10]
mov r8, qword [r8]
mov rdx, qword [rdx]
call fcn.14002f0d4
mov ecx, eax
mov rax, qword [rdi + 8]
mov dword [rax], ecx
mov rax, qword [rdi + 8]
cmp dword [rax], 0
jne 0x14001a907
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rdi + 0x28]
lea r9, [rsp + 0x40]
movabs r14, 0x20c49ba5e353f7cf
mov dword [rsp + 0x20], 4
mov ebx, 0xffff
mov r8d, 0x1006
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi + 0x20]
imul ecx, dword [rax], 0x3e8
add edx, ecx
mov rcx, rsi
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi + 0x38]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [rdi + 0x30]
imul r8d, dword [rcx], 0x3e8
mov rcx, rsi
add edx, r8d
mov r8d, 0x1005
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 8]
mov al, 1
and dword [rcx], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14001e5ac
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x14001e739
cmp ecx, 0x7c
je 0x14001e739
cmp ecx, 0x29
jne 0x14001e626
cmp dword [rdi + 0x1c], 0
jne 0x14001e739
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x14001e752
cmp ecx, 0x5d
jne 0x14001e603
test dword [rbx], 0x10000000
je 0x14001e760
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.14001dba0
mov rcx, rdi
call fcn.140022670
mov rcx, rdi
call fcn.1400226e4
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x14001e5be
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x14001e63d
lea rcx, [rdi + 0x40]
call fcn.14001de28
jmp 0x14001e60f
cmp ecx, 0x5c
jne 0x14001e68b
mov rcx, rdi
call fcn.140022670
test byte [rbx], 0x80
je 0x14001e681
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x14001e669
lea rcx, [rdi + 0x40]
call fcn.14001e5a0
mov rcx, rdi
call fcn.140022670
jmp 0x14001e61f
cmp al, 0x42
jne 0x14001e681
lea rcx, [rdi + 0x40]
call fcn.14001e5a0
lea rcx, [rdi + 0x40]
call fcn.14002260c
jmp 0x14001e65f
mov rcx, rdi
call fcn.14001e77c
jmp 0x14001e617
cmp ecx, 0x5b
jne 0x14001e6b6
mov rcx, rdi
call fcn.140022670
mov rcx, rdi
call fcn.14001f184
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.140020e60
jmp 0x14001e617
cmp ecx, 0x28
jne 0x14001e6eb
mov rcx, rdi
call fcn.140022670
mov rcx, rdi
call fcn.140022eac
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.140020e60
test bl, bl
je 0x14001e61f
jmp 0x14001e617
cmp ecx, 0x5e
jne 0x14001e6fe
lea rcx, [rdi + 0x40]
call fcn.14001db94
jmp 0x14001e65f
cmp ecx, 0x24
jne 0x14001e711
lea rcx, [rdi + 0x40]
call fcn.14001df28
jmp 0x14001e65f
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14001e76e
cmp ecx, 0x3f
je 0x14001e76e
cmp ecx, 0x7b
je 0x14001e76e
cmp ecx, 0x7d
jne 0x14001e5f2
test dword [rbx], 0x10000000
je 0x14001e744
jmp 0x14001e603
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.140020e54
int3
mov edx, 5
mov rcx, rdi
call fcn.140020e54
int3
mov edx, 4
mov rcx, rdi
call fcn.140020e54
int3
mov edx, 0xa
mov rcx, rdi
call fcn.140020e54
int3