joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180013380
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
movdqa xmm0, xmmword [0x1800ed990]
mov esi, ecx
xor ecx, ecx
mov qword [rbp - 0x21], 0xf
mov r14, r9
mov qword [rbp - 0x29], rcx
mov r12, r8
mov byte [rbp - 0x39], cl
lea r15d, [rsi + 0x235]
movdqa xmmword [rbp - 9], xmm0
mov byte [rbp - 0x19], cl
mov rdi, rdx
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm1, xmm0
mov byte [rbp + 7], cl
mov qword [rbp + 0x27], rcx
mov qword [rbp + 0x2f], 0xffffffffffffffff
cmp esi, r15d
jae 0x18001353a
mov qword [rax + 0x10], rbx
movzx ebx, word [rbp + 0x67]
mov qword [rax + 0x18], r13
lea r13, [0x1800e62f0]
mov eax, esi
sub eax, 0xd6
je 0x18001346d
sub eax, 0x48
je 0x18001344b
sub eax, 0x29
je 0x180013445
sub eax, 0x48
je 0x180013427
cmp eax, 0x29
je 0x1800134ef
jmp 0x1800134b1
mov eax, reloc.SHELL32.dll_SHSetFolderPathA
nop dword [rax]
cmp eax, 0xe7
je 0x1800134bf
add eax, 0x78
cmp eax, 0x15f
jb 0x180013430
mov word [rbp + 0x67], bx
jmp 0x1800134b1
mov r8, r14
lea rcx, [rbp - 0x39]
mov edx, 0x52
call fcn.18001a2c0
test al, al
je 0x1800134eb
cmp qword [rbp - 0x29], 0
je 0x1800134e5
jmp 0x1800134b1
mov r8d, dword [rdi]
mov r9, r12
movzx ebx, word [r14]
test r8d, r8d
je 0x1800134ab
nop dword [rax]
dec dword [rdi]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
mov r8d, dword [rdi]
movzx eax, bx
xor rcx, rax
movzx eax, bx
shr ax, 8
movzx edx, cl
movzx ebx, word [r13 + rdx*2]
xor bx, ax
test r8d, r8d
jne 0x180013480
lea eax, [r8 - 1]
mov dword [rdi], eax
add esi, 0x71
cmp esi, r15d
jb 0x180013401
jmp 0x1800134ef
xor eax, eax
mov dword [rsp + 0x30], 0xa4
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r12
call fcn.18002f4d0
mov byte [rbp + 0x67], 1
jmp 0x1800134ef
mov byte [rbp + 0x67], 0
mov rdx, qword [rbp + 0x1f]
mov r13, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x18001353a
mov rcx, qword [rbp + 7]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013535
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800135e6
call fcn.1800ac99c
mov rdx, qword [rbp - 1]
movdqa xmm0, xmmword [0x1800ed990]
movdqa xmmword [rbp + 0x17], xmm0
mov byte [rbp + 7], 0
cmp rdx, 0x10
jb 0x180013582
mov rcx, qword [rbp - 0x19]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001357d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800135e6
call fcn.1800ac99c
mov rdx, qword [rbp - 0x21]
movdqa xmm0, xmmword [0x1800ed990]
movdqa xmmword [rbp - 9], xmm0
mov byte [rbp - 0x19], 0
cmp rdx, 0x10
jb 0x1800135ca
mov rcx, qword [rbp - 0x39]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800135c5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800135e6
call fcn.1800ac99c
movzx eax, word [rbp + 0x67]
mov rsi, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1800b0d14
int3
Function at 0x180024130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x10
lea ebp, [rcx - 3]
mov r14, r8
mov ebx, ecx
cmp ecx, ebp
jbe 0x1800242ab
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r11, qword [rsp]
movzx r10d, byte [rsp + 0x30]
nop word [rax + rax]
mov eax, ebx
sub eax, 0x51
je 0x1800242a5
sub eax, 2
je 0x1800242a0
cmp eax, 1
jne 0x180024294
mov r8, qword [r14]
xor r11d, r11d
sub r8, qword [r9]
cmp qword [rsi], r11
jbe 0x180024294
nop
mov ecx, 0x12a
nop word [rax + rax]
mov eax, ecx
sub eax, 0x12a
je 0x180024274
sub eax, 0x13
je 0x1800241d3
cmp eax, 0x13
jne 0x180024279
lea ebx, [rax + 0x41]
jmp 0x180024279
movzx ecx, r10b
sub ecx, 0x7d
je 0x180024214
cmp ecx, 1
je 0x180024214
mov ecx, 0x2d
mov eax, ecx
sub eax, 0x2d
je 0x1800241fc
cmp eax, 0x76
jne 0x180024202
inc qword [r9]
cmp qword [r9], r8
je 0x18002426d
jmp 0x180024202
mov byte [rdx], r10b
inc rdx
add ecx, 0x76
cmp ecx, 0x119
jb 0x1800241e6
mov ecx, 0x13d
jmp 0x180024279
mov ecx, 0x70
nop dword [rax]
cmp ecx, 0x70
je 0x180024251
cmp ecx, 0x1650
je 0x180024244
cmp ecx, 0x2c30
je 0x18002423f
cmp ecx, 0x4210
jne 0x18002425f
jmp 0x18002425a
inc qword [r9]
jmp 0x18002425f
movzx eax, r10b
xor al, 0x20
mov byte [rdx], al
inc rdx
jmp 0x18002425f
mov byte [rdx], 0x7d
inc rdx
inc qword [r9]
cmp qword [r9], r8
je 0x18002426d
add ecx, 0x15e0
cmp ecx, 0x5780
jbe 0x180024220
mov ecx, 0x13d
jmp 0x180024279
movzx r10d, byte [r11 + rdi]
add ecx, 0x13
cmp ecx, 0x163
jb 0x1800241b0
inc r11
cmp r11, qword [rsi]
jb 0x1800241a0
dec ebx
cmp ebx, ebp
ja 0x180024170
jmp 0x1800242ab
mov rax, r11
jmp 0x1800242af
mov eax, dword [rdi + 0x20]
mov dword [rsp], eax
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x10
pop r14
pop rdi
pop rsi
ret
Function at 0x180031b90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180031bc4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180031bb0
ret
Function at 0x18008aed0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
lea edi, [rcx + 6]
mov rsi, r8
mov r11, rdx
cmp ecx, edi
jae case.0x18008af25.19
mov eax, dword [rsp + 0x18]
lea r10d, [rcx - 0x119]
lea rbp, [0x180000000]
lea r14, [0x1801083d0]
nop dword [rax]
cmp r10d, 0x13
ja case.0x18008af25.2
mov edx, dword [rbp + r10*4 + 0x8b03c]
add rdx, rbp
jmp rdx
mov rdx, qword [r11]
movzx ecx, byte [rsi]
mov byte [rdx], cl
inc qword [r11]
jmp case.0x18008af25.2
cmp word [r11 + 8], 0
sete byte [rsp + 0x18]
jmp case.0x18008af25.2
cmp byte [rsi], 0
je 0x18008af56
or byte [r11 + 0x30], 8
jmp case.0x18008af25.2
and byte [r11 + 0x30], 0xf7
jmp case.0x18008af25.2
mov rcx, r14
lea rax, [0x1800ed390]
mov edx, 8
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18008af70
movsxd rbx, dword [rsi]
xor r9d, r9d
mov eax, 0xffffffff
test rbx, rbx
jle case.0x18008af25.2
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [r9 + r11]
mov ecx, eax
movzx edx, al
inc r9
xor r8, rdx
shr ecx, 8
mov eax, dword [r14 + r8*4]
xor eax, ecx
cmp r9, rbx
jl 0x18008afe0
inc r10d
lea ecx, [r10 + 0x119]
cmp ecx, edi
jb 0x18008af10
mov eax, dword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r14
pop rdi
ret
mov rbx, qword [rsp + 0x20]
not eax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r14
pop rdi
ret
Function at 0x180094400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea r15d, [rcx + 0xf2]
mov r13, r8
mov r12, rdx
mov esi, ecx
cmp ecx, r15d
jae case.0x180094487.131
mov edi, dword [rsp + 0x80]
lea r8, [0x180000000]
mov ebx, dword [rsp + 0x80]
xor edx, edx
mov rbp, qword [rsp + 0x98]
mov r14, qword [rsp + 0x98]
cmp esi, 0x17e
ja case.0x180094487.135
je 0x1800945af
lea eax, [rsi - 0x7d]
cmp eax, 0xeb
ja case.0x180094487.135
movzx eax, byte [r8 + rax + 0x94650]
mov ecx, dword [r8 + rax*4 + 0x94624]
add rcx, r8
jmp rcx
mov word [rsp + 0x80], bx
jmp case.0x180094487.135
not ebx
mov eax, ebx
mov ecx, ebx
shr eax, 8
movzx ebx, al
shl ecx, 8
or ebx, ecx
jmp case.0x180094487.135
mov rbp, r13
mov ebx, 0xffff
mov edi, 0x8408
jmp case.0x180094487.135
lea rdx, [r14 + 0x430]
mov r8d, 0x126
lea rcx, [r14 + 0x44a]
call fcn.180032790
jmp 0x1800945d4
mov rcx, r13
lea rdx, [0x1800e5740]
mov r8d, 0x510
mov r14, r13
call fcn.1800addc0
lea rdx, [r13 + 0x420]
mov ecx, 0xb9
call fcn.180099b50
jmp 0x1800945d4
lea rax, [r14 + 0x430]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, str.AERT1234
mov qword [rsp + 0x20], rdx
mov ecx, 0xcf
xor edx, edx
call fcn.1800a52b0
jmp 0x1800945d4
mov r11, qword [r12]
mov r10, rdx
test r11, r11
je case.0x180094487.135
nop word [rax + rax]
movsx eax, byte [r10 + rbp]
mov r9d, 8
movzx r8d, al
nop
mov edx, ebx
mov ecx, r8d
shr edx, 1
xor ecx, ebx
mov eax, edi
xor eax, edx
and cl, 1
cmove eax, edx
shr r8d, 1
mov ebx, eax
sub r9, 1
jne 0x180094560
inc r10
cmp r10, r11
jb 0x180094550
jmp 0x1800945d4
lea rcx, [r14 + 8]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.180032790
lea rcx, [r14 + 0x24c]
xor edx, edx
mov r8d, 0xef
call fcn.180032790
jmp 0x1800945d4
mov qword [rsp + 0x30], rdx
lea r8, [r14 + 0x49c]
mov qword [rsp + 0x28], rdx
xor ecx, ecx
mov qword [rsp + 0x20], rdx
mov r9d, 0x93
xor edx, edx
call fcn.180038200
lea r8, [0x180000000]
xor edx, edx
add esi, 0x16
cmp esi, r15d
jb 0x180094453
mov eax, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x20], rdx
mov r9d, 0x52
mov rdx, r13
xor r8d, r8d
xor ecx, ecx
call fcn.18007ddf0
jmp 0x1800945f0
Function at 0x1800a1bd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
imul r14d, r8d, 0x5d8
mov r15, r9
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
mov ebx, r8d
cmp r8d, r14d
ja 0x1800a1daf
mov r13d, 0x72
xor r12d, r12d
nop word [rax + rax]
cmp ebx, 0x9990
ja 0x1800a1d0d
je 0x1800a1daf
mov eax, ebx
sub eax, 0xb
je 0x1800a1cf5
sub eax, 0x85
je 0x1800a1cad
sub eax, 0x35
je 0x1800a1c86
sub eax, 0x4c4b
je 0x1800a1c76
cmp eax, 0x1c5d
jne 0x1800a1e1c
mov word [rsp + 0x3e], r13w
mov dword [rsp + 0x3f], 0x707574
mov dword [rsp + 0x48], 0x77
jmp 0x1800a1e1c
movsd xmm0, qword [rdi + 8]
movsd qword [rsp + 0x30], xmm0
jmp 0x1800a1e1c
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], 0x415357
dec rcx
cmp byte [rcx + 1], r12b
lea rcx, [rcx + 1]
jne 0x1800a1c96
mov eax, dword [0x1800ecd3c]
mov dword [rcx], eax
jmp 0x1800a1e1c
mov eax, dword [rdi]
lea r8, [rbp + 0x50]
xor edx, edx
mov dword [rsp + 0x240], eax
lea rcx, [rsp + 0x240]
lea r9d, [rdx + 0x76]
call fcn.18003bcb0
test rax, rax
je 0x1800a1e1c
movzx eax, byte [rax + 0xc]
cmp al, 1
jne 0x1800a1e1c
movsd xmm0, qword [0x1800ed318]
movsd qword [rsp + 0x30], xmm0
jmp 0x1800a1daf
movsxd r8, dword [r15]
mov r9, rbp
mov edx, 1
mov rcx, rdi
call fcn.1800b396c
jmp 0x1800a1e1c
cmp ebx, 0xd215
je 0x1800a1dee
cmp ebx, 0x13abd
je 0x1800a1dd5
cmp ebx, 0x1a365
je 0x1800a1d86
cmp ebx, 0x20c0d
je 0x1800a1d42
cmp ebx, 0x274b5
je 0x1800a1daf
jmp 0x1800a1e1c
xor r9d, r9d
mov qword [rsp + 0x28], r12
mov r8, rbp
mov qword [rsp + 0x20], r12
xor ecx, ecx
lea edx, [r9 + 0x5e]
call fcn.18000f6d0
test al, al
je 0x1800a1daa
mov dword [rsp + 0x28], 0xbf
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call fcn.18009c240
mov byte [rsp + 0x30], al
jmp 0x1800a1e1c
lea r8, [rsp + 0x48]
mov edx, 0xc7
lea rcx, [rsp + 0x38]
call fcn.1800095b0
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call rax
test eax, eax
je 0x1800a1e1c
mov byte [rsp + 0x30], r12b
mov rax, qword [rsp + 0x30]
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8d, 3
lea rdx, [0x1800e819c]
lea rcx, [rsp + 0x58]
call fcn.1800b110c
jmp 0x1800a1e1c
mov eax, dword [0x1800ecd48]
movsd xmm0, qword [0x1800ecd40]
mov dword [rsp + 0x52], eax
mov eax, dword [0x1800e81a4]
mov dword [rsp + 0x54], eax
movzx eax, word [0x1800e81a8]
mov word [rsp + 0x58], ax
movsd qword [rsp + 0x4a], xmm0
imul eax, esi, 0x88
add ebx, eax
cmp ebx, r14d
jbe 0x1800a1c20
jmp 0x1800a1daf
Function at 0x1800c73a4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1800c7244
call fcn.1800b10a4
mov dword [rax], 0x16
call fcn.1800b0cf4
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800c722c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1800c722c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1800c7276
lock or dword [rax + 0x14], 0x10
jmp 0x1800c722c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1800c7293
mov rcx, qword [rbp + 0x10]
call fcn.1800d0880
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1800c14f4
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1800c6c7c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1800c72ea
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1800c722c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1800c7356
mov rcx, qword [rbp + 0x10]
call fcn.1800c14f4
cmp eax, 0xffffffff
je 0x1800c733d
mov rcx, qword [rbp + 0x10]
call fcn.1800c14f4
cmp eax, 0xfffffffe
je 0x1800c733d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1800c14f4
movsxd rdi, eax
lea rsi, [0x18011fb10]
mov rcx, rbx
sar rdi, 6
call fcn.1800c14f4
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1800c7344
lea rax, [0x180106650]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1800c7356
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1800c738c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1800c7388
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1800c7388
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1800c722f
jmp 0x1800c71fc
Function at 0x14000d140
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rsi
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000d18a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000d160
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14000d1a4
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x20]
mov rsi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov ecx, dword [r15]
mov r9, rsi
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000d1fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000d1cf
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14000d218
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000d263
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000d238
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140016ee4
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1c0
mov rsi, rcx
mov ecx, 0x38
call fcn.14005d2c0
mov rdi, rax
mov qword [rsp + 0x1d8], rax
xor ebx, ebx
test rax, rax
je 0x140016f2c
mov rcx, rax
call fcn.1400189ac
mov qword [rdi + 0x28], rsi
mov qword [rdi + 0x30], rbx
jmp 0x140016f2f
mov rdi, rbx
mov qword [rsi], rdi
mov eax, 1
lock xadd dword [0x140087260], eax
inc eax
cmp eax, 1
jne 0x140016f5c
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x140087264], eax
lea rcx, [0x140087260]
call fcn.14004e844
nop
mov ecx, 0xb0
call fcn.14005d2c0
mov qword [rsp + 0x1d8], rax
test rax, rax
je 0x140016f95
xor r9d, r9d
or r8d, 0xffffffff
mov rdx, rsi
mov rcx, rax
call fcn.1400187ac
mov rbx, rax
mov qword [rsp + 0x1d8], rbx
mov rdx, rbx
mov rcx, qword [rsi]
call fcn.140008cfc
nop
mov qword [rsi + 0x10], rbx
mov rax, rsi
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001e0ec
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 1
mov rbx, r8
mov rdi, rcx
mov rcx, rsi
lea r8, [rax + 8]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x14001e16b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14001e15a
mov r8, qword [rdi + 0x10]
mov rcx, rsi
mov rdx, qword [rdi + 8]
mov r8, qword [r8]
mov rdx, qword [rdx]
call fcn.1400505f0
test al, al
jne 0x14001e16b
mov rax, qword [rdi + 0x18]
mov dword [rax], 2
xor al, al
jmp 0x14001e1f9
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rdi + 0x20]
lea r9, [rsp + 0x40]
mov ebx, 0xffff
mov dword [rsp + 0x20], 8
mov r8d, 0x1006
mov edx, ebx
mov ecx, dword [rax]
mov rax, qword [rdi + 0x28]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rax]
mov dword [rsp + 0x44], ecx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x30]
lea r9, [rsp + 0x40]
mov edx, ebx
mov dword [rsp + 0x20], 8
mov r8d, dword [rcx]
mov rcx, qword [rdi + 0x38]
mov dword [rsp + 0x40], r8d
mov r8d, dword [rcx]
mov rcx, rsi
mov dword [rsp + 0x44], r8d
mov r8d, 0x1005
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x18]
mov al, 1
and dword [rcx], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140020e44
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140020eaf
lea rcx, [rsp + 0x4c]
call fcn.14002d818
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x140020ea3
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
jmp 0x140020e76
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x140020eba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x140020ecc
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [str.LocalUniqueApplicationMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x140020f05
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140020f05
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140020f07
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140021990
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x140021b1d
cmp ecx, 0x7c
je 0x140021b1d
cmp ecx, 0x29
jne 0x1400219db
cmp dword [rbx + 0x1c], 0
jne 0x140021b1d
lea rdi, [rbx + 0x80]
test dword [rdi], 0x10000000
je 0x140021b36
jmp 0x140021ad3
lea rdi, [rbx + 0x80]
cmp ecx, 0x2e
jne 0x140021a02
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.140026840
mov rcx, rbx
call fcn.140026898
jmp 0x140021b0b
cmp ecx, 0x5c
jne 0x140021a5f
mov rcx, rbx
call fcn.140026898
test byte [rdi], 0x80
je 0x140021a52
mov al, byte [rbx + 0x78]
cmp al, 0x62
jne 0x140021a36
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.140026840
mov rcx, rbx
call fcn.140026898
jmp 0x140021b13
cmp al, 0x42
jne 0x140021a52
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140026840
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x140021a29
mov rcx, rbx
call fcn.140021b60
jmp 0x140021b0b
cmp ecx, 0x5b
jne 0x140021a83
mov rcx, rbx
call fcn.140026898
mov rcx, rbx
call fcn.1400226dc
cmp dword [rbx + 0x7c], 0x5d
jne 0x140021b44
jmp 0x1400219f5
cmp ecx, 0x28
jne 0x140021aa7
mov rcx, rbx
call fcn.140026898
mov rcx, rbx
call fcn.140027478
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x140021b36
jmp 0x140021afe
cmp ecx, 0x5e
jne 0x140021ab4
lea edx, [rcx - 0x5c]
jmp 0x140021a20
cmp ecx, 0x24
jne 0x140021ac1
lea edx, [rcx - 0x21]
jmp 0x140021a20
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x140021b28
cmp ecx, 0x3f
je 0x140021b28
cmp ecx, 0x7b
je 0x140021b28
cmp ecx, 0x7d
jne 0x140021ae2
test dword [rdi], 0x10000000
je 0x140021b52
jmp 0x140021aef
cmp ecx, 0x5d
jne 0x140021aef
test dword [rdi], 0x10000000
je 0x140021b44
mov dl, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.140020ffc
mov dil, 1
mov rcx, rbx
call fcn.140026898
test dil, dil
je 0x140021b13
mov rcx, rbx
call fcn.1400268e8
mov ecx, dword [rbx + 0x7c]
mov al, 1
jmp 0x1400219a2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.140024cd0
int3
mov edx, 5
mov rcx, rbx
call fcn.140024cd0
int3
mov edx, 4
mov rcx, rbx
call fcn.140024cd0
int3
mov edx, 6
mov rcx, rbx
call fcn.140024cd0
int3