joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff741c0ae40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x7ff741c0ae9d
lea rbx, [0x7ff741cb7a70]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x7ff741c0ae84
cmp r10, 2
jb 0x7ff741c0ae84
cmp byte [r9], r8b
jne 0x7ff741c0ae84
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x7ff741c0ae60
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x7ff741c0aedf
lea rbx, [0x7ff741cb7a70]
cmp r8b, 0x23
jne 0x7ff741c0aec3
cmp byte [r9], r8b
jne 0x7ff741c0aec3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x7ff741c0aeb0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x7ff741c0b020
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x7ff741c0b03a
mov qword [r8], 0
lea rdx, [0x7ff741cb77f4]
call fcn.7ff741c0aef0
mov rbx, rax
test rax, rax
jne 0x7ff741c0b05a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ucrtbase.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x7ff741c0b131
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jne 0x7ff741c0b131
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x7ff741c0b131
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jne 0x7ff741c0b131
cmp rdi, 0xffffffffffffffff
je 0x7ff741c0b131
mov rax, qword [0x7ff741cef310]
test rax, rax
je 0x7ff741c0b0ce
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_malloc]
mov rsi, rax
test rax, rax
je 0x7ff741c0b131
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.ucrtbase.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x7ff741c0b11e
call qword [sym.imp.ucrtbase.dll_fclose]
mov rax, qword [0x7ff741cef310]
test rax, rax
je 0x7ff741c0b113
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_free]
jmp 0x7ff741c0b13a
call qword [sym.imp.ucrtbase.dll_fclose]
test r14, r14
je 0x7ff741c0b12c
mov qword [r14], rdi
mov rax, rsi
jmp 0x7ff741c0b13c
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x7ff741c0e030
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x108]
mov rax, qword [rcx + 0x110]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x7ff741cb7a70]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x7ff741cef310]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x401c], ebx
jne 0x7ff741c0e0c6
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.7ff741c2ce80
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x7ff741c12040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test edx, 0xff000000
je 0x7ff741c124ad
mov r11, rsp
push rbp
push r14
push r15
lea rbp, [r11 - 0x48]
sub rsp, 0x130
mov rax, qword [0x7ff741cd7188]
xor rax, rsp
mov qword [rbp - 0x70], rax
mov rax, qword [rcx + 0x30]
mov r15d, edx
mov qword [r11 + 0x10], rbx
mov r14, rcx
mov qword [r11 + 0x18], rsi
movaps xmmword [r11 - 0x28], xmm6
movss xmm6, dword [rax + 0xc]
movaps xmmword [r11 - 0x38], xmm7
movss xmm7, dword [rax + 8]
movaps xmmword [r11 - 0x48], xmm8
movaps xmm8, xmm6
addss xmm8, dword [rax + 0x14]
movaps xmmword [r11 - 0x58], xmm9
movaps xmm9, xmm7
addss xmm9, dword [rax + 0x10]
mov rax, qword [rcx + 0x3b0]
movaps xmmword [r11 - 0x68], xmm10
movaps xmmword [r11 - 0x78], xmm11
movaps xmmword [r11 - 0x88], xmm12
mov rbx, qword [rax + 0x2c0]
movaps xmmword [r11 - 0x98], xmm13
movss dword [rbp - 0x80], xmm7
movss dword [rbp - 0x7c], xmm6
cmp dword [rbx], 0
movss dword [rbp - 0x78], xmm9
movss dword [rbp - 0x74], xmm8
invalid
invalid
invalid
invalid
Function at 0x7ff741c1b370
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff741cd7188]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x7ff741cef310]
mov edi, ecx
cmp byte [rbx + 0x43fd], 0
jne 0x7ff741c1b3d1
cmp byte [rbx + 0x43fe], 0
jne 0x7ff741c1b3d1
movsx r9d, word [rbx + 0x54de]
lea r8, [0x7ff741cbbd58]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.7ff741c0adc0
test dil, 1
je 0x7ff741c1b4f9
jmp 0x7ff741c1b461
movss xmm1, dword [rbx + 0x39c0]
lea r8, [0x7ff741cbbd58]
movsx r9d, word [rbx + 0x54de]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x7ff741cbceb4]
mulss xmm1, dword [0x7ff741cbcea8]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd9c]
addss xmm1, dword [rbx + 0xda0]
mov qword [rbx + 0x410c], rax
mov dword [rbx + 0x40f4], 1
movss dword [rbx + 0x4104], xmm0
mov byte [rbx + 0x412c], 1
movss dword [rbx + 0x4108], xmm1
movss xmm0, dword [rbx + 0x3a1c]
mulss xmm0, dword [0x7ff741cbce00]
or dword [rbx + 0x40f0], 0x41
movss dword [rbx + 0x4150], xmm0
call fcn.7ff741c0adc0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x7ff741c1b4b1
lea r11, [0x7ff741cb7a70]
cmp r9b, 0x23
jne 0x7ff741c1b494
cmp byte [r8], r9b
jne 0x7ff741c1b494
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff741c1b481
not ecx
call fcn.7ff741c13790
test rax, rax
je 0x7ff741c1b4f9
cmp byte [rax + 0xcb], 0
je 0x7ff741c1b4f9
mov byte [rax + 0xd2], 1
lea r8, [0x7ff741cbbd58]
mov byte [rax + 0xec], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x54de]
mov edx, 0x10
movsx r9d, word [rbx + 0x54de]
call fcn.7ff741c0adc0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.7ff741c16590
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.7ff741ca8850
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x7ff741c20a40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x55d0], 0
lea rbx, [rcx + 0x55d8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x7ff741c20ae7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x7ff741c20a9a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.7ff741c2e1c0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.7ff741c0b7b0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x55d0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x55e0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x7ff741cef2e1]
cmovne rcx, rax
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x7ff741c20aef
mov rcx, rbx
call fcn.7ff741c0b7b0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff741c20f30
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x7ff741c20f82
lea r11, [0x7ff741cb7a70]
cmp r9b, 0x23
jne 0x7ff741c20f65
cmp byte [r8], r9b
jne 0x7ff741c20f65
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff741c20f52
mov r11, qword [0x7ff741cef310]
mov r10, qword [r11 + 0x5598]
test r10, r10
je 0x7ff741c20fc9
lea r9, [r10 + 4]
test r9, r9
je 0x7ff741c20fc9
not eax
cmp dword [r9], eax
je 0x7ff741c20fd2
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x5590]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x7ff741c20fa0
mov rcx, rbx
pop rbx
jmp fcn.7ff741c20e40
mov rax, r9
pop rbx
ret

Function at 0x7ff741c20fe0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x7ff741cef310]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x7ff741c21043
mov qword [rsp], rbx
lea rbx, [0x7ff741cb7a70]
nop dword [rax]
cmp r9b, 0x23
jne 0x7ff741c21023
cmp byte [r8], r9b
jne 0x7ff741c21023
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x7ff741c21010
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5580]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x7ff741c21077
mov r10, qword [r10 + 0x5588]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x7ff741c2107e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x7ff741c21064
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x7ff741c2c680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x7ff741c2c6cd
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x7ff741c2c6d2
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x7ff741c2c6fd
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x7ff741c2c6fd
mov rax, qword [rax + 0x390]
test rax, rax
je 0x7ff741c2c6fd
mov eax, dword [rax + 8]
mov dword [rsp + 0x28], eax
jmp 0x7ff741c2c702
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x7ff741c2c71c
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x7ff741c2c721
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0xc1fc20
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x31], dil
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov ecx, dword [rbp + 0x20]
mov word [rsp + 0x42], ax
cmp ecx, r8d
jne 0x7ff741c2c7a3
inc ecx
test r8d, r8d
je 0x7ff741c2c78e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x7ff741c2c793
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
call fcn.7ff741c2db60
movsxd rax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
movups xmmword [rcx + rdx*4], xmm0
movups xmmword [rcx + rdx*4 + 0x10], xmm1
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
inc edi
test rdx, rdx
je 0x7ff741c2c7e3
mov r8d, edi
mov rcx, rbp
call fcn.7ff741c2c680
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x7ff741c2c6b0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x7ff741c54040
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x7ff741cd7188]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp qword [rdx + 0x18], 0x10
jb 0x7ff741c5406e
mov rdx, qword [rdx]
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
nop dword [rax]
inc r8
cmp byte [rdx + r8], dil
jne 0x7ff741c54090
lea rcx, [rsp + 0x20]
call fcn.7ff741c04170
xor edx, edx
mov esi, edi
lea ecx, [rdx + 2]
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x7ff741c54121
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x130
mov rcx, rax
call qword [sym.imp.kernel32.dll_Process32First]
test eax, eax
je 0x7ff741c54118
nop dword [rax]
nop word [rax + rax]
cmp qword [rsp + 0x38], 0x10
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x6c]
cmovae rdx, qword [rsp + 0x20]
call qword [sym.imp.ucrtbase.dll__stricmp]
test eax, eax
je 0x7ff741c54114
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_Process32Next]
test eax, eax
jne 0x7ff741c540e0
jmp 0x7ff741c54118
mov esi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x7ff741c54161
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c5415c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff741c5415c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff741ca88ac
test esi, esi
setne dil
mov eax, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.7ff741ca8850
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x7ff741c58810
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
sub rdi, rdx
mov rbp, rcx
sar rdi, 2
test rdi, rdi
je 0x7ff741c589ef
mov qword [rsp + 0x60], rbx
mov rbx, qword [rcx + 8]
sub rbx, qword [rcx]
mov qword [rsp + 0x30], r13
sar rbx, 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
cmp rdi, 0x26f
jb 0x7ff741c58860
mov eax, 0xb
jmp 0x7ff741c5888e
cmp rdi, 0x44
jb 0x7ff741c5886d
mov eax, 7
jmp 0x7ff741c5888e
cmp rdi, 0x27
jb 0x7ff741c5887a
mov eax, 5
jmp 0x7ff741c5888e
cmp rdi, 7
jb 0x7ff741c58887
mov eax, 3
jmp 0x7ff741c5888e
lea rax, [rdi - 1]
shr rax, 1
mov r14, rdi
lea r15, [rbx + 1]
sub r14, rax
shr r14, 1
lea r13, [r14 + rax]
cmp rdi, rbx
jbe 0x7ff741c588a7
mov r15, rdi
mov r8, rdi
mov edx, 0x8b8b8b8b
shl r8, 2
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
test r15, r15
je 0x7ff741c5895f
mov qword [rsp + 0x38], r12
nop dword [rax + rax]
xor edx, edx
lea rax, [rcx + r14]
div rdi
mov r11d, dword [rsi + rdx*4]
lea r10, [rsi + rdx*4]
xor edx, edx
mov rax, rcx
div rdi
lea r12, [rsi + rdx*4]
mov r9, rdx
lea rax, [rcx - 1]
xor edx, edx
div rdi
mov r8d, dword [rsi + rdx*4]
xor r8d, dword [r12]
xor r8d, r11d
mov eax, r8d
shr eax, 0x1b
xor eax, r8d
imul edx, eax, 0x19660d
test rcx, rcx
jne 0x7ff741c5891d
mov rax, rbx
jmp 0x7ff741c58932
cmp rcx, rbx
ja 0x7ff741c5892f
mov rax, qword [rbp]
mov eax, dword [rax + rcx*4 - 4]
add rax, r9
jmp 0x7ff741c58932
mov rax, r9
lea r8d, [rax + rdx]
lea eax, [r11 + rdx]
xor edx, edx
mov dword [r10], eax
lea rax, [rcx + r13]
div rdi
inc rcx
add dword [rsi + rdx*4], r8d
mov dword [r12], r8d
cmp rcx, r15
jb 0x7ff741c588d0
mov r12, qword [rsp + 0x38]
add r15, rdi
cmp rcx, r15
jae 0x7ff741c589db
inc r14
lea rbp, [rcx - 1]
inc r13
xor edx, edx
lea rax, [r14 + rbp]
div rdi
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div rdi
mov rax, rbp
mov r9, rdx
xor edx, edx
div rdi
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, r10d
add ecx, dword [rsi + r9*4]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
mov rax, rbp
add rax, r13
mov rbp, rbx
div rdi
xor r10d, ecx
lea rax, [rbx + 1]
mov dword [r11], r10d
mov r8d, ecx
sub r8d, r9d
xor dword [rsi + rdx*4], r8d
mov dword [rsi + r9*4], r8d
cmp rax, r15
jb 0x7ff741c58971
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff741c63ebc
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.ws2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x7ff741c63f08
call qword [sym.imp.ucrtbase.dll__errno]
cmp dword [rax], 4
je 0x7ff741c63ee4
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x7ff741c63f28
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ws2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x7ff741c63f73
call qword [sym.imp.ucrtbase.dll__errno]
cmp dword [rax], 4
je 0x7ff741c63f48
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x7ff741c63f8c
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rsi
xor edx, edx
call qword [sym.imp.ws2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x7ff741c63fd6
call qword [sym.imp.ucrtbase.dll__errno]
cmp dword [rax], 4
je 0x7ff741c63fac
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x7ff741c63ff0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.ws2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x7ff741c6403c
call qword [sym.imp.ucrtbase.dll__errno]
cmp dword [rax], 4
je 0x7ff741c64018
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x7ff741c6405c
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x20]
mov rsi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov ecx, dword [r15]
mov r9, rsi
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov rdx, r14
call qword [sym.imp.ws2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x7ff741c640b2
call qword [sym.imp.ucrtbase.dll__errno]
cmp dword [rax], 4
je 0x7ff741c64087
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x7ff741c71050
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 1
mov rbx, r8
mov rdi, rcx
mov rcx, rsi
lea r8, [rax + 8]
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
jns 0x7ff741c710e1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x7ff741c710ba
mov rax, qword [rdi + 8]
mov dword [rax], 2
xor al, al
jmp 0x7ff741c711a5
mov r8, qword [rdi + 0x18]
mov rcx, rsi
mov rdx, qword [rdi + 0x10]
mov r8, qword [r8]
mov rdx, qword [rdx]
call fcn.7ff741c84dec
mov ecx, eax
mov rax, qword [rdi + 8]
mov dword [rax], ecx
mov rax, qword [rdi + 8]
cmp dword [rax], 0
jne 0x7ff741c710b3
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_ioctlsocket]
mov rax, qword [rdi + 0x28]
lea r9, [rsp + 0x40]
movabs r14, 0x20c49ba5e353f7cf
mov dword [rsp + 0x20], 4
mov ebx, 0xffff
mov r8d, 0x1006
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi + 0x20]
imul ecx, dword [rax], 0x3e8
add edx, ecx
mov rcx, rsi
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.ws2_32.dll_setsockopt]
mov rax, qword [rdi + 0x38]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [rdi + 0x30]
imul r8d, dword [rcx], 0x3e8
mov rcx, rsi
add edx, r8d
mov r8d, 0x1005
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.ws2_32.dll_setsockopt]
mov rcx, qword [rdi + 8]
mov al, 1
and dword [rcx], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x7ff741c74c54
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x7ff741c74de1
cmp ecx, 0x7c
je 0x7ff741c74de1
cmp ecx, 0x29
jne 0x7ff741c74cce
cmp dword [rdi + 0x1c], 0
jne 0x7ff741c74de1
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x7ff741c74dfa
cmp ecx, 0x5d
jne 0x7ff741c74cab
test dword [rbx], 0x10000000
je 0x7ff741c74e08
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.7ff741c74240
mov rcx, rdi
call fcn.7ff741c78be0
mov rcx, rdi
call fcn.7ff741c78c54
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x7ff741c74c66
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x7ff741c74ce5
lea rcx, [rdi + 0x40]
call fcn.7ff741c744c8
jmp 0x7ff741c74cb7
cmp ecx, 0x5c
jne 0x7ff741c74d33
mov rcx, rdi
call fcn.7ff741c78be0
test byte [rbx], 0x80
je 0x7ff741c74d29
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x7ff741c74d11
lea rcx, [rdi + 0x40]
call fcn.7ff741c74c48
mov rcx, rdi
call fcn.7ff741c78be0
jmp 0x7ff741c74cc7
cmp al, 0x42
jne 0x7ff741c74d29
lea rcx, [rdi + 0x40]
call fcn.7ff741c74c48
lea rcx, [rdi + 0x40]
call fcn.7ff741c78b7c
jmp 0x7ff741c74d07
mov rcx, rdi
call fcn.7ff741c74e24
jmp 0x7ff741c74cbf
cmp ecx, 0x5b
jne 0x7ff741c74d5e
mov rcx, rdi
call fcn.7ff741c78be0
mov rcx, rdi
call fcn.7ff741c7566c
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.7ff741c77360
jmp 0x7ff741c74cbf
cmp ecx, 0x28
jne 0x7ff741c74d93
mov rcx, rdi
call fcn.7ff741c78be0
mov rcx, rdi
call fcn.7ff741c792e0
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.7ff741c77360
test bl, bl
je 0x7ff741c74cc7
jmp 0x7ff741c74cbf
cmp ecx, 0x5e
jne 0x7ff741c74da6
lea rcx, [rdi + 0x40]
call fcn.7ff741c74234
jmp 0x7ff741c74d07
cmp ecx, 0x24
jne 0x7ff741c74db9
lea rcx, [rdi + 0x40]
call fcn.7ff741c745c8
jmp 0x7ff741c74d07
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x7ff741c74e16
cmp ecx, 0x3f
je 0x7ff741c74e16
cmp ecx, 0x7b
je 0x7ff741c74e16
cmp ecx, 0x7d
jne 0x7ff741c74c9a
test dword [rbx], 0x10000000
je 0x7ff741c74dec
jmp 0x7ff741c74cab
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.7ff741c77354
int3
mov edx, 5
mov rcx, rdi
call fcn.7ff741c77354
int3
mov edx, 4
mov rcx, rdi
call fcn.7ff741c77354
int3
mov edx, 0xa
mov rcx, rdi
call fcn.7ff741c77354
int3