joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4198d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x0042f630]
test rcx, rcx
je 0x419a28
cmp dword [rcx], 1
je 0x4198f3
call fcn.00419790
mov rax, qword [0x0042f628]
test rax, rax
je 0x419a50
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x419920
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call fcn.00419130
cmp qword [0x00432050], 0
mov rbx, rax
je 0x419913
test rax, rax
je 0x419913
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.00419810
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rdi
mov dword [rsp + 0x30], 2
mov r8, rsi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x422316
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x0042f628]
test rax, rax
je 0x419a78
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x422316
mov r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.0041ca90
mov qword [0x0042f630], rax
mov rcx, rax
jmp 0x4198e9
lea r8, [0x00418710]
mov edx, 4
lea rcx, str._pthread_tls_shmem
call fcn.0041ca90
mov qword [0x0042f628], rax
jmp 0x419903
lea r8, [0x00418710]
mov edx, 4
lea rcx, str._pthread_tls_shmem
call fcn.0041ca90
mov qword [0x0042f628], rax
jmp 0x4199fe
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2
Function at 0x41ca90
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov rsi, r8
mov r12, rcx
movsxd rbx, edx
call sub.msvcrt.dll_strlen
mov r8, rax
lea eax, [rax + 0xf]
mov dword [rbp - 0x54], eax
lea eax, [r8 + 0x51]
lea edi, [r8 + 0x10]
cdqe
lea r15d, [r8 + 0x50]
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.00412120
movabs rcx, 0x656d68732d636367
sub rsp, rax
movsxd r13, r8d
mov rdx, r12
mov eax, 0x326d
mov r8, r13
mov qword [rsp + 0x20], rcx
lea r14, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
mov byte [rsp + 0x2e], 0x2d
call sub.msvcrt.dll_memcpy
lea rax, [r14 + r13 + 0x10]
movsxd r12, dword [rbp - 0x54]
mov r8, r14
movabs rdx, 0x6161616161616161
movabs rcx, 0x6161616161616161
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rdx
xor edx, edx
mov qword [rax + 0x38], rcx
movsxd rax, r15d
xor ecx, ecx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + r12 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + r12 + 0x20], 0x2d
mov edx, 0xffffffff
mov r13, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41cb8e
int3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
je 0x41cbe0
mov rdx, r14
movzx ecx, ax
mov r9d, edi
mov r8d, r15d
call fcn.0041ca20
mov r14, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r14
lea rsp, [rbp - 0x48]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rbx
call sub.msvcrt.dll_malloc
mov r12, rax
mov eax, 0x40
bt r12, rax
jae 0x41cc03
mov edx, r15d
sub edx, eax
movsxd rdx, edx
mov byte [r14 + rdx], 0x41
sub eax, 1
jne 0x41cbf0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
jne 0x41cc17
int3
mov rdx, r14
movzx ecx, ax
mov r9d, edi
mov r8d, r15d
call fcn.0041ca20
mov r14, rax
cmp r12, rax
je 0x41cc3d
mov rcx, r12
call fcn.004178e8
jmp 0x41cbb0
xor edx, edx
mov r8, rbx
mov rcx, rax
call sub.msvcrt.dll_memset
test rsi, rsi
je 0x41cbb0
mov rcx, r14
call rsi
jmp 0x41cbb0

Function at 0x420180
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x00422030]
mov edx, 8
lea rcx, str.__terminate_handler_sh
jmp fcn.00412b40

Function at 0x4201a0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x00422040]
mov edx, 8
lea rcx, str.__unexpected_handler_sh
jmp fcn.00412b40
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x24], 0xfb
mov byte [rsp + 0x25], 0x87
mov byte [rsp + 0x26], 0x13
mov byte [rsp + 0x27], 0xb2
mov dword [rsp + 0x20], 0
jmp 0x14000102c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0x31446
jae 0x14000108d
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rcx, section..data
movsxd rdx, dword [rsp + 0x20]
mov qword [rsp + 0x30], rdx
xor edx, edx
mov r8, qword [rsp + 0x30]
mov rax, r8
mov r8d, 4
div r8
mov rax, rdx
movsx eax, byte [rsp + rax + 0x24]
mov rdx, qword [rsp + 0x38]
movzx ecx, byte [rcx + rdx]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x20]
lea rdx, section..data
mov byte [rdx + rcx], al
jmp 0x140001022
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x31446
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
mov r8d, 0x31446
lea rdx, section..data
mov rcx, qword [rsp + 0x28]
call fcn.14000ebd0
call qword [rsp + 0x28]
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400017fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001846
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001846
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001846
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001846
cmp dword [rcx + 0x84], 0xe
jbe 0x140001846
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001848
xor al, al
add rsp, 0x28
ret

Function at 0x140004d88
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140004df7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004df7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004df7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004df7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004df7
cmp dword [rcx + 0x84], 0xe
jbe 0x140004df7
cmp dword [rcx + 0xf8], 0
je 0x140004df7
mov ecx, ebx
call fcn.140004ea8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140004c84
nop
cmp dword [rbp + 0x20], 0
je 0x140004e45
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140004e50
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140004d88

Function at 0x140004f8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140004d88
Function at 0x14001124e
Capabilities:
Terminate process

Disassembly:
jmp 0x140013970
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112e9
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014cc0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014ce0
xor al, al
jmp 0x140014d61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014cf3
xor al, al
jmp 0x140014d61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014d1d
xor al, al
jmp 0x140014d61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014d31
xor al, al
jmp 0x140014d61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014d43
xor al, al
jmp 0x140014d61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014d5f
xor al, al
jmp 0x140014d61
mov al, 1
add rsp, 0x38
ret
Function at 0x14013cc50
Capabilities:
Terminate process

Disassembly:
invalid
cld
pop r11
jmp 0x14013cc5d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14013cc6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14013cc55
lea eax, [rcx + 1]
jmp 0x14013cc7b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14013cc8e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14013cc74
sub eax, 3
jb 0x14013ccae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14013ccfd
sar eax, 1
movsxd rbp, eax
jb 0x14013cce4
jmp 0x14013ccbc
add ebx, ebx
jne 0x14013ccba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14013cce4
inc ecx
add ebx, ebx
jne 0x14013ccca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14013cce4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14013ccdd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14013cccc
add ecx, 2
jmp 0x14013cce9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14013cc12
jmp 0x14013cc5d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xde400
mov dl, 0x16
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14013cd49
cmp rsi, rcx
jae 0x14013cd51
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14013cd30
cmp al, 0x8f
ja 0x14013cd30
cmp byte [rsi - 2], 0xf
je 0x14013cd36
sub al, 0xe8
cmp al, 1
ja 0x14013cd1a
cmp rsi, rcx
jae 0x14013cd51
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14013cd20
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14013cd51
lodsb al, byte [rsi]
jmp 0x14013cd30
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x139000]
mov eax, dword [rdi]
or eax, eax
je 0x14013cdba
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x140668]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14013cd5e
jns 0x14013cd93
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14013cd9d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14013cdb4
mov qword [rbx], rax
add rbx, 8
jmp 0x14013cd7e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14013ce12
sub rsp, 0xffffffffffffff80
jmp 0x1400cdb10
Function at 0x141099058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410991df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141099089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14109906f
add dl, dl
jne 0x141099096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410990f6
xor eax, eax
add dl, dl
jne 0x1410990a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410991ad
add dl, dl
jne 0x1410990b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410990c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410990d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410990dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410990ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14109907e
mov eax, 1
add dl, dl
jne 0x141099106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141099113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410990fb
sub eax, ebx
mov ebx, 1
jne 0x14109914c
mov ecx, 1
add dl, dl
jne 0x14109912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14109913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141099123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14109907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141099168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141099175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14109915d
cmp eax, 0x7d00
jae 0x14109919b
cmp eax, 0x500
jb 0x141099196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14109907e
cmp eax, 0x7f
ja 0x14109919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14109907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410991d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14109907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x140a43af6
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], 0x5da4e915
add rdi, 0xc
xor eax, eax
jmp 0x140a837b1
Function at 0x14000b4bc
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x14000b508
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000b4e4
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x14000b528
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000b573
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000b548
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14000b58c
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rsi
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000b5d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000b5ac
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14000b5f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x14000b63c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000b618
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x14000b65c
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x20]
mov rsi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov ecx, dword [r15]
mov r9, rsi
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000b6b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14000b687
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14001881c
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 1
mov rbx, r8
mov rdi, rcx
mov rcx, rsi
lea r8, [rax + 8]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x1400188ad
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140018886
mov rax, qword [rdi + 8]
mov dword [rax], 2
xor al, al
jmp 0x140018971
mov r8, qword [rdi + 0x18]
mov rcx, rsi
mov rdx, qword [rdi + 0x10]
mov r8, qword [r8]
mov rdx, qword [rdx]
call fcn.14002cd9c
mov ecx, eax
mov rax, qword [rdi + 8]
mov dword [rax], ecx
mov rax, qword [rdi + 8]
cmp dword [rax], 0
jne 0x14001887f
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rdi + 0x28]
lea r9, [rsp + 0x40]
movabs r14, 0x20c49ba5e353f7cf
mov dword [rsp + 0x20], 4
mov ebx, 0xffff
mov r8d, 0x1006
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi + 0x20]
imul ecx, dword [rax], 0x3e8
add edx, ecx
mov rcx, rsi
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi + 0x38]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [rdi + 0x30]
imul r8d, dword [rcx], 0x3e8
mov rcx, rsi
add edx, r8d
mov r8d, 0x1005
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 8]
mov al, 1
and dword [rcx], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14001c3a4
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x14001c531
cmp ecx, 0x7c
je 0x14001c531
cmp ecx, 0x29
jne 0x14001c41e
cmp dword [rdi + 0x1c], 0
jne 0x14001c531
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x14001c54a
cmp ecx, 0x5d
jne 0x14001c3fb
test dword [rbx], 0x10000000
je 0x14001c558
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.14001b998
mov rcx, rdi
call fcn.140020468
mov rcx, rdi
call fcn.1400204dc
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x14001c3b6
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x14001c435
lea rcx, [rdi + 0x40]
call fcn.14001bc20
jmp 0x14001c407
cmp ecx, 0x5c
jne 0x14001c483
mov rcx, rdi
call fcn.140020468
test byte [rbx], 0x80
je 0x14001c479
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x14001c461
lea rcx, [rdi + 0x40]
call fcn.14001c398
mov rcx, rdi
call fcn.140020468
jmp 0x14001c417
cmp al, 0x42
jne 0x14001c479
lea rcx, [rdi + 0x40]
call fcn.14001c398
lea rcx, [rdi + 0x40]
call fcn.140020404
jmp 0x14001c457
mov rcx, rdi
call fcn.14001c574
jmp 0x14001c40f
cmp ecx, 0x5b
jne 0x14001c4ae
mov rcx, rdi
call fcn.140020468
mov rcx, rdi
call fcn.14001cf7c
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.14001ec58
jmp 0x14001c40f
cmp ecx, 0x28
jne 0x14001c4e3
mov rcx, rdi
call fcn.140020468
mov rcx, rdi
call fcn.140020ca4
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.14001ec58
test bl, bl
je 0x14001c417
jmp 0x14001c40f
cmp ecx, 0x5e
jne 0x14001c4f6
lea rcx, [rdi + 0x40]
call fcn.14001b98c
jmp 0x14001c457
cmp ecx, 0x24
jne 0x14001c509
lea rcx, [rdi + 0x40]
call fcn.14001bd20
jmp 0x14001c457
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14001c566
cmp ecx, 0x3f
je 0x14001c566
cmp ecx, 0x7b
je 0x14001c566
cmp ecx, 0x7d
jne 0x14001c3ea
test dword [rbx], 0x10000000
je 0x14001c53c
jmp 0x14001c3fb
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.14001ec4c
int3
mov edx, 5
mov rcx, rdi
call fcn.14001ec4c
int3
mov edx, 4
mov rcx, rdi
call fcn.14001ec4c
int3
mov edx, 0xa
mov rcx, rdi
call fcn.14001ec4c
int3