joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14022ec60
Capabilities:
Encode data using xor

Disassembly:
push rbx
xor r9d, r9d
xor r11d, r11d
movsxd rax, dword [rcx + 0xc]
lea r10d, [rax + 1]
add rax, qword [rcx]
mov bl, byte [rdx + r9]
xor byte [rax], bl
movsxd rax, r10d
cmp dword [rcx + 8], r10d
cmovle rax, r11
inc r9
cmp r8d, r9d
jg 0x14022ec6b
add dword [rcx + 0x10], r8d
mov dword [rcx + 0xc], eax
pop rbx
ret
Function at 0x140009500
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
mov rax, qword [0x140016030]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
call fcn.14000a480
test rax, rax
jne 0x140009545
xor al, al
jmp 0x140009620
cmp qword [rsp + 0x88], 0
jne 0x14000956f
mov eax, dword [rsp + 0x80]
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x14000956f
xor al, al
jmp 0x140009620
mov rax, qword [rsp + 0x90]
and rax, 0xfffffffffffff000
mov rcx, qword [rsp + 0xa8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xa0]
mov qword [rax], 0
mov rax, qword [rsp + 0x98]
mov dword [rax], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rdx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rax]
call fcn.140008c50
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rcx], rax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
cmp qword [rsp + 0x88], 0
jne 0x14000961c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000961e
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400125e0
add rsp, 0x70
pop rdi
ret
Function at 0x140009b20
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0xc0000001
cmp qword [rsp + 0x78], 0
jne 0x140009b6f
mov eax, dword [rsp + 0x70]
lea rdx, [rsp + 0x38]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x140009b6f
xor al, al
jmp 0x140009ccb
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, qword [rsp + 0x80]
call fcn.140009710
movzx eax, al
test eax, eax
je 0x140009c8a
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + rax - 1]
mov rcx, rax
call fcn.140009710
movzx eax, al
test eax, eax
je 0x140009c8a
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
cmp dword [0x14001ffdc], 0
je 0x140009be7
call fcn.1400021a0
call fcn.14000fa90
cmp dword [0x14001ffdc], 0
jne 0x140009c01
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x30], rax
jae 0x140009c20
mov eax, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0
jmp 0x140009c5d
lfence
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.14000aa70
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x28], eax
je 0x140009c55
mov dword [rsp + 0x20], 0xc0000001
jmp 0x140009c5d
mov dword [rsp + 0x20], 0
cmp dword [0x14001ffdc], 0
je 0x140009c8a
call fcn.14000fb50
mov qword [rsp + 0x48], rax
call fcn.14000faf0
call fcn.1400021b0
cmp qword [rsp + 0x48], 0
je 0x140009c8a
mov dword [rsp + 0x20], 0xc0000001
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x140009c9a
cmp qword [rsp + 0x78], 0
jne 0x140009cad
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [rsp + 0x20], 0
jl 0x140009cbe
mov dword [rsp + 0x24], 1
jmp 0x140009cc6
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x14000a020
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x140016030]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0xc0000001
cmp qword [rsp + 0x30], 0
jne 0x14000a08a
mov eax, dword [rsp + 0xb0]
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x14000a08a
xor al, al
jmp 0x14000a26f
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, qword [rsp + 0xc0]
call fcn.140009710
movzx eax, al
test eax, eax
je 0x14000a22b
mov eax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
lea rax, [rcx + rax - 1]
mov rcx, rax
call fcn.140009710
movzx eax, al
test eax, eax
je 0x14000a22b
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
cmp dword [0x14001ffdc], 0
jne 0x14000a11a
cmp dword [0x14001ff9c], 0
je 0x14000a150
call fcn.1400021a0
cmp dword [0x14001ffdc], 0
je 0x14000a12d
call fcn.14000fa90
cmp dword [0x14001ff9c], 0
je 0x14000a150
call fcn.140002740
btr rax, 0x10
mov rcx, rax
call fcn.140002840
mov dword [rsp + 0x24], 1
cmp dword [0x14001ffdc], 0
jne 0x14000a1af
cmp dword [0x14001ff9c], 0
jne 0x14000a173
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x40], rax
jb 0x14000a1af
mov r8d, dword [rsp + 0xc8]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14000aa70
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xc8]
cmp dword [rsp + 0x38], eax
je 0x14000a1a5
mov dword [rsp + 0x20], 0xc0000001
jmp 0x14000a1ad
mov dword [rsp + 0x20], 0
jmp 0x14000a1cc
mov eax, dword [rsp + 0xc8]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0
cmp dword [0x14001ffdc], 0
jne 0x14000a1dc
cmp dword [rsp + 0x24], 0
je 0x14000a22b
mov qword [rsp + 0x50], 0
cmp dword [rsp + 0x24], 0
je 0x14000a1fe
call fcn.140002740
bts rax, 0x10
mov rcx, rax
call fcn.140002840
cmp dword [0x14001ffdc], 0
je 0x14000a216
call fcn.14000fb50
mov qword [rsp + 0x50], rax
call fcn.14000faf0
call fcn.1400021b0
cmp qword [rsp + 0x50], 0
je 0x14000a22b
mov dword [rsp + 0x20], 0xc0000001
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x14000a23b
cmp qword [rsp + 0xb8], 0
jne 0x14000a251
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [rsp + 0x20], 0
jl 0x14000a262
mov dword [rsp + 0x28], 1
jmp 0x14000a26a
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400125e0
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x14000a480
Capabilities:
Check os version

Disassembly:
sub rsp, 0x168
mov rax, qword [0x140016030]
xor rax, rsp
mov qword [rsp + 0x150], rax
cmp qword [0x1400160f8], 0
jne 0x14000a565
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
je 0x14000a4c5
xor eax, eax
jmp 0x14000a56c
cmp dword [rsp + 0x34], 0xa
jb 0x14000a554
cmp dword [rsp + 0x3c], 0x3839
jb 0x14000a554
call fcn.140002760
and rax, 0xfffffffffffff000
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov qword [rsp + 0x28], rax
movabs rax, 0xffffff8000000000
mov rcx, qword [rsp + 0x28]
and rcx, rax
mov rax, rcx
mov qword [0x1400160f8], rax
movabs rax, 0x7ffffffff8
mov rcx, qword [0x1400160f8]
add rcx, rax
mov rax, rcx
mov qword [0x14001ffc0], rax
movabs rax, 0x7b7ffffff8
mov rcx, qword [0x1400160f8]
add rcx, rax
mov rax, rcx
mov qword [0x14001ffc8], rax
jmp 0x14000a565
movabs rax, 0xfffff68000000000
mov qword [0x1400160f8], rax
mov rax, qword [0x1400160f8]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400125e0
add rsp, 0x168
ret
Function at 0x14000f100
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x14008d180]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov qword [r11 - 0x38], rcx
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
mov rax, rcx
sub rax, r8
xor r15d, r15d
cmp rax, 3
jb 0x14000f1cf
lea rax, [r8 + 3]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x14000f163
mov rdi, qword [rbx]
lea rax, [0x1400799cf]
mov r14d, 3
lea rsi, [0x1400799cc]
cmp rax, rdi
jbe 0x14000f197
lea rax, [rdi + r8]
cmp rsi, rax
ja 0x14000f197
cmp rdi, rsi
ja 0x14000f18f
mov rbp, r15
jmp 0x14000f19a
mov rbp, rdi
sub rbp, rsi
jmp 0x14000f19a
mov rbp, r14
lea rcx, [rdi + 3]
inc r8
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rbp]
sub r14, rbp
lea rdx, [rsi + 3]
add rdx, rbp
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14000f1f7
mov r14d, 3
mov qword [rsp + 0x28], r14
lea rsi, [0x1400799cc]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rbx
call fcn.1400160c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x30], WSACleanup
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
lea rax, str.cmd.exe
mov qword [rsp + 0x48], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000f256
mov rax, qword [rbx]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x68], r15
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14000f2ba
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000f2b3
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000f2ae
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000f36c
mov rcx, r8
call fcn.14006410c
mov eax, 0xffffffff
jmp 0x14000f330
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0xa8]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000f32e
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000f329
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000f36c
mov rcx, r8
call fcn.14006410c
mov eax, edi
mov byte [rbx], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], r15
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140063d50
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001f2ac
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x14001f2f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14001f2d4
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x14001f318
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14001f363
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14001f338
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14001f37c
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rsi
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14001f3c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14001f39c
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14001f3e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x14001f42c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14001f408
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x14001f44c
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x20]
mov rsi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov ecx, dword [r15]
mov r9, rsi
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14001f4a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14001f477
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14002c210
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 1
mov rbx, r8
mov rdi, rcx
mov rcx, rsi
lea r8, [rax + 8]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x14002c2a1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14002c27a
mov rax, qword [rdi + 8]
mov dword [rax], 2
xor al, al
jmp 0x14002c365
mov r8, qword [rdi + 0x18]
mov rcx, rsi
mov rdx, qword [rdi + 0x10]
mov r8, qword [r8]
mov rdx, qword [rdx]
call fcn.1400404d8
mov ecx, eax
mov rax, qword [rdi + 8]
mov dword [rax], ecx
mov rax, qword [rdi + 8]
cmp dword [rax], 0
jne 0x14002c273
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rdi + 0x28]
lea r9, [rsp + 0x40]
movabs r14, 0x20c49ba5e353f7cf
mov dword [rsp + 0x20], 4
mov ebx, 0xffff
mov r8d, 0x1006
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi + 0x20]
imul ecx, dword [rax], 0x3e8
add edx, ecx
mov rcx, rsi
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi + 0x38]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [rdi + 0x30]
imul r8d, dword [rcx], 0x3e8
mov rcx, rsi
add edx, r8d
mov r8d, 0x1005
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 8]
mov al, 1
and dword [rcx], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14002fd5c
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x14002fee9
cmp ecx, 0x7c
je 0x14002fee9
cmp ecx, 0x29
jne 0x14002fdd6
cmp dword [rdi + 0x1c], 0
jne 0x14002fee9
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x14002ff02
cmp ecx, 0x5d
jne 0x14002fdb3
test dword [rbx], 0x10000000
je 0x14002ff10
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.14002f348
mov rcx, rdi
call fcn.140033ea8
mov rcx, rdi
call fcn.140033f1c
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x14002fd6e
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x14002fded
lea rcx, [rdi + 0x40]
call fcn.14002f5d0
jmp 0x14002fdbf
cmp ecx, 0x5c
jne 0x14002fe3b
mov rcx, rdi
call fcn.140033ea8
test byte [rbx], 0x80
je 0x14002fe31
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x14002fe19
lea rcx, [rdi + 0x40]
call fcn.14002fd50
mov rcx, rdi
call fcn.140033ea8
jmp 0x14002fdcf
cmp al, 0x42
jne 0x14002fe31
lea rcx, [rdi + 0x40]
call fcn.14002fd50
lea rcx, [rdi + 0x40]
call fcn.140033e44
jmp 0x14002fe0f
mov rcx, rdi
call fcn.14002ff2c
jmp 0x14002fdc7
cmp ecx, 0x5b
jne 0x14002fe66
mov rcx, rdi
call fcn.140033ea8
mov rcx, rdi
call fcn.140030934
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.140032628
jmp 0x14002fdc7
cmp ecx, 0x28
jne 0x14002fe9b
mov rcx, rdi
call fcn.140033ea8
mov rcx, rdi
call fcn.1400346e4
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.140032628
test bl, bl
je 0x14002fdcf
jmp 0x14002fdc7
cmp ecx, 0x5e
jne 0x14002feae
lea rcx, [rdi + 0x40]
call fcn.14002f33c
jmp 0x14002fe0f
cmp ecx, 0x24
jne 0x14002fec1
lea rcx, [rdi + 0x40]
call fcn.14002f6d0
jmp 0x14002fe0f
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14002ff1e
cmp ecx, 0x3f
je 0x14002ff1e
cmp ecx, 0x7b
je 0x14002ff1e
cmp ecx, 0x7d
jne 0x14002fda2
test dword [rbx], 0x10000000
je 0x14002fef4
jmp 0x14002fdb3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.14003261c
int3
mov edx, 5
mov rcx, rdi
call fcn.14003261c
int3
mov edx, 4
mov rcx, rdi
call fcn.14003261c
int3
mov edx, 0xa
mov rcx, rdi
call fcn.14003261c
int3
Function at 0x140035c0c
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
and dword [rax - 0x38], 0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
mov dword [rax - 0x38], 1
mov rax, qword [rdx + 0x10]
cmp rax, 0xf
jbe 0x140035c78
mov r8b, byte [rsp + 0x60]
mov rdx, rax
call fcn.14001c0bc
and qword [rbx + 0x10], 0
mov rax, qword [rdi + 0x10]
xor esi, esi
lea r14d, [rsi - 6]
cmp qword [rdi + 0x18], 0x10
jb 0x140035c90
mov rbp, qword [rdi]
mov rcx, rbp
mov rdi, rbp
jmp 0x140035c96
mov rbp, rdi
mov rcx, rdi
lea r12, [rcx + rax]
cmp rdi, r12
je 0x140035dbb
lea r8, [0x14006b430]
shl esi, 8
movzx eax, byte [rbp]
add esi, eax
add r14d, 8
js 0x140035d33
movsxd r13, esi
movsxd rdi, r14d
lea ecx, [r14 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov r15d, edx
imul eax, edx, 0xfffffffa
add r14d, eax
mov rax, r13
mov rcx, rdi
sar rax, cl
and eax, 0x3f
mov r9b, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140035d10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140035d05
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140035d29
mov r8b, byte [rsp + 0x60]
mov edx, 1
mov rcx, rbx
call fcn.140015f60
lea r8, [0x14006b430]
sub rdi, 6
sub r15, 1
jne 0x140035cd6
inc rbp
cmp rbp, r12
jne 0x140035caa
cmp r14d, 0xfffffffa
jle 0x140035dbb
lea ecx, [r14 + 8]
shl esi, 8
movsxd rdx, esi
sar rdx, cl
and edx, 0x3f
mov r9b, byte [rdx + r8]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140035da9
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140035d78
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140035dbb
cmp rcx, qword [rbx + 0x18]
jae 0x140035da6
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140035d9e
mov rax, qword [rbx]
mov word [rcx + rax], 0x3d
jmp 0x140035dbb
mov r9b, 0x3d
mov r8b, byte [rsp + 0x60]
mov edx, 1
mov rcx, rbx
call fcn.140015f60
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x140035d83
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140039568
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x470
mov rax, qword [0x14008d180]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r14d, 2
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp word [rcx], r14w
je 0x1400395a9
cmp word [rcx], 0x17
jne 0x14003964d
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
mov dword [rsi], eax
lea rcx, [rsp + 0x50]
mov esi, 0x401
mov r8d, esi
call fcn.140064d9e
mov dword [rsp + 0x30], r14d
lea r8, [rsp + 0x50]
xor r14d, r14d
mov r9d, esi
mov dword [rsp + 0x28], r14d
mov edx, ebp
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x14003964d
lea rax, [rsp + 0x50]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1400395fe
cmp rbx, qword [rdi + 0x18]
ja 0x140039634
cmp qword [rdi + 0x18], 0x10
mov rsi, rdi
jb 0x14003961a
mov rsi, qword [rdi]
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], r14b
jmp 0x140039649
mov r8b, byte [rsp + 0x40]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.1400164a0
mov al, 1
jmp 0x14003964f
xor al, al
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140063d50
add rsp, 0x470
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140039670
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14003967c
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14008d180]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400396d1
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.140039568
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140063d50
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret

Function at 0x14003967c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14003967c
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14008d180]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400396d1
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.140039568
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140063d50
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret