joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d6c97
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140112e90]
jne 0x1400d193a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400d1936
repz ret
ror rcx, 0x10
jmp 0x1400d6bf0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140117b90]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140117c88]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400d6c75
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140117b90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400d6c97
mov rax, qword [rsp + 0x88]
mov qword [0x140117c88], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140117c28], rax
mov rax, qword [0x140117c88]
mov qword [0x140117b00], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140117c10], rax
mov dword [0x140117af0], 0xc0000409
mov dword [0x140117af4], 1
mov rax, qword [0x140112e90]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140112e98]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140117b88], eax
mov ecx, 1
call fcn.1400d473c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400e33c0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140117b88], 0
jne 0x1400d6d1e
mov ecx, 1
call fcn.1400d473c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140132859
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
jmp 0x140132378
nop
jmp rcx
cmc
ror r14d, 0x82
popf
popfq
or byte [rax], al
add byte [rcx + 0xf], cl
leave
pushfq
call fcn.140131d3f
xor ecx, 0x258b958f
inc r15
jne 0x1401328d3
cmp r14, rbp
jge 0x1401324ab
test r11, rdx
lea esi, [rcx - 0xbdbf]
call rax
jg 0x140131d93
mov r12d, 0xb43054c9
movabs r10, 0x14cb4d6b41c27eeb
and r14d, 0x743d68e0
lea ebx, [rbp - 0xc106]
jmp rax
Function at 0x435f00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x435f0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x435f1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x435f05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x435f35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x435f22
sub eax, 3
jb 0x435f4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x435f86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x435f76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x435f74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x435f63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.00435ec2
jmp 0x435f0d
pop rsi
mov rdi, rsi
mov ecx, 0x9e00
mov dl, 6
mov rbx, rdi
jmp 0x435fc2
mov al, byte [rdi]
add rdi, 1
cmp al, 0x80
jb 0x435faa
cmp al, 0x8f
ja 0x435faa
cmp byte [rdi - 2], 0xf
je 0x435fb0
sub al, 0xe8
cmp al, 1
ja 0x435fd3
cmp byte [rdi], dl
jne 0x435fd3
mov eax, dword [rdi]
and eax, 0xffffff00
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
sub rcx, 4
mov al, byte [rdi]
add rdi, 1
dec rcx
jne 0x435faa
jmp 0x435fd8
dec rcx
jne 0x435f96
sub rsp, 0x28
lea rdi, [rsi + 0x33000]
mov eax, dword [rdi]
or eax, eax
je 0x436033
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x44a54]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x435fe3
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x43602d
mov qword [rbx], rax
add rbx, 8
jmp 0x436003
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.004360b6], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.004360b6
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x4360a6
sub rsp, 0xffffffffffffff80
jmp 0x401520
Function at 0x180001130
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], rcx
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x18000118a
call fcn.180001090
test rax, rax
je 0x18000118a
lea r8, [rsp + 0x20]
lea rdx, [0x180001060]
xor ecx, ecx
call rax
test eax, eax
cmovns rbx, qword [rsp + 0x28]
mov rax, rbx
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180001230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
mov r14d, r8d
mov r15d, edx
movabs rax, 0xa3939e9d9093b8
lea rcx, [rsp + 0x20]
mov r8b, 0xff
mov edx, 7
mov qword [rsp + 0x20], rax
call fcn.1800011a0
xor ebp, ebp
mov dword [rsp + 0x80], ebp
mov edi, dword [rsp + 0x80]
mov dword [rsp + 0x98], 0x1bff
nop word [rax + rax]
mov eax, dword [rsp + 0x98]
cmp eax, 0x1bff
je 0x180001460
cmp eax, 0x18acd
je 0x1800012ce
cmp eax, 0x1f8de
jne 0x180001473
mov eax, ebp
imul eax, r15d
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x98], 0x18acd
jmp 0x180001290
lea r10, [rsp + 0x28]
mov r11d, 4
nop dword [rax]
mov eax, dword [rsp + 0x80]
imul eax, eax
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x98], 0x3acf
xor eax, eax
nop
mov ecx, dword [rsp + 0x98]
cmp ecx, 0x3acf
je 0x180001384
cmp ecx, 0x1c353
jne 0x180001394
lea r8, [rsp + 0x80]
mov r9d, 4
mov dword [rsp + 0x98], 0x536e
mov ecx, dword [rsp + 0x98]
cmp ecx, ecx
jne 0x18000136c
movsx ecx, byte [r8]
movzx edx, cl
lea ecx, [rdx + rax]
mov dword [rsp + 0x98], 0x330f8
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
mov ecx, dword [rsp + 0x98]
cmp ecx, 0x536e
je 0x180001342
inc r8
dec r9
jne 0x180001325
mov dword [rsp + 0x98], 0x202e3
jmp 0x180001300
mov dword [rsp + 0x98], 0x1c353
jmp 0x1800012fc
cmp ecx, 0x202e3
jne 0x1800013ac
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul edi, eax, 0x8001
mov dword [r10], edi
add r10, 4
dec r11
jne 0x1800012e0
xor ecx, ecx
nop
movzx eax, byte [rsp + rcx + 0x20]
inc rcx
mov byte [rcx + rsi - 1], al
cmp rcx, 7
jb 0x1800013c0
movups xmm0, xmmword [0x180005268]
movzx eax, byte [0x180005278]
lea rcx, [rsp + 0x38]
mov r8b, 0xff
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rbx, [rsi + 7]
movups xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x48], al
call fcn.1800011a0
mov byte [rbx], 0x7b
inc rbx
lea r8, [rsp + 0x28]
xor edx, edx
nop dword [rax]
lea eax, [rdx - 4]
test eax, 0xfffffff9
jne 0x180001420
mov byte [rbx], 0x2d
inc rbx
movzx ecx, byte [r8]
inc edx
add rbx, 2
mov eax, ecx
and ecx, 0xf
inc r8
shr rax, 4
movzx eax, byte [rsp + rax + 0x38]
mov byte [rbx - 2], al
movzx eax, byte [rsp + rcx + 0x38]
mov byte [rbx - 1], al
cmp edx, 0x10
jb 0x180001410
mov word [rbx], 0x7d
mov dword [rsp + 0x98], 0x36968
jmp 0x180001290
mov ebp, r14d
mov dword [rsp + 0x98], 0x1f8de
jmp 0x180001290
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180001690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov edi, dword [rcx]
mov esi, dword [rcx + 4]
mov r10, r8
mov rbx, rdx
mov r11, rcx
test r9, r9
je 0x18000172d
sub rbx, r8
nop word [rax + rax]
lea eax, [rdi + 1]
movzx edi, al
movzx r8d, byte [rdi + r11 + 8]
lea eax, [rsi + r8]
movzx esi, al
movzx eax, byte [rsi + r11 + 8]
mov byte [rdi + r11 + 8], al
mov byte [rsi + r11 + 8], r8b
movzx eax, byte [rdi + r11 + 8]
add eax, r8d
and eax, 0x800000ff
jge 0x1800016fc
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
inc r10
movzx eax, byte [rcx + r11 + 8]
xor al, byte [rbx + r10 - 1]
mov byte [r10 - 1], al
dec r9
jne 0x1800016c0
mov dword [r11], edi
mov dword [r11 + 4], esi
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov dword [rcx], edi
mov rdi, qword [rsp + 0x18]
mov dword [rcx + 4], esi
mov rsi, qword [rsp + 0x10]
ret
Function at 0x180001bd0
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov esi, eax
test eax, eax
jne 0x180001c0d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x180001d4f
mov r9d, esi
mov r8, rax
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
test eax, eax
je 0x180001d39
cmp eax, esi
jne 0x180001d39
lea rcx, [rbp + 8]
lea r8, [rsi + rbp]
cmp rcx, r8
jae 0x180001d39
nop dword [rax + rax]
cmp byte [rcx], 1
je 0x180001cab
movzx eax, byte [rcx + 1]
add rax, rcx
movzx ecx, byte [rax]
lea rdx, [rax + 1]
or cl, byte [rdx]
je 0x180001c9d
nop word [rax + rax]
mov rax, rdx
inc rdx
movzx ecx, byte [rax]
or cl, byte [rdx]
jne 0x180001c90
lea rcx, [rax + 2]
cmp rcx, r8
jb 0x180001c70
jmp 0x180001d39
cmp byte [rcx + 1], 0x19
jb 0x180001cd4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rbx + 8]
inc rbx
mov byte [rbx + rdi - 1], al
cmp rbx, 0x10
jb 0x180001cc0
jmp 0x180001ce8
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
nop dword [rax]
dec rax
mov byte [rax + rdi], bl
jne 0x180001ce0
mov ecx, dword [rdi]
mov ebx, 1
mov edx, ecx
mov eax, ecx
shr ecx, 8
and eax, 0xff00
shl edx, 0x10
and ecx, 0xff00
or edx, eax
movzx eax, byte [rdi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [rdi + 5]
or edx, eax
movzx eax, word [rdi + 4]
shl ax, 8
mov dword [rdi], edx
or cx, ax
movzx eax, word [rdi + 6]
mov word [rdi + 4], cx
movzx ecx, byte [rdi + 7]
shl ax, 8
or cx, ax
mov word [rdi + 6], cx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800036a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x50], 0xb4a
mov r15d, 0x5a4d
mov edi, ebp
mov ebx, ebp
mov eax, dword [rsp + 0x50]
cmp eax, 0xb4a
je 0x180003747
cmp eax, 0x1b5a2
je 0x1800037b4
cmp eax, 0x1b7f7
je 0x18000370e
cmp eax, 0x20194
jne 0x1800037c9
cmp dword [rbx + 0xc], 0
je 0x1800037c7
mov dword [rsp + 0x50], 0x1b5a2
jmp 0x1800036d2
mov ebx, dword [rdi + 0x90]
add rbx, rbp
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x18000373d
nop
mov ecx, eax
mov rdx, r14
add rcx, rbp
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x18000373d
mov eax, dword [rbx + 0x20]
add rbx, 0x14
test eax, eax
jne 0x180003720
mov dword [rsp + 0x50], 0x20194
jmp 0x1800036d2
test r14, r14
je 0x1800037b9
test rsi, rsi
je 0x1800037b9
mov edx, 0x40
mov rcx, rsi
mov rbp, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x1800037b9
cmp r15w, word [rsi]
jne 0x1800037b9
mov edi, dword [rsi + 0x3c]
mov edx, 0x108
add rdi, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x18000378e
cmp dword [rdi], 0x4550
je 0x18000379e
mov dword [rsp + 0x50], 0xc60
mov eax, dword [rsp + 0x50]
cmp eax, eax
je 0x1800037b9
cmp dword [rdi + 0x90], 0
je 0x1800037c7
mov dword [rsp + 0x50], 0x1b7f7
jmp 0x1800036d2
mov rax, rbx
jmp 0x1800037c9
mov edx, 1
lea ecx, [rdx + 0x56]
call qword [sym.imp.USER32.dll_SetLastErrorEx]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140002180
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140087180]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
mov ecx, 8
call fcn.140056d78
test rax, rax
je 0x1400021b1
mov qword [rax], rdi
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140003760]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400021fe
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140057110
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140008780
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140087180]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 8
call fcn.140056d78
test rax, rax
je 0x1400087ac
lea rcx, [0x140008710]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140003760]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000881e
cmp dword [rsp + 0x38], 0
je 0x140008813
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140008813
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140057110
add rsp, 0x68
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14001172c
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x140011778
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140011754
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x140011798
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x1400117e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x1400117b8
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x1400117fc
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rsi
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140011846
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14001181c
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140011860
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x1400118ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140011888
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x1400118cc
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x20]
mov rsi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov ecx, dword [r15]
mov r9, rsi
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140011922
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x1400118f7
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14001ea8c
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 1
mov rbx, r8
mov rdi, rcx
mov rcx, rsi
lea r8, [rax + 8]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x14001eb1d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14001eaf6
mov rax, qword [rdi + 8]
mov dword [rax], 2
xor al, al
jmp 0x14001ebe1
mov r8, qword [rdi + 0x18]
mov rcx, rsi
mov rdx, qword [rdi + 0x10]
mov r8, qword [r8]
mov rdx, qword [rdx]
call fcn.140032fd4
mov ecx, eax
mov rax, qword [rdi + 8]
mov dword [rax], ecx
mov rax, qword [rdi + 8]
cmp dword [rax], 0
jne 0x14001eaef
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rdi + 0x28]
lea r9, [rsp + 0x40]
movabs r14, 0x20c49ba5e353f7cf
mov dword [rsp + 0x20], 4
mov ebx, 0xffff
mov r8d, 0x1006
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi + 0x20]
imul ecx, dword [rax], 0x3e8
add edx, ecx
mov rcx, rsi
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi + 0x38]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [rdi + 0x30]
imul r8d, dword [rcx], 0x3e8
mov rcx, rsi
add edx, r8d
mov r8d, 0x1005
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 8]
mov al, 1
and dword [rcx], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140022614
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x1400227a1
cmp ecx, 0x7c
je 0x1400227a1
cmp ecx, 0x29
jne 0x14002268e
cmp dword [rdi + 0x1c], 0
jne 0x1400227a1
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x1400227ba
cmp ecx, 0x5d
jne 0x14002266b
test dword [rbx], 0x10000000
je 0x1400227c8
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.140021c08
mov rcx, rdi
call fcn.1400266d8
mov rcx, rdi
call fcn.14002674c
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x140022626
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x1400226a5
lea rcx, [rdi + 0x40]
call fcn.140021e90
jmp 0x140022677
cmp ecx, 0x5c
jne 0x1400226f3
mov rcx, rdi
call fcn.1400266d8
test byte [rbx], 0x80
je 0x1400226e9
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x1400226d1
lea rcx, [rdi + 0x40]
call fcn.140022608
mov rcx, rdi
call fcn.1400266d8
jmp 0x140022687
cmp al, 0x42
jne 0x1400226e9
lea rcx, [rdi + 0x40]
call fcn.140022608
lea rcx, [rdi + 0x40]
call fcn.140026674
jmp 0x1400226c7
mov rcx, rdi
call fcn.1400227e4
jmp 0x14002267f
cmp ecx, 0x5b
jne 0x14002271e
mov rcx, rdi
call fcn.1400266d8
mov rcx, rdi
call fcn.1400231ec
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.140024ec8
jmp 0x14002267f
cmp ecx, 0x28
jne 0x140022753
mov rcx, rdi
call fcn.1400266d8
mov rcx, rdi
call fcn.140026f00
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.140024ec8
test bl, bl
je 0x140022687
jmp 0x14002267f
cmp ecx, 0x5e
jne 0x140022766
lea rcx, [rdi + 0x40]
call fcn.140021bfc
jmp 0x1400226c7
cmp ecx, 0x24
jne 0x140022779
lea rcx, [rdi + 0x40]
call fcn.140021f90
jmp 0x1400226c7
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1400227d6
cmp ecx, 0x3f
je 0x1400227d6
cmp ecx, 0x7b
je 0x1400227d6
cmp ecx, 0x7d
jne 0x14002265a
test dword [rbx], 0x10000000
je 0x1400227ac
jmp 0x14002266b
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.140024ebc
int3
mov edx, 5
mov rcx, rdi
call fcn.140024ebc
int3
mov edx, 4
mov rcx, rdi
call fcn.140024ebc
int3
mov edx, 0xa
mov rcx, rdi
call fcn.140024ebc
int3