joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401fdf37
Capabilities:
Create process on windows

Disassembly:
jmp 0x1402e3c00
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x14200729c]
call fcn.140205606
mov rax, qword [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rsp + 0x20], rax
lea r9, [0x140701a00]
lea r8, str._srar.exe_a__m5__ep__y__s.rar__s
mov edx, 0xc8
lea rcx, [rbp + 0x10]
call fcn.1401f8de8
mov edx, 1
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.140202ef1
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret

Function at 0x1401fdfa5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140557e10
mov rax, rcx
neg rcx
test rax, 7
je 0x140557e2d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140557e88
test al, 7
jne 0x140557e20
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140557e41
mov rdx, qword [rax - 8]
test dl, dl
je 0x140557eb2
test dh, dh
je 0x140557eac
shr rdx, 0x10
test dl, dl
je 0x140557ea6
test dh, dh
je 0x140557ea0
shr rdx, 0x10
test dl, dl
je 0x140557e9a
test dh, dh
je 0x140557e94
shr edx, 0x10
test dl, dl
je 0x140557e8e
test dh, dh
jne 0x140557e41
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1401fe031
Capabilities:
Query environment variable

Disassembly:
jmp 0x1405d6350
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1405d5ed0
lea rcx, [rsp + 0x20]
call fcn.1405d5f20
movzx eax, al
test eax, eax
jne 0x1405d6395
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1405d5f00
mov rax, qword [rsp + 0x40]
jmp 0x1405d648f
lea rcx, [rsp + 0x20]
call fcn.1405d6020
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1405d5fc0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1401fe973
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1401fcf65
lea rcx, [rsp + 0x28]
call fcn.1401ff639
movzx eax, al
test eax, eax
jne 0x1405d642f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.140202906
lea rcx, [rsp + 0x20]
call fcn.1405d5f00
mov rax, qword [rsp + 0x50]
jmp 0x1405d648f
lea rcx, [rsp + 0x20]
call fcn.1405d6020
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140205304
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1401fe76b
lea rcx, [rsp + 0x28]
call fcn.140206b4b
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.140202906
lea rcx, [rsp + 0x20]
call fcn.1405d5f00
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1401fe2f7
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140220130
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x142007002]
call fcn.140205606
mov rax, qword [rbp + 0x120]
mov eax, dword [rax]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x28], rax
jmp 0x140220183
mov rax, qword [rbp + 0x130]
dec rax
mov qword [rbp + 0x130], rax
mov rcx, qword [rbp + 0x28]
call fcn.1401f869f
movzx eax, al
test eax, eax
jne 0x1402201de
cmp qword [rbp + 0x130], 0
jbe 0x1402201de
mov eax, dword [rbp + 4]
and eax, 0xff
mov rcx, qword [rbp + 0x28]
movzx ecx, byte [rcx]
xor eax, ecx
cdqe
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
sar edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 0xf4], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0xf4]
mov dword [rbp + 4], eax
jmp 0x140220172
cmp qword [rbp + 0x130], 4
jb 0x14022029b
mov rax, qword [rbp + 0x28]
mov eax, dword [rax]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
and eax, 0xff
cdqe
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
sar edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
and eax, 0xff
cdqe
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
sar edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
and eax, 0xff
cdqe
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
sar edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
and eax, 0xff
cdqe
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
sar edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x130]
sub rax, 4
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
jmp 0x1402201de
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0x130]
dec rax
mov qword [rbp + 0x130], rax
cmp qword [rbp + 0xf8], 0
je 0x140220305
mov eax, dword [rbp + 4]
and eax, 0xff
mov rcx, qword [rbp + 0x28]
movzx ecx, byte [rcx]
xor eax, ecx
cdqe
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
sar edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 0xf4], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0xf4]
mov dword [rbp + 4], eax
jmp 0x14022029b
mov rax, qword [rbp + 0x120]
mov ecx, dword [rbp + 4]
mov dword [rax], ecx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1401fe644
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x14025d4b0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1420070d9]
call fcn.140205606
mov rax, qword [rbp + 0x100]
movsxd rax, dword [rax + 8]
mov r9d, dword [rbp + 0x118]
mov r8d, dword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jle 0x14025d515
mov eax, dword [rbp + 4]
jmp 0x14025d55f
cmp dword [rbp + 4], 0
jne 0x14025d529
mov rcx, qword [rbp + 0x100]
call fcn.1402018c6
jmp 0x14025d55d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x100]
mov ecx, dword [rbp + 0xd4]
mov dword [rax + 0x14], ecx
cmp dword [rbp + 0xd4], 0x2733
je 0x14025d55d
mov rcx, qword [rbp + 0x100]
call fcn.1402018c6
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1401febe4
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x14025dc60
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x1420070d9]
call fcn.140205606
mov rax, qword [rbp + 0x100]
cmp dword [rax + 8], 0xffffffff
je 0x14025dd04
mov rax, qword [rbp + 0x100]
movsxd rax, dword [rax + 8]
mov r9d, dword [rbp + 0x118]
mov r8d, dword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_send]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x14025dcff
mov rcx, qword [rbp + 0x100]
call fcn.1401faa08
mov rcx, qword [rbp + 0x100]
mov dword [rcx + 0x18], eax
mov rax, qword [rbp + 0x100]
cmp dword [rax + 0x18], 0x2733
je 0x14025dcff
mov rcx, qword [rbp + 0x100]
call fcn.1402018c6
mov eax, dword [rbp + 4]
jmp 0x14025dd3a
mov eax, dword [0x1406fa0fc]
add eax, 0x1a
lea rcx, str.Handle__INVALID_SOCKET
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov r8d, eax
lea rdx, str.TSock::Send
lea rcx, str.D:FortekSVN_rds.vc22commo_sock.cpp
call fcn.1401fb683
mov eax, 0xffffffff
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1401fed7e
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140502b50
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1405024d0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140502b8f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x142093020]
jmp 0x140502b99
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1401ff1fc
Capabilities:
Connect socket

Disassembly:
jmp 0x14025c0f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1420070d9]
call fcn.140205606
mov rcx, qword [rbp + 0x100]
call fcn.1402036e4
mov rax, qword [rbp + 0x100]
mov dword [rax + 0x1c], 1
mov rax, qword [rbp + 0x100]
add rax, 0x30
mov rcx, qword [rbp + 0x100]
movsxd rcx, dword [rcx + 8]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rax
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
je 0x14025c167
mov rax, qword [rbp + 0x100]
mov dword [rax + 0x1c], 2
jmp 0x14025c189
mov rcx, qword [rbp + 0x100]
call fcn.1401faa08
mov rcx, qword [rbp + 0x100]
mov dword [rcx + 0x10], eax
mov rcx, qword [rbp + 0x100]
call fcn.1402018c6
cmp dword [rbp + 4], 0xffffffff
je 0x14025c19b
mov dword [rbp + 0xd4], 1
jmp 0x14025c1a5
mov dword [rbp + 0xd4], 0
movzx eax, byte [rbp + 0xd4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1401ff422
Capabilities:
Query environment variable

Disassembly:
jmp 0x1405d60a0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1405d5ed0
lea rcx, [rsp + 0x40]
call fcn.1405d6050
movzx eax, al
test eax, eax
jne 0x1405d60e8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1405d5f00
mov rax, qword [rsp + 0x70]
jmp 0x1405d62b9
lea rcx, [rsp + 0x40]
call fcn.1405d6020
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1405d5fc0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1405d6020
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140201ff1
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1405d618e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1405d5f00
mov rax, qword [rsp + 0x80]
jmp 0x1405d62b9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1401fe973
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1401fe397
lea rcx, [rsp + 0x48]
call fcn.1401fd4ec
movzx eax, al
test eax, eax
jne 0x1405d61f5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1401fa0b7
lea rcx, [rsp + 0x40]
call fcn.1405d5f00
mov rax, qword [rsp + 0x88]
jmp 0x1405d62b9
lea rcx, [rsp + 0x48]
call fcn.140200011
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1405d6020
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140201ff1
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1405d628b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1401fa0b7
lea rcx, [rsp + 0x40]
call fcn.1405d5f00
mov rax, qword [rsp + 0xa0]
jmp 0x1405d62b9
lea rcx, [rsp + 0x48]
call fcn.1401fe2f2
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1401fa0b7
lea rcx, [rsp + 0x40]
call fcn.1405d5f00
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x1401ff45e
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140502a80
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140502450
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140502ac1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x142093020]
jmp 0x140502ac7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x1401ff643
Capabilities:
Get geographical location

Disassembly:
jmp 0x1405ad200
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1405ac130
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1405ad267
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x142093030]
jmp 0x1405ad289
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1401fd36b
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1401ff675
Capabilities:
Terminate process

Disassembly:
jmp 0x1404cc690
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1401ffeef
Capabilities:
Print debug messages

Disassembly:
jmp 0x1405e2c90
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1405e2cb6
jmp 0x1405e2d33
mov rcx, qword [rbp + 0x30]
call fcn.1401fdfa5
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1405e2ccf
jmp 0x1405e2d33
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1405e2cec
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401fa5d5
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1401fb63d
test eax, eax
jne 0x1405e2d33
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x140200034
Capabilities:
Create process on windows

Disassembly:
jmp 0x140412be0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x5a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0x218], rax
lea rcx, [0x142007a6f]
call fcn.140205606
mov edx, 0x50
lea rcx, [rbp + 0x10]
call fcn.140205d9f
mov r8d, 0x4000000
mov edx, 0x3e8
lea rcx, [rbp + 0x10]
call fcn.140201e66
nop
mov r8b, 1
mov rdx, qword [rbp + 0x248]
lea rcx, [rbp + 0x10]
call fcn.1401ffbde
movzx eax, al
test eax, eax
jne 0x140412c8d
mov rdx, qword [rbp + 0x248]
lea rcx, str.Cant_open_file:__s_n
call fcn.1401fe4d7
nop
lea rcx, [rbp + 0x10]
call fcn.1401fe851
jmp 0x140412dfc
lea rcx, [rbp + 0x10]
call fcn.1402011b9
mov rax, qword [rbp + 0x240]
mov r8d, dword [rax + 0xf0ec44]
lea rdx, str.Date:_d_r_n
lea rcx, [rbp + 0x10]
call fcn.1401fc83a
mov rax, qword [rbp + 0x240]
add rax, 0x47e0
mov r8, rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x240]
call fcn.140205c1e
mov rax, qword [rbp + 0x240]
add rax, 0xa530
mov r8, rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x240]
call fcn.140205c1e
mov rax, qword [rbp + 0x240]
add rax, 0x10280
mov r8, rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x240]
call fcn.140205c1e
mov rax, qword [rbp + 0x240]
add rax, 0x15fd0
mov r8, rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x240]
call fcn.140205c1e
mov rax, qword [rbp + 0x240]
add rax, 0x1bd20
mov r8, rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x240]
call fcn.140205c1e
mov rax, qword [rbp + 0x240]
add rax, 0x21a70
mov r8, rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x240]
call fcn.140205c1e
mov rax, qword [rbp + 0x240]
add rax, 0x119ada0
mov r8, rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x240]
call fcn.140205c1e
lea rcx, [rbp + 0x10]
call fcn.1401f9c0c
lea rcx, [rbp + 0x80]
call fcn.14020049e
mov rax, qword [rbp + 0x248]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x248]
mov qword [rsp + 0x20], rax
lea r9, [0x140701a00]
lea r8, str._srar.exe_a__m5__ep__y__s.rar__s
mov edx, 0xc7
lea rcx, [rbp + 0x80]
call fcn.1401f8de8
mov edx, 1
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_WinExec]
nop
lea rcx, [rbp + 0x10]
call fcn.1401fe851
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.140202ef1
mov rcx, qword [rbp + 0x218]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0x228]
pop rdi
pop rbp
ret

Function at 0x1402009b7
Capabilities:
Set environment variable

Disassembly:
jmp 0x1405d8200
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1402011b4
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404d07d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1404d07f0
xor al, al
jmp 0x1404d0871
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1404d0803
xor al, al
jmp 0x1404d0871
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1404d082d
xor al, al
jmp 0x1404d0871
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1404d0841
xor al, al
jmp 0x1404d0871
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1404d0853
xor al, al
jmp 0x1404d0871
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1404d086f
xor al, al
jmp 0x1404d0871
mov al, 1
add rsp, 0x38
ret

Function at 0x14020172c
Capabilities:
Get common file path

Disassembly:
jmp 0x1405bcb10
push rdi
sub rsp, 0x270
mov rax, qword [0x1406fa740]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x104
ja 0x1405bcb69
lea rcx, [rsp + 0x50]
call fcn.1405bc900
jmp 0x1405bcc3c
mov eax, dword [rsp + 0x30]
inc eax
mov eax, eax
mov dword [rsp + 0x20], 0x25
lea r9, [0x140696178]
mov r8d, 2
mov edx, 2
mov ecx, eax
call fcn.140206876
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1401fcf65
lea rcx, [rsp + 0x38]
call fcn.140205304
test rax, rax
jne 0x1405bcbd1
call fcn.1401fcd35
mov dword [rax], ntohs
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.140202906
mov eax, dword [rsp + 0x40]
jmp 0x1405bcc3c
lea rcx, [rsp + 0x38]
call fcn.140205304
mov ecx, dword [rsp + 0x30]
inc ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1405bcc18
call fcn.1401fcd35
mov dword [rax], ntohs
mov dword [rsp + 0x48], 0
lea rcx, [rsp + 0x38]
call fcn.140202906
mov eax, dword [rsp + 0x48]
jmp 0x1405bcc3c
lea rcx, [rsp + 0x38]
call fcn.140205304
mov rcx, rax
call fcn.1405bc900
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x38]
call fcn.140202906
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401fe6b7
add rsp, 0x270
pop rdi
ret
Function at 0x14020223a
Capabilities:
Delete file

Disassembly:
jmp 0x14025eee0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x1420070ea]
call fcn.140205606
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
jne 0x14025ef1d
mov dword [rbp + 0xc0], 1
jmp 0x14025ef27
mov dword [rbp + 0xc0], 0
movzx eax, byte [rbp + 0xc0]
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x140202681
Capabilities:
Terminate process

Disassembly:
jmp 0x140503e40
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140503e6e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14020458f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140202f23
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14042ae00
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x142007a58]
call fcn.140205606
mov rax, qword [rbp + 0x140]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax]
mov byte [rbp + 0x114], al
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
movzx eax, byte [rbp + 0x114]
mov byte [rbp + 0x44], al
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 8], rax
jae 0x14042ae8d
mov rax, qword [rbp + 8]
movzx eax, byte [rax]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
movzx eax, byte [rbp + 0x44]
xor eax, dword [rbp + 0x114]
mov byte [rbp + 0x44], al
jmp 0x14042ae5c
movzx eax, byte [rbp + 0x44]
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x140202f37
Capabilities:
Create process on windows

Disassembly:
jmp 0x140413340
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x248]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0x1d8], rax
lea rcx, [0x142007a6f]
call fcn.140205606
mov edx, 0x18
lea rcx, [rbp + 8]
call fcn.1401fe987
lea rcx, [rbp + 8]
call fcn.1401fac38
nop
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 8]
call fcn.1401ffb57
movzx eax, al
test eax, eax
jne 0x1404133df
mov rdx, qword [rbp + 0x208]
lea rcx, str.Cant_open_file:__s_n
call fcn.1401fe4d7
nop
lea rcx, [rbp + 8]
call fcn.14020607e
jmp 0x1404134f7
lea rcx, [rbp + 8]
call fcn.1401f84ab
mov rax, qword [rbp + 0x200]
mov r9d, dword [rax + 0xf0ec44]
lea r8, str.Date:_d_r_n
mov edx, 0xc8
lea rcx, [rbp + 0x40]
call fcn.1401f8de8
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 8]
call fcn.1401fc88f
lea rax, str.DiffAmtW
mov qword [rsp + 0x30], rax
lea rax, [0x14065fcfc]
mov qword [rsp + 0x28], rax
lea rax, str.Name
mov qword [rsp + 0x20], rax
lea r9, [0x14065fd08]
lea r8, str._5s__12s__2s__8s_r_n
mov edx, 0xc8
lea rcx, [rbp + 0x40]
call fcn.1401f8de8
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 8]
call fcn.1401fc88f
mov rax, qword [rbp + 0x200]
mov r8, qword [rax + 0x118eec0]
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x200]
call fcn.1401f99f0
mov rax, qword [rbp + 0x200]
mov r8, qword [rax + 0x118ef58]
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x200]
call fcn.1401f99f0
lea rcx, [rbp + 8]
call fcn.140203bad
mov rax, qword [rbp + 0x208]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x208]
mov qword [rsp + 0x20], rax
lea r9, [0x140701a00]
lea r8, str._srar.exe_a__m5__ep__y__s.rar__s
mov edx, 0xc7
lea rcx, [rbp + 0x40]
call fcn.1401f8de8
mov edx, 1
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_WinExec]
nop
lea rcx, [rbp + 8]
call fcn.14020607e
lea rcx, [rbp - 0x40]
lea rdx, reloc.WS2_32.dll_bind
call fcn.140202ef1
mov rcx, qword [rbp + 0x1d8]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0x1e8]
pop rdi
pop rbp
ret