joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402033a6
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1404c2ae0
sub rsp, 0x28
cmp dword [0x1406fa738], 0xffffffff
jne 0x1404c2af1
xor eax, eax
jmp 0x1404c2afd
mov ecx, dword [0x1406fa738]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x28
ret

Function at 0x14020370c
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x14025d3b0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1420070d9]
call fcn.140205606
mov rax, qword [rbp + 0x100]
mov dword [rax + 0x14], 0
mov rax, qword [rbp + 0x100]
movsxd rax, dword [rax + 8]
xor r9d, r9d
mov r8d, dword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jle 0x14025d41a
mov eax, dword [rbp + 4]
jmp 0x14025d46a
cmp dword [rbp + 4], 0
jne 0x14025d42e
mov rcx, qword [rbp + 0x100]
call fcn.1402018c6
jmp 0x14025d468
mov rcx, qword [rbp + 0x100]
call fcn.1401faa08
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x100]
mov ecx, dword [rbp + 0xd4]
mov dword [rax + 0x14], ecx
cmp dword [rbp + 0xd4], 0x2733
je 0x14025d468
mov rcx, qword [rbp + 0x100]
call fcn.1402018c6
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140203b6c
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14021fb60
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x142007002]
call fcn.140205606
mov rax, qword [rbp + 0x150]
mov eax, dword [rax]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x48], rax
jmp 0x14021fbb8
mov rax, qword [rbp + 0x48]
dec rax
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x28]
call fcn.1401f869f
movzx eax, al
test eax, eax
jne 0x14021fc10
cmp qword [rbp + 0x48], 0
jbe 0x14021fc10
mov eax, dword [rbp + 4]
and eax, 0xff
mov rcx, qword [rbp + 0x28]
movzx ecx, byte [rcx]
xor eax, ecx
mov eax, eax
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x14021fbad
cmp qword [rbp + 0x48], 4
jb 0x14021fcc4
mov rax, qword [rbp + 0x28]
mov eax, dword [rax]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
and eax, 0xff
mov eax, eax
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
and eax, 0xff
mov eax, eax
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
and eax, 0xff
mov eax, eax
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
and eax, 0xff
mov eax, eax
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x48]
sub rax, 4
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
jmp 0x14021fc10
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x48]
dec rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x118], 0
jbe 0x14021fcf0
mov dword [rbp + 0x120], 1
jmp 0x14021fcfa
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x14021fd44
mov eax, dword [rbp + 4]
and eax, 0xff
mov rcx, qword [rbp + 0x28]
movzx ecx, byte [rcx]
xor eax, ecx
mov eax, eax
lea rcx, [0x140619c20]
mov edx, dword [rbp + 4]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x14021fcc4
mov rax, qword [rbp + 0x150]
mov ecx, dword [rbp + 4]
mov dword [rax], ecx
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x140203b80
Capabilities:
Create directory

Disassembly:
jmp 0x14025eac0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x278
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x298]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0x248], rax
lea rcx, [0x1420070ea]
call fcn.140205606
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
cmp qword [rbp + 0x270], 0
je 0x14025eb31
mov rax, qword [rbp + 0x270]
movsx eax, byte [rax]
test eax, eax
jne 0x14025eb38
xor al, al
jmp 0x14025ece8
xor edx, edx
mov rcx, qword [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x14025eb57
mov dword [rbp + 0x244], 1
jmp 0x14025eb61
mov dword [rbp + 0x244], 0
movzx eax, byte [rbp + 0x244]
mov byte [rbp + 0x134], al
movzx eax, byte [rbp + 0x134]
test eax, eax
jne 0x14025ece1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14025ece1
mov r8d, 0x104
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.140201e5c
mov r8d, 0x103
mov rdx, qword [rbp + 0x270]
lea rcx, [rbp + 0x10]
call fcn.1401fb552
mov edx, 0x5c
lea rcx, [rbp + 0x10]
call fcn.1401f8c3a
mov qword [rbp + 0x158], rax
mov edx, 0x3a
lea rcx, [rbp + 0x10]
call fcn.1401f8c3a
mov qword [rbp + 0x178], rax
cmp qword [rbp + 0x158], 0
je 0x14025ec44
mov rax, qword [rbp + 0x158]
movsx eax, byte [rax + 1]
test eax, eax
jne 0x14025ec44
mov rax, qword [rbp + 0x158]
mov byte [rax], 0
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x10]
cmp rax, qword [rbp + 0x158]
jae 0x14025ec2f
mov rax, qword [rbp + 0x158]
movsx eax, byte [rax]
cmp eax, 0x5c
je 0x14025ebf8
mov edx, 0x5c
lea rcx, [rbp + 0x10]
call fcn.1401f8c3a
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
je 0x14025ece1
mov rax, qword [rbp + 0x158]
mov byte [rax], 0
cmp qword [rbp + 0x178], 0
jne 0x14025ec77
lea rcx, [rbp + 0x10]
call fcn.140203b80
mov byte [rbp + 0x134], al
jmp 0x14025eca0
mov rax, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x158]
sub rcx, rax
mov rax, rcx
cmp rax, 1
jle 0x14025eca0
lea rcx, [rbp + 0x10]
call fcn.140203b80
mov byte [rbp + 0x134], al
movzx eax, byte [rbp + 0x134]
test eax, eax
je 0x14025ece1
xor edx, edx
mov rcx, qword [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x14025ecca
mov dword [rbp + 0x244], 1
jmp 0x14025ecd4
mov dword [rbp + 0x244], 0
movzx eax, byte [rbp + 0x244]
mov byte [rbp + 0x134], al
movzx eax, byte [rbp + 0x134]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.140202ef1
mov rax, rdi
mov rcx, qword [rbp + 0x248]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret

Function at 0x140203bb2
Capabilities:
Delete file

Disassembly:
jmp 0x14022a560
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x14200702d]
call fcn.140205606
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
jne 0x14022a59d
mov dword [rbp + 0xc0], 1
jmp 0x14022a5a7
mov dword [rbp + 0xc0], 0
movzx eax, byte [rbp + 0xc0]
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x140204666
Capabilities:
Print debug messages

Disassembly:
jmp 0x1405ab9a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x140204733
Capabilities:
Read file on windows

Disassembly:
jmp 0x14022e520
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x138]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x14200702d]
call fcn.140205606
cmp qword [rbp + 0x108], 0
je 0x14022e5bb
cmp dword [rbp + 0x110], 0
je 0x14022e5bb
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
mov r8d, dword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14022e5bb
mov eax, dword [rbp + 4]
jmp 0x14022e5bd
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.140202ef1
mov rax, rdi
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1402047b5
Capabilities:
Resume thread

Disassembly:
jmp 0x1404c3500
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov rcx, rax
call fcn.140200494
add rax, 0x20
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x50]
call fcn.1401fdfc3
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9, rax
lea r8, [0x1404c4300]
xor edx, edx
xor ecx, ecx
call fcn.140205403
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1404c355f
xor al, al
jmp 0x1404c35b6
mov rax, qword [rsp + 0x50]
mov rcx, rax
call fcn.1401fdfc3
mov rcx, rax
call fcn.1401f8a41
mov rax, qword [rsp + 0x50]
mov rcx, rax
call fcn.140200494
add rax, 0x10
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.14020238e
mov rax, qword [rsp + 0x50]
mov rcx, rax
call fcn.140200494
add rax, 0x10
mov rcx, rax
call fcn.1401ff3cd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
add rsp, 0x48
ret
Function at 0x1402049d1
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140502bc0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140502510
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140502c09
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x142093020]
jmp 0x140502c18
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140204ce2
Capabilities:
Set environment variable

Disassembly:
jmp 0x1405edfa0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1401fcea7
lea rcx, [rsp + 0x48]
call fcn.1401fcea7
call fcn.1401ff288
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1401fc6b4
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1405ee00f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1401fdca3
lea rcx, [rsp + 0x78]
call fcn.1401fdca3
mov eax, dword [rsp + 0x24]
jmp 0x1405ee0a0
call fcn.1401ff288
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1401fc6b4
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1405ee056
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1401fdca3
lea rcx, [rsp + 0x78]
call fcn.1401fdca3
mov eax, dword [rsp + 0x2c]
jmp 0x1405ee0a0
lea rcx, [rsp + 0x48]
call fcn.1401fcc63
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1401fcc63
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1401fdca3
lea rcx, [rsp + 0x78]
call fcn.1401fdca3
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x140204e22
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x1402fc1b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x508
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xda
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x528]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0x4d0], rax
lea rcx, [0x142007307]
call fcn.140205606
lea rcx, [rbp + 8]
call fcn.1402054bc
nop
lea rcx, [rbp + 0x48]
call fcn.1402054bc
nop
lea rcx, [0x140701a00]
call fcn.1401fdfa5
mov qword [rbp + 0x228], rax
mov rdx, qword [rbp + 0x508]
lea rcx, [rbp + 0x3c8]
call fcn.1402015b0
mov qword [rbp + 0x4b8], rax
mov rax, qword [rbp + 0x4b8]
mov qword [rbp + 0x4c0], rax
lea r8, [0x1406224c8]
mov rdx, qword [rbp + 0x4c0]
lea rcx, [rbp + 0x408]
call fcn.1402041ed
mov qword [rbp + 0x4c8], rax
mov rdx, qword [rbp + 0x4c8]
lea rcx, [rbp + 8]
call fcn.1401fb96c
lea rcx, [rbp + 0x408]
call fcn.1401fa67f
nop
lea rcx, [rbp + 0x3c8]
call fcn.1401fa67f
lea rcx, [rbp + 8]
call fcn.1401f9211
lea rdx, [rbp + 0xd0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0xffffffffffffffff
je 0x1402fc3e0
mov rdx, qword [rbp + 0x508]
lea rcx, [rbp + 0x448]
call fcn.1402015b0
mov qword [rbp + 0x4b8], rax
mov rdx, qword [rbp + 0x4b8]
lea rcx, [rbp + 8]
call fcn.1401fb96c
lea rcx, [rbp + 0x448]
call fcn.1401fa67f
mov eax, 1
imul rax, rax, 0
movsx eax, byte [rbp + rax + 0xfc]
cmp eax, 0x2e
jne 0x1402fc316
jmp 0x1402fc3b6
mov eax, dword [rbp + 0xd0]
and eax, 0x10
test eax, eax
je 0x1402fc328
jmp 0x1402fc3b6
lea r8, [rbp + 0xfc]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x488]
call fcn.1402025dc
mov qword [rbp + 0x4b8], rax
mov rdx, qword [rbp + 0x4b8]
lea rcx, [rbp + 0x48]
call fcn.1401fb96c
lea rcx, [rbp + 0x488]
call fcn.1401fa67f
xor r8d, r8d
lea rdx, [0x140701a00]
lea rcx, [rbp + 0x48]
call fcn.1401fe054
test rax, rax
jne 0x1402fc393
lea rcx, [rbp + 0x48]
call fcn.1401f9211
add rax, qword [rbp + 0x228]
mov qword [rbp + 0x88], rax
jmp 0x1402fc3a3
lea rcx, [rbp + 0x48]
call fcn.1401f9211
mov qword [rbp + 0x88], rax
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x500]
call fcn.1402040cb
lea rdx, [rbp + 0xd0]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1402fc2fb
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp + 0x48]
call fcn.1401fa67f
nop
lea rcx, [rbp + 8]
call fcn.1401fa67f
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.140202ef1
mov rcx, qword [rbp + 0x4d0]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0x4e8]
pop rdi
pop rbp
ret
Function at 0x1402052fa
Capabilities:
Write file on windows

Disassembly:
jmp 0x140230550
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x138]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x14200702d]
call fcn.140205606
cmp qword [rbp + 0x108], 0
je 0x1402305fb
cmp dword [rbp + 0x110], 0
jbe 0x1402305fb
cmp dword [rbp + 0x110], 0x7fffffff
ja 0x1402305fb
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
mov r8d, dword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1402305f7
mov eax, dword [rbp + 4]
jmp 0x1402305fd
xor eax, eax
jmp 0x1402305fd
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.140202ef1
mov rax, rdi
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1402053d1
Capabilities:
Copy file

Disassembly:
jmp 0x140229180
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x14200702d]
call fcn.140205606
movzx eax, byte [rbp + 0x100]
mov r8d, eax
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, 1
jne 0x1402291d8
mov dword [rbp + 0xc0], 1
jmp 0x1402291e2
mov dword [rbp + 0xc0], 0
movzx eax, byte [rbp + 0xc0]
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x140205403
Capabilities:
Create thread

Disassembly:
jmp 0x140591700
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x14059172c
mov dword [rsp + 0x30], 1
jmp 0x140591734
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x14059177d
lea rax, str.procedure___nullptr
mov qword [rsp + 0x28], rax
lea rax, [0x14066a940]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xc8
lea rdx, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
mov ecx, 2
call fcn.1401f9720
cmp eax, 1
jne 0x14059177d
int3
cmp dword [rsp + 0x34], 0
jne 0x1405917bf
call fcn.1401fcd35
mov dword [rax], reloc.WS2_32.dll_shutdown
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
lea r8, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
lea rdx, str._beginthreadex
lea rcx, str.procedure___nullptr
call fcn.1402035fe
xor eax, eax
jmp 0x1405918bf
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1405911f0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140590ff0
lea rcx, [rsp + 0x40]
call fcn.140591060
movzx eax, al
test eax, eax
jne 0x14059180f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.140591040
mov rax, qword [rsp + 0x50]
jmp 0x1405918bf
lea rcx, [rsp + 0x40]
call fcn.1405913a0
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x140590da0]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140591883
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401fbe62
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call fcn.140591040
mov rax, qword [rsp + 0x58]
jmp 0x1405918bf
cmp qword [rsp + 0xa8], 0
je 0x14059189c
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
lea rcx, [rsp + 0x40]
call fcn.140591360
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.140591040
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140205a8e
Capabilities:
Create process on windows

Disassembly:
jmp 0x1402b2c60
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xa6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0x408], rax
lea rcx, [0x142007202]
call fcn.140205606
mov edx, 0x18
lea rcx, [rbp + 8]
call fcn.1401fe987
lea rcx, [rbp + 8]
call fcn.1401fac38
nop
mov rdx, qword [rbp + 0x438]
lea rcx, [rbp + 8]
call fcn.1401ffb57
movzx eax, al
test eax, eax
jne 0x1402b2cff
mov rdx, qword [rbp + 0x438]
lea rcx, str.Cant_open_file:__s_n
call fcn.1401fe4d7
nop
lea rcx, [rbp + 8]
call fcn.14020607e
jmp 0x1402b2e10
lea rcx, [rbp + 8]
call fcn.1401f84ab
lea rcx, [rbp + 0x38]
call fcn.1402054bc
nop
mov edx, 0x8000
lea rcx, [rbp + 0x38]
call fcn.1401faaf3
mov rax, qword [rbp + 0x430]
mov r9d, dword [rax + 0x13520]
lea r8, str.Date:_d_r_n
mov edx, 0x1f4
lea rcx, [rbp + 0x80]
call fcn.1401f8de8
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 8]
call fcn.1401fc88f
mov rax, qword [rbp + 0x430]
add rax, 0x140
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x430]
call fcn.1401fc9ed
mov rax, qword [rbp + 0x430]
add rax, 0x99f8
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x430]
call fcn.1401fc9ed
lea rcx, [rbp + 8]
call fcn.140203bad
mov r8d, 0x1f4
xor edx, edx
lea rcx, [rbp + 0x80]
call fcn.140201e5c
mov rax, qword [rbp + 0x438]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x438]
mov qword [rsp + 0x20], rax
lea r9, [0x140701a00]
lea r8, str._srar.exe_a__m5__ep__y__s.rar__s
mov edx, 0x1f3
lea rcx, [rbp + 0x80]
call fcn.1401f8de8
mov edx, 1
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_WinExec]
nop
lea rcx, [rbp + 0x38]
call fcn.1401fa67f
nop
lea rcx, [rbp + 8]
call fcn.14020607e
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.140202ef1
mov rcx, qword [rbp + 0x408]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0x418]
pop rdi
pop rbp
ret

Function at 0x140205dc2
Capabilities:
Resolve dns

Disassembly:
jmp 0x14025d150
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1420070d9]
call fcn.140205606
mov eax, 2
mov rcx, qword [rbp + 0x118]
mov word [rcx], ax
cmp qword [rbp + 0x108], 0
je 0x14025d1ed
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rcx, qword [rbp + 0x118]
mov dword [rcx + 4], eax
mov rax, qword [rbp + 0x118]
cmp dword [rax + 4], 0xffffffff
jne 0x14025d1eb
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14025d1eb
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x118]
mov eax, dword [rax]
mov dword [rcx + 4], eax
jmp 0x14025d1fb
mov rax, qword [rbp + 0x118]
mov dword [rax + 4], 0
movzx ecx, word [rbp + 0x110]
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbp + 0x118]
mov word [rcx + 2], ax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140206231
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1405b86f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1406fa740]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x28], 0
jmp 0x1405b872c
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x20
jge 0x1405b8758
movsxd rax, dword [rsp + 0x28]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0x20
jae 0x1405b8747
jmp 0x1405b874c
call fcn.1402018ad
mov rax, qword [rsp + 0x48]
mov byte [rsp + rax + 0x68], 0
jmp 0x1405b8722
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
and eax, 7
mov ecx, 1
mov dword [rsp + 0x40], ecx
movzx ecx, al
mov eax, dword [rsp + 0x40]
shl eax, cl
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
sar ecx, 3
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x68]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx]
sar ecx, 3
movsxd rcx, ecx
mov byte [rsp + rcx + 0x68], al
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x44], 0
jne 0x1405b8765
cmp qword [rsp + 0xa0], 0
je 0x1405b87e5
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
jmp 0x1405b87f5
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movzx eax, byte [rax]
sar eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x68]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
and eax, ecx
test eax, eax
je 0x1405b8856
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x1405b8856
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x1405b8809
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
jmp 0x1405b886f
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x1405b88c6
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movzx eax, byte [rax]
sar eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x68]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
movzx ecx, byte [rcx]
and ecx, 7
mov edx, 1
shl edx, cl
mov ecx, edx
and eax, ecx
test eax, eax
je 0x1405b88c4
mov rax, qword [rsp + 0x20]
mov byte [rax], 0
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x1405b88c6
jmp 0x1405b8862
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x20], rax
je 0x1405b88ee
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
jmp 0x1405b88f7
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401fe6b7
add rsp, 0x98
ret