joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001dad0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
mov ecx, esi
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, dword [edi]
shr eax, 8
xor dl, al
movsx eax, dl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x10069060]
xor eax, ecx
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, esi
shr esi, 8
and eax, 0xff
xor esi, dword [eax*4 + 0x10069060]
mov al, dl
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
ret

Function at 0x1001e040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push 1
lea eax, [edi + 0xcb0]
push eax
push edi
call fcn.1000bbc0
test eax, eax
je 0x1001e0ae
mov eax, dword [edi]
push edi
call dword [eax + 0x194]
push 0
push 0
push 1
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov dword [edi + 0xdc0], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0xdc4], eax
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x1001de30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xdbc], eax
pop edi
pop ebp
ret 4
Function at 0x10022660
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov di, word [ebp + 8]
and eax, 0x8000
movzx edx, di
add edx, 0xfffffffd
cmp edx, 0x17
ja case.0x1002268e.4
movzx ecx, byte [edx + 0x100227f8]
jmp dword [ecx*4 + 0x100227e0]
test dword [esi + 0xdf8], 0x800
jne 0x100227d3
test eax, eax
jne 0x100227d3
mov eax, dword [esi + 0xe10]
cmp eax, dword [esi + 0xe14]
jne 0x100226e6
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.10021d50
mov eax, dword [esi + 0xe14]
test eax, eax
je 0x100226d1
dec eax
push eax
push dword [esi + 0xe10]
mov ecx, esi
call fcn.10021d50
mov ecx, esi
call fcn.100219f0
mov eax, dword [esi]
push esi
call dword [eax + 0x1c4]
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
test byte [esi + 0xdf8], 0x20
jne 0x100227d3
mov eax, dword [esi]
push esi
call dword [eax + 0x1c0]
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
test dword [esi + 0xdf8], 0x800
jne 0x100227d3
mov eax, dword [esi]
push esi
call dword [eax + 0x1bc]
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0xdf8]
test eax, 0x800
jne 0x100227d3
test al, 0x20
jne 0x100227d3
mov eax, dword [esi]
push esi
call dword [eax + 0x1c8]
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
test dword [esi + 0xdf8], 0x800
jne 0x100227d3
mov ecx, esi
call fcn.10022f40
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0xdf8]
test eax, 0x2000
je 0x100227a5
cmp di, 0x30
jb 0x1002279f
cmp di, 0x39
jbe 0x100227a5
cmp di, 0x2d
jne 0x100227d3
test eax, 0x800
jne 0x100227d3
cmp di, 0x20
jb 0x100227d3
cmp di, 0x7f
je 0x100227d3
xor eax, eax
mov word [ebp + 8], di
push 1
mov word [ebp + 0xa], ax
mov ecx, esi
push 1
lea eax, [ebp + 8]
push eax
push 1
call fcn.10022a40
pop edi
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x10022840
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push edi
mov eax, dword [ecx + 0xe10]
mov edi, dword [ecx + 0xe14]
cmp eax, edi
mov ecx, edi
cmovl ecx, eax
cmovg edi, eax
mov dword [ebp - 4], ecx
cmp edi, ecx
je 0x100228d2
sub edi, ecx
push ebx
add edi, edi
push esi
lea eax, [edi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp - 4]
push edi
mov ecx, dword [ecx + 0xdd8]
lea ecx, [ecx + eax*2]
push ecx
push esi
call fcn.1004b630
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
push dword [eax + 0xc38]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10023010
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
jne 0x100231d8
push edi
push 0x10
call esi
movzx edi, ax
push 0x11
and edi, 0x8000
call esi
mov ecx, dword [ebp + 0xc]
movzx edx, ax
add ecx, 0xffffffdd
and edx, 0x8000
cmp ecx, 0xb
ja case.0x10023056.38
jmp dword [ecx*4 + 0x100231e0]
mov ecx, dword [ebp + 8]
push edi
test edx, edx
je 0x10023070
call fcn.10022580
pop edi
pop esi
pop ebp
ret 0x10
call fcn.10022460
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
push edi
test edx, edx
je 0x1002308e
call fcn.100225f0
pop edi
pop esi
pop ebp
ret 0x10
call fcn.100224f0
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
push edx
push edi
call fcn.10022540
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
push edx
push edi
call fcn.100224a0
pop edi
pop esi
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
test dword [esi + 0xdf8], 0x800
jne case.0x10023056.38
test edi, edi
je 0x100230d8
test edx, edx
jne case.0x10023056.38
mov eax, dword [esi + 0xe10]
cmp eax, dword [esi + 0xe14]
je 0x100230fd
mov eax, dword [esi]
push esi
test edi, edi
je 0x10023199
call dword [eax + 0x1c8]
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, esi
push 0
push 0xffffffffffffffff
test edi, edi
je 0x1002313b
call fcn.10021d50
mov eax, dword [esi + 0xe14]
test eax, eax
je 0x10023117
dec eax
push eax
push dword [esi + 0xe10]
mov ecx, esi
call fcn.10021d50
mov ecx, esi
call fcn.100219f0
mov eax, dword [esi]
push esi
call dword [eax + 0x1c4]
pop edi
pop esi
pop ebp
ret 0x10
test edx, edx
je 0x10023188
call fcn.10021d50
cmp dword [esi + 0xddc], 0xffffffff
jne 0x1002315f
push dword [esi + 0xdd8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esi + 0xddc], eax
push dword [esi + 0xddc]
mov ecx, esi
push dword [esi + 0xe10]
call fcn.10021d50
mov ecx, esi
call fcn.100219f0
mov eax, dword [esi]
push esi
call dword [eax + 0x1c4]
pop edi
pop esi
pop ebp
ret 0x10
call fcn.10021d50
push 1
mov ecx, esi
call fcn.100224f0
mov eax, dword [esi]
push esi
call dword [eax + 0x1c4]
pop edi
pop esi
pop ebp
ret 0x10
test edi, edi
je 0x100231c7
mov ecx, dword [ebp + 8]
test dword [ecx + 0xdf8], 0x800
jne case.0x10023056.38
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1bc]
pop edi
pop esi
pop ebp
ret 0x10
test edx, edx
je case.0x10023056.38
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c0]
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x100235a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0xdf8], 0x800
jne 0x10023618
push edi
push dword [esi + 0xc38]
call dword [sym.imp.USER32.dll_OpenClipboard]
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x100235f6
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 1
push 1
push eax
push 1
mov ecx, esi
call fcn.10022a40
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
ret 4
test byte [esi + 0xdf8], 0x20
je 0x10023611
push 1
push 1
push 0x1006a280
push 1
mov ecx, esi
call fcn.10022a40
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10029e20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov eax, dword [edi]
call dword [eax + 0x54]
push 2
push edi
mov esi, eax
call fcn.1000d8c0
push 1
push edi
call sym.zbgui.dll_Plugin_Redraw
cmp esi, 4
jne 0x10029e6c
push 5
push 0
push 0
lea eax, [edi + 0xcb0]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push 0x21
mov ecx, edi
call fcn.1000bd50
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10029e80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 5
push 0
push 0
add eax, 0xcb0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 4

Function at 0x10030420
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ecx + 0xffc]
push edi
mov edi, dword [ecx + 0x1000]
cmp eax, edi
mov dword [ebp - 4], ecx
mov ecx, edi
cmovl ecx, eax
cmovg edi, eax
mov dword [ebp - 8], ecx
cmp edi, ecx
je 0x100304b4
sub edi, ecx
push ebx
add edi, edi
push esi
lea eax, [edi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp - 4]
mov esi, eax
mov eax, dword [ebp - 8]
push edi
mov ecx, dword [ecx + 0xfcc]
lea ecx, [ecx + eax*2]
push ecx
push esi
call fcn.1004b630
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push dword [eax + 0xc38]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10030dc0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
test dword [esi + 0xfe4], 0x800
jne 0x10030e0e
push edi
push dword [esi + 0xc38]
call dword [sym.imp.USER32.dll_OpenClipboard]
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x10030e06
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 1
push 1
push eax
push 1
mov ecx, esi
call fcn.100316d0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret

Function at 0x10038020
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
js 0x10038108
cmp ecx, dword [edi + 0x11d4]
jge 0x10038108
mov eax, dword [edi + 0x11e4]
push ebx
mov ebx, dword [eax + ecx*4]
test ebx, ebx
je 0x10038107
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
and eax, 0x8000
push 0x11
mov dword [ebp - 4], eax
call esi
and eax, 0x8000
cmp dword [edi + 0x11cc], 0
je 0x100380c0
cmp dword [ebp - 4], 0
jne 0x1003809e
test eax, eax
je 0x100380c0
cmp dword [ebx + 0xc], 0
mov ecx, ebx
je 0x100380f8
push 1
mov dword [ebx + 0xc], 0
call fcn.10036ae0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
call fcn.10037590
cmp eax, 0xffffffff
je 0x100380f6
push esi
push eax
mov ecx, edi
call fcn.10038110
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
xor esi, esi
cmp dword [edi + 0x11d4], esi
jle 0x100380f6
lea ebx, [ebx]
mov eax, dword [edi + 0x11e4]
mov ecx, dword [eax + esi*4]
cmp dword [ecx + 0xc], 0
je 0x100380ed
push 1
mov dword [ecx + 0xc], 0
call fcn.10036ae0
inc esi
cmp esi, dword [edi + 0x11d4]
jl 0x100380d0
mov ecx, ebx
push 4
mov dword [ebx + 0xc], 1
call fcn.10036ae0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x100457e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100654a3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10080680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
xor eax, eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], 0
mov word [esi + 0x1c], ax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea ecx, [esi + 0x48]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], eax
mov word [ecx], ax
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
push eax
push 0x10066594
mov byte [ebp - 4], 1
mov dword [esi + 0x60], 4
mov byte [esi + 0x40], al
mov dword [esi + 0x44], eax
call fcn.10007a50
mov dword [esi + 0x68], 0
mov eax, esi
mov dword [esi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100458b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100654d3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10080680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
xor eax, eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], 0
mov word [esi + 0x1c], ax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi], vtable.TiXmlElement.0
xor ecx, ecx
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x40], vtable.TiXmlAttribute.0
mov dword [esi + 0x64], 7
mov dword [esi + 0x60], 0
mov dword [ebp - 4], eax
lea eax, [esi + 0x40]
mov word [eax + 0x10], cx
mov dword [eax + 0x3c], 7
mov dword [eax + 0x38], ecx
mov word [eax + 0x28], cx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x44], eax
mov dword [eax + 0x40], eax
mov edi, dword [ebp + 8]
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], ecx
mov byte [ebp - 4], 1
cmp word [edi], cx
jne 0x10045972
xor eax, eax
jmp 0x1004597b
push edi
call fcn.1004c3e4
add esp, 4
push eax
push edi
lea ecx, [esi + 0x1c]
call fcn.10007a50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10045a00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100654f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10080680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
xor eax, eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], 0
mov word [esi + 0x1c], ax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov ebx, dword [ebp + 8]
mov dword [esi], vtable.TiXmlText.0
mov dword [ebp - 4], eax
cmp word [ebx], ax
je 0x10045a80
push ebx
call fcn.1004c3e4
add esp, 4
push eax
push ebx
lea ecx, [esi + 0x1c]
call fcn.10007a50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002940
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.WS2_32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
mov dword [0x10026938], eax
cmp eax, esi
jne 0x10002968
push str.WS2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10026938], eax
push 1
push str.WS2_32.dll
call fcn.1001c2b0
add esp, 8
mov dword [0x1002693c], eax
cmp dword [0x10026938], esi
je 0x10002ab2
cmp dword [0x1002ba6c], esi
je 0x10002ab2
push 0x100276b0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x10026938]
push str.send
mov dword [0x100276cc], esi
mov dword [0x100276c8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov edi, 8
mov dword [0x10026754], eax
mov eax, 0x10002360
lea ecx, [edi - 4]
call fcn.10001910
test eax, eax
jne 0x100029de
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [0x10026938]
push str.recv
push ecx
call esi
mov edi, 9
mov dword [0x10026798], eax
mov eax, 0x100023a0
lea ecx, [edi - 5]
call fcn.10001910
test eax, eax
je 0x100029d9
mov edx, dword [0x10026938]
push str.sendto
push edx
call esi
mov edi, 0xa
mov dword [0x100267dc], eax
mov eax, 0x10002410
lea ecx, [edi - 6]
call fcn.10001910
test eax, eax
je 0x100029d9
mov eax, dword [0x10026938]
push str.recvfrom
push eax
call esi
mov edi, 0xb
mov dword [0x10026820], eax
mov eax, 0x10002450
lea ecx, [edi - 7]
call fcn.10001910
test eax, eax
je 0x100029d9
mov ecx, dword [0x10026938]
push str.WSASend
push ecx
call esi
mov edi, 0xc
mov dword [0x10026864], eax
mov eax, 0x100024d0
lea ecx, [edi - 8]
call fcn.10001910
test eax, eax
je 0x100029d9
mov edx, dword [0x10026938]
push str.WSARecv
push edx
call esi
mov edi, 0xd
mov dword [0x100268a8], eax
mov eax, 0x10002510
lea ecx, [edi - 9]
call fcn.10001910
test eax, eax
je 0x100029d9
pop edi
mov eax, 1
pop esi
ret

Function at 0x10002b20
Capabilities:
Terminate process

Disassembly:
cmp dword [0x10027ea0], 0
jne 0x10002b7b
call fcn.10005c80
test eax, eax
je 0x10002b67
call fcn.10005c20
test eax, eax
je 0x10002b51
mov dword [0x10027e9c], 0x4d
mov dword [0x10027ea0], 0x37
jmp 0x10002b7b
mov dword [0x10027e9c], 0xd7
mov dword [0x10027ea0], 0x18f
jmp 0x10002b7b
mov dword [0x10027e9c], 0x89
mov dword [0x10027ea0], 0x115
call fcn.10005c80
test eax, eax
je 0x10002bb9
call fcn.100058c0
test eax, eax
jne 0x10002b92
or eax, 0xffffffff
jmp 0x10002ba4
call fcn.10005990
movzx eax, al
neg eax
sbb eax, eax
and eax, 2
add eax, 0xfffffffe
cmp dword [0x10029908], 8
jne 0x10002bbe
test eax, eax
je 0x10002bbe
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.10002590
call fcn.10002940
call fcn.10005b50
mov eax, 1
ret
Function at 0x10003550
Capabilities:
Get common file path

Disassembly:
cmp byte [0x1002bb48], 0
jne 0x10003663
push 0x100
push 0x1002bb48
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [esp + 4], 0
jne 0x100035b8
mov eax, dword [str.C:_Windows_SysWOW64_]
mov ecx, dword [0x1002156c]
mov edx, dword [0x10021570]
mov dword [0x1002bb48], eax
mov eax, dword [0x10021574]
mov dword [0x1002bb4c], ecx
mov ecx, dword [0x10021578]
mov dword [0x1002bb50], edx
mov dl, byte [0x1002157c]
mov dword [0x1002bb54], eax
mov dword [0x1002bb58], ecx
mov byte [0x1002bb5c], dl
mov eax, 0x1002bb48
push esi
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100035c3
sub eax, esi
test eax, eax
jle 0x100035fd
cmp byte [edx + 0x1002bb48], 0x5c
jne 0x100035e0
mov byte [edx + 0x1002bb48], 0x2f
mov eax, 0x1002bb48
inc edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100035f0
sub eax, esi
cmp edx, eax
jl 0x100035d0
mov eax, 0x1002bb48
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003606
sub eax, edx
cmp byte [eax + 0x1002bb47], 0x2f
je 0x10003632
push edi
mov edi, 0x1002bb48
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003620
mov ax, word [0x10021580]
mov word [edi], ax
pop edi
mov eax, 0x1002bb48
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10003638
mov ecx, dword [str.rundll32.exe]
mov edx, dword [0x10021588]
mov dword [eax], ecx
mov ecx, dword [0x1002158c]
mov dword [eax + 4], edx
mov dl, byte [0x10021590]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, 0x1002bb48
ret
Function at 0x10003830
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, eax
mov esi, ecx
lea ecx, [edi + 2]
test ecx, ecx
jl 0x10003976
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x40000000
jge 0x10003976
push ebp
lea eax, [eax*4 + 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp edi, 2
mov ebp, eax
mov ecx, ebp
jle 0x10003902
lea edx, [edi - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx*4]
sub eax, edx
neg eax
add edi, eax
mov edi, edi
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x10021038]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
movzx eax, byte [eax + ebx + 0x10021038]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
shr ebx, 6
movzx eax, byte [ebx + eax*4 + 0x10021038]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + 0x10021038]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x100038a0
mov ebx, dword [esp + 0x14]
test edi, edi
je 0x10003962
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + 0x10021038]
mov byte [ecx], al
inc ecx
cmp edi, 1
jle 0x10003948
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shl edx, 4
shr eax, 4
movzx edx, byte [edx + eax + 0x10021038]
mov byte [ecx], dl
movzx eax, byte [esi + 1]
inc ecx
and eax, 0xf
movzx edx, byte [eax*4 + 0x10021038]
mov byte [ecx], dl
jmp 0x1000395d
movzx eax, byte [esi]
and eax, 3
shl eax, 4
mov dl, byte [eax + 0x10021038]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
test ebx, ebx
je 0x1000396c
mov eax, ecx
sub eax, ebp
mov dword [ebx], eax
mov eax, ebp
pop ebp
pop edi
pop esi
mov byte [ecx], 0
pop ebx
ret
test ebx, ebx
je 0x10003980
mov dword [ebx], 0
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10003ac0
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x100252c0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
push ebp
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.RookIE_1.0
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebp, eax
test ebp, ebp
je 0x10003b8b
push edi
push ebx
push 0x4000000
push ebx
push ebx
push esi
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x10003b83
push 0x100215a8
push str.xxxx.tmp
mov dword [esp + 0x18], 1
call fcn.1000b909
mov esi, eax
add esp, 8
test esi, esi
je 0x10003b7c
cmp dword [esp + 0x10], ebx
jbe 0x10003b6e
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x10003b40
lea eax, [esp + 0x10]
push eax
push 0x3ff
lea ecx, [esp + 0x1c]
push ecx
push edi
call ebx
mov edx, dword [esp + 0x10]
push esi
push edx
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.1000bd61
add esp, 0x10
cmp dword [esp + 0x10], 0
ja 0x10003b40
push esi
call fcn.1000bab3
add esp, 4
mov ebx, 1
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
mov ecx, dword [esp + 0x410]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1000b4b2
add esp, 0x408
ret