joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e830
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x53307c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.004e7890
mov eax, dword fs:[0x2c]
add esp, 0xc
mov dword [ebp - 0x234], 0x11c
mov ecx, dword [eax]
mov eax, dword [0x5372d8]
cmp eax, dword [ecx + 4]
jg 0x40e986
mov eax, dword [0x5372dc]
test eax, eax
je 0x40e962
lea ecx, [ebp - 0x234]
push ecx
call eax
test eax, eax
jne 0x40e962
cmp dword [ebp - 0x230], 0xa
sete al
test al, al
jne 0x40e962
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004e7890
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40e952
mov eax, dword [ebp - 0x114]
cmp eax, 5
jne 0x40e904
cmp dword [ebp - 0x110], 1
jne 0x40e952
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e964
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x40e952
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x40e926
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e964
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x40e93a
call fcn.0040e7d0
mov ecx, 3
lea edx, [ecx + 0xa]
jmp 0x40e971
cmp eax, 2
jne 0x40e952
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e964
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e964
mov esp, ebp
pop ebp
ret
call fcn.0040e7d0
mov ecx, 5
mov edx, 0xf
test al, al
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e964
mov esp, ebp
pop ebp
ret
push 0x5372d8
call fcn.0049ec68
add esp, 4
cmp dword [0x5372d8], 0xffffffff
jne 0x40e87c
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5372d8
mov dword [0x5372dc], eax
call fcn.0049ec1e
add esp, 4
jmp 0x40e87c
Function at 0x40e9d0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a1e0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x53307c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0040e830
cmp eax, 1
jne 0x40ea0d
mov eax, 3
jmp 0x40eb73
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
mov word [ebp - 0x14], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x40ea5f
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x4c]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x50]
cmp eax, 1
je 0x40ea03
xor eax, eax
mov dword [ebp - 0x38], 0
push eax
push 0x522d78
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
call fcn.00405140
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
push 0xc
xor eax, eax
mov dword [ebp - 0x20], 0
push str.explorer.exe
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.00405140
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0040c680
mov edx, dword [ebp - 0x1c]
add esp, 8
mov esi, eax
cmp edx, 8
jb 0x40eb00
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40eaf6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40eb8d
push edx
push ecx
call fcn.0049e956
add esp, 8
mov edx, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
cmp edx, 8
jb 0x40eb4a
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40eb40
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40eb92
push edx
push ecx
call fcn.0049e956
add esp, 8
test esi, esi
je 0x40eb6e
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x40eb6e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
jmp 0x40eb73
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e964
mov esp, ebp
pop ebp
ret
call fcn.004e9a8c
call fcn.004e9a8c
int3
Function at 0x40f130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [edx + 0x14], 8
jb 0x40f146
mov edx, dword [edx]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x18]
push 0
or eax, 0x2001b
push eax
push 0
push 0
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40f172
xor al, al
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x40f180
mov ecx, dword [ecx]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x14], 8
jb 0x40f18b
mov edx, dword [edx]
push ebx
lea eax, [eax*2 + 2]
mov bl, 1
push eax
push ecx
push dword [ebp + 0x14]
push 0
push edx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40f1d0
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov eax, ecx
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x40f200
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x410100
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a2c4
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x53307c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
lea esi, [ebx + 8]
mov dword [ebx], 0x526fc0
mov byte [ebx + 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0xf
mov byte [ebx + 0x20], 0
lea edi, [ebx + 0x38]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebx + 0x50], 0x526fe4
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0xf
mov byte [ebx + 0x58], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0xf
mov byte [ebx + 0x70], 0
mov dword [ebx + 0x54], 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004089f0
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 0
je 0x4101e2
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4101ee
lea eax, [ebp - 0x28]
push eax
call fcn.00407340
add esp, 4
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
cmp eax, 0xb
jb 0x41022e
cmp edx, 8
lea esi, [ebp - 0x28]
push 0x16
cmovae esi, dword [ebp - 0x28]
lea edi, [ecx + 0xb]
push str.config.dat
mov dword [ebp - 0x18], edi
lea eax, [esi + ecx*2]
push eax
call fcn.004e6f70
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
lea esi, [ebx + 8]
lea edi, [ebx + 0x38]
jmp 0x410246
push 0xb
push str.config.dat
mov byte [ebp - 0x44], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x44]
push 0xb
call fcn.00408280
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00405420
add esp, 8
lea ecx, [ebx + 0x20]
push eax
call fcn.00404fa0
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x41028f
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x410285
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4102ff
push edx
push ecx
call fcn.0049e956
add esp, 8
push 5
push str.kantu
mov ecx, edi
call fcn.00401c70
push 5
push str.kantu
mov ecx, esi
call fcn.00401c70
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4102e1
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4102d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410304
push edx
push ecx
call fcn.0049e956
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e964
mov esp, ebp
pop ebp
ret
call fcn.004e9a8c
call fcn.004e9a8c
int3
Function at 0x410c00
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a3d6
mov eax, dword fs:[0]
push eax
mov eax, 0x102c
call fcn.0049ff70
mov eax, dword [0x53307c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 4], 0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
jne 0x410c4d
call fcn.00410450
test al, al
je 0x410e1c
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.004e7890
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x410c6b
mov esi, dword [esi]
cmp dword [edi + 0x4c], 0x10
lea eax, [edi + 0x38]
jb 0x410c76
mov eax, dword [eax]
push esi
push eax
push str.SELECT__FROM__s_WHERE_key_s
lea eax, [ebp - 0x1010]
push 0x1000
push eax
call fcn.00401c40
lea ecx, [ebp - 0x1010]
mov dword [ebp - 0x1018], 0
add esp, 0x14
mov dword [ebp - 0x1014], 0xf
mov byte [ebp - 0x1028], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410cb5
sub ecx, edx
lea eax, [ebp - 0x1010]
push ecx
push eax
lea ecx, [ebp - 0x1028]
call fcn.00401c70
mov dword [ebp - 4], 0
mov dword [ebp - 0x1038], 0
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0x1030], 0
mov dword [ebp - 0x102c], 0
lea eax, [ebp - 0x1038]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1028]
push eax
lea ecx, [edi + 0x50]
call fcn.00418480
mov edi, dword [ebp - 0x1034]
mov eax, edi
mov esi, dword [ebp - 0x1038]
sub eax, esi
sub eax, 0xc
cmp eax, 0xc
jb 0x410d36
xor bl, bl
jmp 0x410d62
mov eax, dword [esi]
add eax, 0x18
cmp ebx, eax
je 0x410d60
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x410d49
mov edx, dword [eax]
push dword [eax + 0x10]
mov ecx, ebx
push edx
call fcn.00401c70
mov edi, dword [ebp - 0x1034]
mov esi, dword [ebp - 0x1038]
mov bl, 1
test esi, esi
je 0x410de4
cmp esi, edi
je 0x410d84
nop word [eax + eax]
mov ecx, esi
call fcn.00410ed0
add esi, 0xc
cmp esi, edi
jne 0x410d70
mov esi, dword [ebp - 0x1038]
mov ecx, dword [ebp - 0x1030]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 2
cmp ecx, 0x1000
jb 0x410dbc
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410e3a
push ecx
push esi
call fcn.0049e956
add esp, 8
mov dword [ebp - 0x1038], 0
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0x1030], 0
mov edx, dword [ebp - 0x1014]
cmp edx, 0x10
jb 0x410e1a
mov ecx, dword [ebp - 0x1028]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x410e10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410e3f
push edx
push ecx
call fcn.0049e956
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e964
mov esp, ebp
pop ebp
ret 8
call fcn.004e9a8c
call fcn.004e9a8c
int3
Function at 0x4114b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, ecx
xor ebx, ebx
mov esi, eax
mov cl, byte [ebp + 0xb]
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmp dword [ebp + 8], ebx
jle 0x41160a
nop
mov eax, 0xaaaaaaab
mul ebx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ebx
sub edx, eax
sub edx, 0
je 0x4115cd
sub edx, 1
je 0x411574
sub edx, 1
jne 0x411600
mov al, byte [edi]
shr al, 6
or al, cl
and al, 0x3f
cmp al, 0x1a
jae 0x41150c
add al, 0x41
jmp 0x411526
cmp al, 0x34
jae 0x411514
add al, 0x47
jmp 0x411526
cmp al, 0x3e
jae 0x41151c
sub al, 4
jmp 0x411526
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi], al
mov al, byte [edi]
and al, 0x3f
cmp al, 0x1a
jae 0x41153d
add al, 0x41
mov byte [esi + 1], al
add esi, 2
jmp 0x4115ff
cmp al, 0x34
jae 0x41154e
add al, 0x47
mov byte [esi + 1], al
add esi, 2
jmp 0x4115ff
cmp al, 0x3e
jae 0x41155f
sub al, 4
mov byte [esi + 1], al
add esi, 2
jmp 0x4115ff
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi + 1], al
add esi, 2
jmp 0x4115ff
mov al, byte [edi]
shr al, 4
or al, cl
and al, 0x3f
cmp al, 0x1a
jae 0x411590
add al, 0x41
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x4115ff
cmp al, 0x34
jae 0x4115a3
add al, 0x47
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x4115ff
cmp al, 0x3e
jae 0x4115b6
sub al, 4
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x4115ff
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x4115ff
mov al, byte [edi]
shr al, 2
cmp al, 0x1a
jae 0x4115da
add al, 0x41
jmp 0x4115f4
cmp al, 0x34
jae 0x4115e2
add al, 0x47
jmp 0x4115f4
cmp al, 0x3e
jae 0x4115ea
sub al, 4
jmp 0x4115f4
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 3
shl cl, 4
inc edi
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x4114d0
mov ebx, dword [ebp + 8]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
sub ebx, eax
je 0x41165d
and cl, 0x3f
cmp cl, 0x1a
jae 0x41162f
add cl, 0x41
jmp 0x41164d
cmp cl, 0x34
jae 0x411639
add cl, 0x47
jmp 0x41164d
cmp cl, 0x3e
jae 0x411643
sub cl, 4
jmp 0x41164d
setne cl
lea ecx, [ecx*4 + 0x2b]
mov byte [esi], cl
inc esi
cmp ebx, 1
jne 0x411659
mov byte [esi], 0x3d
inc esi
mov byte [esi], 0x3d
inc esi
mov byte [esi], 0
sub esi, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411670
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 8], ecx
mov ebx, ecx
lea esi, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x411683
sub edi, esi
xor esi, esi
test edi, edi
jle 0x411744
mov ah, byte [ebp - 1]
nop dword [eax]
mov al, byte [edx]
cmp al, 0x3d
je 0x411741
nop word [eax + eax]
test al, al
je 0x411741
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x4116c4
sub al, 0x41
jmp 0x4116e6
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x4116d0
sub al, 0x47
jmp 0x4116e6
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x4116dc
add al, 4
jmp 0x4116e6
cmp al, 0x2b
je 0x4116f9
cmp al, 0x2f
je 0x4116f5
mov al, 0x40
inc edx
cmp al, 0x40
jne 0x4116ef
mov al, byte [edx]
jmp 0x4116b0
cmp al, 0x41
je 0x411741
jmp 0x4116fc
mov al, 0x3f
jmp 0x4116fb
mov al, 0x3e
inc edx
mov ecx, esi
and ecx, 3
jmp dword [ecx*4 + 0x411750]
mov ah, al
shl ah, 2
jmp 0x411738
mov cl, al
shr cl, 4
or cl, ah
mov ah, al
mov byte [ebx], cl
inc ebx
shl ah, 4
jmp 0x411738
mov cl, al
shr cl, 2
or cl, ah
mov ah, al
mov byte [ebx], cl
inc ebx
shl ah, 6
jmp 0x411738
mov cl, ah
or cl, al
mov byte [ebx], cl
inc ebx
inc esi
cmp esi, edi
jl 0x4116a0
mov ecx, dword [ebp - 8]
pop edi
sub ebx, ecx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419740
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37cc
call fcn.0049ff70
mov eax, dword [0x53307c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor eax, eax
push esi
push edi
mov dword [ebp - 0x37cc], eax
xor edi, edi
nop word [eax + eax]
push edi
lea eax, [ebp - 0x108]
push str..PhysicalDrive_d
push eax
call fcn.0041a0f0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x419933
push 0x2710
lea eax, [ebp - 0x37b8]
mov dword [ebp - 0x37c8], 0
push 0
push eax
mov dword [ebp - 0x37bc], 0
mov dword [ebp - 0x37c4], 0
mov dword [ebp - 0x37c0], 0
call fcn.004e7890
add esp, 0xc
lea eax, [ebp - 0x37c8]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0xc
lea eax, [ebp - 0x37c4]
push eax
push 0x2d1400
push esi
call ebx
test eax, eax
je 0x419926
mov edx, dword [ebp - 0x37ac]
lea eax, [ebp - 0xcc0]
push eax
push 0
lea ecx, [ebp - 0x37b8]
call fcn.004195c0
mov edx, dword [ebp - 0x37a8]
lea eax, [ebp - 0x8d8]
push eax
push 0
lea ecx, [ebp - 0x37b8]
call fcn.004195c0
mov edx, dword [ebp - 0x37a4]
lea eax, [ebp - 0x10a8]
push eax
push 0
lea ecx, [ebp - 0x37b8]
call fcn.004195c0
mov edx, dword [ebp - 0x37a0]
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0x37b8]
call fcn.004195c0
add esp, 0x20
cmp byte [0x5363a0], 0
jne 0x4198ed
movsx eax, byte [ebp - 0x4f0]
push eax
call fcn.004eefc1
add esp, 4
test eax, eax
jne 0x4198b1
movsx eax, byte [ebp - 0x4dd]
push eax
call fcn.004eefc1
add esp, 4
test eax, eax
je 0x4198ed
lea eax, [ebp - 0x4f0]
push eax
push 0x400
push 0x5363a0
call fcn.004f01f9
add esp, 0xc
lea eax, [ebp - 0x8d8]
push eax
push 0x400
push 0x5369b0
call fcn.004f01f9
add esp, 0xc
mov dword [ebp - 0x37cc], 1
push 0x2710
lea eax, [ebp - 0x37b8]
push 0
push eax
call fcn.004e7890
add esp, 0xc
lea eax, [ebp - 0x37c8]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
jmp 0x41992c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x10
jl 0x419770
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x37cc]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0049e964
mov esp, ebp
pop ebp
ret
Function at 0x41a610
Capabilities:
Connect to http server
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2820
call fcn.0049ff70
mov eax, dword [0x53307c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2820], eax
mov eax, dword [ebp + 0x10]
push str.RookIE_1.0
mov dword [ebp - 0x2814], eax
mov dword [ebp - 0x281c], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 3
push 0
push 0
push 0x50
mov edi, eax
push 0x522d7a
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test edi, edi
je 0x41a6a5
cmp dword [esi + 0x14], 0x10
jb 0x41a682
mov esi, dword [esi]
push 0
push 0x80000800
push 0
push 0
push esi
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x2810], eax
test eax, eax
jne 0x41a6ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e964
mov esp, ebp
pop ebp
ret 0xc
push 0
lea ecx, [ebp - 0x2818]
mov dword [ebp - 0x2818], 8
push ecx
lea ecx, [ebp - 0x281c]
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ebx, 0x2800
mov dword [ebp - 0x2808], 1
push ebx
xor edi, edi
call fcn.0049f224
mov esi, eax
add esp, 4
test esi, esi
je 0x41a6a5
push ebx
push edi
push esi
call fcn.004e7890
push ebx
lea eax, [ebp - 0x2804]
push edi
push eax
call fcn.004e7890
add esp, 0x18
cmp dword [ebp - 0x2808], edi
jbe 0x41a7cd
nop word [eax + eax]
lea eax, [ebp - 0x2808]
push eax
push 0x27ff
lea eax, [ebp - 0x2804]
push eax
push dword [ebp - 0x2810]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [ebp - 0x2808]
lea eax, [edi + ecx]
cmp eax, ebx
jbe 0x41a7a1
add ebx, ebx
mov dword [ebp - 0x280c], esi
push ebx
call fcn.0049f224
mov esi, eax
add esp, 4
test esi, esi
je 0x41a6a5
push ebx
push 0
push esi
call fcn.004e7890
push edi
push dword [ebp - 0x280c]
push esi
call fcn.004e69f0
push dword [ebp - 0x280c]
call fcn.0049f22d
mov ecx, dword [ebp - 0x2808]
add esp, 0x1c
push ecx
lea eax, [ebp - 0x2804]
push eax
lea eax, [edi + esi]
push eax
call fcn.004e69f0
mov ecx, dword [ebp - 0x2814]
add esp, 0xc
mov eax, dword [ebp - 0x2808]
add edi, eax
mov dword [ecx], edi
test eax, eax
jne 0x41a730
push dword [ebp - 0x2810]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x2820]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], esi
mov eax, dword [ebp - 0x2814]
mov dword [eax], edi
mov al, 1
pop edi
pop esi
pop ebx
call fcn.0049e964
mov esp, ebp
pop ebp
ret 0xc
Function at 0x424240
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x42426e
nop dword [eax + eax]
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x524de0]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x424250
pop esi
ret

Function at 0x4242e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov edx, ecx
push esi
push edi
mov dword [ebp - 4], edx
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x42433a
mov al, byte [ebx]
xor esi, esi
mov edi, ebx
test al, al
je 0x424321
nop
movzx eax, al
lea edi, [edi + 1]
movzx ecx, byte [eax + 0x524de0]
lea eax, [esi*8]
xor ecx, eax
mov al, byte [edi]
xor esi, ecx
test al, al
jne 0x424300
mov ecx, dword [edx + 0xc]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
div dword [esi]
mov eax, edx
mov dword [ebp - 4], eax
mov esi, dword [ecx + eax*8 + 4]
mov edi, dword [ecx + eax*8]
mov ecx, edx
jmp 0x424342
mov esi, dword [edx + 8]
xor ecx, ecx
mov edi, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test edi, edi
je 0x424367
nop dword [eax + eax]
push ebx
push dword [esi + 0xc]
dec edi
call fcn.00422d60
add esp, 8
test eax, eax
je 0x424370
mov esi, dword [esi]
test edi, edi
jne 0x424350
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0x14], edx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
test ebx, ebx
je 0x434cfb
cmp byte [ebx + 9], 0
je 0x434bc8
inc dword [ebx + 0xc]
cmp byte [ebx + 0xa], 0
jne 0x434bc8
call fcn.00431180
mov eax, dword [ebx + 4]
mov esi, dword [eax + 8]
test esi, esi
je 0x434ce8
cmp dword [ebp + 8], 0
je 0x434c1d
test byte [esi + 0x40], 1
jne 0x434c1d
mov al, byte [esi + 0x42]
cmp al, 1
je 0x434bf1
cmp al, 2
jne 0x434c8e
mov ecx, esi
call fcn.004313c0
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x434c8e
mov ebx, dword [esp + 0x10]
mov edx, edi
push 0
mov ecx, ebx
call fcn.00434b90
add esp, 4
jmp 0x434ce8
mov edi, dword [esi + 0x30]
test edi, edi
je 0x434c7c
cmp dword [0x533e90], 0
je 0x434c72
mov eax, dword [0x537108]
test eax, eax
je 0x434c40
push eax
call dword [0x533ee4]
add esp, 4
push edi
call dword [0x533ec0]
sub dword [0x536f90], eax
add esp, 4
dec dword [0x536fb4]
push edi
call dword [0x533eb8]
mov eax, dword [0x537108]
add esp, 4
test eax, eax
je 0x434c7c
push eax
call dword [0x533eec]
jmp 0x434c79
push edi
call dword [0x533eb8]
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
xor ebx, ebx
cmp byte [esi + 0x44], bl
jl 0x434cd5
lea edi, [esi + 0x78]
mov ecx, dword [edi]
test ecx, ecx
je 0x434cc3
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x40
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x1c], eax
je 0x434cb5
call fcn.0042bfc0
jmp 0x434cba
call fcn.004285a0
mov ecx, dword [esp + 0x1c]
call fcn.0042d140
mov dword [edi], 0
inc ebx
movsx eax, byte [esi + 0x44]
add edi, 4
cmp ebx, eax
jle 0x434c98
mov esi, dword [esi + 8]
test esi, esi
jne 0x434bd6
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp byte [ebx + 9], 0
je 0x434cfb
add dword [ebx + 0xc], 0xffffffff
jne 0x434cfb
mov ecx, ebx
call fcn.00431140
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret