joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034690
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10200c9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102044b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x1003477f
push 0x55
push 0x102044b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10034768
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.1010ca00
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x102044b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10034713
inc edx
cmp edx, 0x55
jl 0x100346f0
mov byte [ebp - 8], 0
push 0x41
call sym.icuuc69.dll_utrie_enum_69
mov esi, eax
add esp, 4
test esi, esi
je 0x10034767
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call sym.icuuc69.dll_utrie_enum_69
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x1003475e
push 0x10033e30
push 0x17
mov byte [eax + esi], 0
mov dword [0x102044b0], esi
mov byte [0x102044b4], 1
call sym.icuuc69.dll_utrie_enum_69
add esp, 8
jmp 0x10034767
push esi
call sym.icuuc69.dll_utrie_enum_69
add esp, 4
pop esi
mov eax, dword [0x102044b0]
mov ecx, 0x1016b5e8
test eax, eax
cmovne ecx, eax
mov dword [0x102044b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e9efb
mov esp, ebp
pop ebp
ret
Function at 0x100a9710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b68
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push 0
push dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.icu_69::UnicodeSet.0
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call sym.icuuc69.dll_utrie_enum_69
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100a97c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 8]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x110000
call sym.icuuc69.dll_utrie_enum_69
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100ad890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158f58
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0x18]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x14]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 0x10]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
push dword [ebp + 0xc]
mov dword [esi + 8], eax
push dword [ebp + 8]
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call sym.icuuc69.dll_utrie_enum_69
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x100ad950
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158f88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0x14]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 0xc]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
push dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call sym.icuuc69.dll_utrie_enum_69
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100ae130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159098
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov dword [esi], vtable.icu_69::UnicodeSet.0
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call sym.icuuc69.dll_utrie_enum_69
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x408379
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x408388
pop dword [ebp - 0x3c]
mov eax, 0x408388
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3768e
push 0
mov eax, 0x6b13c13
sub eax, 0x6705b3b
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xf02cf6e5
add ecx, 0xfd349cd
mov edi, eax
mov ebx, 0xbee117c
sub ebx, 0xbacd5b8
add ebx, dword [ebp - 0x3c]
mov esi, 0x26cf9d31
sub esi, 0xf24b1077
add dword [ebp - 0x20], edi
mov edx, dword [ebx]
xor dword [ebp - 0x10], 0x2c97f9f5
sub edx, esi
mov dword [ebp - 0x20], 0x4aae31a9
mov dword [edi], edx
xor dword [ebp - 0x34], edx
add edi, 4
add ebx, 0xb6859897
sub ebx, 0xb6859893
loop 0x4083e2
add eax, 0x4cf66dc7
add eax, 0xb30a87d4
xor ebx, ebx
add ebx, eax
add eax, 0xd8263592
add eax, 0x27d9ca73
mov ecx, 0xa808c97d
add ecx, 0x58373683
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x2007294
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x22ea008], 0x8088405
inc edx
mov dword [ebx + 0x22ea008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x20072b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x22ea008], 0x8088405
inc edx
mov dword [ebx + 0x22ea008], edx
fld qword [ebx + 0x22ea798]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret
Function at 0x2022998
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x20229f1
test eax, edx
je 0x20229f4
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x20229af
movzx eax, word [eax]
sub eax, ecx
jmp 0x20229d6
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x20229d7
add ecx, 4
js 0x20229c7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x20229d4
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x20229d6
xor eax, eax
ret
test eax, eax
je 0x2022a00
test edx, edx
jne 0x20229a0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x202b5bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0200a260
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0200f1d4
mov edi, eax
cmp edi, 0x104
jbe 0x202b567
mov eax, edi
add eax, eax
call fcn.02006e8c
mov esi, eax
jmp 0x202b569
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0200f1d4
push esi
call fcn.020153a0
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x202b5a2
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x202b58c
mov eax, esp
cmp esi, eax
je 0x202b5af
mov eax, esi
call fcn.02006ea8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x202b5e8
cmp bl, 0
je 0x202b5e4
cmp bl, 0x41
jl 0x202b5df
cmp bl, 0x5a
jg 0x202b5df
or bl, 0x20
xor al, bl
inc esi
jmp 0x202b5c3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x202b528
Function at 0x20845f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x2084600
mov eax, edx
pop esi
pop ebx
ret

Function at 0x20f8e80
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x20f8e86
ret

Function at 0x2114ddc
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x22ef8e8
test edx, edx
jne 0x2114dfb
xor eax, eax
jmp 0x2114f19
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x2114e18
push esi
push edx
push eax
call fcn.02114f20
add esp, 0xc
jmp 0x2114f19
push esi
push edx
push eax
call fcn.021151e0
add esp, 0xc
jmp 0x2114f19
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x2248da8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x2248db0
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x2248f65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x2248f80
call fcn.0200ab64
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.022463f8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x2248f94
call fcn.021edad0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x2248e2b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x2248e6c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.022463f8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x2248ffc
call fcn.021edad0
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0200ab0c
mov eax, esi
mov edx, 0x2249028
call fcn.0200ab0c
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x2248e84
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x2248ef2
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x224903c
call fcn.021edad0
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0200ab0c
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x2248ebb
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x2248ee6
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x224906c
call fcn.021edad0
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0200ab0c
mov eax, esi
mov edx, 0x2249028
call fcn.0200ab0c
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x2248efe
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x2248f29
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x2249098
call fcn.021edad0
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0200ab0c
mov eax, esi
mov edx, 0x2249028
call fcn.0200ab0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2248f6c
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.02009df0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.02009df0
lea eax, [ebp - 4]
call fcn.02009d90
ret
Function at 0x227a0a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov eax, 8
test byte [edx + 1], 0x80
setne bl
movzx esi, word [edx]
add esi, esi
movzx edi, cl
shr edi, 7
or si, di
mov word [edx], si
test bl, bl
je 0x227a0d1
xor word [edx], 0x1021
add ecx, ecx
and cl, 0xff
dec eax
jne 0x227a0b0
pop edi
pop esi
pop ebx
ret

Function at 0x22910f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x22fd9f0], 0
jne 0x229110b
call fcn.022910b0
mov eax, edi
dec eax
test eax, eax
jl 0x2291133
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x22fd5f0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x2291115
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x2293e88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x2293f22.0
jmp dword [ecx*4 + 0x2293ebb]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x2293eed
sub dl, 8
je 0x2293efc
jmp case.0x2293f22.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x2293b54
jmp case.0x2293f22.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x2293ba8
jmp case.0x2293f22.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x2293f22.0
movzx ecx, byte [ecx + 0x2293f29]
jmp dword [ecx*4 + 0x2293f3a]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x2293c48
jmp case.0x2293f22.0
cmp dl, 3
jne 0x2293f67
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x2293ca0
jmp case.0x2293f22.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x2293c5c
jmp case.0x2293f22.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x2293ce4
jmp case.0x2293f22.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x2293f92
sub dl, 8
je 0x2293f9e
jmp case.0x2293f22.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x2293d10
jmp case.0x2293f22.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x2293d74
jmp case.0x2293f22.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x2293fbd
sub dl, 8
je 0x2293fc9
jmp case.0x2293f22.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x2293e24
jmp case.0x2293f22.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x2293e4c
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x229406b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.022930b0
test eax, eax
je 0x229406b
mov eax, ebx
call fcn.02294074
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x2294004
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2294074
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x22940a5
dec al
je 0x22940e0
dec al
je 0x2294124
dec al
je 0x2294196
jmp 0x2294231
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x2294231
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x22940b5
jmp 0x2294231
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x2294231
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x22940f0
jmp 0x2294231
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x2294231
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x2294157
xor edx, edx
mov dword [esp + 4], edx
jmp 0x229416c
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x2294184
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x2294134
jmp 0x2294231
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x2294231
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x22941fd
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.0229113c
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x22941b2
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x22dacf0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x22dad74
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x20ed5f4]
call fcn.020ee740
mov dword [ebp - 4], eax
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.020ee828
xor ecx, ecx
mov edx, 0x22dad8c
mov eax, dword [ebp - 4]
call fcn.020ee980
lea edx, [ebp - 8]
xor eax, eax
call fcn.0200720c
mov ecx, dword [ebp - 8]
mov edx, 0x22dadf4
mov eax, dword [ebp - 4]
call fcn.020ef2d8
mov eax, dword [ebp - 4]
call fcn.020ee7f8
mov eax, dword [ebp - 4]
call fcn.02007f24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x22dad7b
lea eax, [ebp - 8]
call fcn.02009d90
ret

Function at 0x2497d28
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x25a8008], 0x8088405
inc edx
mov dword [ebx + 0x25a8008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x24c3c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x24c3c8d
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x24c3c7e
and ecx, 3
je 0x24c3ca5
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x24c3c92
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x24c3cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x24c3ce9
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x24c3cd1
pop esi
and esi, 3
je 0x24c3d0e
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x24c3cef
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x24c3d18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x24c3d44
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x24c3d35
and ecx, 3
je 0x24c3d5c
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x24c3d49
pop esi
pop edi
pop ebx
pop ebp
ret 4