joyce8/EMBER2024-capa huggingface dataset:
Function at 0x22917904
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov dword [esp], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x28]
mov edx, dword [esp]
lea eax, [edx + eax + 0x44]
mov edx, dword [esp]
movzx edx, byte [edx + 0x3d]
shl edx, 3
lea ecx, [eax + edx]
or edx, 0xffffffff
cmp ecx, eax
je 0x22917932
xor edx, dword [eax]
add eax, 4
cmp ecx, eax
jne 0x22917929
mov eax, edx
pop edx
ret

Function at 0x22917de4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ebx
ret

Function at 0x22917df8
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
test esi, esi
jg 0x22917e09
mov bl, 1
jmp 0x22917e57
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push eax
call sub.kernel32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
jne 0x22917e2c
xor ebx, ebx
jmp 0x22917e57
push 2
push 0
push 0
push edi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [esp + 4]
push eax
mov ebx, esi
push ebx
push ebp
push edi
call sub.kernel32.dll_WriteFile
cmp ebx, dword [esp]
sete al
mov ebx, eax
push edi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x22918e34
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x22918e3d
mov eax, dword [esp + 0x10000]
add esp, 0xfffffff4
mov dword [esp + 8], edx
mov ebx, eax
lea esi, [esp + 0xc]
lea edi, [esp + 0x1000a]
mov eax, esi
mov edx, ebx
cmp dl, 0xf
ja 0x22918e76
and edx, 0x7f
bt word [0x22a39cbc], dx
jae 0x22918e89
push edi
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [0x22a39cc0]
call fcn.22918d90
mov dword [esp + 4], eax
movzx edx, bl
cmp edx, 0xa
ja case.default.0x22918e99
jmp dword [edx*4 + 0x22918ea0]
mov edx, dword [0x22a39ccc]
mov ecx, dword [0x22a39cd0]
mov dword [esp], ecx
jmp 0x22918fcf
mov edx, dword [0x22a39cc4]
mov ecx, dword [0x22a39cd0]
mov dword [esp], ecx
jmp 0x22918fcf
mov edx, dword [0x22a39cc8]
mov ecx, dword [0x22a39cd0]
mov dword [esp], ecx
jmp 0x22918fcf
mov edx, dword [esp + 8]
cmp dword [edx + 0x10], 0
je 0x22918f1a
mov edx, dword [0x22a39cd8]
jmp 0x22918f20
mov edx, dword [0x22a39cd4]
mov ecx, dword [0x22a39ce4]
mov dword [esp], ecx
jmp 0x22918fcf
test byte [0x22a39cbc], 8
je 0x22918f3f
mov edx, dword [0x22a39ce0]
jmp 0x22918f45
mov edx, dword [0x22a39cdc]
mov ecx, dword [0x22a39ce4]
mov dword [esp], ecx
jmp 0x22918fcf
mov edx, dword [0x22a39ce8]
mov ecx, dword [0x22a39d00]
mov dword [esp], ecx
jmp 0x22918fcf
mov edx, dword [0x22a39cec]
mov ecx, dword [0x22a39d00]
mov dword [esp], ecx
jmp 0x22918fcf
mov edx, dword [0x22a39cf4]
mov ecx, dword [0x22a39d00]
mov dword [esp], ecx
jmp 0x22918fcf
mov edx, dword [esp + 8]
cmp dword [edx + 0x14], 0
je 0x22918f95
mov edx, dword [0x22a39cfc]
jmp 0x22918f9b
mov edx, dword [0x22a39cf8]
mov ecx, dword [0x22a39d00]
mov dword [esp], ecx
jmp 0x22918fcf
mov edx, dword [0x22a39cf0]
mov ecx, dword [0x22a39d00]
mov dword [esp], ecx
jmp 0x22918fcf
mov edx, dword [0x22a39d04]
mov ecx, dword [0x22a39d08]
mov dword [esp], ecx
jmp 0x22918fcf
xor edx, edx
xor ecx, ecx
mov dword [esp], ecx
push edi
mov ecx, dword [esp + 0xc]
xchg edx, ecx
xchg ecx, eax
call fcn.22918d90
mov word [eax], 0
mov edx, ebx
cmp dl, 0xf
ja 0x22918ff3
and edx, 0x7f
bt word [0x22a39cbc], dx
jae 0x22919010
lea edx, [esp + 0xc]
mov ecx, eax
sub ecx, edx
sar ecx, 1
jns 0x22919004
adc ecx, 0
mov eax, 0x22a4daca
mov edx, esi
call fcn.22917f84
mov eax, ebx
cmp al, 0xf
ja 0x22919021
and eax, 0x7f
bt word [0x22a39cba], ax
jae 0x22919029
push esi
call sub.kernel32.dll_OutputDebugStringW
cmp bl, 0xf
ja 0x22919039
and ebx, 0x7f
bt word [0x22a39cbe], bx
jae 0x22919047
mov edx, dword [esp]
mov eax, dword [esp + 4]
call fcn.22917e60
add esp, 0x10010
pop edi
pop esi
pop ebx
ret

Function at 0x2291b7f8
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push 0x22a39da6
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x2291b812
xor esi, esi
jmp 0x2291b82e
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, dword [eax]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, esi
pop esi
pop ebx
ret
Function at 0x2291b8dc
Capabilities:
Read file via mapping

Disassembly:
cmp byte [0x22a4da85], 3
jne 0x2291b93f
call fcn.2291b774
test al, al
jne 0x2291b93f
cmp dword [0x22a4e2d4], 0
jne 0x2291b93f
call fcn.2291b7f8
test eax, eax
jne 0x2291b93c
push 0x22a39da6
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x22a4e2d4], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x22a4e2d4]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], 0x22a4daac
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov al, 1
jmp 0x2291b941
xor eax, eax
ret
xor eax, eax
ret

Function at 0x2292a6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x2292a6f9
test eax, edx
je 0x2292a6fc
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x2292a6b7
movzx eax, word [eax]
sub eax, ecx
jmp 0x2292a6de
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x2292a6df
add ecx, 4
js 0x2292a6cf
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x2292a6dc
movzx eax, word [eax + ecx]
movzx edx, word [edx + ecx]
sub eax, edx
pop ebx
pop ebx
jmp 0x2292a6de
xor eax, eax
ret
test eax, eax
je 0x2292a708
test edx, edx
jne 0x2292a6a8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x2292b954
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.2290ae20
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x2292b9be
test ah, 4
je 0x2292b9b7
test bl, bl
jne 0x2292b97c
mov al, 1
jmp 0x2292b9e5
test al, 0x10
je 0x2292b984
xor eax, eax
jmp 0x2292b9e5
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x2292b9a8
push eax
call sub.kernel32.dll_CloseHandle
mov al, 1
jmp 0x2292b9e5
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x2292b9e5
test al, 0x10
sete al
jmp 0x2292b9e5
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x2292b9df
cmp ebx, 3
je 0x2292b9df
cmp ebx, 0x7b
je 0x2292b9df
mov eax, esi
call fcn.2292b914
test al, al
jne 0x2292b9e3
xor eax, eax
jmp 0x2292b9e5
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x22930768
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x229307a1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.2290a50c
jmp 0x229307aa
mov eax, ebx
mov edx, esi
call fcn.2290a764
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x229307b4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 3
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x229307d8
movzx eax, word [esp]
jmp 0x229307da
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x229324d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x229325f7
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.229322d8
mov esi, eax
mov eax, dword [0x22a40f54]
cmp byte [eax], 0
je 0x2293259d
mov eax, dword [0x22a40c44]
call fcn.22907cc8
call fcn.2290721c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x229324a0]
call fcn.2290d288
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x22932610
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x229325d9
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x22a40bd4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x22a45634]
call fcn.2290d958
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x229325fe
lea eax, [ebp - 4]
mov edx, dword [0x229324a0]
call fcn.2290d3ac
pop eax
jmp eax
Function at 0x22933a38
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x22933a7b
mov eax, dword [ebp - 0x10c]
mov dword [0x22a4e570], eax
mov eax, 0x22a4e574
lea edx, [ebp - 0x108]
mov ecx, 0x80
call fcn.2290aed4
mov eax, 0x22a4e578
call fcn.2290a374
xor eax, eax
mov dword [0x22a4e57c], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x22a4e434], 0xa
jl 0x22933bd1
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x22933bdc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x22933bd1
xor eax, eax
push ebp
push 0x22933bca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x22933c38
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x22933b2a
cmp dword [ebp - 8], 2
jle 0x22933b2a
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x22933afd
adc edx, 0
mov eax, 0x22a4e578
call fcn.2290afac
lea eax, [ebp - 8]
push eax
mov eax, dword [0x22a4e578]
call fcn.2290ae20
push eax
push 0
push 0
push 0x22933c38
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
jmp 0x22933b84
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x22933c58
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x22933b84
cmp dword [ebp - 8], 2
jle 0x22933b84
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x22933b59
adc edx, 0
mov eax, 0x22a4e578
call fcn.2290afac
lea eax, [ebp - 8]
push eax
mov eax, dword [0x22a4e578]
call fcn.2290ae20
push eax
push 0
push 0
push 0x22933c58
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x22a4e57c
push 0
push 0
push 0x22933c6c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x22933bb1
xor eax, eax
mov dword [0x22a4e57c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x22933bd1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
mov byte [0x22a3b840], 1
mov esp, ebp
pop ebp
ret
Function at 0x22934c1c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.2290a854
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.229105d4
mov edi, eax
cmp edi, 0x104
jbe 0x22934bc7
mov eax, edi
add eax, eax
call fcn.22907038
mov esi, eax
jmp 0x22934bc9
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.229105d4
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x22934c02
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x22934bec
mov eax, esp
cmp esi, eax
je 0x22934c0f
mov eax, esi
call fcn.22907054
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x22934c48
cmp bl, 0
je 0x22934c44
cmp bl, 0x41
jl 0x22934c3f
cmp bl, 0x5a
jg 0x22934c3f
or bl, 0x20
xor al, bl
inc esi
jmp 0x22934c23
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x22934b88

Function at 0x22935564
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.2290aed4
add esp, 0x800
pop ebx
ret
Function at 0x22937d98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x22937db6
mov eax, dword [eax - 4]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x22937dce
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x22937dc9
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
jmp 0x22937dd3
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x22937e41
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x22937e8a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x22937dff
inc dword [ebp - 0xc]
jmp 0x22937e17
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x22937e17
cmp dword [ebp - 0xc], 0
jle 0x22937e17
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x22937e39
xor eax, eax
jmp 0x22937e35
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x22937e34
mov eax, esi
jmp 0x22937e8d
inc eax
cmp eax, ecx
jle 0x22937e21
inc esi
cmp esi, dword [ebp - 8]
jl 0x22937deb
jmp 0x22937e8a
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x22937e8a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x22937e62
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x22937e84
xor eax, eax
jmp 0x22937e80
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x22937e7f
mov eax, esi
jmp 0x22937e8d
inc eax
cmp eax, ecx
jle 0x22937e6c
inc esi
cmp esi, dword [ebp - 8]
jl 0x22937e4a
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2293807c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x22938099
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x229380a7
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x229381c9
test ebx, ebx
jl 0x229381c9
test esi, esi
jle 0x229381c9
mov eax, dword [ebp - 8]
call fcn.2290ae20
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.2290ae20
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x22938166
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x229381c9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x2293814b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x2293811a
inc dword [ebp - 0x14]
jmp 0x2293812a
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x2293812a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x22938135
or eax, 0xffffffff
jmp 0x2293814b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x22938148
inc eax
jmp 0x2293814b
or eax, 0xffffffff
test eax, eax
jl 0x22938153
cmp esi, eax
jg 0x22938108
cmp esi, eax
jg 0x2293815e
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x229381cc
inc edx
dec dword [ebp - 0x1c]
jne 0x22938104
jmp 0x229381c9
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x229381c9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x229381b0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x2293818f
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x2293819a
or eax, 0xffffffff
jmp 0x229381b0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x229381ad
inc eax
jmp 0x229381b0
or eax, 0xffffffff
test eax, eax
jl 0x229381b8
cmp esi, eax
jg 0x22938178
cmp esi, eax
jg 0x229381c3
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x229381cc
inc edx
dec dword [ebp - 0x1c]
jne 0x22938174
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x2294a26c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x2294a274
mov eax, edx
pop esi
pop ebx
ret

Function at 0x2294cee8
Capabilities:
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x2294ceff
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x2294ceef
mov eax, ecx
pop ebx
ret
Function at 0x2295dd30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x2295dd44
add esp, 0xfffffff0
call fcn.22908b0c
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x22957cb4]
call fcn.2297c790
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x2295cd00]
call fcn.2297f544
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x2295cd00]
call fcn.2297f544
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x2295dd99
call fcn.22908b64
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x229c6e00
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x229c6e43
cmp byte [ebx + 0x11], 0
jne 0x229c6e43
cmp byte [ebx + 0x24], 0
jne 0x229c6e43
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x229c6e5a
mov ecx, dword [0x22a40eec]
mov dl, 1
mov eax, dword [0x22996c54]
call fcn.2293275c
call fcn.229099dc
pop ebx
ret
mov ecx, dword [0x22a40eec]
mov dl, 1
mov eax, dword [0x22996c54]
call fcn.2293275c
call fcn.229099dc
pop ebx
ret

Function at 0x229c77c8
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x229c7816
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.229c6cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x229c782f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x229c7838
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.229c6cac
dec esi
jne 0x229c785a
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x22a2856c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
and eax, 0xff
shr ecx, 8
inc edx
xor ecx, dword [eax*4 + 0x22a3e0e0]
cmp edx, 4
mov eax, ecx
jl 0x22a28574
pop ebp
ret

Function at 0x22a28590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
inc edx
shr eax, 0x18
and eax, 0xff
shl ecx, 8
xor ecx, dword [eax*4 + 0x22a3e4e0]
cmp edx, 4
mov eax, ecx
jl 0x22a28598
pop ebp
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edx
call fcn.0040101e
dec edx

Function at 0x40101e
Capabilities:
Parse pe header

Disassembly:
pop edx
sbb edx, edx
add edx, edi
jmp 0x401028
and edx, ebx
pop edx
push eax
call 0x401032
inc eax
pop eax
pop eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push edi
call 0x401041
inc edi
pop edi
sbb edi, eax
call 0x40104a
inc edi
pop edi
or edi, esi
pop edi
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x401065
mov eax, dword [ebp - 8]
cmp dword [eax + 0x3c], 0
jne 0x40106c
xor al, al
jmp 0x40116f
push edx
add edx, esi
add edx, edx
and edx, ecx
sbb edx, edx
xor edx, ebx
jmp 0x40107b
xor edx, ebp
sbb edx, eax
pop edx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
push esi
call 0x401093
dec esi
pop esi
add esi, ebp
call 0x40109c
dec esi
pop esi
add esi, eax
pop esi
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
jne 0x4010ba
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 0x18]
cmp edx, 0x10b
je 0x4010c1
xor al, al
jmp 0x40116f
push ebx
call 0x4010c8
dec ebx
pop ebx
call 0x4010cf
dec ebx
pop ebx
add ebx, eax
sbb ebx, edi
pop ebx
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 6]
cmp eax, edx
jl 0x4010eb
xor al, al
jmp 0x40116f
push eax
call 0x4010f2
inc eax
pop eax
call 0x4010f9
inc eax
pop eax
add eax, esi
add eax, edi
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 0xc]
movzx eax, word [edx + 0x14]
lea ecx, [ecx + eax + 0x18]
movzx edx, word [ebp + 0xc]
imul eax, edx, 0x28
add ecx, eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x10]
cmp eax, dword [edx + 8]
jae 0x401146
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x10], edx
jmp 0x40114f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov al, 1
jmp 0x40116f
pop ebx
mov esp, ebp
pop ebp
ret