joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010f74
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x1003fa1c]
xor edx, edx
sub esp, 0xa8
mov eax, edx
and ecx, 0x25185554
inc eax
cmp byte [eax + str.3_464_4_4J4X4a4r4], dl
jne 0x10010f8d
cmp eax, 0x1a4c
mov eax, dword [0x1003fa54]
jae 0x10010fae
xor eax, 0x4ae02791
mov dword [0x1003fa54], eax
jmp 0x10010fba
mov ecx, dword [0x1003fa18]
add ecx, 0xb7367b36
push ebx
push esi
mov ebx, ecx
mov esi, str.CellLength
push edi
imul ecx, ecx, 0x3a5d2d91
lea edi, [ebp - 0x2c]
push 5
or ebx, 0x6076a63b
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], ecx
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x6d
movsw word es:[edi], word [esi]
pop esi
cmp si, word [ebp - 0x2c]
jne 0x10011033
mov ecx, edx
test si, si
je 0x1001100b
cmp word [ebp + ecx - 0x2c], dx
je 0x1001100b
inc ebx
lea ecx, [ebx + ebx]
movzx esi, word [ecx + str.marylhurst]
cmp si, word [ebp + ecx - 0x2c]
je 0x10010fed
mov ecx, dword [ebp - 8]
cmp ecx, ebx
jae 0x10011033
mov esi, dword [ebp - 8]
cmp ecx, 0x21cd
jne 0x10011024
mov eax, esi
and eax, 0xa09df2d0
and eax, 0x54df5007
inc ecx
cmp ecx, ebx
jb 0x10011015
mov dword [0x1003fa54], eax
mov ecx, dword [ebp - 4]
lea edi, [ebp - 0xa8]
and ecx, 0x266fff83
mov esi, str.GetWindowsAppDataDirs___:_removing_duplicate_directory_dir_s
push 0x1f
mov dword [ebp - 4], ecx
mov ebx, edx
mov dword [0x1003f9f8], ecx
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x53
pop ecx
cmp cx, word [ebp - 0xa8]
jne 0x100110ab
mov eax, edx
test cx, cx
je 0x10011089
cmp word [ebp + eax - 0xa8], dx
je 0x10011089
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.Sensor_failed_to_initialize.]
cmp cx, word [ebp + eax - 0xa8]
je 0x10011065
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
jmp 0x100110a5
cmp ecx, 0xf3c
jne 0x100110a4
lea eax, [esi + 0x5a4d09fa]
mov dword [0x1003fa54], eax
inc ecx
cmp ecx, ebx
jb 0x10011091
jmp 0x100110ae
mov esi, dword [ebp - 4]
mov ebx, esi
lea edi, [ebp - 0x14]
mov esi, str.InsertInt
and ebx, 0x501aaef
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x14], 0x61
jne 0x100110e2
mov al, 0x61
test al, al
je 0x100110e2
cmp byte [ebp + edx - 0x14], 0
je 0x100110e2
mov al, byte [edx + 0x10037759]
inc edx
cmp al, byte [ebp + edx - 0x14]
je 0x100110ca
movzx ecx, byte [edx + str.amtrak.com]
movzx eax, byte [ebp + edx - 0x14]
sub ecx, eax
cmp ecx, 0xa2b
jne 0x10011100
or ebx, 0xd5292cf8
jmp 0x10011106
or ebx, 0x7e35a467
mov eax, dword [ebp - 4]
add eax, 0xbb0fab56
mov dword [0x1003fa1c], eax
lea eax, [ebx + 0x303103f0]
pop edi
and eax, 0x71a80584
pop esi
mov dword [0x1003fa18], eax
pop ebx
leave
ret
Function at 0x10011128
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1003fb3c]
sub esp, 0x1c
mov ecx, edx
and ecx, 0x24e97a67
push ebx
mov ebx, str.kongsberg
push esi
mov eax, ebx
xor esi, esi
lea eax, [eax + 2]
add ecx, 0x20d11363
cmp word [eax], si
jne 0x10011147
mov eax, esi
mov dword [0x1003fa08], ecx
push edi
mov esi, str.23_3d3h3l3p3t3x3
lea edi, [ebp - 0x1c]
or ecx, 0xd1bb25e8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x1c], 0x2e
pop edi
jne 0x100111b3
mov edx, dword [0x1003fb3c]
mov byte [ebp - 1], 0x2e
mov bl, byte [ebp - 1]
test bl, bl
je 0x1001119e
cmp byte [ebp + eax - 0x1c], 0
je 0x1001119e
mov bl, byte [eax + 0x10037701]
inc eax
cmp bl, byte [ebp + eax - 0x1c]
je 0x10011186
mov ebx, str.kongsberg
cmp dword [ebp - 8], eax
jae 0x100111b3
sub eax, dword [ebp - 8]
imul eax, eax, 0x49db4102
add ecx, eax
xor eax, eax
lea ebx, [ebx + 2]
xor ecx, 0x6ee7ba88
cmp word [ebx], ax
jne 0x100111b5
sub edx, 0x744aa43d
mov dword [0x1003fb04], ecx
and ecx, 0x41ec788
mov dword [0x1003fb3c], edx
pop esi
mov dword [0x1003fa38], ecx
pop ebx
leave
ret
Function at 0x10011a5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1003f9fc]
sub esp, 0x24
push ebx
xor ebx, ebx
mov eax, ebx
imul edx, edx, 0x8b61e0d
inc eax
cmp byte [eax + str.CloseEnhMetaFile], bl
jne 0x10011a6e
cmp dword [ebp - 4], eax
jae 0x10011a96
sub eax, dword [ebp - 4]
imul edx, edx, 0xb25c2104
sub eax, 1
jne 0x10011a85
mov dword [0x1003f9fc], edx
xor edx, 0x52b1caa7
mov ecx, ebx
lea eax, [edx - 0x3386c912]
mov dword [ebp - 4], eax
inc ecx
cmp word [ecx*2 + str.cannot_open__s_column_for_writing], bx
jne 0x10011aa7
push esi
mov esi, dword [ebp - 4]
push edi
cmp esi, ecx
jae 0x10011ad7
cmp esi, 0x2417
jne 0x10011ac9
lea eax, [edx - 0x1fb706d5]
imul eax, eax, 0xc45b3f18
inc esi
cmp esi, ecx
jb 0x10011abb
mov dword [ebp - 4], eax
mov esi, str._XXXXXXXXXXXXXX
lea edi, [ebp - 0x18]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x54
jne 0x10011b14
mov cl, 0x54
test cl, cl
je 0x10011b05
cmp byte [ebp + eax - 0x18], bl
je 0x10011b05
mov cl, byte [eax + 0x10037721]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x10011aee
cmp dword [ebp - 4], eax
jae 0x10011b14
mov eax, edx
and eax, 0xd3531277
mov dword [ebp - 4], eax
push 8
pop ecx
mov esi, str.xn__hnefoss_q1a
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
push 0x2e
pop esi
mov eax, ebx
cmp si, word [ebp - 0x24]
jne 0x10011b4c
mov ecx, ebx
test si, si
je 0x10011b4c
cmp word [ebp + ecx - 0x24], bx
je 0x10011b4c
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.._AVPK_MessageAccumulatorBase_CryptoPP__]
cmp si, word [ebp + ecx - 0x24]
je 0x10011b2e
movzx ecx, byte [eax*2 + str.._AVPK_MessageAccumulatorBase_CryptoPP__]
movzx eax, byte [ebp + eax*2 - 0x24]
sub ecx, eax
cmp ecx, 0xd1c
jbe 0x10011b6c
mov edx, dword [ebp - 4]
and edx, 0xb0486df4
mov eax, ebx
xor edx, 0xeecf6753
inc eax
cmp word [eax*2 + str.._AVPK_MessageAccumulatorBase_CryptoPP__], bx
jne 0x10011b6e
mov eax, ebx
lea esi, [edx - 0x6d70eead]
inc eax
cmp byte [eax + str.._AVFBframeprogress__], bl
jne 0x10011b87
mov ecx, dword [ebp - 4]
jmp 0x10011baa
cmp ecx, 0x1382
jne 0x10011ba3
xor edx, 0x975da719
sub edx, 0x379f8e44
inc ecx
cmp ecx, eax
jb 0x10011b95
mov eax, esi
imul edx, esi, 0x6063f023
push 6
pop ecx
mov esi, str.GdipSetPenCustomStartCap
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
xor eax, 0xbaaeb30f
mov dword [0x1003f9fc], eax
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x20], 0x52
pop edi
pop esi
jne 0x10011c12
mov cl, 0x52
test cl, cl
je 0x10011bf0
cmp byte [ebp + ebx - 0x20], 0
je 0x10011bf0
mov cl, byte [ebx + 0x10037021]
inc ebx
cmp cl, byte [ebp + ebx - 0x20]
je 0x10011bd8
mov ecx, dword [ebp - 4]
jmp 0x10011c0e
cmp ecx, 0xdd4
jne 0x10011c07
and eax, 0x28cf7740
mov dword [0x1003f9fc], eax
xor edx, 0x3fe3cf39
inc ecx
cmp ecx, ebx
jb 0x10011bf5
imul ecx, eax, 0x82478ddd
pop ebx
mov dword [0x1003fa84], ecx
leave
ret
Function at 0x10011c21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov edx, dword [0x1003fa98]
push ebx
push esi
push edi
imul eax, edx, 0x89436c20
lea edi, [ebp - 0x1c]
push 6
pop ecx
mov esi, str.7_8_868B9Y9
rep movsd dword es:[edi], dword [esi]
push 0x36
mov dword [ebp - 4], eax
xor esi, esi
xor eax, eax
pop ecx
mov ebx, eax
cmp cx, word [ebp - 0x1c]
jne 0x10011c73
test cx, cx
je 0x10011c73
cmp word [ebp + eax - 0x1c], si
je 0x10011c73
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.6_6F6M6V6i6n6s66]
cmp cx, word [ebp + eax - 0x1c]
je 0x10011c55
movzx ecx, byte [ebx*2 + str.6_6F6M6V6i6n6s66]
movzx eax, byte [ebp + ebx*2 - 0x1c]
mov ebx, dword [ebp - 4]
sub ecx, eax
cmp ecx, 0xefc
jne 0x10011c95
mov edx, ebx
and edx, 0x2e1a8834
mov eax, esi
inc eax
cmp byte [eax + str.pcant_flush_this_buffer], 0
jne 0x10011c97
cmp eax, 0xf5f
jne 0x10011cb4
mov ebx, dword [0x1003fa64]
add ebx, 0x3db61567
and edx, 0x84af7f9
mov ecx, esi
imul edx, edx, 0xaa603039
imul eax, ebx, 0xf32d4dbd
xor eax, 0xfefa24fe
inc ecx
cmp word [ecx*2 + str.._AVPK_DefaultDecryptionFilter_CryptoPP__], si
jne 0x10011cc8
imul edi, edx, 0xcf5b3f00
mov dword [0x1003fa98], eax
mov edx, edi
mov dword [0x1003fa64], edi
or edx, 0xa3df162
xor ebx, ebx
mov dword [0x1003fac0], edx
inc esi
cmp word [esi*2 + str.bad_function_call], bx
jne 0x10011cf9
mov ecx, dword [ebp - 4]
cmp ecx, esi
jae 0x10011d2f
lea eax, [edx - 0x66df1f1c]
mov dword [0x1003fa98], eax
cmp ecx, 0x1d36
jne 0x10011d2a
imul edi, edi, 0x20a46104
mov dword [0x1003fa64], edi
inc ecx
cmp ecx, esi
jb 0x10011d16
xor edi, 0x68492d93
mov esi, 0x100353c8
push 0xd
mov dword [0x1003fa6c], edi
lea edi, [ebp - 0x50]
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x66
pop esi
cmp si, word [ebp - 0x50]
jne 0x10011da0
xor edi, edi
mov ecx, edi
test si, si
je 0x10011d73
cmp word [ebp + ecx - 0x50], di
je 0x10011d73
inc ebx
lea ecx, [ebx + ebx]
movzx esi, word [ecx + str.functions]
cmp si, word [ebp + ecx - 0x50]
je 0x10011d55
mov ecx, dword [ebp - 4]
cmp ecx, ebx
jae 0x10011da0
imul eax, edx, 0xbb3990d4
cmp ecx, 0x10
jne 0x10011d96
sub edx, 0x6c026314
sub eax, 0x75294c90
mov dword [0x1003fac0], edx
inc ecx
mov dword [0x1003fa98], eax
cmp ecx, ebx
jb 0x10011d80
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10017794
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x1003fbe4]
xor esi, 0x5ef58f53
add esi, 0xaddb5f97
imul ecx, esi, 0xfcb9c3ce
and esi, 0xb0e20ecb
push edi
mov edi, edx
xor edx, edx
mov eax, edx
mov dword [0x1003fbe4], ecx
inc eax
cmp word [eax*2 + str.4_4_40484D4d4l4t4], dx
jne 0x100177c4
cmp dword [ebp - 4], eax
jae 0x100177e2
sub eax, dword [ebp - 4]
or esi, 0x61cd0f5a
sub eax, 1
jne 0x100177d7
lea eax, [ecx + 0x4291e9e4]
mov dword [0x1003fc00], eax
cmp byte [edi], dl
je 0x10017814
xor ecx, 0xc3221c
inc edx
cmp byte [edx + edi], 0
jne 0x100177f1
mov dword [0x1003fbe4], ecx
cmp edx, 0x1092
jne 0x10017814
and ecx, 0x34e4be8e
jmp 0x1001781a
and ecx, 0x6b2d0766
pop edi
mov dword [0x1003fb58], ecx
pop esi
leave
ret

Function at 0x10017824
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1003fbfc]
sub esp, 0x54
mov ecx, str.8_808P8X8_8l8
add eax, 0x16e1e7d7
inc ecx
cmp byte [ecx], 0
jne 0x10017834
push ebx
push esi
push edi
push 5
pop ecx
mov esi, str.2f3u3V5d5
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
push 0x32
xor edx, edx
pop esi
mov ebx, edx
cmp si, word [ebp - 0x18]
jne 0x10017898
mov ecx, edx
test si, si
je 0x1001787c
cmp word [ebp + ecx - 0x18], dx
je 0x1001787c
inc ebx
lea ecx, [ebx + ebx]
movzx esi, word [ecx + str.22_222C2H2R2f2s2]
cmp si, word [ebp + ecx - 0x18]
je 0x1001785e
mov ecx, dword [ebp - 4]
jmp 0x10017894
cmp ecx, 0x253c
jne 0x10017893
mov eax, dword [0x1003fba8]
or eax, 0xe010948b
inc ecx
cmp ecx, ebx
jb 0x10017881
push 0xe
pop ecx
mov esi, str.unknown_chunk:_out_of_memory
imul ebx, eax, 0xba1a418c
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
push 0x2e
movsw word es:[edi], word [esi]
pop edi
cmp di, word [ebp - 0x54]
jne 0x100178e3
mov ecx, edx
mov esi, edx
test di, di
je 0x100178d8
cmp word [ebp + ecx - 0x54], dx
je 0x100178d8
inc esi
lea ecx, [esi + esi]
movzx edi, word [ecx + str..060_0_0J0X0a0v0]
cmp di, word [ebp + ecx - 0x54]
je 0x100178ba
cmp dword [ebp - 4], esi
jae 0x100178e3
lea ebx, [eax + 0xb2679b9]
mov esi, 0x10037a94
imul ecx, eax, 0xaa65582a
mov eax, dword [0x1003fba8]
lea edi, [ebp - 0x14]
and eax, 0xddec78f0
mov dword [0x1003fb78], eax
movsd dword es:[edi], dword [esi]
mov eax, ecx
mov dword [ebp - 4], ecx
xor eax, 0xfdd6e512
mov dword [0x1003fba8], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x14], 0x6e
jne 0x10017934
mov al, 0x6e
test al, al
je 0x10017934
cmp byte [ebp + edx - 0x14], 0
je 0x10017934
mov al, byte [edx + 0x10038141]
inc edx
cmp al, byte [ebp + edx - 0x14]
je 0x1001791c
movzx ecx, byte [edx + str.no_protocol_option]
movzx eax, byte [ebp + edx - 0x14]
sub ecx, eax
cmp ecx, 0xfa8
jne 0x10017953
mov ebx, dword [ebp - 4]
add ebx, 0x70d1eb2b
and ebx, 0x40ba2241
mov dword [0x1003fc10], ebx
xor ebx, 0x8bb9b832
pop edi
pop esi
mov dword [0x1003fbfc], ebx
pop ebx
leave
ret
Function at 0x10017add
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [0x1003fc3c]
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebp - 8], ebx
push edi
mov al, byte [ebx]
mov byte [ebp - 1], al
test al, al
je 0x10017b18
imul eax, edx, 0x523a627e
inc esi
cmp byte [esi + ebx], 0
jne 0x10017b02
cmp esi, 0x63
jbe 0x10017b18
mov edx, eax
xor edx, 0xd3100799
jmp 0x10017b1f
mov eax, edx
or eax, 0x53d17e4b
mov ecx, str.GetCurrentProcessorNumberEx
or edx, 0x22db8daa
inc ecx
cmp byte [ecx], 0
jne 0x10017b24
xor ecx, ecx
cmp byte [ebp - 1], cl
je 0x10017b53
or edx, 0x83591ea3
inc ecx
cmp byte [ecx + ebx], 0
jne 0x10017b37
cmp ecx, 0x1599
jne 0x10017b53
add eax, 0x7da566d7
jmp 0x10017b59
imul edx, edx, 0x5f9ce629
mov bl, byte [ebp - 1]
lea edi, [ebp - 0x14]
mov esi, str.NO_ACTION
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp bl, byte [ebp - 0x14]
jne 0x10017ba4
mov esi, dword [ebp - 8]
test bl, bl
je 0x10017b87
cmp byte [ebp + ecx - 0x14], 0
je 0x10017b87
inc ecx
mov bl, byte [esi + ecx]
cmp bl, byte [ebp + ecx - 0x14]
je 0x10017b72
mov esi, dword [ebp - 8]
jmp 0x10017ba0
cmp esi, 0xcfa
jne 0x10017b9a
lea edx, [eax - 0x5973e852]
or eax, 0x7703083c
inc esi
cmp esi, ecx
jb 0x10017b8c
xor eax, eax
or edx, 0xaadc8e85
inc eax
cmp byte [eax + str.InstallForCurrentUserIE:_extract_d_upgrade_d], 0
jne 0x10017ba6
mov ecx, edx
cmp eax, 0x2578
je 0x10017bc7
add edx, 0xecb6b5d3
mov ecx, edx
imul eax, ecx, 0xfc4b00ad
lea edi, [ebp - 0x1c]
push 5
pop ecx
mov esi, str.GdipGetPenDashStyle
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x1c], 0x4d
jne 0x10017c1b
mov cl, 0x4d
test cl, cl
je 0x10017bfc
cmp byte [ebp + ebx - 0x1c], 0
je 0x10017bfc
mov cl, byte [ebx + 0x100384a1]
inc ebx
cmp cl, byte [ebp + ebx - 0x1c]
je 0x10017be4
mov ecx, dword [ebp - 8]
jmp 0x10017c17
cmp ecx, 0x141c
jne 0x10017c10
mov eax, edx
xor eax, 0x68669131
imul edx, eax, 0x3c398d5
inc ecx
cmp ecx, ebx
jb 0x10017c01
mov ebx, dword [ebp - 8]
xor edi, edi
mov ecx, edi
cmp byte [ebp - 1], cl
je 0x10017c4c
add edx, 0xa977df55
inc ecx
cmp byte [ecx + ebx], 0
jne 0x10017c27
cmp ecx, 0x17bc
jbe 0x10017c4c
mov eax, edx
mov ecx, edi
or eax, 0xf706842a
mov dword [0x1003fb80], eax
jmp 0x10017c59
mov ecx, edi
and edx, 0xb9d124c8
cmp byte [ebp - 1], cl
je 0x10017c75
lea eax, [edx - 0x5e2a73e7]
inc ecx
cmp byte [ecx + ebx], 0
jne 0x10017c5f
cmp ecx, 0x91d
jb 0x10017c75
or eax, 0xa93c134
jmp 0x10017c7a
xor eax, 0x10d77d22
mov ecx, edi
xor eax, 0x269291d8
and eax, 0x54bf365a
inc ecx
cmp byte [ecx + str.Invalid_index_passed_to_GetClientData__], 0
jne 0x10017c81
cmp ecx, 0x1669
jne 0x10017c9e
imul eax, eax, 0xffd20909
lea esi, [eax - 0x4e8bb217]
mov edx, edi
mov dword [0x1003fb80], esi
xor eax, 0xc1581c29
inc edx
cmp word [edx*2 + str.SetLanguage_:_initializatin_locale], di
jne 0x10017cac
mov ecx, dword [ebp - 8]
mov dword [0x1003fc3c], eax
cmp ecx, edx
jae 0x10017ceb
cmp ecx, 0xf28
jne 0x10017cda
xor eax, 0xbcb8bb4
mov dword [0x1003fc3c], eax
or esi, 0x96269f41
inc ecx
cmp ecx, edx
jb 0x10017cc8
mov dword [0x1003fb80], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10018c62
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret
Function at 0x1001b360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1003fc48]
push ebx
mov ebx, ecx
add eax, 0xf9adb4cf
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ebx
movzx edx, word [ebx]
mov esi, ecx
mov edi, edx
test dx, dx
mov edx, dword [0x1003fc9c]
mov dword [ebp - 8], edi
je 0x1001b39d
mov eax, edx
xor eax, 0x8a1c278a
inc esi
cmp word [ebx + esi*2], cx
jne 0x1001b396
cmp dword [ebp - 4], esi
jae 0x1001b3af
sub esi, dword [ebp - 4]
or eax, 0x9d5e82a
sub esi, 1
jne 0x1001b3a5
and eax, 0xd7adb00e
and edx, 0x34197954
imul esi, eax, 0x589a7226
test di, di
je 0x1001b3ed
xor edi, edi
inc ecx
cmp word [ebx + ecx*2], di
jne 0x1001b3c7
mov eax, dword [ebp - 0xc]
jmp 0x1001b3e7
cmp eax, 0x1315
jne 0x1001b3e0
lea edx, [esi - 0x1a419bac]
or edx, 0x88763643
inc eax
cmp eax, ecx
jb 0x1001b3d3
jmp 0x1001b3ef
xor edi, edi
imul eax, esi, 0x1b3a7233
mov ebx, edi
push 0xa
pop ecx
mov esi, str.wxWindowDestroyEvent
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
add edx, 0x5e8768b
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movsw word es:[edi], word [esi]
mov dword [0x1003fc9c], edx
cmp ax, word [ebp - 0x38]
jne 0x1001b443
xor edi, edi
movzx esi, ax
mov eax, edi
test si, si
je 0x1001b443
cmp word [ebp + eax - 0x38], di
je 0x1001b443
inc ebx
lea eax, [ebx + ebx]
movzx esi, word [eax + ecx]
cmp si, word [ebp + eax - 0x38]
je 0x1001b428
movzx ecx, byte [ecx + ebx*2]
movzx eax, byte [ebp + ebx*2 - 0x38]
pop edi
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0x17d4
je 0x1001b468
mov edx, dword [ebp - 0xc]
add edx, 0xfd499682
mov dword [0x1003fc9c], edx
mov eax, edx
and eax, 0x12e4e38b
xor edx, 0xf7097fc1
mov dword [0x1003fc48], eax
mov dword [0x10040ed0], edx
leave
ret
Function at 0x1001e701
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov ebx, esi
mov dword [ebp - 8], ecx
mov ecx, esi
push edi
mov eax, ecx
mov byte [ebp + ecx - 0x108], cl
and eax, 0x1f
mov al, byte [eax + edx]
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x1001e71c
mov edi, esi
mov dl, byte [ebp + edi - 0x108]
movzx eax, byte [ebp + edi - 0x208]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x1001e763
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x108]
mov byte [ebp + ebx - 0x108], dl
mov byte [ebp + edi - 0x108], al
inc edi
cmp edi, 0x100
jl 0x1001e73d
mov edi, esi
cmp dword [ebp - 4], esi
jle 0x1001e7f5
mov ebx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sub ebx, edx
inc esi
and esi, 0x800000ff
jns 0x1001e7a1
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + esi - 0x108]
movzx eax, cl
add edi, eax
and edi, 0x800000ff
jns 0x1001e7bd
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + edi - 0x108], cl
mov byte [ebp + esi - 0x108], al
movzx ecx, byte [ebp + edi - 0x108]
movzx eax, al
add ecx, eax
movzx eax, cl
mov al, byte [ebp + eax - 0x108]
xor al, byte [ebx + edx]
mov byte [edx], al
inc edx
sub dword [ebp - 4], 1
jne 0x1001e790
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001ea81
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edx, dword [0x10040fb0]
lea edi, [ebp - 0x1c]
push 5
pop ecx
mov esi, str.._AVwxDirTraverser__
or edx, 0x2d0e3288
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
add edx, 0x5011bbf7
mov eax, ebx
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x76
jne 0x1001eacd
mov cl, 0x76
test cl, cl
je 0x1001eacd
cmp byte [ebp + eax - 0x1c], bl
je 0x1001eacd
mov cl, byte [eax + 0x10039da1]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x1001eab6
movzx ecx, byte [eax + str.vtable_constructor_called_recursively:__s]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0xd6e
jae 0x1001eaf2
mov eax, dword [0x10040fb0]
and eax, 0xe92044f
mov dword [0x10041040], eax
mov eax, dword [0x10040fb0]
mov ecx, ebx
lea esi, [eax - 0x43c6ed6]
inc ecx
cmp byte [ecx + str.vtable_constructor_called_recursively:__s], bl
jne 0x1001eaff
cmp ecx, 0x9d1
jae 0x1001eb18
and esi, 0x5e5a720b
jmp 0x1001eb1e
lea esi, [eax - 0x155c8806]
mov dword [0x10040fe4], esi
mov ecx, ebx
inc ecx
cmp byte [ecx + 0x10039d18], bl
jne 0x1001eb26
cmp dword [ebp - 4], ecx
jae 0x1001eb3c
mov edx, eax
xor edx, 0x5a46ef7a
push 6
pop ecx
mov esi, str.._AVwxObjectEventFunctor__
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
or edx, 0x83de087a
mov dword [0x1004101c], edx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x20], 0x76
jne 0x1001eb79
push 0x76
pop eax
test al, al
je 0x1001eb79
cmp byte [ebp + ebx - 0x20], 0
je 0x1001eb79
mov al, byte [ebx + 0x10039da1]
inc ebx
cmp al, byte [ebp + ebx - 0x20]
je 0x1001eb61
movzx eax, byte [ebp + ebx - 0x20]
movzx edx, byte [ebx + str.vtable_constructor_called_recursively:__s]
sub edx, eax
mov eax, dword [0x10040fb0]
mov ecx, eax
add eax, 0xb94664e0
xor ecx, 0xee04f80c
cmp edx, 0x483
pop edi
cmovbe eax, ecx
pop esi
mov dword [0x10040ff0], eax
pop ebx
leave
ret
Function at 0x1001ee95
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x10040fb4]
sub esp, 0x34
xor edx, edx
mov eax, edx
or ecx, 0xa0f24614
inc eax
cmp byte [eax + str._sUnlink_Windows_Login], dl
jne 0x1001eea5
push esi
push edi
push 7
pop ecx
mov esi, str.Failed_to_splitmydir_A_from_s
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
mov eax, edx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x34], 0x41
jne 0x1001ef11
mov cl, 0x41
test cl, cl
je 0x1001eee7
cmp byte [ebp + eax - 0x34], dl
je 0x1001eee7
mov cl, byte [eax + 0x10039cad]
inc eax
cmp cl, byte [ebp + eax - 0x34]
je 0x1001eed0
mov esi, dword [ebp - 4]
cmp esi, eax
jae 0x1001ef11
mov ecx, dword [0x10041000]
mov edi, dword [0x10040fe8]
cmp esi, 0xca7
jne 0x1001ef0a
mov ecx, edi
xor ecx, 0xfcb2cceb
inc esi
cmp esi, eax
jb 0x1001eefa
jmp 0x1001ef1d
mov ecx, dword [0x10041000]
mov edi, dword [0x10040fe8]
push ebx
mov ebx, dword [0x10040fb0]
mov eax, edx
imul esi, ebx, 0xdc06f8ef
inc eax
cmp byte [eax + str.545_5D5L5T55d5l5x5], dl
jne 0x1001ef2c
cmp eax, 0x15c1
jb 0x1001ef42
imul ecx, esi, 0xef02f8f9
mov eax, str.GdipFillClosedCurve
lea eax, [eax + 2]
xor ecx, 0x60c5818
cmp word [eax], dx
jne 0x1001ef47
xor edi, 0x950dd31a
mov esi, str..magentosite
mov dword [0x10040fac], edi
mov eax, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x14], 0x47
jne 0x1001ef8f
mov cl, 0x47
test cl, cl
je 0x1001ef8f
cmp byte [ebp + eax - 0x14], dl
je 0x1001ef8f
mov cl, byte [eax + 0x10039e21]
inc eax
cmp cl, byte [ebp + eax - 0x14]
je 0x1001ef78
movzx ecx, byte [eax + str.GdipCreateFontFamilyFromName]
movzx eax, byte [ebp + eax - 0x14]
sub ecx, eax
cmp ecx, 0x7a9
je 0x1001efb4
mov eax, dword [0x10040fe8]
add eax, 0xe782df4e
mov dword [0x10040fac], eax
mov edi, dword [0x10040fe8]
lea esi, [ebx - 0x17e23ae0]
or ebx, 0x75d547a7
mov dword [0x10041000], esi
add edi, 0x4f8a0dbb
mov dword [0x1004100c], ebx
mov dword [0x10040fb4], edi
pop ebx
inc edx
cmp byte [edx + str.AttachConsole], 0
jne 0x1001efdf
mov ecx, dword [ebp - 4]
jmp 0x1001f010
cmp ecx, 0x162d
jne 0x1001f004
mov esi, edi
or esi, 0x85df0db
mov dword [0x10041000], esi
lea eax, [esi + 0x2abc7ede]
inc ecx
mov dword [0x10040fac], eax
cmp ecx, edx
jb 0x1001efee
pop edi
pop esi
leave
ret