joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017757
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret

Function at 0x10017f87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov al, byte [str.beharabic]
mov byte [ebp - 1], al
test al, al
je 0x10017fa7
mov ecx, dword [0x1003c2bc]
or ecx, 0x97ac195
jmp 0x10017fad
mov ecx, dword [0x1003c2a0]
push ebx
push esi
push edi
mov esi, str.macronmonospace
imul edx, ecx, 0xce78c398
lea edi, [ebp - 0x20]
xor ebx, ebx
mov ecx, ebx
mov dword [ebp - 8], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp al, byte [ebp - 0x20]
jne 0x10017fe8
test al, al
je 0x10017fe5
cmp byte [ebp + ecx - 0x20], bl
je 0x10017fe5
mov al, byte [ecx + 0x1003c279]
inc ecx
cmp al, byte [ebp + ecx - 0x20]
je 0x10017fce
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [ecx + str.beharabic]
movzx eax, byte [ebp + eax - 0x20]
sub ecx, eax
cmp ecx, 0x9df
jbe 0x10018010
mov eax, dword [0x1003c2bc]
mov edx, eax
or edx, 0x8fa7e70a
jmp 0x10018016
imul eax, edx, 0xb525244
mov ecx, str._Rules_AddAppIntoGroup_CAfwCoreClient__QEAAKVCGUID__0_Z
xor edx, 0xdde7b60a
inc ecx
cmp byte [ecx], bl
jne 0x1001801b
mov ecx, str.Missing_or_invalid_Decode_array_in_shading_dictionary
lea ecx, [ecx + 2]
and edx, 0xd42d7643
cmp word [ecx], bx
jne 0x1001802b
push 6
pop ecx
mov esi, str.page_subscription_chromium
imul eax, eax, 0xcbc3e3f4
lea edi, [ebp - 0x28]
mov dword [ebp - 0xc], ebx
rep movsd dword es:[edi], dword [esi]
imul eax, eax, 0xed35e541
movsw word es:[edi], word [esi]
mov dword [ebp - 8], eax
mov al, byte [ebp - 1]
movsb byte es:[edi], byte [esi]
cmp al, byte [ebp - 0x28]
jne 0x10018081
mov cl, al
mov eax, ebx
test cl, cl
je 0x1001807e
cmp byte [ebp + eax - 0x28], bl
je 0x1001807e
mov cl, byte [eax + 0x1003c279]
inc eax
cmp cl, byte [ebp + eax - 0x28]
je 0x10018067
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + str.beharabic]
movzx eax, byte [ebp + eax - 0x28]
sub ecx, eax
mov eax, dword [ebp - 8]
cmp ecx, 0xf9f
jae 0x100180a2
or eax, 0xde051d3d
mov esi, str.driveLetter
lea edi, [ebp - 0x1c]
xor eax, 0x4419e9af
add edx, 0xdbd5d6ff
mov dword [ebp - 8], eax
mov al, byte [ebp - 1]
movsd dword es:[edi], dword [esi]
mov dword [0x1003d440], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp al, byte [ebp - 0x1c]
jne 0x100180e3
test al, al
je 0x100180e3
cmp byte [ebp + ebx - 0x1c], 0
je 0x100180e3
mov al, byte [ebx + 0x1003c279]
inc ebx
cmp al, byte [ebp + ebx - 0x1c]
je 0x100180cb
movzx ecx, byte [ebx + str.beharabic]
movzx eax, byte [ebp + ebx - 0x1c]
pop edi
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0x1bcb
jne 0x10018104
lea eax, [edx - 0x3a2b632d]
jmp 0x1001810c
mov eax, dword [ebp - 8]
add eax, 0x95bb0f4a
lea ecx, [edx + 0x79162ad3]
mov dword [0x1003c2a0], eax
mov dword [0x1003c2bc], ecx
leave
ret
Function at 0x1001827f
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [0x1003d4a4], 0x685ac83c
imul edx, dword [0x1003c288], 0x4656a44a
push esi
mov esi, ecx
push edi
mov dword [0x1003d4a4], eax
xor edi, edi
xor eax, 0x18240400
mov dword [0x1003c288], edx
and eax, 0x5d2d2e75
mov ecx, edi
mov dword [str._nfs_f], eax
mov eax, dword [0x1003d4c4]
cmp word [esi], di
je 0x100182e0
xor eax, 0x4fbc9217
inc ecx
cmp word [esi + ecx*2], di
jne 0x100182bf
cmp ecx, 0xc82
jb 0x100182e0
imul eax, edx, 0x79cacdf3
mov dword [0x1003c288], eax
jmp 0x100182ea
or eax, 0xd0d7d6c0
mov dword [0x1003d4a4], eax
pop edi
mov dword [0x1003d4c4], 0x65c7c4f8
pop esi
ret
Function at 0x10019395
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov esi, str.extralarge
lea edi, [ebp - 0x10]
xor edx, edx
mov ecx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x70
jne 0x100193fd
mov al, 0x70
test al, al
je 0x100193ce
cmp byte [ebp + ecx - 0x10], dl
je 0x100193ce
mov al, byte [ecx + 0x10033371]
inc ecx
cmp al, byte [ebp + ecx - 0x10]
je 0x100193b7
mov esi, dword [ebp - 4]
cmp esi, ecx
jae 0x100193fd
mov eax, dword [0x1003c274]
mov edi, dword [0x1003d4f0]
cmp esi, 0xb31
jne 0x100193ee
lea eax, [edi - 0x3a851113]
mov edi, eax
xor edi, 0xfe56b69a
inc esi
cmp esi, ecx
jb 0x100193e0
jmp 0x10019402
mov eax, dword [0x1003c274]
lea ecx, [eax - 0x18d30d70]
mov esi, edx
and ecx, 0x2715cff6
xor ecx, 0xcb953765
inc esi
cmp byte [esi + str.lp.ecilrog], dl
jne 0x10019410
cmp esi, 0x133b
jb 0x1001942e
mov eax, ecx
or eax, 0x9fc67482
add eax, 0x91c73fd
mov ecx, edx
inc ecx
cmp byte [ecx + str.vectaury.io], dl
jne 0x10019435
cmp dword [ebp - 4], ecx
jae 0x1001944d
add eax, 0x6278f63c
xor eax, 0x9ed702a5
xor eax, 0xd4330e7a
imul ebx, eax, 0x859c7cf7
lea eax, [ebx - 0x76e1750f]
mov dword [0x1003c274], eax
mov eax, str.rieulpansioskorean
sub ebx, 0x6c8b19d4
inc eax
cmp byte [eax], dl
jne 0x10019468
push 6
pop ecx
mov esi, str.failed_to_get_instup_info
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x2c], 0x70
jne 0x100194a3
push 0x70
pop eax
test al, al
je 0x100194a3
cmp byte [ebp + edx - 0x2c], 0
je 0x100194a3
mov al, byte [edx + 0x100333fd]
inc edx
cmp al, byte [ebp + edx - 0x2c]
je 0x1001948b
movzx ecx, byte [edx + str.pj.amnug.annak]
movzx eax, byte [ebp + edx - 0x2c]
sub ecx, eax
cmp ecx, 0x40c
jae 0x100194c1
xor ebx, 0x1068ab9c
jmp 0x100194cd
mov ebx, dword [0x1003c274]
add ebx, 0x2ad5be09
pop edi
pop esi
mov dword [0x1003d4f0], ebx
pop ebx
leave
ret
Function at 0x1001974b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [0x1003c284]
push esi
push edi
mov esi, str.rk.nowgnag
lea edi, [ebp - 0x10]
lea edx, [ebx + 0x7e8b8049]
mov eax, edx
xor eax, 0xbb7dd90
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
xor eax, eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x70
jne 0x10019799
mov cl, 0x70
test cl, cl
je 0x10019799
cmp byte [ebp + eax - 0x10], 0
je 0x10019799
mov cl, byte [eax + 0x10033b41]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0x10019781
movzx ecx, byte [eax + str.pj.akoukuf.oto]
movzx eax, byte [ebp + eax - 0x10]
sub ecx, eax
cmp ecx, 0xd76
jne 0x100197b7
lea esi, [edx + 0x39a79c1b]
jmp 0x100197c2
mov esi, dword [ebp - 4]
mov ebx, edx
xor ebx, 0x71a9f0a4
xor eax, eax
mov ecx, eax
xor edx, 0xa4e77e55
inc ecx
cmp word [ecx*2 + str.._AVWWWFormRecord_proto_passwdmgr_avast_com__], ax
jne 0x100197c6
mov eax, dword [ebp - 4]
mov edx, dword [0x1003d4c0]
cmp eax, ecx
jae 0x100197fc
cmp eax, 0x187d
jne 0x100197f1
lea esi, [edx + 0x5c61e381]
mov edx, esi
or edx, 0x1f2d09fd
inc eax
jmp 0x100197e0
imul ecx, ebx, 0x17a45a08
lea eax, [ebx + 0x69b66c94]
and edx, 0xf310bedb
mov dword [0x1003c250], eax
pop edi
pop esi
mov dword [0x1003c284], edx
imul eax, ecx, 0x177cd60d
mov dword [0x1003d494], ecx
pop ebx
mov dword [0x1003d4c0], eax
leave
ret
Function at 0x10019a83
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 4], ebx
push 9
pop ecx
mov esi, str.pj.igayim.amakihs
mov edx, eax
movzx eax, word [ebx]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov esi, eax
cmp ax, word [ebp - 0x2c]
jne 0x10019ace
mov ecx, esi
mov eax, edi
test cx, cx
je 0x10019ace
cmp word [ebp + eax - 0x2c], di
je 0x10019ace
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + ebx]
cmp cx, word [ebp + eax - 0x2c]
je 0x10019ab3
movzx ecx, byte [ebx + edx*2]
movzx eax, byte [ebp + edx*2 - 0x2c]
sub ecx, eax
cmp ecx, 0xf50
jbe 0x10019af3
imul edx, dword [0x1003d460], 0xa33d579c
mov ecx, dword [0x1003c2a4]
jmp 0x10019aff
mov edx, dword [0x1003d460]
lea ecx, [edx - 0x1351e71f]
mov ebx, dword [0x1003d498]
mov eax, edi
add ebx, 0x281cda1b
test si, si
je 0x10019b33
mov esi, dword [ebp - 4]
mov edx, ebx
and edx, 0x4cdc2e3
inc eax
cmp word [esi + eax*2], di
jne 0x10019b1d
cmp eax, 0x159c
jb 0x10019b33
imul edx, ecx, 0xfd64374c
jmp 0x10019b39
imul ebx, ecx, 0x68641754
mov eax, edi
mov esi, str.avcfg:__settings_Common_StreamingUpdates
push 0xa
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x30], 0x41
jne 0x10019b87
mov cl, 0x41
test cl, cl
je 0x10019b69
cmp byte [ebp + eax - 0x30], 0
je 0x10019b69
mov cl, byte [eax + 0x100334f1]
inc eax
cmp cl, byte [ebp + eax - 0x30]
je 0x10019b51
mov ecx, dword [ebp - 4]
jmp 0x10019b83
cmp ecx, 0x2572
jne 0x10019b7c
imul edx, edx, 0xa6b8599
and ebx, 0xd152cfe3
inc ecx
cmp ecx, eax
jb 0x10019b6e
push 7
pop ecx
mov esi, str.muesum.rawdloc
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
push 0x57
xor ebx, ebx
mov eax, ebx
movsw word es:[edi], word [esi]
pop esi
cmp si, word [ebp - 0x28]
jne 0x10019bc3
mov ecx, ebx
test si, si
je 0x10019bc3
cmp word [ebp + ecx - 0x28], bx
je 0x10019bc3
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.WtuBrowserCleaner]
cmp si, word [ebp + ecx - 0x28]
je 0x10019ba5
movzx ecx, byte [eax*2 + str.WtuBrowserCleaner]
movzx eax, byte [ebp + eax*2 - 0x28]
pop edi
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0x1522
jbe 0x10019be5
add edx, 0xc85534f6
jmp 0x10019beb
xor edx, 0xa8729cfe
xor edx, 0x4d000301
and edx, 0xed856b83
mov dword [0x1003c2a4], edx
or edx, 0x51e16d95
xor edx, 0x507c7421
mov dword [0x1003d460], edx
lea eax, [edx + 0x6bec7723]
mov dword [0x1003d498], eax
leave
ret
Function at 0x10019e68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, str.on.dnalevi
lea edi, [ebp - 0x10]
xor ebx, ebx
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x53
jne 0x10019ea1
mov cl, 0x53
test cl, cl
je 0x10019ea1
cmp byte [ebp + eax - 0x10], bl
je 0x10019ea1
mov cl, byte [eax + 0x10033bf1]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0x10019e8a
movzx ecx, byte [eax + str.SnxReboot.txt]
movzx eax, byte [ebp + eax - 0x10]
mov edx, dword [0x1003d490]
sub ecx, eax
cmp ecx, 0xb07
jne 0x10019ec5
imul ecx, edx, 0x5a3b9457
jmp 0x10019ed1
mov ecx, dword [0x1003c264]
and ecx, 0x22124cc3
mov esi, dword [0x1003d478]
mov eax, str.END_Alpha_InsertLegacyLicenseFile___OK
mov edi, dword [0x1003d56c]
add esi, 0xa1238405
mov dword [0x1003c24c], esi
or ecx, 0x52a70fa
lea eax, [eax + 2]
imul edi, edi, 0x2d3045f7
cmp word [eax], bx
jne 0x10019ef4
mov dword [0x1003d56c], edi
mov eax, ebx
inc eax
cmp byte [eax + str.moc.gofgp], bl
jne 0x10019f0a
mov edi, dword [ebp - 4]
cmp edi, eax
jae 0x10019f43
mov edx, dword [0x1003c264]
cmp edi, 0x23a2
jne 0x10019f30
mov edx, ecx
xor edx, 0x9983fbd1
mov ecx, edx
xor ecx, 0xe66ecadc
inc edi
cmp edi, eax
jb 0x10019f20
mov edx, dword [0x1003d490]
mov edi, ebx
inc edi
cmp byte [edi + str.lp.vog.zouw], bl
jne 0x10019f45
mov eax, dword [ebp - 4]
cmp eax, edi
jae 0x10019f7b
mov esi, dword [0x1003d56c]
add esi, 0x76736d52
mov dword [0x1003c24c], esi
cmp eax, 0x1159
jne 0x10019f76
mov edx, ecx
or edx, 0xbf3b1e2f
inc eax
cmp eax, edi
jb 0x10019f67
mov eax, ebx
xor edx, 0x3095db0e
inc eax
cmp word [eax*2 + str.END_Alpha_InsertLegacyLicenseFile___OK], bx
jne 0x10019f83
cmp eax, 0xdfa
jne 0x10019fa1
add esi, 0x16b4e82c
mov dword [0x1003c24c], esi
mov eax, str.lp.vog.zouw
xor edx, 0x3ad4afe6
inc eax
cmp byte [eax], bl
jne 0x10019fa6
lea eax, [esi - 0x3cfdbc7e]
mov dword [0x1003c264], edx
mov dword [0x1003d490], eax
inc ebx
cmp byte [ebx + str.avcfg:__settings_Common_ignore_remote_access_shield_off], 0
jne 0x10019fc2
cmp ebx, 0x2005
je 0x10019fe0
sub edx, 0x2cc15a51
mov dword [0x1003c264], edx
pop edi
lea ecx, [edx + 0x65d7d82e]
mov eax, esi
xor edx, 0x91678cdc
mov dword [0x1003d478], ecx
pop esi
mov dword [0x1003d3f4], edx
pop ebx
leave
ret
Function at 0x1001ca05
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov ebx, esi
mov dword [ebp - 8], ecx
mov ecx, esi
push edi
mov eax, ecx
mov byte [ebp + ecx - 0x108], cl
and eax, 0x1f
mov al, byte [eax + edx]
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x1001ca20
mov edi, esi
mov dl, byte [ebp + edi - 0x108]
movzx eax, byte [ebp + edi - 0x208]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x1001ca67
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x108]
mov byte [ebp + ebx - 0x108], dl
mov byte [ebp + edi - 0x108], al
inc edi
cmp edi, 0x100
jl 0x1001ca41
mov edi, esi
cmp dword [ebp - 4], esi
jle 0x1001caf9
mov ebx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sub ebx, edx
inc esi
and esi, 0x800000ff
jns 0x1001caa5
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + esi - 0x108]
movzx eax, cl
add edi, eax
and edi, 0x800000ff
jns 0x1001cac1
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + edi - 0x108], cl
mov byte [ebp + esi - 0x108], al
movzx ecx, byte [ebp + edi - 0x108]
movzx eax, al
add ecx, eax
movzx eax, cl
mov al, byte [ebp + eax - 0x108]
xor al, byte [ebx + edx]
mov byte [edx], al
inc edx
sub dword [ebp - 4], 1
jne 0x1001ca94
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001d30b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1003d700]
sub esp, 0x30
push ebx
push esi
xor ebx, ebx
lea eax, [edx + 0x238ec090]
push edi
mov ecx, ebx
inc ecx
cmp word [ecx*2 + str.addakgurmukhi], bx
jne 0x1001d324
cmp ecx, 0x13eb
jbe 0x1001d341
mov ecx, eax
xor ecx, 0xefaf296c
jmp 0x1001d34d
mov ecx, dword [0x1003d6e4]
add edx, 0x59f840bd
mov esi, ebx
xor ecx, 0xb263435a
inc esi
cmp byte [esi + str.afii57680], bl
jne 0x1001d34f
cmp esi, 0x847
jbe 0x1001d36d
xor eax, 0x36289168
jmp 0x1001d373
lea eax, [edx - 0x5903c6c3]
imul edx, ecx, 0xc0102de1
mov esi, ebx
mov dword [0x1003d6e4], edx
lea edi, [edx + 0x53938bbe]
inc esi
cmp word [esi*2 + str.addakgurmukhi], bx
jne 0x1001d387
mov ecx, dword [ebp - 4]
jmp 0x1001d3ac
cmp ecx, 0x6bf
jne 0x1001d3a5
imul edi, edi, 0xbe720bec
imul eax, edi, 0xfa69df92
inc ecx
cmp ecx, esi
jb 0x1001d397
mov esi, ebx
xor eax, 0x99b4a9bc
inc esi
cmp word [esi*2 + str.addakgurmukhi], bx
jne 0x1001d3b2
mov ecx, dword [ebp - 4]
jmp 0x1001d3e3
cmp ecx, 0x134d
jne 0x1001d3db
add edx, 0x7dc807a9
mov dword [0x1003d6e4], edx
mov eax, edx
or eax, 0x73983850
inc ecx
cmp ecx, esi
jb 0x1001d3c7
mov ecx, ebx
and eax, 0x65c6a7ea
inc ecx
cmp word [ecx*2 + str.addakgurmukhi], bx
jne 0x1001d3e9
cmp dword [ebp - 4], ecx
jae 0x1001d412
sub ecx, dword [ebp - 4]
imul edx, edx, 0x82c3b0b1
sub ecx, 1
jne 0x1001d401
mov dword [0x1003d6e4], edx
mov ecx, ebx
mov ebx, eax
xor ebx, 0xce02ccab
xor edi, edi
mov dword [0x1003d700], ebx
inc ecx
cmp word [ecx*2 + str.addakgurmukhi], di
jne 0x1001d424
mov esi, dword [ebp - 4]
jmp 0x1001d44f
cmp esi, 0x217e
jne 0x1001d448
lea edx, [eax + 0xc2b8dc]
mov dword [0x1003d6e4], edx
lea eax, [edx - 0x3b323396]
inc esi
cmp esi, ecx
jb 0x1001d434
push 5
pop ecx
mov esi, str.none_guest
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
push 0x61
pop ecx
movsw word es:[edi], word [esi]
cmp cx, word [ebp - 0x1c]
jne 0x1001d4bf
mov edi, ecx
xor ecx, ecx
mov esi, ecx
xor ebx, ebx
test di, di
je 0x1001d491
cmp word [ebp + ecx - 0x1c], bx
je 0x1001d491
inc esi
lea ecx, [esi + esi]
movzx edi, word [ecx + str.addakgurmukhi]
cmp di, word [ebp + ecx - 0x1c]
je 0x1001d473
mov ecx, dword [ebp - 4]
mov ebx, dword [0x1003d700]
cmp ecx, esi
jae 0x1001d4bf
cmp ecx, 0x25aa
jne 0x1001d4ae
mov edx, ebx
or edx, 0xbfe51cdd
imul edx, edx, 0x9ba81644
inc ecx
cmp ecx, esi
jb 0x1001d49e
mov dword [0x1003d6e4], edx
xor ecx, ecx
lea edi, [ebp - 0x30]
push 0xa
mov ebx, ecx
mov esi, str.product.parts.latest
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x61
xor eax, 0xa2ba27eb
mov dword [0x1003d78c], eax
movsw word es:[edi], word [esi]
pop esi
cmp si, word [ebp - 0x30]
jne 0x1001d531
xor edi, edi
mov ecx, edi
test si, si
je 0x1001d507
cmp word [ebp + ecx - 0x30], di
je 0x1001d507
inc ebx
lea ecx, [ebx + ebx]
movzx esi, word [ecx + str.addakgurmukhi]
cmp si, word [ebp + ecx - 0x30]
je 0x1001d4e9
mov ecx, dword [ebp - 4]
cmp ecx, ebx
jae 0x1001d531
cmp ecx, 0x517
jne 0x1001d520
xor eax, 0xe8d2ce56
mov dword [0x1003d78c], eax
sub edx, 0x20855b32
inc ecx
cmp ecx, ebx
jb 0x1001d50e
mov dword [0x1003d6e4], edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001d5e5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 0xa
pop ecx
mov esi, str.tools_rescuedisk_off
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
push 0x61
xor eax, eax
mov ebx, edx
pop ecx
movsw word es:[edi], word [esi]
mov edx, eax
cmp cx, word [ebp - 0x30]
jne 0x1001d64f
xor edi, edi
test cx, cx
je 0x1001d62c
cmp word [ebp + eax - 0x30], di
je 0x1001d62c
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.addakgurmukhi]
cmp cx, word [ebp + eax - 0x30]
je 0x1001d60e
mov ecx, dword [ebp - 4]
cmp ecx, edx
jae 0x1001d64d
cmp ecx, 0xbcf
jne 0x1001d64a
mov eax, dword [0x1003d62c]
and eax, 0x645c9031
mov dword [0x1003d688], eax
inc ecx
jmp 0x1001d62f
xor eax, eax
push 8
pop ecx
mov esi, str.pj.ikarabi.enot
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
push 0x52
mov edx, ebx
or edx, 0x45935e2d
pop esi
mov dword [0x1003d6f4], edx
cmp si, word [ebp - 0x28]
jne 0x1001d695
xor edi, edi
mov ecx, edi
test si, si
je 0x1001d695
cmp word [ebp + ecx - 0x28], di
je 0x1001d695
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.ReuseTest]
cmp si, word [ebp + ecx - 0x28]
je 0x1001d677
movzx ecx, byte [eax*2 + str.ReuseTest]
movzx eax, byte [ebp + eax*2 - 0x28]
sub ecx, eax
cmp ecx, 0x11db
jbe 0x1001d6b5
mov eax, ebx
xor eax, 0x9fdd9aef
jmp 0x1001d6bf
imul eax, dword [0x1003d688], 0x4320c195
mov dword [0x1003d678], eax
imul eax, ebx, 0xa40d0f73
and edx, 0xe5be87cc
pop edi
pop esi
mov dword [0x1003d5e8], edx
pop ebx
mov dword [0x1003d62c], eax
leave
ret
Function at 0x1001d6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 5
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
mov esi, str.yoikorean
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
push 0x61
mov edx, eax
xor esi, esi
pop eax
cmp ax, word [ebp - 0x1c]
jne 0x1001d748
mov ecx, eax
mov eax, esi
test cx, cx
je 0x1001d729
cmp word [ebp + eax - 0x1c], si
je 0x1001d729
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.addakgurmukhi]
cmp cx, word [ebp + eax - 0x1c]
je 0x1001d70b
mov eax, dword [ebp - 4]
cmp eax, edx
jae 0x1001d748
mov ecx, dword [0x1003d5e4]
cmp eax, 0x1d2
jne 0x1001d743
xor ecx, 0x373f56a5
inc eax
cmp eax, edx
jb 0x1001d736
mov eax, esi
lea edi, [ebp - 0x14]
mov esi, str.tnatnuocca
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x14], 0x66
jne 0x1001d777
mov cl, 0x66
test cl, cl
je 0x1001d777
cmp byte [ebp + eax - 0x14], 0
je 0x1001d777
mov cl, byte [eax + 0x10034b79]
inc eax
cmp cl, byte [ebp + eax - 0x14]
je 0x1001d75f
movzx edx, byte [eax + str.finalkafhebrew]
movzx eax, byte [ebp + eax - 0x14]
sub edx, eax
cmp edx, 0x11f1
jbe 0x1001d799
mov eax, ebx
and eax, 0x5648aba8
mov dword [0x1003d6cc], eax
push 5
pop ecx
mov esi, str.gumgum.com
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
push 0x61
xor eax, eax
pop ecx
movsw word es:[edi], word [esi]
mov edx, eax
cmp cx, word [ebp - 0x1c]
jne 0x1001d7e6
xor esi, esi
test cx, cx
je 0x1001d7d5
cmp word [ebp + eax - 0x1c], si
je 0x1001d7d5
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.addakgurmukhi]
cmp cx, word [ebp + eax - 0x1c]
je 0x1001d7b7
cmp dword [ebp - 4], edx
jae 0x1001d7e6
mov eax, ebx
or eax, 0x3f9f930
mov dword [0x1003d6cc], eax
lea eax, [ebx - 0x20783456]
xor ebx, 0xdbbd4c95
pop edi
pop esi
mov dword [0x1003d5e4], ebx
mov dword [0x1003d6e0], eax
pop ebx
leave
ret
Function at 0x1001e171
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 7
pop ecx
mov ebx, dword [0x1003d6c4]
lea edi, [ebp - 0x24]
mov esi, str.consumable.com
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x76
pop ecx
and ebx, 0x8569dba1
mov edx, eax
movsw word es:[edi], word [esi]
xor esi, esi
cmp cx, word [ebp - 0x24]
jne 0x1001e1f2
test cx, cx
je 0x1001e1c2
cmp word [ebp + eax - 0x24], si
je 0x1001e1c2
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.valid_till]
cmp cx, word [ebp + eax - 0x24]
je 0x1001e1a4
mov eax, dword [ebp - 4]
cmp eax, edx
jae 0x1001e1f2
lea ecx, [ebx - 0x72a1c4f4]
mov ebx, dword [0x1003d6bc]
mov dword [ebp - 4], ecx
mov ecx, dword [0x1003d734]
cmp eax, 0xd55
jne 0x1001e1eb
imul ebx, ecx, 0x5fd5f154
inc eax
cmp eax, edx
jb 0x1001e1de
jmp 0x1001e201
mov ecx, dword [0x1003d69c]
mov ebx, dword [0x1003d6bc]
mov dword [ebp - 4], ecx
mov eax, esi
lea edi, [ebp - 0x24]
push 8
mov edx, ebx
mov esi, str.._AVCefResourceRequestHandler__
pop ecx
xor edx, 0x4e9fdd4e
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x24], 0x61
jne 0x1001e238
mov cl, 0x61
test cl, cl
je 0x1001e238
cmp byte [ebp + eax - 0x24], 0
je 0x1001e238
mov cl, byte [eax + 0x10034d25]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0x1001e220
movzx ecx, byte [eax + str.au.cinimod]
movzx eax, byte [ebp + eax - 0x24]
sub ecx, eax
cmp ecx, 0x2053
jae 0x1001e25b
mov eax, dword [ebp - 4]
mov edx, ebx
or edx, 0x75714b1
jmp 0x1001e261
lea eax, [edx + 0x29fa9fae]
add eax, 0xf5de3601
or edx, 0xd98d5172
xor eax, 0xa40775d2
mov dword [0x1003d6c4], eax
or eax, 0xd0244602
mov ecx, eax
mov dword [0x1003d6bc], eax
add eax, 0xb251e124
xor ecx, 0x477f0a0e
xor ebx, ebx
mov dword [0x1003d734], eax
mov eax, ebx
xor edx, 0x3b0383bc
inc eax
cmp word [eax*2 + str.valid_till], bx
jne 0x1001e296
mov dword [0x1003d6dc], edx
pop edi
pop esi
pop ebx
cmp eax, 0x16ab
jbe 0x1001e2c3
lea edx, [ecx - 0x2f4bb57a]
mov dword [0x1003d6dc], edx
lea eax, [edx - 0x14cb0931]
mov dword [0x1003d69c], eax
leave
ret