joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000352e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
and eax, 0x6f4c940a
xor ecx, ecx
mov dword [ebp - 8], eax
mov eax, ecx
push esi
inc eax
cmp word [eax*2 + str.Fax3Encode], cx
jne 0x10003547
cmp eax, 0x924
jbe 0x10003563
mov edx, ebx
xor edx, 0x319966a7
jmp 0x1000356f
mov edx, dword [0x1003f418]
or edx, 0x6eaf7823
push edi
push 9
mov dword [ebp - 4], ecx
lea edi, [ebp - 0x2c]
pop ecx
mov esi, 0x10032adc
mov dword [0x1003f440], edx
rep movsd dword es:[edi], dword [esi]
push 0x46
pop eax
xor esi, esi
cmp ax, word [ebp - 0x2c]
jne 0x100035bb
mov ecx, eax
mov eax, esi
mov ebx, esi
test cx, cx
je 0x100035b5
cmp word [ebp + eax - 0x2c], si
je 0x100035b5
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.Fax3Encode]
cmp cx, word [ebp + eax - 0x2c]
je 0x10003597
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax*2 + str.Fax3Encode]
movzx eax, byte [ebp + eax*2 - 0x2c]
sub ecx, eax
cmp ecx, 0x232b
jb 0x100035e3
mov edx, ebx
or edx, 0x25c798f1
mov dword [0x1003f440], edx
mov eax, esi
lea edi, [ebp - 0x20]
push 5
pop ecx
mov esi, str.HaltIfNull
mov dword [ebp - 4], eax
rep movsd dword es:[edi], dword [esi]
push 0x46
pop ecx
movsw word es:[edi], word [esi]
xor esi, esi
cmp cx, word [ebp - 0x20]
jne 0x1000362e
mov ebx, dword [ebp - 4]
mov eax, esi
test cx, cx
je 0x10003625
cmp word [ebp + eax - 0x20], si
je 0x10003625
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.Fax3Encode]
cmp cx, word [ebp + eax - 0x20]
je 0x10003607
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax*2 + str.Fax3Encode]
movzx eax, byte [ebp + eax*2 - 0x20]
sub ecx, eax
cmp ecx, 0xc5e
mov ecx, dword [ebp - 8]
jae 0x1000364e
sub ecx, 0x63db6b21
mov eax, esi
lea edi, [edx + 0x42607df5]
inc eax
cmp word [eax*2 + str.InternetCrackUrl], si
jne 0x10003656
cmp eax, 0xacb
jae 0x10003678
mov edx, ecx
and edx, 0x95faceab
mov dword [0x1003f440], edx
jmp 0x1000367e
imul ecx, ebx, 0x65654ff6
imul eax, ebx, 0x4bcdc7e7
mov dword [0x1003f418], eax
inc esi
cmp byte [esi + str.Fractional_scanlines_cannot_be_read], 0
jne 0x10003689
mov eax, dword [ebp + 8]
cmp eax, esi
jae 0x100036ba
mov edx, ebx
and edx, 0xd6910e90
mov dword [0x1003f440], edx
cmp eax, 0x23ff
jne 0x100036b5
imul ecx, ecx, 0x558af7a6
inc eax
cmp eax, esi
jb 0x100036a8
xor eax, eax
mov esi, eax
imul edi, edi, 0x734f07ad
inc esi
cmp word [esi*2 + str.Fax3Encode], ax
jne 0x100036be
mov ecx, dword [ebp + 8]
mov dword [0x1003f49c], edi
pop edi
cmp ecx, esi
jae 0x10003702
lea edx, [ebx + 0x17fd5caf]
mov dword [0x1003f440], edx
cmp ecx, 0x1b1d
jne 0x100036fd
mov eax, ebx
and eax, 0x7b76984b
mov dword [0x1003f49c], eax
inc ecx
cmp ecx, esi
jb 0x100036e9
and ebx, 0xe0f41c89
mov eax, edx
pop esi
mov dword [0x1003f478], ebx
pop ebx
leave
ret
Function at 0x10004dd9
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea edi, [ebp - 0x24]
push 6
pop ecx
mov esi, str.floating_point_predictor
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov cl, byte [edx]
movsw word es:[edi], word [esi]
cmp cl, byte [ebp - 0x24]
jne 0x10004e12
test cl, cl
je 0x10004e12
cmp byte [ebp + eax - 0x24], 0
je 0x10004e12
inc eax
mov cl, byte [edx + eax]
cmp cl, byte [ebp + eax - 0x24]
je 0x10004dfd
movzx ecx, byte [eax + edx]
movzx eax, byte [ebp + eax - 0x24]
sub ecx, eax
cmp ecx, 0x1b3
ja 0x10004e33
mov ebx, dword [0x1003f73c]
or ebx, 0x4eda99a1
jmp 0x10004e39
mov ebx, dword [0x1003f744]
mov edx, dword [0x1003f60c]
lea edi, [ebp - 0x3c]
push 0xd
pop ecx
mov esi, str.TIFF:_Error_saving_image.
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
or edx, 0x5a28b4c7
mov dword [0x1003f73c], edx
movzx eax, word [ecx]
mov esi, eax
mov dword [ebp - 4], esi
cmp ax, word [ebp - 0x3c]
jne 0x10004ec3
xor eax, eax
movzx edi, si
mov esi, eax
xor edx, edx
test di, di
je 0x10004e8f
cmp word [ebp + eax - 0x3c], dx
je 0x10004e8f
inc esi
lea eax, [esi + esi]
movzx edi, word [eax + ecx]
cmp di, word [ebp + eax - 0x3c]
je 0x10004e74
mov eax, dword [ebp - 8]
mov edx, dword [0x1003f73c]
cmp eax, esi
jae 0x10004ec0
cmp eax, 0x12dd
jne 0x10004eaf
mov edx, dword [0x1003f634]
or edx, 0xb8743798
and edx, 0xc20ca58c
inc eax
cmp eax, esi
jb 0x10004e9c
mov dword [0x1003f73c], edx
mov esi, dword [ebp - 4]
test si, si
je 0x10004eea
xor eax, eax
lea ecx, [ecx + 2]
xor ebx, 0xfbe03bfd
cmp word [ecx], ax
jne 0x10004eca
and edx, 0x42024b08
or edx, 0x2004b061
mov dword [0x1003f73c], edx
mov eax, str.application_x_executable
imul ebx, ebx, 0xe78136a2
inc eax
cmp byte [eax], 0
jne 0x10004eef
lea eax, [edx + 0x604fb527]
lea ecx, [eax + 0x3f5675da]
mov dword [0x1003f60c], eax
mov dword [0x1003f744], ecx
lea ecx, [eax - 0x19716a34]
pop edi
and ecx, 0x801d6830
pop esi
mov dword [0x1003f634], ecx
pop ebx
leave
ret
Function at 0x10005277
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
push esi
push edi
push 0x1e
mov dword [ebp - 4], ecx
lea edi, [ebp - 0xbc]
pop ecx
push 0x77
mov esi, str.Could_not_install_the_LastPass_Plugin_for_Internet_Explorer
xor ebx, ebx
pop edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
cmp dx, word [ebp - 0xbc]
jne 0x100052cc
mov ecx, ebx
test dx, dx
je 0x100052cc
cmp word [ebp + ecx - 0xbc], bx
je 0x100052cc
inc eax
lea ecx, [eax + eax]
movzx edx, word [ecx + str.wxAcceleratorTable]
cmp dx, word [ebp + ecx - 0xbc]
je 0x100052a8
movzx ecx, byte [eax*2 + str.wxAcceleratorTable]
movzx eax, byte [ebp + eax*2 - 0xbc]
sub ecx, eax
cmp ecx, 0xc11
jbe 0x100052f2
mov eax, dword [0x1003f734]
mov edi, 0x31d0b196
jmp 0x10005307
mov eax, dword [str._l8vc]
mov edi, dword [0x1003f608]
and eax, 0xd9d6f372
mov dword [0x1003f734], eax
mov esi, dword [ebp - 4]
lea ebx, [edi + 0x29d2fd58]
mov edx, 0x6a981350
mov dword [0x1003f640], ebx
mov dword [str._L__f], edx
xor ecx, ecx
movzx edx, word [esi]
movzx esi, dx
test dx, dx
mov dword [ebp - 0xc], edx
mov edx, 0x6a981350
mov dword [ebp - 8], esi
mov esi, dword [ebp - 4]
je 0x100053ce
mov ebx, eax
or ebx, 0xd2f53bf8
xor edx, edx
mov dword [0x1003f640], ebx
inc ecx
cmp word [esi + ecx*2], dx
jne 0x10005350
mov esi, dword [ebp - 8]
mov edx, 0x6a981350
jmp 0x1000537b
cmp esi, 0x4f2
jne 0x10005374
lea eax, [edi + 0x3aac1b18]
mov dword [0x1003f734], eax
imul edx, edx, 0xd01dafbe
inc esi
cmp esi, ecx
jb 0x10005361
mov edi, dword [ebp - 4]
xor esi, esi
mov ecx, edi
lea ecx, [ecx + 2]
sub edx, 0x4c068fb9
cmp word [ecx], si
jne 0x10005386
add eax, 0xfb195cad
mov dword [str._L__f], edx
mov ecx, esi
mov dword [0x1003f608], eax
inc ecx
cmp word [edi + ecx*2], si
jne 0x100053a6
cmp ecx, 0x156d
jb 0x100053d0
mov eax, dword [str._l8vc]
mov ecx, esi
mov esi, dword [0x1003f76c]
and eax, 0x7810893b
mov dword [0x1003f734], eax
jmp 0x100053ed
mov edi, esi
mov esi, dword [0x1003f76c]
lea eax, [esi - 0x78c82be7]
mov dword [0x1003f608], eax
xor eax, eax
mov ecx, eax
movzx eax, word [edi]
test ax, ax
je 0x10005418
mov eax, ebx
or eax, 0xa6525709
mov dword [str._l8vc], eax
xor eax, eax
inc ecx
cmp word [edi + ecx*2], ax
jne 0x100053fb
cmp ecx, 0xcb9
jbe 0x1000541a
sub esi, 0x6459364a
mov dword [0x1003f76c], esi
jmp 0x10005426
xor eax, eax
xor edx, 0x6d2f7c9f
mov dword [0x1003f608], edx
push 0xe
pop ecx
mov esi, str.Failed_to_extract_template.
lea edi, [ebp - 0x44]
mov edx, eax
mov eax, dword [ebp - 0xc]
rep movsd dword es:[edi], dword [esi]
cmp ax, word [ebp - 0x44]
jne 0x10005497
mov eax, dword [ebp - 8]
xor edi, edi
mov esi, dword [ebp - 4]
movzx ecx, ax
mov eax, edi
test cx, cx
je 0x10005466
cmp word [ebp + eax - 0x44], di
je 0x10005466
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x44]
je 0x1000544b
mov ecx, dword [ebp - 8]
cmp ecx, edx
jae 0x10005497
mov esi, dword [0x1003f76c]
cmp ecx, 0x18d5
jne 0x10005487
imul ebx, esi, 0xb305a16
mov dword [0x1003f640], ebx
inc ecx
lea eax, [ebx - 0x5fed3f19]
mov dword [0x1003f608], eax
cmp ecx, edx
jb 0x10005473
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100055a2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1003f59c]
sub esp, 0x18
or edx, 0xbf7bff9e
xor eax, eax
mov ecx, eax
push ebx
push esi
push edi
lea esi, [edx - 0x5b7c961a]
inc ecx
cmp byte [ecx + str.3_424c4j4], al
jne 0x100055c1
mov edi, dword [ebp - 4]
cmp edi, ecx
jae 0x100055f9
mov ebx, esi
mov dword [ebp - 4], esi
cmp edi, 0x6a7
jne 0x100055e9
mov ebx, dword [ebp - 4]
mov edx, esi
and edx, 0xf890ace9
imul esi, ebx, 0x8357c6ae
inc edi
mov dword [ebp - 4], esi
mov ebx, esi
cmp edi, ecx
jb 0x100055d6
and edx, 0xd27a1e4a
mov ecx, eax
lea ebx, [edx - 0x55402d64]
mov dword [0x1003f5a4], ebx
inc ecx
cmp word [ecx*2 + str.zdnet.com], ax
jne 0x1000560d
cmp ecx, 0x1733
jne 0x10005628
and edx, 0x84662672
jmp 0x10005636
mov ebx, edx
and ebx, 0x93b5ccb8
mov dword [0x1003f5a4], ebx
mov esi, str.sharebuilder.com
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x51
jne 0x10005663
mov cl, 0x51
test cl, cl
je 0x10005663
cmp byte [ebp + eax - 0x18], 0
je 0x10005663
mov cl, byte [eax + 0x10034c3d]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x1000564b
movzx ecx, byte [eax + str.QeFbFTiKwZ]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
cmp ecx, 0xde9
jae 0x10005689
mov ebx, edx
xor ebx, 0x653e8cc5
mov dword [0x1003f5a4], ebx
jmp 0x10005691
mov edx, ebx
and edx, 0xf9402fc
mov esi, str.bad_height_format
lea edi, [ebp - 0x18]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x18], 0x63
jne 0x100056c1
mov cl, 0x63
test cl, cl
je 0x100056c1
cmp byte [ebp + eax - 0x18], 0
je 0x100056c1
mov cl, byte [eax + 0x100351b1]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x100056a9
movzx ecx, byte [eax + str.codeproject.com]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
cmp ecx, 0xc37
je 0x100056e3
imul ebx, edx, 0xbd8fa287
mov dword [0x1003f5a4], ebx
mov eax, ebx
and eax, 0x504096d0
xor ecx, ecx
imul eax, eax, 0xa23a5275
inc ecx
cmp byte [ecx + str.._AVwxImageHandler__], 0
jne 0x100056ec
mov edx, dword [ebp - 4]
mov dword [0x1003f59c], eax
cmp edx, ecx
jae 0x1000572c
cmp edx, 0xb75
jne 0x1000571c
lea ebx, [eax - 0x5db789c4]
mov dword [0x1003f5a4], ebx
imul eax, ebx, 0x93b0cf9d
inc edx
cmp edx, ecx
jb 0x10005708
mov dword [0x1003f59c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005a42
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, edx
mov dword [ebp - 0xc], ecx
xor edx, edx
push esi
mov esi, dword [0x1003f6c4]
mov eax, edx
or esi, 0x1f6e7963
inc eax
cmp byte [eax + str.._AVwxWindowsPrintDialog__], dl
jne 0x10005a59
push edi
push 8
mov eax, ebx
lea edi, [ebp - 0x2c]
or eax, 0xed07527f
mov esi, str.4_565H5_5j5v55
mov dword [0x1003f6c4], eax
mov eax, ebx
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xc]
and eax, 0x41059350
mov dword [0x1003f660], eax
or eax, 0xbc4d36f2
mov dword [ebp - 8], eax
mov eax, edx
movzx ecx, word [edi]
cmp cx, word [ebp - 0x2c]
jne 0x10005af8
mov esi, ecx
mov ecx, edx
test si, si
je 0x10005ac3
cmp word [ebp + ecx - 0x2c], dx
je 0x10005ac3
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + edi]
cmp si, word [ebp + ecx - 0x2c]
je 0x10005aa8
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp ecx, eax
jae 0x10005af8
lea esi, [ebx - 0x2c380c23]
mov dword [ebp - 8], esi
mov esi, dword [0x1003f6c4]
cmp ecx, 0x1b2d
jne 0x10005af3
mov eax, esi
xor eax, 0x9acaf4db
mov dword [0x1003f660], eax
mov eax, dword [ebp - 4]
inc ecx
cmp ecx, eax
jb 0x10005adc
push 7
pop ecx
mov esi, str.s3_website_eu_west_1.amazonaws
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov eax, edx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x2c], 0x2e
pop edi
jne 0x10005b2a
mov cl, 0x2e
test cl, cl
je 0x10005b2a
cmp byte [ebp + eax - 0x2c], dl
je 0x10005b2a
mov cl, byte [eax + 0x100349a1]
inc eax
cmp cl, byte [ebp + eax - 0x2c]
je 0x10005b13
movzx ecx, byte [eax + str.._AVwxWindowsPrintDialog__]
movzx eax, byte [ebp + eax - 0x2c]
sub ecx, eax
cmp ecx, 0x1d94
jbe 0x10005b48
imul eax, ebx, 0x22557e0b
jmp 0x10005b50
mov eax, dword [ebp - 8]
add eax, 0x47eb0c0a
or ebx, 0xfa2f5170
mov dword [0x1003f6d0], ebx
inc edx
cmp byte [edx + str.._AVwxWindowsPrintDialog__], 0
jne 0x10005b5c
mov ecx, eax
add eax, 0x98bda2aa
xor ecx, 0xabbb513e
cmp edx, 0x7c5
pop esi
cmovne eax, ecx
mov dword [0x1003f590], eax
mov eax, ebx
pop ebx
leave
ret
Function at 0x10005b87
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
imul eax, dword [0x1003f760], 0x7a477c
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], ecx
or eax, 0xfcb69cea
lea edi, [ebp - 0x1c]
mov dword [0x1003f5e8], eax
mov esi, str.quora.com
mov al, byte [ecx]
mov byte [ebp - 1], al
xor eax, eax
push 5
mov edx, eax
movzx eax, word [ebx]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
cmp ax, word [ebp - 0x1c]
jne 0x10005be9
xor esi, esi
mov eax, esi
test cx, cx
je 0x10005be9
cmp word [ebp + eax - 0x1c], si
je 0x10005be9
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + ebx]
cmp cx, word [ebp + eax - 0x1c]
je 0x10005bce
movzx ecx, byte [ebx + edx*2]
movzx eax, byte [ebp + edx*2 - 0x1c]
sub ecx, eax
cmp ecx, 0x1be4
mov ecx, dword [ebp + 8]
jb 0x10005c0a
lea eax, [ecx - 0x7ea353cb]
mov dword [0x1003f5e8], eax
xor ebx, ebx
imul edx, ecx, 0xef29c2a7
mov eax, ebx
inc eax
cmp byte [eax + str.GdipFillPolygon2I], bl
jne 0x10005c14
cmp eax, 0x815
ja 0x10005c30
xor edx, 0xc0688ae3
mov dword [0x1003f5e8], edx
mov esi, dword [ebp + 0xc]
mov eax, esi
and eax, 0xba5ec87c
mov dword [0x1003f784], eax
imul eax, ecx, 0xdc4951ef
mov dword [0x1003f690], eax
mov eax, ebx
cmp byte [ebp - 1], al
je 0x10005c7a
mov edi, dword [ebp - 8]
mov edx, esi
and edx, 0xf641a0e2
mov dword [0x1003f5e8], edx
inc eax
cmp byte [eax + edi], bl
jne 0x10005c62
cmp eax, 0xc8f
jbe 0x10005c7a
lea eax, [edx - 0x7363b544]
mov dword [0x1003f784], eax
mov eax, ebx
inc eax
cmp byte [eax + str.unknown_database:__s], bl
jne 0x10005c7c
cmp eax, 0xff5
jne 0x10005c97
lea eax, [esi - 0x7c9867fa]
mov dword [0x1003f5e8], eax
lea eax, [ecx + 0x7e3438c8]
mov edx, ebx
mov dword [0x1003f760], eax
inc edx
cmp word [edx*2 + str.GdipSetCustomLineCapBaseInset], bx
jne 0x10005ca4
pop edi
pop esi
pop ebx
cmp dword [ebp + 8], edx
jae 0x10005cc3
mov eax, ecx
and eax, 0x3e0bd80c
mov dword [0x1003f690], eax
or ecx, 0xba185d02
mov dword [0x1003f6cc], ecx
leave
ret

Function at 0x10005e5f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
movzx eax, word [eax]
lea edi, [ebp - 0x40]
mov ecx, eax
mov ebx, edx
mov dword [ebp - 8], ecx
mov esi, str.._AVGdiplusBase_Gdiplus__
xor ecx, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
xor edx, 0x525fbd31
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
cmp ax, word [ebp - 0x40]
jne 0x10005ec3
xor edi, edi
movzx ecx, ax
mov eax, edi
mov ebx, edi
test cx, cx
je 0x10005ebd
cmp word [ebp + eax - 0x40], di
je 0x10005ebd
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x40]
je 0x10005ea2
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx ecx, byte [esi + eax*2]
movzx eax, byte [ebp + eax*2 - 0x40]
sub ecx, eax
cmp ecx, 0x3a
jne 0x10005ede
imul edx, ebx, 0x384c5ab5
jmp 0x10005ee4
xor edx, 0x1c3d7c49
lea ecx, [ebx + 0x20ff5333]
mov dword [0x1003f750], edx
pop edi
and ebx, 0x84924261
mov dword [0x1003f668], ecx
pop esi
mov dword [0x1003f5e4], ebx
mov eax, edx
pop ebx
leave
ret
Function at 0x100063aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [0x1003f738]
mov eax, dword [0x1003f684]
push ebx
xor ebx, ebx
add eax, 0xc36ae702
push esi
lea esi, [edx + 0x4068f1e8]
mov dword [ebp - 4], eax
mov ecx, ebx
inc ecx
cmp word [ecx*2 + str._password_manager_enabled], bx
jne 0x100063cf
cmp ecx, 0xc59
jne 0x100063ea
or edx, 0xfb720a78
jmp 0x100063f0
imul edx, eax, 0xc89cf3f1
mov ecx, ebx
inc ecx
cmp byte [ecx + str.CoCreateInstance], bl
jne 0x100063f2
cmp ecx, 0xbf8
ja 0x10006409
imul edx, esi, 0xcc9ee9
mov esi, ebx
lea ecx, [eax + 0x43bdb702]
and ecx, 0xa68fc044
inc esi
cmp byte [esi + str.CoCreateInstance], bl
jne 0x10006411
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
cmp ecx, esi
jae 0x10006446
cmp ecx, 0x33f
jne 0x10006439
mov eax, edx
and eax, 0x338bd325
or eax, 0xacfabfe6
inc ecx
cmp ecx, esi
jb 0x1000642a
mov dword [ebp - 4], eax
push edi
mov esi, str.bad_conversion
lea edi, [ebp - 0x18]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x35
jne 0x10006476
mov cl, 0x35
test cl, cl
je 0x10006476
cmp byte [ebp + eax - 0x18], bl
je 0x10006476
mov cl, byte [eax + 0x10034985]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x1000645f
movzx ecx, byte [eax + str.5tEXtComment]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
mov eax, dword [ebp - 8]
cmp ecx, 0x1828
jb 0x10006494
or eax, 0x5cdbf971
mov esi, ebx
inc esi
cmp byte [esi + str.nespresso.com], bl
jne 0x10006496
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp edi, esi
jae 0x100064c0
cmp edi, 0x1e2e
jne 0x100064b7
lea edx, [ecx + 0x2a9e59ef]
sub edx, 0x1e613fb0
inc edi
jmp 0x100064a5
pop edi
xor eax, 0x3e1bf798
inc ebx
cmp byte [ebx + str.SQLite_format_3], 0
jne 0x100064c1
pop esi
cmp ebx, 0xdc1
pop ebx
jbe 0x100064e2
imul edx, ecx, 0x5577ebc8
jmp 0x100064e8
or edx, 0x21450cd2
add ecx, 0xa63a9c5e
mov dword [0x1003f738], edx
mov dword [0x1003f58c], ecx
lea eax, [ecx - 0xa2eeba0]
mov dword [0x1003f684], eax
lea eax, [ecx - 0x7b292c75]
mov dword [0x1003f630], eax
leave
ret
Function at 0x10006a9d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x10033d20
and edi, 0x2fe60a6c
mov dword [ebp - 4], ecx
mov dword [0x1003f5bc], edi
xor edx, edx
push 8
pop ecx
lea edi, [ebp - 0x38]
mov eax, edx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
movzx esi, word [edi]
cmp si, word [ebp - 0x38]
jne 0x10006b0d
mov ebx, dword [ebp - 4]
mov edi, esi
mov ecx, edx
test di, di
je 0x10006af7
cmp word [ebp + ecx - 0x38], dx
je 0x10006af7
inc eax
lea ecx, [eax + eax]
movzx edi, word [ecx + ebx]
cmp di, word [ebp + ecx - 0x38]
je 0x10006adc
mov edi, ebx
cmp dword [ebp + 8], eax
jae 0x10006b0d
sub eax, dword [ebp + 8]
imul eax, eax, 0x38805579
add dword [0x1003f5bc], eax
mov ecx, dword [ebp + 8]
imul eax, ecx, 0x7211c3a1
mov dword [0x1003f61c], eax
mov eax, edx
test si, si
je 0x10006bbb
mov ebx, ecx
xor ebx, 0x2b5b35f
mov dword [0x1003f5e0], ebx
inc eax
cmp word [edi + eax*2], dx
jne 0x10006b34
cmp eax, 0x18f0
jb 0x10006bbb
push 0x10
pop ecx
mov esi, str.registry_hives_cant_be_renamed
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
mov eax, edx
movzx esi, word [edi]
cmp si, word [ebp - 0x58]
jne 0x10006bf8
mov ecx, edx
test si, si
je 0x10006b7e
cmp word [ebp + ecx - 0x58], dx
je 0x10006b7e
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + edi]
cmp si, word [ebp + ecx - 0x58]
je 0x10006b63
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp ecx, eax
jae 0x10006bf8
mov esi, dword [0x1003f61c]
mov edi, dword [ebp + 8]
cmp ecx, 0x7c9
jne 0x10006ba8
mov eax, edi
or eax, 0x121efc9e
mov dword [0x1003f5bc], eax
mov eax, dword [ebp - 8]
or esi, 0x26e47cac
inc ecx
cmp ecx, eax
jb 0x10006b91
mov dword [0x1003f61c], esi
jmp 0x10006bf8
lea ebx, [ecx + 0x1e39de0c]
mov eax, edx
mov dword [0x1003f5e0], ebx
inc eax
cmp word [eax*2 + str.REG_NOMATCH], dx
jne 0x10006bc9
cmp eax, 0xa68
jae 0x10006bed
imul ebx, dword [0x1003f5bc], 0xefe605f8
mov dword [0x1003f5e0], ebx
jmp 0x10006bf8
lea eax, [ecx - 0x2994e1ac]
mov dword [0x1003f5bc], eax
mov esi, str.m_freezeCount
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x18], 0x73
jne 0x10006c25
mov al, 0x73
test al, al
je 0x10006c25
cmp byte [ebp + edx - 0x18], 0
je 0x10006c25
mov al, byte [edx + 0x100346a5]
inc edx
cmp al, byte [ebp + edx - 0x18]
je 0x10006c0d
movzx ecx, byte [edx + str.siluninstall]
movzx eax, byte [ebp + edx - 0x18]
sub ecx, eax
cmp ecx, 0x120a
jae 0x10006c43
and ebx, 0x807330d5
jmp 0x10006c49
imul ebx, ebx, 0xf707e17f
imul eax, dword [0x1003f61c], 0xe72d00c5
pop edi
pop esi
mov dword [0x1003f740], ebx
pop ebx
mov dword [0x1003f764], eax
leave
ret
Function at 0x1000d5fa
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1003f95c]
sub esp, 0x30
xor edx, 0x9def502a
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov ecx, esi
movzx eax, word [ebx]
test ax, ax
je 0x1000d63e
mov eax, dword [0x1003f9ac]
or eax, 0xa2c25fce
inc ecx
cmp word [ebx + ecx*2], si
jne 0x1000d621
cmp ecx, 0x8b5
jb 0x1000d63b
lea edx, [eax + 0x52351354]
movzx eax, word [ebx]
mov ecx, str.GetPasswordsCR___:_Skipping_cuz_CR_is_not_installed
and edx, 0xbfad4568
inc ecx
cmp byte [ecx], 0
jne 0x1000d643
imul ecx, edx, 0x3cc2109c
mov esi, str.818A8R8_8d8j8q8v88
push edi
push 0xa
lea edi, [ebp - 0x30]
mov dword [0x1003f95c], edx
mov dword [ebp - 8], ecx
pop ecx
rep movsd dword es:[edi], dword [esi]
xor edi, edi
cmp ax, word [ebp - 0x30]
jne 0x1000d6be
movzx esi, ax
mov eax, edi
mov ecx, edi
test si, si
je 0x1000d696
cmp word [ebp + eax - 0x30], di
je 0x1000d696
inc ecx
lea eax, [ecx + ecx]
movzx esi, word [eax + ebx]
cmp si, word [ebp + eax - 0x30]
je 0x1000d67b
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1000d6be
mov esi, dword [ebp - 8]
cmp eax, 0x264d
jne 0x1000d6b3
lea edx, [esi + 0x33310a0c]
mov dword [0x1003f95c], edx
imul esi, esi, 0x38bc07ab
inc eax
cmp eax, ecx
jb 0x1000d6a0
movzx ecx, word [ebx]
mov eax, edi
test cx, cx
je 0x1000d6f3
xor edx, 0x13b31dc0
inc eax
mov ecx, edx
mov dword [0x1003f95c], edx
cmp word [ebx + eax*2], di
jne 0x1000d6c8
cmp dword [ebp - 8], eax
jae 0x1000d6f3
sub eax, dword [ebp - 8]
imul edx, eax, 0x4b283189
add edx, ecx
mov dword [0x1003f95c], edx
mov eax, edi
mov esi, str.lastpass.log
push 6
pop ecx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [ebx]
movsw word es:[edi], word [esi]
cmp cx, word [ebp - 0x24]
jne 0x1000d754
mov edi, ecx
xor esi, esi
xor ecx, ecx
test di, di
je 0x1000d72e
cmp word [ebp + esi - 0x24], cx
je 0x1000d72e
inc eax
lea esi, [eax + eax]
movzx edi, word [esi + ebx]
cmp di, word [ebp + esi - 0x24]
je 0x1000d713
movzx ecx, word [ebx]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 4]
jmp 0x1000d750
cmp eax, 0x703
jne 0x1000d74f
or edx, 0xc7ca9799
mov dword [0x1003f95c], edx
inc eax
cmp eax, esi
jb 0x1000d73c
lea eax, [edx - 0x762866c7]
mov dword [0x1003f9ac], eax
pop edi
test cx, cx
je 0x1000d77b
xor eax, eax
lea ebx, [ebx + 2]
add edx, 0x6fb713df
cmp word [ebx], ax
jne 0x1000d767
mov dword [0x1003f95c], edx
pop esi
pop ebx
leave
ret