joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001ceb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1003eb14]
sub esp, 0x6c
or dword [0x1003ea34], 0xb63d18f3
add eax, 0xce36931
mov edx, dword [0x1003eb18]
mov dword [0x1003ea3c], eax
push ebx
xor ebx, ebx
push esi
mov ecx, ebx
add edx, 0x620b4473
inc ecx
cmp word [ecx*2 + str.threeideographicparen], bx
jne 0x10001d16
mov dword [0x1003eb18], edx
cmp ecx, 0xafc
jbe 0x10001d41
or eax, 0x46a26f16
mov dword [0x1003ea34], eax
jmp 0x10001d4b
xor eax, 0x6e858239
mov dword [0x1003eb24], eax
push edi
push str.Call_register_cbk.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 8
pop ecx
mov esi, str.PasswordManager
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
push 0x74
mov edx, ebx
xor esi, esi
pop ebx
cmp bx, word [ebp - 0x24]
jne 0x10001da8
mov ecx, ebx
mov eax, esi
test cx, cx
je 0x10001d93
cmp word [ebp + eax - 0x24], si
je 0x10001d93
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.threeideographicparen]
cmp cx, word [ebp + eax - 0x24]
je 0x10001d75
mov eax, dword [0x1003eb24]
mov ecx, 0x224a23c8
cmp dword [ebp - 4], edx
cmovb eax, ecx
mov dword [0x1003eb24], eax
mov edx, dword [0x1003ea34]
lea edi, [ebp - 0x6c]
imul eax, edx, 0x1ed408ed
push 0x11
pop ecx
mov dword [0x1003ea3c], eax
mov eax, esi
mov esi, str.Received_HTTP_0.9_when_not_allowed
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
cmp bx, word [ebp - 0x6c]
jne 0x10001e2b
mov esi, ebx
mov ecx, edi
test si, si
je 0x10001df4
cmp word [ebp + ecx - 0x6c], di
je 0x10001df4
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.threeideographicparen]
cmp si, word [ebp + ecx - 0x6c]
je 0x10001dd6
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, eax
jae 0x10001e2b
mov esi, dword [0x1003ea3c]
mov edx, 0xce0387c3
mov dword [0x1003ea34], edx
cmp ecx, 0x17a8
jne 0x10001e26
mov eax, esi
and eax, 0xa22cbb6b
mov dword [0x1003eb24], eax
mov eax, dword [ebp - 4]
inc ecx
cmp ecx, eax
jb 0x10001e0f
mov eax, dword [0x1003eb14]
mov ecx, edi
or eax, 0x496908ae
mov dword [0x1003eb18], eax
inc ecx
cmp byte [ecx + str.._AVSWUAdapterImpl__], 0
jne 0x10001e3c
mov esi, dword [ebp - 4]
jmp 0x10001e60
cmp esi, 0x1ffd
jne 0x10001e5f
mov eax, edx
and eax, 0xf728edcc
mov dword [0x1003eb24], eax
inc esi
cmp esi, ecx
jb 0x10001e4b
mov eax, edi
mov esi, str.decyrillic
push 5
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
cmp bx, word [ebp - 0x1c]
jne 0x10001e9e
xor esi, esi
mov ecx, esi
test bx, bx
je 0x10001e9e
cmp word [ebp + ecx - 0x1c], si
je 0x10001e9e
inc eax
lea ecx, [eax + eax]
movzx ebx, word [ecx + str.threeideographicparen]
cmp bx, word [ebp + ecx - 0x1c]
je 0x10001e80
movzx ecx, byte [eax*2 + str.threeideographicparen]
movzx eax, byte [ebp + eax*2 - 0x1c]
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0xa8a
jae 0x10001ebf
and edx, 0x3aedc9c6
jmp 0x10001ec4
mov edx, 0xaf3fffff
mov dword [0x1003eb14], edx
mov eax, edx
leave
ret
Function at 0x1000218d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1003ead8]
sub esp, 0x1c
or edx, 0x7277a372
mov eax, str.pj.ihcok.onustihsagih
xor edx, 0xbf584960
push ebx
xor ebx, ebx
lea eax, [eax + 2]
add edx, 0xe2f8e9c2
cmp word [eax], bx
jne 0x100021ad
mov eax, ebx
xor edx, 0x84bd8e04
inc eax
cmp byte [eax + str..customize], bl
jne 0x100021bd
cmp eax, 0x1066
jbe 0x100021db
imul edx, edx, 0x86ada4dd
jmp 0x100021e1
and edx, 0xfb856d4e
mov eax, 0x1002e490
imul edx, edx, 0xc3cf8599
inc eax
cmp byte [eax], bl
jne 0x100021e6
mov dword [0x1003ead8], edx
mov eax, ebx
add edx, 0x9af72331
inc eax
cmp byte [eax + str.zdotbelow], bl
jne 0x100021f9
mov dword [0x1003ead8], edx
cmp eax, 0x19cb
jne 0x1000221d
xor edx, 0x897d3f24
jmp 0x10002223
imul edx, edx, 0xf9023f65
push esi
push edi
push 5
pop ecx
mov esi, str.pCAL:_invalid_keyword
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
or edx, 0x24f32ca4
mov eax, ebx
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x1c], 0x50
jne 0x10002279
mov cl, 0x50
test cl, cl
je 0x1000225b
cmp byte [ebp + eax - 0x1c], bl
je 0x1000225b
mov cl, byte [eax + 0x1002e251]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x10002244
mov ecx, dword [ebp - 4]
jmp 0x10002275
cmp ecx, 0xfbf
jne 0x1000226e
add edx, 0x4a7ed0f5
and edx, 0x3120ff14
inc ecx
cmp ecx, eax
jb 0x10002260
mov esi, ebx
xor edx, 0xed9525f9
xor edx, 0xab44edde
inc esi
cmp byte [esi + 0x1002e8a0], bl
jne 0x10002281
mov eax, edx
lea edi, [ebp - 0x1c]
and edx, 0xa4f2b061
xor eax, 0x28965c85
cmp esi, 0x43c
mov esi, str.yakatakanahalfwidth
push 5
cmovbe edx, eax
mov eax, ebx
xor edx, 0xb4d0437f
pop ecx
imul edx, edx, 0x71ee2b76
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x1c], 0x70
jne 0x100022fe
mov cl, 0x70
test cl, cl
je 0x100022e0
cmp byte [ebp + eax - 0x1c], bl
je 0x100022e0
mov cl, byte [eax + 0x1002e771]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x100022c9
mov ecx, dword [ebp - 4]
jmp 0x100022fa
cmp ecx, 0x26c3
jne 0x100022f3
imul edx, edx, 0xd7e12c23
imul edx, edx, 0x30ac8e49
inc ecx
cmp ecx, eax
jb 0x100022e5
mov esi, str.pj.ufig.atagatik
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x2e
pop edi
pop esi
jne 0x1000232d
mov al, 0x2e
test al, al
je 0x1000232d
cmp byte [ebp + ebx - 0x18], 0
je 0x1000232d
mov al, byte [ebx + 0x1002eb61]
inc ebx
cmp al, byte [ebp + ebx - 0x18]
je 0x10002315
movzx ecx, byte [ebx + str..customize]
movzx eax, byte [ebp + ebx - 0x18]
sub ecx, eax
pop ebx
cmp ecx, 0xf6f
jae 0x1000234c
and edx, 0x4285b551
jmp 0x10002352
xor edx, 0xe60195b2
mov dword [0x1003ead8], edx
mov eax, edx
leave
ret
Function at 0x10004563
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
lea ebx, [edx + 0x362ba93b]
mov dword [ebp - 0x10], edx
mov eax, ebx
xor eax, 0x2001ee22
mov dword [0x1003ec40], eax
mov eax, dword [ebp + 8]
push esi
movzx ecx, word [eax]
movzx esi, cx
mov dword [ebp - 0xc], esi
xor esi, esi
mov dword [ebp - 8], ecx
test cx, cx
je 0x100045a4
lea eax, [eax + 2]
xor ebx, 0x11c40c1a
cmp word [eax], si
jne 0x10004596
push edi
mov eax, esi
lea edi, [ebp - 0x30]
push 8
pop ecx
mov esi, 0x1002ebf8
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp + 8]
cmp cx, word [ebp - 0x30]
jne 0x100045f0
mov eax, dword [ebp - 0xc]
xor edi, edi
movzx ecx, ax
mov eax, edi
mov edx, edi
test cx, cx
je 0x100045e7
cmp word [ebp + eax - 0x30], di
je 0x100045e7
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x30]
je 0x100045cc
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
movzx ecx, byte [esi + eax*2]
movzx eax, byte [ebp + eax*2 - 0x30]
sub ecx, eax
pop edi
cmp ecx, 0x1f93
jne 0x1000460c
and edx, 0xbbb7915b
jmp 0x10004618
mov edx, dword [0x1003ec40]
add edx, 0xea6e0f93
or ebx, 0x9ae23b57
mov dword [0x1003ed14], edx
pop esi
mov dword [0x1003ecec], ebx
mov eax, edx
pop ebx
leave
ret
Function at 0x1000e646
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1003ee38]
sub esp, 0x7c
add edx, 0x70b675e3
mov eax, str.Offers.ini
add edx, 0xac2a53b2
inc eax
cmp byte [eax], 0
jne 0x1000e65d
push ebx
push esi
push edi
push 0x18
pop ecx
mov ebx, dword [0x1003ee00]
lea edi, [ebp - 0x7c]
mov esi, str.._AVStoreWindow_impl_windows_edge_renderer_asw__
and ebx, 0x26a0bd40
rep movsd dword es:[edi], dword [esi]
push 0x41
xor eax, eax
movsw word es:[edi], word [esi]
pop esi
xor edi, edi
cmp si, word [ebp - 0x7c]
jne 0x1000e6b4
mov ecx, edi
test si, si
je 0x1000e6b4
cmp word [ebp + ecx - 0x7c], di
je 0x1000e6b4
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.AswWinNLMMonitor.DetectNLMChanges.Merge.fail__code:0x_x_]
cmp si, word [ebp + ecx - 0x7c]
je 0x1000e696
movzx ecx, byte [eax*2 + str.AswWinNLMMonitor.DetectNLMChanges.Merge.fail__code:0x_x_]
movzx eax, byte [ebp + eax*2 - 0x7c]
sub ecx, eax
cmp ecx, 0x429
jbe 0x1000e6d3
lea ebx, [edx + 0x7c24fbd9]
jmp 0x1000e6d9
and edx, 0x47d105c5
mov eax, edi
mov esi, str.on.arkua
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x32
jne 0x1000e713
mov cl, 0x32
test cl, cl
je 0x1000e706
cmp byte [ebp + eax - 0x10], 0
je 0x1000e706
mov cl, byte [eax + 0x10032701]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0x1000e6ee
cmp dword [ebp - 4], eax
jae 0x1000e713
mov edx, ebx
or edx, 0x2a9c708d
xor ebx, ebx
lea esi, [edx - 0x1d6b9b90]
mov eax, ebx
add edx, 0xcde96064
inc eax
cmp word [eax*2 + str.AswWinNLMMonitor.DetectNLMChanges.Merge.fail__code:0x_x_], bx
jne 0x1000e71d
mov ecx, edx
cmp dword [ebp - 4], eax
jae 0x1000e73d
lea edx, [esi - 0x5dc6a1a8]
mov ecx, edx
imul eax, ecx, 0xd286df3c
mov ecx, ebx
imul edx, edx, 0x7db700eb
inc ecx
cmp byte [ecx + str.Offers.ini], bl
jne 0x1000e745
cmp ecx, 0x1370
jbe 0x1000e766
mov edx, eax
and edx, 0x8b1b3877
jmp 0x1000e76c
lea eax, [edx - 0x991e55d]
or edx, 0xa597bbfd
mov ecx, str.gro.ue.ten
sub edx, 0x1102538b
lea ecx, [ecx + 2]
add eax, 0x5cdb64ee
cmp word [ecx], bx
jne 0x1000e77d
mov esi, str.OpenType
lea edi, [ebp - 0x18]
push 0x61
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
xor edi, edi
cmp si, word [ebp - 0x18]
jne 0x1000e7e0
mov ecx, edi
test si, si
je 0x1000e7c3
cmp word [ebp + ecx - 0x18], di
je 0x1000e7c3
inc ebx
lea ecx, [ebx + ebx]
movzx esi, word [ecx + str.analysed]
cmp si, word [ebp + ecx - 0x18]
je 0x1000e7a5
mov ecx, dword [ebp - 4]
jmp 0x1000e7dc
cmp ecx, 0x2b2
jne 0x1000e7d5
or eax, 0x359a7db6
imul edx, edx, 0xdd492523
inc ecx
cmp ecx, ebx
jb 0x1000e7c8
and eax, 0x4416000
mov ecx, edi
mov dword [0x1003ee38], eax
inc ecx
cmp word [ecx*2 + str.gro.ue.ten], di
jne 0x1000e7ec
pop edi
pop esi
pop ebx
cmp ecx, 0xe9f
je 0x1000e80c
xor eax, 0xcf8b4e3f
mov dword [0x1003ee38], eax
add eax, 0x29a60447
mov dword [0x1003ee00], eax
leave
ret
Function at 0x1000eb34
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x1003ee78]
mov eax, str.pj.ikarabi.oyihcay
xor ecx, 0x45a53dd8
inc eax
cmp byte [eax], 0
jne 0x1000eb3f
mov ecx, dword [0x1003ee68]
xor ecx, 0x131330
or ecx, 0xeda8cc88
lea eax, [ecx - 0x6e9bee4f]
and ecx, 0x5a7b16f3
mov dword [0x1003ee78], eax
mov dword [0x1003ee5c], ecx
ret

Function at 0x1000eb75
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 7
mov dword [ebp - 4], ecx
lea edi, [ebp - 0x38]
pop ecx
mov esi, str.product.groups
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x69
pop edx
mov ebx, eax
movsw word es:[edi], word [esi]
cmp dx, word [ebp - 0x38]
jne 0x1000ebbf
xor esi, esi
test dx, dx
je 0x1000ebbd
cmp word [ebp + eax - 0x38], si
je 0x1000ebbd
inc ebx
lea eax, [ebx + ebx]
movzx edx, word [eax + str.integral]
cmp dx, word [ebp + eax - 0x38]
je 0x1000eb9f
xor eax, eax
push 0xb
pop ecx
mov esi, str.NtQueryInformationFile
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
push 0x52
pop edx
mov ebx, eax
movsw word es:[edi], word [esi]
cmp dx, word [ebp - 0x48]
jne 0x1000ebfd
mov ecx, edx
xor esi, esi
test cx, cx
je 0x1000ebfb
cmp word [ebp + eax - 0x48], si
je 0x1000ebfb
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.RemainingBatteryPercentage]
cmp cx, word [ebp + eax - 0x48]
je 0x1000ebdd
xor eax, eax
mov esi, str.zib.erom_rof
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x61
jne 0x1000ec29
mov cl, 0x61
test cl, cl
je 0x1000ec29
cmp byte [ebp + eax - 0x18], 0
je 0x1000ec29
mov cl, byte [eax + 0x10032b39]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x1000ec11
xor ecx, ecx
mov eax, ecx
inc eax
cmp byte [eax + str.ais_cmp_hds], cl
jne 0x1000ec2d
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x48]
mov ebx, ecx
mov esi, str.Shuffling__i_addresses
push 0xb
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, 0x64bfa7ac
mov dword [0x1003edf8], eax
movsw word es:[edi], word [esi]
cmp dx, word [ebp - 0x48]
jne 0x1000ec7c
xor esi, esi
mov eax, esi
test dx, dx
je 0x1000ec7c
cmp word [ebp + eax - 0x48], si
je 0x1000ec7c
inc ebx
lea eax, [ebx + ebx]
movzx edx, word [eax + str.RemainingBatteryPercentage]
cmp dx, word [ebp + eax - 0x48]
je 0x1000ec5e
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x60]
push 0x12
pop ecx
mov esi, str.avdef:__config_ipm_tracker_elements
and eax, 0x4c3ae093
rep movsd dword es:[edi], dword [esi]
push 0x6f
xor ebx, ebx
mov dword [0x1003ee3c], eax
pop ecx
mov edx, ebx
cmp cx, word [ebp - 0x60]
jne 0x1000ecc3
mov eax, ebx
test cx, cx
je 0x1000ecc3
cmp word [ebp + eax - 0x60], bx
je 0x1000ecc3
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.orea.licnuoc]
cmp cx, word [ebp + eax - 0x60]
je 0x1000eca5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000ee69
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x14], edx
mov edx, ecx
push esi
movzx eax, word [eax]
mov dword [ebp - 0xc], edx
mov ecx, eax
mov dword [ebp - 0x10], ecx
push edi
test ax, ax
je 0x1000ee92
imul ebx, edx, 0x47095a03
jmp 0x1000ee98
mov ebx, dword [0x1003ee60]
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov esi, edi
movzx eax, word [ecx]
test ax, ax
je 0x1000eee5
lea eax, [edx - 0x34f2cafe]
mov dword [ebp - 8], eax
inc esi
cmp word [ecx + esi*2], di
jne 0x1000eeb0
mov ecx, dword [ebp + 0xc]
cmp ecx, esi
jae 0x1000eeed
mov ebx, dword [0x1003ee64]
add ebx, 0x16ae7ce7
cmp ecx, 0xf18
jne 0x1000eede
mov eax, edx
and eax, 0x98f2caba
mov dword [0x1003ee08], eax
inc ecx
cmp ecx, esi
jb 0x1000eeca
jmp 0x1000eeed
mov eax, dword [0x1003edcc]
mov dword [ebp - 8], eax
mov eax, dword [0x1003ee08]
mov esi, str.pj.atagamay.azuy
and eax, 0xd19bcbb3
mov dword [0x1003ee64], eax
lea eax, [edx - 0x26aa6b30]
mov dword [0x1003ee08], eax
mov eax, edi
push 8
pop ecx
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp + 8]
movzx ecx, word [edi]
cmp cx, word [ebp - 0x38]
jne 0x1000ef85
mov ecx, dword [ebp - 0x10]
movzx esi, cx
xor ecx, ecx
xor edx, edx
test si, si
je 0x1000ef49
cmp word [ebp + ecx - 0x38], dx
je 0x1000ef49
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + edi]
cmp si, word [ebp + ecx - 0x38]
je 0x1000ef2e
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp ecx, eax
jae 0x1000ef85
mov eax, dword [0x1003ee64]
mov esi, dword [ebp - 4]
cmp ecx, 0x97
jne 0x1000ef76
imul eax, edx, 0x9a1664db
mov dword [0x1003ee08], eax
mov eax, dword [0x1003ee64]
add eax, 0x3ce21bd0
inc ecx
mov dword [0x1003ee64], eax
cmp ecx, esi
jb 0x1000ef5e
mov esi, dword [ebp - 0x14]
xor edi, edi
mov ecx, edi
cmp word [esi], di
je 0x1000efb2
mov ebx, edx
xor ebx, 0x83ecbf8b
inc ecx
cmp word [esi + ecx*2], di
jne 0x1000ef99
cmp ecx, 0x1694
jb 0x1000efb2
mov ebx, edx
or ebx, 0x3d202b88
jmp 0x1000efbf
mov eax, dword [ebp - 8]
add eax, 0x916b0001
mov dword [0x1003ee64], eax
imul ecx, ebx, 0x63a2db42
lea edi, [ebp - 0x44]
push 0xc
mov esi, str.NumberOfMisusedLicenses
mov ebx, edx
or ebx, 0xa4311f1b
mov dword [0x1003ee58], ebx
mov dword [0x1003ee60], ecx
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
movzx ecx, word [esi]
cmp cx, word [ebp - 0x44]
jne 0x1000f04b
xor eax, eax
mov edi, ecx
mov ecx, eax
mov esi, eax
mov eax, dword [ebp + 0xc]
xor edx, edx
test di, di
je 0x1000f01a
cmp word [ebp + ecx - 0x44], dx
je 0x1000f01a
inc esi
lea ecx, [esi + esi]
movzx edi, word [ecx + eax]
cmp di, word [ebp + ecx - 0x44]
je 0x1000efff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
jmp 0x1000f042
cmp ecx, 0x1373
jne 0x1000f036
lea ebx, [eax + 0x644d9cab]
mov dword [0x1003ee58], ebx
lea eax, [ebx + 0x16afd769]
inc ecx
mov dword [0x1003ee08], eax
mov eax, dword [0x1003ee64]
cmp ecx, esi
jb 0x1000f022
mov eax, dword [0x1003ee60]
or edx, 0x475ec815
pop edi
pop esi
mov dword [0x1003edcc], edx
pop ebx
leave
ret
Function at 0x1000fcb6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x34], 0x1495
mov ebx, ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 8], ebx
mov esi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0x1863
mov dword [ebp - 0x18], 0x23ac
mov dword [ebp - 0x14], 0x56e
mov dword [ebp - 0x10], 0x9b3
mov dword [ebp - 0xc], 0x24bf
cmp esi, 3
je 0x1000fd0c
inc esi
cmp esi, 0xb
jl 0x1000fd01
mov esi, dword [ebp + esi*4 - 0x34]
mov dword [ebp - 4], esi
call fcn.1000f34c
mov edx, dword [0x1003edf4]
mov eax, edx
and eax, 0x3b208164
mov dword [0x1003ee80], eax
xor eax, eax
inc edi
cmp word [edi*2 + str.if_none_match], ax
jne 0x1000fd2c
push ecx
mov ecx, str.customData
call fcn.1000e450
pop ecx
cmp dword [ebp - 4], edi
jae 0x1000fd84
mov ebx, dword [0x1003ee80]
mov esi, dword [ebp - 4]
mov eax, 0x776c4c1d
cmp esi, 0x1c60
cmove ebx, eax
mov eax, ebx
xor eax, 0xe5ecb6c3
mov dword [0x1003edf4], eax
call fcn.1000e4b0
inc esi
cmp esi, edi
jb 0x1000fd51
mov esi, dword [ebp - 4]
mov dword [0x1003ee80], ebx
mov ebx, dword [ebp - 8]
jmp 0x1000fd84
inc esi
cmp byte [esi + ebx], 0
jne 0x1000fd83
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1001034d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x1003efa8]
sub esp, 0x10
xor edx, edx
mov eax, edx
imul ecx, ecx, 0xcd925e17
inc eax
cmp word [eax*2 + str.._AVCSecuredDataHandler_detail_pam_asw__], dx
jne 0x1001035d
push ebx
mov ebx, dword [0x1003efe0]
cmp eax, 0xcad
jae 0x10010384
add ebx, 0x5491a4f4
jmp 0x1001038a
add ebx, 0xf72f2f0e
imul eax, ecx, 0x43550f45
add ebx, 0xdfbdbe53
mov ecx, edx
xor eax, 0x90aaf302
inc ecx
cmp byte [ecx + str.fivedeva], dl
jne 0x10010398
cmp ecx, 0x227e
jne 0x100103b6
imul eax, eax, 0x4dafd0c0
jmp 0x100103c0
mov eax, dword [0x1003efd0]
xor eax, 0x433257e6
push esi
imul ecx, eax, 0x2c67330c
mov esi, edx
lea eax, [ebx + 0x2d97668a]
push edi
mov dword [0x1003f024], eax
inc esi
cmp word [esi*2 + str.._AVCSecuredDataHandler_detail_pam_asw__], dx
jne 0x100103d5
cmp esi, 0x1d69
je 0x100103f4
mov eax, ebx
xor eax, 0x24d1c941
mov dword [0x1003f024], eax
and ebx, 0x9628bddb
mov esi, edx
mov dword [0x1003efa8], ebx
imul edi, ecx, 0xd376e53
inc esi
cmp byte [esi + str.asmallkatakanahalfwidth], dl
jne 0x10010408
cmp esi, 0x2593
jbe 0x10010426
lea eax, [edi + 0x1045f9d8]
mov dword [0x1003f024], eax
jmp 0x1001042c
lea ecx, [edi + 0x62858a65]
mov esi, str.fiveoldstyle
lea edi, [ebp - 0x10]
xor ecx, 0x81192694
add eax, 0xe113a9e0
mov dword [0x1003efd0], ecx
mov dword [0x1003efe0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x53
pop edi
pop esi
jne 0x10010470
mov al, 0x53
test al, al
je 0x10010470
cmp byte [ebp + edx - 0x10], 0
je 0x10010470
mov al, byte [edx + 0x100333d1]
inc edx
cmp al, byte [ebp + edx - 0x10]
je 0x10010458
movzx ecx, byte [edx + str.SFZONE_SECURED_DNS]
movzx eax, byte [ebp + edx - 0x10]
sub ecx, eax
cmp ecx, 0x2378
jae 0x10010494
and ebx, 0x29af5ba7
mov dword [0x1003efa8], ebx
jmp 0x100104a3
mov eax, dword [0x1003efd0]
and eax, 0xa494e8d1
mov dword [0x1003f024], eax
pop ebx
leave
ret
Function at 0x100108c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
imul eax, dword [0x1003eea4], 0x81f74ba6
push esi
mov ecx, ebx
xor eax, 0x2dc6ae08
inc ecx
cmp byte [ecx + str.JPXDecode], bl
jne 0x100108da
cmp ecx, 0xa54
jae 0x100108f7
xor eax, 0x94803c4e
jmp 0x100108fd
imul eax, eax, 0x7cc07d2d
mov ecx, str.suhiragana
or eax, 0xc8449945
inc ecx
cmp byte [ecx], bl
jne 0x10010902
mov dword [0x1003eea4], eax
mov ecx, ebx
imul edx, eax, 0xdd04c5ed
add edx, 0xe4163ed2
inc ecx
cmp byte [ecx + str.Error:_Unexpected_token_found], bl
jne 0x10010919
mov eax, edx
mov esi, ebx
or edx, 0xb041f47e
and eax, 0x38038a6e
cmp ecx, 0x25e0
cmovbe edx, eax
add edx, 0x4061a1ec
xor edx, 0x3003b5cc
sub edx, 0x39535f9c
xor edx, 0xfb631d15
add edx, 0x44ed410b
inc esi
cmp word [esi*2 + str.ibom.ysrab], bx
jne 0x10010958
push edi
lea eax, [edx + 0x7cbb3ae5]
xor edx, 0x48b8e3d9
cmp esi, 0x847
lea edi, [ebp - 0x14]
mov esi, str.rcedilla
push 0x69
cmovae edx, eax
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
pop edi
cmp si, word [ebp - 0x14]
jne 0x100109b9
mov ecx, ebx
test si, si
je 0x100109b9
cmp word [ebp + ecx - 0x14], bx
je 0x100109b9
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.ibom.ysrab]
cmp si, word [ebp + ecx - 0x14]
je 0x1001099b
movzx ecx, byte [eax*2 + str.ibom.ysrab]
movzx eax, byte [ebp + eax*2 - 0x14]
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0x138e
jne 0x100109da
xor edx, 0x3e6c79a2
jmp 0x100109e0
or edx, 0xf8a1b1b6
and edx, 0xf31020
xor edx, 0x2024028
imul eax, edx, 0x7603560
and eax, 0xc490242
or eax, 0xa2b6c01c
add eax, 0xe2ecfe36
mov dword [0x1003eea4], eax
leave
ret
Function at 0x100110a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1003ef7c]
sub esp, 0x54
mov ecx, dword [0x1003ef18]
add edx, 0x9a32747c
push ebx
xor ebx, ebx
add ecx, 0x3a50f3be
push edi
mov eax, ebx
inc eax
cmp word [eax*2 + str.ibom.ysrab], bx
jne 0x100110c6
cmp dword [ebp + 8], eax
jae 0x100110de
mov ecx, edx
xor ecx, 0xcf7e311c
mov eax, ebx
inc eax
cmp word [eax*2 + str.ibom.ysrab], bx
jne 0x100110e0
cmp dword [ebp + 8], eax
jae 0x100110fe
sub eax, dword [ebp + 8]
sub ecx, 0x450ff62a
sub eax, 1
jne 0x100110f3
mov eax, str.ibom.ysrab
mov edx, eax
lea edx, [edx + 2]
imul ecx, ecx, 0xe885071d
cmp word [edx], bx
jne 0x10011105
push esi
mov esi, ebx
mov ebx, dword [ebp + 8]
mov edx, ebx
and edx, 0x86251c2f
xor edi, edi
inc esi
cmp word [esi*2 + str.SUVWAVAW], di
jne 0x10011123
mov edi, dword [0x1003ef18]
cmp dword [ebp + 8], esi
jae 0x10011141
mov edx, edi
or edx, 0x1c1975fa
xor esi, esi
lea eax, [eax + 2]
xor ecx, 0x205c1f63
cmp word [eax], si
jne 0x10011143
mov eax, esi
lea edi, [ebp - 0x54]
push 0x14
pop ecx
mov esi, str.AutoLogin:_atomic_lock_operation_timeout
and ebx, 0xf5eddfda
rep movsd dword es:[edi], dword [esi]
push 0x50
movsw word es:[edi], word [esi]
pop esi
cmp si, word [ebp - 0x54]
jne 0x10011193
xor edi, edi
mov ecx, edi
test si, si
je 0x10011193
cmp word [ebp + ecx - 0x54], di
je 0x10011193
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.Pam_vault_sync:_unsupported_account_type]
cmp si, word [ebp + ecx - 0x54]
je 0x10011175
movzx ecx, byte [eax*2 + str.Pam_vault_sync:_unsupported_account_type]
movzx eax, byte [ebp + eax*2 - 0x54]
sub ecx, eax
pop esi
cmp ecx, 0x1c91
je 0x100111b3
mov edx, ebx
xor edx, 0x40da2017
and edx, 0xa7ee3e4d
imul ecx, edx, 0x8a4c49d8
mov eax, edx
pop edi
mov dword [0x1003ef24], edx
pop ebx
mov dword [0x1003ef7c], ecx
leave
ret

Function at 0x10011e63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1003efc0]
sub esp, 0x10
xor eax, eax
mov ecx, eax
push ebx
push esi
mov esi, edx
push edi
and esi, 0x544b1972
inc ecx
cmp word [ecx*2 + str.muesum.maets], ax
jne 0x10011e7e
cmp ecx, 0x255
ja 0x10011e97
imul edx, esi, 0x8b03080
mov esi, str.zib.ptfym
lea edi, [ebp - 0x10]
lea ebx, [edx + 0x7120231b]
lea edx, [ebx - 0x11bee5b4]
mov dword [0x1003efd8], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x10], 0x61
jne 0x10011ee8
mov cl, 0x61
test cl, cl
je 0x10011ed5
cmp byte [ebp + eax - 0x10], 0
je 0x10011ed5
mov cl, byte [eax + 0x100332e1]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0x10011ebd
cmp dword [ebp - 4], eax
jae 0x10011ee8
sub eax, dword [ebp - 4]
xor ebx, 0xa7b80be2
sub eax, 1
jne 0x10011edd
lea eax, [edx - 0x288a82b7]
mov dword [0x1003efc0], eax
lea ecx, [edx + 0x2e4b1fd8]
pop edi
mov eax, edx
mov dword [0x1003eeec], ecx
xor eax, 0x27050d76
pop esi
mov dword [0x1003f008], eax
pop ebx
leave
ret