joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004257
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [0x1003bd7c]
push ebx
imul ebx, dword [0x1003bc78], 0x7e870bcb
xor edx, 0xa46b1a15
push esi
push edi
mov esi, str.part_451_500
lea edi, [ebp - 0x1c]
imul eax, ebx, 0xfbd1796b
mov dword [ebp - 8], ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x6b
jne 0x100042b0
mov cl, 0x6b
test cl, cl
je 0x100042b0
cmp byte [ebp + eax - 0x1c], 0
je 0x100042b0
mov cl, byte [eax + 0x1002ed09]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x10004298
movzx ecx, byte [eax + str.kenarmenian]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0x6ea
jne 0x10004336
mov ebx, edx
or ebx, 0xfc8b6df7
mov dword [ebp - 8], ebx
mov ecx, dword [0x1003bd90]
mov esi, str.Chrome2:_started
lea edi, [ebp - 0x20]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x20], 0x46
jne 0x1000431b
mov byte [ebp - 1], 0x46
mov bl, byte [ebp - 1]
test bl, bl
je 0x1000430b
cmp byte [ebp + eax - 0x20], 0
je 0x1000430b
mov bl, byte [eax + 0x1002e491]
inc eax
cmp bl, byte [ebp + eax - 0x20]
je 0x100042f3
mov ebx, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
jae 0x1000431b
mov ebx, ecx
or ebx, 0xe32cd51b
xor eax, eax
inc eax
cmp byte [eax + str.ohorntilde], 0
jne 0x1000431d
cmp eax, 0x1f03
jbe 0x10004378
add ebx, 0x87bee676
jmp 0x1000437e
mov esi, dword [ebp - 0xc]
xor eax, eax
mov edx, esi
or edx, 0xa6952443
inc eax
cmp byte [eax + str.ohorntilde], 0
jne 0x10004343
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jae 0x100042d1
imul esi, esi, 0xf6c2a1c3
cmp ecx, 0x160d
jne 0x1000436c
imul edx, ebx, 0x422ab026
inc ecx
cmp ecx, eax
jb 0x1000435e
mov ecx, esi
jmp 0x100042d7
lea ebx, [ecx - 0x3c54c071]
mov esi, str.ui.opm.modal.open
lea edi, [ebp - 0x20]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x20], 0x6f
jne 0x100043ae
mov cl, 0x6f
test cl, cl
je 0x100043ae
cmp byte [ebp + eax - 0x20], 0
je 0x100043ae
mov cl, byte [eax + 0x1002e96d]
inc eax
cmp cl, byte [ebp + eax - 0x20]
je 0x10004396
movzx ecx, byte [eax + str.ohorntilde]
movzx eax, byte [ebp + eax - 0x20]
sub ecx, eax
cmp ecx, 0xca4
jae 0x100043cc
xor edx, 0x20e25a56
jmp 0x100043d2
and edx, 0xebd3c196
lea eax, [edx + 0x161d42e3]
imul esi, ebx, 0xf363b707
xor ebx, ebx
mov dword [0x1003bd90], eax
imul eax, edx, 0xe4dbb401
mov ecx, ebx
mov dword [0x1003bd7c], edx
mov dword [0x1003bc78], eax
inc ecx
cmp word [ecx*2 + str.Content_Type], bx
jne 0x100043f8
cmp ecx, 0x1322
jae 0x10004412
and eax, 0xf7c76e3
jmp 0x10004418
lea eax, [esi + 0x3ba01e2c]
pop edi
pop esi
mov dword [0x1003bbec], eax
mov eax, edx
pop ebx
leave
ret
Function at 0x10004c22
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1003bb90]
mov edx, ecx
push ebx
xor ebx, ebx
mov dword [ebp - 8], edx
and eax, 0x2a2d6b3c
mov cl, byte [edx]
mov byte [ebp - 1], cl
push esi
mov esi, ebx
test cl, cl
je 0x10004c60
or eax, 0xf390cb2c
inc esi
cmp byte [esi + edx], bl
jne 0x10004c4b
cmp esi, 0x25fe
jne 0x10004c65
mov eax, dword [0x1003bb84]
jmp 0x10004c6f
mov eax, dword [0x1003bce0]
xor eax, 0x3ac34c92
mov dword [0x1003bb84], eax
push edi
mov esi, str.scheduled
lea edi, [ebp - 0x14]
lea edx, [eax - 0xea01be3]
add eax, 0xe9ccfd65
mov dword [0x1003bce0], eax
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp cl, byte [ebp - 0x14]
jne 0x10004caa
mov esi, dword [ebp - 8]
test cl, cl
je 0x10004caa
cmp byte [ebp + eax - 0x14], bl
je 0x10004caa
inc eax
mov cl, byte [esi + eax]
cmp cl, byte [ebp + eax - 0x14]
je 0x10004c96
mov ecx, dword [ebp - 8]
movzx ecx, byte [eax + ecx]
movzx eax, byte [ebp + eax - 0x14]
sub ecx, eax
cmp ecx, 0x1f91
jae 0x10004cd1
mov eax, dword [0x1003bce0]
or eax, 0x97a296c2
mov dword [0x1003bb84], eax
jmp 0x10004cdd
mov edx, dword [0x1003bce0]
add edx, 0xd74b9591
push 0xb
pop ecx
mov esi, str.schannel:_Curl_read_plain_returned_error__d
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov cl, byte [ebp - 1]
and edx, 0xaebcac41
mov eax, ebx
mov dword [str._q5], edx
cmp cl, byte [ebp - 0x44]
jne 0x10004d37
mov esi, dword [ebp - 8]
mov ch, cl
test ch, ch
je 0x10004d19
cmp byte [ebp + eax - 0x44], bl
je 0x10004d19
inc eax
mov ch, byte [esi + eax]
cmp ch, byte [ebp + eax - 0x44]
je 0x10004d05
mov esi, dword [ebp - 8]
jmp 0x10004d33
cmp esi, 0xc8e
jne 0x10004d32
or edx, 0x4c99d3c7
mov dword [str._q5], edx
inc esi
cmp esi, eax
jb 0x10004d1e
test cl, cl
je 0x10004d46
lea eax, [edx + 0x1a502f4c]
mov dword [0x1003bb84], eax
mov esi, 0x1002d028
lea edi, [ebp - 0x18]
mov eax, edx
or eax, 0x1a7996a2
imul eax, eax, 0xede4b792
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or eax, 0xd073c878
mov dword [0x1003bb90], eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
cmp cl, byte [ebp - 0x18]
jne 0x10004d89
mov eax, dword [ebp - 8]
test cl, cl
je 0x10004d89
cmp byte [ebp + ebx - 0x18], 0
je 0x10004d89
inc ebx
mov cl, byte [eax + ebx]
cmp cl, byte [ebp + ebx - 0x18]
je 0x10004d74
mov eax, dword [ebp - 8]
pop esi
movzx ecx, byte [ebx + eax]
movzx eax, byte [ebp + ebx - 0x18]
sub ecx, eax
pop ebx
cmp ecx, 0x15e7
jbe 0x10004dae
lea eax, [edx - 0x7f4b1ac3]
mov dword [0x1003bb84], eax
leave
ret
add edx, 0x52eec047
mov dword [str._q5], edx
leave
ret
Function at 0x10005e3a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
lea edi, [ebp - 0x6c]
push 0x17
pop ecx
mov esi, str.._AVTraits_PasswordLogin_passwdmgr_avast_com__
mov dword [ebp - 4], edx
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x1003bd54]
xor eax, eax
mov ebx, eax
and edx, 0x66cfcd3c
mov dword [ebp - 0xc], edx
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 8]
movzx eax, word [esi]
mov edi, eax
cmp ax, word [ebp - 0x6c]
jne 0x10005e9d
xor eax, eax
mov ecx, edi
xor edx, edx
test cx, cx
je 0x10005e9a
cmp word [ebp + eax - 0x6c], dx
je 0x10005e9a
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x6c]
je 0x10005e7f
mov edx, dword [ebp - 0xc]
movzx ecx, byte [esi + ebx*2]
movzx eax, byte [ebp + ebx*2 - 0x6c]
mov ebx, dword [ebp - 4]
sub ecx, eax
cmp ecx, 0x2413
jb 0x10005ebb
mov edx, ebx
and edx, 0xa4b6a581
mov ecx, dword [ebp + 8]
or edx, 0xaab67f6d
mov dword [0x1003bcd8], edx
test di, di
je 0x10005eed
xor edx, edx
mov eax, edx
inc eax
cmp word [esi + eax*2], dx
jne 0x10005ed3
cmp eax, 0x15fb
jbe 0x10005eed
mov eax, ecx
xor eax, 0x808e68d9
mov dword [0x1003bcd8], eax
mov eax, ecx
xor eax, 0x14a535d4
or ecx, 0xdc2e089e
pop edi
mov dword [0x1003bbac], eax
lea eax, [ebx - 0x5102ce6b]
pop esi
mov dword [0x1003bd54], eax
mov dword [0x1003bb74], ecx
pop ebx
leave
ret
Function at 0x1000df34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, str.H9T_XrVH
lea edi, [ebp - 0x10]
xor edx, edx
mov eax, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x69
jne 0x1000df7b
mov cl, 0x69
test cl, cl
je 0x1000df6a
cmp byte [ebp + eax - 0x10], dl
je 0x1000df6a
mov cl, byte [eax + 0x1002fb4d]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0x1000df53
cmp dword [ebp - 4], eax
jae 0x1000df7b
mov eax, dword [0x1003be84]
add eax, 0x8ba07bf8
jmp 0x1000df80
mov eax, dword [0x1003bdd8]
add eax, 0x1b91c19a
mov ecx, str.sync_skipped___vault_locked
and eax, 0x3ffb8a32
imul eax, eax, 0x39c18580
inc ecx
cmp byte [ecx], dl
jne 0x1000df8f
or eax, 0xcdec77a8
add eax, 0x76107efc
mov esi, eax
or esi, 0x73d411a
add eax, 0x731a2c2e
mov dword [0x1003bdd8], esi
xor eax, 0x783ca390
inc edx
cmp byte [edx + str.iknisleh], 0
jne 0x1000dfb7
mov ecx, dword [ebp - 4]
mov dword [0x1003be84], eax
cmp ecx, edx
jae 0x1000dfef
cmp ecx, 0x1ba7
jne 0x1000dfe0
lea eax, [esi - 0x44c50324]
and eax, 0x5cde9fd5
inc ecx
cmp ecx, edx
jb 0x1000dfd2
mov dword [0x1003be84], eax
pop edi
pop esi
leave
ret
Function at 0x1000f11e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [0x1003becc]
mov ebx, ecx
push edi
mov dword [ebp - 8], ebx
mov eax, str.alefmaddaabovefinalarabic
sub esi, 0x3b7c07ca
inc eax
cmp byte [eax], 0
jne 0x1000f137
xor eax, eax
mov dword [0x1003becc], esi
and dword [ebp - 0x18], eax
and dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0x15b7
mov dword [ebp - 0x34], 0x6b9
mov dword [ebp - 0x30], 0x7a1
mov dword [ebp - 0x2c], 0x1e46
mov dword [ebp - 0x28], 0x1580
mov dword [ebp - 0x24], 0x985
mov dword [ebp - 0x20], 0x2260
mov dword [ebp - 0x1c], 0x26e7
mov dword [ebp - 0x14], 0xd66
mov dword [ebp - 0xc], 0x785
cmp eax, 0xa
je 0x1000f1a2
inc eax
cmp eax, 0xc
jl 0x1000f197
mov edi, dword [ebp + eax*4 - 0x38]
jmp 0x1000f1d5
xor esi, 0xf0849035
mov ebx, str.Acircumflexgrave
xor edi, edi
call fcn.1000e25d
lea ebx, [ebx + 2]
xor esi, 0xa8db9e3c
cmp word [ebx], di
jne 0x1000f1b5
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
inc edi
mov dword [0x1003becc], esi
cmp byte [edi + ebx], 0
mov dword [ebp - 4], edi
jne 0x1000f1a8
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f909
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0xb
pop ecx
mov esi, str.avcfg:__volatile_Streams_LastStrmUpdReceived
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov eax, ebx
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x44], 0x74
jne 0x1000f943
mov cl, 0x74
test cl, cl
je 0x1000f943
cmp byte [ebp + eax - 0x44], bl
je 0x1000f943
mov cl, byte [eax + 0x10030f2d]
inc eax
cmp cl, byte [ebp + eax - 0x44]
je 0x1000f92c
movzx ecx, byte [eax + str.ti.omref]
movzx eax, byte [ebp + eax - 0x44]
sub ecx, eax
cmp ecx, 0x1a0f
jae 0x1000f96a
mov eax, dword [0x1003c044]
add eax, 0x6e7abb2d
mov dword [0x1003c068], eax
jmp 0x1000f97e
mov eax, dword [0x1003c018]
add eax, 0xd64ee485
mov dword [0x1003bfe4], eax
mov eax, dword [0x1003c068]
mov esi, 0x1002fd40
lea edi, [ebp - 0x10]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x50
jne 0x1000f9e1
mov dl, 0x50
test dl, dl
je 0x1000f9aa
cmp byte [ebp + ecx - 0x10], bl
je 0x1000f9aa
mov dl, byte [ecx + 0x10030ff1]
inc ecx
cmp dl, byte [ebp + ecx - 0x10]
je 0x1000f993
mov edx, dword [ebp - 4]
cmp edx, ecx
jae 0x1000f9e1
mov ebx, dword [0x1003c018]
cmp edx, 0x1a0e
jne 0x1000f9d0
mov eax, ebx
and eax, 0x8fabfd7
mov dword [0x1003c044], eax
mov eax, dword [0x1003c068]
and eax, 0x7deb57ed
inc edx
mov dword [0x1003c068], eax
cmp edx, ecx
jb 0x1000f9b7
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x1003c068]
mov ecx, ebx
xor eax, 0x7e348287
inc ecx
cmp byte [ecx + str.maitrilowleftthai], 0
jne 0x1000f9ee
cmp ecx, 0x1787
jbe 0x1000fa0a
or eax, 0x61ce614c
mov esi, str.lennahclevart
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x14], 0x70
jne 0x1000fa65
mov cl, 0x70
test cl, cl
je 0x1000fa37
cmp byte [ebp + ebx - 0x14], 0
je 0x1000fa37
mov cl, byte [ebx + 0x10030d21]
inc ebx
cmp cl, byte [ebp + ebx - 0x14]
je 0x1000fa1f
mov ecx, dword [ebp - 4]
cmp ecx, ebx
jae 0x1000fa65
mov edx, dword [0x1003c044]
imul esi, eax, 0x7a536b1b
cmp ecx, 0x12c8
cmove edx, esi
add eax, 0x961671e
add esi, 0x6e196a2a
inc ecx
cmp ecx, ebx
jb 0x1000fa4a
jmp 0x1000fa6b
mov edx, dword [0x1003c044]
mov ecx, edx
add eax, 0x73214b40
or ecx, 0x51284b78
mov dword [0x1003bfe4], eax
mov dword [0x1003c068], ecx
imul ecx, edx, 0x96a119a8
pop edi
pop esi
pop ebx
mov dword [0x1003c018], ecx
or ecx, 0xa9cf6cfe
mov dword [0x1003c044], ecx
leave
ret
Function at 0x1001005b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x1003bfb8]
sub esp, 0x28
mov eax, str.IDR_HTM_DIALOG_NAG_SCREEN
xor edx, edx
lea eax, [eax + 2]
lea ecx, [ecx + 0x38e70d4f]
cmp word [eax], dx
jne 0x1001006e
push ebx
push esi
push edi
lea ebx, [ecx - 0x1e619f51]
mov esi, str.ofni.eht_skorg
push 7
pop ecx
lea edi, [ebp - 0x28]
mov dword [ebp - 4], ebx
rep movsd dword es:[edi], dword [esi]
push 0x49
pop ecx
movsw word es:[edi], word [esi]
xor esi, esi
cmp cx, word [ebp - 0x28]
jne 0x100100de
mov eax, esi
test cx, cx
je 0x100100c2
cmp word [ebp + eax - 0x28], si
je 0x100100c2
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.IDR_HTM_DIALOG_NAG_SCREEN]
cmp cx, word [ebp + eax - 0x28]
je 0x100100a4
mov eax, dword [ebp - 8]
cmp eax, edx
jae 0x100100de
cmp eax, 0x2a6
jne 0x100100d6
xor ebx, 0x74a027d8
inc eax
cmp eax, edx
jb 0x100100c9
mov dword [ebp - 4], ebx
imul edx, dword [ebp - 4], 0xecc79376
lea edi, [ebp - 0x24]
mov eax, esi
mov ebx, dword [0x1003bfd0]
push 6
pop ecx
mov esi, str.FromUserScan
mov dword [0x1003bfc0], 0x72b7bb2b
rep movsd dword es:[edi], dword [esi]
push 0x70
or ebx, 0x27357377
mov dword [0x1003bfc8], edx
pop ecx
movsw word es:[edi], word [esi]
xor esi, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
cmp cx, word [ebp - 0x24]
jne 0x1001014f
mov ebx, dword [ebp - 4]
mov eax, esi
test cx, cx
je 0x10010146
cmp word [ebp + eax - 0x24], si
je 0x10010146
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.pj.igihcot.amayo]
cmp cx, word [ebp + eax - 0x24]
je 0x10010128
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax*2 + str.pj.igihcot.amayo]
movzx eax, byte [ebp + eax*2 - 0x24]
sub ecx, eax
cmp ecx, 0x850
jne 0x10010174
lea edx, [ebx + 0x641153db]
mov dword [0x1003bfc8], edx
jmp 0x10010179
mov ebx, 0x11bbc816
mov eax, dword [0x1003bfd0]
mov ecx, esi
add eax, 0x1ff5fb73
mov dword [0x1003c0a8], eax
sub ebx, 0x465812f4
inc ecx
cmp word [ecx*2 + str.._AVAvBehav_PropertyListAlerts__], si
jne 0x1001018a
mov dword [0x1003bfb8], ebx
pop edi
pop esi
pop ebx
cmp ecx, 0x19ca
jbe 0x100101b8
and eax, 0xf574725c
mov dword [0x1003bfd0], eax
leave
ret
xor edx, 0x499d46a4
mov dword [0x1003bfb8], edx
leave
ret
Function at 0x10015985
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov eax, dword [0x1003c114]
mov esi, str.amgdgt.com
push edi
push 5
pop ecx
lea edi, [ebp - 0x30]
xor eax, 0x857246f2
rep movsd dword es:[edi], dword [esi]
mov dword [0x1003c114], eax
xor ebx, ebx
xor eax, 0x3c4bac7f
mov edx, eax
mov dword [ebp - 8], eax
push 0x77
or edx, 0x13229ff5
movsw word es:[edi], word [esi]
pop ecx
mov eax, ebx
mov dword [ebp - 4], edx
cmp cx, word [ebp - 0x30]
jne 0x100159f5
mov edx, ebx
test cx, cx
je 0x100159ec
cmp word [ebp + eax - 0x30], bx
je 0x100159ec
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.webtrendslive.com]
cmp cx, word [ebp + eax - 0x30]
je 0x100159ce
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax*2 + str.webtrendslive.com]
movzx eax, byte [ebp + eax*2 - 0x30]
sub ecx, eax
cmp ecx, 0x1740
jae 0x10015a1a
mov edx, dword [0x1003c114]
and edx, 0xe6c0147c
jmp 0x10015a20
add edx, 0xd06a6caa
xor dword [ebp - 8], 0x1d2f6491
mov eax, ebx
xor edx, 0xf43e5220
inc eax
cmp byte [eax + str.._AVAvCfg_SnxAdditionalApp__], bl
jne 0x10015a29
cmp dword [ebp - 0xc], eax
jae 0x10015a46
lea eax, [edx + 0x7683d999]
mov dword [ebp - 4], eax
mov esi, str.arguments
lea edi, [ebp - 0x18]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x18], 0x41
jne 0x10015a73
mov cl, 0x41
test cl, cl
je 0x10015a73
cmp byte [ebp + eax - 0x18], bl
je 0x10015a73
mov cl, byte [eax + 0x10031db5]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x10015a5c
movzx ecx, byte [eax + str.AsyncUnlock]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
cmp ecx, 0xbdf
jae 0x10015a9a
mov ecx, dword [0x1003c114]
add ecx, 0x8d153f80
mov dword [ebp - 4], ecx
jmp 0x10015aa7
mov ecx, dword [ebp - 4]
mov eax, ecx
and eax, 0x9ec036fd
mov dword [ebp - 8], eax
mov esi, str.on.ajsel
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x41
jne 0x10015b04
push 0x41
pop eax
test al, al
je 0x10015ad3
cmp byte [ebp + ebx - 0x18], 0
je 0x10015ad3
mov al, byte [ebx + 0x10031db5]
inc ebx
cmp al, byte [ebp + ebx - 0x18]
je 0x10015abb
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jae 0x10015b04
mov edx, dword [ebp - 8]
mov ecx, dword [0x1003c114]
xor edx, 0xc38b7938
cmp eax, 0x26ef
jne 0x10015af6
xor ecx, 0x590039e4
inc eax
cmp eax, ebx
jb 0x10015ae9
mov dword [0x1003c114], ecx
mov ecx, dword [ebp - 4]
xor ecx, 0x74091735
imul eax, edx, 0xb3482a7f
pop edi
mov dword [0x1003c1e8], ecx
pop esi
pop ebx
mov dword [0x1003c108], eax
lea ecx, [eax + 0x5bfdd776]
mov dword [0x1003c1e4], ecx
leave
ret
Function at 0x10016128
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov ecx, dword [0x1003c18c]
push ebx
xor ecx, 0xcbfa7fdb
xor edx, edx
push esi
mov esi, dword [0x1003c170]
mov eax, edx
push edi
mov dword [ebp - 8], ecx
xor esi, 0xdfe8279a
inc eax
cmp word [eax*2 + str.CheckPasswordStrength__parsing_input_data_failed], dx
jne 0x1001614a
cmp eax, 0x2569
mov eax, dword [0x1003c184]
je 0x10016172
mov ecx, eax
or ecx, 0x3d6a294d
mov dword [ebp - 8], ecx
push 7
mov ebx, ecx
lea edi, [ebp - 0x2c]
pop ecx
mov esi, str.antiransomware
and ebx, 0xea278d4d
rep movsd dword es:[edi], dword [esi]
imul eax, ebx, 0x142420e9
push 0x43
movsw word es:[edi], word [esi]
pop esi
mov dword [ebp - 4], eax
mov eax, edx
cmp si, word [ebp - 0x2c]
jne 0x100161ec
mov ecx, edx
test si, si
je 0x100161bd
cmp word [ebp + ecx - 0x2c], dx
je 0x100161bd
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.CheckPasswordStrength__parsing_input_data_failed]
cmp si, word [ebp + ecx - 0x2c]
je 0x1001619f
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jae 0x100161ec
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, 0x2529
jne 0x100161de
lea esi, [eax + 0x34f655f1]
or esi, 0xbde7822c
inc ecx
cmp ecx, edi
jb 0x100161d0
mov dword [ebp - 4], esi
mov esi, str.OverrideDataFolder
lea edi, [ebp - 0x24]
mov eax, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x24], 0x73
jne 0x1001621c
mov cl, 0x73
test cl, cl
je 0x1001621c
cmp byte [ebp + eax - 0x24], dl
je 0x1001621c
mov cl, byte [eax + 0x100320a1]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0x10016205
movzx ecx, byte [eax + str.show_app_store_window:265]
movzx eax, byte [ebp + eax - 0x24]
mov edi, dword [ebp - 4]
sub ecx, eax
cmp ecx, 0xc3
jb 0x10016243
mov eax, edi
and eax, 0x1dcbc060
mov dword [0x1003c184], eax
jmp 0x10016248
mov eax, dword [0x1003c184]
mov ecx, edx
xor ebx, 0xd0d4fe10
inc ecx
cmp byte [ecx + str.show_app_store_window:265], dl
jne 0x10016250
mov esi, dword [ebp - 0xc]
jmp 0x10016275
cmp esi, 0x1286
jne 0x1001626e
mov ebx, edi
or ebx, 0x35ef4da7
lea edi, [ebx + 0x27ff20d0]
inc esi
cmp esi, ecx
jb 0x1001625e
mov ecx, edx
inc ecx
cmp word [ecx*2 + str._tComponent], dx
jne 0x1001627b
cmp ecx, 0x662
jbe 0x10016298
mov ecx, ebx
or ecx, 0x1594be20
jmp 0x1001629e
lea ecx, [ebx + 0x16a44def]
push 0xb
mov dword [0x1003c18c], ecx
lea edi, [ebp - 0x3c]
pop ecx
mov esi, str.ChangeDevicePassword__pam_vault_inaccessible
and ebx, 0x73e7965d
rep movsd dword es:[edi], dword [esi]
mov dword [0x1003c170], ebx
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x3c], 0x52
pop edi
pop esi
pop ebx
jne 0x100162f1
mov cl, 0x52
test cl, cl
je 0x100162e2
cmp byte [ebp + edx - 0x3c], 0
je 0x100162e2
mov cl, byte [edx + 0x10031e91]
inc edx
cmp cl, byte [ebp + edx - 0x3c]
je 0x100162ca
cmp dword [ebp - 0xc], edx
jae 0x100162f1
xor eax, 0xdb7bc73e
mov dword [0x1003c18c], eax
mov eax, dword [0x1003c184]
and eax, 0x7bb271cd
mov dword [0x1003c1bc], eax
leave
ret
Function at 0x10016572
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov ebx, dword [0x1003c1d0]
lea edi, [ebp - 0x20]
push 6
pop ecx
mov esi, str.Send_svc.icarus.run_fail
mov edx, ebx
rep movsd dword es:[edi], dword [esi]
or edx, 0x4dd110f8
xor eax, eax
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x20], 0x74
jne 0x100165bc
mov cl, 0x74
test cl, cl
je 0x100165bc
cmp byte [ebp + eax - 0x20], 0
je 0x100165bc
mov cl, byte [eax + 0x10031fe1]
inc eax
cmp cl, byte [ebp + eax - 0x20]
je 0x100165a4
movzx ecx, byte [eax + 0x10031fe0]
movzx eax, byte [ebp + eax - 0x20]
sub ecx, eax
cmp ecx, 0x2237
je 0x100165d8
lea edx, [ebx + 0x25da019d]
xor esi, esi
mov eax, esi
inc eax
cmp word [eax*2 + str.avcfg:__settings_Common_CanInstallMobileSecurity], si
jne 0x100165dc
mov ecx, dword [ebp - 4]
jmp 0x100165fb
cmp ecx, 0x82
jne 0x100165fa
lea edx, [ebx - 0x7bde895c]
inc ecx
cmp ecx, eax
jb 0x100165ec
mov eax, esi
lea edi, [ebp - 0x94]
push 0x1c
pop ecx
mov esi, str.._AVModalDialogScriptController_detail_ui_renderer_asw__
rep movsd dword es:[edi], dword [esi]
push 0x61
movsw word es:[edi], word [esi]
pop esi
xor edi, edi
cmp si, word [ebp - 0x94]
jne 0x1001666c
mov ecx, edi
test si, si
je 0x10016647
cmp word [ebp + ecx - 0x94], di
je 0x10016647
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.avcfg:__settings_Common_CanInstallMobileSecurity]
cmp si, word [ebp + ecx - 0x94]
je 0x10016623
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
jmp 0x10016668
cmp eax, 0x2697
jne 0x10016661
mov edx, ebx
and edx, 0x9c7ce2a1
and edx, 0x5805b5eb
inc eax
cmp eax, ecx
jb 0x10016652
mov eax, ebx
mov ecx, edi
xor eax, 0x97a08d59
mov dword [0x1003c208], eax
or eax, 0xd7eff7fe
xor eax, 0xb37a0dd0
inc ecx
cmp word [ecx*2 + str.rf.selbatpmoc_strepxe], di
jne 0x1001667f
mov dword [0x1003c248], eax
cmp dword [ebp - 4], ecx
jae 0x100166a5
mov eax, ebx
and eax, 0x3bae7bbb
mov dword [0x1003c248], eax
pop edi
pop esi
pop ebx
leave
ret