joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6da1df
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
in al, dx
invalid
in al, dx
or al, 1
invalid

Function at 0x6da1e1
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
in al, dx
invalid
in al, dx
or al, 1
invalid

Function at 0x6da1f7
Capabilities:
Parse credit card information

Disassembly:
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ebx
jne 0x6da21b
invalid
lea ecx, [eax + 1]
mov al, byte [eax + 1]
cmp al, 0x41
jl 0x6da20e
cmp al, 0x5a
jle 0x6da216
cmp al, 0x61
jl 0x6da21b
cmp al, 0x7a
jg 0x6da21b
invalid

Function at 0x6da227
Capabilities:
Parse credit card information

Disassembly:
mov al, byte [ebx]
cmp al, 0x3a
jne 0x6da232
cmp byte [ebx + 1], al
je 0x6da244
cmp al, 0x27
jne 0x6da3b5
add dword [eax], eax
invalid
cmp byte [ebx + 1], 0
je 0x6da3b5
mov eax, dword [ebp - 8]
Function at 0x6dc958
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x6dd172
invalid
invalid
or byte [eax], al
invalid
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
test edi, edi
mov ebx, 0x40000
je 0x6dc9b7
test byte [ebp + 0x1d], 1
je 0x6dc983
push dword [ebp + 0x14]
invalid
push 0x73

Function at 0x6dd42b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
Function at 0x6e66eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x14], 0
je 0x6e689a
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
mov esi, dword [ebp + 0xc]
push 1
push dword [ebp + 0x14]
mov ecx, dword [edi + 8]
push dword [ecx + eax*4]
push esi
push edi
call fcn.006e6541
push 0xa
push 0x280ab458
push edi
call fcn.007370a7
push eax
push 0
push 5
push edi
call fcn.006e86bf
add esp, 0x30
mov dword [ebp + 0xc], eax
test esi, esi
je 0x6e674d
mov eax, dword [esi]
push 0
push dword [eax + 0x2c]
push edi
call fcn.00737048
add esp, 0xc
jmp 0x6e6753
lea eax, [edi + 0x97c]
push 0
push 9
push edi
mov dword [ebp + 0x10], eax
call fcn.006e75fe
push dword [ebp + 0x14]
mov esi, eax
mov eax, dword [ebx + 0xc]
push edi
mov dword [esi + 0xc], eax
call fcn.006e6665
add esp, 0x14
push eax
push 0x14
push esi
push edi
call fcn.006e57c4
push eax
push 0
push 0x14
push edi
call fcn.006e76af
add esp, 0x1c
mov esi, 0x8d
push eax
push esi
push edi
call fcn.006e7468
add esp, 0x10
push eax
push dword [ebp + 0x10]
push 0
push 5
push edi
call fcn.006e86bf
add esp, 0x10
push eax
push esi
push edi
call fcn.006e7468
push 6
push 0x280aa6d8
push edi
mov dword [ebp + 8], eax
call fcn.007370a7
mov ebx, eax
add esp, 0x1c
mov eax, dword [ebx + 8]
and eax, 0xff
cmp eax, 5
jae 0x6e67e3
push 5
push ebx
push edi
call fcn.0072ff9a
add esp, 0xc
test byte [ebx + 0xa], 0x20
je 0x6e67f2
push ebx
push edi
call fcn.00730a6b
pop ecx
pop ecx
mov eax, dword [ebx]
or word [ebx + 0xa], 0x101
mov ecx, dword [eax]
mov dword [ebp + 0x10], ecx
mov ecx, dword [eax + 4]
xor eax, eax
mov edx, ecx
dec ecx
test edx, edx
je 0x6e682a
inc ecx
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx]
add eax, edx
inc ecx
imul eax, eax, 0x401
mov edx, eax
shr edx, 6
xor eax, edx
dec dword [ebp + 0x14]
jne 0x6e6812
lea eax, [eax + eax*8]
push ebx
mov ecx, eax
push 0
shr ecx, 0xb
xor ecx, eax
mov eax, dword [ebx]
imul ecx, ecx, 0x8001
push 0x15e
push edi
mov dword [eax + 0xc], ecx
call fcn.006e86bf
add esp, 0x10
push eax
push dword [ebp + 8]
push edi
call fcn.006e55d5
push eax
push dword [ebp + 0xc]
push esi
push edi
call fcn.006e7468
add esp, 0x18
push eax
push esi
push edi
call fcn.006e739e
push eax
push 0xc1
push 0xa6
push edi
call fcn.006e72ea
mov ebx, dword [ebp + 0x18]
or byte [eax + 0x15], 0x40
push eax
push dword [ebx]
push esi
push edi
call fcn.006e739e
add esp, 0x30
mov dword [ebx], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x796b5a
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x82a28f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ebx
test eax, eax
je 0x82a382
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x82a382
cmp dword [ebp + 0xc], 0
je 0x82a382
mov ecx, dword [esi + 0x18]
cmp ecx, 2
je 0x82a382
cmp ecx, 1
jne 0x82a2d5
cmp dword [esi + 4], 0x2a
jne 0x82a382
cmp dword [esi + 0x18], 0
je 0x82a2f0
push ebx
push dword [ebp + 0xc]
push dword [eax + 0x30]
call fcn.008287cf
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ecx + 0x30], eax
cmp ebx, 3
jb 0x82a37e
mov eax, dword [esi + 0x24]
add eax, 0xfffffefa
cmp ebx, eax
jbe 0x82a30c
mov edi, eax
sub ebx, edi
add dword [ebp + 0xc], ebx
push edi
push dword [ebp + 0xc]
push dword [esi + 0x30]
call fcn.0082e0f7
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x64], edi
mov dword [esi + 0x54], edi
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
add esp, 0xc
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
xor edx, edx
and eax, dword [esi + 0x4c]
add edi, 0xfffffffd
mov dword [ebp + 0xc], edi
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x30]
mov edi, dword [esi + 0x40]
mov ecx, dword [esi + 0x50]
mov ebx, dword [esi + 0x38]
movzx eax, byte [eax + edx + 2]
shl edi, cl
mov ecx, dword [esi + 0x3c]
xor eax, edi
mov edi, dword [esi + 0x2c]
and eax, dword [esi + 0x4c]
and edi, edx
mov dword [esi + 0x40], eax
mov ax, word [ecx + eax*2]
mov word [ebx + edi*2], ax
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
mov word [ecx + eax*2], dx
inc edx
cmp edx, dword [ebp + 0xc]
jbe 0x82a343
xor eax, eax
jmp 0x82a385
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x82ab50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov ebx, dword [esi + 0x34]
mov ecx, dword [esi + 0x24]
sub ebx, dword [esi + 0x6c]
mov eax, dword [esi + 0x64]
lea ecx, [edi + ecx - 0x106]
sub ebx, eax
cmp eax, ecx
jb 0x82abd8
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.0082e0f7
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
mov dword [ebp + 8], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x82ab9b
mov eax, dword [esi + 0x38]
mov dword [ebp + 8], edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x82abbd
add ebx, edi
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x82ac33
mov ecx, dword [esi + 0x6c]
push ebx
add ecx, dword [esi + 0x64]
add ecx, dword [esi + 0x30]
push ecx
push eax
call fcn.0082ac38
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x82ac1f
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x82ac33
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x82ab5c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x8a30d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ebx
test eax, eax
je 0x8a31c8
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x8a31c8
cmp dword [ebp + 0xc], 0
je 0x8a31c8
mov ecx, dword [esi + 0x18]
cmp ecx, 2
je 0x8a31c8
cmp ecx, 1
jne 0x8a311b
cmp dword [esi + 4], 0x2a
jne 0x8a31c8
cmp dword [esi + 0x18], 0
je 0x8a3136
push ebx
push dword [ebp + 0xc]
push dword [eax + 0x30]
call fcn.008a1615
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ecx + 0x30], eax
cmp ebx, 3
jb 0x8a31c4
mov eax, dword [esi + 0x24]
add eax, 0xfffffefa
cmp ebx, eax
jbe 0x8a3152
mov edi, eax
sub ebx, edi
add dword [ebp + 0xc], ebx
push edi
push dword [ebp + 0xc]
push dword [esi + 0x30]
call fcn.008a6f3d
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x64], edi
mov dword [esi + 0x54], edi
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
add esp, 0xc
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
xor edx, edx
and eax, dword [esi + 0x4c]
add edi, 0xfffffffd
mov dword [ebp + 0xc], edi
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x30]
mov edi, dword [esi + 0x40]
mov ecx, dword [esi + 0x50]
mov ebx, dword [esi + 0x38]
movzx eax, byte [eax + edx + 2]
shl edi, cl
mov ecx, dword [esi + 0x3c]
xor eax, edi
mov edi, dword [esi + 0x2c]
and eax, dword [esi + 0x4c]
and edi, edx
mov dword [esi + 0x40], eax
mov ax, word [ecx + eax*2]
mov word [ebx + edi*2], ax
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
mov word [ecx + eax*2], dx
inc edx
cmp edx, dword [ebp + 0xc]
jbe 0x8a3189
xor eax, eax
jmp 0x8a31cb
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x8a3996
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov ebx, dword [esi + 0x34]
mov ecx, dword [esi + 0x24]
sub ebx, dword [esi + 0x6c]
mov eax, dword [esi + 0x64]
lea ecx, [edi + ecx - 0x106]
sub ebx, eax
cmp eax, ecx
jb 0x8a3a1e
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.008a6f3d
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
mov dword [ebp + 8], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x8a39e1
mov eax, dword [esi + 0x38]
mov dword [ebp + 8], edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x8a3a03
add ebx, edi
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x8a3a79
mov ecx, dword [esi + 0x6c]
push ebx
add ecx, dword [esi + 0x64]
add ecx, dword [esi + 0x30]
push ecx
push eax
call fcn.008a3a7e
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x8a3a65
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x8a3a79
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x8a39a2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10001e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1003f4f8]
sub esp, 0x48
push ebx
xor ebx, ebx
push esi
mov ecx, ebx
add eax, 0x9c94d3e4
inc ecx
cmp byte [ecx + str.nouninstallsurvey], bl
jne 0x10001e41
mov edx, dword [ebp - 8]
push edi
cmp edx, ecx
jae 0x10001e7e
mov esi, eax
mov edi, eax
mov eax, edi
cmp edx, 0x17ce
jne 0x10001e6b
imul eax, esi, 0xe70a46b3
and eax, 0xa63fe97f
inc edx
mov dword [0x1003f4f8], eax
mov esi, eax
mov edi, esi
cmp edx, ecx
jb 0x10001e5b
or eax, 0xcb5e1ed2
mov esi, ebx
add eax, 0x42d3710e
add eax, 0xb6232736
inc esi
cmp byte [esi + str.is_a_celticsfan], bl
jne 0x10001e8a
cmp esi, 0x1270
mov edx, 0xf15f9dd6
mov edi, 0x67db00ad
mov ecx, ebx
cmovne edx, edi
xor edx, eax
imul edx, edx, 0x7bc8b98e
inc ecx
cmp word [ecx*2 + str.77_7k7u7z7], bx
jne 0x10001eaf
mov eax, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp eax, ecx
jae 0x10001eed
mov esi, edx
mov edi, edx
cmp eax, 0x116d
jne 0x10001edb
imul edi, esi, 0xb984df7f
lea edx, [edi - 0x647ea3e0]
inc eax
mov dword [ebp - 4], edx
mov esi, edx
mov edi, esi
cmp eax, ecx
jb 0x10001ece
push 0xc
pop ecx
mov esi, 0x10032658
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
push 0x53
pop ecx
mov eax, ebx
movsw word es:[edi], word [esi]
cmp cx, word [ebp - 0x48]
jne 0x10001f30
mov edx, ebx
test cx, cx
je 0x10001f27
cmp word [ebp + eax - 0x48], bx
je 0x10001f27
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.StripByteCounts]
cmp cx, word [ebp + eax - 0x48]
je 0x10001f09
mov dword [ebp - 8], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax*2 + str.StripByteCounts]
movzx eax, byte [ebp + eax*2 - 0x48]
sub ecx, eax
cmp ecx, 0xe37
jae 0x10001f4f
add edx, 0x2bd6816d
jmp 0x10001f55
or edx, 0x7ea06446
mov esi, str.stargard
lea edi, [ebp - 0x14]
lea eax, [edx - 0x1af8b792]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x14], 0x57
pop edi
jne 0x10001fa5
mov dl, 0x57
test dl, dl
je 0x10001f88
cmp byte [ebp + ecx - 0x14], bl
je 0x10001f88
mov dl, byte [ecx + 0x10032cf1]
inc ecx
cmp dl, byte [ebp + ecx - 0x14]
je 0x10001f71
mov edx, dword [ebp - 8]
jmp 0x10001fa1
cmp edx, 0x146d
jne 0x10001f9b
imul eax, eax, 0xb51cb22f
sub eax, 0x6e129b58
inc edx
cmp edx, ecx
jb 0x10001f8d
or eax, 0x20286132
add eax, 0x17fff83e
add eax, 0xa8200134
inc ebx
cmp byte [ebx + str.is_a_celticsfan], 0
jne 0x10001faf
mov ecx, dword [ebp - 8]
cmp ecx, ebx
jae 0x10001fe6
mov edx, eax
mov esi, eax
cmp ecx, 0x1225
lea eax, [edx - 0x2283e578]
cmovne eax, esi
xor eax, 0xaf819bd5
inc ecx
mov edx, eax
mov esi, eax
cmp ecx, ebx
jb 0x10001fc9
pop esi
mov ecx, str.nouninstallsurvey
pop ebx
imul eax, eax, 0x35818598
inc ecx
cmp byte [ecx], 0
jne 0x10001fed
and eax, 0x410de176
add eax, 0x34e70b7b
mov dword [0x1003f4f8], eax
leave
ret
Function at 0x1000200a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1003f438]
sub esp, 0x64
mov ecx, str.00040L00_0d0x00
push ebx
xor ebx, ebx
lea ecx, [ecx + 2]
xor eax, 0xc684fca9
cmp word [ecx], bx
jne 0x1000201d
mov ecx, ebx
xor eax, 0x2b68ed6a
inc ecx
cmp byte [ecx + str.GetModuleFileNameExW], bl
jne 0x1000202c
mov edx, dword [ebp - 4]
mov dword [0x1003f438], eax
push esi
push edi
cmp edx, ecx
jae 0x10002070
mov esi, eax
mov edi, eax
mov eax, edi
cmp edx, 0xa6
jne 0x1000205d
mov eax, esi
xor eax, 0xdc4b73c0
and eax, 0x426f23df
inc edx
mov dword [0x1003f438], eax
mov esi, eax
mov edi, esi
cmp edx, ecx
jb 0x1000204c
xor eax, 0xfbe3e7dd
mov ecx, str.xn__zf0avx
or eax, 0xf2c0c441
lea ecx, [ecx + 2]
and eax, 0x59c9584b
cmp word [ecx], bx
jne 0x1000207f
push 0x12
pop ecx
mov esi, str.5_6_6D6H6L6P6T6X66_6d6h6l6p6t6x66
imul edx, eax, 0xca117bfa
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
push 0x75
pop ecx
xor edx, 0x2c1a97dd
movsw word es:[edi], word [esi]
cmp cx, word [ebp - 0x64]
jne 0x100020ef
xor esi, esi
mov eax, esi
test cx, cx
je 0x100020d2
cmp word [ebp + eax - 0x64], si
je 0x100020d2
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.unknown_column___s__in_foreign_key_definition]
cmp cx, word [ebp + eax - 0x64]
je 0x100020b4
mov eax, dword [ebp - 4]
jmp 0x100020eb
cmp eax, 0x954
jne 0x100020e4
and edx, 0xa2f15778
or edx, 0x5b63abb0
inc eax
cmp eax, ebx
jb 0x100020d7
xor ebx, ebx
mov eax, ebx
add edx, 0x957da92e
inc eax
cmp byte [eax + str.GetModuleFileNameExW], bl
jne 0x100020f3
mov ecx, dword [ebp - 4]
cmp ecx, eax
jae 0x1000212c
mov esi, edx
mov edi, edx
mov edx, edi
cmp ecx, 0x3e2
jne 0x1000211d
imul edx, esi, 0xd2151c09
or edx, 0x5c2d42fd
inc ecx
mov esi, edx
mov edi, esi
cmp ecx, eax
jb 0x1000210d
mov esi, str.american_english
lea edi, [ebp - 0x18]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x4d
jne 0x1000215a
mov cl, 0x4d
test cl, cl
je 0x1000215a
cmp byte [ebp + eax - 0x18], bl
je 0x1000215a
mov cl, byte [eax + 0x10033061]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x10002143
movzx ecx, byte [eax + str.Method1_:_Found_mozilla_firefox_profile_directory:__s]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
cmp ecx, 0x578
jne 0x10002178
or edx, 0x6f5e7cae
jmp 0x1000217e
imul edx, edx, 0xcf107b4b
mov eax, ebx
or edx, 0x12ce4c96
inc eax
mov esi, edx
sub edx, 0x5f62b04b
cmp byte [eax + str.Method1_:_Found_mozilla_firefox_profile_directory:__s], bl
jne 0x10002186
cmp eax, 0x1a62
mov edx, str.oirm.gov
pop edi
sbb ecx, ecx
add esi, 0xde8090e3
and ecx, 0xd6ac68d3
add ecx, esi
pop esi
lea edx, [edx + 2]
and ecx, 0x2e2a21b0
cmp word [edx], bx
jne 0x100021b3
mov dword [0x1003f438], ecx
mov edx, ebx
xor ecx, 0x679cb99c
or ecx, 0x372b449c
inc edx
cmp word [edx*2 + str.._AVwxMessageOutputBase__], bx
jne 0x100021cf
mov eax, ecx
add ecx, 0x14d9a34d
xor eax, 0x59575c90
cmp edx, 0x1d10
pop ebx
cmovne ecx, eax
add ecx, 0x40051cb2
xor ecx, 0xf1b1c6cc
sub ecx, 0x246da7c7
mov dword [0x1003f438], ecx
leave
ret
Function at 0x10002aab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1003f41c]
sub esp, 0x2c
xor edx, edx
mov ecx, edx
push ebx
push esi
push edi
mov edi, dword [0x1003f44c]
lea esi, [edi - 0x43a150db]
xor eax, 0x72f444b7
inc ecx
cmp word [ecx*2 + str.xtLHtBHt_], dx
jne 0x10002ac9
mov edx, dword [ebp - 4]
cmp edx, ecx
jae 0x10002b00
mov eax, edi
or eax, 0x470be529
cmp edx, 0x11ac
jne 0x10002afb
mov esi, dword [0x1003f498]
and esi, 0xe1549120
inc edx
cmp edx, ecx
jb 0x10002ae7
imul ecx, esi, 0x55254174
xor eax, 0xc87227e
xor esi, esi
mov dword [0x1003f498], eax
mov eax, esi
lea ebx, [ecx - 0x1e232890]
and ecx, 0x324e6913
inc eax
cmp byte [eax + str.Data_with_provided_ID_doesnt_exist.], 0
jne 0x10002b1a
cmp eax, 0x1f7b
jbe 0x10002b3c
imul eax, ecx, 0x3bd5a7ea
mov dword [0x1003f498], eax
xor ecx, 0xd74ef7b4
lea edi, [ebp - 0x2c]
mov dword [0x1003f44c], ecx
xor ebx, 0xb6c89cd2
imul ecx, ebx, 0x1aa90cc0
mov esi, str._template_parameter
push 0xa
xor eax, eax
mov edx, eax
mov dword [0x1003f41c], ecx
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x53
pop ecx
cmp cx, word [ebp - 0x2c]
jne 0x10002bb8
xor esi, esi
test cx, cx
je 0x10002b94
cmp word [ebp + eax - 0x2c], si
je 0x10002b94
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.Service_was_stopped.]
cmp cx, word [ebp + eax - 0x2c]
je 0x10002b76
mov ecx, dword [ebp - 4]
jmp 0x10002bb4
cmp ecx, 0xfe7
jne 0x10002bad
mov eax, ebx
or eax, 0x4917485c
mov dword [0x1003f44c], eax
imul ebx, ebx, 0x8f8118e9
inc ecx
cmp ecx, edx
jb 0x10002b99
mov eax, dword [0x1003f41c]
pop edi
add eax, 0xa305916
pop esi
mov dword [0x1003f454], eax
pop ebx
leave
ret
Function at 0x10002d29
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x1003f3dc]
mov edx, dword [0x1003f414]
or eax, 0x69a991f8
push ebx
mov ebx, dword [0x1003f3b0]
xor edx, 0x84bda4ee
push esi
push edi
mov esi, str.VVVVUUTTTS
mov dword [ebp - 8], eax
lea edi, [ebp - 0x18]
and ebx, 0x95fea282
sub ebx, 0x69487800
xor eax, eax
mov dword [ebp - 0xc], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x64
jne 0x10002d92
mov cl, 0x64
test cl, cl
je 0x10002d92
cmp byte [ebp + eax - 0x18], 0
je 0x10002d92
mov cl, byte [eax + 0x10033099]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x10002d7a
movzx ecx, byte [eax + str.dreamspark.com]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
mov eax, dword [ebp - 8]
cmp ecx, 0xeb7
jne 0x10002db2
add eax, 0xc7d71476
jmp 0x10002db7
xor eax, 0x14ce32cc
mov ecx, str.Arabic__Morocco_
xor esi, esi
lea ecx, [ecx + 2]
imul eax, eax, 0x3eb8242
cmp word [ecx], si
jne 0x10002dbe
push 0x1e
pop ecx
mov dword [ebp - 4], esi
lea edi, [ebp - 0xb4]
mov esi, str.Trying_to_launch_default_browser_via_wxLaunchDefaultBrowser
mov dword [0x1003f3b0], eax
rep movsd dword es:[edi], dword [esi]
push 0x46
pop eax
xor edi, edi
cmp ax, word [ebp - 0xb4]
jne 0x10002e1f
mov ecx, edi
mov esi, eax
mov eax, ecx
test si, si
je 0x10002e1c
cmp word [ebp + ecx - 0xb4], di
je 0x10002e1c
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.Fax3Encode]
cmp si, word [ebp + ecx - 0xb4]
je 0x10002df8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx ecx, byte [eax*2 + str.Fax3Encode]
movzx eax, byte [ebp + eax*2 - 0xb4]
sub ecx, eax
cmp ecx, 0x1ef1
mov ecx, dword [ebp - 8]
jne 0x10002e4a
lea ebx, [ecx - 0x6fad4c27]
mov dword [ebp - 0xc], ebx
jmp 0x10002e4f
mov edx, 0x9f30499d
mov eax, edi
or edx, 0xffabe7cd
inc eax
cmp word [eax*2 + str.Fax3Encode], di
jne 0x10002e51
mov dword [0x1003f414], edx
cmp dword [ebp - 0xc], eax
jae 0x10002e78
lea eax, [ecx + 0xd542f04]
mov dword [0x1003f3b0], eax
push 9
pop ecx
lea eax, [edx - 0x2a24f0da]
mov dword [ebp - 4], edi
push 0x46
mov dword [0x1003f3dc], eax
lea edi, [ebp - 0x3c]
mov esi, str.3_3_343_3D3L3X3x3
pop eax
rep movsd dword es:[edi], dword [esi]
cmp ax, word [ebp - 0x3c]
jne 0x10002ec7
mov ebx, dword [ebp - 4]
xor esi, esi
mov ecx, esi
test ax, ax
je 0x10002ec1
cmp word [ebp + ecx - 0x3c], si
je 0x10002ec1
inc ebx
lea ecx, [ebx + ebx]
movzx eax, word [ecx + str.Fax3Encode]
cmp ax, word [ebp + ecx - 0x3c]
je 0x10002ea3
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax*2 + str.Fax3Encode]
movzx eax, byte [ebp + eax*2 - 0x3c]
sub ecx, eax
cmp ecx, 0x11f6
jne 0x10002eec
mov ebx, dword [ebp - 8]
or ebx, 0x72349f9a
jmp 0x10002ef8
and edx, 0xe3d39b2c
mov dword [0x1003f3b0], edx
mov eax, dword [0x1003f3dc]
xor ebx, 0xcd6be77a
pop edi
and eax, 0xe8b9909c
mov dword [0x1003f430], ebx
pop esi
mov dword [0x1003f3c4], eax
pop ebx
leave
ret