joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 9
pop ecx
mov esi, str.The_LZMA_stream_has_ended_prematurely_
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov eax, ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x48], 0x72
jne 0x1001e30c
mov cl, 0x72
test cl, cl
je 0x1001e30c
cmp byte [ebp + eax - 0x48], bl
je 0x1001e30c
mov cl, byte [eax + 0x100351e9]
inc eax
cmp cl, byte [ebp + eax - 0x48]
je 0x1001e2f5
movzx ecx, byte [eax + str.rcommaaccent]
movzx eax, byte [ebp + eax - 0x48]
mov edx, dword [0x1003d624]
sub ecx, eax
cmp ecx, 0xfc4
jb 0x1001e32e
sub edx, 0x46b3ff4c
push 0xf
pop ecx
mov esi, str.nc.moc.swanozama.1_htron_nc.3s
mov dword [ebp - 4], edx
lea edi, [ebp - 0x5c]
mov eax, edx
rep movsd dword es:[edi], dword [esi]
xor eax, 0x79b20f04
push 0x70
pop ecx
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc], eax
mov eax, ebx
cmp cx, word [ebp - 0x5c]
jne 0x1001e37e
mov edx, ebx
test cx, cx
je 0x1001e375
cmp word [ebp + eax - 0x5c], bx
je 0x1001e375
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.pehfinalarabic]
cmp cx, word [ebp + eax - 0x5c]
je 0x1001e357
mov dword [ebp - 8], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax*2 + str.pehfinalarabic]
movzx eax, byte [ebp + eax*2 - 0x5c]
sub ecx, eax
cmp ecx, 0xfb1
jae 0x1001e39e
imul edx, dword [ebp - 0xc], 0xb2503d7c
jmp 0x1001e3a4
and edx, 0x86d483f7
mov esi, str.muesum.sednal
lea edi, [ebp - 0x1c]
or edx, 0xecf4c0f4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x1c], 0x5c
jne 0x1001e3f4
mov al, 0x5c
test al, al
je 0x1001e3d7
cmp byte [ebp + ebx - 0x1c], 0
je 0x1001e3d7
mov al, byte [ebx + 0x10034da1]
inc ebx
cmp al, byte [ebp + ebx - 0x1c]
je 0x1001e3bf
mov eax, dword [ebp - 0xc]
jmp 0x1001e3f0
cmp eax, 0x10f0
jne 0x1001e3e9
imul edx, edx, 0x543b953b
and edx, 0x9efd25d8
inc eax
cmp eax, ebx
jb 0x1001e3dc
lea eax, [edx + 0x432b916f]
imul eax, eax, 0x904ca72a
pop edi
pop esi
pop ebx
add eax, 0x3011b76b
mov dword [0x1003d624], eax
imul eax, eax, 0xa3a0678c
mov dword [0x1003d628], eax
leave
ret
Function at 0x1001e41a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [0x1003d740]
or esi, 0xa3f4b6ac
xor ebx, ebx
push edi
mov edi, dword [0x1003d6d8]
mov eax, ebx
xor edi, 0x9e34e295
inc eax
cmp word [eax*2 + str.cilohtac], bx
jne 0x1001e439
mov ecx, dword [ebp - 4]
mov edx, dword [0x1003d6f0]
cmp ecx, eax
jae 0x1001e46e
cmp ecx, 0x1220
jne 0x1001e465
lea edx, [edi - 0x430f75f0]
imul esi, esi, 0xef7558b3
inc ecx
jmp 0x1001e453
push 5
pop ecx
mov esi, str.bdotbelow
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
push 0x50
pop ecx
cmp cx, word [ebp - 0x18]
jne 0x1001e4a6
xor esi, esi
mov eax, esi
test cx, cx
je 0x1001e4a6
cmp word [ebp + eax - 0x18], si
je 0x1001e4a6
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.Potential_overflow_in_png_zalloc__]
cmp cx, word [ebp + eax - 0x18]
je 0x1001e488
movzx ecx, byte [ebx*2 + str.Potential_overflow_in_png_zalloc__]
movzx eax, byte [ebp + ebx*2 - 0x18]
sub ecx, eax
cmp ecx, 0x81d
ja 0x1001e4c3
and edx, 0xee2c7e07
imul ecx, edx, 0x2a5f844d
mov eax, str.isInstalled
sub ecx, 0x7d725d4b
inc eax
cmp byte [eax], 0
jne 0x1001e4ce
mov eax, ecx
mov edx, ecx
xor eax, 0x828870cb
or edx, 0x9275e570
imul esi, eax, 0x80f98ca4
xor ebx, ebx
mov eax, ebx
add ecx, 0x54c4c66f
inc eax
cmp byte [eax + str.isInstalled], bl
jne 0x1001e4f3
cmp eax, 0x1d20
jae 0x1001e511
xor esi, 0x9e54d26e
jmp 0x1001e517
lea esi, [ecx - 0x42ddacc1]
mov eax, ebx
and edx, 0x1fba6031
inc eax
cmp byte [eax + str.com.avast.ipm.ClientParameters.AvastAccountEmail], bl
jne 0x1001e519
cmp eax, 0x1115
jne 0x1001e537
lea eax, [esi - 0x371b5623]
jmp 0x1001e53e
mov eax, ecx
and eax, 0x6127c5a
mov esi, ebx
or eax, 0xda240d74
inc esi
cmp byte [esi + str.endpoint_name], bl
jne 0x1001e540
mov edi, dword [ebp - 4]
mov dword [0x1003d740], eax
jmp 0x1001e574
cmp edi, 0x1fbd
jne 0x1001e56b
lea eax, [edx - 0x4aadfdb4]
mov dword [0x1003d740], eax
mov ecx, eax
and ecx, 0x218cec8f
inc edi
cmp edi, esi
jb 0x1001e558
mov esi, ebx
or edx, 0x72970d
inc esi
cmp word [esi*2 + str.avcfg:__settings_Common_ignore_expiring], bx
jne 0x1001e57a
mov dword [0x1003d6f0], edx
mov edx, dword [ebp - 4]
cmp edx, esi
jae 0x1001e5bd
mov eax, ecx
and eax, 0x78a8db8e
mov dword [0x1003d740], eax
cmp edx, 0x1d3d
jne 0x1001e5b8
mov eax, ecx
or eax, 0x96ad2cb0
mov dword [0x1003d6f0], eax
inc edx
cmp edx, esi
jb 0x1001e5a4
pop edi
add ecx, 0x2ed51927
pop esi
mov dword [0x1003d6d8], ecx
pop ebx
leave
ret
Function at 0x1001e6f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 7
pop ecx
mov esi, str.SEC_E_MAX_REFERRALS_EXCEEDED
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov eax, ebx
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x24], 0x64
jne 0x1001e731
mov cl, 0x64
test cl, cl
je 0x1001e731
cmp byte [ebp + eax - 0x24], bl
je 0x1001e731
mov cl, byte [eax + 0x100350c9]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0x1001e71a
movzx ecx, byte [eax + str.downtackmod]
movzx eax, byte [ebp + eax - 0x24]
mov edx, dword [0x1003d638]
sub ecx, eax
cmp ecx, 0x9ef
jbe 0x1001e75b
mov ecx, dword [0x1003d76c]
imul esi, ecx, 0x26fb0961
jmp 0x1001e76f
mov esi, dword [0x1003d6c8]
mov ecx, edx
and ecx, 0xc80213da
mov dword [0x1003d76c], ecx
mov eax, ebx
inc eax
cmp byte [eax + str.AvBehav_Flash], bl
jne 0x1001e771
cmp eax, 0x1136
je 0x1001e78d
imul ecx, esi, 0xaf44f383
mov dword [0x1003d76c], ecx
mov eax, ebx
inc eax
cmp byte [eax + str.still_pending], bl
jne 0x1001e78f
mov esi, dword [ebp - 4]
jmp 0x1001e7ac
cmp esi, 0x2301
jne 0x1001e7ab
lea edx, [ecx + 0xb566bf5]
inc esi
cmp esi, eax
jb 0x1001e79d
and edx, 0xc2ae2c7e
mov esi, ebx
inc esi
cmp word [esi*2 + str.avdef:__config_Tasklib_PerformanceLogMaxTotalSizeMB], bx
jne 0x1001e7b8
mov eax, dword [ebp - 4]
jmp 0x1001e7dc
cmp eax, 0x1592
jne 0x1001e7db
or ecx, 0x54738635
mov dword [0x1003d76c], ecx
inc eax
cmp eax, esi
jb 0x1001e7c8
pop edi
pop esi
mov eax, str._passwords:
pop ebx
xor edx, 0xd1ad4592
inc eax
cmp byte [eax], 0
jne 0x1001e7e8
and ecx, 0xbb855216
or edx, 0x13ed8381
mov dword [0x1003d718], ecx
mov dword [0x1003d638], edx
lea eax, [ecx + 0x25caf8d9]
mov dword [0x1003d6c8], eax
lea eax, [ecx - 0x21e28b9]
mov dword [0x1003d608], eax
leave
ret
Function at 0x1001ec13
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 7
pop ecx
mov esi, str.Internal_error
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
push 0x70
xor ebx, ebx
pop ecx
movsw word es:[edi], word [esi]
mov edx, ebx
cmp cx, word [ebp - 0x20]
jne 0x1001ec58
mov eax, ebx
test cx, cx
je 0x1001ec58
cmp word [ebp + eax - 0x20], bx
je 0x1001ec58
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.pj.akaso.otomamihs]
cmp cx, word [ebp + eax - 0x20]
je 0x1001ec3a
movzx ecx, byte [edx*2 + str.pj.akaso.otomamihs]
movzx eax, byte [ebp + edx*2 - 0x20]
mov esi, dword [0x1003d618]
sub ecx, eax
lea ebx, [esi - 0x47bb867c]
cmp ecx, 0x3a9
ja 0x1001ec81
mov ebx, dword [0x1003d788]
mov eax, str.alc_cmp_shredder
sub ebx, 0x4f661fbe
inc eax
cmp byte [eax], 0
jne 0x1001ec86
imul ecx, esi, 0x5854f1f7
mov eax, ecx
mov dword [0x1003d768], ecx
and eax, 0xfa06e321
xor edi, edi
mov dword [0x1003d720], eax
mov eax, edi
sub ebx, 0x2a573b0d
inc eax
cmp word [eax*2 + str.pj.akaso.otomamihs], di
jne 0x1001ecae
cmp eax, 0x1589
jbe 0x1001ecda
mov edx, dword [0x1003d648]
sub ecx, 0x2268259
mov dword [0x1003d768], ecx
jmp 0x1001ece8
mov edx, esi
or edx, 0xcc024512
mov dword [0x1003d648], edx
lea eax, [esi - 0x5cb4452d]
and esi, 0x7387c07d
mov dword [0x1003d618], esi
mov esi, str.WinHttpSetTimeouts_failed.
push 0xd
mov dword [0x1003d784], eax
mov eax, edi
pop ecx
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
push 0x6f
movsw word es:[edi], word [esi]
pop esi
cmp si, word [ebp - 0x38]
jne 0x1001ed3b
xor edi, edi
mov ecx, edi
test si, si
je 0x1001ed3b
cmp word [ebp + ecx - 0x38], di
je 0x1001ed3b
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.oshortvowelsigndeva]
cmp si, word [ebp + ecx - 0x38]
je 0x1001ed1d
movzx ecx, byte [eax*2 + str.oshortvowelsigndeva]
movzx eax, byte [ebp + eax*2 - 0x38]
sub ecx, eax
cmp ecx, 0x155a
jne 0x1001ed5c
mov ebx, edx
xor ebx, 0x9139a6f
jmp 0x1001ed62
add ebx, 0xfb22e237
pop edi
pop esi
mov dword [0x1003d788], ebx
mov eax, edx
pop ebx
leave
ret
Function at 0x1001f88a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003d6a0]
push ebx
push esi
push edi
push 5
pop ecx
mov esi, str.load_page
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
push 0x74
add eax, 0x16cf0244
xor ebx, ebx
pop esi
mov dword [ebp - 4], eax
mov dword [0x1003d61c], eax
cmp si, word [ebp - 0x18]
jne 0x1001f919
mov edx, ebx
mov ecx, ebx
test si, si
je 0x1001f8df
cmp word [ebp + edx - 0x18], bx
je 0x1001f8df
inc ecx
lea edx, [ecx + ecx]
movzx esi, word [edx + 0x100350e0]
cmp si, word [ebp + edx - 0x18]
je 0x1001f8c1
mov edx, dword [ebp - 4]
cmp edx, ecx
jae 0x1001f919
mov eax, dword [0x1003d604]
mov ebx, dword [ebp - 4]
add eax, 0x12dba569
mov dword [0x1003d5f0], eax
cmp edx, 0xf31
jne 0x1001f90c
add ebx, 0x4750b28b
mov dword [0x1003d61c], ebx
inc edx
cmp edx, ecx
jb 0x1001f8f8
mov dword [ebp - 4], ebx
xor ebx, ebx
mov eax, dword [ebp - 4]
and eax, 0x12b0f529
mov dword [0x1003d6a0], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 5
pop ecx
mov esi, str.LeakedRequest.dat
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x18], 0x47
jne 0x1001f956
mov al, 0x47
test al, al
je 0x1001f956
cmp byte [ebp + ebx - 0x18], 0
je 0x1001f956
mov al, byte [ebx + 0x100351b1]
inc ebx
cmp al, byte [ebp + ebx - 0x18]
je 0x1001f93e
movzx ecx, byte [ebx + str.Getting_latest_definition_from_resources.ini_failed_]
movzx eax, byte [ebp + ebx - 0x18]
pop edi
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0x21db
jne 0x1001f97e
mov eax, dword [0x1003d5f0]
add eax, 0x699d1f49
mov dword [0x1003d6a0], eax
mov eax, dword [0x1003d604]
or eax, 0x205f066b
mov dword [0x1003d604], eax
leave
ret
Function at 0x10022001
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0xa
pop ecx
mov esi, str.SmartHomeIspContract
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
push 0x53
xor edx, edx
mov eax, edx
movsw word es:[edi], word [esi]
pop esi
cmp si, word [ebp - 0x3c]
jne 0x10022046
mov ecx, edx
test si, si
je 0x10022046
cmp word [ebp + ecx - 0x3c], dx
je 0x10022046
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.SEC_E_REVOCATION_OFFLINE_C]
cmp si, word [ebp + ecx - 0x3c]
je 0x10022028
movzx ecx, byte [eax*2 + str.SEC_E_REVOCATION_OFFLINE_C]
movzx eax, byte [ebp + eax*2 - 0x3c]
mov edi, dword [0x1003d7d4]
sub ecx, eax
cmp ecx, 0x50
mov ecx, dword [0x1003d7ec]
jne 0x1002206f
mov eax, edi
or eax, 0xab6a98b1
jmp 0x1002207a
mov eax, dword [0x1003d88c]
add ecx, 0x36975022
mov ebx, dword [0x1003d7c4]
mov esi, edx
sub ebx, 0x42d6d5db
add eax, 0xeaabf61f
inc esi
cmp byte [esi + str.on.netol], dl
jne 0x10022088
cmp dword [ebp - 4], esi
jae 0x100220a1
imul ebx, edi, 0x97f0e62d
mov esi, edx
imul eax, eax, 0x911c7472
inc esi
mov dword [0x1003d88c], eax
cmp byte [esi + str.license.avastbs], dl
jne 0x100220a3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jae 0x100220c5
lea ebx, [ecx + 0x4a4e7e43]
lea eax, [ecx + 0x34ef833c]
mov ecx, edx
mov dword [0x1003d7d4], eax
mov eax, dword [0x1003d8a0]
add eax, 0x96804042
imul esi, eax, 0xdf1b379a
inc ecx
cmp word [ecx*2 + str.SEC_E_REVOCATION_OFFLINE_C], dx
jne 0x100220e2
mov eax, dword [ebp - 4]
jmp 0x10022102
cmp eax, 0x986
jne 0x10022101
mov esi, ebx
xor esi, 0xae4a0850
inc eax
cmp eax, ecx
jb 0x100220f2
lea eax, [esi + 0x73409c84]
mov esi, str.integral
lea edi, [ebp - 0x10]
mov dword [0x1003d90c], eax
imul eax, ebx, 0xdcca8a44
movsd dword es:[edi], dword [esi]
mov dword [0x1003d7ec], eax
add eax, 0x932fee56
movsd dword es:[edi], dword [esi]
mov dword [0x1003d8a0], eax
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x62
jne 0x10022151
mov al, 0x62
test al, al
je 0x10022151
cmp byte [ebp + edx - 0x10], 0
je 0x10022151
mov al, byte [edx + 0x100368ed]
inc edx
cmp al, byte [ebp + edx - 0x10]
je 0x10022139
movzx ecx, byte [edx + str.bgui.exe]
movzx eax, byte [ebp + edx - 0x10]
sub ecx, eax
cmp ecx, 0x277
jae 0x10022178
mov eax, dword [0x1003d7d4]
add eax, 0xfb238f71
mov dword [0x1003d8a0], eax
jmp 0x10022182
add dword [0x1003d7ec], 0x14b5b1ca
mov eax, dword [ebp - 4]
or ebx, 0x3b7bf4a6
pop edi
pop esi
mov dword [0x1003d7c4], ebx
pop ebx
leave
ret
Function at 0x10022ad9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1003d8b0]
or eax, 0x348cbf45
xor edx, edx
push ebx
mov dword [ebp - 0xc], eax
mov ecx, edx
lea ebx, [eax - 0x4fde3e8b]
mov dword [ebp - 8], ebx
inc ecx
cmp byte [ecx + str.moc.rehcaet_a_si], dl
jne 0x10022afa
push esi
mov esi, dword [ebp - 0x10]
push edi
cmp esi, ecx
jae 0x10022b30
mov edx, ebx
cmp esi, 0x684
jne 0x10022b1c
lea eax, [edx - 0x9558d27]
mov ebx, eax
xor ebx, 0xb93d4129
inc esi
cmp esi, ecx
jb 0x10022b0e
mov dword [ebp - 0xc], eax
xor edx, edx
jmp 0x10022b36
mov ebx, dword [0x1003d800]
mov esi, str.PolyLine
mov dword [ebp - 0x10], 0x6d
lea edi, [ebp - 0x1c]
mov ecx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x6d
jne 0x10022b90
mov byte [ebp - 1], 0x6d
xor edx, edx
mov al, byte [ebp - 1]
test al, al
je 0x10022b70
cmp byte [ebp + ecx - 0x1c], dl
je 0x10022b70
mov al, byte [ecx + 0x100365d1]
inc ecx
cmp al, byte [ebp + ecx - 0x1c]
je 0x10022b59
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
jmp 0x10022b8c
cmp esi, 0x13db
jne 0x10022b86
and ebx, 0xe40e9431
and eax, 0x15ac24bb
inc esi
cmp esi, ecx
jb 0x10022b78
mov esi, str.System_date
lea edi, [ebp - 0x1c]
mov eax, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x1c], 0x6d
jne 0x10022bd6
mov ecx, dword [ebp - 0x10]
test cl, cl
je 0x10022bbe
cmp byte [ebp + eax - 0x1c], 0
je 0x10022bbe
mov cl, byte [eax + 0x10036781]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x10022ba6
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
jae 0x10022bd9
sub eax, dword [ebp - 0x10]
xor ecx, 0xd1717c8f
sub eax, 1
jne 0x10022bc9
jmp 0x10022bd9
mov ecx, dword [ebp - 8]
imul ebx, ecx, 0x41ef8189
lea edi, [ebp - 0x58]
push 0xe
pop ecx
mov esi, str.packet_responder_endpoint:_invalid_communication_protocol_
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx - 0x7b040b4f]
mov dword [ebp - 0x10], eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x58], 0x70
pop edi
pop esi
jne 0x10022c36
mov al, 0x70
test al, al
je 0x10022c1a
cmp byte [ebp + edx - 0x58], 0
je 0x10022c1a
mov al, byte [edx + 0x10036591]
inc edx
cmp al, byte [ebp + edx - 0x58]
je 0x10022c02
mov eax, dword [ebp - 0x10]
cmp eax, edx
jae 0x10022c36
mov ecx, dword [ebp - 0x10]
cmp eax, 0x208c
jne 0x10022c31
lea ebx, [ecx - 0x23bcf2]
inc eax
cmp eax, edx
jb 0x10022c24
imul ecx, ebx, 0xbeb5079d
pop ebx
imul eax, ecx, 0x4132dd97
mov dword [0x1003d878], ecx
or eax, 0x73c78e5e
mov dword [0x1003d8b0], eax
lea eax, [ecx + 0x452f2b21]
mov dword [0x1003d800], eax
leave
ret
Function at 0x10022dfc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 7
imul ebx, dword [0x1003d7b0], 0x9ce52258
lea edi, [ebp - 0x24]
pop ecx
mov esi, str.moc.swanozama.1_lartnec_ac_3s
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov eax, edx
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x24], 0x69
jne 0x10022e54
mov cl, 0x69
test cl, cl
je 0x10022e41
cmp byte [ebp + eax - 0x24], dl
je 0x10022e41
mov cl, byte [eax + 0x100362b9]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0x10022e2a
cmp dword [ebp - 4], eax
jae 0x10022e54
add ebx, 0xa6e57dc6
mov dword [0x1003d900], ebx
jmp 0x10022e5a
mov ebx, dword [0x1003d900]
mov eax, edx
mov edx, dword [0x1003d7b8]
and edx, 0x5fbb03d6
xor edi, edi
inc eax
cmp word [eax*2 + str.lp.vog.wopu], di
jne 0x10022e6a
mov ecx, dword [ebp - 4]
jmp 0x10022e89
cmp ecx, 0x2181
jne 0x10022e88
imul edx, ebx, 0x27ecbd32
inc ecx
cmp ecx, eax
jb 0x10022e7a
mov eax, ebx
mov esi, str.DecodeParms
and eax, 0x868b2111
mov dword [ebp - 4], eax
mov eax, edi
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x14], 0x47
jne 0x10022ec4
mov cl, 0x47
test cl, cl
je 0x10022ec4
cmp byte [ebp + eax - 0x14], 0
je 0x10022ec4
mov cl, byte [eax + 0x100368a1]
inc eax
cmp cl, byte [ebp + eax - 0x14]
je 0x10022eac
movzx ecx, byte [eax + str.GrammarlyInstallationStatus]
movzx eax, byte [ebp + eax - 0x14]
sub ecx, eax
cmp ecx, 0x26df
jbe 0x10022ee3
imul edx, dword [ebp - 4], 0xbdbf38c7
jmp 0x10022ee9
or edx, 0xd728356a
mov ecx, dword [0x1003d900]
or ebx, 0x54046038
mov eax, ecx
mov dword [0x1003d7b0], edx
and eax, 0x44082002
mov dword [0x1003d82c], ebx
or eax, 0x29715ef8
xor edi, edi
mov dword [0x1003d8d8], eax
mov esi, edi
imul eax, edx, 0x72232e3c
mov dword [0x1003d7b8], eax
inc esi
cmp word [esi*2 + str.lp.vog.wopu], di
jne 0x10022f21
mov eax, dword [ebp - 4]
cmp eax, esi
jae 0x10022f57
and ecx, 0x5941b456
mov dword [0x1003d8d8], ecx
cmp eax, 0x12db
jne 0x10022f52
imul ebx, edx, 0xd3ffd156
mov dword [0x1003d82c], ebx
inc eax
cmp eax, esi
jb 0x10022f3f
push 5
mov eax, edi
mov esi, str.BcBootScan
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
push 0x74
movsw word es:[edi], word [esi]
pop esi
cmp si, word [ebp - 0x1c]
jne 0x10022f93
xor edi, edi
mov ecx, edi
test si, si
je 0x10022f93
cmp word [ebp + ecx - 0x1c], di
je 0x10022f93
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.thousandsseparatorpersian]
cmp si, word [ebp + ecx - 0x1c]
je 0x10022f75
movzx ecx, byte [eax*2 + str.thousandsseparatorpersian]
movzx eax, byte [ebp + eax*2 - 0x1c]
sub ecx, eax
cmp ecx, 0x2420
jae 0x10022fb8
xor ebx, 0xd653c933
mov dword [0x1003d7b0], ebx
jmp 0x10022fc3
lea eax, [edx - 0x37571039]
mov dword [0x1003d8d8], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100231d3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor eax, eax
mov ecx, dword [ebp + 0xc]
push edi
mov edi, edx
movzx ebx, word [ecx]
movzx edx, word [edi]
test bx, bx
je 0x1002320b
xor edx, edx
inc eax
cmp word [ecx + eax*2], dx
jne 0x100231ef
movzx edx, word [edi]
cmp eax, 0xf70
jne 0x1002320b
lea eax, [esi - 0x3bd83ad7]
mov dword [0x1003d838], eax
xor eax, eax
mov ecx, eax
test dx, dx
je 0x10023238
imul eax, esi, 0x5c5d2ab0
mov dword [0x1003d838], eax
xor eax, eax
inc ecx
cmp word [edi + ecx*2], ax
jne 0x10023221
cmp dword [ebp + 0xc], ecx
jae 0x10023238
lea eax, [esi - 0x6e42354c]
mov dword [0x1003d838], eax
test bx, bx
je 0x10023249
mov eax, esi
xor eax, 0x54757fc7
mov dword [0x1003d838], eax
xor ecx, ecx
lea edx, [esi - 0x7c426b]
mov eax, ecx
mov dword [0x1003d7c8], edx
inc eax
cmp word [eax*2 + str.on.asiar], cx
jne 0x10023259
mov ecx, dword [ebp + 8]
cmp dword [ebp + 0xc], eax
jae 0x10023277
lea eax, [ecx - 0x5f7fd6ec]
mov dword [0x1003d838], eax
movzx eax, word [edi]
test ax, ax
je 0x10023295
xor eax, eax
lea edi, [edi + 2]
and edx, 0xb01597d6
cmp word [edi], ax
jne 0x10023281
mov dword [0x1003d7c8], edx
pop edi
lea eax, [esi - 0x1e7d029e]
test bx, bx
pop esi
mov dword [0x1003d7b4], eax
pop ebx
je 0x100232b4
or ecx, 0xa12492a3
mov dword [0x1003d7b4], ecx
pop ebp
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x45473d6c
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..text_1
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x59f5477e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401ce0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
test byte [0x40701c], 1
jne 0x401cfc
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ExitProcess]
xor eax, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__d__semi_stub:_no_script_engine_clean_up_n
mov dword [esp + 8], str.Host_Quit
mov dword [esp + 4], 0x40701c
mov dword [esp], eax
call sym._wine_dbg_log.constprop.0_1
jmp 0x401cf3
Function at 0x405270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4052c8
cmp byte [esi + ebx - 1], 0xa
je 0x40529c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x413304], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x405e40
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x405eb0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x405f07
xor ecx, ecx
xor edx, edx
jmp 0x405ee9
cmp ax, 0x5c
jne 0x405f70
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x405f07
cmp ax, 9
je 0x405ef5
cmp ax, 0x20
jne 0x405ed0
test ecx, ecx
je 0x405f58
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x405ee9
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x405f90
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x405f58
cmp ax, 0x20
je 0x405f58
jmp 0x405f07
cmp ax, 0x22
jne 0x405ef9
and edx, 1
jne 0x405ef9
xor ecx, 1
jmp 0x405edd
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x405f20