joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100164cd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [0x1003f038]
xor eax, eax
push esi
push edi
or ebx, 0xf0bfdd10
lea edi, [ebp - 0x18]
xor ebx, 0x5e38be92
mov esi, str.pj.iromoa.ehonihcah
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x18], 0x70
lea edx, [ebx - 0x1baee93c]
jne 0x1001653d
mov cl, 0x70
test cl, cl
je 0x1001651d
cmp byte [ebp + eax - 0x18], 0
je 0x1001651d
mov cl, byte [eax + 0x10034a85]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x10016505
mov ecx, dword [ebp - 4]
jmp 0x10016539
cmp ecx, 0xfa4
jne 0x10016532
mov ebx, edx
or ebx, 0xb889939c
add ebx, 0x604007ec
inc ecx
cmp ecx, eax
jb 0x10016522
pop edi
and edx, 0x5909008
mov eax, str.LOCALDOMAIN
pop esi
or edx, 0x220a4846
xor ecx, ecx
pop ebx
lea eax, [eax + 2]
xor edx, 0xfdf7aa0
cmp word [eax], cx
jne 0x10016553
xor edx, 0x70b342ab
imul eax, edx, 0x48043aa4
or edx, 0x1b0e2d2d
add eax, 0xfdc3e2e6
or eax, 0xe4099fee
inc ecx
cmp byte [ecx + str.pj.amnug.aro], 0
jne 0x10016578
cmp ecx, 0x4da
jne 0x10016596
mov eax, edx
xor eax, 0x6adb731a
add eax, 0x6c370673
mov dword [0x1003f228], eax
add eax, 0x168aa1c1
mov dword [0x1003f038], eax
leave
ret
Function at 0x100165ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [0x1003f05c]
xor edx, edx
push esi
push edi
mov esi, str.TTTtSSS2
imul eax, ebx, 0xfad10aab
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], eax
mov eax, edx
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x67
jne 0x100165f2
mov cl, 0x67
test cl, cl
je 0x100165f2
cmp byte [ebp + eax - 0x18], dl
je 0x100165f2
mov cl, byte [eax + 0x100344fd]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x100165db
movzx ecx, byte [eax + str.gb.topsgolb]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
mov eax, dword [ebp - 8]
cmp ecx, 0x26b7
je 0x10016610
add eax, 0x3175e294
add ebx, 0x3d494762
mov ecx, str.zedescendercyrillic
lea ecx, [ecx + 2]
xor eax, 0x234ecb2c
cmp word [ecx], dx
jne 0x1001661b
imul ecx, ebx, 0xaa559e97
mov eax, edx
mov dword [ebp - 0xc], ecx
add ebx, 0x4b0d5c33
inc eax
cmp word [eax*2 + str.Helvetica_Oblique], dx
jne 0x10016633
cmp eax, 0xbd4
jbe 0x10016654
mov eax, ecx
and eax, 0x470084b5
jmp 0x1001665a
lea eax, [ecx + 0x952b207]
push 5
pop ecx
mov esi, str.app.utils.AvCommand
mov dword [ebp - 8], eax
lea edi, [ebp - 0x24]
mov dword [str.bKLex_r], eax
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x24], 0x67
jne 0x100166bb
push 0x67
mov ecx, edx
pop eax
test al, al
je 0x10016691
cmp byte [ebp + ecx - 0x24], dl
je 0x10016691
mov al, byte [ecx + 0x100344fd]
inc ecx
cmp al, byte [ebp + ecx - 0x24]
je 0x1001667a
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
jmp 0x100166b7
cmp esi, 0xd7a
jne 0x100166a7
or ebx, 0x3a48fa1b
mov eax, ebx
or eax, 0xdb546846
inc esi
mov dword [ebp - 8], eax
mov dword [str.bKLex_r], eax
cmp esi, ecx
jb 0x10016699
mov esi, str.ViewState
lea edi, [ebp - 0x18]
mov ecx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x18], 0x2e
jne 0x10016719
mov byte [ebp - 1], 0x2e
xor edx, edx
mov al, byte [ebp - 1]
test al, al
je 0x100166ef
cmp byte [ebp + ecx - 0x18], dl
je 0x100166ef
mov al, byte [ecx + 0x10034dd1]
inc ecx
cmp al, byte [ebp + ecx - 0x18]
je 0x100166d8
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp esi, ecx
jae 0x10016719
mov edi, dword [ebp - 0xc]
cmp esi, 0x196b
jne 0x1001670c
mov ebx, edi
xor ebx, 0xd2b9442b
mov edi, ebx
or edi, 0x3e4c2f57
inc esi
cmp esi, ecx
jb 0x100166fc
push 5
pop ecx
mov esi, str.Avast_Password_Manager
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
xor ebx, 0x197792c2
mov dword [0x1003f05c], ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x24], 0x6f
jne 0x10016774
mov cl, 0x6f
test cl, cl
je 0x10016757
cmp byte [ebp + edx - 0x24], 0
je 0x10016757
mov cl, byte [edx + 0x10034479]
inc edx
cmp cl, byte [ebp + edx - 0x24]
je 0x1001673f
mov ecx, dword [ebp - 0xc]
jmp 0x10016770
cmp ecx, 0x428
jne 0x1001676f
lea eax, [ebx + 0x17065b86]
mov dword [str.bKLex_r], eax
inc ecx
cmp ecx, edx
jb 0x1001675c
mov ecx, eax
pop edi
or ecx, 0xff0bad34
sub ecx, 0x4f189b19
pop esi
mov dword [0x1003f26c], ecx
pop ebx
leave
ret
Function at 0x1001725a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x1003f2c4]
sub esp, 0x20
push esi
mov esi, dword [0x1003f0fc]
add esi, 0xd4cfbe9
xor edx, edx
mov eax, edx
add ecx, 0xd784833a
inc eax
cmp byte [eax + str.SetLanguages___failed.], dl
jne 0x10017277
push ebx
push edi
cmp eax, 0x1444
jbe 0x1001729b
mov eax, dword [0x1003f298]
add eax, 0xc56ba3a4
jmp 0x100172a6
mov eax, dword [0x1003f1f0]
imul ecx, ecx, 0x867dd275
mov dword [ebp - 4], eax
mov edi, ecx
lea eax, [esi + 0x76063102]
imul ebx, edi, 0xa657bfce
imul esi, eax, 0x40a872e9
lea edi, [ebp - 0x20]
push 0x2e
mov dword [0x1003f298], eax
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 0xc], esi
mov esi, str.SF020000
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
cmp di, word [ebp - 0x20]
jne 0x10017313
mov esi, edx
test di, di
je 0x10017301
cmp word [ebp + esi - 0x20], dx
je 0x10017301
inc ebx
lea esi, [ebx + ebx]
movzx edi, word [esi + str.._AVAvBehav_ProgressAnim__]
cmp di, word [ebp + esi - 0x20]
je 0x100172e3
cmp dword [ebp - 0xc], ebx
jae 0x10017313
mov eax, dword [ebp - 4]
xor eax, 0x8c1b5df3
mov dword [0x1003f298], eax
pop edi
mov esi, edx
pop ebx
xor ecx, 0x7ebe3aa8
inc esi
cmp byte [esi + str.ieungacirclekorean], dl
jne 0x10017317
mov dword [0x1003f2c4], ecx
cmp esi, 0x2d6
jae 0x10017343
mov ecx, dword [ebp - 8]
or ecx, 0x502560e9
mov dword [0x1003f2c4], ecx
inc edx
cmp byte [edx + str.expFileCreationFailed], 0
jne 0x10017343
mov esi, dword [ebp - 0xc]
jmp 0x10017367
cmp esi, 0x849
jne 0x10017366
mov eax, ecx
xor eax, 0xf66ececf
mov dword [0x1003f298], eax
inc esi
cmp esi, edx
jb 0x10017352
mov edx, dword [ebp - 0xc]
add ecx, 0xce1fb57b
and edx, 0xaa5bf3cf
mov dword [0x1003f1f0], ecx
xor ecx, 0x45e89039
mov dword [0x1003f2b8], edx
mov dword [0x1003f0fc], ecx
pop esi
leave
ret

Function at 0x10017395
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1003f0d0]
mov edx, str.ideographicsuperviseparen
xor ecx, ecx
lea edx, [edx + 2]
xor eax, 0xeff9297d
cmp word [edx], cx
jne 0x100173a1
inc ecx
cmp byte [ecx + str.bqsquare], 0
jne 0x100173ae
cmp ecx, 0x4a
jb 0x100173c7
add eax, 0x1177e017
xor eax, 0x56aa160d
imul eax, eax, 0x674d6c43
mov dword [0x1003f270], eax
and eax, 0xd2ff9427
mov dword [0x1003f0d0], eax
and eax, 0x22534704
or eax, 0x98ac20ca
mov dword [0x1003f0d8], eax
ret
Function at 0x10017d3d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
mov al, byte [ecx]
mov byte [ebp - 1], al
test al, al
mov eax, dword [0x1003f0b8]
je 0x10017d7e
and eax, 0xf776d6eb
inc esi
cmp byte [esi + ecx], bl
jne 0x10017d5f
cmp esi, 0x361
jne 0x10017d7e
mov eax, dword [0x1003f240]
and eax, 0x3bcca8ba
jmp 0x10017d83
or eax, 0x916e8121
or eax, 0xb09fa83b
mov ecx, 0x98220eca
imul eax, eax, 0x38bfb49f
mov edx, ebx
sub ecx, eax
lea eax, [ecx + 0x31e1543]
imul eax, eax, 0xcae16352
xor eax, 0xfe4baf3b
or eax, 0xa80ba23a
mov ecx, eax
or ecx, 0xcd063723
inc edx
cmp word [edx*2 + str.pj.atagamay.ataganuf], bx
jne 0x10017db5
cmp dword [ebp + 8], edx
jae 0x10017dcd
mov ecx, eax
and ecx, 0x59268e95
mov edx, ebx
movzx ebx, word [edi]
test bx, bx
je 0x10017df2
mov ecx, eax
and ecx, 0x2ae90ce3
xor esi, esi
inc edx
cmp word [edi + edx*2], si
jne 0x10017de1
cmp edx, 0x25f0
je 0x10017e05
jmp 0x10017df4
xor esi, esi
add ecx, 0x6759619f
mov dword [0x1003f0b8], ecx
test bx, bx
je 0x10017e13
mov ecx, eax
xor ecx, 0x78065499
mov dword [0x1003f0b8], ecx
cmp byte [ebp - 1], 0
je 0x10017e52
mov edx, dword [ebp + 8]
xor ecx, 0x6fb32778
inc esi
cmp byte [esi + edx], 0
jne 0x10017e1c
mov edx, dword [ebp + 8]
mov dword [0x1003f0b8], ecx
jmp 0x10017e4e
cmp edx, 0xeb3
jne 0x10017e48
lea ecx, [eax - 0x328813fa]
mov dword [0x1003f0b8], ecx
xor eax, 0xd29097fc
inc edx
cmp edx, esi
jb 0x10017e34
test bx, bx
je 0x10017e68
xor ebx, ebx
lea edi, [edi + 2]
xor eax, 0x99f84658
cmp word [edi], bx
jne 0x10017e59
jmp 0x10017e6a
xor ebx, ebx
mov esi, dword [ebp - 8]
mov edx, ebx
cmp word [esi], bx
je 0x10017e99
mov ecx, eax
xor ecx, 0x324f1e48
mov dword [0x1003f0b8], ecx
inc edx
cmp word [esi + edx*2], bx
jne 0x10017e82
cmp edx, 0x29e
jb 0x10017e99
imul eax, ecx, 0x9fac754b
jmp 0x10017e9e
and eax, 0xc4b2eeaa
mov edx, str.on.ladnera
lea edx, [edx + 2]
or eax, 0x749bad70
cmp word [edx], bx
jne 0x10017ea3
pop edi
pop esi
mov dword [0x1003f240], eax
mov eax, ecx
pop ebx
leave
ret

Function at 0x10017f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
imul ebx, dword [0x1003f2c0], 0xfcaef5b5
xor eax, eax
push esi
push edi
push 5
pop ecx
mov esi, str.esuperior
mov dword [0x1003f2e4], ebx
lea edi, [ebp - 0x18]
mov edx, eax
rep movsd dword es:[edi], dword [esi]
push 0x62
pop ecx
xor edi, edi
cmp cx, word [ebp - 0x18]
jne 0x10017fd9
test cx, cx
je 0x10017fa3
cmp word [ebp + eax - 0x18], di
je 0x10017fa3
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.backup_blob]
cmp cx, word [ebp + eax - 0x18]
je 0x10017f85
mov ecx, dword [ebp - 4]
cmp ecx, edx
jae 0x10017fd9
mov esi, dword [0x1003f2c0]
mov eax, dword [0x1003f2e8]
add esi, 0xae395ff7
cmp ecx, 0x19bb
jne 0x10017fca
mov eax, ebx
or eax, 0x7077f829
inc ecx
mov ebx, esi
cmp ecx, edx
jb 0x10017fbb
mov dword [0x1003f2e4], ebx
jmp 0x10017fde
mov eax, dword [0x1003f2e8]
mov ecx, str.backup_blob
lea ecx, [ecx + 2]
xor eax, 0x90d6c588
cmp word [ecx], di
jne 0x10017fe3
pop edi
pop esi
mov dword [0x1003f2e8], eax
pop ebx
leave
ret
Function at 0x1001867d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0xa
pop ecx
mov esi, str.HTMLayout_UseElement
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
push 0x63
xor ebx, ebx
pop ecx
movsw word es:[edi], word [esi]
mov edx, ebx
cmp cx, word [ebp - 0x44]
jne 0x100186c2
mov eax, ebx
test cx, cx
je 0x100186c2
cmp word [ebp + eax - 0x44], bx
je 0x100186c2
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str.com.avast.ipm.ClientParameters.BreachGuardLicenseNumber]
cmp cx, word [ebp + eax - 0x44]
je 0x100186a4
mov edx, dword [0x1003f208]
lea edi, [ebp - 0x18]
mov esi, str.pj.akoukuf.atumo
lea eax, [edx - 0x3a1de5f9]
movsd dword es:[edi], dword [esi]
mov dword [0x1003f104], eax
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x62
jne 0x10018701
mov cl, 0x62
test cl, cl
je 0x10018701
cmp byte [ebp + eax - 0x18], bl
je 0x10018701
mov cl, byte [eax + 0x10034ae5]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x100186ea
movzx ecx, byte [eax + str.beginbfrange]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
cmp ecx, 0x1f02
je 0x10018723
and edx, 0xe43b7d87
mov dword [0x1003f208], edx
mov eax, dword [0x1003f104]
or eax, 0x3ec95bde
and edx, 0x64dad124
mov dword [0x1003f06c], eax
mov eax, str.saraamthai
imul edx, edx, 0x7f2ba387
inc eax
cmp byte [eax], bl
jne 0x1001873d
mov dword [0x1003f14c], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 9
pop ecx
mov esi, str.app.pam.onStatusChanged.vaultLocked
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x40], 0x73
lea edx, [eax - 0x6d6422a2]
jne 0x10018788
mov cl, 0x73
mov eax, ebx
test cl, cl
je 0x10018788
cmp byte [ebp + eax - 0x40], bl
je 0x10018788
mov cl, byte [eax + 0x10034e41]
inc eax
cmp cl, byte [ebp + eax - 0x40]
je 0x10018771
mov eax, str.saraamthai
xor edx, 0xde44a052
inc eax
cmp byte [eax], bl
jne 0x1001878d
mov eax, dword [0x1003f208]
mov ecx, ebx
mov edx, eax
and edx, 0x130f24c1
mov dword [0x1003f14c], edx
inc ecx
cmp word [ecx*2 + str.param_int_1], bx
jne 0x100187ad
cmp dword [ebp - 4], ecx
jae 0x100187c8
lea eax, [edx + 0x2485bf05]
mov dword [0x1003f208], eax
or eax, 0x40b04391
imul ecx, dword [0x1003f06c], 0x3806a10
mov dword [0x1003f104], eax
mov dword [0x1003f278], ecx
inc ebx
cmp byte [ebx + str.com.avast.passwdmgr.proto.CreateUnlockKeyPayload], 0
jne 0x100187e2
pop edi
pop esi
cmp ebx, 0x2482
pop ebx
jae 0x10018803
sub eax, 0x27949604
mov dword [0x1003f104], eax
leave
ret
sub ecx, 0x2685030d
mov dword [0x1003f278], ecx
leave
ret
Function at 0x10018e1b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x1003f2a4]
sub esp, 0x24
xor edx, 0x98d41b06
mov dword [0x1003f040], edx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
inc esi
cmp byte [esi + str.com.avast.id.proto.GoogleAccount], 0
jne 0x10018e3a
mov ebx, dword [str.IMHv]
mov ecx, ebx
xor ecx, 0x886bcf22
cmp esi, 0xbca
push 7
mov esi, str.expected:_softwareIDs_array_
lea eax, [ebx - 0x56ef211c]
cmovae ecx, eax
mov eax, edi
mov dword [0x1003f148], ecx
lea edi, [ebp - 0x24]
pop ecx
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x24], 0x2e
jne 0x10018e97
mov cl, 0x2e
test cl, cl
je 0x10018e97
cmp byte [ebp + eax - 0x24], 0
je 0x10018e97
mov cl, byte [eax + 0x10034ea1]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0x10018e7f
movzx ecx, byte [eax + str.._AVIWindowDelegate_BrowserWindow_wndfmw_cef_renderer_asw__]
movzx eax, byte [ebp + eax - 0x24]
sub ecx, eax
cmp ecx, 0x8a8
ja 0x10018ebb
lea esi, [ebx - 0x1ebf8b22]
mov dword [0x1003f148], esi
jmp 0x10018ec1
mov esi, dword [0x1003f148]
mov eax, dword [0x1003f070]
xor edi, edi
and eax, 0x35f7a26
mov dword [0x1003f0a4], eax
inc edi
cmp byte [edi + str.yodhebrew], 0
jne 0x10018ed2
cmp edi, 0x45a
jae 0x10018ef0
sub esi, 0x238ecae8
mov dword [0x1003f148], esi
push 7
pop ecx
mov esi, str.LOCK_VAULT_ON_BROWSER_CLOSE
lea edi, [ebp - 0x24]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x24], 0x63
jne 0x10018f1f
mov cl, 0x63
test cl, cl
je 0x10018f1f
cmp byte [ebp + eax - 0x24], 0
je 0x10018f1f
mov cl, byte [eax + 0x10034c91]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0x10018f07
movzx ecx, byte [eax + str.com.avast.passwdmgr.proto.LoginPinPayload]
movzx eax, byte [ebp + eax - 0x24]
sub ecx, eax
cmp ecx, 0x9c9
jne 0x10018f43
mov edx, ebx
or edx, 0x8eeaaeda
mov dword [0x1003f040], edx
xor edi, edi
mov eax, edi
inc eax
cmp byte [eax + str.com.avast.passwdmgr.proto.LoginPinPayload], 0
jne 0x10018f47
mov esi, dword [ebp - 4]
mov ecx, dword [0x1003f0a4]
cmp esi, eax
jae 0x10018f83
cmp esi, 0x1bae
jne 0x10018f72
lea ecx, [ebx + 0x7e75af92]
mov dword [0x1003f0a4], ecx
add edx, 0x310ca0da
inc esi
cmp esi, eax
jb 0x10018f5e
mov dword [0x1003f040], edx
imul eax, ebx, 0x94e5710c
mov edx, edi
mov dword [0x1003f2a4], eax
inc edx
cmp word [edx*2 + str.th:checked], di
jne 0x10018f90
cmp edx, 0x1a51
jae 0x10018fb1
or ebx, 0x80b3ba6b
mov dword [0x1003f2a4], ebx
jmp 0x10018fbd
imul ecx, ebx, 0x1cc200c1
mov dword [0x1003f0a4], ecx
pop edi
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x10019e05
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret
Function at 0x1001aba9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, str.pj.agihs.amahagan
lea edi, [ebp - 0x1c]
xor ebx, ebx
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x1c], 0x63
mov edi, dword [0x1003f348]
jne 0x1001ac17
mov cl, 0x63
test cl, cl
je 0x1001abe9
cmp byte [ebp + eax - 0x1c], bl
je 0x1001abe9
mov cl, byte [eax + 0x10036091]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x1001abd2
mov esi, dword [ebp - 4]
cmp esi, eax
jae 0x1001ac17
mov ecx, dword [0x100405cc]
lea edx, [edi + 0x5103ed5d]
mov dword [0x10040578], edx
cmp esi, 0x1958
jne 0x1001ac10
imul ecx, ecx, 0xc12218dc
inc esi
cmp esi, eax
jb 0x1001ac02
jmp 0x1001ac23
mov ecx, dword [0x100405cc]
mov edx, dword [0x10040578]
mov esi, dword [0x1003f390]
mov eax, ebx
xor esi, 0x60bcf4e6
inc eax
cmp word [eax*2 + str.djecyrillic], bx
jne 0x1001ac2b
mov dword [0x1003f390], esi
cmp eax, 0xbd4
ja 0x1001ac57
mov edx, ecx
or edx, 0x86ef71b8
mov dword [0x10040578], edx
or ecx, 0x5d7e5829
mov eax, ebx
mov dword [0x1003f368], ecx
inc eax
cmp byte [eax + str.onefitted], bl
jne 0x1001ac65
mov ecx, dword [ebp - 4]
jmp 0x1001ac88
cmp ecx, 0xa48
jne 0x1001ac87
lea edx, [edi + 0x5bc13036]
mov dword [0x10040578], edx
inc ecx
cmp ecx, eax
jb 0x1001ac73
and esi, 0x463a16f7
lea edi, [ebp - 0x1c]
mov dword [0x1003f348], esi
mov eax, ebx
push 5
pop ecx
mov esi, str.AndroidBuildApiLevel
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x6f
jne 0x1001acc7
mov cl, 0x6f
test cl, cl
je 0x1001acc7
cmp byte [ebp + eax - 0x1c], bl
je 0x1001acc7
mov cl, byte [eax + 0x100365f5]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x1001acb0
movzx ecx, byte [eax + str.onefitted]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0x136a
jbe 0x1001ace5
add edx, 0xb49c41a7
jmp 0x1001aceb
xor edx, 0x828b66f4
mov dword [0x100405cc], edx
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov edi, dword [0x1003f390]
mov edx, ebx
mov esi, edi
and esi, 0xd16bd68a
mov eax, esi
mov dword [0x10040578], esi
and eax, 0x72b26c04
mov dword [0x1003f368], eax
mov eax, dword [0x100405cc]
or eax, 0x95aa52ab
inc edx
cmp word [edx*2 + str.app.pap.GetExcludedFiles], bx
jne 0x1001ad1e
mov ecx, dword [ebp - 4]
mov dword [0x100405cc], eax
cmp ecx, edx
jae 0x1001ad5d
imul eax, esi, 0x8afe8076
mov dword [0x1003f368], eax
cmp ecx, 0xb80
jne 0x1001ad58
lea eax, [edi + 0x5f3d59ab]
mov dword [0x1003f348], eax
inc ecx
cmp ecx, edx
jb 0x1001ad45
mov eax, dword [0x1003f348]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001ca53
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1003f3c4]
sub esp, 0x80
mov edx, eax
push ebx
xor ebx, ebx
xor edx, 0x908ad01f
mov ecx, ebx
inc ecx
cmp byte [ecx + str.app:shields_on], bl
jne 0x1001ca6e
cmp ecx, 0x1c93
jbe 0x1001ca87
lea edx, [eax + 0x297c4edd]
jmp 0x1001ca8d
imul eax, eax, 0x3c7392bd
or eax, 0x7927ce09
mov ecx, str.app:shields_on
xor edx, 0x53903e0d
inc ecx
cmp byte [ecx], bl
jne 0x1001ca97
push esi
push edi
push 8
pop ecx
mov esi, str.avcfg:__settings_Support_Minidumps
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x28], 0x66
jne 0x1001cadf
mov cl, 0x66
test cl, cl
je 0x1001cad4
cmp byte [ebp + ebx - 0x28], 0
je 0x1001cad4
mov cl, byte [ebx + 0x10035379]
inc ebx
cmp cl, byte [ebp + ebx - 0x28]
je 0x1001cabc
cmp dword [ebp - 4], ebx
jae 0x1001cadf
lea eax, [edx + 0x3966a3d1]
push 0x15
pop ecx
mov esi, str.._AVIdVaarException_exceptions_idlib_asw__
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
push 0x67
mov ebx, eax
xor edx, edx
xor ebx, 0xbe75a435
movsw word es:[edi], word [esi]
pop esi
xor edi, edi
cmp si, word [ebp - 0x80]
jne 0x1001cb40
mov ecx, edi
test si, si
je 0x1001cb23
cmp word [ebp + ecx - 0x80], di
je 0x1001cb23
inc edx
lea ecx, [edx + edx]
movzx esi, word [ecx + str.gSafeZoneBrowser__u]
cmp si, word [ebp + ecx - 0x80]
je 0x1001cb05
mov ecx, dword [ebp - 4]
jmp 0x1001cb3c
cmp ecx, 0x206e
jne 0x1001cb36
imul eax, eax, 0x8b916bf6
sub eax, 0x1e1b8d43
inc ecx
cmp ecx, edx
jb 0x1001cb28
mov ecx, edi
imul edx, ebx, 0x96145ab6
inc ecx
cmp word [ecx*2 + str.gSafeZoneBrowser__u], di
jne 0x1001cb48
mov eax, dword [ebp - 4]
pop edi
pop esi
jmp 0x1001cb6e
cmp eax, 0x1f8d
jne 0x1001cb67
lea ebx, [edx + 0x5cbf7894]
xor edx, 0x84252e8b
inc eax
cmp eax, ecx
jb 0x1001cb5a
imul eax, ebx, 0x195da90b
pop ebx
imul ecx, eax, 0x60d0464b
mov dword [0x10040560], eax
mov dword [0x1003f3c4], ecx
leave
ret
Function at 0x1001cd8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x100405f0]
xor edx, edx
push edi
mov ebx, ecx
mov edi, esi
mov dword [ebp - 0x10], ebx
mov eax, edx
or edi, 0x294559bd
inc eax
cmp word [eax*2 + str.ten.revres_xnk], dx
jne 0x1001cdaa
cmp eax, 0x25bf
jbe 0x1001cdc2
lea esi, [edi - 0x6e8398a6]
xor esi, 0x99f59e17
mov ecx, edx
mov dl, byte [ebx]
mov eax, esi
xor eax, 0xc5e49a57
mov byte [ebp - 1], dl
push 0
test dl, dl
mov dword [ebp - 0xc], esi
pop edx
je 0x1001cdec
add eax, 0x4b09a100
inc ecx
cmp byte [ecx + ebx], 0
jne 0x1001cde0
mov edi, dword [ebp - 0x10]
cmp edi, ecx
jae 0x1001ce1e
mov esi, eax
mov dword [ebp - 8], eax
mov ebx, eax
mov eax, esi
or eax, 0x96bfcdf2
cmp edi, 0x1fca
cmovne eax, ebx
or eax, 0x658c69a0
inc edi
mov esi, eax
mov ebx, eax
cmp edi, ecx
jb 0x1001cdfa
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
and esi, 0x14604540
mov ecx, edx
or esi, 0x829522bd
cmp byte [ebp - 1], 0
je 0x1001ce3e
add eax, 0xf147c1a3
inc ecx
cmp byte [ecx + ebx], 0
jne 0x1001ce32
cmp ecx, 0x111d
jne 0x1001ce4d
mov eax, esi
xor eax, 0xed6dac10
add eax, 0x4a2961d0
cmp byte [ebp - 1], 0
mov dword [str.uHH], eax
je 0x1001ce8c
xor eax, 0x7b0d48aa
inc edx
cmp byte [edx + ebx], 0
jne 0x1001ce5d
mov ecx, dword [ebp - 0x10]
mov dword [str.uHH], eax
cmp ecx, edx
jae 0x1001ce8c
cmp ecx, 0xe9d
jne 0x1001ce82
xor eax, 0xc3fa2544
inc ecx
cmp ecx, edx
jb 0x1001ce75
mov dword [str.uHH], eax
imul eax, eax, 0x6c17686a
pop edi
pop esi
pop ebx
mov dword [0x100405f0], eax
leave
ret
Function at 0x1001f610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov ebx, esi
mov dword [ebp - 8], ecx
mov ecx, esi
push edi
mov eax, ecx
mov byte [ebp + ecx - 0x108], cl
and eax, 0x1f
mov al, byte [eax + edx]
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x1001f62b
mov edi, esi
mov dl, byte [ebp + edi - 0x108]
movzx eax, byte [ebp + edi - 0x208]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x1001f672
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x108]
mov byte [ebp + ebx - 0x108], dl
mov byte [ebp + edi - 0x108], al
inc edi
cmp edi, 0x100
jl 0x1001f64c
mov edi, esi
cmp dword [ebp - 4], esi
jle 0x1001f704
mov ebx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sub ebx, edx
inc esi
and esi, 0x800000ff
jns 0x1001f6b0
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + esi - 0x108]
movzx eax, cl
add edi, eax
and edi, 0x800000ff
jns 0x1001f6cc
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + edi - 0x108], cl
mov byte [ebp + esi - 0x108], al
movzx ecx, byte [ebp + edi - 0x108]
movzx eax, al
add ecx, eax
movzx eax, cl
mov al, byte [ebp + eax - 0x108]
xor al, byte [ebx + edx]
mov byte [edx], al
inc edx
sub dword [ebp - 4], 1
jne 0x1001f69f
pop edi
pop esi
pop ebx
leave
ret