joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100163fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x14
pop ecx
mov edx, dword [0x1003ec30]
lea edi, [ebp - 0x54]
mov esi, str.Menu_radio_item_not_part_of_radio_group_
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x6e
pop ecx
and edx, 0x9e9fd50d
mov ebx, eax
movsw word es:[edi], word [esi]
xor esi, esi
cmp cx, word [ebp - 0x54]
jne 0x1001644c
test cx, cx
je 0x1001644c
cmp word [ebp + eax - 0x54], si
je 0x1001644c
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.need_an_object_to_post_event_to]
cmp cx, word [ebp + eax - 0x54]
je 0x1001642e
movzx ecx, byte [ebx*2 + str.need_an_object_to_post_event_to]
movzx eax, byte [ebp + ebx*2 - 0x54]
sub ecx, eax
cmp ecx, 0x236e
jae 0x1001646b
and edx, 0x6d9fda2e
jmp 0x10016471
imul edx, edx, 0x6b28789
mov eax, str.DoLaunchDefaultBrowserHelper
lea eax, [eax + 2]
xor edx, 0xbb6541a3
cmp word [eax], si
jne 0x10016476
imul ecx, edx, 0x4a454257
mov eax, 0x9da762a
pop edi
pop esi
pop ebx
sub eax, ecx
mov dword [0x1003ec30], eax
leave
ret
Function at 0x100182fd
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret
Function at 0x10018f14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1003ff04]
sub esp, 0x28
lea edx, [eax - 0x47be0fe4]
add eax, 0xacac369f
xor eax, 0xd1355075
mov dword [0x1003ffd4], edx
mov dword [0x1003ed7c], eax
mov eax, edx
push ebx
xor ebx, ebx
or eax, 0x534d20d7
mov ecx, ebx
inc ecx
cmp byte [ecx + str.cornsilk], bl
jne 0x10018f46
cmp ecx, 0x4e3
jne 0x10018f60
mov eax, edx
and eax, 0xaf4f4a19
jmp 0x10018f6c
or edx, 0x390fcb10
mov dword [0x1003ffd4], edx
mov ecx, ebx
xor eax, 0x307f7ae9
inc ecx
cmp byte [ecx + str.8_8_8_8_8084888_8_8D8H8L8P8T8X88_8d8h8l8p8t8x88], bl
jne 0x10018f6e
cmp dword [ebp - 4], ecx
jae 0x10018f8d
mov eax, edx
xor eax, 0x3897b2e2
mov dword [0x1003ed7c], eax
push esi
push edi
push 8
pop ecx
mov esi, str.34383_3_3D3H3L3P3T3X33_3d3h33
mov dword [0x1003ff04], 0xd9cb94c4
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x28], 0x65
pop edi
pop esi
jne 0x10018ff3
mov al, 0x65
test al, al
je 0x10018fc9
cmp byte [ebp + ebx - 0x28], 0
je 0x10018fc9
mov al, byte [ebx + 0x100381cd]
inc ebx
cmp al, byte [ebp + ebx - 0x28]
je 0x10018fb1
mov eax, dword [ebp - 4]
cmp eax, ebx
jae 0x10018ff3
cmp eax, 0xaee
jne 0x10018fe3
or edx, 0xf92fe8be
mov dword [0x1003ed7c], edx
inc eax
mov edx, 0x4810621b
cmp eax, ebx
jb 0x10018fd0
mov dword [0x1003ffd4], edx
pop ebx
leave
ret
Function at 0x10019933
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x1003ff7c]
mov edx, str.StripByteCounts
push ebx
push edi
mov edi, dword [0x1003ff98]
or ecx, 0x95858beb
lea eax, [edi + 0x183dfb07]
or ecx, 0xe096ef34
inc edx
cmp byte [edx], 0
jne 0x10019956
xor ebx, ebx
mov edx, ebx
xor eax, 0x3716fc74
inc edx
cmp byte [edx + str.wxSetWorkingDirectory], bl
jne 0x10019966
push esi
mov esi, dword [ebp - 4]
jmp 0x10019990
cmp esi, 0x2417
jne 0x10019988
lea edi, [ecx - 0x17e595ea]
mov eax, edi
or eax, 0xfd7c50ee
inc esi
cmp esi, edx
jb 0x1001997a
mov ecx, str.unknown_help_even_origin
lea ecx, [ecx + 2]
and eax, 0xa45adb96
cmp word [ecx], bx
jne 0x10019999
mov dword [0x1003ff7c], eax
lea ecx, [eax - 0xb48588d]
mov edx, ebx
or ecx, 0x875186ff
inc edx
cmp byte [edx + str.Can_not_write_scanlines_to_a_tiled_image], bl
jne 0x100199b3
mov dword [0x1003ff98], ecx
cmp edx, 0xce4
ja 0x100199de
mov ecx, eax
xor ecx, 0xb797c7e9
mov dword [0x1003ff98], ecx
mov esi, ecx
mov edx, ebx
and esi, 0x68ca910b
mov dword [0x1003ffa0], esi
pop esi
inc edx
cmp word [edx*2 + str.unknown_help_even_origin], bx
jne 0x100199ef
pop edi
pop ebx
cmp edx, 0xc17
jae 0x10019a11
lea eax, [ecx + 0x1d7d0200]
mov dword [0x1003ff7c], eax
jmp 0x10019a1b
xor eax, 0xd071fc67
mov dword [0x1003ffa0], eax
mov eax, ecx
leave
ret
Function at 0x1001bde7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [0x1003ffdc]
mov ebx, ecx
push edi
mov dword [ebp - 8], edx
mov edi, str.6.6C6X6m6
mov ecx, str.1_1Q1f1r1
call fcn.10019604
xor esi, 0x79c0ed7
inc edi
cmp byte [edi], 0
jne 0x1001be00
mov ecx, 0xfef
mov dword [ebp - 0x34], 0xbb0
xor edx, edx
mov dword [ebp - 0x30], ecx
mov eax, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0x267c
mov dword [ebp - 0x24], 0x2108
mov dword [ebp - 0x20], 0x2535
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0x20c5
mov dword [ebp - 0x14], 0x1938
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0x22f3
cmp eax, 6
je 0x1001be67
inc eax
cmp eax, 0xb
jl 0x1001be5c
mov eax, dword [ebp + eax*4 - 0x34]
mov ecx, 0x4e3
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0x28], 0x2075
mov dword [ebp - 0x24], 0xae9
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0x4f1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
cmp eax, 2
je 0x1001bea4
inc eax
cmp eax, 8
jl 0x1001be99
mov edi, dword [ebp + eax*4 - 0x28]
and esi, 0xee22d92c
xor eax, eax
mov dword [ebp - 0x2c], 0xb86
inc eax
mov dword [ebp - 0x24], 0x1087
xor edi, 0xe3
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
xor esi, 0xb0420763
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov eax, str.wxGetNativeFontEncoding
mov dword [ebp - 0x20], 0xdd3
mov dword [ebp - 0x1c], 0x74c
mov dword [ebp - 0x18], 0x2465
mov dword [ebp - 0x14], 0x1d87
mov dword [ebp - 0xc], 0x13d8
or esi, 0x55192617
inc eax
cmp byte [eax], dl
jne 0x1001beff
lea eax, [esi - 0x178bfe85]
mov dword [0x1003ffdc], eax
cmp edx, 3
je 0x1001bf20
inc edx
cmp edx, 0xb
jl 0x1001bf15
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
imul eax, dword [ebp - 4]
add eax, edi
mov dword [ecx], eax
mov ecx, dword [ebp + edx*4 - 0x34]
xor edx, edx
sub ecx, ebx
add ecx, dword [ebp - 8]
div ecx
pop edi
pop esi
lea eax, [ebx + edx]
pop ebx
leave
ret
Function at 0x1001c896
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov ebx, esi
mov dword [ebp - 8], ecx
mov ecx, esi
push edi
mov eax, ecx
mov byte [ebp + ecx - 0x108], cl
and eax, 0x1f
mov al, byte [eax + edx]
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x1001c8b1
mov edi, esi
mov dl, byte [ebp + edi - 0x108]
movzx eax, byte [ebp + edi - 0x208]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x1001c8f8
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x108]
mov byte [ebp + ebx - 0x108], dl
mov byte [ebp + edi - 0x108], al
inc edi
cmp edi, 0x100
jl 0x1001c8d2
mov edi, esi
cmp dword [ebp - 4], esi
jle 0x1001c98a
mov ebx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sub ebx, edx
inc esi
and esi, 0x800000ff
jns 0x1001c936
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + esi - 0x108]
movzx eax, cl
add edi, eax
and edi, 0x800000ff
jns 0x1001c952
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + edi - 0x108], cl
mov byte [ebp + esi - 0x108], al
movzx ecx, byte [ebp + edi - 0x108]
movzx eax, al
add ecx, eax
movzx eax, cl
mov al, byte [ebp + eax - 0x108]
xor al, byte [ebx + edx]
mov byte [edx], al
inc edx
sub dword [ebp - 4], 1
jne 0x1001c925
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001ca30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x100400ac]
sub esp, 0x2c
mov ecx, edx
or ecx, 0xb7ff42f0
push ebx
xor ebx, ebx
mov eax, ebx
xor edx, 0x332aa296
inc eax
cmp byte [eax + str.GdipGetStringFormatMeasurableCharacterRangeCount], bl
jne 0x1001ca49
cmp dword [ebp - 8], eax
jae 0x1001ca6b
sub eax, dword [ebp - 8]
and ecx, 0xcf292b8
sub eax, 1
jne 0x1001ca60
imul eax, edx, 0xe8593186
mov edx, dword [0x10040024]
mov ecx, edx
xor ecx, 0xade00fa8
push esi
push edi
mov dword [str._KP], eax
mov edi, ebx
mov eax, ecx
xor eax, 0xbb15db53
mov dword [0x10040048], eax
inc edi
cmp byte [edi + str.Wrote_palette_index_exceeding_num_palette], bl
jne 0x1001ca94
mov esi, dword [ebp - 8]
cmp esi, edi
jae 0x1001cac9
imul edx, eax, 0x89fac167
mov dword [0x10040024], edx
cmp esi, 0x18a2
jne 0x1001cac4
mov eax, ecx
xor eax, 0x4b7c041
mov dword [str._KP], eax
inc esi
cmp esi, edi
jb 0x1001cab0
mov esi, str.woot.com
lea edi, [ebp - 0x14]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x14], 0x47
jne 0x1001cb2a
mov byte [ebp - 1], 0x47
mov bl, byte [ebp - 1]
test bl, bl
je 0x1001cafb
cmp byte [ebp + eax - 0x14], 0
je 0x1001cafb
mov bl, byte [eax + 0x10038ae1]
inc eax
cmp bl, byte [ebp + eax - 0x14]
je 0x1001cae3
mov esi, dword [ebp - 8]
push 0
pop ebx
cmp esi, eax
jae 0x1001cb2a
cmp esi, 0x181a
jne 0x1001cb15
mov ecx, edx
and ecx, 0xc0872905
mov ebx, ecx
or ebx, 0x475374f6
inc esi
mov dword [str._KP], ebx
cmp esi, eax
jb 0x1001cb05
xor ebx, ebx
push 5
pop ecx
mov eax, dword [0x10040048]
lea edi, [ebp - 0x2c]
mov esi, str.FirefoxMessageWindow
add eax, 0x97ba2d37
rep movsd dword es:[edi], dword [esi]
mov dword [0x100400ac], eax
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x2c], 0x57
pop edi
pop esi
jne 0x1001cb80
mov al, 0x57
test al, al
je 0x1001cb69
cmp byte [ebp + ebx - 0x2c], 0
je 0x1001cb69
mov al, byte [ebx + 0x100389e1]
inc ebx
cmp al, byte [ebp + ebx - 0x2c]
je 0x1001cb51
cmp dword [ebp - 8], ebx
jae 0x1001cb80
mov edx, dword [str._KP]
xor edx, 0xbdd398d0
mov dword [0x10040024], edx
mov eax, edx
pop ebx
leave
ret
Function at 0x1001d358
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor edx, edx
mov ecx, edx
push ebx
push esi
mov esi, dword [0x1003ffe8]
lea eax, [esi - 0x36e4e5cc]
mov dword [0x10040038], eax
xor esi, 0x85d98311
inc ecx
cmp word [ecx*2 + str.NewRowid], dx
jne 0x1001d375
cmp ecx, 0x20ef
jne 0x1001d398
and eax, 0xe405bdbb
mov dword [0x10040038], eax
and eax, 0x2f1c48ef
mov ecx, edx
mov dword [0x10040044], eax
inc ecx
cmp byte [ecx + str.chrome:__sxipper_memorablePassword], dl
jne 0x1001d3a4
mov ebx, dword [0x10040050]
cmp dword [ebp - 4], ecx
jae 0x1001d3c3
imul eax, ebx, 0x469d476
mov dword [0x10040038], eax
mov eax, edx
inc eax
cmp word [eax*2 + str.NewRowid], dx
jne 0x1001d3c5
cmp eax, 0x18bc
jae 0x1001d3e4
lea eax, [ebx + 0x4d8f8d9e]
mov dword [0x10040038], eax
jmp 0x1001d3ef
lea eax, [ebx + 0x6d9a1114]
mov dword [0x10040044], eax
push edi
mov esi, str.steamcommunity.com
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x60
pop edi
jne 0x1001d420
mov al, 0x60
test al, al
je 0x1001d420
cmp byte [ebp + edx - 0x18], 0
je 0x1001d420
mov al, byte [edx + 0x100389b1]
inc edx
cmp al, byte [ebp + edx - 0x18]
je 0x1001d408
movzx ecx, byte [edx + str._vector_vbase_constructor_iterator]
movzx eax, byte [ebp + edx - 0x18]
sub ecx, eax
cmp ecx, 0x220
jne 0x1001d43e
imul eax, ebx, 0x2bb82c4d
jmp 0x1001d445
mov eax, ebx
and eax, 0xcc7d1b74
mov dword [0x1003ffe8], eax
lea eax, [ebx + 0x44f2edfc]
pop esi
mov dword [0x1003ffec], eax
pop ebx
leave
ret
Function at 0x1001e83e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [0x100402c0]
push esi
push edi
push 8
pop ecx
mov esi, str.0_020A0Q0Z0q0
mov dword [ebp - 8], edx
lea edi, [ebp - 0x2c]
xor edx, edx
rep movsd dword es:[edi], dword [esi]
push 0x47
pop esi
mov eax, edx
cmp si, word [ebp - 0x2c]
jne 0x1001e8ae
mov ecx, edx
test si, si
je 0x1001e88a
cmp word [ebp + ecx - 0x2c], dx
je 0x1001e88a
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.GdipAddPathPolygon]
cmp si, word [ebp + ecx - 0x2c]
je 0x1001e86c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x1001e8aa
cmp ecx, 0x309
jne 0x1001e8a9
mov eax, ebx
and eax, 0xe1f28e6e
mov dword [0x10040284], eax
mov eax, dword [ebp - 0xc]
inc ecx
cmp ecx, eax
jb 0x1001e892
mov eax, ebx
lea esi, [ebx + 0x7188376]
and eax, 0xc5551be3
mov ecx, edx
mov dword [ebp - 0xc], eax
inc ecx
cmp byte [ecx + str.Recheck_Page], dl
jne 0x1001e8c0
cmp ecx, 0xcea
jae 0x1001e8dc
imul eax, esi, 0x5d5a4e74
mov dword [0x10040284], eax
mov eax, dword [ebp - 8]
lea edi, [ebp - 0x1c]
mov esi, str.GetClientRect
mov cl, byte [eax]
mov eax, edx
movsd dword es:[edi], dword [esi]
mov byte [ebp - 1], cl
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 8]
cmp cl, byte [ebp - 0x1c]
jne 0x1001e90f
test cl, cl
je 0x1001e90f
cmp byte [ebp + eax - 0x1c], dl
je 0x1001e90f
inc eax
mov cl, byte [esi + eax]
cmp cl, byte [ebp + eax - 0x1c]
je 0x1001e8fb
movzx ecx, byte [eax + esi]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0x1dd2
ja 0x1001e92f
mov eax, dword [ebp - 0xc]
and eax, 0x303e7aaa
mov dword [0x10040284], eax
mov eax, dword [ebp + 8]
mov al, byte [eax]
mov byte [ebp + 0xb], al
test al, al
je 0x1001e94a
mov eax, dword [0x10040284]
add eax, 0xe8f47823
mov dword [0x10040128], eax
mov al, byte [ebp - 1]
lea edi, [ebp - 0x20]
mov esi, str.application_x_gzip
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp al, byte [ebp - 0x20]
jne 0x1001e97f
mov ebx, dword [ebp - 8]
test al, al
je 0x1001e979
cmp byte [ebp + edx - 0x20], 0
je 0x1001e979
inc edx
mov al, byte [ebx + edx]
cmp al, byte [ebp + edx - 0x20]
je 0x1001e964
mov ebx, dword [0x100402c0]
mov eax, dword [ebp - 8]
movzx ecx, byte [edx + eax]
movzx eax, byte [ebp + edx - 0x20]
sub ecx, eax
cmp ecx, 0xf54
jbe 0x1001e9a1
mov eax, dword [0x10040128]
and eax, 0xfe6fff6b
jmp 0x1001e9a7
imul eax, ebx, 0xccd459fe
cmp byte [ebp + 0xb], 0
mov dword [0x100402b0], eax
je 0x1001e9be
mov eax, ebx
xor eax, 0xdea6c8fa
mov dword [0x10040284], eax
pop edi
xor ebx, 0x9c1833dc
pop esi
mov dword [0x10040244], ebx
pop ebx
leave
ret
Function at 0x100202d1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100400c4]
mov edx, dword [0x10040238]
and eax, 0x8c766c16
push ebx
push esi
push edi
mov esi, str.1_1_1h1p1x1
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x1c]
add edx, 0xd49a547c
xor ebx, ebx
mov dword [ebp - 4], edx
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x1c], 0x73
jne 0x10020324
mov cl, 0x73
test cl, cl
je 0x10020324
cmp byte [ebp + eax - 0x1c], bl
je 0x10020324
mov cl, byte [eax + 0x10038d45]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x1002030d
movzx ecx, byte [eax + str.signons3.txt]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0xf7e
jbe 0x10020342
lea eax, [edx - 0x3db875de]
jmp 0x10020353
mov edx, dword [ebp - 0xc]
mov eax, dword [0x10040270]
add edx, 0xb47db1e4
mov dword [ebp - 4], edx
push 9
pop ecx
mov esi, str.sPLT_out_of_memory
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x44]
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
push 0x2e
pop ecx
movsw word es:[edi], word [esi]
cmp cx, word [ebp - 0x44]
jne 0x10020399
mov edx, ebx
test cx, cx
je 0x10020390
cmp word [ebp + eax - 0x44], bx
je 0x10020390
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + 0x10038fe0]
cmp cx, word [ebp + eax - 0x44]
je 0x10020372
mov dword [ebp - 8], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax*2 + 0x10038fe0]
movzx eax, byte [ebp + eax*2 - 0x44]
sub ecx, eax
cmp ecx, 0x1268
jae 0x100203b8
and edx, 0x18a184f0
jmp 0x100203be
imul edx, edx, 0xe249084d
mov ecx, dword [ebp - 0xc]
mov eax, ebx
and ecx, 0xac0ad38b
mov dword [0x10040174], edx
mov dword [0x10040170], ecx
inc eax
cmp byte [eax + str.575D5M5S5_5x5], bl
jne 0x100203d5
cmp dword [ebp - 0x10], eax
jae 0x100203f7
sub eax, dword [ebp - 0x10]
and edx, 0x21bd1542
sub eax, 1
jne 0x100203e6
mov dword [0x10040174], edx
mov esi, dword [ebp - 0x10]
lea eax, [edx + 0x52e42c4e]
or esi, 0x5177393
mov dword [0x10040238], eax
mov dword [0x1004026c], esi
lea edi, [esi + 0x1f4fef53]
mov dword [0x100400c4], edi
inc ebx
cmp byte [ebx + str.HTTP_STATUS_NOT_FOUND], 0
jne 0x1002041d
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
jae 0x10020452
imul eax, edi, 0xcbe0d756
mov dword [0x10040238], eax
cmp ecx, 0x1a59
jne 0x1002044d
mov eax, esi
xor eax, 0xa3e7e42e
mov dword [0x10040170], eax
inc ecx
cmp ecx, ebx
jb 0x10020439
imul eax, edx, 0x1ac975d2
pop edi
pop esi
pop ebx
mov dword [0x10040270], eax
leave
ret
Function at 0x10023f55
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov ebx, edx
lea edi, [ebp - 0x3c]
xor eax, eax
mov esi, str.Invalid_memory_pool_code__d
push 0xe
pop ecx
mov edx, eax
movzx eax, word [ebx]
rep movsd dword es:[edi], dword [esi]
mov esi, eax
mov dword [ebp - 4], esi
cmp ax, word [ebp - 0x3c]
jne 0x10023fa1
xor edi, edi
movzx ecx, si
mov eax, edi
test cx, cx
je 0x10023fa1
cmp word [ebp + eax - 0x3c], di
je 0x10023fa1
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + ebx]
cmp cx, word [ebp + eax - 0x3c]
je 0x10023f86
movzx ecx, byte [ebx + edx*2]
movzx eax, byte [ebp + edx*2 - 0x3c]
mov edi, dword [0x1004039c]
sub ecx, eax
cmp ecx, 0x1bce
jae 0x10023fc5
imul eax, edi, 0x8dcfdbaa
mov dword [0x10040340], eax
mov ecx, dword [0x10040310]
lea eax, [ecx - 0x246437c7]
mov dword [0x100403d0], eax
xor eax, eax
mov edx, eax
test si, si
je 0x1002401b
inc edx
cmp word [ebx + edx*2], ax
jne 0x10023fdf
mov esi, dword [ebp + 8]
cmp esi, edx
jae 0x10024018
imul eax, edi, 0x8e104062
mov dword [0x10040340], eax
mov eax, dword [0x100403d0]
cmp esi, 0x94
jne 0x10024011
lea ecx, [eax - 0x6de0d03d]
mov dword [0x10040310], ecx
inc esi
cmp esi, edx
jb 0x10023ffd
xor eax, eax
mov esi, dword [ebp - 4]
mov edx, eax
xor edi, edi
mov eax, dword [ebp + 8]
cmp word [eax], di
mov edi, dword [0x1004039c]
je 0x10024062
xor esi, esi
and ecx, 0x4c7d299a
inc edx
cmp word [eax + edx*2], si
jne 0x1002402f
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov dword [0x10040310], ecx
jmp 0x1002405e
cmp eax, 0x21d6
jne 0x1002405d
or ecx, 0xe56d12d3
mov dword [0x10040310], ecx
inc eax
cmp eax, edx
jb 0x1002404a
mov eax, edi
xor edx, edx
xor eax, 0xfe2e17f4
mov dword [0x1004031c], eax
mov eax, edx
test si, si
je 0x1002408d
inc eax
cmp word [ebx + eax*2], dx
jne 0x10024077
cmp eax, 0x23b0
jne 0x1002408d
imul ecx, edi, 0x8ea5e8c2
jmp 0x10024093
and ecx, 0x93c2e2bc
pop edi
pop esi
mov dword [0x1004040c], ecx
pop ebx
leave
ret
Function at 0x10024321
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov edx, dword [0x100402ec]
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov dword [ebp - 8], ebx
mov eax, esi
and edx, 0xcc7cf886
inc eax
cmp byte [eax + str.Clicking_No_might_result_LastPass_not_being_fully_installed.], 0
jne 0x10024339
mov dword [0x100402ec], edx
cmp eax, 0x6a8
jbe 0x10024367
mov eax, dword [0x100403fc]
add eax, 0x88b33f64
mov dword [0x100403d4], eax
jmp 0x10024376
mov eax, dword [0x10040424]
add eax, 0x90a5a565
mov dword [0x10040394], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, word [ebx]
lea edi, [ebp - 0x38]
mov edx, esi
mov esi, str.INET_E_INVALID_REQUEST
push 0xb
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [ebp - 4], ecx
movsw word es:[edi], word [esi]
cmp ax, word [ebp - 0x38]
jne 0x100243bd
xor esi, esi
movzx ecx, cx
mov eax, esi
test cx, cx
je 0x100243bd
cmp word [ebp + eax - 0x38], si
je 0x100243bd
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + ebx]
cmp cx, word [ebp + eax - 0x38]
je 0x100243a2
movzx ecx, byte [ebx + edx*2]
movzx eax, byte [ebp + edx*2 - 0x38]
mov edx, 0xce9cbae0
mov esi, dword [0x10040424]
sub ecx, eax
mov ebx, dword [0x100402ec]
cmp ecx, 0x1240
mov eax, 0xff38d88a
mov ecx, ebx
cmovae esi, eax
or ecx, 0x54823b89
mov edi, esi
mov dword [0x1004036c], ecx
xor eax, eax
and edi, 0xd4047048
xor ecx, ecx
inc eax
cmp word [eax*2 + str.ifttt.com], cx
jne 0x10024401
cmp eax, 0xf2d
jae 0x1002441b
lea edx, [ebx + 0xcb760fc]
jmp 0x10024420
mov esi, 0xeebebbf8
mov ecx, dword [0x1004036c]
and edi, 0x3ae31830
imul eax, edi, 0x42583283
and ecx, 0x94f3527a
mov dword [0x10040394], edi
xor edx, 0x9ec5d0b3
mov dword [0x100403d4], ecx
lea edi, [ebp - 0x38]
push 0xb
pop ecx
mov dword [0x10040414], eax
imul eax, esi, 0xc4758314
mov esi, str.GdipDrawClosedCurve2I
rep movsd dword es:[edi], dword [esi]
mov dword [0x10040424], eax
xor eax, eax
mov ebx, eax
mov dword [0x100403fc], edx
mov eax, dword [ebp - 4]
cmp ax, word [ebp - 0x38]
jne 0x100244cb
mov esi, dword [ebp - 8]
xor edi, edi
movzx ecx, ax
mov eax, edi
test cx, cx
je 0x1002449f
cmp word [ebp + eax - 0x38], di
je 0x1002449f
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x38]
je 0x10024484
mov ecx, dword [ebp - 8]
cmp ecx, ebx
jae 0x100244cb
cmp ecx, 0x19ac
jne 0x100244ba
mov eax, edx
xor eax, 0x42b4fb6f
mov dword [0x10040394], eax
imul edx, edx, 0x7e866a7f
inc ecx
cmp ecx, ebx
jb 0x100244a6
mov dword [0x100403fc], edx
mov eax, dword [0x1004036c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10024b9e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, str.SoftNull
lea edi, [ebp - 0x18]
mov ebx, edx
xor eax, eax
mov dword [ebp - 0xc], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x33
jne 0x10024c09
mov cl, 0x33
test cl, cl
je 0x10024bd9
cmp byte [ebp + eax - 0x18], 0
je 0x10024bd9
mov cl, byte [eax + 0x1003bfb1]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x10024bc1
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jae 0x10024c09
mov esi, dword [0x100403e8]
mov edx, dword [0x10040368]
cmp ecx, 0xdf0
jne 0x10024bfa
lea esi, [edx - 0x70616a5e]
mov edx, esi
xor edx, 0x86f4a951
inc ecx
cmp ecx, eax
jb 0x10024bec
jmp 0x10024c0f
mov edx, dword [0x10040368]
mov al, byte [ebx]
or edx, 0x2aaa3340
mov ecx, dword [0x10040450]
xor edx, 0xbfd8de06
mov byte [ebp - 1], al
mov ebx, edx
and ebx, 0xd90429f9
mov dword [0x100402dc], ebx
lea eax, [ecx + 0xc2b2a4c]
mov dword [ebp - 8], eax
xor eax, eax
mov edi, eax
cmp byte [ebp - 1], al
je 0x10024c84
mov esi, dword [ebp - 0xc]
or ecx, 0xbed7be7d
mov dword [ebp - 8], ecx
inc edi
cmp byte [edi + esi], al
jne 0x10024c52
mov esi, dword [ebp - 0xc]
cmp esi, edi
jae 0x10024c84
mov ebx, dword [0x10040450]
cmp esi, 0x1981
jne 0x10024c73
imul ebx, ecx, 0x8175c9e0
add ebx, 0x702c5135
inc esi
cmp esi, edi
jb 0x10024c65
mov ebx, dword [0x100402dc]
mov esi, str.sr_BA_Latn
lea edi, [ebp - 0x18]
and edx, 0x3763f37a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x2e
jne 0x10024cb7
mov cl, 0x2e
test cl, cl
je 0x10024cb7
cmp byte [ebp + eax - 0x18], 0
je 0x10024cb7
mov cl, byte [eax + 0x1003bac1]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x10024c9f
movzx ecx, byte [eax + str.._AUTopologyObject_GlobalCore_details_Concurrency__]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
cmp ecx, 0x193c
jae 0x10024cd8
mov eax, dword [ebp - 8]
or edx, 0x876100fe
jmp 0x10024cdf
mov eax, edx
or eax, 0x57dbc4e4
xor ecx, ecx
imul eax, eax, 0x77c45ad4
mov esi, ecx
cmp byte [ebp - 1], cl
je 0x10024d10
lea eax, [edx + 0x226693dc]
mov edx, dword [ebp - 0xc]
inc esi
cmp byte [esi + edx], cl
jne 0x10024cf7
cmp esi, 0x268f
jbe 0x10024d0b
imul eax, ebx, 0x7e07a526
and eax, 0xa2de3ff6
mov edx, ebx
mov esi, ecx
or edx, 0x7b29e7f2
add eax, 0x485b6b94
mov dword [0x100403e8], edx
mov dword [0x10040368], eax
inc esi
cmp byte [esi + str.._AUTopologyObject_GlobalCore_details_Concurrency__], cl
jne 0x10024d2a
cmp esi, 0x1263
jne 0x10024d7e
mov eax, edx
xor eax, 0x7fe31b87
mov dword [0x10040450], eax
xor ebx, 0xf3c721a7
inc ecx
cmp byte [ecx + str.installoption_addtostartmenu], 0
jne 0x10024d47
mov dword [0x100402dc], ebx
cmp ecx, 0x683
jne 0x10024d71
or eax, 0x55529821
mov dword [0x10040368], eax
jmp 0x10024d8a
lea eax, [edx + 0x6595e8b0]
mov dword [0x100402dc], eax
jmp 0x10024d8a
or ebx, 0xbfc7bd7d
mov dword [0x10040450], ebx
pop edi
pop esi
pop ebx
leave
ret