joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ab00
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.004764d0
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.004764a0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x46ab47
push edi
call fcn.004764e0
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.0046a790
mov dword [esi + 4], fcn.0046a620
mov dword [esi + 8], fcn.0046a6f0
mov dword [esi + 0xc], fcn.0046a570
mov dword [esi + 0x10], 0x46ae60
mov dword [esi + 0x14], 0x46adf0
mov dword [esi + 0x18], 0x46ac50
mov dword [esi + 0x1c], 0x46a420
mov dword [esi + 0x20], 0x46a2d0
mov dword [esi + 0x24], 0x46aa00
mov dword [esi + 0x28], 0x46aed0
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x46ac2a
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x46ac2a
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x46ac19
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x46ac21
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x46c060
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1c0]
mov dword [esp + 0x1c], ebx
jne 0x46c085
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x46c08b
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x46c1a0
push edi
lea ecx, [ecx]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x46c0dd
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
lea esp, [esp]
cmp esi, edx
jle 0x46c136
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
lea ecx, [ecx]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x46c120
mov edi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x46c100
mov esi, dword [esp + 0x14]
test esi, esi
je 0x46c181
mov ecx, 1
lea edx, [ebp - 1]
jmp 0x46c160
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x46c160
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x46c0c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x496a7c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4d2218], 0
push ebx
push esi
mov esi, 0x4d2220
jne 0x496aa8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4d2238], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4d2218], 1
push dword [0x4d2238]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x496b45
push 0x14
push 8
push dword [0x4d1a90]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x496b6f
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4d221c]
test eax, eax
je 0x496aea
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4d221c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x496b74
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4d2238]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x4d1a90]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x496b6f
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x496e89
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x4d1a90]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x4d2360]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x4d2364], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00499abc
mov dword [esi + 0x58], 0x497a9c
mov eax, esi
mov dword [esi + 0x5c], 0x497ae8
mov dword [esi + 0x10], fcn.0049763d
mov dword [esi + 0x30], 0x49752f
mov dword [esi + 0x64], 0x497b72
mov dword [esi + 0x60], 0x497b2a
mov dword [esi + 0x34], 0x4971df
mov dword [esi + 0x24], 0x4971b6
mov dword [esi + 0x28], 0x49718b
mov dword [esi + 0x2c], 0x4970dd
mov dword [esi + 0x44], 0x4978a2
pop esi
ret 4
Function at 0x49cd60
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x49ce16
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x49cdf6
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x49cdd1
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x49ce0b
add edi, dword [esp + 0x14]
jmp 0x49ce0f
add edi, dword [esp + 0x24]
test edx, edx
jne 0x49cdaf
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x49d121
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x49d1fb
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x49d1d1
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x49d199
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x49d1e8
add edi, ecx
jmp 0x49d1ec
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x49d16f
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x49d81b
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x49d8d0
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x49d8b1
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x49d88c
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x49d8c6
add edx, dword [esp + 0x14]
jmp 0x49d8ca
add edx, dword [esp + 0x24]
test esi, esi
jne 0x49d86a
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x4209a4
Capabilities:
Encode data using xor

Disassembly:
popal
dec esi
outsb dx, byte [esi]
enter 0x1acd, 0x7e
push es
mov bl, 0
push eax
shl ch, cl
jae 0x4209d7
shr ah, 1
mov al, byte [0xb0f04599]
pop ss
mov edx, 0x1f92eaec
int1
xchg esi, eax
add byte [0x5580fc25], ch
inc ebx
fbstp tbyte [edi]
std
invalid
sbb dh, byte [ebx]
xor dword [ecx - 0x7410f82b], esp
xor eax, 0x8c29e9d0
aaa
xor byte [edi + 0x402f50e1], dl
shr cl, 1
sub dword [edi + esi + 0x50e19730], ecx
das
inc eax
cmpsb byte [esi], byte es:[edi]
pop esi
pop edx
inc edi
lodsb al, byte [esi]
dec esp
inc esp
and byte [ecx + 0x5f], bl
adc dl, byte [ecx]
and eax, 0xbfb69645
mov byte [0x40b591f4], al
cmp dword [esi - 0x4d], ebp
mov al, 0x78
jnp 0x4209ce
outsb dx, byte [esi]
std
dec esp
pop edx
idiv byte [eax + 0x3c379a18]
retf

Function at 0x437664
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0xdb
add eax, 0xa8f6bbd5
or eax, 0xbbd1735
jecxz 0x43768d
mov dword [esi - 0x64c7a340], edx
not dword [edx + esi*8 - 0x46a2fc5]
cmp dword [ebp - 0x1a], ebp
invalid
jbe 0x437610
mov ah, byte [edi]
scasb al, byte es:[edi]
inc ebp
add eax, 0x797137
xchg esi, eax
mov al, 5
cdq
mov cl, 0xfb
or edx, 0xffffffd2
invalid
mov ch, 0x2d
mov edx, dword [ebp + eax*8 + 0x25]
xchg esp, eax
je 0x4376b2
invalid
push eax
nop
aad 0x70
movsb byte es:[edi], byte [esi]
mov dl, 0x15
dec esi
shr dword [eax], 1
sar dword [eax], 1
mov bl, 0xb0
and ebp, edx
rcl dword [ebp - 0x4f254438], 0x5e
or edi, esp
stc
insb byte es:[edi], dx
push edx
invalid

Function at 0x437a14
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x22ac12b3], al
inc esp
cwde
jmp 0x31fa6b33
mov bh, 0
insd dword es:[edi], dx
lahf
lds edx, [0x3b531606]
sbb ebp, dword [esi + 0x203d9d84]
repne cmpsd dword [esi], dword es:[edi]
dec ebp
in al, 0xd5
jns 0x437a61
inc ecx
add ebp, ebp
outsb dx, byte [esi]
test al, 5
lds eax, [edi]
les esi, [esp + esi*8]
in eax, dx
fst qword [ebx + 0x100f4667]
pop es
inc edi
pop es
rcl al, 1
push eax
lds eax, [ebx + 0x43a7a6b5]
invalid
jo 0x4379ea
ror dword [edi], 0x70
mov eax, dword [0xbc9d80ef]
les edx, [ecx - 0x68c234a8]
push ebp
mov ebx, 0x4777781c
je 0x437add
inc ebp
mov fs, word [ebp + 0x7b]
push ecx
adc byte [0xcfc0f905], bh
or dl, byte [ebp + 0x6d7c5725]
int 0xad
call dword [eax - 0x6b]
push eax
xchg ebp, eax
out 0x61, eax
sub byte [edi], ah
into
or al, byte [esi - 0x33]
push edx
mov bl, 0x4e
invalid
lds ecx, [ebx + 0x5a93bca]
rol edi, 0xe5
ror dword [ebp - 0x29], 1
adc eax, 0xb00951c5
stosd dword es:[edi], eax
and byte [ebp + 0xd], dl
js 0x437a8d
jae 0x437b1d
mov bh, 0x69
dec edx
dec ebp
adc eax, 0xf161892a
and byte [ecx - 0x178d2a4b], 0x82
test ebx, esp
add al, 0xc2
mov ch, 0xed
out 0x65, al
cmp eax, 0xc5f08f79
xor dword [esi + 0xc9d557e], esp
or edi, dword [ebx + 0x7d]
and dword [ecx - 0x6b], edx
jge 0x437b40
push ecx
xchg ebp, eax
xchg ebp, eax
rol byte [esi + 0x7d], 1
aad 0xb7
jge 0x437b00
adc al, 0xb0
push esi
into
imul esp, dword [edi - 0x11], 0xffffff96
inc ebx
lea edx, [edx + 0x30]
and byte [esi + 0x5b041575], dl
push edx
sahf
inc ecx
pop esp
dec esp
cmp eax, 0xd03263eb
cmc
Function at 0x47c634
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x834cbe87]
sahf
fdivr dword [esi + 0x23]
leave
xchg byte [0x3550dd01], ah
sbb eax, 0xc2228746
out dx, al
stosd dword es:[edi], eax
jns 0x47c6a4
push esp
cmp edx, dword [ebp + 0x3f]
sub al, dl
adc eax, 0xf71b98b4
ljmp 0xef73
jns 0x47c6df
mov eax, dword [0xd4790d6a]
dec esi
jno 0x47c6f9
out dx, al
inc bx
insb byte es:[edi], dx
daa
adc eax, 0x715dd723
jmp 0xe1bd3e6
aam 0xdf
dec ebp
pop edx
inc ebx
stc
sub al, 0x7d
sbb eax, 0x4106e1a
cwde
dec edi
mov bh, 0x40
pop ecx
inc ecx
salc
std
and dword [eax + 0x640098d8], ebx
stc
stc
pop esp
invalid

Function at 0x495284
Capabilities:
Encode data using xor

Disassembly:
ret
pop eax
pop eax
jbe 0x495204
sub dword [edi], ecx
insd dword es:[edi], dx
xor dl, byte [edi + ebx*8]
lodsd eax, dword [esi]
jl 0x495204
sub dh, byte [ecx]
cmp byte [eax], bl
scasd eax, dword es:[edi]
jmp 0x4951b4
inc ebx
pop eax
jns 0x495249
cwde
in al, dx
lodsd eax, dword [esi]
push es
jl 0x49520f
insb byte es:[edi], dx
fstp qword [edi - 0x63]
mov dword [0x70a9c9ff], eax
xchg ecx, eax
salc
pop ecx
lahf
xchg edx, eax
invalid
sbb dword [ecx + edx*2 - 0x74], eax
add ecx, edi
push edi
lea edi, [ebp - 0x480ea14d]
outsb dx, byte [esi]
adc dword [ebx], eax
mov ah, 0x93
xchg ecx, eax
fdivr qword [ebp - 0x6b]
jae 0x4952df
int 0x19
pushfd
or byte [eax - 0xb937463], bh
sbb eax, 0x581d14f
jbe 0x4952a3
xor ebp, edx
int 0xdd
push ebp
sub eax, 0xa1dbb723
jl 0x4952ca
aad 0xcd
fst qword [ebp + 0x2d]
and esi, dword [edi + 0x4d7ca1db]
sbb al, 0x8f
cmp ebx, dword [ebx]
sbb eax, 0x616b0d3d
imul esp, dword [ecx - 0x7e], 0x12
pop ecx
je 0x49522c
shr dword [ecx - 0x4328ea72], cl
call 0x25ae6499
retf
mov esp, 0x651203e8
and eax, 0x37be9ccb
leave
iretd
popal
movsd dword es:[edi], dword [esi]
xchg esp, eax
retf 0xed95
push cs
sbb dword [ebx], esp
sub ch, cl
sbb byte [edx - 0x5196df20], ch
int1
mov al, byte [0x5baaba14]
push ds
push eax
jno 0x495271
xor eax, 0x2b929437
stosb byte es:[edi], al
cld
ret
xchg edx, eax
sub ebp, dword [edx + 0xd7fc3fc]
sub dword [esi], ebx
mov bh, 0x33
je 0x4952a3
sbb ecx, edx
adc dword [ecx], esp
sub dword [edi], esi
mov al, byte [0xd07a9efa]
sahf
jp 0x4952b2
mov byte [0x7c9488bc], al
je 0x495290
lds eax, [edx + 0x46bfce1d]
scasb al, byte es:[edi]
mov edx, 0x1a54ca7d
cmp ah, byte [ebp + 0xb928af6]
sbb al, byte [ebx + 0xd]
mov dl, 0x52
cmp al, 0x8b
pushal
and al, ah
or eax, 0xfcab63ce
cld
and byte [ebp - 0x59], dl
xor al, 0xc9
xchg ebp, eax
push 0xd7440830
je 0x495309
pop ds
pop ebx
mov ch, dl
and eax, 0xf841d421
mov bh, 0xa7
or dl, byte [esi]
scasd eax, dword es:[edi]
add ecx, dword [edx + 0x34]
invalid
Function at 0x49e712
Capabilities:
Encode data using xor

Disassembly:
or cl, byte [eax + ebx*2 + 0x74]
pop es
dec edx
lcall 0x76c3, 0x7d075f3d
inc ebp
jg 0x49e743
add eax, 0x8a7048e0
aam 0x77
hlt
xchg edi, eax
out dx, al
mov ah, 4
dec esi
sbb eax, 0x350720fd
dec ebp
push es
xor eax, 0x81c54ce4
out dx, eax
and al, 0xbb
dec edx
sbb eax, ebx
sbb eax, 0x1843e46c
cmp bh, ah
mov dl, 0x1d
sub eax, dword [ecx + edi*2 + 0x1c04957e]
jle 0x49e6cc
add al, 0x1c
jno 0x49e7a7
lds esi, [esi]
jg 0x49e735
clc
clc
sub dword [edx + 0x15c29a0b], 0xffffffd3
out 0x84, al
cmp al, 0xa9
or ebx, dword [edx - 0x192cea3e]
test byte [ecx + ebp*4], bh
push 7
adc ch, byte [esi - 0x10]
fist word [eax + edx*8]
cmp ah, ah
add eax, 0x890bfd2d
xor ebp, esi
cli
jb 0x49e740
test dword [eax + 0x52], edx
std
bound edx, qword [ebp + 0x14]
lds eax, [ebx - 0x5d]
push ds
ljmp 0x63fa
and eax, 0xa7ba03a1
and al, 0xd
mov gs, word [0xa6bddd03]
ret
xchg ecx, eax
mov ebx, 0x3257607f
loopne 0x49e782
out 0xa, eax
sub dword [ebx], esp
jns 0x49e737
rol dword [0x78caf958], 1
and ecx, ebx
adc ah, byte [edi]
rcr esp, 1
enter 0xffffffffffffc755, 0x62
sbb eax, 0x8ea40523
in eax, 0xf1
invalid

Function at 0x4ab464
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
popal
ret
mov ah, 0xc5
cmp ah, dh
hlt
sub dword [esi + 0x15], 0xffffff81
pop ebp
dec edx
jbe 0x4ab461
pop esp
lds ebp, [eax - 0x362bbce3]
xchg ebp, eax
and esp, esp
mov edx, dword [esi]
inc edx
popal
test word [eax + 0x34], dx
inc esi
dec eax
xor esi, dword [edi + 0x6a]
je 0x4ab4b9
mov dword [edi - 0x1a809c0], ebx
les eax, [ebx]
out 0x31, eax
aam 0xb3
jne 0x4ab4e5
lodsd eax, dword [esi]
sbb ebp, dword [edx + 0x13]
ja 0x4ab435
push ds
mov byte [0xc10aee17], al
lodsb al, byte [esi]
out 0x46, eax
push es
in eax, 0x1e
add al, 0xd3
pushfd
xor esi, dword [ebx]
mov byte [eax], al
mov ebx, 0x45cf0f34
inc ecx
or byte [ebx], dh
loopne 0x4ab4a1
xchg esp, eax
in eax, dx
cmp edx, eax
pushfd
loop 0x4ab51f
xchg byte [edi - 0xad480a5], bh
retf
adc byte [esi + 1], bh
jnp 0x4ab560
dec esp
xor dword [ebx + esi - 0x481043dc], 0x64
push ss
inc edx
mov dword [0xa0f5e011], eax
pushal
mov al, 0x50
ret 0x67db
cmp ah, byte [ebp - 0x896e583]
fsub qword [edi + eax*2 + 0x47]
ret
pop esp
in al, dx
invalid
invalid

Function at 0x4ae594
Capabilities:
Encode data using xor

Disassembly:
mov ah, byte [esp + edx*2 + 0x1eebd935]
std
dec eax
ljmp 0x65de
push ebx
pop eax
or al, 0xa4
movsb byte es:[edi], byte [esi]
vmaxps xmm4, xmm3, xmmword [eax + 0x1f28e66e]
stosd dword es:[edi], eax
adc al, 0x58
fcomp dword [edi - 0x49]
cmp eax, 0xb21b6a33
xor ebp, dword [edx + 0x1b]
mov dl, 0xae
xor ebp, dword [edx + 0x1b]
mov dl, 0xae
xchg esi, eax
dec eax
aad 6
loopne fcn.004ae5a4
mov byte [0x8e814435], al
jg 0x4ae591
jne 0x4ae541
mov edi, 0x59a367d0
xchg ecx, eax
retf 0xab51
Function at 0x4bb519
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3338
cmp edx, dword [eax]
je 0x4bb53b
add eax, 8
inc ecx
cmp eax, 0x4c33c8
jl 0x4bb52c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3338]
jne 0x4bb669
mov eax, dword [0x4c7cbc]
cmp eax, 1
je 0x4bb643
test eax, eax
jne 0x4bb56c
cmp dword [0x4c3264], 1
je 0x4bb643
cmp edx, 0xfc
je 0x4bb669
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb5a3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bbf00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc390
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb5e6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc390
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09f4
push edi
call fcn.004be260
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bbf00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbf10
lea eax, [ebp - 0xa0]
push 0x4c09d4
push eax
call fcn.004bbf10
push dword [esi + 0x4c333c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbf10
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be1d4
add esp, 0x2c
pop edi
jmp 0x4bb669
lea eax, [ebp + 8]
lea esi, [esi + 0x4c333c]
push 0
push eax
push dword [esi]
call fcn.004bc390
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401428
Capabilities:
Create directory
Get common file path
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 5
push 0
call sub.shell32.dll_SHGetFolderPathA
push str.DecSoftHTMLCompilerLicense_
lea eax, [ebp - 0x10c]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x10c]
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0x10
je 0x401477
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
call sub.shell32.dll_SHCreateDirectoryExA
push str.license
lea eax, [ebp - 0x10c]
push eax
call sub.kernel32.dll_lstrcatA
mov dword [ebp - 4], 0
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x10c]
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x40150f
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push 0x405554
push dword [ebp - 8]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 4], eax
je 0x4014f1
push 0x10
push str.ERROR
push str.Keyfile_not_created
push dword [ebp + 8]
call sub.user32.dll_MessageBoxA
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
jmp 0x40152b
push 0
push str.Success
push str.Keyfile_written_successful
push dword [ebp + 8]
call sub.user32.dll_MessageBoxA
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
jmp 0x40152b
push 0x10
push str.ERROR
push str.Keyfile_not_created
push dword [ebp + 8]
call sub.user32.dll_MessageBoxA
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
leave
ret 0xc
Function at 0x40159d
Capabilities:
Get hostname
Get session user name

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x405300], eax
call sub.comctl32.dll_InitCommonControls
push 0
push 0x40
push 0x40
push 1
push 0xbb8
push dword [0x405300]
call sub.user32.dll_LoadImageA
mov dword [0x405304], eax
push dword [0x405304]
push 0x40159d
push 0
push 0x3e8
push dword [0x405300]
call sub.user32.dll_DialogBoxParamA
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov eax, dword [ebp + 0xc]
cmp eax, 0x110
jne 0x401643
push 0x8040
push 0x20
push 0x20
push 1
push 0x7d0
push dword [0x405300]
call sub.user32.dll_LoadImageA
push eax
push 1
push 0x80
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
push 0x3ed
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
push dword [ebp + 0x14]
push 1
push 0x172
push eax
call sub.user32.dll_SendMessageA
mov dword [ebp - 4], 0x100
lea eax, [ebp - 4]
push eax
push 0x40534c
call sub.kernel32.dll_GetComputerNameA
mov dword [ebp - 4], 0x100
lea eax, [ebp - 4]
push eax
push 0x405450
call sub.advapi32.dll_GetUserNameA
push 0x405450
push 0x40534c
call sub.kernel32.dll_lstrcatA
push 0x405308
push 0x40534c
call fcn.00401355
jmp 0x40169f
cmp eax, 0x111
jne 0x401685
cmp dword [ebp + 0x10], 0x3e9
jne 0x40166c
push 0x198
push 0x405554
call sub.kernel32.dll_RtlZeroMemory
push dword [ebp + 8]
call section..text
jmp 0x40169f
cmp dword [ebp + 0x10], 0x3ea
jne 0x40169f
push 0
push 0
push 0x10
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
jmp 0x40169f
cmp eax, 0x10
jne 0x401696
push 0
push dword [ebp + 8]
call sub.user32.dll_EndDialog
jmp 0x40169f
mov eax, 0
leave
ret 0x10
mov eax, 1
leave
ret 0x10

Function at 0x4017cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov edx, dword [0x405750]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [0x405754]
dec edi
xor eax, eax
add bl, byte [edx + 0x405651]
mov al, byte [edx + 0x405651]
mov ch, byte [ebx + 0x405650]
mov byte [ebx + 0x405650], al
mov byte [edx + 0x405651], ch
add al, ch
inc edi
mov al, byte [eax + 0x405650]
inc dl
xor byte [edi], al
dec cl
jne 0x4017e7
mov dword [0x405750], edx
mov dword [0x405754], ebx
pop ebx
pop edi
pop esi
pop ebp
ret 8