joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448800
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.004257f0
lea ecx, [ebp - 0x34]
call fcn.004257f0
call fcn.0042d110
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00425740
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x448853
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.00425890
lea ecx, [ebp - 0x4c]
call fcn.00425890
mov eax, dword [ebp - 8]
jmp 0x4488c8
call fcn.0042d110
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00425740
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x44888e
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.00425890
lea ecx, [ebp - 0x4c]
call fcn.00425890
mov eax, dword [ebp - 0x10]
jmp 0x4488c8
lea ecx, [ebp - 0x34]
call fcn.00425b40
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.00425b40
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.00425890
lea ecx, [ebp - 0x4c]
call fcn.00425890
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret

Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x5ccf60e2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, str._q.q
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x716c4cce
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x1001feb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b7466
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push ebx
push esi
mov eax, dword [0x100de3a4]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
push 1
xor ebx, ebx
push 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ebx
call fcn.1001f890
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0xc4]
mov edx, dword [esp + 0xc0]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0xc8], ebx
call fcn.1001c710
add esp, 0x10
mov esi, eax
lea ecx, [esp + 0x34]
mov byte [esp + 0xb8], 1
call fcn.10013510
cmp dword [esi + 0x18], 0x10
mov eax, dword [esi + 0x14]
jb 0x1001ff3b
mov esi, dword [esi + 4]
jmp 0x1001ff3e
add esi, 4
mov ecx, dword [esp + 0x74]
push ecx
push eax
push esi
lea ecx, [esp + 0x40]
call fcn.10014100
cmp dword [esp + 0x28], 0x10
mov byte [esp + 0xb8], bl
jb 0x1001ff69
mov edx, dword [esp + 0x14]
push edx
call fcn.1007af72
add esp, 4
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.1001fc10
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x7c]
mov dword [esp + 0xb8], 0xffffffff
call fcn.1001bf70
lea ecx, [esp + 0x7c]
push ecx
mov dword [esp + 0x80], vtable.std::ios_base.0
call fcn.10078ee9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xb0
ret
Function at 0x10021d70
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100de3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
push 0
push 8
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10021e1a
call esi
cmp eax, 0x3f0
jne 0x10021dfa
lea ecx, [ebp - 0x14]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10021e1a
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007b636
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007b636
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 2
push edx
call ebx
test eax, eax
jne 0x10021de4
call esi
cmp eax, 0x7a
jne 0x10021de4
mov edi, dword [ebp - 0x18]
mov eax, edi
call fcn.1007c9a0
mov esi, esp
test esi, esi
je 0x10021de4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 2
push ecx
call ebx
test eax, eax
je 0x10021de4
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10021de4
xor edi, edi
mov byte [ebp - 0xd], 0
cmp dword [esi], edi
jbe 0x10021eb4
lea ebx, [esi + 4]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebx]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10021eb0
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x10021e95
jmp 0x10021eb4
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0xd]
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007b636
mov esp, ebp
pop ebp
ret
Function at 0x10021ee0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100de3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
push 0
push 8
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10021f8a
call esi
cmp eax, 0x3f0
jne 0x10021f6a
lea ecx, [ebp - 0x14]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10021f8a
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007b636
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007b636
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 2
push edx
call ebx
test eax, eax
jne 0x10021f54
call esi
cmp eax, 0x7a
jne 0x10021f54
mov edi, dword [ebp - 0x18]
mov eax, edi
call fcn.1007c9a0
mov esi, esp
test esi, esi
je 0x10021f54
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 2
push ecx
call ebx
test eax, eax
je 0x10021f54
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x222
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10021f54
xor edi, edi
mov byte [ebp - 0xd], 0
cmp dword [esi], edi
jbe 0x10022024
lea ebx, [esi + 4]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebx]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10022020
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x10022005
jmp 0x10022024
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0xd]
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007b636
mov esp, ebp
pop ebp
ret
Function at 0x10031250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x100b86f0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100de3a4]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x18], ebx
mov edi, dword [esp + 0x70]
mov eax, dword [edi]
xor ebp, ebp
xor esi, esi
mov byte [esp + 0x14], 0
cmp eax, ebp
je 0x100312d0
mov ecx, str.AMT_SERIALIZE_ONLY_APP
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100312b5
test dl, dl
je 0x100312b1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100312b5
add eax, 2
add ecx, 2
test dl, dl
jne 0x10031295
xor eax, eax
jmp 0x100312ba
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
je 0x100312cb
inc esi
lea eax, [esi + esi*2]
mov eax, dword [edi + eax*4]
cmp eax, ebp
jne 0x10031290
jmp 0x100312d0
mov byte [esp + 0x14], 1
cmp byte [ebx + 0x21], 0
jne 0x100312e0
cmp byte [ebx + 0x22], 0
jne 0x100312e0
xor bl, bl
jmp 0x100312e2
mov bl, 1
mov edx, dword [esp + 0x68]
mov edi, 0xf
mov eax, edx
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebp
mov byte [esp + 0x3c], 0
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10031300
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x40]
call fcn.10011860
mov ecx, dword [esp + 0x6c]
mov eax, ecx
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
lea esi, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10031330
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.10011860
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x64]
push ebx
push ecx
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0x70], 1
call fcn.1001b600
add esp, 0x14
test al, al
mov esi, 0x10
sete bl
cmp dword [esp + 0x34], esi
jb 0x10031383
mov edx, dword [esp + 0x20]
push edx
call fcn.1007af72
add esp, 4
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
mov dword [esp + 0x5c], 0xffffffff
cmp dword [esp + 0x50], esi
jb 0x100313ab
mov eax, dword [esp + 0x3c]
push eax
call fcn.1007af72
add esp, 4
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebp
mov byte [esp + 0x3c], 0
test bl, bl
je 0x100313e4
push str.Catastrophic_failure_to_initialize_application___Probably_client_is_misconfigured.
push ebp
push 1
push 0x100be558
call fcn.10013480
push eax
call fcn.100564f0
mov ecx, dword [esp + 0x2c]
add esp, 0x14
mov dword [ecx + 0xc], 3
jmp 0x1003143f
call fcn.10012e20
mov esi, dword [esp + 0x18]
push str.Application_state_initialized.__Obtaining_Product_License.
push ebp
cmp eax, ebp
setne dl
push 4
push 0x100be558
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], dl
call fcn.10013480
push eax
call fcn.100564f0
mov eax, dword [esp + 0x84]
add esp, 0x14
push eax
mov ecx, esi
call fcn.10020980
mov ecx, dword [esp + 0x74]
push ecx
mov ecx, esi
call fcn.10020f00
mov edx, dword [esp + 0x78]
push edx
mov ecx, esi
call fcn.10030d90
call fcn.100185e0
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x18
Function at 0x10039e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b9088
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100de3a4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
xor ebx, ebx
mov dword [esp + 0x24], ebx
cmp dword [0x100df920], edi
jne 0x10039eef
mov eax, dword [edi + 4]
mov esi, dword [eax]
cmp esi, eax
je 0x10039ee9
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ebx, [ebx]
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x10039ea7
push eax
call ebp
cmp eax, ebx
jne 0x10039ea4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x28], ebx
cmp byte [esi + 0x2d], bl
jne 0x10039ee4
mov eax, dword [esi + 8]
cmp byte [eax + 0x2d], bl
jne 0x10039ecb
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x2d], bl
jne 0x10039ee4
lea ecx, [ecx]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x2d], bl
je 0x10039ec0
jmp 0x10039ee4
mov eax, dword [esi + 4]
cmp byte [eax + 0x2d], bl
jne 0x10039ee2
cmp esi, dword [eax + 8]
jne 0x10039ee2
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x2d], bl
je 0x10039ed3
mov esi, eax
cmp esi, dword [edi + 4]
jne 0x10039e90
mov dword [0x100df920], ebx
mov eax, dword [edi + 0x1c]
lea esi, [edi + 0x18]
cmp eax, ebx
je 0x10039f15
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 8]
push edx
push esi
push ecx
push eax
call fcn.10038d50
mov eax, dword [esi + 4]
push eax
call fcn.1007af72
add esp, 0x14
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
lea esi, [edi + 0xc]
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.100395f0
mov eax, dword [esi + 4]
push eax
call fcn.1007af72
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea ecx, [esp + 0x20]
push ecx
mov ecx, edi
mov dword [esp + 0x30], 0xffffffff
call fcn.100395f0
mov edx, dword [edi + 4]
push edx
call fcn.1007af72
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10041d60
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x10041f10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
xor edx, edx
mov byte [ecx + 0x100], dl
mov byte [ecx + 0x101], dl
mov byte [esp + 3], dl
xor eax, eax
mov byte [eax + ecx], al
inc eax
cmp eax, 0x100
jl 0x10041f25
push ebx
push esi
push edi
xor esi, esi
mov eax, esi
cdq
idiv dword [ecx + 0x204]
mov bl, byte [esi + ecx]
mov al, byte [esp + 0xf]
inc esi
movzx edx, byte [edx + ecx + 0x102]
add dl, bl
add al, dl
cmp esi, 0x100
mov byte [esp + 0xf], al
movzx eax, al
movzx edx, byte [eax + ecx]
lea edi, [eax + ecx]
mov byte [esi + ecx - 1], dl
mov byte [edi], bl
jl 0x10041f35
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x10041f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [esp + 4], 0
push ebp
push esi
mov esi, ecx
je 0x1004200e
cmp dword [esp + 0x10], 0
je 0x1004200e
mov ebp, dword [esp + 0x14]
test ebp, ebp
jle 0x1004200e
mov cl, byte [esi + 0x100]
push ebx
mov bl, byte [esi + 0x101]
push edi
jmp 0x10041fb4
mov bl, byte [esp + 0x1c]
inc cl
movzx eax, cl
mov dl, byte [eax + esi]
add eax, esi
add bl, dl
movzx edi, bl
add edi, esi
mov byte [esp + 0x1c], bl
mov bl, byte [edi]
mov byte [eax], bl
mov byte [edi], dl
mov al, byte [eax]
mov edi, dword [esp + 0x14]
add al, dl
movzx edx, al
movzx edx, byte [edx + esi]
xor dl, byte [edi]
mov eax, dword [esp + 0x18]
dec ebp
mov byte [eax], dl
inc eax
inc edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edi
test ebp, ebp
jg 0x10041fb0
mov al, byte [esp + 0x1c]
pop edi
pop ebx
mov byte [esi + 0x101], al
mov byte [esi + 0x100], cl
pop esi
mov al, 1
pop ebp
ret 0xc
pop esi
xor al, al
pop ebp
ret 0xc
Function at 0x10044b25
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x100df93c], eax
mov al, byte [ebp + 0x10]
mov byte [0x100df944], al
mov eax, dword [ebp + 0xc]
mov dword [0x100df940], eax
mov eax, dword [0x100df974]
test eax, eax
je 0x10044b50
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x10]
push eax
push 0
push 0x100df93c
push 0x10043908
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100df974], eax
test eax, eax
jne 0x10044b9b
push 0x22a6
push str.ALM_Pri_RunPlatformThread
push str.__req_
push str._s:__func:__s__line:__d_
push 0x100c3bf0
call fcn.1004b14b
add esp, 0x14
mov eax, 0x8282
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1004cf71
Capabilities:
Check for time delay via gettickcount

Disassembly:
jmp 0x1005142a
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xac
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 0x70]
push dword [0x100dfef4]
and dword [ebp + 0x64], 0
mov edi, dword [esi]
mov dword [ebp + 0x60], eax
call fcn.10061630
push dword [0x100dfef4]
mov ebx, eax
call fcn.10061630
push ebx
push esi
mov dword [ebp + 0x70], eax
call fcn.1004fded
push ebx
push dword [ebp + 0x70]
push 1
push esi
call fcn.100511f3
add esp, 0x20
push 1
push 3
lea ecx, [ebp - 0x44]
call fcn.100513c3
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
lea eax, [ebp - 0x3c]
push str.CancelPort
push eax
call fcn.10018b80
pop ecx
pop ecx
mov ecx, eax
call fcn.10018d90
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x44]
call fcn.10050f04
cmp dword [eax + 0x18], 0x10
jb 0x100514bb
mov eax, dword [eax + 4]
jmp 0x100514be
add eax, 4
push eax
push dword [ebp + 0x70]
push 0
push edi
call fcn.1004b343
pop ecx
push eax
push dword [0x100dfef4]
call fcn.10061340
add esp, 0x14
push 0
push 1
lea ecx, [ebp + 0x44]
mov edi, eax
call fcn.10001b20
test edi, edi
jne 0x100514fc
push ebx
push esi
mov dword [ebp + 0x64], 1
call fcn.1004fe0e
pop ecx
pop ecx
push ebx
push dword [0x100dfef4]
call fcn.10061720
pop ecx
pop ecx
test di, di
jne 0x1005151b
push 0x100c3ca0
push str._s:_Activation_Succeed
jmp 0x1005152f
mov eax, 0xd001
cmp di, ax
jne 0x1005153f
push 0x100c3ca0
push str._s:_Activation_Canceled
mov esi, 0x100c3bf0
push esi
call fcn.1004b14b
add esp, 0xc
jmp 0x10051564
push edi
push dword [0x100dfef4]
call fcn.100622e0
push eax
push 0x100c3ca0
push str._s:_Activation_Failed:__s
mov esi, 0x100c3bf0
push esi
call fcn.1004b14b
add esp, 0x18
push dword [ebp + 0x70]
push dword [0x100dfef4]
call fcn.10061720
mov eax, dword [ebp + 0x78]
pop ecx
pop ecx
test eax, eax
je 0x10051580
mov ecx, dword [ebp + 0x64]
mov dword [eax], ecx
mov eax, dword [ebp + 0x7c]
test eax, eax
je 0x1005158a
and dword [eax], 0
lea ecx, [ebp - 0x44]
call fcn.100506d6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0x60]
mov dword [ebp + 0x70], eax
fild dword [ebp + 0x70]
test eax, eax
jge 0x100515ab
fadd qword [0x100c3f90]
fdiv qword [0x100c3f88]
fld qword [0x100c3f80]
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x100515df
push ecx
push ecx
fstp qword [esp]
push str.ALM_SL_ProductLicense_Activate
push str._time_
push str._s:__func:__s__duration:__.3f_sec_
push esi
call fcn.1004b14b
add esp, 0x18
jmp 0x100515e1
fstp st(0)
mov ax, di
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret
Function at 0x1004cf76
Capabilities:
Check for time delay via gettickcount

Disassembly:
jmp 0x100515ec
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xb0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp + 0x70]
mov ebx, dword [edi]
xor esi, esi
push esi
push esi
push esi
mov dword [ebp + 0x60], eax
push esi
lea eax, [ebp + 0x5c]
push eax
push esi
push ebx
mov dword [ebp + 0x64], esi
call fcn.1004b343
pop ecx
push eax
push dword [0x100dfef4]
call fcn.10061030
add esp, 0x20
cmp dword [ebp + 0x5c], 3
jne 0x100516d5
push dword [0x100dfef4]
call fcn.10061630
push esi
push eax
push esi
push edi
mov dword [ebp + 0x70], eax
call fcn.100511f3
add esp, 0x14
push 1
push 3
lea ecx, [ebp - 0x48]
call fcn.100513c3
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
lea eax, [ebp - 0x40]
push str.CancelPort
push eax
call fcn.10018b80
pop ecx
pop ecx
mov ecx, eax
call fcn.10018d90
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0x48]
call fcn.10050f04
cmp dword [eax + 0x18], 0x10
jb 0x10051690
mov eax, dword [eax + 4]
jmp 0x10051693
add eax, 4
push eax
push dword [ebp + 0x70]
push esi
push ebx
call fcn.1004b343
pop ecx
push eax
push dword [0x100dfef4]
call fcn.10061440
add esp, 0x14
push esi
push 1
lea ecx, [ebp + 0x40]
mov ebx, eax
call fcn.10001b20
push dword [ebp + 0x70]
push dword [0x100dfef4]
call fcn.10061720
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
call fcn.100506d6
jmp 0x100516ec
push ebx
call fcn.1004b343
push eax
push dword [0x100dfef4]
call fcn.10062010
add esp, 0xc
mov ebx, eax
cmp ebx, esi
jne 0x100516f7
mov dword [ebp + 0x64], 1
cmp bx, si
jne 0x10051708
push 0x100c3ca0
push str._s:_Return_Succeed
jmp 0x1005171c
mov eax, 0xd001
cmp bx, ax
jne 0x1005172c
push 0x100c3ca0
push str._s:_Return_Canceled
mov edi, 0x100c3bf0
push edi
call fcn.1004b14b
add esp, 0xc
jmp 0x10051751
push ebx
push dword [0x100dfef4]
call fcn.100622e0
push eax
push 0x100c3ca0
push str._s:_Return_Failed:__s
mov edi, 0x100c3bf0
push edi
call fcn.1004b14b
add esp, 0x18
mov eax, dword [ebp + 0x7c]
cmp eax, esi
je 0x1005175d
mov ecx, dword [ebp + 0x64]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0x60]
mov dword [ebp + 0x70], eax
fild dword [ebp + 0x70]
test eax, eax
jge 0x10051776
fadd qword [0x100c3f90]
fdiv qword [0x100c3f88]
fld qword [0x100c3f80]
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x100517aa
push ecx
push ecx
fstp qword [esp]
push str.ALM_SL_ProductLicense_Deactivate
push str._time_
push str._s:__func:__s__duration:__.3f_sec_
push edi
call fcn.1004b14b
add esp, 0x18
jmp 0x100517ac
fstp st(0)
pop edi
pop esi
mov ax, bx
pop ebx
add ebp, 0x68
leave
ret