joyce8/EMBER2024-capa huggingface dataset:
Function at 0x25546f58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x2554706b
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov dword [ebp - 4], eax
mov ebx, 1
mov esi, 0x2554e828
mov edi, 0x2554e858
push ebp
push 0xb
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x2554b824
mov edx, ebx
dec edx
lea eax, [ebx + 0x44]
dec eax
call fcn.25546f1c
pop ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.25544544
push ebp
push 0xb
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x2554b854
mov edx, ebx
dec edx
lea eax, [ebx + 0x38]
dec eax
call fcn.25546f1c
pop ecx
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.25544544
inc ebx
add edi, 4
add esi, 4
cmp ebx, 0xd
jne 0x25546f8b
mov ebx, 1
mov esi, 0x2554e888
mov edi, 0x2554e8a4
lea eax, [ebx + 5]
mov ecx, 7
cdq
idiv ecx
mov dword [ebp - 8], edx
push ebp
push 6
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x2554b884
mov edx, ebx
dec edx
mov eax, dword [ebp - 8]
add eax, 0x31
call fcn.25546f1c
pop ecx
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.25544544
push ebp
push 6
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x2554b8a0
mov edx, ebx
dec edx
mov eax, dword [ebp - 8]
add eax, 0x2a
call fcn.25546f1c
pop ecx
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.25544544
inc ebx
add edi, 4
add esi, 4
cmp ebx, 8
jne 0x25546fec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x25547072
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.25544514
ret

Function at 0x25547130
Capabilities:
Clear file content
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0
push esi
xor eax, eax
push ebp
push 0x255471c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
mov ecx, 0x255471dc
mov edx, 0x100b
call fcn.25546ea4
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.25546234
mov esi, eax
mov eax, esi
add eax, 0xfffffffd
sub eax, 3
jae 0x255471b1
push 4
push esi
call sub.KERNEL32.DLL_GetLocaleInfoA
push eax
push 0x2554707c
call sub.KERNEL32.DLL_SetEndOfFile
mov edx, 7
mov eax, 0x2554e8ec
mov dword [eax], 0xffffffff
add eax, 4
dec edx
jne 0x25547192
push 3
push esi
call sub.KERNEL32.DLL_GetLocaleInfoA
push eax
push 0x255470b8
call sub.KERNEL32.DLL_SetEndOfFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x255471ce
lea eax, [ebp - 4]
call fcn.255444f0
ret
Function at 0x255471e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x255473b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
mov eax, edi
call fcn.255444f0
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
mov ecx, 0x255473c8
mov edx, 0x1009
call fcn.25546ea4
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.25546234
add eax, 0xfffffffd
sub eax, 3
jb 0x25547386
mov eax, dword [0x2554e8c4]
sub eax, 4
je 0x25547252
add eax, 0xfffffff3
sub eax, 2
jb 0x25547252
xor eax, eax
jmp 0x25547254
mov al, 1
test al, al
je 0x2554728f
jmp 0x2554727f
movzx eax, byte [esi + ebx - 1]
sub al, 0x47
je 0x2554727e
sub al, 0x20
je 0x2554727e
lea eax, [ebp - 0xc]
movzx edx, byte [esi + ebx - 1]
call fcn.255446bc
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.25544770
inc ebx
mov eax, esi
call fcn.25544764
cmp ebx, eax
jle 0x2554725a
jmp 0x25547395
mov eax, edi
mov edx, esi
call fcn.25544544
jmp 0x25547395
movzx eax, byte [esi + ebx - 1]
movzx eax, al
bt dword [0x2554b7dc], eax
jae 0x255472dc
mov edx, ebx
mov eax, esi
call fcn.25547f90
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.255448c0
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.25544770
add ebx, dword [ebp - 4]
jmp 0x25547386
mov edx, 0x255473cc
lea eax, [esi + ebx - 1]
mov ecx, 2
call fcn.255463d8
test eax, eax
jne 0x25547305
mov eax, edi
mov edx, 0x255473d8
call fcn.25544770
inc ebx
jmp 0x25547385
mov edx, 0x255473dc
lea eax, [esi + ebx - 1]
mov ecx, 4
call fcn.255463d8
test eax, eax
jne 0x2554732d
mov eax, edi
mov edx, 0x255473ec
call fcn.25544770
add ebx, 3
jmp 0x25547385
mov edx, 0x255473f4
lea eax, [esi + ebx - 1]
mov ecx, 2
call fcn.255463d8
test eax, eax
jne 0x25547353
mov eax, edi
mov edx, 0x25547400
call fcn.25544770
inc ebx
jmp 0x25547385
movzx eax, byte [esi + ebx - 1]
sub al, 0x59
je 0x25547360
sub al, 0x20
jne 0x2554736e
mov eax, edi
mov edx, 0x2554740c
call fcn.25544770
jmp 0x25547385
lea eax, [ebp - 0x14]
movzx edx, byte [esi + ebx - 1]
call fcn.255446bc
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.25544770
inc ebx
mov eax, esi
call fcn.25544764
cmp ebx, eax
jle 0x2554729d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x255473b7
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.25544514
ret
Function at 0x25548098
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, 0x2554e8c0
mov dword [esi], 0x409
mov dword [esi + 4], 9
mov dword [esi + 8], 1
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
je 0x255480c5
mov dword [esi], eax
test ax, ax
je 0x255480e0
mov edx, eax
and dx, 0x3ff
movzx edx, dx
mov dword [esi + 4], edx
movzx eax, ax
shr eax, 0xa
mov dword [esi + 8], eax
push esi
mov esi, 0x2554813c
mov edi, 0x2554b7dc
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
cmp dword [0x2554b7cc], 4
jle 0x2554810b
cmp dword [0x2554b7c8], 2
jne 0x2554810b
mov byte [esi + 0xd], 1
jmp 0x2554811a
push 0x4a
call sub.KERNEL32.DLL_lstrlenA
test eax, eax
setne al
mov byte [esi + 0xd], al
push 0x2a
call sub.KERNEL32.DLL_lstrlenA
test eax, eax
setne bl
mov byte [esi + 0xc], bl
test bl, bl
je 0x25548134
push ebp
call fcn.2554803c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4021a0
Capabilities:
Create process on windows
Create process suspended
Read file via mapping

Disassembly:
sub esp, 0x154
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x64]
push 0x100
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x64]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov cl, 0x65
mov byte [eax + 0xa], cl
mov byte [eax + 0xb], 0
push str.__SPVZ__
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
mov byte [eax + 1], 0x53
mov byte [eax + 7], 0x2e
mov byte [eax + 8], cl
mov byte [eax + 3], 0x56
mov byte [eax + 4], 0x69
mov byte [eax + 2], 0x70
mov byte [eax + 5], 0x72
mov byte [eax + 6], 0x4c
mov byte [eax + 9], 0x78
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0x1000
push 0
mov ebx, eax
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, dword [esp + 0x16c]
mov ebp, eax
mov ecx, 0x400
xor eax, eax
mov edi, ebp
lea edx, [ebp + 0x800]
rep stosd dword es:[edi], eax
lea edi, [ebp + 0x400]
mov ecx, 0x1d
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x170]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x14], ecx
lea edi, [esp + 0x24]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x24]
push eax
push 0
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x58], 0x100
push 0
push 0x20
push 0
push 0
lea ecx, [esp + 0x80]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4022db
mov edx, dword [esp + 0x10]
push 0x4000
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x168]
mov eax, dword [ebp + 0xc]
push ebp
mov dword [ecx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x154
ret
Function at 0x403430
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x40347b
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, 1
mov ebp, ebx
sub edi, ebx
sub ebp, ecx
mov dword [esp + 0x14], eax
lea esi, [ecx + ebp]
lea eax, [esi + edi]
cdq
idiv dword [esp + 0x1c]
mov al, byte [edx + ebx]
mov dl, byte [ecx]
xor al, dl
mov dl, byte [esi]
xor al, dl
mov byte [ecx], al
mov eax, dword [esp + 0x14]
inc ecx
dec eax
mov dword [esp + 0x14], eax
jne 0x403453
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x411920
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
cmp ebp, 0xffffffff
jne 0x411932
or eax, ebp
pop ebp
pop ebx
ret
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_rand]
call edi
and eax, 0x800000ff
jns 0x41194e
dec eax
or eax, 0xffffff00
inc eax
mov byte [esi + 1], al
call edi
and eax, 0x800000ff
jns 0x411961
dec eax
or eax, 0xffffff00
inc eax
mov byte [esi + 0xfc], al
call edi
and eax, 0x800000ff
jns 0x411977
dec eax
or eax, 0xffffff00
inc eax
mov byte [esi + 0xfd], al
call edi
and eax, 0x800000ff
jns 0x41198d
dec eax
or eax, 0xffffff00
inc eax
mov byte [esi + 0xfe], al
call edi
and eax, 0x800000ff
jns 0x4119a3
dec eax
or eax, 0xffffff00
inc eax
mov edi, dword [esp + 0x1c]
mov byte [esi + 0xff], al
mov eax, 2
cmp edi, eax
jle 0x4119c6
mov cl, byte [esi + 1]
mov dl, byte [eax + esi]
xor dl, cl
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jl 0x4119b6
mov eax, 1
cmp edi, eax
jle 0x4119db
xor edx, edx
mov dl, byte [eax + esi]
add ebx, edx
inc eax
cmp eax, edi
jl 0x4119cf
and ebx, 0x800000ff
jns 0x4119eb
dec ebx
or ebx, 0xffffff00
inc ebx
mov eax, dword [esp + 0x20]
mov byte [esi], bl
push eax
push edi
push esi
push ebp
call sub.WSOCK32.dll_send
xor ecx, ecx
cmp eax, edi
pop edi
pop esi
sete cl
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x411a10
Capabilities:
Encode data using xor
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
cmp eax, 0xffffffff
jne 0x411a20
or eax, eax
pop ebx
ret
mov ecx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
push ecx
push edi
push esi
push eax
call sub.WSOCK32.dll_recv
mov ecx, 1
mov ebp, eax
cmp edi, ecx
jle 0x411a4f
xor edx, edx
mov dl, byte [ecx + esi]
add ebx, edx
inc ecx
cmp ecx, edi
jl 0x411a43
mov ecx, 2
cmp edi, ecx
jle 0x411a68
mov al, byte [esi + 1]
mov bl, byte [ecx + esi]
xor bl, al
mov byte [ecx + esi], bl
inc ecx
cmp ecx, edi
jl 0x411a58
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x411a70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
cmp ebx, 0xffffffff
mov dword [esp + 8], edi
jne 0x411a88
or eax, ebx
pop edi
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esp + 0x18]
cmp ebp, edi
push esi
jle 0x411ac0
push 2
lea eax, [esp + 0x14]
push 1
push eax
push ebx
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jne 0x411ab6
push 1
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebp
jl 0x411a92
test esi, esi
jle 0x411ac0
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
pop esi
pop ebp
pop edi
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x411ad0
Capabilities:
Create raw socket
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x294
mov eax, dword [esp + 0x298]
mov ecx, dword [esp + 0x29c]
mov edx, dword [esp + 0x2a0]
push esi
push edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2ac]
push 1
push 3
push 2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
call sub.WSOCK32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
je 0x411c17
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov byte [esp + 0x24], 8
call edi
lea ecx, [esp + 0x24]
push 0x30
push ecx
mov word [esp + 0x30], ax
call fcn.00411c30
add esp, 8
lea edx, [esp + 0xc]
mov word [esp + 0x26], ax
lea eax, [esp + 0x24]
push 0x10
push edx
push 0
push 0x30
push eax
push esi
call sub.WSOCK32.dll_sendto
cmp eax, 0xffffffff
je 0x411c11
lea ecx, [esp + 0xc]
push 0x10
push ecx
push 0
lea edx, [esp + 0x30]
push 0x30
push edx
push esi
call sub.WSOCK32.dll_sendto
cmp eax, 0xffffffff
je 0x411c11
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x54]
push eax
push 0
push 0
push ecx
push 1
mov dword [esp + 0x68], 1
mov dword [esp + 0x6c], esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 2
call sub.WSOCK32.dll_select
test eax, eax
je 0x411c11
cmp eax, 0xffffffff
je 0x411c11
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push 0
lea ecx, [esp + 0x164]
push 0x144
push ecx
push esi
mov dword [esp + 0x20], 0x10
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
push esi
je 0x411c12
call sub.WS2_32.dll_closesocket
call edi
xor edx, edx
cmp word [esp + 0x170], ax
pop edi
pop esi
sete dl
mov eax, edx
add esp, 0x294
ret
push esi
call sub.WS2_32.dll_closesocket
pop edi
xor eax, eax
pop esi
add esp, 0x294
ret

Function at 0x416870
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
and eax, 0xff
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sar ecx, 8
and ecx, 0xff
and ecx, 0xff
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0x80000000
jae 0x4168c5
mov edx, dword [ebp - 8]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
mov dword [ebp - 0x14], edx
jmp 0x4168ea
cmp dword [ebp - 0x10], 4
jae 0x4168e3
mov eax, dword [ebp - 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and ah, 0x7f
mov dword [ebp - 0x14], eax
jmp 0x4168ea
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 5
jne 0x4168fd
cmp dword [ebp - 4], 2
jne 0x4168fd
mov dword [ebp - 0xc], 8
cmp dword [ebp - 0x10], 5
jne 0x416910
cmp dword [ebp - 4], 1
jne 0x416910
mov dword [ebp - 0xc], 7
cmp dword [ebp - 0x10], 5
jne 0x416923
cmp dword [ebp - 4], 0
jne 0x416923
mov dword [ebp - 0xc], 6
cmp dword [ebp - 0x10], 4
jne 0x416936
cmp dword [ebp - 4], 0
jne 0x416936
mov dword [ebp - 0xc], 4
cmp dword [ebp - 0x10], 3
jne 0x416949
cmp dword [ebp - 4], 0
jne 0x416949
mov dword [ebp - 0xc], 5
cmp dword [ebp - 0x10], 4
jne 0x41695c
cmp dword [ebp - 4], 1
jne 0x41695c
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x416963
Capabilities:
Check mutex on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push edi
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
push str.FLEXLM_TS_GATE
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x4169fe
push str.bypass
mov eax, dword [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4169fe
xor eax, eax
jmp 0x416bda
cmp dword [0x4848c0], 0
jne 0x416bce
call sub.MSVCRT.dll__getpid
push eax
push str.TerminalServerFlexlmMutex
push 0x47224c
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x104]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x416a52
xor eax, eax
jmp 0x416bda
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x416a6e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x4848c0], 0
jne 0x416bb4
call fcn.00416870
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x124]
sub edx, 4
mov dword [ebp - 0x124], edx
cmp dword [ebp - 0x124], 4
ja case.default.0x416ab4
mov eax, dword [ebp - 0x124]
jmp dword [eax*4 + 0x416bdf]
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4848d0], eax
cmp dword [0x4848d0], 0
je 0x416b6d
push str.WTSEnumerateSessionsA
mov ecx, dword [0x4848d0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4848c8], eax
cmp dword [0x4848c8], 0
je 0x416b6d
push str.WTSFreeMemory
mov edx, dword [0x4848d0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4848cc], eax
cmp dword [0x4848cc], 0
je 0x416b6d
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 1
push 0
push 0
call dword [0x4848c8]
cmp dword [ebp - 0x114], 0
je 0x416b47
mov edx, dword [ebp - 0x114]
cmp dword [edx + 8], 0
jne 0x416b56
mov eax, dword [ebp - 0x114]
push eax
call dword [0x4848cc]
jmp 0x416b6d
mov ecx, dword [ebp - 0x114]
push ecx
call dword [0x4848cc]
mov dword [0x4848c4], 1
mov edx, dword [0x4848d0]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4848d0], 0
jmp case.default.0x416ab4
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je case.default.0x416ab4
mov dword [0x4848c4], 1
mov dword [0x4848c0], 1
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x4848c4], 0
setne al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4172fc
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
add eax, 0x80000002
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004187c0
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4173ef
push 0
call fcn.00417481
add esp, 4
push 1
call fcn.00417481
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4173ef
mov eax, dword [ebp - 0xc]
push eax
call fcn.0041ac76
add esp, 4
cmp dword [ebp + 8], 0
je 0x4173e5
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0
je 0x4173b7
xor edx, edx
test edx, edx
je 0x4173b7
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x14], ecx
jmp 0x4173be
mov dword [ebp - 0x14], 0xffffffc1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x14], eax
push 0
push 0xff
push 0
push 0
push 0x1de
push 0xffffffffffffffc1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404a80
add esp, 0x1c
mov eax, 1
jmp 0x41747d
mov edx, dword [ebp - 0xc]
push edx
call fcn.0041ac76
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x417417
cmp dword [ebp + 0x14], 0
jne 0x417427
mov eax, dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jne 0x417427
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x417471
cmp dword [ebp + 0x14], 0
je 0x417435
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
jmp 0x417447
mov ecx, dword [ebp + 0x10]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
neg ecx
sbb ecx, ecx
and ecx, 2
add ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00446570
add esp, 0x18
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4188f2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
pop ebp
ret

Function at 0x41aa0a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
je 0x41aa20
mov eax, dword [ebp + 0x10]
mov dword [0x487420], eax
jmp 0x41aa2a
mov dword [0x487420], 0xffffffff
mov ecx, dword [ebp + 0x14]
mov dword [0x48741c], ecx
cmp dword [0x484a0c], 0
je 0x41aa4b
mov edx, dword [0x487428]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x41aabe
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x487428], eax
cmp dword [0x487428], 0
jne 0x41aa6b
xor eax, eax
jmp 0x41aac3
push 4
push 1
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41aa85
xor eax, eax
jmp 0x41aac3
mov eax, dword [ebp - 4]
mov ecx, dword [0x487428]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0x41a976
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [0x484a0c], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x484a0c], 0
jne 0x41aabe
xor eax, eax
jmp 0x41aac3
mov eax, dword [0x484a0c]
mov esp, ebp
pop ebp
ret

Function at 0x41aae8
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [0x484a04], eax
cmp dword [0x484a04], 0
je 0x41ab10
mov eax, dword [0x484a04]
jmp 0x41ab89
lea ecx, [ebp - 0x10]
push ecx
push 1
push 0
push str.SOFTWAREFLEXlm_License_Manager
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41ab87
mov dword [ebp - 0xc], 0xc7
lea edx, [ebp - 0xc]
push edx
push 0x48493c
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41ab79
mov dword [0x484a04], 0x48493c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x484a04]
jmp 0x41ab89
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x41ab89
xor eax, eax
mov esp, ebp
pop ebp
ret