joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473f2c
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa7c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x584], ecx
mov dword [ebp - 0x580], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x474119
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x14]
mov edx, 0x474134
call fcn.004045c0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.004049e8
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4740ec
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.004049e8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4740d5
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x57c]
push eax
push 0x13
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_HttpQueryInfoA
lea ebx, [ebp - 0x57c]
lea eax, [ebp - 0x580]
mov edx, ebx
call fcn.00404720
mov eax, dword [ebp - 0x580]
mov edx, 0x474144
call fcn.00404934
je 0x474026
lea eax, [ebp - 0x584]
mov edx, ebx
call fcn.00404720
mov eax, dword [ebp - 0x584]
mov edx, 0x474150
call fcn.00404934
jne 0x4740d1
xor eax, eax
push ebp
push 0x4740ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
lea eax, [ebp - 0x568]
call fcn.00402e00
mov edx, 1
lea eax, [ebp - 0x568]
call fcn.00403200
call fcn.004028ec
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x41c]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x568]
call fcn.00402f50
call fcn.004028ec
cmp dword [ebp - 0x10], 0
jne 0x474056
lea eax, [ebp - 0x568]
call fcn.00402f70
call fcn.004028ec
cmp byte [ebp - 0x41c], 0x3d
jne 0x4740af
mov byte [ebp - 1], 0
jmp 0x4740b3
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4740d5
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4740f3
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x4741d4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049d8
mov eax, dword [ebp - 8]
call fcn.004049d8
xor eax, eax
push ebp
push 0x474267
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x47a020], 0
mov eax, 0x47a024
mov edx, dword [ebp - 4]
call fcn.0040457c
mov eax, 0x47a028
mov edx, dword [ebp - 8]
call fcn.0040457c
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x474154
push 0
push 0
call sub.kernel32.dll_CreateThread
test eax, eax
jne 0x47424c
push 0x10
push 0x474274
push 0x47427c
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47426e
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040454c
ret

Function at 0x4742a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049d8
xor eax, eax
push ebp
push 0x47431b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004047e8
mov edx, eax
mov eax, edi
call fcn.00404b74
mov eax, dword [ebp - 4]
call fcn.004047e8
mov esi, eax
test esi, esi
jle 0x474305
mov ebx, 1
mov eax, edi
call fcn.00404a40
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor edx, dword [ebp - 8]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4742eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474322
lea eax, [ebp - 4]
call fcn.00404528
ret

Function at 0x47432c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049d8
mov eax, dword [ebp - 8]
call fcn.004049d8
xor eax, eax
push ebp
push 0x4743d3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004045c0
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.004030d8
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], 1
push 0x47a00c
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 8]
call fcn.004049e8
push eax
push 0
push 4
push 0xffffffffffffffff
push 0
push 0
push 0x4743e0
mov eax, dword [ebp - 0xc]
call fcn.004049e8
push eax
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4743da
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040454c
ret
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x706f64
outsd dx, dword [esi]
jo 0x401005
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [ebx], esp
jge 0x401055
ja 0x4010fe
fld xword [esi - 7]
or al, 0xb7
dec edx
mov ch, 0xfc
outsd dx, dword [esi]
jns 0x4010cd
fcom qword [eax - 0x69d98623]
retf 0x41f8
and ecx, eax
hlt
int1
push 0xffffffffffffffc2
cmp dh, byte [edx + 0xc64b3b4]
inc edx
stosd dword es:[edi], eax
adc eax, 0xa48720e9
jl 0x40108d
hlt
push 0xffffffffffffff9c
pushfd
retf
Function at 0x40110a
Capabilities:
Create process on windows
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push 0x4010dd
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0x4010cf
push 0x4010e8
push 0x40100b
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x4010c5
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
push eax
call sub.kernel32.dll_LoadLibraryA
test eax, eax
jne 0x4011b7
lea eax, [ebp - 0x104]
push eax
call fcn.00401260
push 0x4010cf
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
push eax
call sub.kernel32.dll_LoadLibraryA
test eax, eax
jne 0x4011b7
push 0x100
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x401108
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4010cf
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
push eax
call sub.kernel32.dll_LoadLibraryA
test eax, eax
jne 0x4011b7
mov dword [ebp - 0x108], eax
push 0x40100b
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4011ec
push 0x3e8
call eax
test eax, eax
je 0x4011ec
call 0x4011dc
add dword [esp], 0x1e24
call eax
push 0
call sub.kernel32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.kernel32.dll_FreeLibrary
push 0x14
push 0x401016
push 0x40101f
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 7
jne 0x401211
leave
ret
push 1
push 0x401108
push 0x401108
push 0x4010ed
push 0x401103
push 0
call sub.shell32.dll_ShellExecuteA
leave
ret
Function at 0x9f1790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x508000]
push edi
or ebp, 0xffffffff
jmp 0x9f17b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9f17b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9f17a8
mov eax, 1
add ebx, ebx
jne 0x9f17cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9f17dc
jne 0x9f17ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9f17ec
dec eax
add ebx, ebx
jne 0x9f17e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9f17c0
xor ecx, ecx
sub eax, 3
jb 0x9f1804
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9f1876
sar eax, 1
mov ebp, eax
jmp 0x9f180f
add ebx, ebx
jne 0x9f180f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x9f181c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x9f1840
inc ecx
add ebx, ebx
jne 0x9f182c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9f1821
jne 0x9f183d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9f1821
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9f1860
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9f1851
jmp 0x9f17ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9f1860
add edi, ecx
jmp 0x9f17ae
pop esi
mov edi, esi
mov ecx, 0x5c9839
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x9f189b
cmp byte [edi], 0x13
jne 0x9f1880
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x9f187e
lea edi, [esi + 0x5ef000]
mov eax, dword [edi]
or eax, eax
je 0x9f18ec
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5f7758]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5f7794]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9f18a1
mov ecx, edi
jns 0x9f18d0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5f7798]
or eax, eax
je 0x9f18e6
mov dword [ebx], eax
add ebx, 4
jmp 0x9f18be
call dword [esi + 0x5f779c]
popal
jmp 0x406674
Function at 0x1001270
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x10010d0
call fcn.0100140c
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x10012ab
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10012ab
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10012c3
cmp eax, 0x20b
je 0x10012b0
mov dword [ebp - 0x1c], edi
jmp 0x10012d7
cmp dword [ecx + 0x84], 0xe
jbe 0x10012ab
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x10012d1
cmp dword [ecx + 0x74], 0xe
jbe 0x10012ab
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1002060], 0xffffffff
or dword [0x1002064], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100202c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1002028]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1002068], eax
call fcn.01001408
cmp dword [section..data], edi
jne 0x1001332
push fcn.01001408
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010013f6
push 0x100108c
push 0x1001088
call sub.msvcrt.dll__initterm
mov eax, dword [0x1002024]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1002020]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001084
push 0x1001080
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01001241
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x10013a9
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10013de
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01001445
ret
Function at 0x104f8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104f81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104f807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104f806a
add dl, dl
jne 0x104f8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104f80dc
xor eax, eax
add dl, dl
jne 0x104f8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104f817d
add dl, dl
jne 0x104f80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104f80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104f80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104f80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104f80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104f8075
mov eax, 1
add dl, dl
jne 0x104f80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104f80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104f80e1
sub eax, ebx
mov ebx, 1
jne 0x104f8128
mov ecx, 1
add dl, dl
jne 0x104f810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104f8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104f8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104f8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104f813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104f814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104f8136
cmp eax, 0x7d00
jae 0x104f816d
cmp eax, 0x500
jb 0x104f8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104f8075
cmp eax, 0x7f
ja 0x104f8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104f8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104f819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104f8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4066ca
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x344c
call fcn.004b4840
mov dword [ebp - 0x1008], 0
push 0x4c9288
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x4e7604]
push ecx
call fcn.0042e4d0
add esp, 0xc
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
jne 0x40672c
push 0
push 1
call fcn.0040f302
add esp, 8
mov edx, dword [ebp + 8]
push edx
push str.Error_opening_finder_config._file___s__n
call fcn.0040f492
add esp, 8
push 1
call fcn.004b4c8d
push 2
push 0
mov eax, dword [ebp - 0x1008]
push eax
call fcn.004b50cb
add esp, 0xc
mov ecx, dword [ebp - 0x1008]
push ecx
call fcn.004b4f48
add esp, 4
mov dword [ebp - 0x3448], eax
mov edx, dword [ebp - 0x3448]
push edx
call fcn.004b48c1
add esp, 4
mov dword [ebp - 0x2010], eax
cmp dword [ebp - 0x2010], 0
jne 0x406799
push 0
push 1
call fcn.0040f302
add esp, 8
mov eax, dword [ebp - 0x3448]
push eax
push str.Configuration_file_too_big._malloc__d__failed_n
call fcn.0040f492
add esp, 8
push 1
call fcn.004b4c8d
push 0
push 0
mov ecx, dword [ebp - 0x1008]
push ecx
call fcn.004b50cb
add esp, 0xc
mov edx, dword [ebp - 0x1008]
push edx
mov eax, dword [ebp - 0x3448]
push eax
push 1
mov ecx, dword [ebp - 0x2010]
push ecx
call fcn.004b4e31
add esp, 0x10
push 0x430
push 0
lea edx, [ebp - 0x3444]
push edx
call fcn.004b4340
add esp, 0xc
mov dword [ebp - 0x3440], 2
mov eax, dword [ebp - 0x2010]
mov dword [ebp - 0x3438], eax
mov ecx, dword [ebp - 0x3438]
mov dword [ebp - 0x343c], ecx
push 0
lea edx, [ebp - 0x3444]
push edx
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [0x4e7604]
push ecx
call fcn.0042d8c0
add esp, 0x14
test eax, eax
je 0x406899
lea edx, [ebp - 0x200c]
push edx
lea eax, [ebp - 0x3014]
push eax
push str.DATA__s__s
lea ecx, [ebp - 0x1004]
push ecx
call fcn.004b4dfd
add esp, 0x10
mov dword [ebp - 0x344c], eax
cmp dword [ebp - 0x344c], 1
jle 0x406894
lea edx, [ebp - 0x200c]
push edx
call fcn.004b4950
add esp, 4
add eax, 1
push eax
call fcn.004b48c1
add esp, 4
mov dword [0x4d8c80], eax
lea eax, [ebp - 0x200c]
push eax
mov ecx, dword [0x4d8c80]
push ecx
call fcn.004b4b70
add esp, 8
jmp 0x406899
jmp 0x406803
mov edx, dword [ebp - 0x2010]
push edx
call fcn.004176ae
add esp, 4
mov eax, dword [ebp - 0x1008]
push eax
call fcn.004b4d80
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4079f7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 1
call fcn.0040f302
add esp, 8
push 0x4c9c10
call fcn.0040f492
add esp, 4
push 0
push 1
call fcn.0040f302
add esp, 8
push str.usage:_lmgrd___2__p____z____c_license_file_list__n
call fcn.0040f492
add esp, 4
push 0
push 1
call fcn.0040f302
add esp, 8
push str._______________v____l___debug_log_path___local__n
call fcn.0040f492
add esp, 4
push 0
push 1
call fcn.0040f302
add esp, 8
push str._______________x_lmdownlmremove____help__n
call fcn.0040f492
add esp, 4
push 0
push 1
call fcn.0040f302
add esp, 8
push 0x4c9ca8
call fcn.0040f492
add esp, 4
push 1
call fcn.004b4c8d
pop ebp
ret
Function at 0x407d81
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
push 0
push 1
call fcn.0040f302
add esp, 8
push str.Detecting_other_license_server_manager__lmgrd__processes..._n
call fcn.0040f492
add esp, 4
push 0
mov eax, dword [0x4e7604]
push eax
call fcn.00435b11
add esp, 8
mov dword [ebp - 0x28], eax
mov ecx, dword [0x4d8c68]
mov dword [ebp - 0x18], ecx
jmp 0x407dd5
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x407f12
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
jmp 0x407def
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x407ee8
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x407ea2
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
test ecx, ecx
je 0x407ea2
lea edx, [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
test ecx, ecx
je 0x407e5a
mov edx, dword [ebp - 0x10]
movsx eax, byte [edx]
cmp eax, 0x20
je 0x407e5a
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x407e27
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
lea ecx, [ebp - 0xc]
test ecx, ecx
je 0x407e8a
cmp dword [ebp - 0x18], 0
je 0x407e8a
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.004b47b0
add esp, 8
test eax, eax
jne 0x407e8a
mov dword [ebp - 0x20], 1
jmp 0x407ea2
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ecx]
test edx, edx
je 0x407e9d
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x407e09
cmp dword [ebp - 0x20], 0
jne 0x407ead
jmp 0x407de7
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 4], 0
je 0x407ebf
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], 0
jne 0x407ec4
jmp 0x407de7
push 0
push 1
call fcn.0040f302
add esp, 8
mov eax, dword [ebp - 0x14]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push str._s_already_running__s_n
call fcn.0040f492
add esp, 0xc
cmp dword [ebp - 0x20], 0
je 0x407f06
cmp dword [ebp - 0x14], 0
je 0x407f06
mov edx, dword [ebp - 0x14]
cmp dword [edx + 4], 0
je 0x407f06
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x1c], 0
jne 0x407f0d
mov dword [ebp - 0x24], 1
jmp 0x407dcc
cmp dword [ebp - 0x28], 0
je 0x407f2b
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [0x4e7604]
push edx
call fcn.00436763
add esp, 8
cmp dword [0x4d8c68], 0
je 0x407f68
cmp dword [ebp - 0x24], 0
jne 0x407f68
push 0
push 1
call fcn.0040f302
add esp, 8
push str.The_license_server_manager__lmgrd__is_already_serving_all_vendors__exiting._n
call fcn.0040f492
add esp, 4
mov eax, dword [0x4e7604]
push eax
call fcn.00435092
add esp, 4
push 2
call fcn.004b4c8d
mov esp, ebp
pop ebp
ret
Function at 0x40927b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x2f
jne 0x4092aa
mov edx, dword [ebp + 8]
push edx
push 0x4d98d0
call fcn.004b4b70
add esp, 8
mov eax, 0x4d98d0
jmp 0x409454
push 0x2f
mov eax, dword [ebp + 8]
push eax
call fcn.004b5c90
add esp, 8
test eax, eax
je 0x4092e1
mov ecx, dword [ebp + 8]
push ecx
push 0x4d96cc
push 0x4ca32c
push 0x4d98d0
call fcn.004b486f
add esp, 0x10
mov eax, 0x4d98d0
jmp 0x409454
push 0x800
lea edx, [ebp - 0x804]
push edx
push str.PATH
mov eax, dword [0x4e7604]
push eax
call fcn.00423954
add esp, 0x10
test eax, eax
je 0x40930e
mov eax, str.Cant_get_PATH_environment
jmp 0x409454
lea ecx, [ebp - 0x804]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x409434
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x808], ecx
jmp 0x40933f
mov edx, dword [ebp - 0x808]
add edx, 1
mov dword [ebp - 0x808], edx
mov eax, dword [ebp - 0x808]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40935c
mov edx, dword [ebp - 0x808]
movsx eax, byte [edx]
cmp eax, 0x3a
je 0x40935c
jmp 0x409330
mov ecx, dword [ebp - 0x808]
movsx edx, byte [ecx]
cmp edx, 0x3a
jne 0x409373
mov eax, dword [ebp - 0x808]
mov byte [eax], 0
push 0x4ca358
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b47b0
add esp, 8
test eax, eax
je 0x4093a4
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x4ca35c
push 0x4d98d0
call fcn.004b486f
add esp, 0x10
jmp 0x4093ba
mov ecx, dword [ebp + 8]
push ecx
push 0x4ca364
push 0x4d98d0
call fcn.004b486f
add esp, 0xc
push 1
push 0x4d98d0
mov edx, dword [0x4e7604]
push edx
call fcn.0042ed1c
add esp, 0xc
test eax, eax
jne 0x409419
movsx eax, byte [0x4d98d0]
cmp eax, 0x2f
je 0x409412
push 0x4d98d0
lea ecx, [ebp - 0x804]
push ecx
call fcn.004b4b70
add esp, 8
lea edx, [ebp - 0x804]
push edx
push 0x4d96cc
push 0x4ca368
push 0x4d98d0
call fcn.004b486f
add esp, 0x10
mov eax, 0x4d98d0
jmp 0x409454
mov eax, dword [ebp - 4]
push eax
call fcn.004b4950
add esp, 4
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 1]
mov dword [ebp - 4], edx
jmp 0x409317
push 0x4d98d0
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x40944f
mov eax, str.Cant_find_lmgrd_in_our_path
jmp 0x409454
mov eax, 0x4d98d0
mov esp, ebp
pop ebp
ret