joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x40db63
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.0040d7a0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.0040d800
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.0040d8c0
lea eax, [esp + 0x18]
push eax
call fcn.0040d130
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x40db30
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x40dc14
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.0040db10
or ax, ax
je 0x40dbdc
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x40dc00
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x40dc00
lea eax, [esp + 0xa]
push esi
push eax
call fcn.0040d240
or al, al
jne 0x40dc14
jmp 0x40dc0f
lea eax, [esp + 8]
push esi
push eax
call fcn.0040d190
or al, al
jne 0x40dc14
mov word [esi], 0
mov ax, word [esi]
or ax, ax
je 0x40dc2c
cmp ax, 0xffff
je 0x40dc2c
mov al, 1
pop esi
pop ebx
add esp, 0x40
ret 8
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x40dc50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x40dc73
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.0040d7a0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.0040d800
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.0040d8c0
lea eax, [esp + 0x18]
push eax
call fcn.0040d130
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x40dc40
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x40dd24
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.0040db10
or ax, ax
je 0x40dd24
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x40dd24
cmp byte [esp + eax + 0xa], 0x3a
jne 0x40dd24
push esi
lea eax, [esp + eax + 0xf]
push eax
call fcn.0040d190
or al, al
jne 0x40dd10
jmp 0x40dd1f
mov ax, word [esi]
cmp ax, 1
jl 0x40dd1f
cmp ax, 4
jle 0x40dd24
mov word [esi], 0
cmp word [esi], 1
sbb al, al
inc al
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x40dd50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
push esi
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.0040d7a0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.0040d800
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.0040d9b0
lea eax, [esp + 4]
push 0x10
push eax
call fcn.0040d960
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push 0x10
push eax
lea eax, [esp + 0x40]
push 0x40dd40
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov esi, eax
or esi, esi
je 0x40ddbf
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.0040cfc0
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
cmp esi, 1
sbb al, al
inc al
pop esi
add esp, 0x50
ret 8

Function at 0x40ddd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x10
push eax
call fcn.0040d7a0
lea eax, [esp]
push 0x10
push eax
call fcn.0040d800
lea eax, [esp + 0x10]
push 0x10
push eax
call fcn.0040d910
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ecx, dword [esp + 0x34]
cmp eax, 1
mov word [ecx], ax
sbb cl, cl
inc cl
mov al, cl
add esp, 0x30
ret 4

Function at 0x40de40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
push esi
mov esi, dword [esp + 0x78]
push 0x10
mov word [esi], 0
lea eax, [esp + 8]
push 0
push eax
call fcn.0040d150
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.0040d7a0
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.0040d800
lea eax, [esp + 0x54]
push 0x10
push eax
call fcn.0040d860
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.0040da10
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.0040dac0
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.0040da70
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 8]
push 0x10
push eax
lea eax, [esp + 0x60]
push 0x40de30
push eax
lea eax, [esp + 0x58]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x40df13
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 8]
push eax
call fcn.0040cfc0
or al, al
je 0x40dee1
mov word [esi], 2
jmp 0x40df13
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 8]
push eax
call fcn.0040cfc0
or al, al
je 0x40defb
mov word [esi], 3
jmp 0x40df13
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.0040cfc0
or al, al
je 0x40df13
mov word [esi], 1
cmp word [esi], 1
sbb al, al
inc al
pop esi
add esp, 0x70
ret 4
Function at 0x40e570
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
push esi
mov byte [esp + 4], 0x52
mov byte [esp + 5], 0x4e
mov byte [esp + 6], 0x42
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x44
mov byte [esp + 9], 0x52
mov byte [esp + 0xa], 0x56
mov ax, word [esp + 0x18]
add al, 0x30
mov byte [esp + 0xb], al
mov esi, dword [esp + 0x14]
mov byte [esp + 0xc], 0
mov dword [esi], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x40e606
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x40e5e3
cmp eax, 3
jbe 0x40e5fb
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x40e5f0
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x80b
pop esi
add esp, 0xc
ret 8
mov ax, 0x80c
pop esi
add esp, 0xc
ret 8
mov ax, 0x800
pop esi
add esp, 0xc
ret 8

Function at 0x40e620
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, dword [esp + 0x18]
push esi
mov word [esi + 6], 0xffff
call fcn.0040e510
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov edi, dword [esp + 0x20]
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
or ebx, ebx
je 0x40e670
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
push esi
call fcn.0040e4d0
or ebx, ebx
je 0x40e682
cmp word [esi + 6], 0xffff
jne 0x40e688
mov word [esi + 6], 0x83b
mov ax, word [esi + 6]
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x40e7b0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
push esi
mov al, byte [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.0040e770
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40e81c
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x40e7f9
cmp eax, 3
jbe 0x40e811
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x40e806
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
sub ax, ax
pop esi
add esp, 0x10
ret 8

Function at 0x40e840
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x14]
push esi
mov word [esi + 6], 0xffff
call fcn.0040e510
lea eax, [esp + 8]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov eax, dword [esp + 0x1c]
push esi
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_ReadFile
mov edi, eax
push esi
call fcn.0040e4d0
cmp edi, 1
jne 0x40e885
cmp word [esi + 6], 0xffff
jne 0x40e88b
mov word [esi + 6], 0x23b
mov ax, word [esi + 6]
pop edi
pop esi
add esp, 4
ret 8
Function at 0x40e970
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
add esp, 0x24
ret
Function at 0x40ea40
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
sub esp, 0x58
push esi
mov byte [esp + 0x24], 0x53
mov byte [esp + 0x25], 0x79
mov byte [esp + 0x26], 0x73
mov byte [esp + 0x27], 0x74
sub si, si
mov byte [esp + 0x28], 0x65
mov byte [esp + 0x29], 0x6d
mov byte [esp + 0x2a], 0x5c
mov byte [esp + 0x2b], 0x43
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x2d], 0x72
mov byte [esp + 0x2e], 0x72
mov byte [esp + 0x2f], 0x65
mov byte [esp + 0x30], 0x6e
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x32], 0x43
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x34], 0x6e
mov byte [esp + 0x35], 0x74
mov byte [esp + 0x36], 0x72
mov byte [esp + 0x37], 0x6f
mov byte [esp + 0x38], 0x6c
mov byte [esp + 0x39], 0x53
mov byte [esp + 0x3a], 0x65
mov byte [esp + 0x3b], 0x74
mov byte [esp + 0x3c], 0x5c
mov byte [esp + 0x3d], 0x53
mov byte [esp + 0x3e], 0x65
mov byte [esp + 0x3f], 0x72
mov byte [esp + 0x40], 0x76
mov byte [esp + 0x41], 0x69
mov byte [esp + 0x42], 0x63
mov byte [esp + 0x43], 0x65
mov byte [esp + 0x44], 0x73
mov byte [esp + 0x45], 0x5c
mov byte [esp + 0x46], 0x56
mov byte [esp + 0x47], 0x78
mov byte [esp + 0x48], 0x44
mov byte [esp + 0x49], 0x5c
mov byte [esp + 0x4a], 0x53
mov byte [esp + 0x4b], 0x65
mov byte [esp + 0x4c], 0x6e
mov byte [esp + 0x4d], 0x74
mov byte [esp + 0x4e], 0x69
mov byte [esp + 0x4f], 0x6e
mov byte [esp + 0x50], 0x65
mov byte [esp + 0x51], 0x6c
mov byte [esp + 0x52], 0x5c
mov byte [esp + 0x53], 0x53
mov byte [esp + 0x54], 0x65
mov byte [esp + 0x55], 0x74
mov byte [esp + 0x56], 0x75
mov byte [esp + 0x57], 0x70
mov byte [esp + 0x58], 0
mov byte [esp + 0x10], 0x49
mov byte [esp + 0x11], 0x6f
mov byte [esp + 0x12], 0x45
mov byte [esp + 0x13], 0x6e
mov byte [esp + 0x14], 0x74
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], 0
mov dword [esp + 0xc], 0xa
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x28]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call sub.ADVAPI32.dll_RegOpenKeyA
or eax, eax
jne 0x40ebdf
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.ADVAPI32.dll_RegQueryValueA
or eax, eax
jne 0x40ebd5
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0040d370
or al, al
je 0x40ebd5
mov si, word [esp + 8]
mov eax, dword [esp + 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov ax, si
pop esi
add esp, 0x58
ret
Function at 0x411490
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.0040f3f0
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.00411010
or al, al
jne 0x411515
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.00411da0
or al, al
jne 0x411515
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.00411c10
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.00411e00
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x4115a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov edi, dword [esp + 0x24]
push eax
mov esi, dword [esp + 0x24]
push edi
push esi
call fcn.0040f3f0
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push edi
push esi
call fcn.0040f3f0
mov eax, dword [esp + 0xc]
push 0xe
mov ax, word [eax + 4]
push eax
call fcn.00411010
or al, al
jne 0x41164d
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.00411da0
or al, al
jne 0x41164d
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xe]
push eax
mov eax, dword [esp + 0x10]
mov ax, word [eax + 0xc]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x18]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x1c]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x20]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x28]
push eax
push esi
call fcn.00411c70
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.00411e00
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x413950
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov eax, dword [esp + 8]
or eax, eax
jne 0x413961
mov ax, 2
pop esi
ret 0x1c
push eax
call fcn.0040d080
mov esi, eax
cmp word [esi], 0x7242
je 0x413978
mov ax, 2
pop esi
ret 0x1c
test byte [esi + 0x12], 4
jne 0x413990
mov word [esi + 6], 0xb39
mov ax, 0x39
pop esi
ret 0x1c
mov word [esi + 0x30], 0xe
mov ax, word [esp + 0x18]
mov word [esi + 0x34], ax
mov ax, word [esp + 0x1c]
mov word [esi + 0x36], ax
mov ax, word [esp + 0xc]
mov word [esi + 0x3a], ax
mov ax, word [esp + 0x10]
mov word [esi + 0x3c], ax
mov ax, word [esp + 0x14]
mov word [esi + 0x3e], ax
mov al, byte [esp + 0x20]
mov byte [esi + 0x38], al
push esi
call fcn.0040dfe0
mov ax, word [esi + 6]
cmp ax, 0x103
mov ecx, 0x112
je 0x4139e7
mov ecx, eax
and ecx, 0xffff
cmp cl, 0xc
jne 0x4139f4
mov ax, 3
pop esi
ret 0x1c
cmp ax, 0x103
jne 0x413a07
mov eax, 0x112
and ax, 0xff
pop esi
ret 0x1c
and eax, 0xffff
and ax, 0xff
pop esi
ret 0x1c
Function at 0x419e00
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 0xc]
push esi
test eax, eax
mov dword [0x4a8764], eax
jne 0x419e18
mov dword [0x4a8764], 0xffffffff
cmp dword [0x4920f8], 0
mov eax, dword [esp + 0x14]
mov dword [0x4a8760], eax
je 0x419e3d
mov eax, dword [0x4a876c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x4920f8]
pop esi
ret
xor esi, esi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4a876c], eax
cmp eax, esi
jne 0x419e57
xor eax, eax
jmp 0x419e3b
push 4
call fcn.00448866
add esp, 4
test eax, eax
jne 0x419e69
xor eax, eax
jmp 0x419e3b
mov ecx, dword [0x4a876c]
push eax
xor esi, esi
mov dword [eax], ecx
push esi
push 0x419d99
call fcn.00449729
add esp, 0xc
mov dword [0x4920f8], eax
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4920f8], esi
jne 0x419e36
xor eax, eax
jmp 0x419e3b

Function at 0x419eaf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 8]
call fcn.0044a141
add esp, 4
mov dword [0x4a4a88], eax
test eax, eax
jne 0x419f2e
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREFLEXlm_License_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419f2c
lea eax, [ebp - 8]
mov esi, 0x4a49c0
push eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0xc7
push esi
push ecx
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x419f23
push dword [ebp - 4]
mov dword [0x4a4a88], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4a4a88]
jmp 0x419f2e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419f40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
push eax
mov edi, 0x20006
push edi
push esi
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419fc4
lea eax, [ebp - 0xc]
lea ecx, [ebp - 8]
push eax
push ecx
push esi
push edi
push esi
push 0x49a270
push esi
push str.FLEXlm_License_Manager
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x419fab
push dword [ebp + 0x10]
call fcn.00449210
add esp, 4
inc eax
push eax
push dword [ebp + 0x10]
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x419ff2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
push 0xff
push 0
push 0
mov dword [eax + 0x14], 0xffffffc1
push 0x193
push 0xffffffffffffffc1
push eax
call fcn.00413cf0
add esp, 0x18
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f338
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x50]
test byte [eax + 0x140], 0x40
jne 0x41f359
xor eax, eax
jmp 0x41f491
lea edi, [esi + 0x18c]
mov ecx, 0x80
mov eax, dword [edi]
test ecx, eax
jne 0x41f3a2
or eax, ecx
push str.BUG_B
push 0x45
lea ecx, [ebp - 0x2c8]
push 0x44
mov dword [edi], eax
push str.FLEXLM__c_c_sADDATE
push ecx
call fcn.00448ae2
add esp, 0x14
lea ecx, [ebp - 0x2c8]
push ecx
call fcn.00419eaf
add esp, 4
test eax, eax
je 0x41f3a2
or byte [edi + 1], 1
test byte [edi + 1], 1
je 0x41f3cf
mov edi, 0xffffffa8
push 0xff
push 0
mov dword [esi + 0x14], edi
push 0
push 0x138
push edi
push esi
call fcn.00413cf0
add esp, 0x18
mov eax, edi
jmp 0x41f491
push 0
lea eax, [ebp - 0x200]
mov byte [ebp - 0x200], 0x5c
mov byte [ebp - 0x1ff], 0
push eax
push esi
call fcn.0041f497
add esp, 0xc
test eax, eax
jne 0x41f491
push 0x200
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
lea eax, [ebp - 0x200]
push eax
push esi
call fcn.0041f497
add esp, 0xc
test eax, eax
jne 0x41f491
mov byte [ebp - 0x200], 0x2f
mov byte [ebp - 0x1fe], 0x61
push 0
lea eax, [ebp - 0x200]
mov byte [ebp - 0x1fd], 0x72
mov byte [ebp - 0x1ff], 0x76
mov byte [ebp - 0x1fc], 0
push eax
push esi
call fcn.0041f497
add esp, 0xc
test eax, eax
jne 0x41f491
mov byte [ebp - 0x200], 0x2f
mov byte [ebp - 0x1fc], 0
push 0
lea eax, [ebp - 0x200]
mov byte [ebp - 0x1fe], 0x6d
mov byte [ebp - 0x1ff], 0x74
mov byte [ebp - 0x1fd], 0x70
push eax
push esi
call fcn.0041f497
add esp, 0xc
test eax, eax
jne 0x41f491
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x421a1f
Capabilities:
Check os version

Disassembly:
push ebp
mov eax, dword [esp + 0xc]
mov ebp, esp
cmp eax, 0xa
push esi
push edi
je 0x421b50
cmp eax, 0x11
je 0x421b50
cmp eax, 0xe
jne 0x421a92
push 8
mov esi, dword [ebp + 8]
push esi
call fcn.00419808
add esp, 8
cmp eax, 0xc7
je 0x421a87
push 0xff
xor edi, edi
mov dword [esi + 0x14], 0xffffffd3
push edi
call fcn.0044a4b8
push dword [eax]
push 0x12d
push 0xffffffffffffffd3
push esi
call fcn.00413cf0
add esp, 0x18
xor eax, eax
mov dword [esi + 0x170], edi
jmp 0x421bdd
push esi
call fcn.0042880e
jmp 0x421b9b
cmp eax, 0xf
jne 0x421acd
mov esi, dword [ebp + 8]
push 0xff
xor edi, edi
mov dword [esi + 0x14], 0xffffffd3
push edi
call fcn.0044a4b8
push dword [eax]
push 0x12d
push 0xffffffffffffffd3
push esi
call fcn.00413cf0
add esp, 0x18
xor eax, eax
mov dword [esi + 0x170], edi
jmp 0x421bdd
cmp eax, 0x10
jne 0x421b08
mov esi, dword [ebp + 8]
push 0xff
xor edi, edi
mov dword [esi + 0x14], 0xffffffd3
push edi
call fcn.0044a4b8
push dword [eax]
push 0x12d
push 0xffffffffffffffd3
push esi
call fcn.00413cf0
add esp, 0x18
xor eax, eax
mov dword [esi + 0x170], edi
jmp 0x421bdd
mov esi, dword [ebp + 8]
cmp eax, 0xb
jne 0x421b2a
lea edi, [esi + 0x170]
mov eax, dword [edi]
mov word [eax + 2], 0xb
call fcn.004280b6
mov ecx, dword [edi]
mov dword [ecx + 8], eax
jmp 0x421b9e
push esi
call fcn.0042819b
add esp, 4
test eax, eax
jne 0x421b9e
lea eax, [esi + 0x170]
mov ecx, dword [eax]
mov word [ecx + 2], 1
mov ecx, dword [eax]
mov dword [ecx + 8], 0xffffffff
jmp 0x421b9e
push 7
mov esi, dword [ebp + 8]
push esi
call fcn.00419808
add esp, 8
cmp eax, 0x4e9b
je 0x421b95
push 0xff
xor edi, edi
mov dword [esi + 0x14], 0xffffffd3
push edi
call fcn.0044a4b8
push dword [eax]
push 0x12d
push 0xffffffffffffffd3
push esi
call fcn.00413cf0
add esp, 0x18
xor eax, eax
mov dword [esi + 0x170], edi
jmp 0x421bdd
push esi
call fcn.00427dac
add esp, 4
add esi, 0x170
mov ecx, dword [esi]
test ecx, ecx
je 0x421bdb
cmp word [ecx + 2], 9
jne 0x421bdb
add ecx, 8
cmp byte [ecx], 0
je 0x421bdb
mov al, byte [ecx]
cmp al, 0x20
jne 0x421bd5
mov edi, ecx
test al, al
je 0x421bd6
lea eax, [edi + 1]
mov dl, byte [eax]
mov byte [edi], dl
mov edi, eax
cmp byte [eax], 0
jne 0x421bc5
jmp 0x421bd6
inc ecx
cmp byte [ecx], 0
jne 0x421bb9
mov eax, dword [esi]
pop edi
pop esi
pop ebp
ret