joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db70
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x24
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
xor ebx, ebx
mov dword [esp + 0xc], 0x32
push eax
push 8
mov dword [esp + 0x2c], ebx
xor edi, edi
mov word [esp + 0x30], 0x500
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40dbcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40dce6
push ebp
push dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
call ebp
mov ebx, eax
test ebx, ebx
jne 0x40dbeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40dce5
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebx
push 2
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40dc56
call esi
cmp eax, 0x7a
je 0x40dc19
call esi
jmp 0x40dce5
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [esp + 0x10]
push 0
call ebp
mov ebx, eax
test ebx, ebx
jne 0x40dc35
call esi
jmp 0x40dce5
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebx
push 2
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40dc56
call esi
jmp 0x40dce5
mov ebp, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 4
push 1
lea eax, [esp + 0x50]
push eax
call ebp
test eax, eax
jne 0x40dc82
call esi
jmp 0x40dce5
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 6
push 1
lea eax, [esp + 0x50]
push eax
call ebp
test eax, eax
jne 0x40dca8
call esi
jmp 0x40dce5
xor esi, esi
cmp dword [ebx], esi
jbe 0x40dce0
lea edi, [ebx + 4]
push dword [esp + 0x1c]
mov ebp, dword [edi]
mov eax, dword [edi + 4]
push ebp
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40dd30
push dword [esp + 0x18]
push ebp
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40dce0
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x40dcb1
mov edi, 1
pop ebp
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_FreeSid]
test eax, eax
je 0x40dcf7
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40dd02
push eax
call esi
test ebx, ebx
je 0x40dd0d
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40dd1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404be0
add esp, 0x24
ret
xor edi, edi
jmp 0x40dce5
Function at 0x40e9f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
test edi, edi
je 0x40ea6a
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x40ea64
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ea64
mov eax, dword [esp + 8]
inc eax
push esi
push eax
call fcn.00404c32
mov esi, eax
add esp, 4
test esi, esi
je 0x40ea58
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40ea5d
push esi
call fcn.00402bf6
add esp, 4
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov eax, esi
pop esi
pop ebx
pop edi
pop ecx
ret
pop ebx
xor eax, eax
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x40f3a0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
sub esp, 0x87c
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x878], eax
push esi
push 0x207
lea eax, [esp + 0x61]
mov byte [esp + 0x60], 0
push 0
push eax
call fcn.004056e0
xor eax, eax
push 0x40e
push eax
mov word [esp + 0x480], ax
lea eax, [esp + 0x482]
push eax
call fcn.004056e0
call fcn.0043c7f0
push 0
push 1
mov esi, eax
call fcn.004354b0
push str.Running_the_license_server_manager__lmgrd__in_dedicated_windows_..._n
call fcn.00435180
push 0
push 1
call fcn.004354b0
push str._tUse__z_to_run_in_foreground_in_this_window_n
call fcn.00435180
add esp, 0x30
cmp esi, 2
jne 0x40f4c1
push 0x207
lea eax, [esp + 0x269]
mov byte [esp + 0x268], 0
push 0
push eax
call fcn.004056e0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [esp + 0x26c]
push eax
call fcn.0041a780
push 0
lea eax, [esp + 0x274]
push str.__z2
push eax
call fcn.0041a530
push 0
push 0x44
lea eax, [esp + 0x38]
push 0
push eax
call fcn.0041a4e0
add esp, 0x28
mov dword [esp + 0x18], 0x44
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
xor eax, eax
cmp dword [0x4d9f1c], eax
push 0
sete al
push 0
lea eax, [eax*8 + 8]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x284]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x40f5d5
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push str.__z2
call fcn.0043c5d0
mov esi, eax
add esp, 8
test esi, esi
je 0x40f5f8
mov ecx, 0x40e
sub ecx, dword [esp + 4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x478]
push eax
call fcn.0041a450
push dword [esp + 0x14]
lea eax, [esp + 0x480]
push esi
push eax
call fcn.0042807d
push esi
call fcn.0043eeb0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x490]
push eax
call fcn.0043c640
mov esi, eax
add esp, 0x28
test esi, esi
je 0x40f57e
mov ecx, dword [esp + 4]
mov eax, 0x207
cmp ecx, 0x208
push 0
cmovae ecx, eax
lea eax, [esp + 0x60]
push ecx
push esi
push eax
mov dword [esp + 0x14], ecx
call fcn.0041ab00
mov eax, dword [esp + 0x14]
add esp, 0x10
cmp eax, 0x208
jae 0x40f60e
push esi
mov byte [esp + eax + 0x60], 0
call fcn.0043eeb0
add esp, 4
jmp 0x40f583
mov byte [esp + 0x5c], 0
push 0
push 0x44
lea eax, [esp + 0x20]
push 0
push eax
call fcn.0041a4e0
add esp, 0x10
mov dword [esp + 0x18], 0x44
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
xor eax, eax
cmp dword [0x4d9f1c], eax
push 0
sete al
push 0
lea eax, [eax*8 + 8]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x48c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40f613
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x60]
push eax
push str.CreateProcess_of___s__failed__error:__d_n
call fcn.00426270
push eax
call fcn.004275e6
add esp, 0x10
mov ecx, dword [esp + 0x87c]
pop esi
xor ecx, esp
call fcn.00404be0
add esp, 0x87c
ret
call fcn.0040661c
push dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 8]
call esi
push 0
call fcn.00401ac1
int3
Function at 0x410de0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
cmp dword [0x4d9f34], 0
je 0x410f3a
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [0x4da658]
mov eax, dword [esi + 0x18]
mov dword [0x4da658], 0
test eax, eax
je 0x410f11
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
cmp eax, 0x102
sete cl
test ecx, ecx
je 0x410f11
push 0
push 1
call fcn.004354b0
push dword [esi + 0x18]
push esi
push str.Still_trying_to_kill_daemon__s_pid__d_n
call fcn.00435180
mov dword [esp + 0x1c], 5
mov dword [esp + 0x20], 0
call fcn.004039f6
mov dword [eax], 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
call fcn.0043f1b0
mov eax, dword [esi + 0x18]
add esp, 0x24
test eax, eax
je 0x410f32
cmp eax, 0xffffffff
je 0x410f32
push 0
push 1
call fcn.004354b0
push dword [esi + 0x18]
push esi
push str.Terminating__s_pid__d_n
call fcn.00435180
add esp, 0x14
push 0x25
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esp + 8], 5
mov dword [esp + 0xc], 0
call fcn.004039f6
mov dword [eax], 0
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
call fcn.0043f1b0
mov eax, dword [esi + 0x18]
add esp, 0x10
test eax, eax
je 0x410f32
cmp eax, 0xffffffff
je 0x410f32
push 0
push 1
mov dword [esi + 0x18], 0
call fcn.004354b0
push dword [esi + 0x18]
push esi
push str.lmgrd_cant_kill__s_pid__d._Trying_to_restart_anyway_n
call fcn.00435180
add esp, 0x14
mov dword [0x4da658], edi
pop edi
pop esi
add esp, 8
ret
push 0
push 1
call fcn.004354b0
push dword [esi + 0x18]
push esi
push str.daemon_process__s_pid__d_exited_n
call fcn.00435180
mov dword [esi + 0x18], 0
add esp, 0x14
mov dword [0x4da658], edi
pop edi
pop esi
add esp, 8
ret
Function at 0x411700
Capabilities:
Terminate process

Disassembly:
sub esp, 0x404
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [0x4da654]
push ebx
push esi
mov esi, dword [esp + 0x410]
push edi
test eax, eax
je 0x411739
mov edi, dword [eax + 0x1b0]
test edi, edi
je 0x411739
mov edi, dword [edi + 0x1cd0]
jmp 0x41173b
xor edi, edi
xor ebx, ebx
push ebx
push 1
call fcn.004354b0
push str.Starting_vendor_daemons_...__n
call fcn.00435180
add esp, 0xc
test esi, esi
je 0x4118e8
lea ebx, [ebx]
push 0x3ff
lea eax, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0
push eax
call fcn.004056e0
add esp, 0xc
cmp dword [esi + 0x10], 0xffffffff
jne 0x411786
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41179b
cmp eax, 0xffffffff
je 0x41179b
push esi
call fcn.00410de0
add esp, 4
mov eax, dword [esi + 0x3c]
test eax, eax
js 0x411879
cmp eax, 0xffff
jg 0x411879
push edi
lea eax, [esp + 0x10]
push 0x400
push eax
call fcn.004187d0
add esp, 8
push eax
push 0x4e53e0
push esi
call fcn.00417f00
mov eax, dword [esi + 0x18]
add esp, 0x10
test eax, eax
je 0x4118a6
cmp eax, 0xffffffff
je 0x4118a6
mov ebx, 1
push 0
push ebx
call fcn.004354b0
push esi
push str.Started__s
call fcn.00435180
mov eax, dword [esi + 0x1c]
add esp, 0x10
push eax
test eax, 0xffff0000
je 0x411814
push str.__pid__X_
jmp 0x411819
push str.__pid__d_
call fcn.00435180
add esp, 8
push 0x4bc198
call fcn.00435180
add esp, 4
call fcn.00418780
test eax, eax
je 0x41183f
mov eax, dword [esi + 0x10]
mov dword [esi + 0x14], eax
jmp 0x4118a6
cmp dword [0x4d20cc], 0
je 0x411870
test edi, edi
je 0x411870
push edi
call fcn.00412120
add esp, 4
test eax, eax
je 0x411867
push eax
call fcn.00418d60
add esp, 4
mov dword [esi + 0x14], eax
jmp 0x4118a6
mov dword [esi + 0x14], 0xffffffff
jmp 0x4118a6
mov dword [esi + 0x14], 0
jmp 0x4118a6
push 0
push 1
call fcn.004354b0
push esi
push str._s_VD_port_mentioned_in_the_license_file_is_Out_of_valid_port_range__0___65535__n
call fcn.00435180
push 0
push 1
call fcn.004354b0
push dword [esi + 0x3c]
push str.VD_port___d_n
call fcn.00435180
add esp, 0x20
mov esi, dword [esi + 0x38]
test esi, esi
jne 0x411760
test ebx, ebx
je 0x4118e8
mov dword [0x4d2390], esi
cmp dword [0x4d9f34], esi
je 0x4118d0
test edi, edi
je 0x4118d0
push edi
call fcn.00412290
add esp, 4
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404be0
add esp, 0x404
ret
push 0x4a
call fcn.00401ac1
int3
Function at 0x418d60
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x418cd3
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x418cf1
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x418d4f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x418cb5
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
Function at 0x41ae00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 4
lea edi, [ebp + 3]
shr edi, 2
push edi
call fcn.00428198
mov esi, eax
add esp, 8
test esi, esi
je 0x41ae84
push ebx
push ebp
push dword [esp + 0x1c]
push esi
call fcn.00405a60
mov ebx, dword [esp + 0x20]
add esp, 0xc
xor edx, edx
test edi, edi
je 0x41ae48
mov ecx, dword [esi + edx*4]
mov eax, ecx
xor eax, ebx
mov ebx, ecx
mov dword [esi + edx*4], eax
inc edx
cmp edx, edi
jb 0x41ae37
xor edx, edx
xor eax, eax
xor bl, bl
test ebp, ebp
je 0x41ae71
mov edi, dword [esp + 0x18]
mov eax, dword [esi + eax*4]
movzx ecx, bl
add bl, 8
and ecx, 0x1f
shr eax, cl
mov byte [edx + edi], al
inc edx
mov eax, edx
shr eax, 2
cmp edx, ebp
jb 0x41ae56
push esi
call fcn.00402bf6
add esp, 4
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
Function at 0x41b560
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x228]
lea eax, [esp + 0x11]
push ebp
mov ebp, dword [esp + 0x224]
push esi
mov esi, dword [esp + 0x220]
push edi
push 0x1ff
push 0
push eax
mov edi, 3
mov byte [esp + 0x28], 0
call fcn.004056e0
add esp, 0xc
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
push 0x200
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b611
test ebx, ebx
je 0x41b752
mov eax, dword [ebx + 4]
test eax, eax
je 0x41b5ee
push 0x398
push 2
push 0x19
push dword [ebx]
call eax
add esp, 0x10
mov eax, dword [ebx + 8]
test eax, eax
je 0x41b752
push 0x399
push str.Not_able_to_read_message_from_license_service
push 0xc
push dword [ebx]
call eax
add esp, 0x10
jmp 0x41b752
imul eax, dword [esp + 0x228], 0x19660d
push dword [esp + 0x10]
add eax, 0x3c6ef35f
imul ebx, eax, 0x19660d
lea eax, [esp + 0x20]
push eax
add ebx, 0x3c6ef35f
push ebx
call fcn.0041ae00
add esp, 0xc
cmp eax, 0xffffffff
jne 0x41b64c
lea edi, [eax + 6]
jmp 0x41b752
mov eax, dword [esp + 0x10]
cmp eax, 0x200
jae 0x41b76d
mov byte [esp + eax + 0x1c], 0
lea ecx, [esp + 0x1c]
mov edx, str.___TPMProps
mov esi, 0xa
mov edi, edi
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x41b74d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x41b670
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x41b74d
cmp byte [esp + 0x2a], 0
je 0x41b74d
lea eax, [esp + 0x2a]
push 0xc
push eax
call fcn.004295f0
mov esi, eax
add esp, 8
test esi, esi
je 0x41b74d
push 0xa
lea eax, [esp + 0x18]
mov byte [esi], 0
push eax
lea eax, [esp + 0x32]
push eax
call fcn.00429eaa
mov ecx, eax
add esp, 0xc
mov eax, dword [esp + 0x14]
cmp byte [eax], 0
jne 0x41b74d
inc esi
je 0x41b74d
cmp ecx, 1
je 0x41b6e6
mov edi, 6
jmp 0x41b752
cmp byte [esi], 0
je 0x41b74d
push 0xc
push esi
call fcn.004295f0
mov edi, eax
add esp, 8
test edi, edi
je 0x41b74d
push 0xa
lea eax, [esp + 0x1c]
mov byte [edi], 0
push eax
push esi
call fcn.00429eaa
mov ecx, eax
add esp, 0xc
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
jne 0x41b74d
inc edi
je 0x41b74d
cmp ecx, ebx
je 0x41b728
mov edi, 2
jmp 0x41b752
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b730
sub ecx, edx
push ecx
push edi
push 0x200
push ebp
call fcn.004057b2
add esp, 0x10
xor edi, edi
jmp 0x41b752
mov edi, 4
mov ecx, dword [esp + 0x21c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404be0
add esp, 0x210
ret
call fcn.0040661c
int3
Function at 0x41b780
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x228]
lea eax, [esp + 0x11]
push ebp
mov ebp, dword [esp + 0x224]
push esi
mov esi, dword [esp + 0x220]
push edi
push 0x1ff
push 0
push eax
mov edi, 3
mov byte [esp + 0x28], 0
call fcn.004056e0
add esp, 0xc
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
push 0x200
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b831
test ebx, ebx
je 0x41b972
mov eax, dword [ebx + 4]
test eax, eax
je 0x41b80e
push 0x346
push 2
push 0x19
push dword [ebx]
call eax
add esp, 0x10
mov eax, dword [ebx + 8]
test eax, eax
je 0x41b972
push 0x347
push str.Not_able_to_read_message_from_license_service
push 0xc
push dword [ebx]
call eax
add esp, 0x10
jmp 0x41b972
imul eax, dword [esp + 0x228], 0x19660d
push dword [esp + 0x10]
add eax, 0x3c6ef35f
imul ebx, eax, 0x19660d
lea eax, [esp + 0x20]
push eax
add ebx, 0x3c6ef35f
push ebx
call fcn.0041ae00
add esp, 0xc
cmp eax, 0xffffffff
jne 0x41b86c
lea edi, [eax + 6]
jmp 0x41b972
mov eax, dword [esp + 0x10]
cmp eax, 0x200
jae 0x41b98d
mov byte [esp + eax + 0x1c], 0
lea ecx, [esp + 0x1c]
mov edx, str.___VMAttrs
mov esi, 9
mov edi, edi
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x41b96d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x41b890
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x41b96d
cmp byte [esp + 0x29], 0
je 0x41b96d
lea eax, [esp + 0x29]
push 0xc
push eax
call fcn.004295f0
mov esi, eax
add esp, 8
test esi, esi
je 0x41b96d
push 0xa
lea eax, [esp + 0x18]
mov byte [esi], 0
push eax
lea eax, [esp + 0x31]
push eax
call fcn.00429eaa
mov ecx, eax
add esp, 0xc
mov eax, dword [esp + 0x14]
cmp byte [eax], 0
jne 0x41b96d
inc esi
je 0x41b96d
cmp ecx, 1
je 0x41b904
mov edi, 6
jmp 0x41b972
cmp byte [esi], 0
je 0x41b96d
push 0xc
push esi
call fcn.004295f0
mov edi, eax
add esp, 8
test edi, edi
je 0x41b96d
push 0xa
lea eax, [esp + 0x1c]
mov byte [edi], 0
push eax
push esi
call fcn.00429eaa
mov ecx, eax
add esp, 0xc
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
jne 0x41b96d
inc edi
je 0x41b96d
cmp ecx, ebx
je 0x41b946
mov edi, 2
jmp 0x41b972
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x41b950
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b950
sub ecx, edx
push ecx
push edi
push 0x200
push ebp
call fcn.004057b2
add esp, 0x10
xor edi, edi
jmp 0x41b972
mov edi, 4
mov ecx, dword [esp + 0x21c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404be0
add esp, 0x210
ret
call fcn.0040661c
int3
Function at 0x41bd30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x41bdae
cmp byte [esi], 0xbc
push edi
jne 0x41bd67
cmp byte [esi + 1], 0xbd
jne 0x41bd67
lea eax, [esi + 2]
push 0
push eax
call fcn.0041a870
push 0
push esi
mov edi, eax
call fcn.0041a8d0
add esp, 0x10
mov byte [eax + edi - 4], 0
mov eax, edi
pop edi
pop esi
ret
xor edi, edi
push edi
push esi
call fcn.0041a8d0
inc eax
push eax
call fcn.00404c32
mov edx, eax
add esp, 0xc
mov al, byte [esi]
xor al, 0x23
mov byte [edx], al
cmp byte [esi], 0
je 0x41bda5
mov ecx, edx
sub ecx, esi
jmp 0x41bd90
mov al, byte [esi + 1]
lea esi, [esi + 1]
dec al
inc edi
xor al, byte [ecx + esi - 1]
mov byte [ecx + esi], al
cmp byte [esi], 0
jne 0x41bd90
mov byte [edi + edx], 0
mov eax, edx
pop edi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x41c850
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x108], eax
cmp dword [0x4df054], 0
push esi
mov esi, dword [esp + 0x114]
jne 0x41c956
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0xc]
push str.Locala3d0d9cf_ef71_409f_acb2_91dca7237f13__lx_s_vm_init
push eax
call fcn.00427717
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x41c933
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41c8ed
cmp dword [0x4df054], eax
jne 0x41c90f
push 0x4df058
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x41c820
call fcn.00403cbc
add esp, 4
mov dword [0x4df054], 0xffffffff
jmp 0x41c90f
test esi, esi
je 0x41c90f
cmp dword [esi + 4], 0
je 0x41c90f
push 0x134
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi + 4]
push 0x11
push dword [esi]
call eax
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x41c955
test esi, esi
je 0x41c955
cmp dword [esi + 4], eax
je 0x41c955
push 0x134
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x12
jmp 0x41c94b
test esi, esi
je 0x41c955
cmp dword [esi + 4], 0
je 0x41c955
push 0x134
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10
push dword [esi]
mov eax, dword [esi + 4]
call eax
add esp, 0x10
pop edi
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
call fcn.00404be0
add esp, 0x10c
ret
Function at 0x41d350
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x108], eax
cmp dword [0x4df070], 0
push esi
mov esi, dword [esp + 0x114]
jne 0x41d44d
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0xc]
push str.Locala3d0d9cf_ef71_409f_acb2_91dca7237f13__lx_s_tpm_init
push eax
call fcn.00427717
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x41d42d
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41d3ed
cmp dword [0x4df070], eax
jne 0x41d40c
push 0x4df074
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x41d320
call fcn.00403cbc
add esp, 4
mov dword [0x4df070], 0xffffffff
jmp 0x41d40c
test esi, esi
je 0x41d40c
cmp dword [esi + 4], 0
je 0x41d40c
push 0x1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi + 4]
push 0x11
push dword [esi]
call eax
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x41d44c
test esi, esi
je 0x41d44c
cmp dword [esi + 4], eax
je 0x41d44c
push 0x1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x12
jmp 0x41d442
test esi, esi
je 0x41d44c
cmp dword [esi + 4], 0
je 0x41d44c
push 0x1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10
push dword [esi]
mov eax, dword [esi + 4]
call eax
add esp, 0x10
pop edi
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
call fcn.00404be0
add esp, 0x10c
ret

Function at 0x41eb10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x40c
mov eax, dword [0x4d1ce0]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
mov ebx, dword [esp + 0x418]
push esi
mov esi, dword [esp + 0x418]
push edi
xor edi, edi
test esi, esi
je 0x41ec08
push 0x400
lea eax, [esp + 0x15]
mov byte [esp + 0x14], 0
push edi
push eax
call fcn.004056e0
push ebx
push esi
call fcn.0041a8d0
add esp, 0x14
mov dword [esp + 0xc], eax
cmp eax, 2
jbe 0x41ebe6
cmp byte [esi], 0x7c
jne 0x41ebe6
cmp byte [esi + eax - 1], 0x7c
jne 0x41ebe6
push ebp
lea eax, [esi + 1]
push ebx
push eax
call fcn.0041a870
mov ebp, eax
mov eax, dword [esp + 0x18]
push 0x4bc450
push ebp
mov byte [eax + ebp - 2], 0
call fcn.0042935f
add esp, 0x10
mov dword [esp + 0x10], eax
test eax, eax
je 0x41ebd4
push eax
push 0x400
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0042797d
add esp, 0x10
test eax, eax
je 0x41ebc8
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0041a870
add esp, 8
mov edi, eax
push dword [esp + 0x10]
call fcn.00407485
add esp, 4
test ebp, ebp
je 0x41ebe1
push ebp
call fcn.00402bf6
add esp, 4
pop ebp
test edi, edi
jne 0x41ec08
push ebx
push esi
call fcn.0041a870
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00404be0
add esp, 0x40c
ret
mov ecx, dword [esp + 0x414]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404be0
add esp, 0x40c
ret