joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41df70
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
push str.ROOTCIMV2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0xc], eax
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 0
jge 0x41dfdb
cmp dword [ebp - 0x14], 0x80010106
je 0x41dfdb
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 8]
jmp 0x41e0ed
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x41e00a
cmp dword [ebp - 0x14], 0x80010119
je 0x41e00a
jmp 0x41e0a9
lea edx, [ebp - 0x18]
push edx
push 0x5308e0
push 1
push 0
push 0x5309b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x41e02d
jmp 0x41e0a9
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x41e05a
jmp 0x41e0a9
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x41e07d
jmp 0x41e0a9
cmp dword [ebp + 8], 1
jne 0x41e094
lea ecx, [ebp - 0x10]
push ecx
call fcn.0041dcd0
add esp, 4
mov dword [ebp - 8], eax
jmp 0x41e0a9
cmp dword [ebp + 8], 0
jne 0x41e0a9
lea edx, [ebp - 0x10]
push edx
call fcn.0041de20
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
je 0x41e0bd
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
cmp dword [ebp - 0x18], 0
je 0x41e0d1
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
cmp dword [ebp - 4], 0x80010106
je 0x41e0e0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x41e910
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jge 0x41e972
push 0
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 1
je 0x41e944
mov eax, dword [ebp - 4]
neg eax
mov dword [ebp - 4], eax
jmp 0x41e972
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
cmp eax, 0xd
jne 0x41e95a
jmp 0x41e91b
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx]
cmp edx, 0xa
jne 0x41e967
jmp 0x41e972
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
jmp 0x41e91b
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x41ec70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
jmp 0x41ec88
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x41ecc2
push 0
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x41ecb7
mov eax, dword [ebp - 4]
neg eax
jmp 0x41ecc5
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov dword [ebp + 0xc], edx
jmp 0x41ec7f
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x424810
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x539a68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x16164], 1
cmp dword [0x55c6a8], 0
je 0x42483f
xor eax, eax
jmp 0x424865
lea ecx, [ebp - 0x198]
push ecx
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x424859
or eax, 0xffffffff
jmp 0x424865
mov dword [0x55c6a8], 1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040553d
mov esp, ebp
pop ebp
ret

Function at 0x425980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebp - 0x12a43], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00424a7e
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
cmp al, 0xc6
test dword [ebx + 0x27fffffc], esp
Function at 0x435fe0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x436011
mov eax, dword [ebp + 0x14]
add eax, 2
cdq
mov ecx, 3
idiv ecx
lea edx, [eax*4 + 1]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004269a0
add esp, 8
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x43601e
xor eax, eax
jmp 0x436195
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
cmp dword [ebp + 0xc], 0
jne 0x436038
mov eax, dword [ebp - 4]
jmp 0x436195
jmp 0x43604c
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp + 0x14], eax
mov ecx, dword [ebp + 0xc]
add ecx, 3
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x14], 2
jle 0x4360c4
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 1]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 2]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
jmp 0x436091
mov ecx, dword [ebp - 0xc]
shr ecx, 6
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 0
jle 0x4360b6
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
and eax, 0x3f
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 8]
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x436088
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [ebp + 0x10], eax
jmp 0x43603a
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
cmp dword [ebp + 0x14], 0
jle 0x436192
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x4360ed
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jge 0x436111
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
jmp 0x4360e4
jmp 0x43611c
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jge 0x43612d
mov eax, dword [ebp - 0xc]
shl eax, 8
mov dword [ebp - 0xc], eax
jmp 0x436113
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x436141
mov edx, dword [ebp - 0xc]
shr edx, 6
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
jle 0x436166
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0x3f
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 8]
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
jmp 0x436138
mov dword [ebp - 8], 3
jmp 0x436178
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x14]
jle 0x43618b
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 8]
mov byte [eax], 0x3d
jmp 0x43616f
mov ecx, dword [ebp + 0x10]
mov byte [ecx + 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x443918
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x443955
cmp dword [ebp + 0x14], edi
je 0x443955
cmp ecx, edi
jne 0x44395c
call fcn.00402cf0
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00402c91
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x443970
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x443991
cmp ebx, 0xffffffff
je 0x443980
push ebx
push edi
push ecx
call fcn.004057a0
add esp, 0xc
cmp esi, edi
je 0x44393d
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x44393d
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4439ad
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4439b4
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x443aa5
test word [esi + 0xc], 0x10c
je 0x443a08
mov eax, dword [esi + 4]
test eax, eax
je 0x443a08
jl 0x443b06
cmp ebx, eax
mov edi, ebx
jb 0x4439d9
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x443aad
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0044b4eb
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x443a9d
cmp ebx, dword [ebp - 0xc]
jb 0x443a75
cmp dword [ebp - 0xc], 0
je 0x443a32
mov ecx, closesocket
xor edx, edx
cmp ebx, ecx
jbe 0x443a27
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x443a2e
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x443a3d
mov eax, closesocket
cmp ebx, eax
ja 0x443a3d
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x443ad9
push eax
push dword [ebp - 8]
push esi
call fcn.00449383
pop ecx
push eax
call fcn.00448962
add esp, 0xc
test eax, eax
je 0x443b18
cmp eax, 0xffffffff
je 0x443b06
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x443a9d
push esi
call fcn.0044b3cb
cmp eax, 0xffffffff
pop ecx
je 0x443b0a
cmp dword [ebp - 4], 0
je 0x443ad9
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4439bc
mov eax, dword [ebp + 0x14]
jmp 0x443957
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x443ac4
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004057a0
add esp, 0xc
call fcn.00402cf0
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x44394d
cmp dword [ebp + 0xc], 0xffffffff
je 0x443aef
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004057a0
add esp, 0xc
call fcn.00402cf0
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x44394d
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x443957
or dword [esi + 0xc], 0x10
jmp 0x443b0a
Function at 0x446106
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x446133
call fcn.00402d03
mov dword [eax], esi
call fcn.00402cf0
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00402c91
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x44610f
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x446162
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d16
pop ecx
call fcn.00402cf0
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x446189
test al, 1
je 0x446189
test byte [esp + 0xc], 2
je 0x446189
call fcn.00402d03
mov dword [eax], 5
call fcn.00402cf0
mov dword [eax], 0xd
jmp 0x446159
xor eax, eax
pop esi
ret
Function at 0x44ee0b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x44ee38
call fcn.00402d03
mov dword [eax], esi
call fcn.00402cf0
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00402c91
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x44ee14
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x44ee67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d16
pop ecx
call fcn.00402cf0
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x44ee8e
test al, 1
je 0x44ee8e
test byte [esp + 0xc], 2
je 0x44ee8e
call fcn.00402d03
mov dword [eax], 5
call fcn.00402cf0
mov dword [eax], 0xd
jmp 0x44ee5e
xor eax, eax
pop esi
ret

Function at 0x4550f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [0x558c60], 1
push 0
call fcn.00455e80
add esp, 4
call fcn.004559d0
test eax, eax
je 0x455130
push 0
push 0
push 0
push 0
push 0
push 0
push 0x11
call fcn.004555e0
add esp, 0x1c
push 0
push 0
call fcn.00455760
add esp, 8
cmp dword [ebp + 8], 0x18
jne 0x45515d
push 0
push 1
call fcn.004542f0
add esp, 8
push str.daemon_shutdown_requested___shutting_down_n
call fcn.00454520
add esp, 4
jmp 0x4551a6
cmp dword [ebp + 8], 0x17
jle 0x455189
push 0
push 1
call fcn.004542f0
add esp, 8
mov eax, dword [ebp + 8]
sub eax, 0x17
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.EXITING_DUE_TO_SIGNAL__d_Exit_reason__d_n
call fcn.00454520
add esp, 0xc
jmp 0x4551a6
push 0
push 1
call fcn.004542f0
add esp, 8
mov edx, dword [ebp + 8]
push edx
push str.EXITING_DUE_TO_SIGNAL__d_n
call fcn.00454520
add esp, 8
call fcn.0040be00
call fcn.0040be30
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4551d6
push 0
push 1
call fcn.004542f0
add esp, 8
mov eax, dword [ebp - 4]
push eax
push str.ts_cleanup_returns__d_n
call fcn.00454520
add esp, 8
cmp dword [0x539cf0], 0
je 0x4551e1
jmp 0x4551eb
push 1
call fcn.004570e0
add esp, 4
cmp dword [0x539cf0], 0
jne 0x45523e
push 1
mov ecx, dword [0x558b28]
push ecx
call fcn.0045ed50
add esp, 8
test eax, eax
je 0x45523e
mov edx, dword [0x558b28]
push edx
call fcn.0048b2b0
add esp, 4
test eax, eax
jne 0x45523e
cmp dword [0x558b1c], 0
je 0x45523e
push 0xffffffffffffffff
push 1
call fcn.004542f0
add esp, 8
push str.Failed_to_close_the_VM_client_session_handle.__n
call fcn.00454520
add esp, 4
push str.on_exit
push 0x53eb90
call fcn.00459440
add esp, 8
mov eax, dword [0x558b28]
push eax
call fcn.00459510
add esp, 4
call fcn.00457010
cmp dword [ebp + 8], 0x20
je 0x455273
push 1
call fcn.00412df0
add esp, 4
cmp dword [ebp + 8], 0x18
jne 0x455282
push 0x25
call fcn.0040153c
jmp 0x45528b
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040153c
mov esp, ebp
pop ebp
ret
Function at 0x460240
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x539a68]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x228], 0
push 0x103
push 0
lea eax, [ebp - 0x227]
push eax
call fcn.004057a0
add esp, 0xc
mov byte [ebp - 0x120], 0
push 0x103
push 0
lea ecx, [ebp - 0x11f]
push ecx
call fcn.004057a0
add esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x4602b4
jmp 0x46034f
mov edx, dword [ebp + 8]
push edx
push str._s_EventLoggingMode
lea eax, [ebp - 0x228]
push eax
call fcn.00443408
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.SOFTWAREFNPlmLicense_Server
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46030a
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push str.SOFTWAREMacrovision_CorporationFLEXlm_License_Manager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46034f
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46034f
push str.ENABLE
lea edx, [ebp - 0x120]
push edx
call fcn.0040a332
add esp, 8
test eax, eax
jne 0x46034f
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], 0
je 0x460366
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040553d
mov esp, ebp
pop ebp
ret
Function at 0x4603d0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x539a68]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x11c], 0xffffff77
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call fcn.004057a0
add esp, 0xc
cmp dword [0x55a760], 0
je 0x460436
movzx ecx, word [ebp + 0x18]
test ecx, ecx
je 0x46043b
cmp dword [ebp + 0x1c], 0
jne 0x46043b
jmp 0x460527
mov dx, word [ebp + 0x18]
add dx, 1
mov word [ebp + 0x18], dx
movzx eax, word [ebp + 0x18]
shl eax, 2
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00462740
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46051d
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 0x540d3c
lea edx, [ebp - 0x118]
push edx
call fcn.00443408
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 8], 1
jmp 0x46049f
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
movzx eax, word [ebp + 0x18]
cmp dword [ebp - 8], eax
jge 0x4604e0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax + edx*4 - 4]
push ecx
call fcn.00460660
add esp, 8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ecx + edx*4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp dword [eax + edx*4], 0
jne 0x4604de
mov cx, word [ebp - 8]
mov word [ebp + 0x18], cx
jmp 0x460527
jmp 0x460496
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov dx, word [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov cx, word [ebp + 0x10]
push ecx
mov dx, word [ebp + 0xc]
push edx
mov eax, dword [0x55a760]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x46051b
mov dword [ebp - 0x11c], 0
jmp 0x460527
mov dword [ebp - 0x11c], 0xffffffd8
cmp dword [ebp - 4], 0
je 0x460588
mov dword [ebp - 8], 1
jmp 0x46053f
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
movzx edx, word [ebp + 0x18]
cmp dword [ebp - 8], edx
jge 0x460575
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp dword [ecx + eax*4], 0
je 0x460573
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00462990
add esp, 4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [eax + edx*4], 0
jmp 0x460536
mov ecx, dword [ebp - 4]
push ecx
call fcn.00462990
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040553d
mov esp, ebp
pop ebp
ret
Function at 0x4605a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x539a68]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x55a76c], 0
jne 0x460641
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.004057a0
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x460637
cmp dword [ebp - 0x90], 1
jne 0x460606
mov dword [0x55a768], 2
jmp 0x460637
cmp dword [ebp - 0x90], 2
je 0x460618
cmp dword [ebp - 0x9c], 6
jb 0x460624
mov dword [0x55a768], 1
jmp 0x460637
cmp dword [ebp - 0x90], 0
jne 0x460637
mov dword [0x55a768], 3
mov dword [0x55a76c], 1
mov eax, dword [0x55a768]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040553d
mov esp, ebp
pop ebp
ret

Function at 0x460e30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
jne 0x460e68
jmp 0x460eac
mov eax, dword [ebp + 8]
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x460eac
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00460a00
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x460eac
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00460ed0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
je 0x460ec5
mov edx, dword [ebp - 0x10]
push edx
call fcn.00462990
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4612c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x461301
cmp dword [ebp + 0xc], 0
je 0x461301
cmp dword [ebp + 0x10], 0
je 0x461301
cmp dword [ebp + 0x14], 0
jne 0x461306
jmp 0x4613d9
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00460660
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4613d9
cmp dword [ebp - 0x14], 0
je 0x4613d9
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4613d9
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
call fcn.00405e7b
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4613d9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4613d9
mov edx, dword [ebp + 0x10]
cmp dword [edx], 1
je 0x4613af
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x4613c4
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00460b60
add esp, 8
mov dword [ebp - 8], eax
jmp 0x4613d9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
cmp dword [ebp - 4], 0
je 0x4613f2
mov eax, dword [ebp - 4]
push eax
call fcn.00462990
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x46140b
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00462990
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret