joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bc20
Capabilities:
Reference wmi statements

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, 1
push edi
push esi
mov dword [esp + 0x10], 0
call fcn.00420360
mov edi, eax
add esp, 4
test edi, edi
jne 0x41bc7a
test esi, esi
je 0x41bd89
mov eax, dword [esi + 8]
test eax, eax
je 0x41bd89
push 0x8e
push str.Failed_to_create_WMI_object
push 9
push dword [esi]
call eax
add esp, 0x10
push edi
call fcn.00420580
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret
push esi
push str.SELECT__FROM_Win32_BIOS
push edi
call fcn.00420640
add esp, 0xc
test eax, eax
jne 0x41bd6b
push esi
push edi
call fcn.004205f0
add esp, 8
test eax, eax
je 0x41bd4f
lea eax, [esp + 0xc]
push eax
push str.Manufacturer
push edi
call fcn.00420630
add esp, 0xc
test eax, eax
jne 0x41bcd0
push esi
push str.innotek_GmbH
push dword [esp + 0x14]
call fcn.00414c70
add esp, 0xc
test eax, eax
je 0x41bd4d
push dword [esp + 0xc]
call fcn.00444a71
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push str.SMBIOSBIOSVersion
push edi
call fcn.00420630
add esp, 0x10
test eax, eax
jne 0x41bd0e
push esi
push str.VirtualBox
push dword [esp + 0x14]
call fcn.00414c70
add esp, 0xc
test eax, eax
je 0x41bd4d
push dword [esp + 0xc]
call fcn.00444a71
push esi
push edi
mov dword [esp + 0x18], 0
call fcn.004205f0
add esp, 0xc
test eax, eax
jne 0x41bca3
push dword [esp + 0xc]
call fcn.00444a71
add esp, 4
push edi
call fcn.00420580
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret
xor ebx, ebx
push dword [esp + 0xc]
call fcn.00444a71
add esp, 4
push edi
test esi, esi
je 0x41bd89
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41bd89
push 0xb5
push str.Error:_Cmn_Wmi_query_failed
push 9
push dword [esi]
call ecx
add esp, 0x10
push edi
call fcn.00420580
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41be30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 4
lea edi, [ebp + 3]
shr edi, 2
push edi
call fcn.004475d8
mov esi, eax
add esp, 8
test esi, esi
je 0x41beb4
push ebx
push ebp
push dword [esp + 0x1c]
push esi
call fcn.00429b40
mov ebx, dword [esp + 0x20]
add esp, 0xc
xor edx, edx
test edi, edi
je 0x41be78
mov ecx, dword [esi + edx*4]
mov eax, ecx
xor eax, ebx
mov ebx, ecx
mov dword [esi + edx*4], eax
inc edx
cmp edx, edi
jb 0x41be67
xor edx, edx
xor eax, eax
xor bl, bl
test ebp, ebp
je 0x41bea1
mov edi, dword [esp + 0x18]
mov eax, dword [esi + eax*4]
movzx ecx, bl
add bl, 8
and ecx, 0x1f
shr eax, cl
mov byte [edx + edi], al
inc edx
mov eax, edx
shr eax, 2
cmp edx, ebp
jb 0x41be86
push esi
call fcn.00444a71
add esp, 4
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
Function at 0x41e360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 4
lea edi, [ebp + 3]
shr edi, 2
push edi
call fcn.004475d8
mov esi, eax
add esp, 8
test esi, esi
je 0x41e3de
push ebp
push dword [esp + 0x18]
push esi
call fcn.00429b40
mov ecx, dword [esp + 0x1c]
add esp, 0xc
xor eax, eax
test edi, edi
je 0x41e3a1
xor dword [esi + eax*4], ecx
mov ecx, dword [esi + eax*4]
inc eax
cmp eax, edi
jb 0x41e396
push ebx
xor edx, edx
xor eax, eax
xor bl, bl
test ebp, ebp
je 0x41e3cb
mov edi, dword [esp + 0x18]
mov eax, dword [esi + eax*4]
movzx ecx, bl
add bl, 8
and ecx, 0x1f
shr eax, cl
mov byte [edx + edi], al
inc edx
mov eax, edx
shr eax, 2
cmp edx, ebp
jb 0x41e3b0
push esi
call fcn.00444a71
add esp, 4
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
Function at 0x41ec90
Capabilities:
Encode data using base64

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov ecx, edx
push esi
lea esi, [ecx + 1]
jmp 0x41eca0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41eca0
sub ecx, esi
xor esi, esi
test cl, 3
je 0x41ecd1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41eccb
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41eccb
push 0x56
push esi
push 0xc
push dword [eax]
call ecx
add esp, 0x10
or eax, 0xffffffff
pop esi
pop ecx
ret
test ecx, ecx
jne 0x41ece0
mov eax, dword [esp + 0x14]
mov dword [eax], esi
xor eax, eax
pop esi
pop ecx
ret
mov eax, ecx
shr eax, 2
cmp byte [ecx + edx - 1], 0x3d
lea eax, [eax + eax*2]
jne 0x41ecf8
dec eax
cmp byte [ecx + edx - 2], 0x3d
jne 0x41ecf8
dec eax
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi], eax
jae 0x41ed24
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41ed1d
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41ed1d
push 0x6e
push 0
push 0xc
push dword [eax]
call ecx
add esp, 0x10
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret
test ecx, ecx
je 0x41ee82
push ebx
push ebp
lea ebp, [ecx - 1]
mov ecx, 0x3f
shr ebp, 2
lea edi, [edx + 1]
inc ebp
mov dword [esp + 0x10], ecx
mov bl, byte [edi - 1]
lea eax, [ebx - 0x41]
cmp al, 0x19
ja 0x41ed50
sub bl, 0x41
jmp 0x41ed7e
lea eax, [ebx - 0x61]
cmp al, 0x19
ja 0x41ed5c
sub bl, 0x47
jmp 0x41ed7e
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x41ed68
add bl, 4
jmp 0x41ed7e
cmp bl, 0x2b
jne 0x41ed71
mov bl, 0x3e
jmp 0x41ed7e
cmp bl, 0x2d
mov eax, 0xff
cmove eax, ecx
mov bl, al
mov dl, byte [edi]
lea eax, [edx - 0x41]
cmp al, 0x19
ja 0x41ed8c
sub dl, 0x41
jmp 0x41edba
lea eax, [edx - 0x61]
cmp al, 0x19
ja 0x41ed98
sub dl, 0x47
jmp 0x41edba
lea eax, [edx - 0x30]
cmp al, 9
ja 0x41eda4
add dl, 4
jmp 0x41edba
cmp dl, 0x2b
jne 0x41edad
mov dl, 0x3e
jmp 0x41edba
cmp dl, 0x2d
mov eax, 0xff
cmove eax, ecx
mov dl, al
mov cl, byte [edi + 1]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x41edc9
sub cl, 0x41
jmp 0x41edfc
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x41edd5
sub cl, 0x47
jmp 0x41edfc
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x41ede1
add cl, 4
jmp 0x41edfc
cmp cl, 0x2b
jne 0x41edea
mov cl, 0x3e
jmp 0x41edfc
cmp cl, 0x2d
mov eax, 0xff
mov ecx, 0x3f
cmove eax, ecx
mov cl, al
mov ch, byte [edi + 2]
mov al, ch
sub al, 0x41
cmp al, 0x19
ja 0x41ee0c
sub ch, 0x41
jmp 0x41ee3e
mov al, ch
sub al, 0x61
cmp al, 0x19
ja 0x41ee19
sub ch, 0x47
jmp 0x41ee3e
mov al, ch
sub al, 0x30
cmp al, 9
ja 0x41ee26
add ch, 4
jmp 0x41ee3e
cmp ch, 0x2b
jne 0x41ee2f
mov ch, 0x3e
jmp 0x41ee3e
cmp ch, 0x2d
mov eax, 0xff
cmove eax, dword [esp + 0x10]
mov ch, al
mov al, dl
shl bl, 2
shr al, 4
add al, bl
mov ebx, dword [esp + 0x1c]
mov byte [esi + ebx], al
inc esi
cmp cl, 0xff
je 0x41ee71
mov al, cl
shl dl, 4
shr al, 2
add al, dl
mov byte [esi + ebx], al
inc esi
cmp ch, 0xff
je 0x41ee71
shl cl, 6
add cl, ch
mov byte [esi + ebx], cl
inc esi
add edi, 4
mov ecx, 0x3f
dec ebp
jne 0x41ed41
pop ebp
pop ebx
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ecx
ret

Function at 0x46591a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046551f
Function at 0x465925
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004656a0
Function at 0x47d0b0
Capabilities:
Terminate process

Disassembly:
call fcn.0054b960
cmp eax, 1
jne 0x47d153
cmp dword [0x59c538], 0
je 0x47d0dc
push 0xffffffffffffffff
push eax
call fcn.0053dde0
push str.Setting_the_server_cloud_type_to_AMAZON_n
call fcn.0053d620
add esp, 0xc
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x160]
test eax, eax
je 0x47d1da
mov eax, dword [eax + 4]
test eax, eax
je 0x47d1da
mov eax, dword [eax + 0x404]
test eax, eax
je 0x47d1da
movzx eax, word [eax + 2]
mov edx, 0x1f5
cmp ax, dx
jl 0x47d1da
mov ecx, 0x208
cmp ax, cx
jg 0x47d1da
cmp ax, dx
je 0x47d1da
push 0
push 1
call fcn.0053dde0
push str.The_AMZN_HOSTID_on_SERVER_line_isnt_supported_by_vendor_daemon.__n
call fcn.0053d620
add esp, 0xc
mov dword [esp + 4], 0x39
jmp fcn.0053d390
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x160]
test eax, eax
je 0x47d1da
mov eax, dword [eax + 4]
test eax, eax
je 0x47d1da
mov eax, dword [eax + 0x404]
test eax, eax
je 0x47d1da
movzx eax, word [eax + 2]
mov ecx, 0x1f5
cmp ax, cx
jne 0x47d1a3
push 0
push 1
call fcn.0053dde0
push str.The_HOSTID_on_the_SERVER_line_needs_the_server_to_run_in_Amazon_Cloud_environment.__n
call fcn.0053d620
add esp, 0xc
mov dword [esp + 4], 0x33
jmp fcn.0053d390
mov ecx, 0x1f6
cmp ax, cx
jl 0x47d1da
mov ecx, 0x208
cmp ax, cx
jg 0x47d1da
push 0
push 1
call fcn.0053dde0
push str.The_AMZN_HOSTID_on_SERVER_line_isnt_supported_by_vendor_daemon.__n
call fcn.0053d620
add esp, 0xc
mov dword [esp + 4], 0x39
jmp fcn.0053d390
ret

Function at 0x47d4a0
Capabilities:
Terminate process

Disassembly:
push esi
push 3
push dword [0x59c53c]
call fcn.00511040
push eax
call fcn.00511190
push 0
push 1
mov esi, eax
call fcn.0053dde0
push str.SLOG:_FNPLS_INTERNAL_CKPT5_n
call fcn.0053d620
push 0
push 1
call fcn.0053dde0
push esi
push str.SLOG:_TPM_Status:__d_n
call fcn.0053d620
push 0
push 1
call fcn.0053dde0
push str.SLOG:_FNPLS_INTERNAL_CKPT6_n
call fcn.0053d620
mov eax, dword [esp + 0x3c]
add esp, 0x34
mov eax, dword [eax + 0x160]
test eax, eax
je 0x47d553
mov eax, dword [eax + 4]
test eax, eax
je 0x47d553
mov eax, dword [eax + 0x404]
test eax, eax
je 0x47d553
movzx eax, word [eax + 2]
mov ecx, 0x12d
cmp ax, cx
jl 0x47d553
mov ecx, 0x15e
cmp ax, cx
jg 0x47d553
cmp esi, 1
je 0x47d553
push 0
push 1
call fcn.0053dde0
push str.The_HOSTID_on_the_SERVER_line_needs_the_server_to_run_in_TPM_Configured_environment.__n
call fcn.0053d620
add esp, 0xc
pop esi
mov dword [esp + 4], 0x33
jmp fcn.0053d390
pop esi
ret
Function at 0x47e4f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x34
mov eax, dword [0x5923b4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [esp + 0x3c]
push edi
xor edi, edi
test ebx, ebx
je 0x47e6e1
push esi
push ebx
call fcn.00481800
mov esi, eax
add esp, 4
test esi, esi
je 0x47e6cd
push ebp
mov eax, dword [esi]
add eax, 0xfffffffe
cmp eax, 9
ja case.0x47e531.4
jmp dword [eax*4 + 0x47e6f8]
mov ebp, dword [esi + 4]
test ebp, ebp
je case.0x47e531.4
push ebp
call fcn.00480fa0
add esp, 4
mov edi, eax
call fcn.0047a660
mov eax, dword [ebp]
test eax, eax
je 0x47e698
and dword [eax + 0x14b0], 0xfffffdff
jmp 0x47e698
mov eax, dword [esi + 4]
test eax, eax
je case.0x47e531.4
push eax
call fcn.00481090
add esp, 4
mov edi, eax
jmp 0x47e698
mov eax, dword [esi + 4]
test eax, eax
je 0x47e698
push 0xffffffffffffffff
push eax
call fcn.004812d0
add esp, 8
mov edi, eax
jmp 0x47e698
mov ebp, dword [esi + 4]
test ebp, ebp
je 0x47e698
cmp dword [ebp + 4], 0
je 0x47e698
push 0
push 1
call fcn.0053dde0
push dword [ebp + 4]
push 0x56b610
call fcn.0053d620
add esp, 0x10
jmp 0x47e698
mov eax, dword [esi + 4]
test eax, eax
je 0x47e698
mov eax, dword [eax]
test eax, eax
je 0x47e698
push 2
push eax
call fcn.005445f0
add esp, 8
jmp 0x47e698
mov ebp, dword [esi + 4]
test ebp, ebp
je case.0x47e531.4
cmp dword [ebp + 0x1c], 0
je case.0x47e531.4
push 0
push 0x30
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00414af0
mov eax, dword [ebp]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x20]
push eax
push dword [ebp + 0x1c]
push dword [0x59c53c]
call fcn.00515620
add esp, 0x1c
mov edi, eax
call fcn.0047a660
mov eax, dword [ebp + 0x1c]
and dword [eax + 0x14b0], 0xfffffdff
jmp 0x47e698
mov eax, dword [esi + 4]
test eax, eax
je case.0x47e531.4
push eax
call fcn.004811e0
add esp, 4
mov edi, eax
jmp 0x47e698
mov edi, 0xffffffd6
push esi
call fcn.00485a80
add esp, 4
test edi, edi
jne 0x47e6b8
push ebx
call fcn.00481800
mov esi, eax
add esp, 4
test esi, esi
jne 0x47e523
pop ebp
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00424604
add esp, 0x34
ret
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00424604
add esp, 0x34
ret
mov ecx, dword [esp + 0x38]
mov eax, 0xffffffd6
pop edi
pop ebx
xor ecx, esp
call fcn.00424604
add esp, 0x34
ret
Function at 0x481df0
Capabilities:
Terminate process

Disassembly:
call fcn.0053cae0
test eax, eax
jne 0x481e16
push dword [esp + 4]
call fcn.0053cc80
add esp, 4
test al, al
jne 0x481e16
mov dword [esp + 4], 0x30
jmp fcn.0053d390
ret
Function at 0x4967f0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
call fcn.004deb00
mov esi, dword [esp + 0xc]
mov edi, eax
test esi, esi
je 0x4969d5
mov eax, dword [esi + 0x14b0]
test eax, 0x200
je 0x4968a2
test eax, 0x400
jne 0x4969d5
push dword [esi]
call fcn.0047fcd0
or dword [esi + 0x14b0], 0x400
push 8
push dword [0x59c53c]
call fcn.004bad00
mov edx, eax
add esp, 0xc
test edx, edx
je 0x4969d5
mov eax, dword [0x59c53c]
test eax, eax
je 0x496896
cmp dword [eax + 0x1b0], 0
je 0x496896
mov dword [edx], esi
mov eax, dword [0x59c53c]
mov ecx, dword [eax + 0x1b0]
mov eax, dword [ecx + 0x1cf4]
test eax, eax
jne 0x496880
pop edi
mov dword [ecx + 0x1cf4], edx
pop esi
ret
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x496890
mov eax, ecx
test eax, eax
jne 0x496880
pop edi
pop esi
ret
pop edi
mov dword [eax + 4], edx
pop esi
ret
push edx
call fcn.004bace0
add esp, 4
pop edi
pop esi
ret
push 0x207
push dword [esi + 0x14c8]
call fcn.004c0ae0
add esp, 8
test eax, eax
je 0x4968d2
push esi
push 0x207
push dword [esi + 0x14c8]
call fcn.004c0ae0
add esp, 8
call eax
add esp, 4
test byte [esi + 0x14b0], 0x40
push ebx
mov ebx, dword [esp + 0x20]
je 0x496923
call fcn.005463c0
test eax, eax
je 0x496905
push 0
push 0
push 0
push str.lmgrd
push 0x56b6af
push dword [esi]
push 2
call fcn.00546200
add esp, 0x1c
push 0
push 1
call fcn.0053dde0
push ebx
push str.Lost_communications_with_lmgrd.__n_s_nExiting._n
call fcn.0053d620
push 0x1c
call fcn.0053d390
add esp, 0x14
push ebx
push dword [esp + 0x20]
push esi
call fcn.004973a0
mov ebx, dword [esp + 0x20]
add esp, 0xc
test ebx, ebx
je 0x496990
cmp edi, 0x2714
je 0x496990
cmp edi, 0x274a
je 0x496990
cmp edi, 0x2745
je 0x496990
cmp edi, 0x2746
je 0x496990
cmp edi, 0x274c
je 0x496990
cmp dword [0x59c538], 0
je 0x4969d4
push 0xffffffffffffffff
push 1
call fcn.0053dde0
add esp, 8
push dword [esi]
push ebx
call fcn.004deb00
push eax
push str.VD_read:_d_len:_d_fd:_d
call fcn.0053d620
add esp, 0x10
pop ebx
pop edi
pop esi
ret
mov eax, dword [esi]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push str.client
push eax
call fcn.0053eab0
xor eax, eax
push eax
push eax
push 2
push 1
push esi
mov word [esi + 0x1426], ax
call fcn.0049d3e0
xor eax, eax
add esp, 0x1c
mov dword [esi + 0x1422], eax
cmp dword [esp + 0x18], eax
je 0x4969d4
push esi
call fcn.00541620
add esp, 4
pop ebx
pop edi
pop esi
ret
Function at 0x49ace0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
push esi
mov eax, dword [eax + 0x149c]
test eax, eax
setle bl
test eax, eax
jns 0x49acf9
neg eax
push eax
call fcn.00547dd0
mov esi, eax
add esp, 4
test esi, esi
je 0x49ad3c
cmp dword [esi + 0x10], 0
je 0x49ad2a
mov ecx, dword [esi]
mov dword [esp + 0xc], ecx
test ebx, ebx
jne 0x49ad2a
lea eax, [esp + 0xc]
push str.removing_user
push eax
call fcn.0053eab0
add esp, 8
call fcn.00496a50
test ebx, ebx
jne 0x49ad3c
push esi
call fcn.00541620
add esp, 4
pop esi
pop ebx
ret

Function at 0x49ad80
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
test eax, eax
push esi
push eax
setle bl
call fcn.00547dd0
mov esi, eax
add esp, 4
test esi, esi
je 0x49add0
cmp dword [esi + 0x10], 0
je 0x49adbe
mov ecx, dword [esi]
mov dword [esp + 0xc], ecx
test ebx, ebx
jne 0x49adbe
lea eax, [esp + 0xc]
push str.removing_user
push eax
call fcn.0053eab0
add esp, 8
call fcn.00496a50
test ebx, ebx
jne 0x49add0
push esi
call fcn.00541620
add esp, 4
pop esi
pop ebx
ret

Function at 0x49ade0
Capabilities:
Terminate process

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x49ae51
push ebx
push ebp
push esi
lea esp, [esp]
mov eax, dword [edi]
xor ebx, ebx
mov ebp, dword [edi + 4]
test eax, eax
push eax
setle bl
call fcn.00547dd0
mov esi, eax
add esp, 4
test esi, esi
je 0x49ae3f
cmp dword [esi + 0x10], 0
je 0x49ae2d
mov ecx, dword [esi]
mov dword [esp + 0x14], ecx
test ebx, ebx
jne 0x49ae2d
lea eax, [esp + 0x14]
push str.removing_user
push eax
call fcn.0053eab0
add esp, 8
call fcn.00496a50
test ebx, ebx
jne 0x49ae3f
push esi
call fcn.00541620
add esp, 4
push edi
call fcn.004bace0
add esp, 4
mov edi, ebp
test ebp, ebp
jne 0x49adf0
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x49d470
Capabilities:
Terminate process

Disassembly:
mov eax, 0x14d8
call fcn.00424620
mov ecx, dword [0x593194]
mov dword [esp + 4], ecx
test ecx, ecx
je 0x49d626
push ebx
push ebp
push esi
push edi
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x49d622
cmp byte [eax], 0
je 0x49d622
mov eax, dword [ecx + 0xa4]
test eax, eax
je 0x49d614
mov ebp, dword [0x59e578]
mov ebx, dword [0x59e57c]
cdq
sub ebp, eax
sbb ebx, edx
mov dword [esp + 0x10], ebx
js 0x49d614
jg 0x49d4d7
test ebp, ebp
jb 0x49d614
mov edi, dword [ecx + 0xc]
test edi, edi
je 0x49d614
mov eax, dword [edi + 4]
mov esi, dword [edi + 8]
push ebx
push ebp
push edi
mov dword [esp + 0x28], eax
call fcn.004ae4b0
add esp, 0xc
test eax, eax
jne 0x49d54c
push dword [edi + 0x149c]
call fcn.00547e10
mov edi, eax
add esp, 4
test edi, edi
je 0x49d51b
test dword [edi + 0x14b0], 0x800
jne 0x49d54c
push 0
push 0
push 1
push dword [esp + 0x14f8]
push edi
call fcn.0049d3e0
add esp, 0x14
test edi, edi
je 0x49d54c
mov eax, dword [edi + 0x18]
mov dword [esp + 0x14bc], eax
lea eax, [esp + 0x20]
push eax
call fcn.0049ace0
add esp, 4
test esi, esi
je 0x49d602
mov edi, dword [esi + 8]
push ebx
push ebp
push esi
call fcn.004ae4b0
add esp, 0xc
test eax, eax
jne 0x49d5f8
push dword [esi + 0x149c]
call fcn.00547e10
add esp, 4
test eax, eax
je 0x49d588
test dword [eax + 0x14b0], 0x800
jne 0x49d5f8
push 0
push 0
push 1
push dword [esp + 0x14f8]
push eax
call fcn.0049d3e0
mov eax, dword [esi + 0x149c]
xor ebx, ebx
add esp, 0x14
test eax, eax
setle bl
test eax, eax
jns 0x49d5b1
neg eax
push eax
call fcn.00547dd0
mov esi, eax
add esp, 4
test esi, esi
je 0x49d5f4
cmp dword [esi + 0x10], 0
je 0x49d5e2
mov ecx, dword [esi]
mov dword [esp + 0x18], ecx
test ebx, ebx
jne 0x49d5e2
lea eax, [esp + 0x18]
push str.removing_user
push eax
call fcn.0053eab0
add esp, 8
call fcn.00496a50
test ebx, ebx
jne 0x49d5f4
push esi
call fcn.00541620
add esp, 4
mov ebx, dword [esp + 0x10]
mov esi, edi
test edi, edi
jne 0x49d554
mov eax, dword [esp + 0x1c]
mov edi, eax
test eax, eax
jne 0x49d4e2
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
mov dword [esp + 0x14], ecx
test ecx, ecx
jne 0x49d490
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14d8
ret
Function at 0x49dbc0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x14d4
call fcn.00424620
push edi
mov edi, dword [esp + 0x14dc]
mov eax, dword [edi + 0xa4]
test eax, eax
je 0x49dd44
push ebx
mov ebx, dword [0x59e57c]
push ebp
mov ebp, dword [0x59e578]
cdq
sub ebp, eax
sbb ebx, edx
mov dword [esp + 0xc], ebx
js 0x49dd42
jg 0x49dc07
test ebp, ebp
jb 0x49dd42
mov edi, dword [edi + 0xc]
test edi, edi
je 0x49dd42
push esi
mov eax, dword [edi + 4]
mov esi, dword [edi + 8]
push ebx
push ebp
push edi
mov dword [esp + 0x24], eax
call fcn.004ae4b0
add esp, 0xc
test eax, eax
jne 0x49dc7d
push dword [edi + 0x149c]
call fcn.00547e10
mov edi, eax
add esp, 4
test edi, edi
je 0x49dc4c
test dword [edi + 0x14b0], 0x800
jne 0x49dc7d
push 0
push 0
push 1
push dword [esp + 0x14f8]
push edi
call fcn.0049d3e0
add esp, 0x14
test edi, edi
je 0x49dc7d
mov eax, dword [edi + 0x18]
mov dword [esp + 0x14b8], eax
lea eax, [esp + 0x1c]
push eax
call fcn.0049ace0
add esp, 4
test esi, esi
je 0x49dd33
mov edi, dword [esi + 8]
push ebx
push ebp
push esi
call fcn.004ae4b0
add esp, 0xc
test eax, eax
jne 0x49dd29
push dword [esi + 0x149c]
call fcn.00547e10
add esp, 4
test eax, eax
je 0x49dcb9
test dword [eax + 0x14b0], 0x800
jne 0x49dd29
push 0
push 0
push 1
push dword [esp + 0x14f8]
push eax
call fcn.0049d3e0
mov eax, dword [esi + 0x149c]
xor ebx, ebx
add esp, 0x14
test eax, eax
setle bl
test eax, eax
jns 0x49dce2
neg eax
push eax
call fcn.00547dd0
mov esi, eax
add esp, 4
test esi, esi
je 0x49dd25
cmp dword [esi + 0x10], 0
je 0x49dd13
mov ecx, dword [esi]
mov dword [esp + 0x14], ecx
test ebx, ebx
jne 0x49dd13
lea eax, [esp + 0x14]
push str.removing_user
push eax
call fcn.0053eab0
add esp, 8
call fcn.00496a50
test ebx, ebx
jne 0x49dd25
push esi
call fcn.00541620
add esp, 4
mov ebx, dword [esp + 0x10]
mov esi, edi
test edi, edi
jne 0x49dc85
mov eax, dword [esp + 0x18]
mov edi, eax
test eax, eax
jne 0x49dc13
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x14d4
ret
Function at 0x4a3640
Capabilities:
Terminate process

Disassembly:
sub esp, 8
or eax, 0xffffffff
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4a367a
cmp dword [esi + 0x14], 1
jne 0x4a37c7
push 0x208
push dword [esi + 0x14c8]
call fcn.004c0ae0
add esp, 8
test eax, eax
jne 0x4a37c7
mov eax, dword [esi + 0x146c]
mov edx, dword [esp + 0x14]
test edx, edx
je 0x4a377d
test esi, esi
je 0x4a377d
mov ecx, dword [edx]
sub ecx, dword [esi + 0x1458]
push edi
mov edi, dword [edx + 4]
sbb edi, dword [esi + 0x145c]
test edi, edi
jg 0x4a36bb
jl 0x4a36aa
test ecx, ecx
jae 0x4a36bb
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
cmp dword [esi + 0x1458], 0xffffffff
jne 0x4a36cd
cmp dword [esi + 0x145c], 0
je 0x4a370f
test eax, eax
jle 0x4a370f
cdq
cmp edi, edx
jl 0x4a370f
jg 0x4a36dc
cmp ecx, eax
jbe 0x4a370f
push esi
call fcn.004a35f0
add esp, 4
test eax, eax
jne 0x4a370f
push str.Client_timeout._Close_connection
push dword [esi]
push eax
push eax
push esi
call fcn.004967f0
add esp, 0x14
mov dword [esi + 0x1458], 0xffffffff
mov dword [esi + 0x145c], 0
cmp dword [esi + 0x1458], 0xffffffff
pop edi
jne 0x4a37c7
cmp dword [esi + 0x145c], 0
jne 0x4a37c7
cmp dword [0x59c280], 0
push str.E:FNP_11.16.2_tier1_flexnet_appls_ck_client.c
jne 0x4a374b
push 0x7d
push 8
call fcn.00541380
mov ecx, eax
mov dword [0x59c280], ecx
jmp 0x4a3761
push 0x82
push 8
call fcn.00541380
mov ecx, eax
mov eax, dword [0x59c284]
mov dword [eax + 4], ecx
add esp, 0xc
mov dword [ecx], esi
mov dword [0x59c284], ecx
mov eax, 1
mov dword [ecx + 4], 0
pop esi
add esp, 8
ret
mov eax, dword [0x59c280]
mov dword [0x59c284], eax
test eax, eax
je 0x4a37bd
jmp 0x4a3790
push dword [eax]
call fcn.00541620
mov ecx, dword [0x59c284]
push ecx
mov dword [0x59c280], ecx
mov eax, dword [ecx + 4]
mov dword [0x59c284], eax
call fcn.004bace0
mov eax, dword [0x59c284]
add esp, 8
test eax, eax
jne 0x4a3790
mov dword [0x59c280], 0
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x4a3d20
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0x10
call fcn.00444a76
mov esi, eax
add esp, 4
test esi, esi
jne 0x4a3d35
pop esi
pop ecx
ret
push edi
push 0
push 0x10
push 0
push esi
call fcn.00414af0
mov eax, dword [esp + 0x20]
mov dword [esi], eax
mov eax, dword [esp + 0x28]
push 4
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esp + 0x1c], 0
call fcn.00444a76
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4a3d96
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x4a3e40
push 0
push 0
call fcn.004560fd
add esp, 0x18
mov dword [edi], eax
test eax, eax
jne 0x4a3d98
push edi
call fcn.004bace0
add esp, 4
xor edi, edi
mov dword [esi + 4], edi
mov eax, esi
pop edi
pop esi
pop ecx
ret
Function at 0x4b0bf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x74
mov eax, dword [0x5923b4]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
mov ebx, dword [esp + 0x7c]
push esi
xor esi, esi
test ebx, ebx
je 0x4b0ca2
push edi
mov edi, dword [esp + 0x88]
test edi, edi
je 0x4b0c8e
push dword [esp + 0x8c]
lea eax, [esp + 0x48]
push edi
push eax
call fcn.004b08a0
add esp, 0xc
test eax, eax
jne 0x4b0c8e
push dword [esp + 0x8c]
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004b0960
add esp, 0xc
test eax, eax
jne 0x4b0c8e
xor ecx, ecx
test edi, edi
je 0x4b0c77
mov edx, 1
jmp 0x4b0c60
mov al, byte [esp + ecx + 0xc]
xor al, byte [esp + ecx + 0x44]
cmp al, byte [ecx + ebx]
cmovne esi, edx
inc ecx
cmp ecx, edi
jb 0x4b0c60
test esi, esi
jne 0x4b0c8e
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00424604
add esp, 0x74
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00424604
add esp, 0x74
ret
mov ecx, dword [esp + 0x78]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.00424604
add esp, 0x74
ret