joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40df60
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 4]
test eax, eax
mov dword [ebp - 0xc], ecx
jne 0x40df90
call fcn.004044f0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push str.Invalid_ky_in_crcr
push eax
call edx
add esp, 8
mov eax, 0x8000
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 8
push eax
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
jne 0x40dfdd
call fcn.004044f0
mov edi, eax
mov esi, dword [edi]
add esi, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi]
push str.Unable_to_get_IVLen__GLE__d_
push edi
call eax
add esp, 0xc
pop edi
mov eax, 0x8000
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
xor edx, edx
lea eax, [edi + ecx*2 - 1]
div ecx
push ebx
mov ebx, dword [ebp + 0x14]
mov esi, eax
imul esi, ecx
add esi, 2
cmp esi, dword [ebx]
jbe 0x40e022
call fcn.004044f0
mov edx, dword [ebx]
mov ecx, dword [eax]
push esi
push edx
push str.Data_buffer_too_small__d____d
push eax
mov eax, dword [ecx + 0x28]
call eax
add esp, 0x10
pop ebx
pop edi
mov eax, 0x8000
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push edi
push ecx
push esi
call sub.MSVCR80.dll_memcpy
mov edx, dword [ebx]
mov ecx, dword [ebp - 0xc]
add esp, 0xc
push edx
mov edx, dword [ecx + 4]
lea eax, [ebp - 4]
push eax
push esi
push 0
push 1
push 0
push edx
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x40e083
call fcn.004044f0
mov edi, eax
mov esi, dword [edi]
add esi, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi]
push str.crcr_failed__GLE__d_
push edi
call eax
add esp, 0xc
pop ebx
pop edi
mov eax, 0x8000
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov dword [ebx], ecx
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40e0a0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
cmp dword [ebx + 4], 0
jne 0x40e0cb
call fcn.004044f0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push str.Invalid_ky_in_crdr
push eax
call edx
add esp, 8
mov eax, 0x8000
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push esi
push eax
push edi
call sub.MSVCR80.dll_memcpy
mov edx, dword [ebx + 4]
add esp, 0xc
lea ecx, [ebp + 0xc]
push ecx
push edi
push 0
push 1
push 0
push edx
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x40e129
call fcn.004044f0
mov edi, eax
mov esi, dword [edi]
add esi, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi]
push str.crcr_failed__GLE__d_
push edi
call eax
add esp, 0xc
pop edi
pop esi
mov eax, 0x8000
pop ebx
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx], edx
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x40e1a0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8004
call fcn.0040e140
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40e1ed
call fcn.004044f0
mov edi, eax
mov esi, dword [edi]
add esi, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
push eax
push str.Unable_to_create_hsh__GLE__d_
push edi
call ecx
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 0
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40e239
call fcn.004044f0
mov edi, eax
mov esi, dword [edi]
add esi, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
push eax
push str.Unable_to_hsh_ky__GLE__d_
push edi
call edx
mov eax, dword [ebp - 4]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x40e650
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push 2
mov word [esi], 0
mov dword [ebp + 8], 0
call sub.Secur32.dll_GetUserNameExW
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add eax, 1
cmp eax, ecx
mov dword [ebp + 8], eax
jbe 0x40e69e
call fcn.004044f0
mov edx, dword [ebp + 8]
mov ecx, dword [eax]
push edx
push str.GetUserName:_UserName_is_too_long__d_
push eax
mov eax, dword [ecx + 0x28]
call eax
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret
mov dword [ebp + 8], ecx
lea ecx, [ebp + 8]
push ecx
push esi
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x40e6cc
call fcn.004044f0
mov edx, dword [eax]
push esi
push str.GetUserName:_GetUserName:__s
push eax
mov eax, dword [edx + 0x38]
call eax
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
push ebx
push edi
call fcn.004044f0
mov ebx, eax
mov edi, dword [ebx]
add edi, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
push eax
push str.Unable_to_get_user_name__GLE_d_
push ebx
call ecx
add esp, 0xc
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40eb10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0
push 0
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
jle 0x40eb6d
lea eax, [edi + edi]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
push edi
mov esi, eax
push esi
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push ecx
push esi
push edi
call dword [sym.imp.MSVCR80.dll_wcsncpy]
add esp, 0xc
test esi, esi
je 0x40eb66
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
pop ebp
ret

Function at 0x40eb80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0
push 0
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
jle 0x40ebdd
lea eax, [edi + edi]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
push edi
mov esi, eax
push esi
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push ecx
push esi
push edi
call dword [sym.imp.MSVCR80.dll_wcsncpy]
add esp, 0xc
test esi, esi
je 0x40ebd6
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
pop ebp
ret
Function at 0x40ebf0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c2c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, eax
cmp ebx, eax
push edi
mov dword [ebp - 0x10], esp
jne 0x40ec48
call fcn.004044f0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push str.No_account_name_when_looking_for_SID
push eax
call edx
add esp, 8
mov eax, 0x8000
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp + 0xc], eax
mov dword [edi], eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
mov eax, dword [ebp + 0xc]
add esp, 4
add eax, eax
mov dword [edi], esi
call fcn.0041b450
mov eax, esp
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp + 0xc]
push edx
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x40ed1c
call fcn.004044f0
mov ebx, eax
mov esi, dword [ebx]
add esi, 0x40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
push eax
push str.LookupAccountName___failed.__GLE_d_
push ebx
call ecx
mov edx, dword [edi]
add esp, 0xc
push edx
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov dword [edi], 0
mov eax, 0x8000
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f580
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setae bl
call fcn.004044f0
mov ecx, dword [eax]
movzx edx, bl
push edx
push 0x423b50
push eax
mov eax, dword [ecx + 0x48]
call eax
add esp, 0xc
test bl, bl
pop ebx
jne 0x40f5b6
xor al, al
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [ebp - 8]
push ecx
xor esi, esi
push 8
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40f5da
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
push 4
lea eax, [ebp - 4]
push eax
push 0x18
push ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40f5fd
mov dword [ebp - 4], esi
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004044f0
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
push edx
push str.Vista_Is_Virtualized___d
push eax
mov eax, dword [ecx + 0x48]
call eax
add esp, 0xc
cmp dword [ebp - 4], esi
pop esi
setne al
mov esp, ebp
pop ebp
ret

Function at 0x40f720
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.MSVCR80.dll__wmkdir]
add esp, 4
test eax, eax
je 0x40f75e
call dword [sym.imp.MSVCR80.dll__errno]
cmp dword [eax], 0x11
je 0x40f75e
call fcn.004044f0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push esi
push str.Unable_to_create_dir__s
push eax
call edx
add esp, 0xc
mov eax, 0x8000
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40f9e0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041b480
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
lea edx, [eax + 2]
jmp 0x40fa00
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40fa00
mov edi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.MSVCR80.dll_wcsncat]
sub eax, edx
sar eax, 1
mov ecx, edi
sub ecx, eax
sub ecx, 1
push ecx
push str.Bentley
push esi
call ebx
push esi
mov word [esi + edi*2 - 2], 0
call dword [sym.imp.MSVCR80.dll__wmkdir]
add esp, 0x10
test eax, eax
je 0x40fa67
call dword [sym.imp.MSVCR80.dll__errno]
cmp dword [eax], 0x11
je 0x40fa67
call fcn.004044f0
mov edx, dword [eax]
push esi
push str.Unable_to_create_dir__s
push eax
mov eax, dword [edx + 0x28]
call eax
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40fa70
sub eax, edx
sar eax, 1
mov ecx, edi
sub ecx, eax
sub ecx, 1
push ecx
push str.Licensing_
push esi
call ebx
push esi
mov word [esi + edi*2 - 2], 0
call fcn.0040f720
add esp, 0x10
test eax, eax
jne 0x40fa5e
push str.test
push esi
lea edx, [ebp - 0x800]
push str._s_s
push edx
call fcn.004038d0
lea eax, [ebp - 0x800]
push 0x41f698
push eax
call dword [sym.imp.MSVCR80.dll__wfopen]
add esp, 0x18
test eax, eax
jne 0x40faf8
call fcn.004044f0
mov ecx, dword [eax]
lea edx, [ebp - 0x800]
push edx
push str.Unable_to_create_test_file__s
push eax
mov eax, dword [ecx + 0x28]
call eax
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
lea ecx, [ebp - 0x800]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40fb40
push eax
push esi
lea edx, [ebp - 0x1000]
push str._s_s
push edx
call fcn.004038d0
lea eax, [ebp - 0x1000]
push eax
call fcn.0040f770
add esp, 0x14
cmp al, 1
jne 0x40fa5e
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410960
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
add ecx, 0xffffffff
push ecx
push esi
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x41098f
mov eax, dword [ebp + 0xc]
mov byte [eax + esi], 0
xor eax, eax
pop esi
pop ebp
ret 0xc
push edi
call fcn.004044f0
mov edi, eax
mov esi, dword [edi]
add esi, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
push eax
push str.InternetReadFile_failed_in_refillBuffer_GLE:__lu
push edi
call ecx
add esp, 0xc
pop edi
mov eax, 0x8000
pop esi
pop ebp
ret 0xc

Function at 0x410df0
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
call fcn.004044f0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
push str.About_to_send_request_ex
call eax
call fcn.004044f0
mov ebx, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
push ebx
push 0x424c7c
push eax
call edx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add esp, 0xc
push esi
push esi
push esi
push eax
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
test eax, eax
jne 0x410e68
call fcn.004044f0
mov edi, eax
mov esi, dword [edi]
add esi, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
push eax
push str.Error_on_HttpSendRequestEx___GLE__d_
push edi
call ecx
add esp, 0xc
pop edi
pop esi
mov eax, 0xffffc94c
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 4]
push edx
push eax
push ebx
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x410ecc
call fcn.004044f0
mov edi, eax
mov esi, dword [edi]
add esi, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
push eax
push str.Error_on_InternetWriteFile__lu
push edi
call ecx
add esp, 0xc
mov esi, 0xffffc94b
call fcn.004044f0
mov ecx, dword [eax]
xor edx, edx
test esi, esi
sete dl
push edx
push str.internetSend_HttpEndRequest__OK__d
push eax
mov eax, dword [ecx + 0x38]
call eax
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpEndRequestW]
test eax, eax
jne 0x410ea4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004044f0
mov edx, dword [eax]
push esi
push str.Error_on_HttpEndRequest__lu
push eax
mov eax, dword [edx + 0x28]
call eax
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x411070
Capabilities:
Check if file exists
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.004044f0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
push str.CheckPostRequest
push eax
call edx
mov ebx, dword [ebp + 8]
add esp, 8
xor esi, esi
call fcn.004044f0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
push esi
push str.CheckPostRequest_retry__d
push eax
call edx
add esp, 0xc
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x4110de
mov ecx, dword [ebp - 4]
push ebx
call fcn.00410810
mov edi, eax
cmp edi, 0x2f00
jne 0x411149
add esi, 1
xor edi, edi
cmp esi, 5
jl 0x411096
jmp 0x411149
mov edi, 0xffffc94c
call fcn.004044f0
mov esi, dword [eax]
mov dword [ebp + 8], eax
add esi, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
push eax
mov eax, dword [ebp + 8]
push str.CheckPostRequest:_HttpSendRequest_Failed__GLE__d_
push eax
call ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
call esi
cmp eax, 2
jne 0x411129
call fcn.004044f0
mov edx, dword [eax]
push str.In_offline_mode__HttpSendRequest_returns_ERROR_FILE_NOT_FOUND__2__if_the_resource_is_not_found_in_the_Internet_cache
push eax
mov eax, dword [edx + 0x28]
call eax
add esp, 8
call esi
cmp eax, 0x2ee7
jne 0x411149
mov edi, eax
call fcn.004044f0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push str.Could_not_resolve_host_name.__Possibly_the_network_is_down__or_bad_DNS__or_the_host_name_is_wrong__etc.
push eax
call edx
add esp, 8
mov ecx, dword [ebp - 4]
push ebx
call fcn.00410c60
mov esi, dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp + 8], 4
nop
lea eax, [ebp + 8]
push eax
push 0x64
lea ecx, [ebp - 0x6c]
push ecx
push ebx
call esi
cmp dword [ebp + 8], 0
jne 0x411160
cmp edi, 0x8000
mov eax, 0xffffc94c
je 0x411182
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x415400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c888
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x14]
mov dword [ebp - 4], edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x10], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41ae40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push edi
mov edi, 1
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
jle 0x41af4a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + edi*4]
call fcn.004044f0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
push esi
push str.parsing_arg__S
push eax
call edx
mov al, byte [esi]
add esp, 0xc
cmp al, 0x2d
je 0x41ae8d
cmp al, 0x2f
jne 0x41af4f
movsx eax, byte [esi + 1]
add eax, 0xffffffc1
cmp eax, 0x37
ja case.0x41aea4.64
movzx eax, byte [eax + 0x41af84]
jmp dword [eax*4 + 0x41af70]
push 0x105
push 0x42f598
push 0xffffffffffffffff
add esi, 2
push esi
push 0
push 0
mov byte [0x42f7a2], 1
call ebx
jmp case.0x41aea4.64
push 0x105
lea ecx, [ebp - 0x210]
push ecx
push 0xffffffffffffffff
add esi, 2
push esi
push 0
push 0
call ebx
lea edx, [ebp - 0x210]
push edx
call sym.Bentley.lictransmit.exe_LicenseClient_SetErrorLogPath
add esp, 4
jmp case.0x41aea4.64
mov cl, byte [esi + 2]
test cl, cl
lea edx, [esi + 2]
mov eax, 5
je 0x41af1e
cmp cl, 0x30
jle 0x41af1e
cmp cl, 0x39
jge 0x41af1e
push 0
push 0
push edx
call dword [sym.imp.MSVCR80.dll_strtol]
add esp, 0xc
test eax, eax
jl case.0x41aea4.64
xor esi, esi
lea edi, [eax + 1]
push 1
push esi
call sym.Bentley.lictransmit.exe_LicenseClient_SetLoggerSeverity
add esp, 8
sub esi, 1
sub edi, 1
jne 0x41af23
mov edi, dword [ebp - 4]
add edi, 1
cmp edi, dword [ebp + 8]
mov dword [ebp - 4], edi
jl 0x41ae63
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
call fcn.004044f0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push esi
push str.Bad_argument_to_transmit__S
push eax
call edx
add esp, 0xc
push 1
call dword [sym.imp.MSVCR80.dll_exit]
lea ecx, [ecx]
scasd eax, dword es:[edi]
inc ecx
add dl, cl
scasb al, byte es:[edi]
inc ecx
add byte [ebx - 0xcffbe52], ch
scasb al, byte es:[edi]
inc ecx
add byte [ecx], bh
scasd eax, dword es:[edi]
inc ecx
add byte [eax], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add byte [esp + eax], al
add al, 1
add al, 4
add al, 2
add al, 4
add al, 4
add al, 3
int3
Function at 0x41afc0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41cf5d
push eax
mov dword fs:[0], esp
sub esp, 0x458
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call fcn.0041ae40
add esp, 8
call fcn.0040d280
push str.Bentley.Lictransmit.Exe
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x41b116
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x41b116
call esi
cmp eax, 5
je 0x41b116
call fcn.004175c0
test al, al
jne 0x41b055
call fcn.004044f0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1c]
push str.MSXML_is_not_installed
call eax
push 1
call dword [sym.imp.MSVCR80.dll_exit]
cmp byte [0x42f7a2], 0
je 0x41b0f8
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x28]
push edx
push 0x42f598
mov byte [ebp - 4], 1
call fcn.00416610
add esp, 0xc
lea ecx, [ebp - 0x464]
mov esi, eax
call fcn.00402e00
mov dword [ebp - method.Bentley::SelectServer::Client::LocalLogHandler.virtual_0], vtable.Bentley::SelectServer::Client::ShadowLogHandler.0
push 0x42f598
lea ecx, [ebp - 0x464]
mov byte [ebp - 4], 2
call fcn.00402e80
lea ecx, [ebp - 0x464]
call fcn.00403420
lea ecx, [ebp - 0x464]
mov byte [ebp - 4], 1
call fcn.004034d0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x41b0ff
call fcn.00416830
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004044f0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x44]
push str.Lictransmit_exiting_because_another_one_is_currently_running
call eax
push 0
call dword [sym.imp.MSVCR80.dll_exit]
int3