joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410758
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x563
push ebx
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edx
movzx eax, byte [ecx]
inc ecx
test al, al
je 0x410780
add esi, eax
cmp esi, 0xae8
jbe 0x41076e
mov ecx, ebx
mov esi, 0x12f1
movzx eax, word [ecx]
add ecx, 2
test ax, ax
je 0x41079c
add esi, eax
cmp esi, 0x1c72
jbe 0x410787
mov eax, dword [0x429488]
mov esi, ebx
add eax, 0xb6a6a64
mov di, word [esi]
lea ecx, [edi - 0x30]
cmp cx, 9
ja 0x4107b9
add esi, 2
jmp 0x4107a8
mov edi, eax
mov esi, ebx
xor edi, 0xb11ab201
mov dword [ebp - 0x1c], edi
mov dword [0x429674], edi
mov edi, 0x1b
movzx ecx, word [esi]
add esi, 2
test cx, cx
je 0x4107e6
add edi, ecx
cmp edi, 0x16cc
jbe 0x4107d1
movzx edi, byte [edx]
lea ecx, [edi - 0x30]
cmp cl, 9
ja 0x4107f4
inc edx
jmp 0x4107e6
mov ecx, ebx
mov di, word [ecx]
lea edx, [edi - 0x30]
cmp dx, 9
ja 0x410807
add ecx, 2
jmp 0x4107f6
xor eax, 0xc0ae1f0e
mov edx, ebx
mov ecx, 0x1e0b
mov dword [0x429858], eax
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x41082d
add ecx, eax
cmp ecx, 0xca4
jbe 0x410818
mov eax, dword [ebp - 0x1c]
and eax, 0x3a09df01
mov dword [0x429488], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, 0xb34
and dword [0x429858], 0x620657e0
movzx eax, word [ebx]
add ebx, 2
test ax, ax
je 0x410873
add edx, eax
cmp edx, 0x15d8
jbe 0x41084f
imul eax, dword [0x429674], 0x77de2114
mov dword [0x429858], eax
mov eax, dword [0x429858]
mov edx, eax
imul eax, eax, 0xf9cf5f95
and edx, 0x37b8824a
mov dword [0x429674], edx
mov edx, eax
sub eax, 0x7c66b2d2
or edx, 0x7d6b01b7
mov dword [0x429488], eax
mov dword [0x429858], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x410a7c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str.WWWWWWWWWWWW
mov ecx, 0xb5e
mov ebp, esp
push ebx
sub esp, 0x14
movzx eax, byte [edx]
inc edx
test al, al
je 0x410ab7
add ecx, eax
cmp ecx, 0xfc8
jbe 0x410a8d
xor dword [0x429590], 0xe7bdc7a5
mov dword [esp], str.The_specified_group_type_is_invalid.
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
mov eax, dword [0x429590]
mov ebx, 0xcd6
xor eax, 0xde3bc502
sub eax, 0x5caeccd6
and eax, 0xba244b31
sub eax, 0x644261f7
mov dword [0x429590], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp], 0xd8e
or eax, 0x2f725185
mov dword [0x429590], eax
call dword [sym.imp.USER32.dll_OpenIcon]
push eax
mov eax, dword [0x429590]
add eax, 0x21c04fca
or eax, 0x7c65ebc4
mov dword [0x429590], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
sub dword [0x429590], 0x1d25dbf
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, str.WWWWWWWWWWWW
or eax, 0xafcf8f41
xor eax, 0x932e5b34
and eax, 0xfd8d2378
imul eax, eax, 0x4ed6b928
mov dword [0x429590], eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x410b5d
add ebx, edx
cmp ebx, 0x198d
jbe 0x410b41
xor eax, 0x9593128
mov dword [0x429590], eax
mov eax, dword [0x429590]
mov ebx, dword [ebp - 4]
and eax, 0x6f93b7c9
sub eax, 0x6ffcfd8c
and eax, 0xe453d6e5
add eax, 0x46ace7d6
imul eax, eax, 0xfc6638d1
xor eax, 0x98c4843c
and eax, 0xc4018b1a
imul eax, eax, 0xadbb5945
add eax, 0x58309b1b
xor eax, 0x93ed20ae
sub eax, 0x292d3c4f
xor eax, 0x28186f26
add eax, 0x57b0611b
xor eax, 0xfeb7c893
mov dword [0x429590], eax
leave
ret
Function at 0x410bb4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str.PICTURESLIBRARY
mov ebp, esp
sub esp, 8
mov al, byte [edx]
test al, al
je 0x410bdb
sub eax, 0x30
cmp al, 9
jbe 0x410bd8
and dword [str.JkK], 0xea03d8e9
jmp 0x410bdb
inc edx
jmp 0x410bbf
mov eax, dword [str.JkK]
mov ecx, str._tIME_Year
sub eax, 0x31fd5987
mov dword [str.JkK], eax
mov dl, byte [ecx]
test dl, dl
je 0x410c0d
sub edx, 0x30
cmp dl, 9
jbe 0x410c0a
imul eax, eax, 0x28f45862
mov dword [str.JkK], eax
jmp 0x410c0d
inc ecx
jmp 0x410bef
imul eax, dword [str.JkK], 0xc8271d88
and eax, 0xd98ae896
imul eax, eax, 0x4980e314
sub eax, 0x42b883f6
xor eax, 0x4b0de535
and eax, 0xb0b12438
cmp byte [str._tIME_Year], 0
lea edx, [eax + 0x4b663997]
mov dword [str.JkK], edx
je 0x410c50
sub eax, 0x73ea9ddd
mov dword [str.JkK], eax
mov eax, dword [str.JkK]
or eax, 0x758c297e
xor eax, 0x59c580bf
lea edx, [eax + 0x2a46da21]
mov dword [str.JkK], edx
xor edx, edx
cmp byte [edx + str.PICTURESLIBRARY], 0
je 0x410c89
inc edx
cmp edx, 0xb22
jne 0x410c6d
add eax, 0x1b31abf7
mov dword [str.JkK], eax
mov eax, dword [str.JkK]
mov ecx, str.PICTURESLIBRARY
xor eax, 0xdf52efe4
add eax, 0x79ab1e9d
and eax, 0x9450000
xor eax, 0x8a00064
mov dword [str.JkK], eax
mov dl, byte [ecx]
test dl, dl
je 0x410cc9
sub edx, 0x30
cmp dl, 9
jbe 0x410cc6
add eax, 0xa2ad43d
mov dword [str.JkK], eax
jmp 0x410cc9
inc ecx
jmp 0x410cac
mov eax, dword [str.JkK]
and eax, 0x24d6a60
xor eax, 0xd4e0cc
sub eax, 0x193fb43a
and eax, 0xc46a826b
xor eax, 0xace3a02d
add eax, 0x25ad0431
xor eax, 0xf539de27
mov dword [str.JkK], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
sub dword [str.JkK], 0x3f778d21
call dword [sym.imp.USER32.dll_GetShellWindow]
or eax, 0x2c97f2b
imul eax, eax, 0x95ed026d
xor eax, 0x780885bf
mov dword [str.JkK], eax
leave
ret
Function at 0x410d24
Capabilities:
Accept command line arguments

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x14
cmp byte [eax + str.The_TPM_attestation_challenge_is_not_set.], 0
je 0x410d4d
inc eax
cmp eax, 0xbee
jne 0x410d2d
mov eax, dword [0x42973c]
sub eax, 0x2a061f55
mov dword [0x429770], eax
imul eax, dword [0x429594], 0x5107041d
mov dword [esp], str.loadReason
mov ebx, 0x46e
mov dword [0x429708], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov eax, dword [0x42973c]
mov ecx, str._cHRM_GreenY
sub eax, 0x4ce87e8
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x410da4
add ebx, edx
cmp ebx, 0x1195
jbe 0x410d84
mov edx, eax
xor edx, 0xcfc9c16d
mov dword [0x42973c], edx
and eax, 0x94d644fb
or eax, 0x90824449
mov dword [0x429594], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [0x429770]
or eax, 0x939ab347
mov dword [0x42973c], eax
mov eax, dword [0x429708]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
mov eax, dword [0x429594]
add eax, 0x4c6f1036
mov dword [0x429708], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [0x42973c]
mov ecx, str.220211182559Z0
mov edx, eax
or edx, 0x7feffdda
mov dword [0x429770], edx
mov edx, eax
or eax, 0x73ce5c52
or edx, 0xf3ef7ed7
add eax, 0x66830ac7
mov dword [0x42973c], edx
mov dword [0x429594], eax
mov dl, byte [ecx]
test dl, dl
je 0x410e3e
sub edx, 0x30
cmp dl, 9
jbe 0x410e3b
and eax, 0x52ebbc5
mov dword [0x429594], eax
jmp 0x410e3e
inc ecx
jmp 0x410e21
mov eax, dword [0x429594]
mov ebx, dword [ebp - 4]
mov edx, eax
or edx, 0x7cbec6ec
mov dword [0x429708], edx
leave
ret

Function at 0x410e58
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ecx, str.Microsoft_Time_Stamp_Service0
mov ebp, esp
push ebx
mov ebx, 0x1ea
sub esp, 0x14
mov eax, dword [0x42970c]
lea edx, [eax + 0x53cfff74]
mov dword [0x429464], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x410e9b
add ebx, edx
cmp ebx, 0xc8d
jbe 0x410e7a
imul edx, eax, 0xcf42b39d
mov dword [0x429464], edx
mov edx, dword [0x429464]
or eax, 0x2c26cb6e
mov dword [0x429628], eax
or edx, 0x12744e6e
imul edx, edx, 0x98529232
mov dword [0x4293ec], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x38010591
mov dword [0x4293ec], eax
mov eax, dword [0x42970c]
and eax, 0x5f19dc01
imul eax, eax, 0xe9567d26
mov dword [0x42970c], eax
mov eax, dword [0x429628]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
push eax
mov eax, dword [0x42970c]
imul edx, eax, 0xc39b4b59
imul eax, eax, 0x22972caf
add eax, 0x3a29a41
mov dword [0x429464], eax
xor eax, eax
cmp byte [eax + str.SdbUnpackQueryResult], 0
je 0x410f29
inc eax
cmp eax, 0x7fd
jne 0x410f0e
or dword [0x429628], 0xa8a5a30e
lea eax, [edx - 0x14cbb1b9]
mov dword [0x42970c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [0x429628]
mov ebx, dword [ebp - 4]
mov edx, eax
and eax, 0x9e6758e0
and edx, 0x99be6fa2
mov dword [0x429628], eax
mov eax, dword [0x4293ec]
mov dword [0x42970c], edx
leave
ret
Function at 0x410f64
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str.The_operation_is_only_supported_on_simple_plexes.
mov ecx, 0xfff
mov ebp, esp
push ebx
sub esp, 0x14
movzx eax, byte [edx]
inc edx
test al, al
je 0x410f87
add ecx, eax
cmp ecx, 0x62f
jbe 0x410f75
mov eax, dword [0x429824]
mov ebx, 0x149b
mov edx, eax
and eax, 0xa33bcf84
and edx, 0x5a06b13f
mov dword [0x429824], eax
mov dword [0x4297e0], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
or dword [0x4297e0], 0xb1f4adfd
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [0x429824]
mov dword [esp], str.DynamicDaylightTimeDisabled
add eax, 0x5f2eed89
mov dword [0x4297e0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov eax, dword [0x429824]
mov ecx, str.RtlStringCchPrintfW_failed___x_
push edx
lea edx, [eax + 0x72b5743a]
mov dword [0x4297e0], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x411020
add ebx, edx
cmp ebx, 0x1c67
jbe 0x410ffc
and eax, 0x432b5b52
sub eax, 0x6efc672d
mov dword [0x4297e0], eax
mov edx, str.Entries_enumerated_have_exceeded_the_allowed_threshold.
mov al, byte [edx]
test al, al
je 0x411056
sub eax, 0x30
cmp al, 9
jbe 0x411053
mov eax, dword [0x4297e0]
add eax, 0x3cbc73ff
mov dword [0x429824], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
and eax, 0xff03cf08
mov dword [0x4297e0], eax
jmp 0x411056
inc edx
jmp 0x411025
mov eax, dword [0x4297e0]
mov ebx, dword [ebp - 4]
sub eax, 0x6387e02a
mov dword [0x4297e0], eax
and eax, 0x15891862
mov dword [0x429824], eax
leave
ret

Function at 0x41173c
Capabilities:
Identify system language via api

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x18
cmp byte [eax + str.Specified_video_present_path_is_already_in_VidPNs_topology.], 0
je 0x411764
inc eax
cmp eax, 0xd35
jne 0x411744
mov eax, dword [0x42966c]
and eax, 0x8ca19619
mov dword [0x4293d8], eax
mov eax, dword [0x4293d8]
mov dword [esp], str.Debugger_got_control_C.
sub eax, 0x6003e25d
mov dword [0x42966c], eax
xor eax, 0x45ca8a39
mov dword [0x429504], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x8d3
imul eax, eax, 0x7f4090b8
push edx
mov edx, str.Specified_video_present_path_is_already_in_VidPNs_topology.
mov dword [0x42940c], eax
movsx eax, byte [edx]
inc edx
test al, al
je 0x4117b2
add ecx, eax
cmp ecx, 0x2352
jbe 0x4117a0
mov eax, dword [0x4293d8]
mov edx, eax
mov dword [esp], eax
or edx, 0x3826439f
mov dword [0x42966c], edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
mov eax, dword [0x42940c]
mov edx, eax
xor edx, 0xdfc72355
mov dword [0x42966c], edx
lea edx, [eax + 0x489afc4c]
sub eax, 0x7f95e4fc
mov dword [0x429504], edx
mov dword [0x4293d8], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x429504]
add eax, 0x5fb01ea5
mov dword [0x42940c], eax
leave
ret
Function at 0x411870
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov eax, dword [0x4295b0]
mov edx, eax
mov ebp, esp
xor edx, 0x35a309e
push esi
push ebx
mov ebx, dword [ebp + 8]
mov dword [0x4296f8], edx
xor edx, edx
cmp byte [ebx + edx], 0
je 0x4118aa
inc edx
cmp edx, 0x152c
jne 0x41188d
mov edx, eax
and edx, 0x6cd321f4
mov dword [0x4296f8], edx
mov ecx, dword [0x4296a0]
and eax, 0x591bb48c
mov esi, ebx
imul edx, eax, 0xaaf8a7dd
mov eax, ecx
xor eax, 0xc6a2356b
mov dword [0x4295a8], eax
mov al, byte [esi]
test al, al
je 0x4118e7
sub eax, 0x30
cmp al, 9
jbe 0x4118e4
xor ecx, 0x5c7eda86
mov dword [0x4295a8], ecx
jmp 0x4118e7
inc esi
jmp 0x4118c9
mov eax, dword [0x4296f8]
mov ecx, edx
or ecx, 0xae3cc1c8
xor eax, 0x56bfd209
mov dword [0x4296a0], ecx
mov ecx, ebx
add eax, 0x20d934b8
mov dword [0x4296f8], eax
mov al, byte [ecx]
test al, al
je 0x411929
sub eax, 0x30
cmp al, 9
jbe 0x411926
add edx, 0x3d68a9b8
mov dword [0x4295a8], edx
jmp 0x411929
inc ecx
jmp 0x41190b
mov edx, dword [0x4295a8]
mov ecx, ebx
mov al, byte [ecx]
sub eax, 0x30
cmp al, 9
ja 0x41193d
inc ecx
jmp 0x411931
lea eax, [edx - 0xb5f423f]
mov ecx, ebx
mov dword [0x4295b0], eax
mov al, byte [ecx]
test al, al
je 0x41197c
sub eax, 0x30
cmp al, 9
jbe 0x411979
add edx, 0x607a0956
mov dword [0x429308], edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
imul eax, eax, 0x22b78927
mov dword [0x4295b0], eax
jmp 0x41197c
inc ecx
jmp 0x41194a
mov eax, dword [0x4296f8]
mov ecx, ebx
and eax, 0xf7fe559b
mov dword [0x429308], eax
mov dl, byte [ecx]
test dl, dl
je 0x4119aa
sub edx, 0x30
cmp dl, 9
jbe 0x4119a7
or eax, 0xe17196d4
mov dword [0x429308], eax
jmp 0x4119aa
inc ecx
jmp 0x41198d
mov edx, dword [0x4295a8]
lea eax, [edx + 0x3299fe98]
mov dword [0x4296a0], eax
xor eax, eax
cmp byte [ebx + eax], 0
je 0x4119d7
inc eax
cmp eax, 0x9f3
jne 0x4119bd
sub edx, 0x7f6c6a01
mov dword [0x429308], edx
mov eax, dword [0x429308]
pop ebx
pop esi
pop ebp
xor eax, 0xc9a254e2
mov dword [0x4296f8], eax
sub eax, 0x5c1889a7
mov dword [0x4295a8], eax
ret

Function at 0x411dd4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str.Crash_dump_exists_in_paging_file.
mov ecx, 0x9b1
mov ebp, esp
sub esp, 8
movzx eax, byte [edx]
inc edx
test al, al
je 0x411df6
add ecx, eax
cmp ecx, 0xf6a
jbe 0x411de4
imul eax, dword [ebp + 8], 0x6382ff77
mov dword [0x4294c0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, str.Crash_dump_exists_in_paging_file.
mov al, byte [edx]
test al, al
je 0x411e29
sub eax, 0x30
cmp al, 9
jbe 0x411e26
sub dword [0x4294c0], 0xadb1a83
jmp 0x411e29
inc edx
jmp 0x411e0d
leave
ret
Function at 0x411e2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, esi
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x411e45
inc edx
jmp 0x411e39
mov edx, esi
mov ecx, 0xa06
movzx eax, byte [edx]
inc edx
test al, al
je 0x411e5e
add ecx, eax
cmp ecx, 0xec9
jbe 0x411e4c
mov eax, ebx
xor eax, 0x8cdff3bb
mov dword [0x4293bc], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, esi
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x411e7e
inc edx
jmp 0x411e72
mov edx, esi
mov ecx, 0x8bd
movzx eax, byte [edx]
inc edx
test al, al
je 0x411e97
add ecx, eax
cmp ecx, 0x2241
jbe 0x411e85
lea eax, [ebx - 0x6631011e]
cmp byte [esi], 0
mov dword [0x4293bc], eax
je 0x411ead
call dword [sym.imp.USER32.dll_GetShellWindow]
add ebx, 0x7961fc5
mov dword [0x4293bc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
pop ebx
mov eax, dword [0x4293bc]
pop esi
pop ebp
ret
Function at 0x411ec8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov edx, str.A_remote_procedure_call_is_already_in_progress_for_this_thread.
mov ecx, 0x130d
mov ebp, esp
sub esp, 0x18
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x411eed
add ecx, eax
cmp ecx, 0x1949
jbe 0x411ed8
mov eax, dword [0x42975c]
mov edx, eax
or edx, 0x125d5174
cmp byte [str.The_extended_attribute__EA__list_is_inconsistent.], 0
mov dword [0x42987c], edx
je 0x411f1d
mov edx, eax
and edx, 0x421fa3fa
xor edx, 0xd1fb2910
mov dword [0x42987c], edx
mov ecx, dword [0x42987c]
mov dword [esp], str.LdrResFindResource_failed___x_
lea edx, [ecx - 0x56267901]
mov ecx, eax
add eax, 0x1a43d7da
mov dword [0x42987c], edx
imul edx, edx, 0x9551d1c4
and ecx, 0x4008a3e0
and eax, 0x50ca3bb2
mov dword [0x4297c0], ecx
mov dword [0x42975c], eax
mov dword [0x4297d4], edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add dword [0x4297c0], 0x184e2772
push eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov eax, dword [0x4297d4]
xor eax, 0x3e098ba7
cmp byte [str.LdrResFindResource_failed___x_], 0
mov dword [0x42975c], eax
je 0x411fa3
mov eax, dword [0x4297c0]
xor eax, 0x9e8a8189
mov dword [0x4297d4], eax
call dword [sym.imp.USER32.dll_GetShellWindow]
imul eax, dword [0x4297d4], 0x772a38bd
mov dword [0x4297d4], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
mov eax, dword [0x42975c]
mov edx, str.Specified_visible_region_size_is_invalid.
mov ecx, 0x8dd
and eax, 0xb99b2d47
mov dword [0x4297d4], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x411ff2
add ecx, eax
cmp ecx, 0x111e
jbe 0x411fd1
mov eax, dword [0x4297c0]
or eax, 0x18181099
mov dword [0x4297d4], eax
mov eax, dword [0x4297d4]
mov edx, dword [0x42987c]
or eax, 0x8f131654
mov dword [0x42975c], eax
xor eax, eax
cmp word [eax + str.The_specified_number_of_extents_is_invalid.], 0
je 0x412029
add eax, 2
cmp eax, 0x2ee8
jne 0x412009
add edx, 0x2d7da290
mov dword [0x42975c], edx
mov eax, dword [0x4297c0]
mov edx, eax
and edx, 0xe03c9273
mov dword [0x4297d4], edx
mov edx, dword [0x42975c]
and edx, 0x8edbe9d8
mov dword [0x42987c], edx
mov edx, eax
or edx, 0x936c321c
mov dword [0x42975c], edx
xor edx, edx
cmp byte [edx + str.LdrResFindResource_failed___x_], 0
je 0x41207a
inc edx
cmp edx, 0x1644
jne 0x41205e
or eax, 0x93fd36df
mov dword [0x4297c0], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x42987c]
mov ecx, str.The_extended_attribute__EA__list_is_inconsistent.
xor eax, 0x1f1f07fc
mov dword [0x4297d4], eax
mov dl, byte [ecx]
test dl, dl
je 0x4120b1
sub edx, 0x30
cmp dl, 9
jbe 0x4120ae
or eax, 0x9e61735a
mov dword [0x4297d4], eax
jmp 0x4120b1
inc ecx
jmp 0x412094
mov eax, dword [0x4297d4]
lea edx, [eax - 0x5579375e]
sub eax, 0x66c411f4
or eax, 0x7cbbf69c
mov dword [0x42987c], edx
mov dword [0x4297d4], eax
mov eax, dword [0x4297c0]
and eax, 0x5d865183
mov dword [0x42975c], eax
leave
ret
Function at 0x412a74
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x436
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edx, edi
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x412aa2
add ecx, eax
cmp ecx, 0x305
jbe 0x412a8d
mov edx, ebx
mov ecx, 0x1314
movsx eax, byte [edx]
inc edx
test al, al
je 0x412abb
add ecx, eax
cmp ecx, 0x37d
jbe 0x412aa9
mov eax, dword [ebp + 0x14]
xor eax, 0x150a6290
mov dword [0x4297f4], eax
mov eax, esi
xor eax, 0xae93d67
mov dword [0x4293a4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, ebx
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x412ae8
inc edx
jmp 0x412adc
mov eax, dword [ebp + 0x14]
mov edx, edi
mov ecx, 0x890
add eax, 0x2a2b7dbd
mov dword [0x4293a4], eax
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x412b26
add ecx, eax
cmp ecx, 0x25ae
jbe 0x412afc
lea eax, [esi + 0x6c238852]
mov dword [0x4297f4], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push edx
mov eax, dword [ebp + 0x14]
mov edx, ebx
or eax, 0x40371453
mov dword [0x4293a4], eax
mov al, byte [edx]
test al, al
je 0x412b58
sub eax, 0x30
cmp al, 9
jbe 0x412b55
imul eax, esi, 0x6cea56ba
mov dword [0x4297f4], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
jmp 0x412b58
inc edx
jmp 0x412b35
mov edx, ebx
mov ecx, 0x7bf
movsx eax, byte [edx]
inc edx
test al, al
je 0x412b71
add ecx, eax
cmp ecx, 0x37d
jbe 0x412b5f
mov edx, 0x1abe
movzx eax, word [edi]
add edi, 2
test ax, ax
je 0x412b8b
add edx, eax
cmp edx, 0xb94
jbe 0x412b76
mov al, byte [ebx]
sub eax, 0x30
cmp al, 9
ja 0x412b97
inc ebx
jmp 0x412b8b
mov eax, dword [ebp + 0x14]
imul esi, esi, 0xc3543601
or eax, 0xd15ac0af
mov dword [0x4297f4], esi
mov dword [0x4293a4], eax
mov dword [esp], str.No_receive_buffer_has_been_supplied_in_a_synchronous_request.
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [0x4293a4]
xor dword [0x4297f4], 0x198d9fa9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x412dfc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [0x429818]
mov ebx, dword [sym.imp.USER32.dll_GetLastActivePopup]
mov edx, eax
add eax, 0x3321c4cd
and edx, 0xb5d1c91f
mov dword [0x429818], eax
mov dword [0x4295f4], edx
mov dword [esp], eax
call ebx
push eax
xor eax, eax
cmp word [eax + str.A_close_operation_is_pending_on_the_Terminal_Connection.], 0
je 0x412e51
add eax, 2
cmp eax, 0x4620
jne 0x412e2e
mov eax, dword [0x4295c8]
or eax, 0x5bf6fea8
mov dword [0x429818], eax
sub dword [0x4295c8], 0x71c0c94a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [0x4295f4]
and eax, 0x6e639908
mov dword [0x429818], eax
add eax, 0x71f105d6
mov dword [0x4295f4], eax
mov eax, dword [0x4295c8]
mov dword [esp], eax
call ebx
add eax, 0x394b71a7
push edx
mov edx, eax
imul eax, eax, 0x346f29a1
xor edx, 0xb6abac39
mov dword [0x429818], edx
mov dword [0x4295f4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
sub eax, 0x1750c6e3
or eax, 0x56b0619e
mov dword [0x429818], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov eax, dword [0x429818]
push ecx
sub eax, 0x628906ae
mov edx, eax
or edx, 0x345ce921
mov dword [0x4295c8], edx
xor edx, edx
cmp word [edx + str.The_cluster_node_is_already_a_member_of_the_cluster.], 0
je 0x412efe
add edx, 2
cmp edx, 0x4c22
jne 0x412edf
xor eax, 0x23fb75eb
mov dword [0x4295c8], eax
mov eax, dword [0x4295c8]
mov ebx, dword [ebp - 4]
mov edx, eax
or edx, 0x49ddcc66
mov dword [0x4295f4], edx
mov edx, eax
and edx, 0x5000c0a0
or edx, 0x4000c020
mov dword [0x429818], edx
leave
ret
Function at 0x413064
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0xb8e
push ecx
mov eax, dword [0x429324]
mov ecx, str.Register_NaT_consumption_faults.
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x41308a
add ebx, edx
cmp ebx, 0xc60
jbe 0x413078
xor eax, 0xed281d91
xor edx, edx
sub eax, 0x7bf3c934
mov dword [0x429348], eax
xor eax, 0xc389b3f4
mov dword [0x429324], eax
cmp word [edx + str.Exception_status_code_used_by_Win32_x86_emulation_subsystem.], 0
je 0x4130d5
add edx, 2
cmp edx, 0x1396
jne 0x4130a5
imul eax, eax, 0x430b2e1
mov dword [0x429348], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub eax, 0x6c4f85be
mov dword [0x429348], eax
xor dword [0x429348], 0x38555eac
call dword [sym.imp.USER32.dll_GetShellWindow]
sub eax, 0x400bc3c3
imul edx, eax, 0x2960047b
imul eax, eax, 0x3b989abe
mov dword [0x429324], edx
xor edx, edx
add eax, 0x5f4fdb7e
mov dword [0x429348], eax
cmp word [edx + str.Exception_status_code_used_by_Win32_x86_emulation_subsystem.], 0
je 0x41312d
add edx, 2
cmp edx, 0xda0
jne 0x413108
and eax, 0x7520149
mov dword [0x429324], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x429324]
or eax, 0xd7221b1
imul eax, eax, 0x252c8997
add eax, 0x6c8e9123
mov dword [0x429324], eax
imul eax, eax, 0xe71a2185
mov dword [0x429348], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x429348]
mov ecx, str.The_cluster_node_is_already_up.
add eax, 0x4e250f28
imul eax, eax, 0xf4ed0a34
mov edx, eax
xor edx, 0xe326578b
imul edx, edx, 0x62d20b58
mov dword [0x429348], edx
mov dl, byte [ecx]
test dl, dl
je 0x41319e
sub edx, 0x30
cmp dl, 9
jbe 0x41319b
xor eax, 0x6fc74c72
mov dword [0x429348], eax
jmp 0x41319e
inc ecx
jmp 0x413181
mov eax, dword [0x429348]
and eax, 0x86987ecd
mov dword [0x429324], eax
pop edx
pop ebx
pop ebp
ret

Function at 0x4131b4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov edx, str.The_interface_was_not_found.
mov ecx, 0x720
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
movzx eax, byte [edx]
inc edx
test al, al
je 0x4131da
add ecx, eax
cmp ecx, 0x1a10
jbe 0x4131c8
mov edx, str.STATUS_DEVICE_POWER_FAILURE
mov ecx, 0x182f
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x4131f9
add ecx, eax
cmp ecx, 0x21e9
jbe 0x4131e4
imul eax, ebx, 0xe8976c31
mov dword [str.li_t9Q], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebx - 0x32d52b46]
sub ebx, 0x2e1f069c
mov dword [str.li_t9Q], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [str.li_t9Q], ebx
mov dword [esp], 0x4df
call dword [sym.imp.USER32.dll_IsWindow]
mov ebx, dword [ebp - 4]
push eax
mov eax, dword [str.li_t9Q]
leave
ret