Function at 0x41d1dc
Capabilities:
Accept command line arguments
Identify system language via api
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435428
push 0x430760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
movsx eax, word [0x43ac88]
push eax
push 0x1445ffff
call fcn.0040af32
mov word [0x43ac82], ax
push 0x3d25ffff
movsx eax, byte [0x43ac7e]
push eax
call fcn.0040b0f0
mov dword [0x43acb4], eax
push dword [0x43aca0]
push 0xfa2bffff
call fcn.0040b037
add esp, 0x18
add word [0x43ac88], ax
mov edi, dword [ebp + 8]
test edi, edi
je 0x41d4a9
push dword [0x43acb0]
movsx eax, word [0x43ac82]
push eax
call fcn.0040b0f0
pop ecx
pop ecx
mov dword [0x43acac], eax
mov ebx, dword [sym.imp.USER32.dll_GetForegroundWindow]
call ebx
mov word [0x43ac8a], ax
push dword [0x43ac9c]
movsx eax, word [0x43ac8c]
push eax
call fcn.0040af32
pop ecx
pop ecx
mov ecx, eax
mov dword [0x43aca0], ecx
and dword [ebp - 0x20], 0
mov al, byte [0x43ac8c]
imul cl
add byte [0x43ac7b], al
movsx eax, word [0x43ac82]
imul eax, eax, 0x9153ffff
mov dword [0x43acb4], eax
movsx ax, byte [0x43ac80]
neg eax
mov word [0x43ac8e], ax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
jne 0x41d4a9
mov al, byte [0x43ac7d]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaA]
mov byte [0x43ac79], al
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x41d4a9
movsx eax, byte [0x43ac7b]
imul eax, eax, 0xf25fffff
mov dword [0x43acb0], eax
push 0x2ad7ffff
push dword [0x43aca8]
call fcn.0040b087
add dword [0x43aca8], eax
push 0xbe5fffff
push 0x3edfffff
call fcn.0040b087
mov dword [0x43aca8], eax
push 0x4c
call fcn.0040f588
add esp, 0x14
call eax
and eax, 0xc0000000
cmp eax, 0x80000000
jne 0x41d36b
push edi
call fcn.0041e692
pop ecx
mov edi, eax
mov dword [ebp - 0x1c], edi
movsx eax, byte [0x43ac7b]
push eax
push 0xe63dffff
call fcn.0040afcb
add byte [0x43ac7c], al
movsx eax, byte [0x43ac78]
push eax
push 0x9787ffff
call fcn.0040b002
add esp, 0x10
mov dword [0x43aca0], eax
push 0x40
push edi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
call esi
test eax, eax
jne 0x41d4a9
push 0xdd1bffff
push 0x583ffff
call fcn.0040b002
add word [0x43ac94], ax
push dword [0x43acac]
push 0x9ffffff
call fcn.0040b037
add esp, 0x10
mov word [0x43ac8c], ax
call ebx
mov byte [0x43ac79], al
cmp word [edi], 0x5a4d
jne 0x41d4a9
push 0x8b97ffff
movsx eax, byte [0x43ac7a]
push eax
call fcn.0040b002
add word [0x43ac8c], ax
push 0x7583ffff
push 0xefe9ffff
call fcn.0040af94
add dword [0x43ac9c], eax
mov al, byte [0x43acbc]
or al, byte [0x43ac7d]
mov byte [0x43ac7c], al
push dword [edi + 0x3c]
push edi
call fcn.0041d190
mov ebx, eax
mov dword [ebp - 0x24], ebx
push dword [0x43aca8]
push 0x9199ffff
call fcn.0040b0f0
add byte [0x43ac7c], al
push 0x9989ffff
movsx eax, byte [0x43ac7b]
push eax
call fcn.0040b002
add esp, 0x28
mov dword [0x43acb0], eax
push 0xf8
push ebx
call esi
test eax, eax
jne 0x41d4a9
movsx eax, byte [0x43ac7e]
push eax
push 0x6c1ffff
call fcn.0040af32
pop ecx
pop ecx
add dword [0x43aca4], eax
mov al, byte [0x43ac92]
sub byte [0x43ac7b], al
cmp dword [ebx], 0x4550
je 0x41d4b0
xor eax, eax
jmp 0x41df2e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [0x43ac9c], eax
push dword [0x43aca8]
push 0x7c9ffff
call fcn.0040b087
mov word [0x43ac8e], ax
push dword [ebx + 0x80]
push edi
call fcn.0041d190
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add dword [0x43acbc], eax
cmp esi, edi
je 0x41d91d
call dword [sym.imp.USER32.dll_GetActiveWindow]
add word [0x43ac8a], ax
cmp esi, ebx
je 0x41d91d
push 0x21e1ffff
push 0xea19ffff
call fcn.0040af32
mov byte [0x43ac7b], al
push 0x5c15ffff
push 0xa203ffff
call fcn.0040afcb
mov word [0x43ac90], ax
push 0x129bffff
push dword [0x43acac]
call fcn.0040aeeb
add esp, 0x18
add dword [0x43aca4], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [0x43acb0]
push 0xb10dffff
call fcn.0040b002
pop ecx
pop ecx
mov word [0x43ac8e], ax
cmp dword [esi + 0xc], ebx
je 0x41d67b
mov dword [ebp - 4], 1
push 0xdc9ffff
movsx eax, ax
push eax
call fcn.0040afcb
mov byte [0x43ac7d], al
push dword [0x43aca4]
push 0xe3b1ffff
call fcn.0040aeeb
mov word [0x43ac92], ax
push dword [esi + 0xc]
push edi
call fcn.0041d190
mov dword [ebp - 0x38], eax
push 0x13b3ffff
movsx eax, word [0x43ac88]
push eax
call fcn.0040b0ac
add esp, 0x20
add byte [0x43ac7a], al
lea eax, [ebp - 0x34]
push eax
push 4
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5e
call fcn.0040f588
pop ecx
call eax
mov dword [ebp - 0x3c], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov word [0x43ac86], ax
mov ax, word [0x43ac8a]
dec ax
add word [0x43ac86], ax
push dword [ebp + 0xc]
push dword [ebp - 0x38]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x41d71f
movsx eax, byte [0x43ac7e]
and eax, dword [0x43acbc]
mov dword [0x43acb4], eax
movsx eax, word [0x43ac90]
or eax, dword [0x43aca0]
add dword [0x43aca8], eax
mov word [0x43ac8a], 1
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5e
call fcn.0040f588
pop ecx
call eax
push 0x5171ffff
push dword [0x43acb8]
call fcn.0040b0f0
pop ecx
pop ecx
add word [0x43ac94], ax
mov dword [ebp - 4], ebx
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
cmp dword [esi + 0xc], 0
je 0x41d91d
push dword [esi + 0x10]
push edi
call fcn.0041d190
mov esi, eax
cmp byte [0x43ac7d], 0
setne al
mov byte [0x43ac7e], al
movsx eax, byte [0x43ac7a]
push eax
push dword [0x43acac]
call fcn.0040afcb
add esp, 0x10
xor eax, eax
cmp word [0x43ac86], ax
setne al
mov word [0x43ac82], ax
cmp dword [esi], 0
je 0x41d91d
push 0x3de5ffff
push 0xcb0dffff
call fcn.0040b0f0
pop ecx
pop ecx
add dword [0x43acac], eax
mov word [0x43ac84], bx
sub dword [0x43ac98], 0x40480001
mov eax, dword [esi]
cmp eax, dword [ebp - 0x28]
je 0x41d7ac
add esi, 4
xor eax, eax
cmp dword [0x43aca0], eax
setne al
add byte [0x43ac78], al
jmp 0x41d6cd
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5e
call fcn.0040f588
pop ecx
call eax
mov dword [ebp - 4], ebx
jmp 0x41d769
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add byte [0x43ac7d], al
mov ax, word [0x43aca0]
or ax, word [0x43ac94]
add word [0x43ac8e], ax
push 0xc151ffff
push dword [0x43ac9c]
call fcn.0040b037
pop ecx
pop ecx
mov word [0x43ac8e], ax
add esi, 0x14
mov dword [ebp - 0x2c], esi
jmp 0x41d570
push ebx
call dword [sym.imp.USER32.dll_IsCharAlphaA]
mov word [0x43ac8a], ax
xor eax, eax
cmp byte [0x43ac7c], al
setne al
mov word [0x43ac92], ax
lea eax, [ebp - 0x40]
push eax
push 4
push 4
push esi
push 0x5e
call fcn.0040f588
pop ecx
call eax
mov edi, eax
movsx eax, byte [0x43ac7d]
or eax, 0xe0afffff
mov dword [0x43acb0], eax
movsx eax, word [0x43ac92]
mov ecx, dword [0x43aca8]
lea eax, [ecx + eax - 0x21d40001]
mov dword [0x43aca8], eax
push 0x6a2bffff
movsx eax, word [0x43ac82]
push eax
call fcn.0040b0ac
pop ecx
pop ecx
mov byte [0x43ac7b], al
test edi, edi
je 0x41d89c
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
push 0x8a5bffff
movsx eax, byte [0x43ac7a]
push eax
call fcn.0040af32
pop ecx
pop ecx
mov word [0x43ac92], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x43acb8], eax
movsx eax, word [0x43ac88]
push eax
movsx eax, byte [0x43ac79]
push eax
call fcn.0040b002
pop ecx
pop ecx
mov word [0x43ac86], ax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
push 4
push esi
push 0x5e
call fcn.0040f588
pop ecx
call eax
dec word [0x43ac8a]
sub bx, word [0x43ac88]
mov word [0x43ac94], bx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
push 0xda8bffff
movsx eax, byte [0x43ac81]
push eax
call fcn.0040b0ac
mov byte [0x43ac7e], al
push 0x9a8dffff
movsx eax, word [0x43ac88]
push eax
call fcn.0040aeeb
add esp, 0x10
add dword [0x43ac98], eax
jmp 0x41d91d
push 0x6d8bffff
push 0xbf07ffff
call fcn.0040b0ac
add word [0x43ac82], ax
movsx eax, word [0x43ac88]
push eax
push 0x66d5ffff
call fcn.0040b087
add byte [0x43ac81], al
push 0x8975ffff
movsx eax, byte [0x43ac79]
push eax
call fcn.0040b0ac
mov byte [0x43ac81], al
push 0x6b9dffff
movsx eax, byte [0x43ac7c]
push eax
call fcn.0040b087
add byte [0x43ac79], al
movsx eax, word [0x43ac8c]
push eax
push 0x8ce3ffff
call fcn.0040afcb
mov word [0x43ac92], ax
mov esi, dword [ebp - 0x24]
push dword [esi + 0xe0]
push dword [ebp - 0x1c]
call fcn.0041d190
add esp, 0x30
mov edi, eax
mov dword [ebp - 0x48], edi
xor eax, eax
cmp word [0x43ac82], ax
jne 0x41d9bf
cmp word [0x43ac94], ax
je 0x41d9c2
push 1
pop eax
add byte [0x43ac7a], al
movsx eax, word [0x43ac94]
push eax
movsx eax, word [0x43ac88]
push eax
call fcn.0040b0ac
add byte [0x43ac7c], al
movsx eax, word [0x43ac90]
push eax
push 0x662dffff
call fcn.0040b037
add esp, 0x10
add byte [0x43ac7a], al
cmp edi, dword [ebp - 0x1c]
je 0x41df14
push 0xb22fffff
push 0x5355ffff
call fcn.0040b002
pop ecx
pop ecx
mov byte [0x43ac7d], al
cmp edi, esi
je 0x41df14
push 0x3cc9ffff
push 0x284fffff
call fcn.0040af32
pop ecx
pop ecx
mov dword [0x43acb0], eax
push 2
pop esi
mov dword [ebp - 4], esi
xor ebx, ebx
cmp dword [edi + 4], ebx
je 0x41db81
movsx eax, byte [0x43ac7d]
push eax
push 0x4ee3ffff
call fcn.0040afcb
mov byte [0x43ac81], al
push 0xcecfffff
movsx eax, byte [0x43ac7b]
push eax
call fcn.0040b002
add esp, 0x10
mov dword [0x43ac9c], eax
inc word [0x43ac82]
mov dword [ebp - 4], 3
push dword [edi + 4]
push dword [ebp - 0x1c]
call fcn.0041d190
mov dword [ebp - 0x58], eax
movsx eax, byte [0x43ac80]
push eax
push 0x4ebffff
call fcn.0040aeeb
add byte [0x43ac79], al
mov al, byte [0x43aca4]
inc al
add byte [0x43ac79], al
push 0xb30bffff
push 0x1e5dffff
call fcn.0040b002
add esp, 0x18
mov byte [0x43ac7b], al
lea eax, [ebp - 0x54]
push eax
push 4
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5e
call fcn.0040f588
pop ecx
call eax
mov dword [ebp - 0x5c], eax
push dword [ebp + 0xc]
push dword [ebp - 0x58]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x41dc6a
push dword [0x43ac98]
movsx eax, byte [0x43ac7a]
push eax
call fcn.0040af6d
pop ecx
pop ecx
add word [0x43ac94], ax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5e
call fcn.0040f588
pop ecx
call eax
movsx eax, byte [0x43ac7b]
push eax
push 0xc599ffff
call fcn.0040afcb
mov dword [0x43aca4], eax
movsx eax, word [0x43ac84]
push eax
push 0x84e9ffff
call fcn.0040b037
mov word [0x43ac86], ax
push 0xed47ffff
push 0x885ffff
call fcn.0040af32
add esp, 0x18
add byte [0x43ac80], al
mov dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
push 0x5adffff
push dword [0x43acb8]
call fcn.0040b087
pop ecx
pop ecx
mov byte [0x43ac81], al
call dword [sym.imp.USER32.dll_GetInputState]
add byte [0x43ac7a], al
cmp dword [edi + 4], ebx
je 0x41df14
push 0x2db3ffff
movsx eax, word [0x43ac84]
push eax
call fcn.0040b037
mov dword [0x43aca8], eax
push dword [edi + 0x10]
push dword [ebp - 0x1c]
call fcn.0041d190
add esp, 0x10
mov esi, eax
and dword [ebp - 0x4c], 0
cmp dword [esi], 0
je 0x41debb
inc byte [0x43ac79]
movsx eax, word [0x43ac90]
push eax
movsx eax, word [0x43ac82]
push eax
call fcn.0040aeeb
add dword [0x43ac98], eax
push 0x16bffff
push 0x6f4bffff
call fcn.0040b0f0
add esp, 0x10
mov byte [0x43ac7b], al
test byte [esi + 3], 0x80
je 0x41dd1e
mov eax, dword [0x43acb8]
dec eax
add word [0x43ac8a], ax
push 0x5625ffff
push 0x3b69ffff
call fcn.0040b0ac
add word [0x43ac8e], ax
push 0x428dffff
movsx eax, byte [0x43ac7f]
push eax
call fcn.0040b0ac
add esp, 0x10
add byte [0x43ac7a], al
jmp 0x41dd96
cmp word [0x43ac8e], bx
je 0x41dc81
cmp byte [0x43ac7a], 0
je 0x41dc81
push 1
pop eax
jmp 0x41dc83
xor eax, eax
mov word [0x43ac94], ax
movsx eax, byte [0x43ac79]
push eax
push 0xbc03ffff
call fcn.0040af32
pop ecx
pop ecx
add word [0x43ac90], ax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5e
call fcn.0040f588
pop ecx
call eax
mov dword [ebp - 4], esi
jmp 0x41dd13
add edi, 0x20
mov dword [ebp - 0x48], edi
jmp 0x41da41
add al, byte [0x43ac80]
mov byte [0x43ac7b], al
mov al, byte [0x43ac94]
dec al
add byte [0x43ac7c], al
mov eax, dword [esi]
mov cx, word [0x43acb4]
add word [0x43ac82], cx
add eax, 2
push eax
push dword [ebp - 0x1c]
call fcn.0041d190
mov ebx, eax
movsx eax, byte [0x43ac80]
push eax
push dword [0x43acbc]
call fcn.0040af6d
add dword [0x43acac], eax
push 0xd86bffff
movsx eax, byte [0x43ac7c]
push eax
call fcn.0040b0ac
mov word [0x43ac8a], ax
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x20
test eax, eax
je 0x41ddc6
and word [0x43ac88], 0
movsx eax, word [0x43ac94]
push eax
movsx eax, byte [0x43ac7a]
push eax
call fcn.0040af6d
pop ecx
pop ecx
add byte [0x43ac79], al
add esi, 4
inc dword [ebp - 0x4c]
jmp 0x41dbdc
inc word [0x43ac92]
xor ebx, ebx
cmp word [0x43ac94], bx
je 0x41dde6
cmp word [0x43ac82], bx
je 0x41dde6
push 1
pop eax
jmp 0x41dde8
xor eax, eax
add byte [0x43ac7d], al
push dword [edi + 0xc]
push dword [ebp - 0x1c]
call fcn.0041d190
mov esi, eax
push dword [0x43aca0]
push 0x735bffff
call fcn.0040aeeb
add esp, 0x10
mov word [0x43ac8c], ax
mov eax, dword [ebp - 0x4c]
lea esi, [esi + eax*4]
lea eax, [ebp - 0x68]
push eax
push 4
push 4
push esi
push 0x5e
call fcn.0040f588
pop ecx
call eax
mov cl, byte [0x43aca8]
add byte [0x43ac7a], cl
cmp eax, ebx
je 0x41debb
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
mov dword [0x43aca4], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call edi
mov byte [0x43ac7e], al
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x68]
push 4
push esi
push 0x5e
call fcn.0040f588
pop ecx
call eax
movsx eax, word [0x43ac8a]
push eax
push 0x1fb3ffff
call fcn.0040b087
pop ecx
pop ecx
add dword [0x43ac9c], eax
call edi
add byte [0x43ac7e], al
push 0x2e01ffff
movsx eax, byte [0x43ac7b]
push eax
call fcn.0040af32
pop ecx
pop ecx
add dword [0x43acac], eax
cmp dword [ebp - 0x20], ebx
jne 0x41deb4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
or byte [0x43ac7e], 0xff
mov dword [0x43acbc], 0x1bffff
push 0x6327ffff
push dword [0x43aca0]
call fcn.0040b0ac
pop ecx
pop ecx
add dword [0x43acb4], eax
jmp 0x41df14
push 0x5ccfffff
push 0x12e3ffff
call fcn.0040af94
pop ecx
pop ecx
mov word [0x43ac84], ax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10