joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fa59
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x42fcd4
call fcn.0042e9c0
sub esp, 0x34
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [0x438c50], 0xedebffff
cmp byte [esi + 8], bl
jne 0x40fc17
movsx ax, byte [0x438c1f]
dec eax
mov dword [ebp - 0x10], ebx
mov word [0x438c28], ax
mov eax, dword [esi + 0x28]
lea edx, [ebp - 0x10]
push edx
push 0x433500
mov ecx, dword [eax]
push eax
mov dword [ebp - 4], ebx
call dword [ecx]
movsx eax, word [0x438c30]
push eax
movsx eax, word [0x438c2e]
push eax
call fcn.0040a933
add word [0x438c34], ax
push 0x1a9bffff
push 0x6b59ffff
call fcn.0040a933
add word [0x438c26], ax
add esp, 0x10
cmp dword [ebp - 0x10], ebx
je 0x40fc06
push 0xa7ffff
push 0x4d01ffff
call fcn.0040aa83
push 0xd603ffff
push 0x1c8fffff
mov word [0x438c30], ax
call fcn.0040aac5
mov byte [0x438c1d], al
mov ax, word [0x438c24]
add word [0x438c2c], ax
mov eax, dword [ebp - 0x10]
add esp, 0x10
push dword [esi + 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40fbd7
push edi
push 0xbef9ffff
push dword [0x438c58]
call fcn.0040a933
mov dword [0x438c50], eax
mov eax, dword [esi + 0x30]
pop ecx
add eax, 4
pop ecx
lea edi, [esi + 4]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc]
push dword [0x438c50]
push 0x6ef9ffff
call fcn.0040aac5
inc word [0x438c32]
pop ecx
pop ecx
lea edx, [ebp - 0x24]
push edx
mov dword [0x438c38], eax
mov eax, dword [ebp - 0x10]
mov byte [0x438c21], 1
push dword [edi]
lea edx, [ebp - 0x40]
mov ecx, dword [eax]
push ebx
push dword [esi + 0x30]
push edx
push 0xfffffffffffffffb
push eax
call dword [ecx + 0x2c]
test eax, eax
pop edi
jne 0x40fbab
mov byte [esi + 8], 1
mov esi, dword [esi + 0x28]
lea ecx, [ebp - 0x14]
push ecx
push 0x4334c0
mov eax, dword [esi]
push esi
call dword [eax]
test eax, eax
jne 0x40fbd7
mov eax, dword [ebp - 0x14]
push 0xffffea77
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
movsx eax, word [0x438c22]
push eax
movsx eax, word [0x438c26]
push eax
push 0xe1dbffff
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [0x438c50], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
add dword [0x438c50], eax
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x40fc17
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
movsx ax, byte [0x438c1d]
mov ecx, dword [ebp - 0xc]
add word [0x438c22], 0xfffe
add word [0x438c26], ax
pop esi
mov dword [0x438c54], 0xbe7fffff
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40fce5
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x42fcf8
call fcn.0042e9c0
sub esp, 0x30
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00428811
push eax
push 0xb
call fcn.0040ebd2
pop ecx
call eax
mov ecx, edi
call fcn.00428981
call dword [sym.imp.USER32.dll_GetDesktopWindow]
and word [ebp - 0x3c], 0
mov byte [0x438c1b], al
mov edi, dword [edi]
lea ecx, [ebp - 0x3c]
push edi
call fcn.004105ed
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
mov word [ebp - 0x1c], 3
mov word [ebp - 0x2c], 3
mov dword [ebp - 0x24], 0xe
inc byte [0x438c1c]
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
lea edx, [ebp - 0x1c]
mov byte [0x438c1e], al
push edx
mov eax, dword [esi + 0x28]
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x2c]
push edx
lea edx, [ebp - 0x3c]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [esi + 0x28]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
mov esi, dword [esi + 0x28]
push 0xffffffffffffffff
push esi
mov eax, dword [esi]
call dword [eax + 0xf0]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x2c]
push eax
call esi
lea eax, [ebp - 0x1c]
push eax
call esi
lea eax, [ebp - 0x3c]
push eax
call esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x410312
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, ecx
test ebx, ebx
mov dword [0x438c5c], 1
je 0x41045b
movsx ax, byte [0x438c1c]
imul eax, dword [0x438c40]
add word [0x438c24], ax
push esi
push 0x37fbffff
push 0xa43ffff
call fcn.0040aa18
add dword [0x438c38], eax
push 0xe74dffff
movsx eax, byte [0x438c1f]
push eax
call fcn.0040a8f9
push 0xc
mov word [0x438c24], ax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4103ba
mov eax, dword [ebp + 8]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
cmp byte [0x438c1f], 0
jne 0x4103a3
cmp byte [0x438c1d], 0
jne 0x4103a3
xor eax, eax
jmp 0x4103a6
push 1
pop eax
add byte [0x438c1f], al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add byte [0x438c20], al
jmp 0x4103bc
xor esi, esi
mov al, byte [0x438c2a]
dec al
add byte [0x438c21], al
mov al, 0xfe
sub al, byte [0x438c1e]
mov byte [0x438c1f], al
mov ax, word [0x438c28]
and ax, word [0x438c32]
add word [0x438c32], ax
lea eax, [ebp + 0xc]
push eax
xor eax, eax
push eax
push esi
push 0x41023e
push eax
push eax
push 0x3a
call fcn.0040ebd2
pop ecx
call eax
push eax
push 0x33
call fcn.0040ebd2
pop ecx
call eax
xor eax, eax
pop esi
cmp word [0x438c28], ax
jne 0x410422
cmp dword [0x438c50], eax
je 0x410425
push 1
pop eax
add dword [0x438c58], eax
movsx ax, byte [0x438c19]
neg eax
mov word [0x438c34], ax
movsx eax, byte [0x438c21]
push eax
push 0x2acfffff
call fcn.0040a9de
add word [0x438c22], ax
pop ecx
pop ecx
jmp 0x4104f2
movsx eax, byte [0x438c1c]
push eax
push 0x5ed7ffff
call fcn.0040a8f9
mov dword [0x438c3c], eax
movsx eax, word [0x438c28]
push eax
push 0xeff5ffff
call fcn.0040ab0e
add esp, 0x10
mov dword [0x438c38], eax
movsx eax, word [0x438c24]
push 0x4831ffff
push dword [0x438c5c]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push dword [ebp + 8]
add word [0x438c22], ax
mov ecx, edi
call fcn.004101ff
movsx eax, byte [0x438c1c]
push eax
movsx eax, word [0x438c2a]
push eax
call fcn.0040aa83
mov byte [0x438c1f], al
xor eax, eax
cmp byte [0x438c1e], al
pop ecx
pop ecx
setne al
mov dword [0x438c48], eax
mov eax, dword [0x438c4c]
and eax, 0x90d9ffff
add dword [0x438c5c], eax
push 0x5537ffff
push dword [0x438c58]
call fcn.0040aa4f
push 0x81c9ffff
mov dword [0x438c58], eax
push dword [0x438c4c]
call fcn.0040a9a5
add esp, 0x10
mov dword [0x438c4c], eax
pop edi
pop ebx
pop ebp
ret 8
Function at 0x410ce2
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor ecx, ecx
cmp word [0x438c32], cx
jne 0x410d04
cmp word [0x438c30], cx
jne 0x410d04
and byte [0x438c1e], cl
jmp 0x410d0b
mov byte [0x438c1e], 1
movsx eax, byte [0x438c1a]
sub eax, 0x632fffff
mov dword [0x438c48], eax
mov eax, dword [ebp + 8]
cmp eax, ecx
je 0x410e3e
xor edx, edx
cmp word [0x438c2e], cx
push ebx
push esi
setne dl
push edi
mov ecx, edx
add word [0x438c2e], cx
lea esi, [eax + 0x3c]
lea edi, [ebp - 0x10]
lea ebx, [eax + 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ebx
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp eax, dword [ebp - 0x18]
je 0x410e09
call dword [sym.imp.USER32.dll_GetInputState]
add byte [0x438c1f], al
push 0xb95fffff
push dword [0x438c44]
call fcn.0040a96f
mov byte [0x438c18], al
pop ecx
movsx eax, word [0x438c22]
imul eax, eax, 0x37e7ffff
mov dword [0x438c50], eax
mov eax, dword [ebp - 8]
pop ecx
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push dword [0x438c40]
add word [0x438c28], ax
push 0xbe01ffff
call fcn.0040ab0e
add byte [0x438c1e], 0xfe
push esi
mov word [0x438c30], ax
call fcn.00410ce2
xor eax, eax
push 0x1481ffff
cmp byte [0x438c19], al
push 0x267dffff
setne al
add word [0x438c24], ax
call fcn.0040a9a5
add word [0x438c2a], ax
add esp, 0x14
dec byte [0x438c1d]
lea ecx, [ebp - 0x10]
call fcn.00409ac0
jmp 0x410d4c
movsx eax, word [0x438c22]
push 0x16fdffff
push eax
call fcn.0040a9a5
add dword [0x438c44], eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
add byte [0x438c1d], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
pop edi
pop esi
mov word [0x438c2a], ax
pop ebx
movsx eax, word [0x438c30]
push eax
movsx eax, byte [0x438c21]
push eax
call fcn.0040a96f
push 0x93c7ffff
push 0x3871ffff
mov word [0x438c26], ax
call fcn.0040aa83
mov byte [0x438c20], al
movsx eax, word [0x438c26]
push eax
push 0xb189ffff
call fcn.0040ab0e
add esp, 0x18
mov dword [0x438c3c], eax
leave
ret
Function at 0x4151c1
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x430052
call fcn.0042e9c0
sub esp, 0x20
push ebx
push esi
push dword [0x438c4c]
push 0xcfbbffff
call fcn.0040ab0e
add word [0x438c22], ax
lea eax, [ebp - 0x2c]
push 5
push eax
call fcn.00404a4b
xor ebx, ebx
push 0x38
mov dword [ebp - 4], ebx
call fcn.0040ebd2
push 0x43
call fcn.0040ebd2
add esp, 0x18
push 1
pop esi
push ebx
push 0x55
mov dword [0x438c5c], esi
call fcn.0040ebd2
pop ecx
call eax
mov eax, dword [ebp - 0x28]
cmp eax, ebx
jne 0x415228
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
push ebx
push ebx
push 0x38
call fcn.0040ebd2
pop ecx
call eax
push 0x43
mov dword [0x4390e0], eax
call fcn.0040ebd2
pop ecx
call eax
cmp eax, 0xb7
jne 0x4152a7
movsx eax, byte [0x438c1f]
push eax
movsx eax, byte [0x438c1c]
push eax
call fcn.0040a933
pop ecx
add byte [0x438c20], al
pop ecx
mov byte [0x438c1a], bl
push dword [0x4390e0]
push 0x33
call fcn.0040ebd2
pop ecx
call eax
cmp byte [0x438c1e], bl
jne 0x415292
cmp byte [0x438c1a], bl
jne 0x415292
xor eax, eax
jmp 0x415294
mov eax, esi
add dword [0x438c44], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x438c3c], eax
jmp 0x4152ff
lea eax, [ebp - 0x1c]
push 6
push eax
call fcn.00404a4b
pop ecx
pop ecx
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 1
cmp eax, ebx
jne 0x4152c4
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
push ebx
push ebx
push 0x38
call fcn.0040ebd2
pop ecx
call eax
mov dword [0x4390cc], eax
push 0xca6fffff
movsx eax, word [0x438c2a]
push eax
call fcn.0040aa83
pop ecx
mov word [0x438c32], ax
pop ecx
mov byte [ebp - 4], bl
push esi
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov bl, 1
or dword [ebp - 4], 0xffffffff
push esi
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41636a
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 4
push 0x3b
mov dword [ebp - 8], eax
call fcn.0040ebd2
pop ecx
call eax
mov edi, eax
cmp edi, 0xffffffff
je 0x416417
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x41640c
push esi
cmp dword [ebp - 0x24], 0x10
jb 0x4163f6
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jne 0x4163f6
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
je 0x4163f6
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x4163f6
cmp byte [ebp + 8], 0
push esi
je 0x4163e5
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4163eb
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
push 0x33
call fcn.0040ebd2
pop ecx
call eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x4163ae
pop esi
push edi
push 0x33
call fcn.0040ebd2
pop ecx
call eax
pop edi
leave
ret

Function at 0x41643f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea ecx, [ebp - 4]
xor eax, eax
push ecx
push eax
push eax
push 0x41641a
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
push 0x33
call fcn.0040ebd2
pop ecx
call eax
leave
ret
Function at 0x416db7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [0x433070]
push edi
mov al, byte [esi]
sub al, 3
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042e9e0
xor ebx, ebx
mov eax, esp
lea ecx, [ebp - 4]
push ebx
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push esi
push eax
call fcn.0042bd2b
pop ecx
mov edi, 0x80000001
pop ecx
push eax
push edi
push 0x10
pop esi
push esi
call fcn.0040ebd2
pop ecx
call eax
test eax, eax
jne 0x416ebf
mov dword [ebp - 8], esi
mov esi, dword [0x433074]
mov al, byte [esi]
sub al, 3
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042e9e0
lea ecx, [ebp - 8]
mov eax, esp
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push esi
push eax
call fcn.0042bd2b
pop ecx
pop ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x416e6a
cmp dword [ebp - 0xc], 1
jne 0x416e6a
cmp byte [ebp - 0x20], 0x79
jne 0x416e6a
cmp byte [ebp - 0x1e], 0x73
jne 0x416e6a
cmp byte [ebp - 0x1f], 0x65
jne 0x416e6a
cmp byte [ebp - 0x1d], bl
je 0x416eb2
mov esi, dword [0x433074]
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1d], bl
mov al, byte [esi]
sub al, 3
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042e9e0
mov eax, esp
lea ecx, [ebp - 0x20]
push 4
push ecx
push 1
push ebx
push esi
push eax
call fcn.0042bd2b
pop ecx
pop ecx
push eax
push dword [ebp - 4]
push 0x13
call fcn.0040ebd2
pop ecx
call eax
push dword [ebp - 4]
push 0xf
call fcn.0040ebd2
pop ecx
call eax
mov esi, dword [0x433078]
mov al, byte [esi]
sub al, 3
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042e9e0
mov eax, esp
lea ecx, [ebp - 4]
push ebx
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push esi
push eax
call fcn.0042bd2b
pop ecx
pop ecx
push eax
push edi
push 0x10
call fcn.0040ebd2
pop ecx
call eax
test eax, eax
jne 0x416f9b
mov esi, dword [0x43307c]
push 4
pop edi
mov dword [ebp - 0xc], edi
mov al, byte [esi]
sub al, 3
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042e9e0
lea ecx, [ebp - 0xc]
mov eax, esp
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push esi
push eax
call fcn.0042bd2b
pop ecx
pop ecx
push eax
push dword [ebp - 4]
push 0x12
call fcn.0040ebd2
pop ecx
call eax
test eax, eax
jne 0x416f54
cmp dword [ebp - 0x10], edi
jne 0x416f54
cmp dword [ebp - 8], ebx
je 0x416f8e
mov esi, dword [0x43307c]
mov dword [ebp - 8], ebx
mov al, byte [esi]
sub al, 3
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042e9e0
mov eax, esp
lea ecx, [ebp - 8]
push edi
push ecx
push edi
push ebx
push esi
push eax
call fcn.0042bd2b
pop ecx
pop ecx
push eax
push dword [ebp - 4]
push 0x13
call fcn.0040ebd2
pop ecx
call eax
push dword [ebp - 4]
push 0xf
call fcn.0040ebd2
pop ecx
call eax
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d3ba
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movsx ecx, word [0x438c2e]
add ecx, dword [0x438c4c]
mov esi, dword [0x43311c]
mov byte [0x438c19], al
push 3
movsx eax, word [0x438c22]
add ecx, eax
pop ebx
mov dword [0x438c4c], ecx
mov al, byte [esi]
sub al, bl
movzx eax, al
add eax, ebx
and al, 0xfc
call fcn.0042e9e0
mov eax, esp
push esi
push eax
call fcn.0042bd2b
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [0x438c5c]
mov dword [ebp - 4], eax
push dword [0x438c38]
call fcn.0040aac5
cmp dword [ebp - 4], 0
pop ecx
pop ecx
mov word [0x438c24], ax
je 0x41d59a
add dword [0x438c58], 0x3f8fffff
push 0xec89ffff
push 0x2cbfffff
call fcn.0040a96f
mov esi, dword [0x433120]
add word [0x438c22], ax
and byte [0x438c1b], 0
pop ecx
mov al, byte [esi]
pop ecx
sub al, bl
movzx eax, al
add eax, ebx
and al, 0xfc
call fcn.0042e9e0
mov eax, esp
push esi
push eax
call fcn.0042bd2b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ecx
pop ecx
push eax
push dword [ebp - 4]
call edi
push 0xa991ffff
push 0xca3bffff
mov dword [ebp - 8], eax
call fcn.0040ab0e
mov word [0x438c2a], ax
mov al, byte [0x438c2e]
push 0xb527ffff
inc al
push dword [0x438c4c]
mov byte [0x438c21], al
call fcn.0040a8f9
add esp, 0x10
cmp dword [ebp - 8], 0
mov byte [0x438c20], al
je 0x41d59a
push 0x33fffff
push dword [0x438c50]
call fcn.0040a96f
push 0x592bffff
mov word [0x438c30], ax
push dword [0x438c44]
call fcn.0040a9a5
mov esi, dword [0x433124]
mov dword [0x438c44], eax
add esp, 0x10
mov al, byte [esi]
sub al, bl
movzx eax, al
add eax, ebx
and al, 0xfc
call fcn.0042e9e0
mov eax, esp
push esi
push eax
call fcn.0042bd2b
pop ecx
pop ecx
push eax
push dword [ebp - 4]
call edi
mov esi, eax
push 0x3d57ffff
movsx eax, byte [0x438c20]
push eax
call fcn.0040a933
add byte [0x438c1e], al
push dword [0x438c3c]
movsx eax, byte [0x438c1c]
push eax
call fcn.0040a9a5
add byte [0x438c1b], al
add esp, 0x10
test esi, esi
je 0x41d59a
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push dword [ebp + 8]
mov word [0x438c2c], ax
call dword [ebp - 8]
inc word [0x438c22]
push 0x67d3ffff
push 0x8f1dffff
mov edi, eax
call fcn.0040ab0e
pop ecx
mov dword [0x438c4c], eax
test edi, edi
pop ecx
jne 0x41d59e
xor eax, eax
jmp 0x41d5c1
push dword [0x438c38]
or byte [0x438c19], 0xff
push 0xb4dffff
call fcn.0040a9de
add word [0x438c2e], ax
pop ecx
pop ecx
push edi
call esi
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41f868
Capabilities:
Get system information on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov al, byte [0x438c54]
push ebx
push esi
push edi
push dword [0x438c40]
inc al
mov word [0x438c24], 1
mov byte [0x438c1d], al
push 0x1547ffff
call fcn.0040a96f
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
inc word [0x438c30]
pop ecx
mov dword [0x438c44], eax
pop ecx
call esi
add byte [0x438c1c], al
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx ax, byte [0x438c1e]
mov edi, dword [ebp + 8]
mov word [0x438c24], ax
mov eax, edi
xor edx, edx
div dword [ebp - 0x24]
push dword [0x438c50]
push 0x3ca5ffff
mov ebx, edx
call fcn.0040aa83
add word [0x438c2e], ax
push 0x66dffff
push 0x34e5ffff
call fcn.0040a9a5
push dword [0x438c48]
add word [0x438c32], ax
push 0x8377ffff
call fcn.0040a96f
add word [0x438c28], ax
mov eax, dword [0x438c58]
or eax, dword [0x438c5c]
push 0x5bd1ffff
push 0x4737ffff
add dword [0x438c50], eax
call fcn.0040a933
add byte [0x438c1f], al
or byte [0x438c1e], 0xff
add esp, 0x20
call esi
add word [0x438c30], ax
push 0x3243ffff
push dword [0x438c58]
call fcn.0040a9a5
add dword [0x438c3c], eax
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
add eax, ebx
push 0x40
sub edi, ebx
push eax
push edi
push 0x5b
call fcn.0040ebd2
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421e38
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push 0x1c59ffff
push 0xaea7ffff
mov dword [ebp - 0xc], ebx
call fcn.0040aac5
mov dword [0x438c58], eax
movsx eax, byte [0x438c20]
push eax
movsx eax, word [0x438c32]
push eax
call fcn.0040a8f9
mov esi, dword [0x4331a0]
add word [0x438c2a], ax
add esp, 0x10
mov al, byte [esi]
sub al, 3
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042e9e0
mov eax, esp
lea ecx, [ebp - 8]
push ebx
push ecx
push ebx
push 0x20019
push ebx
push ebx
push ebx
push esi
push eax
call fcn.0042bd2b
pop ecx
pop ecx
push eax
push 0x80000001
push 0x10
call fcn.0040ebd2
pop ecx
call eax
test eax, eax
jne 0x422028
movsx eax, byte [0x438c1a]
push eax
movsx eax, byte [0x438c18]
push eax
call fcn.0040aa18
mov dword [0x438c5c], eax
mov ax, word [0x438c48]
add word [0x438c22], ax
movsx eax, byte [0x438c20]
push eax
push dword [0x438c40]
call fcn.0040aac5
add word [0x438c32], ax
push 0x56d3ffff
movsx eax, byte [0x438c1b]
push eax
mov dword [ebp - 4], 4
call fcn.0040a9de
mov byte [0x438c1b], al
mov al, byte [0x438c44]
add al, byte [0x438c1e]
push 0xff81ffff
mov byte [0x438c20], al
movsx eax, byte [0x438c1d]
push eax
call fcn.0040a8f9
mov esi, dword [0x4331a4]
add dword [0x438c40], eax
add esp, 0x20
mov al, byte [esi]
sub al, 3
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042e9e0
lea ecx, [ebp - 4]
mov eax, esp
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push esi
push eax
call fcn.0042bd2b
pop ecx
pop ecx
push eax
push dword [ebp - 8]
push 0x12
call fcn.0040ebd2
pop ecx
call eax
test eax, eax
jne 0x421ff8
cmp dword [ebp - 0x10], 4
jne 0x421ff8
cmp dword [ebp - 4], 4
jne 0x421ff8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add byte [0x438c21], al
call dword [sym.imp.USER32.dll_GetInputState]
mov byte [0x438c19], al
push 0x66cbffff
movsx eax, byte [0x438c21]
push eax
call fcn.0040a9a5
add byte [0x438c1c], al
mov eax, dword [ebp - 0x14]
push 0xfc75ffff
push 0x9eafffff
mov dword [ebp - 0xc], eax
call fcn.0040aa18
push dword [0x438c3c]
mov dword [0x438c58], eax
push 0xb1dfffff
call fcn.0040aac5
add esp, 0x18
mov byte [0x438c21], al
movsx eax, byte [0x438c20]
push dword [ebp - 8]
or byte [0x438c19], 0xff
or eax, 0x4217ffff
add dword [0x438c38], eax
push 0xf
call fcn.0040ebd2
pop ecx
call eax
mov dword [0x438c50], 1
movsx eax, word [0x438c24]
push 0x3337ffff
push eax
call fcn.0040a9a5
push 0xb191ffff
push 0x5711ffff
mov word [0x438c26], ax
call fcn.0040a933
add dword [0x438c4c], eax
add esp, 0x10
xor eax, eax
cmp byte [0x438c21], bl
lea esp, [ebp - 0x1c]
setne al
add dword [0x438c3c], eax
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret