joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d0b
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x430c08
call fcn.0042f2d0
sub esp, 0x34
mov ax, word [0x43abdc]
push ebx
add word [0x43abd6], ax
xor ebx, ebx
cmp byte [0x43abc8], bl
push esi
mov esi, ecx
jne 0x416d41
cmp dword [0x43ac08], ebx
mov byte [0x43abce], bl
je 0x416d48
mov byte [0x43abce], 1
cmp byte [esi + 8], bl
jne 0x416eff
mov al, byte [0x43abe4]
mov dword [ebp - 0x10], ebx
mov cl, al
sub cl, byte [0x43abcc]
add byte [0x43abcf], cl
or cl, 0xff
sub cl, al
mov byte [0x43abc8], cl
mov eax, dword [esi + 0x1c]
lea edx, [ebp - 0x10]
push edx
push 0x434714
mov ecx, dword [eax]
push eax
mov dword [ebp - 4], ebx
call dword [ecx]
cmp word [0x43abe2], bx
jne 0x416d9d
cmp dword [0x43abfc], ebx
mov byte [0x43abca], bl
je 0x416da4
mov byte [0x43abca], 1
cmp dword [0x43ac00], ebx
je 0x416dba
cmp word [0x43abda], bx
je 0x416dba
push 1
pop eax
jmp 0x416dbc
xor eax, eax
add word [0x43abe4], ax
cmp dword [ebp - 0x10], ebx
je 0x416eee
movsx eax, byte [0x43abc9]
push eax
push 0x115fffff
call fcn.00411864
add dword [0x43abe8], eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add word [0x43abd4], ax
mov eax, dword [ebp - 0x10]
push dword [esi + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x416ec2
push edi
push dword [0x43abec]
push 0x6c7fffff
call fcn.004117b3
add dword [0x43abf8], eax
mov eax, dword [esi + 0x20]
pop ecx
add eax, 4
pop ecx
lea edi, [esi + 4]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc]
push 0xb1efffff
push dword [0x43abf4]
call fcn.00411775
mov word [0x43abd2], ax
push 0x7457ffff
movsx eax, word [0x43abd6]
push eax
mov byte [0x43abd0], 1
call fcn.004118af
add dword [0x43ac08], eax
add esp, 0x10
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
push edx
lea edx, [ebp - 0x40]
push dword [edi]
mov ecx, dword [eax]
push ebx
push dword [esi + 0x20]
push edx
push 0xfffffffffffffffb
push eax
call dword [ecx + 0x2c]
test eax, eax
pop edi
jne 0x416e96
mov byte [esi + 8], 1
mov esi, dword [esi + 0x1c]
lea ecx, [ebp - 0x14]
push ecx
push 0x4346d4
mov eax, dword [esi]
push esi
call dword [eax]
test eax, eax
jne 0x416ec2
mov eax, dword [ebp - 0x14]
push 0xffffea77
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
movsx eax, word [0x43abd8]
push 0x3c1bffff
push eax
call fcn.004118af
inc word [0x43abe4]
mov byte [0x43abcd], al
mov al, byte [0x43ac04]
pop ecx
dec al
pop ecx
mov byte [0x43abcb], al
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x416eff
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xee59ffff
push 0x439dffff
call fcn.00411706
add word [0x43abdc], ax
pop ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41cc28
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xbf67ffff
push 0x8f03ffff
call fcn.00411738
pop ecx
mov dword [0x43ac00], eax
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add byte [0x43abcf], al
mov eax, dword [0x43ac00]
mov esi, dword [0x434350]
inc eax
mov word [0x43abdc], ax
mov al, byte [esi]
add al, 0x76
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042f2f0
mov ecx, esp
mov edx, esi
call fcn.0042b788
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
push 0x6777ffff
movsx eax, word [0x43abe2]
push eax
call fcn.0041181a
add word [0x43abd8], ax
dec byte [0x43abd0]
pop ecx
test ebx, ebx
pop ecx
je 0x41ce26
push 0xa765ffff
push 0x5f67ffff
call fcn.00411906
mov esi, dword [0x434354]
add byte [0x43abcb], al
pop ecx
mov al, byte [esi]
pop ecx
add al, 0x76
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042f2f0
mov ecx, esp
mov edx, esi
call fcn.0042b788
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push ebx
call edi
push 0xcd8fffff
push 0x358bffff
mov dword [ebp - 4], eax
call fcn.004118af
add byte [0x43abc8], al
cmp dword [ebp - 4], 0
pop ecx
pop ecx
je 0x41ce26
mov al, byte [0x43abcc]
sub al, byte [0x43abc8]
mov byte [0x43abcb], al
movsx eax, word [0x43abd2]
push eax
push dword [0x43ac08]
call fcn.00411775
add byte [0x43abcf], al
movsx eax, word [0x43abd8]
push eax
push 0x218dffff
call fcn.004116b5
mov esi, dword [0x434358]
add dword [0x43ac08], eax
add esp, 0x10
mov al, byte [esi]
add al, 0x76
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042f2f0
mov ecx, esp
mov edx, esi
call fcn.0042b788
push eax
push ebx
call edi
mov esi, eax
mov ax, word [0x43abf8]
sub word [0x43abd6], ax
push 0x2709ffff
movsx eax, word [0x43abde]
push eax
call fcn.004118af
add byte [0x43abcf], al
push 0x6227ffff
push 0x38abffff
call fcn.00411906
add esp, 0x10
mov word [0x43abd2], ax
test esi, esi
je 0x41ce26
push 0x9369ffff
push 0xa7b7ffff
mov dword [0x43abfc], 0x2879ffff
call fcn.00411864
add dword [0x43ac04], eax
movsx eax, byte [0x43abcd]
push eax
push dword [0x43abe8]
call fcn.004118af
add esp, 0x10
mov byte [0x43abc9], al
push dword [ebp + 8]
call dword [ebp - 4]
mov edi, eax
push 0xf0f1ffff
movsx eax, word [0x43abe2]
push eax
call fcn.00411775
or word [0x43abe2], 0xffff
pop ecx
test edi, edi
pop ecx
mov byte [0x43abd0], al
jne 0x41ce2a
xor eax, eax
jmp 0x41ce5e
push 0x7913ffff
push 0x8837ffff
call fcn.004117b3
mov word [0x43abd2], ax
movsx eax, byte [0x43abc8]
push eax
push 0x6c8dffff
call fcn.0041181a
add word [0x43abd8], ax
add esp, 0x10
push edi
call esi
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41f13d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
dec word [0x43abdc]
xor eax, eax
cmp dword [0x43ac04], eax
jne 0x41f15d
cmp word [0x43abda], ax
je 0x41f160
push 1
pop eax
add byte [0x43abcd], al
push esi
lea eax, [ebp - 0x28]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx eax, word [0x43abdc]
push eax
push 0x428bffff
call fcn.0041181a
mov dword [0x43ac04], eax
movsx eax, byte [0x43abcb]
push eax
movsx eax, byte [0x43abca]
push eax
call fcn.00411738
mov esi, dword [ebp + 8]
mov dword [0x43abf0], eax
mov eax, esi
xor edx, edx
div dword [ebp - 0x24]
movsx eax, word [0x43abd2]
push eax
push dword [0x43abf4]
mov edi, edx
call fcn.00411738
add byte [0x43abc8], al
movsx eax, byte [0x43abcd]
push eax
movsx eax, word [0x43abde]
push eax
call fcn.00411906
add word [0x43abe4], ax
movsx eax, word [0x43abe0]
push eax
push dword [0x43abf0]
call fcn.00411738
push dword [0x43ac0c]
mov byte [0x43abd0], al
push 0xf63ffff
call fcn.00411864
add esp, 0x30
mov byte [0x43abd0], al
lea eax, [ebp - 4]
sub esi, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, edi
push 0x40
push eax
push esi
push 0x5f
mov word [0x43abe0], 1
call fcn.00415e1f
pop ecx
call eax
pop edi
pop esi
leave
ret
Function at 0x4201e3
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharLowerA]
push 0x3bffff
mov dword [0x43abf8], eax
push dword [0x43abec]
call fcn.00411906
add word [0x43abd2], ax
pop ecx
pop ecx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movsx cx, byte [0x43abcc]
or al, 0xff
sub al, byte [0x43abd0]
mov byte [0x43abc9], al
movsx ax, byte [0x43abcb]
add eax, ecx
mov word [0x43abd2], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
add byte [0x43abcb], al
lea eax, [ebp - 0x10]
push 8
push eax
lea eax, [ebp - 8]
push eax
call sub.MSVCRT.dll_memcpy
movsx eax, byte [0x43abca]
push 0xcde9ffff
push eax
call fcn.004117ef
mov byte [0x43abc8], al
xor eax, eax
add esp, 0x14
cmp word [0x43abdc], ax
mov edx, dword [ebp - 4]
setne al
mov word [0x43abdc], ax
movsx eax, word [0x43abe0]
and eax, 0xce4bffff
add dword [0x43abfc], eax
mov eax, dword [ebp - 8]
leave
ret
Function at 0x425473
Capabilities:
Hash data with md5

Disassembly:
movsx eax, word [0x43abe0]
push esi
push 0x2cabffff
mov esi, ecx
push eax
call fcn.00411906
mov dword [0x43abec], eax
push 8
lea eax, [esi + 0x10]
push 0
push eax
call sub.MSVCRT.dll_memset
mov dword [esi], 0x67452301
movsx eax, word [0x43abd2]
push eax
push 0x3e5fffff
call fcn.00411906
add word [0x43abe2], ax
add esp, 0x1c
call dword [sym.imp.USER32.dll_GetFocus]
add byte [0x43abca], al
movsx eax, word [0x43abd6]
push eax
push 0xdf0dffff
call fcn.00411775
mov dword [0x43abe8], eax
or ax, 0xffff
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
sub ax, word [0x43abda]
pop ecx
pop ecx
mov word [0x43abda], ax
call dword [sym.imp.KERNEL32.dll_GetVersion]
add byte [0x43abca], al
mov dword [esi + 0xc], 0x10325476
movsx eax, word [0x43abda]
push eax
push 0xf00dffff
call fcn.004116b5
add dword [0x43ac04], eax
mov al, byte [0x43abca]
sub byte [0x43abcd], al
push 0x7939ffff
movsx eax, byte [0x43abcc]
push eax
call fcn.00411864
add dword [0x43abe8], eax
add esp, 0x10
pop esi
ret
Function at 0x425553
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0xfdddffff
mov esi, ecx
push 0xfe73ffff
call fcn.00411906
add byte [0x43abc9], al
movsx eax, byte [0x43abcf]
push eax
push 0xcea3ffff
call fcn.00411906
mov word [0x43abd2], ax
xor eax, eax
add esp, 0x10
cmp word [0x43abda], ax
setne al
mov word [0x43abd4], ax
mov edi, dword [esi + 0x10]
shr edi, 3
and edi, 0x3f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ebx, dword [ebp + 0xc]
movzx eax, ax
mov dword [0x43ac04], eax
mov eax, ebx
shl eax, 3
add dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
mov ecx, ebx
shl ecx, 3
cmp eax, ecx
jae 0x4255ce
inc dword [esi + 0x14]
push dword [0x43ac08]
push 0x5725ffff
call fcn.0041181a
add dword [0x43abf4], eax
push 0x56abffff
shr ebx, 0x1d
add dword [esi + 0x14], ebx
push dword [0x43abf8]
call fcn.0041181a
add dword [0x43ac0c], eax
movsx eax, word [0x43abd8]
push eax
push dword [0x43abe8]
call fcn.00411738
push 0x40
mov byte [0x43abcd], al
pop ebx
mov byte [0x43abc8], 1
push dword [0x43ac00]
sub ebx, edi
push 1
call fcn.0041181a
add word [0x43abe0], ax
movsx eax, byte [0x43abcb]
push eax
push dword [0x43ac04]
call fcn.004118af
mov ecx, dword [ebp + 0xc]
add byte [0x43abca], al
add esp, 0x28
cmp ecx, ebx
jb 0x425763
xor eax, eax
push ebx
cmp word [0x43abd6], ax
push dword [ebp + 8]
setne al
add word [0x43abd2], ax
lea eax, [edi + esi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
push dword [0x43abfc]
inc word [0x43abdc]
push 0x3113ffff
call fcn.00411906
push 0x92fffff
mov dword [0x43abf0], eax
push dword [0x43ac00]
call fcn.004117b3
add word [0x43abd2], ax
add esp, 0x1c
lea eax, [esi + 0x18]
mov ecx, esi
push eax
call fcn.004259cd
mov di, word [0x43abe4]
test di, di
je 0x4256db
cmp dword [0x43ac04], 0
je 0x4256db
push 1
pop eax
jmp 0x4256dd
xor eax, eax
add byte [0x43abc8], al
test di, di
jne 0x4256fa
cmp byte [0x43abc9], 0
jne 0x4256fa
and word [0x43abe4], di
jmp 0x425703
mov word [0x43abe4], 1
lea edi, [ebx + 0x3f]
cmp edi, dword [ebp + 0xc]
jae 0x425722
mov eax, dword [ebp + 8]
mov ecx, esi
lea eax, [eax + edi - 0x3f]
push eax
call fcn.004259cd
add ebx, 0x40
add edi, 0x40
jmp 0x425706
push 0xe5a7ffff
push 0xec07ffff
call fcn.004117ef
pop ecx
mov word [0x43abd4], ax
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x7343ffff
mov dword [0x43ac00], eax
push dword [0x43ac08]
call fcn.004118af
add byte [0x43abcd], al
pop ecx
pop ecx
xor edi, edi
mov ecx, dword [ebp + 0xc]
jmp 0x425765
xor ebx, ebx
mov al, byte [0x43abca]
sub ecx, ebx
movsx edx, byte [0x43abc9]
shl al, 1
mov byte [0x43abca], al
push ecx
movsx eax, al
and eax, edx
mov dword [0x43abf8], eax
mov eax, dword [ebp + 8]
add ebx, eax
lea eax, [edi + esi + 0x18]
push ebx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
inc byte [0x43abc8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x428aaf
Capabilities:
Accept command line arguments

Disassembly:
movsx eax, byte [0x43abcb]
push ebx
push esi
push eax
mov esi, ecx
push 0x816bffff
call fcn.00411738
xor ebx, ebx
pop ecx
mov byte [0x43abcf], al
cmp dword [esi + 0x10], ebx
pop ecx
je 0x428b75
movsx eax, byte [0x43abca]
push eax
push 0x6c67ffff
call fcn.00411775
cmp dword [0x43abf0], ebx
pop ecx
pop ecx
mov dword [0x43ac00], eax
jne 0x428b06
cmp byte [0x43abcb], bl
mov dword [0x43ac08], ebx
je 0x428b10
mov dword [0x43ac08], 1
mov al, byte [0x43abcd]
shl al, 1
dec al
mov byte [0x43abcd], al
push dword [esi + 0x10]
push 0x27
call fcn.00415e1f
pop ecx
call eax
test eax, eax
je 0x428b7a
push dword [0x43abfc]
push 0x5cd5ffff
call fcn.004118af
push 0x7f3dffff
mov word [0x43abdc], ax
push dword [0x43ac00]
call fcn.00411706
mov word [0x43abd6], ax
add esp, 0x10
mov dword [esi + 0x10], ebx
inc word [0x43abdc]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add word [0x43abe0], ax
xor eax, eax
pop esi
pop ebx
ret
mov eax, 0x80004005
jmp 0x428b77
Function at 0x42b5c2
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov al, byte [0x43ac08]
push ebx
push esi
push edi
xor edi, edi
inc al
cmp word [0x43abe4], di
mov byte [0x43abc8], al
jne 0x42b5ee
cmp dword [0x43abec], edi
jne 0x42b5ee
xor eax, eax
jmp 0x42b5f1
push 1
pop eax
mov esi, dword [ebp + 8]
add word [0x43abd2], ax
push 0x8a47ffff
push 0xa08fffff
mov eax, dword [esi + 4]
mov ebx, dword [esi]
mov dword [ebp + 8], eax
or al, 0xff
sub al, byte [0x43abca]
mov byte [0x43abce], al
call fcn.00411906
mov dword [0x43abec], eax
mov byte [0x43abc8], 1
movsx eax, word [0x43abd2]
push eax
push dword [0x43ac08]
call fcn.0041181a
add word [0x43abda], ax
add esp, 0x10
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], edi
jle 0x42b741
inc bl
movzx eax, bl
mov dword [ebp - 8], eax
mov ebx, dword [esi + eax*4 + 8]
lea edi, [esi + eax*4 + 8]
mov al, byte [0x43abf8]
imul byte [0x43ac04]
mov byte [0x43abcc], al
mov dword [ebp - 0xc], ebx
movsx eax, byte [0x43abce]
push eax
push eax
call fcn.004116b5
mov dword [0x43ac00], eax
add bl, byte [ebp + 8]
movsx eax, word [0x43abe4]
imul eax, dword [0x43abe8]
mov dword [0x43abf0], eax
movzx eax, bl
mov ebx, dword [esi + eax*4 + 8]
mov dword [ebp + 8], eax
lea eax, [esi + eax*4 + 8]
mov dword [edi], ebx
mov dword [ebp - 0x10], eax
movsx eax, byte [0x43abc9]
push eax
movsx eax, word [0x43abe0]
push eax
call fcn.004117b3
add byte [0x43abc8], al
push 0x107bffff
movsx eax, byte [0x43abce]
push eax
call fcn.00411906
add byte [0x43abca], al
push 0xf995ffff
movsx eax, byte [0x43abcc]
push eax
call fcn.00411906
add byte [0x43abcf], al
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
add bl, cl
push 0xca21ffff
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, bl
add eax, edi
mov cl, byte [esi + ecx*4 + 8]
xor byte [eax], cl
push dword [0x43abfc]
call fcn.00411706
mov ebx, dword [ebp - 8]
add esp, 0x28
inc edi
mov dword [0x43abf4], eax
cmp edi, dword [ebp + 0x10]
mov dword [ebp - 4], edi
jl 0x42b654
movsx eax, byte [0x43abce]
mov ecx, dword [0x43ac08]
push 0xc6b5ffff
push 0x5235ffff
lea eax, [ecx + eax + 0x23620001]
mov dword [0x43ac08], eax
call fcn.004117ef
pop ecx
mov byte [0x43abc9], al
pop ecx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov byte [0x43abca], al
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42bbc6
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x431a0d
call fcn.0042f2d0
sub esp, 0x1c
mov al, byte [0x43abda]
push ebx
imul byte [0x43abc9]
add byte [0x43abcd], al
push esi
mov esi, dword [0x43441c]
xor ebx, ebx
push edi
mov dword [ebp - 0x18], ebx
mov al, byte [esi]
add al, 0x76
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042f2f0
mov ecx, esp
mov edx, esi
call fcn.0042b788
mov edi, eax
mov al, byte [ebp + 0xf]
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x28], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [0x43abfc]
push 1
mov ecx, eax
pop esi
imul ecx, eax
mov dword [ebp - 4], esi
mov dword [0x43abe8], 0x93660001
mov dword [0x43ac08], ecx
mov dword [ebp - 0x10], 8
push 0x94a1ffff
push dword [0x43ac0c]
call fcn.00411775
push 0xb36dffff
push 0x1c7ffff
mov word [0x43abd8], ax
call fcn.00411906
mov dword [0x43abec], eax
movsx eax, byte [0x43abcb]
push eax
push 0xb3b7ffff
call fcn.00411738
mov dword [0x43abf0], eax
mov eax, dword [ebp + 0xc]
shr eax, 0x1c
add esp, 0x18
lea ecx, [ebp - 0x28]
mov al, byte [eax + edi]
mov byte [ebp - 0x14], al
push dword [ebp - 0x14]
push esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_unsigned_int__char_]
movsx eax, byte [0x43abd1]
mov ecx, eax
push eax
push dword [0x43abe8]
or ecx, 0xc6b3ffff
mov dword [0x43abf0], ecx
call fcn.004116b5
pop ecx
mov word [0x43abe2], ax
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
shl dword [ebp + 0xc], 4
dec dword [ebp - 0x10]
mov byte [0x43abd0], al
jne 0x42bc45
movsx eax, byte [0x43abcc]
push eax
push 0x5a99ffff
call fcn.004116b5
add word [0x43abd6], ax
mov edi, dword [ebp + 8]
mov al, byte [ebp - 0x28]
pop ecx
pop ecx
mov byte [edi], al
push ebx
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, edi
push dword [eax]
lea eax, [ebp - 0x28]
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov dword [ebp - 0x18], esi
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x34]
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42edce
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x431d07
call fcn.0042f2d0
push ecx
push ecx
and dword [ebp - 0x14], 0
push ebx
push esi
movsx eax, word [0x43abe4]
push 1
pop ebx
push 0xafe9ffff
push eax
mov dword [ebp - 4], ebx
call fcn.0041181a
add dword [0x43ac08], eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, dword [ebp + 0x10]
add byte [0x43abc8], al
mov dword [0x43abec], ebx
mov al, byte [esi]
add al, 0x76
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042f2f0
mov ecx, esp
mov edx, esi
call fcn.0042b788
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
call fcn.004101fd
lea eax, [ebp - 0x10]
lea ecx, [ebp + 0xc]
push eax
mov byte [ebp - 4], bl
call fcn.0041012f
mov ecx, eax
call fcn.0040fc43
movsx eax, byte [0x43abce]
push dword [0x43ac08]
mov byte [ebp - 4], 3
push eax
call fcn.00411738
mov dword [0x43ac04], eax
dec byte [0x43abcc]
movsx eax, word [0x43abd8]
push eax
movsx eax, byte [0x43abcf]
push eax
call fcn.004118af
mov esi, dword [ebp + 8]
mov byte [0x43abcf], al
mov eax, dword [ebp - 0x10]
add esp, 0x10
test eax, eax
mov dword [esi], eax
je 0x42eea5
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
test eax, eax
mov byte [ebp - 4], bl
je 0x42eeb5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
and byte [ebp - 4], 0
test eax, eax
je 0x42eec6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x1c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
leave
ret
Function at 0x401380
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
xor eax, eax
lea ecx, [esp]
mov dword [esp], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
push ecx
push 0x4013b0
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp]
add esp, 8
ret
Function at 0x402050
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
sub esp, 0x20c
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
xor ebp, ebp
cmp ebx, ebp
push esi
mov dword [esp + 0xc], ebp
je 0x4021cc
mov esi, dword [esp + 0x228]
cmp esi, ebp
je 0x4021cc
mov eax, dword [0x40dd30]
push edi
cmp eax, 6
jae 0x402152
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call edi
mov eax, dword [esp + 0x220]
mov dword [esp + 0x14], ebp
mov edi, dword [edi + 1]
push eax
push ebp
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x4021bd
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push 4
push edx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push 0x200
push ecx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [esi - 1]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
call fcn.00403460
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebx + esi - 1], 0
mov dword [esp + 0x10], ecx
je 0x40213c
mov eax, dword [esp + 0x224]
test eax, eax
je 0x40213c
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
lea edx, [esi + esi]
push edx
call fcn.004033d0
mov edi, dword [esp + 0x224]
mov ebp, eax
push esi
push ebp
push edi
call fcn.004030c0
add esp, 0x10
mov dword [esp + 0x10], eax
test eax, eax
je 0x4021b4
push 0
push 0
push esi
push ebx
push esi
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [esp + 0x224]
test eax, eax
je 0x4021ad
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.004033c5
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret