joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e3e5d4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5e57d28]
and eax, 0x676b09c3
or eax, 0x21000981
mov dword [0x5e57d28], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esp], 0xe6e
call dword [sym.imp.KERNEL32.dll_SetLastError]
add dword [0x5e57d28], 0x567f006b
push eax
mov dword [esp], 0x5e59120
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
push eax
mov eax, dword [0x5e57d28]
sub eax, 0x46a4f39f
imul eax, eax, 0xcce0b8fd
mov dword [0x5e57d28], eax
cmp byte [edx + str.The_specified_storage_reserve_is_not_empty.], 0
je 0x5e3e64d
inc edx
cmp edx, 0x131b
jne 0x5e3e631
or eax, 0x23a5a769
mov dword [0x5e57d28], eax
mov eax, dword [0x5e57d28]
and eax, 0xc32d209d
or eax, 0x42210009
add eax, 0x3859cd1
xor eax, 0x35a841a1
imul eax, eax, 0xff119c4c
sub eax, 0x28d8d0f0
or eax, 0x4ef533e8
imul eax, eax, 0xf0ed9d99
mov dword [0x5e57d28], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov eax, dword [0x5e57d28]
push edx
xor eax, 0x4c73a615
mov dword [0x5e57d28], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor eax, eax
imul edx, dword [0x5e57d28], 0xeb2c24f5
push ecx
mov dword [0x5e57d28], edx
cmp byte [eax + str.The_specified_storage_reserve_is_not_empty.], 0
je 0x5e3e6d3
inc eax
cmp eax, 0x1cf6
jne 0x5e3e6b6
or edx, 0x72c1df31
mov dword [0x5e57d28], edx
mov eax, dword [0x5e57d28]
sub eax, 0xa731b20
mov dword [0x5e57d28], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push eax
leave
ret
Function at 0x5e3e7dc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str._tIME_Second
mov ebp, esp
push esi
push ebx
sub esp, 0x10
or dword [0x5e57ec0], 0xd9674629
mov al, byte [edx]
test al, al
je 0x5e3e80f
sub eax, 0x30
cmp al, 9
jbe 0x5e3e80c
mov dword [0x5e57f10], 0x6b937f62
jmp 0x5e3e80f
inc edx
jmp 0x5e3e7f3
mov dword [0x5e58238], 0xe9e773f7
mov edx, str._tIME_Second
mov al, byte [edx]
test al, al
je 0x5e3e83a
sub eax, 0x30
cmp al, 9
jbe 0x5e3e837
mov dword [0x5e57ec0], 0xf492ee83
jmp 0x5e3e83a
inc edx
jmp 0x5e3e81e
or dword [0x5e57ec0], 0xc2bf9452
mov dword [0x5e5829c], 0xa7654d7e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, str.JR.Inno.Setup
mov edx, eax
and edx, 0xf97441
mov dword [0x5e5829c], edx
mov dl, byte [ecx]
test dl, dl
je 0x5e3e88c
sub edx, 0x30
cmp dl, 9
jbe 0x5e3e889
mov ebx, dword [0x5e58238]
lea edx, [ebx + 0x58a7285e]
mov dword [0x5e57ec0], edx
jmp 0x5e3e88c
inc ecx
jmp 0x5e3e867
mov esi, dword [0x5e57ec0]
and eax, 0x294400
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [0x5e57ec0], eax
lea edx, [esi - 0x4f84786]
mov esi, 0x46e
mov dword [0x5e57f10], edx
mov dword [esp], edx
call ebx
push edx
imul eax, dword [0x5e57f10], 0xb15cd3cb
mov dword [0x5e58238], eax
mov eax, dword [0x5e57ec0]
xor eax, 0xd35e01e0
mov dword [0x5e57f10], eax
sub eax, 0x6eb07f71
mov dword [0x5e5829c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x5e57ec0]
mov ecx, str.An_attempt_was_made_to_reinitialize_the_ACPI_subsystem
lea edx, [eax + 0x1977f176]
mov dword [0x5e57ec0], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x5e3e922
add esi, edx
cmp esi, 0x1bbb
jbe 0x5e3e8fd
imul edx, dword [0x5e58238], 0xf589449e
mov dword [0x5e58238], edx
add eax, 0x18805e9
mov dword [0x5e57f10], eax
mov eax, dword [0x5e58238]
xor eax, 0xc796987e
mov dword [0x5e5829c], eax
mov dword [esp], 0x26c0
call ebx
push eax
mov eax, dword [0x5e5829c]
imul ecx, dword [0x5e57f10], 0xbd45caef
xor eax, 0x2f11174b
and eax, 0x56b1a2ff
lea edx, [eax + 0x418f7156]
sub eax, 0x38b60123
mov dword [0x5e57ec0], ecx
mov dword [0x5e57f10], eax
mov eax, edx
mov dword [0x5e58238], edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x5e3f3f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, str.originModule
push edx
call dword [sym.imp.USER32.dll_AnyPopup]
xor dword [0x5e57e60], 0xcf9121b8
and eax, 0xbd25e69f
mov dword [0x5e5815c], eax
lea ecx, [eax + 0x357822d9]
mov dl, byte [ebx]
test dl, dl
je 0x5e3f43b
sub edx, 0x30
cmp dl, 9
jbe 0x5e3f438
xor eax, 0x789c3eb7
mov dword [0x5e5815c], eax
jmp 0x5e3f43b
inc ebx
jmp 0x5e3f41e
mov eax, ecx
or eax, 0x797e25f6
mov dword [0x5e57dd4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, str.The_claim_type_requested_is_not_supported.
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x5e3f45e
inc edx
jmp 0x5e3f452
mov edx, str.The_flags_field_contains_an_invalid_value.
mov ecx, 0x1af5
movsx eax, byte [edx]
inc edx
test al, al
je 0x5e3f489
add ecx, eax
cmp ecx, 0x2298
jbe 0x5e3f468
mov eax, dword [0x5e5815c]
add eax, 0x1b209cb5
mov dword [0x5e57dd4], eax
mov eax, dword [0x5e5815c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
imul edx, dword [0x5e57e60], 0x41a71f20
sub eax, 0xc0f569c
or eax, 0xe59995f5
mov dword [0x5e57e60], eax
mov eax, edx
and eax, 0x6d9984e1
mov dword [0x5e5815c], eax
call ebx
imul eax, dword [0x5e57dd4], 0x158fac4c
add dword [0x5e5815c], 0x51992a11
mov dword [0x5e57e60], eax
call ebx
add dword [0x5e57dd4], 0x2c1060e4
xor eax, 0xbb991335
and eax, 0xdec7c1cb
or eax, 0x1050f881
mov dword [0x5e57e60], eax
pop eax
pop ebx
pop ebp
ret

Function at 0x5e3f4f8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp], 0x1b4a
call dword [sym.imp.USER32.dll_IsZoomed]
push eax
mov eax, dword [0x5e57d8c]
or eax, 0x6abda9b5
mov dword [0x5e57d20], eax
add eax, 0x457c0a90
mov dword [0x5e57d8c], eax
mov dword [esp], 0x5e5b298
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
mov edx, 0x5e585a0
mov al, byte [edx]
test al, al
je 0x5e3f555
sub eax, 0x30
cmp al, 9
jbe 0x5e3f552
and dword [0x5e57d8c], 0xc3cd0104
jmp 0x5e3f555
inc edx
jmp 0x5e3f539
imul eax, dword [0x5e57d8c], 0x2dc76ab4
mov ecx, str.SdbpGetMatchingTextAttributes
mov ebx, 0x8dd
xor eax, 0xc1ee066
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x5e3f580
add ebx, edx
cmp ebx, 0x1695
jbe 0x5e3f56e
add eax, 0x2cf898ce
mov ecx, str.image_heic
xor eax, 0xda2e026d
mov dword [0x5e57d20], eax
mov dl, byte [ecx]
test dl, dl
je 0x5e3f5b1
sub edx, 0x30
cmp dl, 9
jbe 0x5e3f5ae
add eax, 0x16fda3b
mov dword [0x5e57d20], eax
jmp 0x5e3f5b1
inc ecx
jmp 0x5e3f594
mov edx, dword [0x5e57d20]
mov ecx, 0x5e585a0
mov eax, edx
or eax, 0xbccd781f
mov dword [0x5e57d8c], eax
mov al, byte [ecx]
test al, al
je 0x5e3f5e6
sub eax, 0x30
cmp al, 9
jbe 0x5e3f5e3
sub edx, 0x3ef8d892
mov dword [0x5e57d8c], edx
jmp 0x5e3f5e6
inc ecx
jmp 0x5e3f5c8
imul eax, dword [0x5e57d8c], 0xc392935f
mov dword [0x5e57d20], eax
call dword [sym.imp.USER32.dll_AnyPopup]
mov eax, dword [0x5e57d20]
mov ebx, dword [ebp - 4]
and eax, 0x73fa5066
mov dword [0x5e57d20], eax
xor eax, 0x974865a8
mov dword [0x5e57d8c], eax
leave
jmp dword [sym.imp.KERNEL32.dll_GetCommandLineW]
Function at 0x5e3f620
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x424
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x5e3f655
add ecx, eax
cmp ecx, 0x65
jbe 0x5e3f634
imul eax, dword [0x5e57da8], 0x68cf9f90
mov dword [0x5e5811c], eax
mov eax, dword [0x5e580b0]
mov edx, ebx
xor eax, 0xfb70e725
mov dword [0x5e57da8], eax
mov eax, dword [0x5e5811c]
sub eax, 0x97d02a3
mov dword [0x5e58160], eax
mov ax, word [edx]
test ax, ax
je 0x5e3f693
sub eax, 0x30
cmp ax, 9
jbe 0x5e3f68e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x5e3f693
add edx, 2
jmp 0x5e3f675
mov eax, dword [0x5e58190]
xor eax, 0xb983db42
mov dword [0x5e5811c], eax
xor eax, eax
cmp word [ebx + eax*2], 0
je 0x5e3f6c2
inc eax
cmp eax, 0xa6
jne 0x5e3f6a4
mov eax, dword [0x5e58160]
and eax, 0x3831da21
mov dword [0x5e5811c], eax
imul eax, dword [0x5e57da8], 0x1556e18
mov dword [0x5e580b0], eax
mov eax, dword [0x5e58160]
or eax, 0x6621ec6b
mov dword [0x5e582a0], eax
mov dword [esp], 0x112a
call dword [sym.imp.USER32.dll_GetTopWindow]
sub eax, 0x2e0c45b5
push edx
mov dword [0x5e58190], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, dword [ebp + 8]
mov ecx, 0x23d1
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x5e3f72a
add ecx, eax
cmp ecx, 0x1213
jbe 0x5e3f706
imul eax, dword [0x5e582a0], 0xd40440d4
mov dword [0x5e580b0], eax
mov eax, dword [0x5e582a0]
mov esi, ebx
mov edi, 0x147
mov dword [ebp - 0x1c], eax
mov eax, dword [0x5e58190]
mov edx, eax
or edx, 0x16079eca
lea ecx, [edx + 0x3fb17af8]
mov dword [0x5e58160], ecx
movzx ecx, word [esi]
add esi, 2
test cx, cx
je 0x5e3f767
add edi, ecx
cmp edi, 0x265b
jbe 0x5e3f752
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp + 8]
sub eax, 0x5666bb57
mov dword [0x5e582a0], eax
and ecx, 0x6040000c
cmp word [edi], 0
mov dword [0x5e5811c], ecx
je 0x5e3f795
add edx, 0xd4a1708
mov dword [0x5e58160], edx
mov ecx, ebx
mov esi, 0x1a8e
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x5e3f7bb
add esi, edx
cmp esi, 0x54b
jbe 0x5e3f79c
add dword [0x5e58160], 0x17738c23
mov edx, dword [ebp - 0x1c]
sub edx, 0x49567525
mov dword [0x5e57da8], edx
xor edx, edx
cmp word [ebx + edx*2], 0
je 0x5e3f7e6
inc edx
cmp edx, 0x1017
jne 0x5e3f7cc
or eax, 0x6aa0ac74
mov dword [0x5e58190], eax
mov eax, dword [0x5e58190]
sub eax, 0x2b038a0c
or eax, 0xeede09d7
mov dword [0x5e58190], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5e400dc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x14
cmp word [eax + str._iCCP_ProfileName], 0
je 0x5e40108
add eax, 2
cmp eax, 0x1d04
jne 0x5e400e5
mov eax, dword [0x5e57dc8]
and eax, 0xb18bc4ad
mov dword [0x5e57e0c], eax
imul eax, dword [0x5e57e0c], 0xc87848b
mov dword [0x5e57dc8], eax
add eax, 0x566d91a9
xor eax, 0xe8998514
mov dword [0x5e57e0c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esp], 0xa72
xor dword [0x5e57dc8], 0xef8b6c15
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ecx, 0x113
push edx
mov edx, str.FreeLists
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x5e40178
add ecx, eax
cmp ecx, 0xb63
jbe 0x5e4014e
mov eax, dword [0x5e57e0c]
or eax, 0xb9ad6f06
mov dword [0x5e57dc8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor dword [0x5e57dc8], 0xa3821d8d
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call ebx
mov eax, dword [0x5e57e0c]
mov ecx, str.Specified_video_present_target_set_is_invalid.
and eax, 0xbe36eaab
imul eax, eax, 0x46a59965
mov dword [0x5e57e0c], eax
mov dl, byte [ecx]
test dl, dl
je 0x5e401c1
sub edx, 0x30
cmp dl, 9
jbe 0x5e401be
or eax, 0x4773d33e
mov dword [0x5e57e0c], eax
jmp 0x5e401c1
inc ecx
jmp 0x5e401a4
mov eax, dword [0x5e57e0c]
xor dword [0x5e57dc8], 0xa4d1be02
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
xor edx, edx
push eax
mov eax, dword [0x5e57dc8]
or eax, 0x3010a072
xor eax, 0x1d2b70d2
mov dword [0x5e57dc8], eax
cmp byte [edx + 0x5e583a0], 0
je 0x5e4020d
inc edx
cmp edx, 0x6cb
jne 0x5e401f0
imul eax, eax, 0xb8ec870e
mov dword [0x5e57dc8], eax
mov eax, dword [0x5e57dc8]
add eax, 0x235eabe6
mov dword [0x5e57e0c], eax
call ebx
mov ebx, dword [ebp - 4]
mov dword [0x5e57e0c], 0x5b7c5a8c
sub eax, 0x48071373
or eax, 0xc2911906
add eax, 0x368ad19b
imul eax, eax, 0xa0bbab40
and eax, 0x1bfa624d
or eax, 0xdffedfee
mov dword [0x5e57dc8], eax
leave
ret
Function at 0x5e40acc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [0x5e582c4]
add eax, 0x27fe3cf7
mov dword [0x5e5824c], eax
xor eax, eax
cmp byte [eax + str.An_internal_error_caused_an_operation_to_fail.], 0
je 0x5e40b0a
inc eax
cmp eax, 0x13aa
jne 0x5e40ae4
mov eax, dword [0x5e57d64]
or eax, 0xbea2519d
mov dword [0x5e58020], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [0x5e58020]
xor eax, 0x8b381b12
add eax, 0x30dc7360
mov dword [0x5e57d64], eax
mov eax, dword [0x5e5824c]
sub eax, 0x13b803f8
mov dword [0x5e582c4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [0x5e57d64]
mov ebx, dword [sym.imp.USER32.dll_GetTopWindow]
mov dword [esp], 0x15a9
or dword [0x5e5824c], 0x729a9eb8
mov eax, edx
imul edx, edx, 0x55aa3574
xor eax, 0x540dbef3
mov dword [0x5e582c4], eax
sub eax, 0x66bfc009
mov dword [0x5e58020], edx
mov dword [0x5e57d64], eax
call ebx
mov eax, dword [0x5e582c4]
push edx
mov edx, eax
xor eax, 0x22cce4b5
mov dword [0x5e582c4], eax
xor edx, 0x5ac71bc3
imul eax, dword [0x5e57d64], 0x3efa54ac
mov dword [0x5e5824c], edx
mov dword [esp], edx
mov dword [0x5e57d64], eax
call ebx
xor eax, eax
push ecx
cmp byte [eax + str.The_current_allocation_cant_be_unswizzled_by_an_aperture.], 0
je 0x5e40bc9
inc eax
cmp eax, 0x1050
jne 0x5e40ba9
mov eax, dword [0x5e57d64]
or eax, 0x232d8fbb
mov dword [0x5e5824c], eax
mov edx, dword [0x5e57d64]
imul eax, edx, 0xe420c54d
mov dword [esp], edx
add eax, 0x47062c59
mov dword [0x5e582c4], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edx, dword [0x5e582c4]
mov ebx, dword [ebp - 4]
push eax
imul eax, edx, 0x23c2ac80
add edx, 0x14aa1a3b
mov dword [0x5e57d64], edx
mov dword [0x5e58020], eax
xor eax, 0x5ba9ac73
mov dword [0x5e5824c], eax
leave
ret
Function at 0x5e41168
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
je 0x5e41182
xor dword [0x5e581e4], 0x1dfdb102
mov eax, dword [0x5e57d40]
mov edx, dword [0x5e581e4]
mov ecx, ebx
xor eax, 0xc5c133bf
or edx, 0x83a16560
mov dword [0x5e5808c], eax
mov dword [0x5e57d40], edx
mov dl, byte [ecx]
test dl, dl
je 0x5e411c4
sub edx, 0x30
cmp dl, 9
jbe 0x5e411c1
lea edx, [eax + 0x14df73b]
mov dword [0x5e57d40], edx
jmp 0x5e411c4
inc ecx
jmp 0x5e411a5
mov ecx, ebx
mov dl, byte [ecx]
test dl, dl
je 0x5e411e9
sub edx, 0x30
cmp dl, 9
jbe 0x5e411e6
sub eax, 0x41c3d7f8
mov dword [0x5e581e4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x5e411e9
inc ecx
jmp 0x5e411c6
mov eax, dword [0x5e57d40]
xor edx, edx
xor eax, 0x5bf81d0f
mov dword [0x5e57d40], eax
cmp byte [ebx + edx], 0
je 0x5e4121e
inc edx
cmp edx, 0x13e1
jne 0x5e411fa
imul eax, eax, 0xc03be1b8
mov dword [0x5e581e4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push edx
cmp byte [ebx], 0
je 0x5e4122d
and dword [0x5e57d40], 0x3b2460ec
mov edx, dword [0x5e57d40]
mov ecx, ebx
mov esi, 0x409
mov eax, edx
xor eax, 0x9e75badc
mov dword [0x5e5808c], eax
movsx eax, byte [ecx]
inc ecx
test al, al
je 0x5e41264
add esi, eax
cmp esi, 0x431
jbe 0x5e41246
mov eax, edx
xor eax, 0xc10adc50
mov dword [0x5e5808c], eax
mov eax, dword [0x5e5808c]
imul edx, edx, 0x51790680
add eax, 0x64a7b911
mov dword [0x5e57d40], eax
sub edx, 0x4247a0b8
mov dword [0x5e581e4], edx
xor edx, edx
cmp byte [ebx + edx], 0
je 0x5e412aa
inc edx
cmp edx, 0x7d7
jne 0x5e41287
or eax, 0x55111050
mov dword [0x5e57d40], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
mov eax, dword [0x5e5808c]
sub eax, 0x6e7ea9a4
mov dword [0x5e581e4], eax
xor eax, 0xf8b5a0e
mov dword [0x5e5808c], eax
mov dl, byte [ebx]
test dl, dl
je 0x5e412e7
sub edx, 0x30
cmp dl, 9
jbe 0x5e412e4
imul eax, eax, 0x903c3aa7
mov dword [0x5e581e4], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
jmp 0x5e412e7
inc ebx
jmp 0x5e412c3
mov eax, dword [0x5e57d40]
sub eax, 0x16de2e0b
mov dword [0x5e5808c], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, 0xa5414a76
mov dword [0x5e5808c], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x5e41810
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov eax, ebx
and eax, 0x367879ba
mov dword [0x5e57fcc], eax
lea eax, [ebx + 0x7c9f6905]
mov dword [0x5e57fdc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp], str.AslFileMappingGetImageTypeEx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x94d
push edx
mov edx, edi
movsx eax, byte [edx]
inc edx
test al, al
je 0x5e41866
add ecx, eax
cmp ecx, 0x2646
jbe 0x5e41854
mov edx, edi
mov ecx, 0x1a76
movsx eax, byte [edx]
inc edx
test al, al
je 0x5e4187f
add ecx, eax
cmp ecx, 0x16cf
jbe 0x5e4186d
mov eax, dword [0x5e57fdc]
add eax, 0x13d63f9b
mov dword [0x5e57fcc], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor eax, eax
cmp byte [edi + eax], 0
je 0x5e418af
inc eax
cmp eax, 0x26d4
jne 0x5e41896
imul eax, ebx, 0x96ff05db
mov dword [0x5e57fcc], eax
mov eax, dword [0x5e57fcc]
xor eax, 0x5e421393
mov dword [0x5e57fdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, ebx
or eax, 0x98e0a13d
mov dword [0x5e57fdc], eax
lea eax, [ebx - 0x78417ed9]
mov dword [0x5e57fcc], eax
mov dword [esp], str.Debugger_got_control_C.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov ax, word [esi]
test ax, ax
je 0x5e4190d
sub eax, 0x30
cmp ax, 9
jbe 0x5e41908
add ebx, 0x20e2ae2e
mov dword [0x5e57fcc], ebx
jmp 0x5e4190d
add esi, 2
jmp 0x5e418e9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5e41d8c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [0x5e58158]
mov ebx, dword [ebp + 8]
lea eax, [edx + 0x3d21ecbb]
mov dword [0x5e57fec], eax
xor eax, eax
cmp byte [ebx + eax], 0
je 0x5e41dcb
inc eax
cmp eax, 0x20ea
jne 0x5e41dab
imul edx, edx, 0x6c7edeb0
mov dword [0x5e581a8], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x5e58158]
or eax, 0xc1f7f9db
mov dword [0x5e57fec], eax
xor eax, 0x41ab86d
cmp byte [ebx], 0
mov dword [0x5e58158], eax
je 0x5e41dfe
mov eax, dword [0x5e581a8]
add eax, 0x34a0dc5
mov dword [0x5e58168], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x5e57df8]
mov ecx, ebx
mov eax, edx
and edx, 0x86499ac5
or edx, 0x82480804
or eax, 0xd2ea2c3c
mov dword [ebp - 0x1c], edx
mov dl, byte [ecx]
test dl, dl
je 0x5e41e41
sub edx, 0x30
cmp dl, 9
jbe 0x5e41e3e
mov edx, dword [0x5e58168]
xor edx, 0x73dbd27
mov dword [0x5e57df8], edx
jmp 0x5e41e41
inc ecx
jmp 0x5e41e1c
mov ecx, eax
mov esi, ebx
xor eax, 0xc540862c
mov edi, 0x4d0
xor ecx, 0x94d9e73f
mov dword [0x5e58168], ecx
movzx edx, byte [esi]
inc esi
test dl, dl
je 0x5e41e6d
add edi, edx
cmp edi, 0x1ccf
jbe 0x5e41e5b
sub eax, 0x56f5c567
mov dword [0x5e57fec], eax
mov eax, dword [ebp - 0x1c]
xor eax, 0x7ff05233
mov dword [0x5e58158], eax
lea eax, [ecx - 0x28b9300d]
mov dword [0x5e581a8], eax
mov dword [esp], ecx
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ecx, 0x1ce
add eax, 0x6f75351e
push edx
mov edx, ebx
mov dword [0x5e58168], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x5e41ecb
add ecx, eax
cmp ecx, 0x1a10
jbe 0x5e41eaa
mov eax, dword [0x5e581a8]
sub eax, 0x2c58dfdf
mov dword [0x5e58168], eax
imul eax, dword [0x5e58158], 0x2aa3e1d2
mov esi, 0xbb0
mov dword [0x5e58158], eax
mov eax, dword [0x5e57fec]
xor eax, 0x2c159230
mov dword [0x5e581a8], eax
call dword [sym.imp.USER32.dll_AnyPopup]
sub eax, 0x335048a3
mov dword [0x5e58158], eax
mov eax, dword [0x5e57fec]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebx
push eax
mov eax, dword [0x5e57df8]
sub eax, 0x3ae6b571
mov dword [0x5e581a8], eax
mov eax, dword [0x5e58158]
or eax, 0x7b1d8836
mov dword [0x5e58158], eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x5e41f3f
add esi, edx
cmp esi, 0x1359
jbe 0x5e41f2d
sub eax, 0x4239c79b
mov dword [0x5e58168], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x5e58168]
mov ecx, dword [0x5e57fec]
lea eax, [edx + 0x39e43d3a]
add edx, 0x403bbc42
xor ecx, 0xf65d4513
mov dword [0x5e581a8], eax
mov dword [0x5e57fec], edx
mov dword [0x5e57df8], ecx
mov ecx, 0x22d2
movzx edx, byte [ebx]
inc ebx
test dl, dl
je 0x5e41f95
add ecx, edx
cmp ecx, 0x2551
jbe 0x5e41f83
xor eax, 0x2fc6426e
mov dword [0x5e58158], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
or dword [0x5e58168], 0xd2dfad97
or eax, 0x3e82e78c
mov dword [0x5e57df8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5e41fc4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov edx, str.AslStringDuplicate
mov ebp, esp
sub esp, 0x18
mov al, byte [edx]
test al, al
je 0x5e41ff0
sub eax, 0x30
cmp al, 9
jbe 0x5e41fed
mov eax, dword [0x5e57d74]
add eax, 0x7b17c361
mov dword [0x5e5810c], eax
jmp 0x5e41ff0
inc edx
jmp 0x5e41fcf
xor eax, eax
cmp byte [eax + str.Log_service_encountered_a_corrupted_metadata_file.], 0
je 0x5e42012
inc eax
cmp eax, 0x1e0a
jne 0x5e41ff2
mov eax, dword [0x5e57e8c]
and eax, 0x190a9a53
mov dword [0x5e5810c], eax
mov eax, dword [0x5e5810c]
or eax, 0x53283a68
mov dword [0x5e582b0], eax
mov eax, dword [0x5e57d74]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov edx, dword [0x5e57f38]
push eax
lea eax, [edx + 0x58809236]
mov dword [0x5e582b0], eax
xor eax, eax
cmp byte [eax + str.The_combination_of_IPsec_transform_types_is_not_valid.], 0
je 0x5e42060
inc eax
cmp eax, 0x11c3
jne 0x5e42043
xor edx, 0xf8240f
mov dword [0x5e582b0], edx
imul eax, dword [0x5e57e8c], 0x66e00a6e
mov edx, dword [0x5e582b0]
xor edx, 0x58302814
mov dword [0x5e5810c], eax
sub eax, 0x20d802a
mov dword [0x5e57d74], edx
mov dword [0x5e582b0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x5e57e8c]
mov edx, eax
and edx, 0x8a332a1e
mov dword [0x5e57f38], edx
mov edx, eax
imul eax, eax, 0xabd2e918
xor edx, 0x5c4c8230
mov dword [0x5e582b0], edx
mov dword [0x5e57d74], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, str.AslStringDuplicate
mov al, byte [edx]
test al, al
je 0x5e420e9
sub eax, 0x30
cmp al, 9
jbe 0x5e420e6
mov eax, dword [0x5e57e8c]
xor eax, 0xe88afead
mov dword [0x5e5810c], eax
jmp 0x5e420e9
inc edx
jmp 0x5e420c8
mov eax, dword [0x5e5810c]
lea edx, [eax - 0x49075b78]
xor eax, 0x2e07da08
or eax, 0xb2f18b49
mov dword [0x5e5810c], edx
sub eax, 0x1fd81bc5
mov dword [0x5e57e8c], eax
mov eax, dword [0x5e582b0]
imul edx, eax, 0x5156c8c0
sub eax, 0x1f8be7c8
mov dword [0x5e57d74], eax
mov dword [0x5e57f38], edx
leave
ret