joyce8/EMBER2024-capa huggingface dataset:
Function at 0x643c5e54
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword [0x643e7f28]
and eax, 0x80771193
sub eax, 0x62e51b0f
and eax, 0xcd929c12
mov dword [0x643e7f28], eax
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 1
sete al
movzx eax, al
ret

Function at 0x643c61b4
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x31
push esi
xor esi, esi
push ebx
sub esp, 0x4c
mov eax, dword [0x643e823c]
xor eax, 0x138c7843
add eax, 0x446a8311
imul eax, eax, 0xf87b5498
or eax, 0x6a0e510c
mov dword [0x643e823c], eax
call fcn.643d2564
mov eax, dword [0x643e823c]
mov dword [ebp - 0x24], 0x62
mov dword [ebp - 0x20], 0x4a
or eax, 0x2bdc414d
mov dword [ebp - 0x1c], 0xffffff7e
add eax, 0x4e0a2c2
xor eax, 0xd9edd17e
mov dword [0x643e823c], eax
mov eax, dword [0x643e823c]
xor eax, 0x93f0f10
or eax, 0xbdee6d10
mov dword [0x643e823c], eax
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Invalid_state
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
mov eax, dword [0x643e823c]
mov dword [esp + 8], str.VersionBlock_is_too_long
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.Failed_to_allocate_sdb_context
mov dword [esp], str.No_PIN_was_presented_to_the_smart_card
call fcn.643d0978
sub edi, dword [ebp + esi*4 - 0x24]
inc esi
mov ebx, edi
cmp esi, 3
jne 0x643c6216
mov edx, str.Failed_to_allocate_sdb_context
mov ecx, 0x437
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643c6297
add ecx, eax
cmp ecx, 0x1e13
jbe 0x643c6273
imul eax, dword [0x643e823c], 0x32bf15dc
mov dword [0x643e823c], eax
mov eax, dword [0x643e823c]
or eax, 0x81571ff0
add eax, 0x22f94cbf
mov dword [0x643e823c], eax
mov dword [esp], 0x11f6
call dword [sym.imp.USER32.dll_IsZoomed]
xor ecx, ecx
push edx
and eax, 0xf3e0fa1
sub eax, 0x1ac404ef
mov dword [ebp - 0x30], ecx
mov dword [0x643e823c], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
call fcn.643c1083
mov ebx, eax
test eax, eax
jne 0x643c63a0
mov dword [ebp - 0x2c], 0x17
xor esi, esi
mov edi, 0x58
mov dword [ebp - 0x28], 0xffffff91
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor eax, eax
cmp byte [eax + str._grctlext_delay], 0
je 0x643c6342
inc eax
cmp eax, 0x194d
jne 0x643c6317
and dword [0x643e823c], 0x6890b35c
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
and eax, 0xf10bbd8a
mov dword [0x643e823c], eax
or dword [0x643e823c], 0x981e24e4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, 0x6997fd64
imul eax, eax, 0xb8374e4
mov dword [0x643e823c], eax
mov dword [esp + 8], str.No_PIN_was_presented_to_the_smart_card
mov dword [esp + 4], str._grctlext_delay
mov dword [esp], str.VersionBlock_is_too_long
call fcn.643d0738
add edi, dword [ebp + esi*4 - 0x2c]
test esi, esi
jne 0x643c638d
mov esi, 1
jmp 0x643c630f
cmp edi, dword [ebp - 0x30]
je 0x643c63b7
xor dword [0x643e823c], 0x25ab16fc
mov ebx, esi
jmp 0x643c63b7
mov eax, dword [0x643e823c]
xor ebx, ebx
or eax, 0x5c3132be
imul eax, eax, 0xd83ee68a
mov dword [0x643e823c], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x643c8b04
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x16c
cmp word [eax + str.heap_failure_invalid_argument], 0
je 0x643c8b30
add eax, 2
cmp eax, 0x15fc
jne 0x643c8b12
xor dword [0x643e7e14], 0xc746c2bc
imul eax, dword [0x643e7e14], 0x75d2b69b
lea edi, [ebp - 0x136]
mov esi, 0x643eb3ef
mov dword [0x643e801c], eax
call fcn.643d3548
mov ecx, 0x1e
mov edx, dword [0x643e7e14]
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x154], 0xd4864362
mov word [ebp - 0x150], 0x9638
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x643c8b71
lea eax, [edx - 0x383fd000]
xor esi, esi
xor ebx, ebx
mov dword [0x643e7e14], eax
mov eax, ebx
mov edi, 0x1d
xor edx, edx
mov cl, byte [ebp + ebx - 0x118]
div edi
mov byte [ebp - 0x15c], cl
movzx eax, byte [ebp + edx - 0x136]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
mov eax, dword [0x643e7e14]
lea edx, [eax + 0x6aad790f]
and eax, 0x46228a69
mov dword [0x643e801c], edx
mov dword [0x643e7e14], eax
call fcn.643d2c24
mov al, byte [ebp + esi - 0x118]
mov cl, byte [ebp - 0x15c]
mov byte [ebp + ebx - 0x118], al
inc ebx
mov byte [ebp + esi - 0x118], cl
cmp ebx, 0x100
jne 0x643c8b8f
mov eax, dword [0x643e7e14]
xor ebx, ebx
xor edi, edi
xor esi, esi
lea edx, [ebp - 0x14e]
or eax, 0x9203c48e
mov dword [ebp - 0x15c], eax
lea ecx, [esi + 1]
movzx esi, cl
mov cl, byte [ebp + esi - 0x118]
add edi, ecx
mov eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + esi - 0x118], al
mov byte [ebp + edi - 0x118], cl
add cl, byte [ebp + esi - 0x118]
movzx ecx, cl
mov cl, byte [ebp + ecx - 0x118]
xor cl, byte [ebp + ebx - 0x154]
inc ebx
mov byte [ebx + edx - 1], cl
cmp ebx, 6
jne 0x643c8c19
mov eax, dword [ebp - 0x15c]
lea edi, [ebp - 0x148]
mov esi, 0x643d5098
mov byte [ebp - 0x148], 0
mov ecx, 4
mov ebx, 0x5a
rep movsd dword es:[edi], dword [esi]
xor eax, 0xfc03e63
imul eax, eax, 0xe80cc346
sub ebx, dword [ebp + ecx*4 - 0x148]
inc ecx
mov esi, eax
imul eax, eax, 0x50762020
cmp ecx, 4
jne 0x643c8c93
mov dword [esp + 0xc], ebx
lea ecx, [esi - 0x3f091ab6]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x1318
mov dword [esp], 0x643e58c0
mov dword [0x643e7e14], ecx
mov dword [0x643e801c], eax
call fcn.643cb468
add esp, 0x16c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x643cbad4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x2c]
mov esi, 0x643d5178
push ebx
sub esp, 0x4c
mov eax, dword [0x643e8170]
mov ebx, dword [ebp + 8]
xor eax, 0xffeb7d5
mov dword [0x643e8170], eax
mov dword [esp + 8], str.The_specified_hardware_profile_configuration_is_invalid.
mov dword [esp + 4], eax
mov dword [esp], str.FilterFullPath
call fcn.643cfc0c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call fcn.643cde38
mov eax, dword [0x643e8170]
or eax, 0xdd14c31b
imul eax, eax, 0xa2d8c793
mov dword [0x643e8170], eax
mov dword [esp], str.ftypmif1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
sub dword [0x643e8170], 0x612ca6e3
call fcn.643d36bc
mov eax, dword [0x643e8170]
mov ecx, 5
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xb
add eax, 0x2dfb98d6
or eax, 0x87b824b1
sub eax, 0x46938eb9
mov esi, ecx
sub esi, dword [ebp + edx*4 - 0x2c]
inc edx
mov edi, eax
mov ecx, esi
imul eax, eax, 0xf2d09df
cmp edx, 5
jne 0x643cbb6e
mov dword [0x643e8170], eax
test ebx, ebx
jne 0x643cbc24
mov dword [ebp - 0x34], 5
xor esi, esi
mov ebx, 0x15
mov dword [ebp - 0x30], 0xffffffe6
mov edx, 0x643e8ec0
mov ecx, 0x11e8
movzx eax, byte [edx]
inc edx
test al, al
je 0x643cbbe6
add ecx, eax
cmp ecx, 0x2639
jbe 0x643cbbb0
mov eax, dword [0x643e8170]
mov dword [esp], str.The_requested_operation_is_not_implemented.
mov dword [esp + 4], eax
call fcn.643d10cc
imul eax, dword [0x643e8170], 0x5274d3a7
mov dword [0x643e8170], eax
mov eax, dword [0x643e8170]
sub eax, 0x62ce0dce
imul eax, eax, 0x7e6d8e5
mov dword [0x643e8170], eax
mov dword [esp + 4], str.Thread_Suspended
mov dword [esp], 0x643e8ec0
call fcn.643d0a60
add ebx, dword [ebp + esi*4 - 0x34]
mov edx, ebx
test esi, esi
jne 0x643cbd17
mov esi, 1
jmp 0x643cbba6
imul edi, edi, 0xb18d1938
sub edi, 0x6a62188c
mov dword [0x643e8170], edi
call fcn.643d4a10
mov edx, str.Thread_Suspended
mov ecx, 0x1683
movzx eax, byte [edx]
inc edx
test al, al
je 0x643cbc79
add ecx, eax
cmp ecx, 0x2194
jbe 0x643cbc45
mov dword [esp + 8], str.SDB_file_too_small_to_be_valid
mov dword [esp + 4], edi
mov dword [esp], str.ftypheic
call fcn.643cfc0c
add dword [0x643e8170], 0x4a67f39c
mov eax, dword [0x643e8170]
mov edi, ebx
add eax, 0x47dc66a6
and eax, 0xd2bd62ef
mov dword [0x643e8170], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x2334
xor eax, eax
cmp byte [eax + str.Thread_Suspended], 0
je 0x643cbcb7
inc eax
cmp eax, 0x2091
jne 0x643cbc9c
add dword [0x643e8170], 0x5c271615
mov eax, dword [0x643e8170]
mov dword [ebp - 0x3c], edx
or eax, 0x7f1582f5
imul eax, eax, 0xab157710
mov dword [0x643e8170], eax
call fcn.643d2cfc
cmp dword [ebp + 0xc], 0
mov al, byte [edi]
mov edx, dword [ebp - 0x3c]
jne 0x643cbce5
test al, al
jne 0x643cbcf3
jmp 0x643cbd17
mov ecx, edi
sub ecx, ebx
cmp ecx, dword [ebp + 0xc]
jae 0x643cbd17
cmp al, 1
adc edi, 0
cmp al, 0x60
jbe 0x643cbd00
cmp dword [ebp + 0x10], 0
je 0x643cbd00
sub eax, 0x20
imul edx, edx, 0x21
movzx eax, al
inc edi
xor dword [0x643e8170], 0x74b3bd70
add edx, eax
test esi, esi
jne 0x643cbc9a
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x643ccaf0
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Identify system language via api
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
cmp byte [str.The_maximum_named_pipe_instance_count_has_been_reached.], 0
je 0x643ccb2e
mov eax, dword [0x643e80f4]
mov dword [esp + 4], str.The_cloud_file_provider_exited_unexpectedly.
mov dword [esp], str.The_cloud_file_provider_exited_unexpectedly.
mov dword [esp + 8], eax
call fcn.643d0358
mov eax, dword [0x643e80f4]
or eax, 0x351ae416
mov dword [0x643e7f34], eax
and dword [0x643e80f4], 0xc08a30d3
sub dword [0x643e7f34], 0x138aa586
call fcn.643d0acc
mov eax, dword [0x643e7f34]
xor edx, edx
sub eax, 0x5ebc0a98
mov dword [0x643e7f34], eax
and eax, 0xe88f6fad
mov dword [0x643e80f4], eax
cmp word [edx + edx + str.The_cloud_file_provider_exited_unexpectedly.], 0
je 0x643ccb9f
inc edx
cmp edx, 0x1837
jne 0x643ccb62
mov dword [esp + 8], eax
mov dword [esp + 4], str.The_cloud_file_provider_exited_unexpectedly.
mov dword [esp], str.The_cloud_file_provider_exited_unexpectedly.
call fcn.643d0358
mov eax, dword [0x643e7f34]
and eax, 0xa5e234e3
mov dword [0x643e80f4], eax
jmp 0x643ccbac
xor eax, 0xc1ce66fc
cmp edx, 0xd3
jle 0x643ccbbb
call fcn.643d1918
mov eax, dword [0x643e80f4]
add eax, 0x580070be
xor eax, 0x2209b365
mov ebx, dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov edi, 0x100
mov dword [0x643e80f4], eax
mov dword [esp], 0xa3
call ebx
and eax, 0x7364e625
push esi
mov dword [0x643e7f34], eax
xor eax, eax
cmp byte [eax + str.The_maximum_named_pipe_instance_count_has_been_reached.], 0
je 0x643ccc06
inc eax
cmp eax, 0x2127
jne 0x643ccbe6
call fcn.643ceea8
or dword [0x643e7f34], 0x72dd38cb
mov esi, dword [0x643e7f34]
mov eax, esi
and eax, 0x97a8b07b
mov dword [0x643e80f4], eax
dec edi
jne 0x643ccbe4
mov edi, str.The_maximum_named_pipe_instance_count_has_been_reached.
mov edx, 0x17e7
movzx ecx, byte [edi]
inc edi
test cl, cl
je 0x643ccc45
add edx, ecx
cmp edx, 0x11e9
jbe 0x643ccc25
and esi, 0x4003013
mov dword [0x643e7f34], esi
jmp 0x643ccc52
sub eax, 0x93a391d
cmp edx, 0x11e9
jbe 0x643ccc5c
mov eax, dword [0x643e7f34]
sub eax, 0xb077647
mov dword [0x643e7f34], eax
and eax, 0xf7bd0172
xor edx, edx
mov dword [0x643e80f4], eax
cmp byte [edx + str.FrontEndHeap], 0
je 0x643ccc89
inc edx
cmp edx, 0x2065
jne 0x643ccc6d
xor eax, 0x78787a3a
mov dword [0x643e80f4], eax
imul eax, dword [0x643e80f4], 0x60b6e0b
mov dword [0x643e80f4], eax
mov dword [esp], 0x1b0d
call ebx
or eax, 0x9bc42f01
push edx
mov ebx, dword [0x643d5094]
add eax, 0x61bda4e4
mov edx, eax
and eax, 0x2150fb90
or edx, 0xf1eab180
or eax, 0x2140b180
mov dword [0x643e7f34], edx
mov dword [0x643e80f4], eax
mov dword [esp], 0x100000
call fcn.643cc6c0
xor ecx, ecx
mov dword [ebx + 0x4c], eax
mov eax, dword [0x643d5094]
mov dword [eax + 0x50], ecx
call fcn.643ca140
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.643ca498
Function at 0x643cccfc
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x200
mov ebx, dword [ebp + 0x10]
mov eax, ecx
mov byte [ebp + ecx - 0x10c], cl
cdq
idiv dword [ebp + 0x14]
mov al, byte [ebx + edx]
mov byte [ebp + ecx - 0x20c], al
inc ecx
cmp ecx, 0x100
jne 0x643ccd0d
xor ebx, ebx
xor edx, edx
mov esi, 0x100
movzx eax, byte [ebp + ebx - 0x10c]
mov ecx, eax
add eax, edx
movzx edx, byte [ebp + ebx - 0x20c]
add eax, edx
cdq
idiv esi
mov al, byte [ebp + edx - 0x10c]
mov byte [ebp + edx - 0x10c], cl
mov byte [ebp + ebx - 0x10c], al
inc ebx
cmp ebx, 0x100
jne 0x643ccd36
xor esi, esi
xor ebx, ebx
xor ecx, ecx
mov edi, 0x100
cmp esi, dword [ebp + 0xc]
jge 0x643ccdd0
lea eax, [ebx + 1]
cdq
idiv edi
movzx eax, byte [ebp + edx - 0x10c]
mov ebx, edx
add eax, ecx
cdq
idiv edi
mov al, byte [ebp + edx - 0x10c]
mov ecx, edx
mov dl, byte [ebp + ebx - 0x10c]
mov byte [ebp + ecx - 0x10c], dl
mov edx, dword [ebp + 8]
mov byte [ebp + ebx - 0x10c], al
add al, byte [ebp + ecx - 0x10c]
movzx eax, al
mov al, byte [ebp + eax - 0x10c]
xor al, byte [edx + esi]
mov edx, dword [ebp + 0x18]
mov byte [edx + esi], al
inc esi
jmp 0x643ccd78
add esp, 0x200
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x643cd1f8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
cmp byte [eax + str.AslEnvGetSystem32DirPathBuf_failed___x_], 0
je 0x643cd219
inc eax
cmp eax, 0x2667
jne 0x643cd206
jmp 0x643cd235
cmp eax, 0x55c
jg 0x643cd235
mov eax, dword [0x643e8214]
add eax, 0x4cd8de5f
mov dword [0x643e7f80], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [0x643e8214]
mov esi, 0xff7535fd
xor edi, edi
xor eax, 0xe9091144
mov dword [0x643e7f80], eax
call fcn.643d4200
imul eax, dword [0x643e7f80], 0xcf08cb5d
mov dword [0x643e8214], eax
or eax, 0xd237ff4a
mov dword [0x643e7f80], eax
mov dword [esp + 4], eax
mov dword [esp], 0x643eb78c
call fcn.643cee3c
cmp byte [ebx + edi], 0
je 0x643cd307
mov edx, str.Specified_mode_pruning_algorithm_is_invalid
mov al, byte [edx]
test al, al
je 0x643cd2aa
sub eax, 0x30
cmp al, 9
jbe 0x643cd2a7
sub dword [0x643e7f80], 0x1ad98334
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x643cd2aa
inc edx
jmp 0x643cd288
mov edx, dword [0x643e7f80]
inc edi
mov eax, edx
and eax, 0x1dfe8591
mov dword [0x643e8214], eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.The_cluster_network_provider_is_not_valid.
call fcn.643d0c18
mov dword [esp], 0x643eb7fc
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, esi
imul eax, dword [0x643e7f80], 0x5bcda4aa
ror edx, 8
mov dword [0x643e8214], eax
movzx eax, word [ebx + edi - 1]
add eax, edx
xor esi, eax
jmp 0x643cd279
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x643cdbfc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x2203
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 0x10]
mov edx, ebx
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643cdc23
add ecx, eax
cmp ecx, 0x180d
jbe 0x643cdc0e
mov edx, ebx
mov ecx, 0x1f0d
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643cdc3f
add ecx, eax
cmp ecx, 0x1856
jbe 0x643cdc2a
mov dword [esp], 0xc33
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push eax
call esi
mov edx, ebx
mov ax, word [edx]
sub eax, 0x30
cmp ax, 9
ja 0x643cdc68
add edx, 2
jmp 0x643cdc57
call esi
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov edx, ebx
mov ecx, 0x2526
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643cdc8c
add ecx, eax
cmp ecx, 0x2408
jbe 0x643cdc77
mov ax, word [ebx]
sub eax, 0x30
cmp ax, 9
ja 0x643cdc9d
add ebx, 2
jmp 0x643cdc8c
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x643cdca4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
cmp word [eax + str.Failed_to_read_database_header], 0
je 0x643cdcde
add eax, 2
cmp eax, 0x2c22
jne 0x643cdcb1
lea eax, [ebx - 0x2aae9f88]
mov dword [0x643e7d80], eax
mov dword [esp], str.The_supplied_register_value_is_invalid.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
lea eax, [ebx - 0x214e99b2]
mov dword [0x643e7d80], eax
call dword [sym.imp.USER32.dll_AnyPopup]
mov eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor eax, 0x57442428
mov dword [0x643e7d80], eax
call esi
call esi
mov edx, str.Indicates_that_the_specified_image_is_already_loaded.
mov ecx, 0xc6b
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643cdd24
add ecx, eax
cmp ecx, 0x14b7
jbe 0x643cdd0f
mov eax, str.Kernel_MUI_Language_SKU
movzx esi, byte [eax]
lea edx, [esi - 0x30]
cmp dl, 9
ja 0x643cdd37
inc eax
jmp 0x643cdd29
mov edx, str.File_Type_Description
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x643cdd48
inc edx
jmp 0x643cdd3c
mov edx, str.AslPathToSystemPathBuf_failed___x_
mov ecx, 0x887
movzx eax, byte [edx]
inc edx
test al, al
je 0x643cdd64
add ecx, eax
cmp ecx, 0xf54
jbe 0x643cdd52
add ebx, 0x13e1f617
mov dword [0x643e7d80], ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x643cdd78
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [0x643e7fd0]
mov edx, eax
imul eax, eax, 0x8dd4db8b
or edx, 0xef5bf358
sub edx, 0x31c43e0e
mov dword [0x643e7d2c], edx
mov dword [0x643e7fd0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [sym.imp.USER32.dll_IsZoomed]
imul eax, dword [0x643e7fd0], 0x35961087
mov dword [esp], 0x821
mov dword [0x643e7fd0], eax
or eax, 0x5f7aef52
mov dword [0x643e7d2c], eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [0x643e7fd0]
xor eax, 0x3de5aea8
imul eax, eax, 0xbde9a966
add eax, 0x1e4a7a33
mov dword [0x643e7d2c], eax
and eax, 0x2065b560
mov dword [0x643e7fd0], eax
mov dword [esp], eax
call ebx
mov eax, dword [0x643e7d2c]
mov ebx, dword [ebp - 4]
push edx
and eax, 0x2c376888
xor eax, 0x205a4a16
sub eax, 0x4e79bdff
mov edx, eax
and eax, 0x9a836398
and edx, 0x8806380
xor eax, 0xb0a96019
mov dword [0x643e7fd0], edx
mov dword [0x643e7d2c], eax
leave
ret
Function at 0x643cdf04
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 0xc]
mov edx, ebx
mov ax, word [edx]
test ax, ax
je 0x643cdf39
sub eax, 0x30
cmp ax, 9
jbe 0x643cdf34
imul eax, dword [0x643e7df4], 0xf5f3e35b
mov dword [0x643e80a4], eax
jmp 0x643cdf39
add edx, 2
jmp 0x643cdf12
mov eax, dword [0x643e80a4]
mov ecx, dword [ebp + 8]
mov esi, 0x1bbc
and eax, 0xb23040e5
mov dword [0x643e81e8], eax
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x643cdf6f
add esi, edx
cmp esi, 0x19d0
jbe 0x643cdf50
or eax, 0xfa401f4d
mov dword [0x643e81e8], eax
mov edx, ebx
mov ecx, 0x1e72
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643cdf9a
add ecx, eax
cmp ecx, 0x658
jbe 0x643cdf76
imul eax, dword [0x643e81e8], 0xb299c7ca
mov dword [0x643e81e8], eax
mov eax, dword [0x643e81e8]
mov ecx, dword [ebp + 0x10]
lea edx, [eax - 0x146458a]
imul edx, edx, 0xf80a09bc
cmp word [ecx], 0
mov dword [0x643e7df4], edx
je 0x643cdfc6
add edx, 0x685714f9
mov dword [0x643e7df4], edx
and eax, 0x3f89625f
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
or eax, 0x22802044
mov dword [0x643e80a4], eax
call esi
mov eax, dword [0x643e7df4]
mov ecx, dword [ebp + 8]
add eax, 0x42187db6
or eax, 0xbda37c0b
mov dword [0x643e81e8], eax
mov dx, word [ecx]
test dx, dx
je 0x643ce017
sub edx, 0x30
cmp dx, 9
jbe 0x643ce012
imul eax, eax, 0xf3e026ae
mov dword [0x643e81e8], eax
jmp 0x643ce017
add ecx, 2
jmp 0x643cdff4
mov edx, dword [0x643e81e8]
mov edi, dword [ebp + 8]
lea eax, [edx + 0x3fa3d17e]
mov dword [0x643e7df4], eax
mov cx, word [edi]
sub ecx, 0x30
cmp cx, 9
ja 0x643ce03c
add edi, 2
jmp 0x643ce02b
imul edx, edx, 0xf8dd73d7
mov dword [0x643e81e8], edx
mov dx, word [ebx]
test dx, dx
je 0x643ce06a
sub edx, 0x30
cmp dx, 9
jbe 0x643ce065
and eax, 0x2a45c36c
mov dword [0x643e7df4], eax
jmp 0x643ce06a
add ebx, 2
jmp 0x643ce048
mov eax, dword [0x643e7df4]
and eax, 0xe047d1d9
mov dword [0x643e7df4], eax
or eax, 0xbe38f36d
mov dword [0x643e80a4], eax
call esi
xor eax, eax
mov edi, dword [ebp + 8]
cmp word [edi + eax*2], 0
je 0x643ce0a8
inc eax
cmp eax, 0xf35
jne 0x643ce087
mov eax, dword [0x643e80a4]
sub eax, 0x6bc96fab
mov dword [0x643e81e8], eax
mov eax, dword [0x643e81e8]
xor eax, 0x97772151
mov dword [0x643e80a4], eax
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x643ce10c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x643e7e2c]
mov edx, eax
sub eax, 0x29d1a4b6
or edx, 0xe77d3ea6
mov dword [0x643e7e2c], eax
mov dword [0x643e7ea0], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x643e7ea0]
mov ecx, str.0123456789ABCDEF
mov dx, word [ecx]
sub edx, 0x30
cmp dx, 9
ja 0x643ce150
add ecx, 2
jmp 0x643ce13f
sub eax, 0x7e40fdc1
mov dword [0x643e7e2c], eax
or eax, 0xdcbc7706
mov dword [0x643e7ea0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, dword [0x643e7e2c]
sub eax, 0x69333d8e
mov edx, eax
xor eax, 0xda200b73
xor edx, 0x5a65aa46
mov dword [0x643e7e2c], eax
mov dword [0x643e7ea0], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [0x643e7e2c]
add eax, 0x32c03f83
mov edx, eax
mov dword [0x643e7ea0], eax
xor edx, 0x32608982
mov dword [0x643e7e2c], edx
leave
ret
Function at 0x643ce448
Capabilities:
Identify system language via api

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x14
imul edx, dword [0x643e7fd8], 0x34d65112
mov dword [0x643e7e90], edx
cmp byte [eax + str.No_applicable_app_licenses_found.], 0
je 0x643ce492
inc eax
cmp eax, 0x569
jne 0x643ce461
mov eax, edx
mov dword [esp], edx
and eax, 0xaa93a291
add eax, 0x440e8a51
or eax, 0xea67e2b9
mov dword [0x643e7fd8], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
mov eax, dword [0x643e7e90]
mov ecx, str.An_invalid_level_was_passed_into_the_specified_system_call.
xor eax, 0xe88e667d
sub eax, 0x3319756d
or eax, 0xfeacf880
mov dword [0x643e7e90], eax
mov dl, byte [ecx]
test dl, dl
je 0x643ce4cd
sub edx, 0x30
cmp dl, 9
jbe 0x643ce4ca
xor eax, 0x4ab314e4
mov dword [0x643e7e90], eax
jmp 0x643ce4cd
inc ecx
jmp 0x643ce4b0
mov edx, dword [0x643e7e90]
lea eax, [edx - 0x45603fcd]
mov dword [0x643e7fd8], eax
xor eax, eax
cmp byte [eax + str.AlignMask], 0
je 0x643ce4fd
inc eax
cmp eax, 0x7c1
jne 0x643ce4e0
xor edx, 0x6ffaa21c
mov dword [0x643e7fd8], edx
mov eax, dword [0x643e7fd8]
xor edx, edx
sub eax, 0xe5b1b9a
imul eax, eax, 0x6713e570
xor eax, 0xdb5f13d2
mov dword [0x643e7fd8], eax
cmp word [edx + 0x643ebe20], 0
je 0x643ce538
add edx, 2
cmp edx, 0x414
jne 0x643ce519
and eax, 0xf6ccd71c
mov dword [0x643e7fd8], eax
mov edx, dword [0x643e7fd8]
mov eax, edx
or eax, 0x8f71e2ab
mov dword [0x643e7e90], eax
xor eax, eax
cmp byte [eax + str.An_operation_is_not_supported_on_a_directory.], 0
je 0x643ce569
inc eax
cmp eax, 0x1dd9
jne 0x643ce54c
imul edx, edx, 0xe11ab39a
mov dword [0x643e7e90], edx
mov eax, dword [0x643e7e90]
mov ebx, str.An_invalid_level_was_passed_into_the_specified_system_call.
or eax, 0x283721aa
mov edx, eax
xor eax, 0xd10dc9b2
xor edx, 0xeb569534
mov dword [0x643e7e90], eax
mov dword [0x643e7fd8], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
lea ecx, [eax - 0x7da5f0de]
mov dl, byte [ebx]
test dl, dl
je 0x643ce5c2
sub edx, 0x30
cmp dl, 9
jbe 0x643ce5bf
add eax, 0x503200d1
mov dword [0x643e7e90], eax
jmp 0x643ce5c2
inc ebx
jmp 0x643ce5a5
mov eax, ecx
mov ebx, dword [ebp - 4]
or eax, 0x8a022ca1
mov dword [0x643e7fd8], eax
leave
ret