joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401900
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435488
push 0x42f730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x20], bl
mov dword [ebp - 0x1c], ebx
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharAlphaA]
mov byte [0x43bbcf], al
mov dword [ebp - 4], ebx
movsx eax, byte [0x43bbd1]
push eax
push dword [0x43bc08]
call fcn.004116ab
pop ecx
pop ecx
add word [0x43bbda], ax
push 1
pop eax
mov word [0x43bbde], ax
cmp byte [0x43bbcf], bl
je 0x401973
cmp dword [0x43bc0c], ebx
jne 0x401975
xor eax, eax
mov dword [0x43bc08], eax
push 0x4e
call fcn.00415e0d
pop ecx
call eax
test eax, 0x80000000
je 0x4019c9
dec word [0x43bbe0]
movsx eax, word [0x43bbda]
push eax
push 0x5a7bffff
call fcn.004118e8
mov byte [0x43bbcb], al
mov eax, dword fs:[0x20]
mov dword [ebp - 0x1c], eax
movsx eax, word [0x43bbe2]
push eax
push 0xa54fffff
call fcn.00411820
jmp 0x401ad2
movsx eax, word [0x43bbe4]
push eax
push 0x5ffff
call fcn.004116de
mov word [0x43bbd2], ax
push 0x26cbffff
push 0x6659ffff
call fcn.004117aa
add word [0x43bbd8], ax
movsx eax, word [0x43bbdc]
push eax
push eax
call fcn.0041172e
add esp, 0x18
mov byte [0x43bbca], al
push edx
push ecx
push ebx
nop
sub ecx, 0xb987ffff
add edx, ebx
sub edx, 0xffffff
sub edx, 0x2aefffff
add edx, ecx
pop ebx
pop ecx
pop edx
mov ebx, dword fs:[0x30]
push edx
push ecx
push ebx
push eax
add ecx, 0xc8b3ffff
sub eax, ecx
inc edx
and ebx, ecx
add edx, ecx
mov edx, ecx
pop eax
pop ebx
pop ecx
pop edx
mov bl, byte [ebx + 2]
push edx
push ecx
xor edx, 0xfa11ffff
add edx, edx
xor ecx, 0xe47ffff
dec edx
pop ecx
pop edx
movzx ebx, bl
push edx
push ecx
push ebx
push eax
nop
sub ebx, ebx
inc eax
inc eax
add ecx, 0x966dffff
add edx, 0x35b9ffff
pop eax
pop ebx
pop ecx
pop edx
mov dword [ebp - 0x1c], ebx
push edx
push ecx
push ebx
push eax
or ecx, 0xae73ffff
and ebx, edx
or ecx, 0x345dffff
inc ebx
dec eax
dec eax
pop eax
pop ebx
pop ecx
pop edx
movsx eax, byte [0x43bbcb]
add eax, dword [0x43bbec]
mov word [0x43bbd2], ax
push 0x102dffff
movsx eax, byte [0x43bbc8]
push eax
call fcn.00411856
mov byte [0x43bbd1], al
movsx eax, word [0x43bbe0]
push eax
push 0x7bc3ffff
call fcn.00411762
add esp, 0x10
mov dword [0x43bc08], eax
jmp 0x401b19
or dword [ebp - 4], 0xffffffff
movsx eax, word [0x43bbde]
or eax, 0x7e0bffff
add dword [0x43bc0c], eax
cmp dword [ebp - 0x1c], 0
je 0x401b39
mov byte [ebp - 0x20], 1
mov al, byte [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402115
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x42fe09
call fcn.0042f6e0
sub esp, 0x10
push ebx
xor ebx, ebx
cmp word [0x43bbd8], bx
jne 0x40213a
cmp byte [0x43bbce], bl
jne 0x40213a
xor eax, eax
jmp 0x40213d
push 1
pop eax
add byte [0x43bbd1], al
push dword [0x43bc0c]
movsx eax, byte [0x43bbc9]
push eax
call fcn.00411762
mov dword [0x43bc00], eax
lea eax, [ebp - 0x1c]
push 6
push eax
call fcn.0040b3f4
push 0x3c
mov dword [ebp - 4], ebx
call fcn.00415e0d
push 0x48
call fcn.00415e0d
push 0x3d
call fcn.00415e0d
add esp, 0x1c
cmp dword [0x43b894], ebx
jne 0x402196
push 0x3d
call fcn.00415e0d
pop ecx
mov dword [0x43b894], eax
movsx eax, byte [0x43bbcf]
imul eax, eax, 0x805bffff
add dword [0x43bc04], eax
movsx eax, byte [0x43bbc8]
push eax
push 0xf9ffff
call fcn.0041172e
add word [0x43bbd8], ax
mov al, byte [0x43bbd0]
pop ecx
dec al
add byte [0x43bbcc], al
pop ecx
push ebx
push 0x59
call fcn.00415e0d
pop ecx
call eax
mov eax, dword [0x43b890]
cmp eax, ebx
jne 0x4021f2
push 0x3c
call fcn.00415e0d
pop ecx
mov dword [0x43b890], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
jne 0x4021ff
mov ecx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push ecx
push ebx
push ebx
call eax
push 0x48
mov dword [0x43b88c], eax
call fcn.00415e0d
pop ecx
call eax
cmp eax, 0xb7
jne 0x40227e
push 0x3e3fffff
push 0x577dffff
call fcn.004116de
push dword [0x43bbf0]
mov byte [0x43bbcd], al
push 0xffa9ffff
call fcn.00411762
add esp, 0x10
mov byte [0x43bbcf], al
call fcn.004022e2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
add word [0x43bbdc], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xf821ffff
push 0xd11fffff
mov word [0x43bbde], ax
call fcn.00411856
add word [0x43bbe4], ax
pop ecx
pop ecx
jmp 0x4022c4
movsx eax, word [0x43bbd2]
push dword [0x43bbe8]
push eax
call fcn.00411820
add word [0x43bbe2], ax
mov al, byte [0x43bbe0]
or al, byte [0x43bbcb]
mov byte [0x43bbce], al
movsx eax, byte [0x43bbc9]
push eax
push 0xc34bffff
call fcn.00411856
add esp, 0x10
mov dword [0x43bc00], eax
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x406e52
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 4
push 0x40
mov dword [ebp - 8], eax
call fcn.00415e0d
pop ecx
call eax
mov edi, eax
cmp edi, 0xffffffff
je 0x406eff
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x406ef4
push esi
cmp dword [ebp - 0x24], 0x10
jb 0x406ede
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jne 0x406ede
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
je 0x406ede
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x406ede
cmp byte [ebp + 8], 0
push esi
je 0x406ecd
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x406ed3
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
push 0x37
call fcn.00415e0d
pop ecx
call eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x406e96
pop esi
push edi
push 0x37
call fcn.00415e0d
pop ecx
call eax
pop edi
leave
ret
Function at 0x40851f
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x4302d1
call fcn.0042f6e0
push ecx
push ecx
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], esi
push ebx
mov byte [esi], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x10]
push ebx
mov dword [ebp - 4], ebx
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x20]
push ebx
mov byte [ebp - 4], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x30]
push ebx
mov byte [ebp - 4], 2
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x40]
push ebx
mov byte [ebp - 4], 3
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x50]
push ebx
mov byte [ebp - 4], 4
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], 0x64
mov byte [esi + 0x7c], bl
mov byte [esi + 0x7d], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x409f8f
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x430351
call fcn.0042f6e0
sub esp, 0x10
movsx eax, word [0x43bbe4]
push esi
push eax
push dword [0x43bc04]
call fcn.004118e8
pop ecx
mov byte [0x43bbce], al
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add word [0x43bbe2], ax
mov al, byte [ebp + 0xb]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov esi, 0x43b9bc
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call fcn.0040a01e
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov esi, eax
push 1
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40a7a6
Capabilities:
Set registry value

Disassembly:
mov eax, 0x430402
call fcn.0042f6e0
sub esp, 0x20
mov ax, word [0x43bbd6]
push ebx
push esi
mov esi, ecx
dec ax
xor ebx, ebx
mov word [0x43bbda], ax
cmp dword [esi + 0xf4], ebx
je 0x40a8fd
push 0x80f5ffff
push 0x65fbffff
call fcn.004118e8
mov dword [0x43bc04], eax
lea eax, [ebp - 0x1c]
push 2
push eax
call fcn.0042029f
cmp dword [0x43bc0c], ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
setne al
mov byte [0x43bbc8], al
xor eax, eax
cmp dword [0x43bc04], ebx
setne al
add byte [0x43bbd0], al
lea eax, [ebp - 0x2c]
push eax
call fcn.0042c1b8
add esp, 0x18
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov byte [ebp - 4], 1
push dword [ecx]
lea ecx, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
movsx eax, word [0x43bbd8]
push eax
movsx eax, byte [0x43bbc8]
push eax
call fcn.004116ab
pop ecx
mov word [0x43bbde], ax
pop ecx
push 0x7e53ffff
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
add dword [0x43bc04], eax
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharUpperA]
add word [0x43bbda], ax
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x40a891
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp + 0xc]
push 4
push ecx
push 4
push ebx
push eax
push dword [esi + 0xf4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov al, byte [0x43bbca]
push 0x883fffff
and al, byte [0x43bbd1]
movsx ax, al
mov word [0x43bbd4], ax
movsx eax, word [0x43bbd2]
push eax
call fcn.004118e8
push dword [0x43bc08]
mov word [0x43bbde], ax
push 0x5241ffff
call fcn.00411762
add word [0x43bbde], ax
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea ecx, [ebp - 0x1c]
push 1
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x412018
Capabilities:
Get storage device properties
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x560
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
push 0x3a
call fcn.00415e0d
pop ecx
call eax
mov dword [ebp + 8], eax
mov al, byte [0x43bbda]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerA]
mov dword [0x43bbf8], eax
movsx eax, word [0x43bbde]
push eax
push 0xaae7ffff
call fcn.00411762
add byte [0x43bbcf], al
movsx eax, byte [0x43bbcd]
push eax
movsx eax, byte [0x43bbcb]
push eax
call fcn.0041172e
add esp, 0x10
cmp dword [ebp + 8], 0xffffffff
mov byte [0x43bbc9], al
je 0x41223c
movsx eax, word [0x43bbd8]
push esi
push edi
push eax
mov dword [ebp - 0xc], ebx
movsx eax, byte [0x43bbca]
push eax
call fcn.004116de
add dword [0x43bbe8], eax
or ax, 0xffff
sub ax, word [0x43bbe2]
add word [0x43bbe4], ax
mov eax, dword [0x43bbf8]
push eax
push eax
call fcn.00411856
mov edi, 0xad
mov dword [0x43bbfc], eax
push edi
lea eax, [ebp - 0xbc]
push ebx
push eax
call sub.MSVCRT.dll_memset
movsx ax, byte [0x43bbcf]
and ax, word [0x43bbe4]
or byte [0x43bbcd], 0xff
push 0x869fffff
mov dword [ebp - 0xbc], ebx
mov word [0x43bbd4], ax
xor eax, eax
cmp byte [0x43bbd0], bl
mov word [0x43bbde], 1
mov dword [ebp - 0xb8], ebx
setne al
add word [0x43bbe4], ax
movsx eax, word [0x43bbda]
push eax
call fcn.004118a0
add word [0x43bbd4], ax
mov esi, 0x4a1
push esi
lea eax, [ebp - 0x560]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0xc9b5ffff
push 0xd505ffff
call fcn.00411856
add dword [0x43bc0c], eax
mov al, byte [0x43bbdc]
imul byte [0x43bbcf]
add byte [0x43bbcd], al
push dword [0x43bbf0]
movsx eax, byte [0x43bbcc]
or word [0x43bbe0], 0xffff
push eax
call fcn.004117d2
add word [0x43bbe2], ax
add esp, 0x40
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x560]
push esi
push eax
lea eax, [ebp - 0xbc]
push edi
push eax
push 0x2d1400
push dword [ebp + 8]
push 0x63
call fcn.00415e0d
pop ecx
call eax
pop edi
pop esi
test eax, eax
je 0x4121f1
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x560]
push eax
call fcn.00411b88
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [0x43bbe2], ax
movsx eax, word [0x43bbd6]
movsx ecx, byte [0x43bbcc]
push dword [ebp + 8]
and eax, ecx
mov dword [0x43bbe8], eax
push 0x37
call fcn.00415e0d
pop ecx
call eax
push dword [0x43bbec]
push 0x4ae1ffff
call fcn.00411820
mov dword [0x43bbe8], eax
pop ecx
movsx eax, byte [0x43bbd1]
or eax, 0xdd35ffff
pop ecx
add dword [0x43bbfc], eax
call dword [sym.imp.USER32.dll_GetInputState]
mov dword [0x43bbf0], eax
movsx eax, byte [0x43bbce]
push eax
movsx eax, byte [0x43bbc8]
push eax
call fcn.00411762
mov byte [0x43bbd1], al
pop ecx
movsx ax, byte [0x43bbce]
inc eax
pop ecx
mov word [0x43bbd8], ax
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4
Function at 0x41f0f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
xor eax, eax
cmp dword [0x43bc04], ebx
push esi
push edi
setne al
mov dword [0x43bc04], eax
mov al, byte [0x43bbde]
dec al
push 0x68e7ffff
add byte [0x43bbd0], al
movsx eax, byte [0x43bbc8]
push eax
call fcn.0041172e
pop ecx
mov word [0x43bbde], ax
pop ecx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsx ax, byte [0x43bbcc]
and ax, word [0x43bbe2]
mov esi, dword [ebp + 8]
xor edx, edx
mov word [0x43bbde], ax
mov eax, esi
div dword [ebp - 0x24]
cmp dword [0x43bc08], ebx
mov edi, edx
je 0x41f172
cmp dword [0x43bc04], ebx
je 0x41f172
push 1
pop eax
jmp 0x41f174
xor eax, eax
add dword [0x43bc00], eax
push 0x82b3ffff
push 0xfe37ffff
call fcn.00411856
add byte [0x43bbc8], al
pop ecx
sub esi, edi
cmp dword [0x43bc0c], ebx
pop ecx
jne 0x41f1a4
cmp word [0x43bbdc], bx
je 0x41f1a7
push 1
pop ebx
add dword [0x43bbf8], ebx
push 0x1185ffff
push dword [0x43bbe8]
call fcn.004117aa
add word [0x43bbe0], ax
movsx eax, byte [0x43bbcf]
push eax
push 0x4f39ffff
call fcn.00411762
add dword [0x43bc0c], eax
add esp, 0x10
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
add edi, eax
push 0x40
push edi
push esi
push 0x5f
call fcn.00415e0d
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4226eb
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x431724
call fcn.0042f6e0
sub esp, 0x10
push ebx
push esi
push edi
push 0x22ffffff
push dword [0x43bbf0]
mov esi, ecx
call fcn.004118e8
pop ecx
lea ebx, [esi + 0x20]
pop ecx
mov dword [0x43bbfc], eax
push ebx
push 0x42
mov dword [ebp - 0x18], ebx
call fcn.00415e0d
pop ecx
call eax
mov eax, dword [0x43bbe8]
mov ecx, dword [0x43bc08]
and dword [ebp - 4], 0
push 0x2c9fffff
lea ecx, [ecx + eax + 0x598dffff]
push eax
mov dword [0x43bc08], ecx
call fcn.00411856
pop ecx
mov dword [0x43bbe8], eax
pop ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004232bb
cmp byte [0x43bbd0], 0
push 0x57f5ffff
push 0xfdf1ffff
setne al
mov byte [0x43bbd0], al
call fcn.004118a0
push 0x752fffff
push 0xd74bffff
mov dword [0x43bbf8], eax
call fcn.004116ab
add word [0x43bbe2], ax
mov eax, dword [esi + 4]
add esp, 0x10
cmp dword [ebp - 0x10], eax
je 0x422841
add dword [0x43bc04], 0x7dabfffe
push 0x1f65ffff
push 0xb64dffff
call fcn.0041172e
mov dword [0x43bbe8], eax
pop ecx
movsx eax, byte [0x43bbcb]
and eax, dword [0x43bbf4]
pop ecx
mov dword [0x43bc04], eax
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 0x10]
test edi, edi
je 0x4227f8
push 1
lea ecx, [edi + 4]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push edi
call fcn.0042f63c
pop ecx
mov al, byte [0x43bbce]
push 0x1a6fffff
add byte [0x43bbcd], al
push 0x7b03ffff
call fcn.004116de
push dword [0x43bbf0]
mov byte [0x43bbce], al
movsx eax, byte [0x43bbcb]
push eax
call fcn.004118a0
add dword [0x43bbfc], eax
add esp, 0x10
lea eax, [ebp - 0x1c]
mov ecx, esi
push dword [ebp - 0x10]
push eax
call fcn.00422ed4
movsx eax, word [0x43bbde]
push 0x1b35ffff
push eax
call fcn.00411820
push dword [0x43bbf0]
mov byte [0x43bbc9], al
movsx eax, word [0x43bbd2]
push eax
mov byte [0x43bbd0], 1
call fcn.004117d2
add byte [0x43bbca], al
add esp, 0x10
lea eax, [ebp + 8]
lea edi, [esi + 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.00423623
movsx eax, byte [0x43bbd1]
shl eax, 1
mov dword [0x43bbf8], eax
mov al, byte [0x43bbce]
shl al, 1
add al, byte [0x43bbd0]
mov byte [0x43bbce], al
mov esi, dword [esi + 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x422935
mov esi, dword [eax + 0x10]
test esi, esi
je 0x4228cc
mov ecx, esi
call fcn.00422225
push esi
call fcn.0042f63c
pop ecx
push 0xd9bfffff
push 0xe459ffff
call fcn.004117aa
pop ecx
mov word [0x43bbdc], ax
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push dword [ebp - 0x14]
mov dword [0x43bc00], eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.004232f5
or ax, 0xffff
push 0xf0adffff
sub ax, word [0x43bbd4]
push dword [0x43bbe8]
mov word [0x43bbd8], ax
call fcn.0041172e
pop ecx
pop ecx
mov cx, ax
mov al, byte [0x43bbe2]
imul cl
mov word [0x43bbd6], cx
mov byte [0x43bbcf], al
or dword [ebp - 4], 0xffffffff
push ebx
push 0x53
call fcn.00415e0d
pop ecx
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4256a0
Capabilities:
Hash data with md5
Identify system language via api

Disassembly:
movsx eax, word [0x43bbda]
push esi
push 0x84cdffff
mov esi, ecx
push eax
call fcn.0041172e
push 0x1761ffff
mov byte [0x43bbce], al
push dword [0x43bbf8]
call fcn.004116de
mov word [0x43bbd6], ax
push 8
lea eax, [esi + 0x10]
push 0
push eax
call sub.MSVCRT.dll_memset
mov dword [esi], 0x67452301
push 0x91a3ffff
movsx eax, byte [0x43bbd0]
push eax
call fcn.00411856
add esp, 0x24
mov dword [0x43bbec], eax
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
add dword [0x43bc04], eax
movsx eax, byte [0x43bbc9]
push eax
push dword [0x43bbe8]
call fcn.004118e8
mov dword [0x43bc0c], eax
push 0xf9b3ffff
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
push 0xa069ffff
mov byte [0x43bbca], 1
call fcn.004118e8
mov word [0x43bbde], ax
mov al, byte [0x43bbe2]
add esp, 0x10
dec al
mov byte [0x43bbca], al
mov dword [esi + 0xc], 0x10325476
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
add word [0x43bbd2], ax
cmp word [0x43bbd4], 0
pop esi
jne 0x425787
cmp byte [0x43bbcc], 0
jne 0x425787
xor eax, eax
jmp 0x42578a
push 1
pop eax
add word [0x43bbda], ax
inc word [0x43bbdc]
ret
Function at 0x425799
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
inc dword [0x43bc00]
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
add dword [0x43bc04], eax
push 0xffffffffffffffff
call ebx
mov dword [0x43bc04], eax
mov edi, dword [esi + 0x10]
movsx eax, byte [0x43bbcb]
push eax
movsx eax, word [0x43bbd2]
shr edi, 3
push eax
and edi, 0x3f
call fcn.00411856
add word [0x43bbdc], ax
pop ecx
pop ecx
push 0xffffffffffffffff
call ebx
mov ebx, dword [ebp + 0xc]
add word [0x43bbe2], ax
add dword [0x43bbf4], 0x117bfffe
mov eax, ebx
shl eax, 3
add dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
mov ecx, ebx
shl ecx, 3
cmp eax, ecx
jae 0x425818
inc dword [esi + 0x14]
cmp byte [0x43bbc9], 0
je 0x425835
cmp byte [0x43bbc8], 0
je 0x425835
mov word [0x43bbd8], 1
jmp 0x42583d
and word [0x43bbd8], 0
movsx eax, word [0x43bbd2]
push 0xd5e5ffff
push eax
call fcn.004117d2
add word [0x43bbd4], ax
or word [0x43bbd8], 0xffff
pop ecx
mov eax, ebx
pop ecx
shr eax, 0x1d
add dword [esi + 0x14], eax
push 0x40
pop eax
sub eax, edi
mov dword [ebp + 0xc], eax
movsx eax, byte [0x43bbcb]
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
inc eax
mov word [0x43bbdc], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [0x43bbd6], ax
mov al, byte [0x43bbd0]
or al, byte [0x43bbc8]
add byte [0x43bbcc], al
cmp ebx, dword [ebp + 0xc]
jb 0x425946
movsx eax, byte [0x43bbcb]
push 0x9943ffff
push eax
call fcn.004118a0
push dword [ebp + 0xc]
mov byte [0x43bbce], al
lea eax, [edi + esi + 0x18]
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x14
inc byte [0x43bbcd]
lea eax, [esi + 0x18]
mov ecx, esi
push eax
call fcn.00425b96
movsx eax, byte [0x43bbcb]
push 0x54f9ffff
push eax
call fcn.0041172e
add byte [0x43bbc8], 0xfe
mov dword [0x43bc00], eax
mov eax, dword [ebp + 0xc]
pop ecx
mov dword [ebp + 0xc], eax
add eax, 0x3f
cmp eax, ebx
pop ecx
jae 0x42592f
mov edi, eax
mov eax, dword [ebp + 8]
mov ecx, esi
lea eax, [eax + edi - 0x3f]
push eax
call fcn.00425b96
add dword [ebp + 0xc], 0x40
add edi, 0x40
cmp edi, ebx
jb 0x425915
dec byte [0x43bbca]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
mov byte [0x43bbc9], al
xor edi, edi
jmp 0x42594a
and dword [ebp + 0xc], 0
call dword [sym.imp.USER32.dll_GetInputState]
mov byte [0x43bbc9], al
movsx eax, al
push eax
push 0x917dffff
call fcn.004118e8
add byte [0x43bbd1], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
inc word [0x43bbe2]
sub ebx, eax
add eax, ecx
push ebx
push eax
lea eax, [edi + esi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
movsx eax, byte [0x43bbc9]
push eax
push 0x3ad9ffff
call fcn.004117aa
mov dword [0x43bbfc], eax
movsx eax, word [0x43bbd8]
push eax
movsx eax, word [0x43bbe4]
push eax
call fcn.004116ab
add esp, 0x24
add dword [0x43bbf0], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8