joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019e2
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4221b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
cmp eax, 0x12
jg 0x401b6b
je 0x401b58
dec eax
cmp eax, 0x10
ja case.0x401a1a.2
jmp dword [eax*4 + 0x401cde]
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x76
jmp 0x401caf
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call esi
cmp eax, 0x404
je 0x401a5f
call esi
cmp eax, 0xc04
je 0x401a5f
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x7e
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x7f
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x79
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x77
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x7b
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x78
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xde
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xdf
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x11c
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xe4
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xe5
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xe6
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xe7
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x7c
jmp 0x401caf
cmp eax, 0x3e
jg case.0x401a1a.2
je 0x401c8e
cmp eax, 0x19
jg 0x401c1d
je 0x401c0a
sub eax, 0x13
je 0x401bf7
dec eax
je 0x401be1
dec eax
je 0x401bcb
dec eax
je 0x401bb5
dec eax
dec eax
jne case.0x401a1a.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xe0
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x80
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xdd
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xe3
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x7d
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x7a
jmp 0x401caf
sub eax, 0x1d
je 0x401c7b
dec eax
je 0x401c68
dec eax
je 0x401c55
dec eax
dec eax
je 0x401c42
dec eax
jne case.0x401a1a.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xe8
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xea
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xe1
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xe9
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xe2
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xeb
jmp 0x401caf
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x75
push dword [0x424900]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push eax
push 0x400
push edi
call fcn.0040963c
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.0040900b
leave
ret
Function at 0x401d22
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4221b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
cmp eax, 0x12
jg 0x401ec3
je 0x401ead
dec eax
cmp eax, 0x10
ja case.0x401d5a.2
jmp dword [eax*4 + 0x40203e]
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xb2
jmp 0x402010
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call esi
cmp eax, 0x404
je 0x401da5
call esi
cmp eax, 0xc04
je 0x401da5
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xb6
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xb7
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xb8
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xb5
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xbc
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xb9
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xbe
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xbf
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xc2
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xc5
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xc6
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xc7
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xc8
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xbb
jmp 0x402010
cmp eax, 0x3e
jg case.0x401d5a.2
je 0x401fec
cmp eax, 0x19
jg 0x401f7b
je 0x401f65
sub eax, 0x13
je 0x401f4f
dec eax
je 0x401f39
dec eax
je 0x401f23
dec eax
je 0x401f0d
dec eax
dec eax
jne case.0x401d5a.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xc0
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xb4
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xbd
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xc4
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xba
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xb3
jmp 0x402010
sub eax, 0x1d
je 0x401fd9
dec eax
je 0x401fc6
dec eax
je 0x401fb3
dec eax
dec eax
je 0x401fa0
dec eax
jne case.0x401d5a.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xc9
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xcb
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xc1
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xca
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xc3
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xcc
jmp 0x402010
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xb1
push dword [0x424900]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push eax
push 0x400
push edi
call fcn.0040963c
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.0040900b
leave
ret
Function at 0x402082
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4221b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
cmp eax, 0x12
jg 0x402223
je 0x40220d
dec eax
cmp eax, 0x10
ja case.0x4020ba.2
jmp dword [eax*4 + 0x40239e]
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x82
jmp 0x402370
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call esi
cmp eax, 0x404
je 0x402105
call esi
cmp eax, 0xc04
je 0x402105
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x8a
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x8b
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x85
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x83
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x87
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x84
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xed
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xee
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xf1
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xf4
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xf5
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xf6
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xf7
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x88
jmp 0x402370
cmp eax, 0x3e
jg case.0x4020ba.2
je 0x40234c
cmp eax, 0x19
jg 0x4022db
je 0x4022c5
sub eax, 0x13
je 0x4022af
dec eax
je 0x402299
dec eax
je 0x402283
dec eax
je 0x40226d
dec eax
dec eax
jne case.0x4020ba.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xef
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x8c
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xec
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xf3
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x89
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x86
jmp 0x402370
sub eax, 0x1d
je 0x402339
dec eax
je 0x402326
dec eax
je 0x402313
dec eax
dec eax
je 0x402300
dec eax
jne case.0x4020ba.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xf8
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xfa
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push pe_nt_image_headers32
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xf9
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xf2
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xfb
jmp 0x402370
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x81
push dword [0x424900]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push eax
push 0x400
push edi
call fcn.0040963c
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.0040900b
leave
ret
Function at 0x4023e2
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4221b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
cmp eax, 0x12
jg 0x402583
je 0x40256d
dec eax
cmp eax, 0x10
ja case.0x40241a.2
jmp dword [eax*4 + 0x4026fe]
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x8e
jmp 0x4026d0
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call esi
cmp eax, 0x404
je 0x402465
call esi
cmp eax, 0xc04
je 0x402465
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x96
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x97
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x91
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x8f
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x93
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x90
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xce
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xcf
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xd2
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xd5
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xd6
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xd7
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xd8
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x94
jmp 0x4026d0
cmp eax, 0x3e
jg case.0x40241a.2
je 0x4026ac
cmp eax, 0x19
jg 0x40263b
je 0x402625
sub eax, 0x13
je 0x40260f
dec eax
je 0x4025f9
dec eax
je 0x4025e3
dec eax
je 0x4025cd
dec eax
dec eax
jne case.0x40241a.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xd0
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x98
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xcd
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xd4
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x95
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x92
jmp 0x4026d0
sub eax, 0x1d
je 0x402699
dec eax
je 0x402686
dec eax
je 0x402673
dec eax
dec eax
je 0x402660
dec eax
jne case.0x40241a.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xd9
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xdb
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xd1
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xda
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xd3
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xdc
jmp 0x4026d0
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x8d
push dword [0x424900]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push eax
push 0x400
push edi
call fcn.0040963c
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.0040900b
leave
ret
Function at 0x402742
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4221b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
cmp eax, 0x12
jg 0x4028e3
je 0x4028cd
dec eax
cmp eax, 0x10
ja case.0x40277a.2
jmp dword [eax*4 + 0x402a5e]
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x9a
jmp 0x402a30
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call esi
cmp eax, 0x404
je 0x4027c5
call esi
cmp eax, 0xc04
je 0x4027c5
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xa2
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xa3
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x9d
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x9b
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x9f
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x9c
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xfd
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xfe
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x101
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x104
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x105
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x106
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x107
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xa0
jmp 0x402a30
cmp eax, 0x3e
jg case.0x40277a.2
je 0x402a0c
cmp eax, 0x19
jg 0x40299b
je 0x402985
sub eax, 0x13
je 0x40296f
dec eax
je 0x402959
dec eax
je 0x402943
dec eax
je 0x40292d
dec eax
dec eax
jne case.0x40277a.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xff
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xa4
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xfc
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x103
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xa1
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x9e
jmp 0x402a30
sub eax, 0x1d
je 0x4029f9
dec eax
je 0x4029e6
dec eax
je 0x4029d3
dec eax
dec eax
je 0x4029c0
dec eax
jne case.0x40277a.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x108
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x10a
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x100
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x109
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x102
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x10b
jmp 0x402a30
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x99
push dword [0x424900]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push eax
push 0x400
push edi
call fcn.0040963c
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.0040900b
leave
ret
Function at 0x402aa2
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4221b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
cmp eax, 0x12
jg 0x402c43
je 0x402c2d
dec eax
cmp eax, 0x10
ja case.0x402ada.2
jmp dword [eax*4 + 0x402dbe]
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xa6
jmp 0x402d90
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call esi
cmp eax, 0x404
je 0x402b25
call esi
cmp eax, 0xc04
je 0x402b25
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xae
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xaf
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xa9
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xa7
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xab
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xa8
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x10d
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x10e
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x111
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x114
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x115
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x116
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x117
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xac
jmp 0x402d90
cmp eax, 0x3e
jg case.0x402ada.2
je 0x402d6c
cmp eax, 0x19
jg 0x402cfb
je 0x402ce5
sub eax, 0x13
je 0x402ccf
dec eax
je 0x402cb9
dec eax
je 0x402ca3
dec eax
je 0x402c8d
dec eax
dec eax
jne case.0x402ada.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x10f
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xb0
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x10c
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x113
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xad
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xaa
jmp 0x402d90
sub eax, 0x1d
je 0x402d59
dec eax
je 0x402d46
dec eax
je 0x402d33
dec eax
dec eax
je 0x402d20
dec eax
jne case.0x402ada.2
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x118
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x11a
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x110
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x119
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x112
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x11b
jmp 0x402d90
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0xa5
push dword [0x424900]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push eax
push 0x400
push edi
call fcn.0040963c
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.0040900b
leave
ret
Function at 0x408bc3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor dh, al
test dword [edx + 0x21fffffc], ebx
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00407c81
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407c36
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00407c71
pop edx
inc ebx
pop ss
invalid
Function at 0x412c7d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040f420
mov ebx, dword [ebp + 8]
mov esi, eax
add esi, 0x9c
test ebx, ebx
jne 0x412c29
or dword [esi + 8], 0x104
jmp 0x412ce6
lea eax, [ebx + 0x40]
lea edi, [esi + 4]
mov dword [esi], ebx
mov dword [edi], eax
test eax, eax
je 0x412c4c
cmp byte [eax], 0
je 0x412c4c
push edi
push 0x16
push 0x41dc58
call fcn.00412646
add esp, 0xc
mov eax, dword [esi]
and dword [esi + 8], 0
test eax, eax
je 0x412ca9
cmp byte [eax], 0
je 0x412ca9
mov eax, dword [edi]
test eax, eax
je 0x412c6d
cmp byte [eax], 0
je 0x412c6d
call fcn.00412b5e
jmp 0x412c72
call fcn.00412bc5
cmp dword [esi + 8], 0
jne 0x412cfc
push esi
push 0x40
push 0x41da50
call fcn.00412646
add esp, 0xc
test eax, eax
je 0x412cf2
mov edi, dword [edi]
test edi, edi
je 0x412ca2
cmp byte [edi], 0
je 0x412ca2
call fcn.00412b5e
jmp 0x412cf2
call fcn.00412bc5
jmp 0x412cf2
mov edi, dword [edi]
test edi, edi
je 0x412cdf
cmp byte [edi], 0
je 0x412cdf
push edi
call fcn.004092a0
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x4127bf
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [esi + 8], 4
jne 0x412cf2
and dword [esi + 8], 0
jmp 0x412cf2
mov dword [esi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
cmp dword [esi + 8], 0
je 0x412deb
mov ecx, ebx
sub ebx, 0xffffff80
neg ecx
sbb ecx, ecx
and ecx, ebx
mov edi, esi
call fcn.004126a8
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x412deb
cmp edi, 0xfde8
je 0x412deb
cmp edi, 0xfde9
je 0x412deb
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x412deb
push 1
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x412deb
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x412d72
mov cx, word [esi + 0x18]
mov word [eax], cx
mov cx, word [esi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], di
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x412de6
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x412dae
push str.Norwegian_Nynorsk
push 0x40
push ebx
call fcn.0041034d
add esp, 0xc
test eax, eax
je 0x412dbf
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00409e35
add esp, 0x14
jmp 0x412dbf
push 0x40
push ebx
push 0x1001
push dword [esi + 0x18]
call edi
test eax, eax
je 0x412deb
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [esi + 0x1c]
call edi
test eax, eax
je 0x412deb
push 0xa
push 0x10
sub ebx, 0xffffff80
push ebx
push dword [ebp + 8]
call fcn.0040cabe
add esp, 0x10
xor eax, eax
inc eax
jmp 0x412ded
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4150e3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040f1cb
and dword [ebp - 4], 0
cmp dword [0x4243d8], 0
mov ebx, eax
jne 0x415194
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x415245
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x415245
push eax
call fcn.0040f159
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4243d8], eax
call esi
push eax
call fcn.0040f159
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4243dc], eax
call esi
push eax
call fcn.0040f159
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4243e0], eax
call esi
push eax
call fcn.0040f159
pop ecx
mov dword [0x4243e8], eax
test eax, eax
je 0x415194
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040f159
pop ecx
mov dword [0x4243e4], eax
mov eax, dword [0x4243e4]
cmp eax, ebx
je 0x4151ec
cmp dword [0x4243e8], ebx
je 0x4151ec
push eax
call fcn.0040f1d4
push dword [0x4243e8]
mov esi, eax
call fcn.0040f1d4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4151ec
test edi, edi
je 0x4151ec
call esi
test eax, eax
je 0x4151e3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4151e3
test byte [ebp - 0xc], 1
jne 0x4151ec
or dword [ebp + 0x10], 0x200000
jmp 0x415225
mov eax, dword [0x4243dc]
cmp eax, ebx
je 0x415225
push eax
call fcn.0040f1d4
pop ecx
test eax, eax
je 0x415225
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x415225
mov eax, dword [0x4243e0]
cmp eax, ebx
je 0x415225
push eax
call fcn.0040f1d4
pop ecx
test eax, eax
je 0x415225
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4243d8]
call fcn.0040f1d4
pop ecx
test eax, eax
je 0x415245
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x415247
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret