joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a7ec
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [0x4294d0]
sub eax, 0x35bade2e
and eax, 0xd4892040
or eax, 0x94810000
mov dword [0x4294d0], eax
cmp word [edx + str.STATUS_ABANDONED_WAIT_0], 0
je 0x40a84e
add edx, 2
cmp edx, 0x14b6
jne 0x40a80e
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.The_information_supplied_by_the_GPIO_client_driver_is_invalid.
mov dword [esp + 4], str.The_time_interval_is_not_valid.
mov dword [esp], eax
call fcn.00412a74
imul eax, dword [0x4294d0], 0x410f7695
mov dword [0x4294d0], eax
mov dword [esp], 0xc02
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextLengthW]
and dword [0x4294d0], 0x70a420d2
call ebx
and dword [0x4294d0], 0x54f26cd3
push edx
call fcn.00408378
call fcn.00408f54
imul eax, dword [0x4294d0], 0x3d4c4c1
xor eax, 0x230668d5
mov dword [0x4294d0], eax
call fcn.004088d0
mov edx, str.STATUS_ABANDONED_WAIT_0
mov ecx, 0x1b5b
xor dword [0x4294d0], 0xd52ad174
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40a8cd
add ecx, eax
cmp ecx, 0x2186
jbe 0x40a8a9
call fcn.00410d24
and dword [0x4294d0], 0x58a95763
mov eax, dword [0x4294d0]
sub eax, 0x1a43c34f
imul eax, eax, 0x9a50589d
mov dword [0x4294d0], eax
call fcn.00407ffc
call fcn.00407e60
mov edx, str.The_information_supplied_by_the_GPIO_client_driver_is_invalid.
mov ecx, 0x6c8
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40a941
add ecx, eax
cmp ecx, 0x93b
jbe 0x40a8f6
mov eax, dword [0x4294d0]
mov dword [esp + 8], str.Invalid_heap_signature_for_heap_at__p
mov dword [esp + 4], str.The_time_interval_is_not_valid.
mov dword [esp + 0xc], eax
mov dword [esp], eax
call fcn.00412a74
imul eax, dword [0x4294d0], 0x2e11ffb9
mov dword [0x4294d0], eax
mov dword [esp], eax
call ebx
push eax
mov eax, dword [0x4294d0]
and eax, 0x9cff3c15
or eax, 0x234e74e4
mov dword [0x4294d0], eax
call fcn.00408db4
mov eax, dword [0x4294d0]
mov dword [esp + 8], str.Invalid_heap_signature_for_heap_at__p
mov dword [esp + 4], str.The_time_interval_is_not_valid.
and eax, 0x986be20e
add eax, 0x3d9da32
and eax, 0x91c5006b
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [0x4294d0], eax
call fcn.00412a74
call fcn.0040919c
call fcn.004081a4
mov dword [esp + 8], str.The_time_interval_is_not_valid.
imul eax, dword [0x4294d0], 0x78cc49c6
mov dword [esp + 4], str.Invalid_heap_signature_for_heap_at__p
mov dword [esp], str.Invalid_heap_signature_for_heap_at__p
mov dword [0x4294d0], eax
call fcn.00413cc8
mov eax, dword [0x4294d0]
or eax, 0xd24d3ebf
sub eax, 0x12fd2b0e
mov dword [0x4294d0], eax
call fcn.0040861c
call fcn.00407c04
mov ebx, dword [ebp - 4]
leave
jmp fcn.00408ae0
Function at 0x40d6cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x13
push ebx
xor ebx, ebx
sub esp, 0xac
mov dword [ebp - 0x90], 0x4d
mov dword [ebp - 0x8c], 0x38
mov dword [ebp - 0x88], 0xffffff68
mov edx, str.There_are_not_enough_resources_to_complete_the_operation.
mov ecx, 0x6d6
movzx eax, byte [edx]
inc edx
test al, al
je 0x40d72d
add ecx, eax
cmp ecx, 0x6a2
jbe 0x40d707
call fcn.0041373c
imul eax, dword [0x429428], 0x61737e9
mov dword [0x429428], eax
sub dword [0x429428], 0x731d4fb0
mov dword [esp], str.FallbackError
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov eax, dword [0x429428]
add esi, dword [ebp + ebx*4 - 0x90]
inc ebx
and eax, 0x2714e4a9
mov dword [ebp - 0x9c], esi
or eax, 0x2700a409
xor eax, 0xdefed39a
mov dword [0x429428], eax
mov edx, eax
cmp ebx, 3
jne 0x40d6fd
lea edi, [ebp - 0x84]
mov esi, 0x416108
mov ecx, 5
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ebx, 9
sub ebx, dword [ebp + eax*4 - 0x84]
inc eax
xor edx, 0x416b327f
cmp eax, 5
jne 0x40d78c
xor eax, eax
lea edi, [ebp - 0x6c]
mov ecx, 0x15
sub edx, 0x49a36f00
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x9c]
or edx, 0x985e1dc5
mov dword [0x429428], edx
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
mov dword [0x41611c], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040d314
mov eax, dword [0x41611c]
cmp dword [eax], ebx
je 0x40d7ed
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040d7f8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40da1c
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x200
mov ebx, dword [ebp + 0x10]
mov eax, ecx
mov byte [ebp + ecx - 0x10c], cl
cdq
idiv dword [ebp + 0x14]
mov al, byte [ebx + edx]
mov byte [ebp + ecx - 0x20c], al
inc ecx
cmp ecx, 0x100
jne 0x40da2d
xor ebx, ebx
xor edx, edx
mov esi, 0x100
movzx eax, byte [ebp + ebx - 0x10c]
mov ecx, eax
add eax, edx
movzx edx, byte [ebp + ebx - 0x20c]
add eax, edx
cdq
idiv esi
mov al, byte [ebp + edx - 0x10c]
mov byte [ebp + edx - 0x10c], cl
mov byte [ebp + ebx - 0x10c], al
inc ebx
cmp ebx, 0x100
jne 0x40da56
xor esi, esi
xor ebx, ebx
xor ecx, ecx
mov edi, 0x100
cmp esi, dword [ebp + 0xc]
jge 0x40daf0
lea eax, [ebx + 1]
cdq
idiv edi
movzx eax, byte [ebp + edx - 0x10c]
mov ebx, edx
add eax, ecx
cdq
idiv edi
mov al, byte [ebp + edx - 0x10c]
mov ecx, edx
mov dl, byte [ebp + ebx - 0x10c]
mov byte [ebp + ecx - 0x10c], dl
mov edx, dword [ebp + 8]
mov byte [ebp + ebx - 0x10c], al
add al, byte [ebp + ecx - 0x10c]
movzx eax, al
mov al, byte [ebp + eax - 0x10c]
xor al, byte [edx + esi]
mov edx, dword [ebp + 0x18]
mov byte [edx + esi], al
inc esi
jmp 0x40da98
add esp, 0x200
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40e864
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov ax, word [edx]
test ax, ax
je 0x40e89f
sub eax, 0x30
cmp ax, 9
jbe 0x40e89a
mov eax, dword [0x429550]
or eax, 0xe46c11eb
mov dword [0x42936c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e89f
add edx, 2
jmp 0x40e872
mov edx, dword [0x42936c]
lea eax, [edx - 0x62425a8f]
mov dword [0x429704], eax
xor eax, eax
cmp word [esi + eax*2], 0
je 0x40e8cd
inc eax
cmp eax, 0x1e07
jne 0x40e8b2
add edx, 0x4503a683
mov dword [0x429550], edx
imul eax, dword [0x4295d4], 0xb9febce2
mov dword [0x42936c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [0x4295d4]
lea edx, [eax - 0x26803779]
xor eax, 0xde635f73
mov dword [0x42936c], edx
mov dword [0x429704], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, ebx
imul eax, dword [0x429704], 0x9951536c
mov dword [0x429704], eax
mov ax, word [edx]
test ax, ax
je 0x40e93b
sub eax, 0x30
cmp ax, 9
jbe 0x40e936
mov eax, dword [0x429550]
sub eax, 0x18f81387
mov dword [0x429704], eax
jmp 0x40e93b
add edx, 2
jmp 0x40e914
mov eax, dword [0x429550]
mov edx, dword [0x429704]
mov esi, ebx
lea ecx, [eax - 0x17154654]
and edx, 0xd51ce03f
imul eax, eax, 0xb458648c
mov dword [0x42936c], edx
mov dword [0x429550], ecx
xor eax, 0xf3089125
or eax, 0xfbf5f35f
mov dword [0x4295d4], eax
mov cx, word [esi]
test cx, cx
je 0x40e999
sub ecx, 0x30
cmp cx, 9
jbe 0x40e994
xor edx, 0x1970ae89
mov dword [0x42936c], edx
jmp 0x40e999
add esi, 2
jmp 0x40e975
sub eax, 0x732fb6e8
mov dword [0x429704], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul edx, eax, 0xd542982e
mov dword [0x42936c], edx
mov cx, word [ebx]
test cx, cx
je 0x40e9d8
sub ecx, 0x30
cmp cx, 9
jbe 0x40e9d3
imul eax, eax, 0xd41878e6
mov dword [0x429550], eax
jmp 0x40e9d8
add ebx, 2
jmp 0x40e9b5
and edx, 0xe1961799
pop ebx
pop esi
mov dword [0x4295d4], edx
pop ebp
jmp dword [sym.imp.USER32.dll_GetMessageTime]

Function at 0x40eaac
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ecx, 0x32c
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov edx, ebx
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40ead2
add ecx, eax
cmp ecx, 0x1943
jbe 0x40eabd
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [ebp + 0x10]
or eax, 0x22cc5c05
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, ebx
push ecx
mov ecx, 0x1903
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40eb06
add ecx, eax
cmp ecx, 0x3f0
jbe 0x40eaf1
mov eax, dword [ebp + 0xc]
or eax, 0x20a5fa23
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
push edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ax, word [ebx]
sub eax, 0x30
cmp ax, 9
ja 0x40eb2f
add ebx, 2
jmp 0x40eb1e
mov dword [esp], str.AslEnvGetSystem32DirPathBuf
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
leave
or eax, 0x5c9cb42d
ret
Function at 0x40eec8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edx, ebx
mov al, byte [edx]
test al, al
je 0x40eefd
sub eax, 0x30
cmp al, 9
jbe 0x40eefa
mov eax, dword [str.eQ_d5]
and eax, 0x180c91ff
mov dword [0x4293f0], eax
jmp 0x40eefd
inc edx
jmp 0x40eedc
sub dword [str.eQ_d5], 0x67b37d3d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ax, word [edi]
sub eax, 0x30
cmp ax, 9
ja 0x40ef1e
add edi, 2
jmp 0x40ef0d
mov edx, 0x1403
movzx eax, word [esi]
add esi, 2
test ax, ax
je 0x40ef38
add edx, eax
cmp edx, 0xc13
jbe 0x40ef23
mov eax, dword [0x42942c]
mov dl, byte [ebx]
test dl, dl
je 0x40ef62
sub edx, 0x30
cmp dl, 9
jbe 0x40ef5f
lea edx, [eax + 0x5187cb5a]
imul edx, edx, 0x4ac6970a
mov dword [0x4293f0], edx
jmp 0x40ef62
inc ebx
jmp 0x40ef3d
xor eax, 0xb4bed023
sub eax, 0x3b96f7b5
mov dword [str.eQ_d5], eax
mov eax, dword [0x4293f0]
xor eax, 0x3d3b770d
mov dword [0x42942c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [eax + 0x191d60fa]
mov dword [0x42942c], edx
lea edx, [eax - 0x28f7d5c2]
add eax, 0x39e50070
mov dword [0x4293f0], edx
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40f07c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [0x429328]
and eax, 0xc5d6a76f
or eax, 0x40000161
mov dword [0x429328], eax
xor eax, eax
cmp byte [eax + str.An_attempt_was_made_to_execute_an_invalid_lock_sequence.], 0
je 0x40f0ba
inc eax
cmp eax, 0x217f
jne 0x40f09a
mov eax, dword [0x429644]
and eax, 0x1ff47b79
mov dword [0x429848], eax
mov edx, dword [0x429644]
cmp byte [str.The_operation_is_not_supported_on_mirrored_volumes.], 0
mov eax, dword [0x4294d8]
lea ecx, [edx - 0x57c45c64]
mov dword [0x4294d8], ecx
je 0x40f0ea
xor eax, 0xdc821e4a
imul eax, eax, 0x4cbe21e0
mov dword [0x4294d8], eax
mov eax, dword [0x4294d8]
sub dword [0x429848], 0x290fe9f6
or eax, 0x7fb44ee7
mov dword [0x42960c], eax
mov dword [esp], edx
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov ecx, eax
push edx
xor edx, edx
or ecx, 0xcfadaf91
mov dword [0x429848], ecx
cmp byte [edx + str.The_operation_is_not_supported_on_mirrored_volumes.], 0
je 0x40f141
inc edx
cmp edx, 0x1ec5
jne 0x40f11d
mov edx, dword [0x429644]
xor edx, 0x6efacc00
mov dword [0x4294d8], edx
mov edx, dword [0x42960c]
mov esi, str.FreeLists
and edx, 0x63eb3a26
mov dword [0x429644], edx
mov edx, dword [0x4294d8]
mov bl, byte [esi]
sub ebx, 0x30
cmp bl, 9
ja 0x40f16b
inc esi
jmp 0x40f15e
or eax, 0xefedffd7
mov ebx, 0x575
mov dword [0x42960c], eax
imul eax, ecx, 0xb092e1db
mov ecx, str.The_implementation_is_not_capable_of_performing_the_request.
mov dword [0x42985c], eax
movsx eax, byte [ecx]
inc ecx
test al, al
je 0x40f1ac
add ebx, eax
cmp ebx, 0x8e2
jbe 0x40f18a
imul eax, edx, 0xb28a5940
and eax, 0x89a591f9
mov dword [0x42985c], eax
xor eax, eax
cmp byte [eax + str.The_resource_loader_cache_doesnt_have_loaded_MUI_entry.], 0
je 0x40f1cb
inc eax
cmp eax, 0x21e1
jne 0x40f1ae
mov eax, edx
xor eax, 0xfad4f86d
mov dword [0x42960c], eax
imul edx, edx, 0x8e697d80
mov dword [0x429328], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [0x42985c]
xor edx, edx
and eax, 0xb0ba6ac5
mov dword [0x429644], eax
cmp byte [edx + 0x4302b8], 0
je 0x40f20b
inc edx
cmp edx, 0xab4
jne 0x40f1ee
imul eax, eax, 0xbf588d62
mov dword [0x429848], eax
mov eax, dword [0x429848]
sub eax, 0x3c234587
mov dword [0x42985c], eax
and eax, 0x7aa45cbc
mov dword [0x4294d8], eax
mov dword [esp], str.The_operation_is_not_supported_on_mirrored_volumes.
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, str.PRIVATENETWORKCLIENTSERVER
push eax
mov al, byte [edx]
test al, al
je 0x40f258
sub eax, 0x30
cmp al, 9
jbe 0x40f255
mov eax, dword [0x42960c]
add eax, 0x507f65b6
mov dword [0x4294d8], eax
jmp 0x40f258
inc edx
jmp 0x40f237
imul eax, dword [0x42960c], 0xc46abf11
mov dword [0x429328], eax
imul eax, dword [0x4294d8], 0x2da4218c
mov dword [0x42985c], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
mov esi, dword [0x42960c]
sub eax, 0x765c4d61
lea edx, [esi - 0x526580a4]
mov dword [0x429644], eax
mov dword [0x4294d8], edx
mov edx, dword [0x429328]
and edx, 0x76d9cba5
mov dword [0x42985c], edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40f4d4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ecx, 0x42a8a0
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov edx, dword [0x42933c]
mov eax, dword [0x4294ec]
or edx, 0x1a307bf8
mov dword [0x4296b0], edx
mov dl, byte [ecx]
test dl, dl
je 0x40f519
sub edx, 0x30
cmp dl, 9
jbe 0x40f516
mov edx, eax
and edx, 0x43d91ab9
mov dword [0x4296b0], edx
jmp 0x40f519
inc ecx
jmp 0x40f4f8
sub eax, 0x1c89c3da
xor edx, edx
imul eax, eax, 0x6110ca8b
lea ecx, [eax - 0x152846f4]
or eax, 0x438eeac7
mov dword [0x4294ec], ecx
mov dword [0x42933c], eax
cmp byte [edx + 0x42a8a0], 0
je 0x40f562
inc edx
cmp edx, 0x102a
jne 0x40f53c
add eax, 0x5f5a7a93
mov dword [0x42933c], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edx
mov eax, dword [0x4294ec]
and eax, 0x5ee63166
mov dword [0x4296b0], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [0x4294ec]
imul edx, eax, 0x9dcc63f0
xor eax, 0xa0b95703
mov dword [0x4296b0], eax
mov dword [0x42933c], edx
call ebx
imul eax, dword [0x4296b0], 0x6bd5b13
mov dword [0x42933c], eax
call ebx
mov edx, 0x429d94
mov ecx, 0x751
movzx eax, byte [edx]
inc edx
test al, al
je 0x40f5d5
add ecx, eax
cmp ecx, 0x1ef8
jbe 0x40f5b9
sub dword [0x4294ec], 0x2595758e
mov eax, dword [0x4294ec]
mov ebx, str.Win32_x86_emulation_subsystem_Floating_point_stack_check.
mov esi, 0x51d
or eax, 0x47255b0b
sub eax, 0x7e58eb22
mov ecx, eax
mov edx, eax
and ecx, 0xfd4d4fce
or edx, 0xfb83dacc
mov dword [0x42933c], ecx
movsx ecx, byte [ebx]
inc ebx
test cl, cl
je 0x40f620
add esi, ecx
cmp esi, 0x2244
jbe 0x40f604
or eax, 0xfbbbfeff
mov dword [0x42933c], eax
imul eax, dword [0x42933c], 0x3cc0cad7
or eax, 0x37864273
mov dword [0x42933c], eax
lea eax, [edx + 0x65126eb]
mov dword [0x4296b0], eax
imul eax, eax, 0x6f073c2c
mov dword [0x4294ec], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetCommandLineW]
Function at 0x40f8a8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x212b
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
inc edx
test al, al
je 0x40f8cd
add ecx, eax
cmp ecx, 0xcde
jbe 0x40f8bb
imul eax, dword [0x429390], 0x3ff152ed
mov dword [0x429490], eax
add eax, 0x45adc5c2
mov dword [0x42968c], eax
mov dword [esp], 0x254
call dword [sym.imp.USER32.dll_IsWindow]
mov edx, ebx
mov ecx, 0xdbf
push esi
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40f910
add ecx, eax
cmp ecx, 0x1aae
jbe 0x40f8fb
mov eax, dword [0x429390]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub eax, 0x2c60e56a
mov dword [0x42968c], eax
mov eax, dword [0x429490]
sub eax, 0x39b1564b
mov dword [0x429390], eax
mov dword [esp], str.Tape_could_not_be_partitioned.
call esi
mov edx, ebx
push ecx
mov ecx, 0x1b6c
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40f969
add ecx, eax
cmp ecx, 0xd6c
jbe 0x40f945
mov eax, dword [0x429390]
and eax, 0x39355de9
mov dword [0x42968c], eax
xor dword [0x429390], 0xbfa2316d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x429390]
imul edx, dword [0x429490], 0xe0aca92
imul ecx, eax, 0x13c3fe47
and edx, 0x49740e34
mov dword [0x429390], edx
xor edx, edx
mov dword [0x42968c], ecx
cmp word [ebx + edx*2], 0
je 0x40f9d6
inc edx
cmp edx, 0xaca
jne 0x40f9a2
imul eax, eax, 0xdf3f22f6
sub eax, 0x4cbad26
mov dword [0x429490], eax
mov dword [esp], str.SdbpResolveInitSdbPath
call esi
and eax, 0x142e162e
push edx
mov dword [0x42968c], eax
mov eax, dword [0x429390]
sub eax, 0x437288f9
mov edx, eax
or edx, 0xc6b2dc86
mov dword [0x429490], edx
mov dx, word [ebx]
test dx, dx
je 0x40fa15
sub edx, 0x30
cmp dx, 9
jbe 0x40fa10
and eax, 0x9b023012
or eax, 0x82021002
mov dword [0x42968c], eax
jmp 0x40fa15
add ebx, 2
jmp 0x40f9ee
mov eax, dword [0x42968c]
and eax, 0x41d6b817
mov dword [0x429390], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x429390]
and eax, 0xc25b4223
mov dword [0x429490], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
imul eax, dword [0x42968c], 0xe9846ca3
add dword [0x429490], 0x7eebb032
mov dword [0x429390], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40fa60
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [0x4296c8]
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
lea edx, [eax + 0xab7b2cd]
or eax, 0x27534d29
imul edx, edx, 0x264b001f
mov dword [0x4296c8], eax
mov dword [0x4295ac], edx
mov dl, byte [ecx]
sub edx, 0x30
cmp dl, 9
ja 0x40fa9f
inc ecx
jmp 0x40fa92
xor eax, 0x7c554d68
mov dword [0x429508], eax
mov dword [esp], 0xfb8
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
mov eax, dword [0x429508]
mov edx, eax
sub eax, 0x73bf9cc6
or edx, 0xa29929fe
mov dword [0x4296c8], eax
mov dword [0x4295ac], edx
mov dword [esp], 0x24d1
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push edx
mov eax, dword [0x429508]
sub eax, 0x29291359
cmp byte [esi], 0
mov dword [0x4296c8], eax
je 0x40fb00
or eax, 0xbdd7f7b5
mov dword [0x4296c8], eax
mov eax, dword [0x4295ac]
sub eax, 0x645737a9
mov dword [0x429508], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [0x429508]
sub dword [0x4295ac], 0x2586a6c3
or eax, 0xd9fae5ef
mov dword [0x429508], eax
xor eax, 0x3701c233
cmp byte [esi], 0
mov dword [0x4296c8], eax
je 0x40fb5a
add eax, 0x709746c1
mov dword [0x429508], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
or eax, 0x543b8e91
mov dword [0x4295ac], eax
mov edx, dword [0x4295ac]
lea eax, [edx - 0x786740e9]
mov dword [0x4296c8], eax
mov ax, word [ebx]
test ax, ax
je 0x40fb95
sub eax, 0x30
cmp ax, 9
jbe 0x40fb90
imul edx, edx, 0xc6158d9c
mov dword [0x4295ac], edx
call dword [sym.imp.USER32.dll_GetShellWindow]
jmp 0x40fb95
add ebx, 2
jmp 0x40fb6b
imul eax, dword [0x4295ac], 0x13df7150
mov dword [0x4295ac], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40fbac
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x429830]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
imul edx, eax, 0x970dcebd
mov edi, ebx
sub eax, 0x76c3f003
xor edx, 0xfe6629fb
mov dword [0x42945c], edx
mov cl, byte [edi]
sub ecx, 0x30
cmp cl, 9
ja 0x40fbe6
inc edi
jmp 0x40fbd9
add edx, 0x53f8b3e7
xor eax, 0x31c5cec6
mov ecx, ebx
mov dword [0x429378], edx
mov dword [0x429830], eax
movzx edi, byte [ecx]
lea edx, [edi - 0x30]
cmp dl, 9
ja 0x40fc0c
inc ecx
jmp 0x40fbfe
sub eax, 0x482d8936
mov dword [0x4295e4], eax
mov dword [esp], str.TPM_1.2:_The_consistency_check_on_DAA_tpmSpecific_has_failed.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x458
push edx
mov edx, esi
or dword [0x42945c], 0x56ec1db5
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40fc59
add ecx, eax
cmp ecx, 0x13f6
jbe 0x40fc35
mov eax, dword [0x4295e4]
sub eax, 0x7159ca51
mov dword [0x429378], eax
mov eax, dword [0x4295e4]
and eax, 0xc253deae
mov dword [0x429830], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ax, word [esi]
sub eax, 0x30
cmp ax, 9
ja 0x40fc7f
add esi, 2
jmp 0x40fc6e
mov eax, dword [0x429830]
mov ecx, ebx
mov esi, 0xa9c
sub eax, 0x560541ea
mov dword [0x4295e4], eax
xor eax, 0x4cd7bd84
mov edx, eax
mov dword [0x429378], eax
or edx, 0x958da5f0
mov dword [0x42945c], edx
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x40fcd1
add esi, edx
cmp esi, 0x3b8
jbe 0x40fcad
lea edx, [eax - 0x1c1cfbbb]
imul edx, edx, 0xfa412403
mov dword [0x4295e4], edx
sub eax, 0x6232d1fa
mov dword [0x429830], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push eax
mov edx, dword [0x42945c]
mov eax, edx
xor eax, 0xc1254099
mov dword [0x429830], eax
mov al, byte [ebx]
test al, al
je 0x40fd15
sub eax, 0x30
cmp al, 9
jbe 0x40fd12
xor edx, 0xd931bd9a
mov dword [0x429830], edx
jmp 0x40fd15
inc ebx
jmp 0x40fcf7
mov eax, dword [0x429378]
imul edx, eax, 0xfd539e23
mov dword [0x42945c], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x410104
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 0x202f
call dword [sym.imp.USER32.dll_IsWindow]
push edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor eax, eax
cmp byte [eax + str.SdbpGetMatchingTextAttributes], 0
je 0x41013f
inc eax
cmp eax, 0x1e39
jne 0x410120
mov dword [esp], 0x14fc
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, str._ProfileName
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x410156
inc edx
jmp 0x41014a
mov edx, str._ProfileName
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x410167
inc edx
jmp 0x41015b
mov eax, dword [ebp + 8]
leave
and eax, 0xd1b92971
ret
Function at 0x410648
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [sym.imp.USER32.dll_GetMessageTime]
and dword [0x429400], 0xba7e0f
call ebx
mov eax, dword [0x4294d4]
mov ecx, str.The_cluster_network_is_already_online.
add eax, 0x63f6d54b
or eax, 0xb901717d
mov dword [0x429400], eax
mov dl, byte [ecx]
test dl, dl
je 0x41069c
sub edx, 0x30
cmp dl, 9
jbe 0x410699
sub eax, 0x28c60658
xor eax, 0xf5e2ce4c
mov dword [0x429400], eax
jmp 0x41069c
inc ecx
jmp 0x41067a
cmp byte [str.The_cluster_network_is_already_online.], 0
je 0x4106af
sub dword [0x429400], 0x37cc8022
mov eax, dword [0x429400]
cmp byte [str.Failed_to_read_the_metadata_of_the_virtual_hard_disk.], 0
lea edx, [eax - 0x351ad4e5]
mov dword [0x429400], edx
je 0x4106e6
xor eax, 0x247cb24a
mov dword [esp], 0x170
add eax, 0x6e2589df
mov dword [0x4294d4], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
mov eax, dword [0x429400]
mov ecx, str.Failed_to_read_the_metadata_of_the_virtual_hard_disk.
sub eax, 0x5bb21b72
or eax, 0x5bbeb8b0
sub eax, 0x17e2b876
mov dword [0x4294d4], eax
mov dl, byte [ecx]
sub edx, 0x30
cmp dl, 9
ja 0x410711
inc ecx
jmp 0x410704
and eax, 0xe9caf3ae
or eax, 0xf6973d52
mov dword [0x429400], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
imul eax, dword [0x4294d4], 0x5a4e80f4
add eax, 0x6f37d343
mov dword [0x4294d4], eax
imul eax, dword [0x429400], 0x304dfa0
and eax, 0x9cc0eeab
mov dword [0x429400], eax
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
jmp eax