joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e1b0
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eec38
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
mov dword [ebx + 4], ebx
call fcn.100493d0
test eax, eax
jne 0x1009e1ed
xor edi, edi
jmp 0x1009e1f7
lea ecx, [ebx + 0x30]
call fcn.100493d0
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x30]
call fcn.100ae980
mov esi, dword [eax]
mov ecx, 0x101448a8
movzx eax, byte [ebx + 0x3d]
push eax
mov dword [ebp - 4], 0
call fcn.100ae980
push 0
push 0
push 3
push 0
push 0
push edi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x48], eax
add ecx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1009e25f
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x1009e292
push 0x1009ea40
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
je 0x1009e2c6
push 2
mov ecx, ebx
call fcn.100ae980
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100f6204
lea ecx, [ebp - 0x10]
call fcn.100ae980
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.100ae980
push 0x1012bb4c
lea eax, [ebp - 0x28]
push eax
call fcn.100ae980
push 0x100f6204
lea ecx, [ebp - 0x14]
call fcn.100ae980
mov esi, eax
mov dword [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.100ae980
push 0x1012bb4c
lea eax, [ebp - 0x3c]
push eax
call fcn.100ae980
int3
Function at 0x1009e5e0
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeb38
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x4c]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x1009e631
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009e661
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + eax]
cmp ecx, eax
jb 0x1009e6b0
cmp ecx, edx
jb 0x1009e6b0
test eax, eax
je 0x1009e651
cmp ecx, 0xa00000
ja 0x1009e695
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x100f6204
lea ecx, [ebp - 0x14]
call fcn.100ae980
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.100ae980
push 0x1012bb4c
lea eax, [ebp - 0x34]
push eax
call fcn.100ae980
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100ae980
push 0x1012ad98
lea eax, [ebp - 0x20]
push eax
call fcn.100ae980
push 0xcaa82f9b
lea ecx, [ebp - 0x2c]
call fcn.100ae980
push 0x1012ad98
lea eax, [ebp - 0x2c]
push eax
call fcn.100ae980
int3

Function at 0x1009e850
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eec98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov ecx, dword [ebp + 8]
lea eax, [edi + ecx]
cmp eax, edi
jl 0x1009e8f1
cmp eax, ecx
jl 0x1009e8f1
cmp eax, 0xa00000
jg 0x1009e8f8
push esi
push eax
mov ecx, esi
call fcn.100ae980
mov eax, dword [esi]
lea ecx, [ebx + 0x40]
push ecx
push dword [ebp + 8]
add eax, edi
push eax
push dword [ebx + 0x4c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1009e8c6
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009e913
mov eax, dword [ebx + 0x40]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.100ae980
push 0xa
mov ecx, ebx
call fcn.100ae980
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa82f9c
jmp 0x1009e8fd
push 0xcaa10024
lea ecx, [ebp - 0x1c]
call fcn.100ae980
push 0x1012ad98
lea eax, [ebp - 0x1c]
push eax
call fcn.100ae980
push 0x100f6204
lea ecx, [ebp - 0x10]
call fcn.100ae980
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.100ae980
push 0x1012bb4c
lea eax, [ebp - 0x30]
push eax
call fcn.100ae980
int3
Function at 0x100ae980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100ae98f
pop dword [ebp - 0x1c]
mov eax, 0x100ae98f
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x7e622
push 0
mov eax, 0x7fbd4835
add eax, 0x9051f99b
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x4f4e38d
sub ecx, 0x4f49ec8
xor edx, edx
add edx, eax
mov esi, 0x989dab2
sub esi, 0xf9738cb2
add esi, dword [ebp - 0x1c]
mov ebx, 0x6b7b2b88
add ebx, 0xcb80b75d
mov dword [ebp - 0x18], 0xa3073287
mov edi, dword [esi]
mov dword [ebp - 0xc], 0xc9831a7c
xor edi, ebx
mov dword [ebp - 0x14], 0xf3c553d2
mov dword [edx], edi
sub dword [ebp - 4], esi
add edx, 0x54dcdd90
sub edx, 0x54dcdd8c
add esi, 4
loop 0x100ae9eb
add eax, 0x65691191
sub eax, 0x65680baa
xor ebx, ebx
add ebx, eax
add eax, 0xff9b2e3e
sub eax, 0xff9b2e39
mov ecx, 0x3ccce340
sub ecx, 0x2ccce340
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x4019bd
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435330
push 0x430760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x20], bl
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
movsx eax, word [0x43ac90]
push eax
movsx eax, byte [0x43ac81]
push eax
call fcn.0040b002
mov byte [0x43ac81], al
push 0xf2d1ffff
push 0x4679ffff
call fcn.0040af32
add esp, 0x10
mov dword [0x43aca8], eax
push 0xcf8fffff
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
add dword [0x43aca0], eax
push 0x4c
call fcn.0040f588
pop ecx
call eax
test eax, 0x80000000
je 0x401aed
xor eax, eax
cmp byte [0x43ac7d], bl
setne al
mov byte [0x43ac7e], al
movsx eax, byte [0x43ac7a]
push eax
push dword [0x43acac]
call fcn.0040afcb
pop ecx
pop ecx
add word [0x43ac82], ax
xor eax, eax
cmp word [0x43ac86], bx
setne al
mov word [0x43ac82], ax
push edx
push ecx
push ebx
push eax
or eax, edx
imul ecx, ecx, 0xc197ffff
inc ecx
nop
imul ebx, edx
pop eax
pop ebx
pop ecx
pop edx
mov eax, dword fs:[0x20]
push ecx
push ebx
push eax
nop
dec ebx
xor ecx, 0xb469ffff
or ebx, 0xc3bbffff
sub eax, 0x26d1ffff
pop eax
pop ebx
pop ecx
mov dword [ebp - 0x1c], eax
push ecx
nop
dec ecx
nop
pop ecx
push 0x3de5ffff
push 0xcb0dffff
call fcn.0040b0f0
pop ecx
pop ecx
add dword [0x43acac], eax
or word [0x43ac84], 0xffff
sub dword [0x43ac98], 0x40480001
jmp 0x401c15
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharAlphaA]
mov word [0x43ac8a], ax
xor eax, eax
cmp byte [0x43ac7c], bl
setne al
mov word [0x43ac92], ax
push ecx
push ebx
push eax
nop
xor ebx, 0xf573ffff
inc ebx
dec ecx
and eax, 0xaa49ffff
dec ebx
mov ebx, ebx
dec eax
pop eax
pop ebx
pop ecx
mov ebx, dword fs:[0x30]
push edx
push ecx
push ebx
push eax
or edx, 0x769dffff
mov ecx, edx
mov edx, eax
imul ebx, ebx
pop eax
pop ebx
pop ecx
pop edx
mov al, byte [ebx + 2]
push edx
push ecx
push ebx
push eax
nop
or edx, eax
and ebx, 0x8ce1ffff
dec ecx
add edx, 0x35cbffff
xor eax, edx
mov ebx, 0xfd4fffff
pop eax
pop ebx
pop ecx
pop edx
movzx ebx, al
push edx
push ecx
push eax
dec ecx
sub eax, 0xd72fffff
or eax, 0xc809ffff
dec edx
pop eax
pop ecx
pop edx
mov dword [ebp - 0x1c], ebx
push edx
push eax
mov edx, eax
sub edx, 0x6f87ffff
nop
pop eax
pop edx
movsx eax, byte [0x43ac7d]
or eax, 0xe0afffff
mov dword [0x43acb0], eax
movsx eax, word [0x43ac92]
mov ecx, dword [0x43aca8]
lea eax, [ecx + eax - 0x21d40001]
mov dword [0x43aca8], eax
push 0x6a2bffff
movsx eax, word [0x43ac82]
push eax
call fcn.0040b0ac
pop ecx
pop ecx
mov byte [0x43ac7b], al
jmp 0x401c15
or dword [ebp - 4], 0xffffffff
dec word [0x43ac8a]
or ax, 0xffff
sub ax, word [0x43ac88]
mov word [0x43ac94], ax
cmp dword [ebp - 0x1c], 0
je 0x401c3b
mov byte [ebp - 0x20], 1
mov al, byte [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402db3
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push dword [0x43aca8]
movzx eax, ax
push 0x7c9ffff
mov dword [0x43ac9c], eax
call fcn.0040b087
pop ecx
mov word [0x43ac8e], ax
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add dword [0x43acbc], eax
push 0
xor eax, eax
call eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
add word [0x43ac8a], ax
ret

Function at 0x402eb5
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movsx eax, word [0x43ac82]
push esi
push edi
push dword [0x43acb0]
push eax
call fcn.0040b0f0
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
pop ecx
pop ecx
mov dword [0x43acac], eax
call edi
push dword [0x43ac9c]
mov word [0x43ac8a], ax
movsx eax, word [0x43ac8c]
push eax
call fcn.0040af32
push 3
mov dword [0x43aca0], eax
push dword [ebp + 8]
call fcn.00402e4e
mov esi, eax
mov al, byte [0x43ac8c]
imul byte [0x43aca0]
add byte [0x43ac7b], al
add esp, 0x10
movsx eax, word [0x43ac82]
imul eax, eax, 0x9153ffff
mov dword [0x43acb4], eax
movsx ax, byte [0x43ac80]
neg eax
test edx, edx
mov word [0x43ac8e], ax
jne 0x403054
mov al, byte [0x43ac7d]
push ebx
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaA]
mov byte [0x43ac79], al
push 0x2ad7ffff
movsx eax, byte [0x43ac7b]
imul eax, eax, 0xf25fffff
push dword [0x43aca8]
mov dword [0x43acb0], eax
shl esi, 2
call fcn.0040b087
add dword [0x43aca8], eax
push 0xbe5fffff
push 0x3edfffff
call fcn.0040b087
push 0x4c
push esi
mov dword [0x43aca8], eax
call fcn.00402e4e
mov ebx, eax
mov dword [ebp - 4], edx
movsx eax, byte [0x43ac7b]
push eax
push 0xe63dffff
call fcn.0040afcb
add byte [0x43ac7c], al
movsx eax, byte [0x43ac78]
push eax
push 0x9787ffff
call fcn.0040b002
push 0xdd1bffff
push 0x583ffff
mov dword [0x43aca0], eax
call fcn.0040b002
push dword [0x43acac]
add word [0x43ac94], ax
push 0x9ffffff
call fcn.0040b037
add esp, 0x38
mov word [0x43ac8c], ax
call edi
mov byte [0x43ac79], al
push 0x8b97ffff
movsx eax, byte [0x43ac7a]
push eax
call fcn.0040b002
add word [0x43ac8c], ax
push 0x7583ffff
push 0xefe9ffff
call fcn.0040af94
add dword [0x43ac9c], eax
mov al, byte [0x43acbc]
add esp, 0x10
or al, byte [0x43ac7d]
mov byte [0x43ac7c], al
lea eax, [esi + ebx*2 + 1]
pop ebx
jmp 0x4030fe
push dword [0x43aca8]
push 0x9199ffff
call fcn.0040b0f0
add byte [0x43ac7c], al
push 0x9989ffff
movsx eax, byte [0x43ac7b]
push eax
call fcn.0040b002
mov dword [0x43acb0], eax
lea esi, [esi*4 + 4]
movsx eax, byte [0x43ac7e]
push eax
push 0x6c1ffff
call fcn.0040af32
add dword [0x43aca4], eax
mov al, byte [0x43ac92]
sub byte [0x43ac7b], al
push 0x4c
push esi
call fcn.00402e4e
add esp, 0x20
mov edi, eax
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push dword [0x43aca8]
movzx eax, ax
push 0x7c9ffff
mov dword [0x43ac9c], eax
call fcn.0040b087
pop ecx
mov word [0x43ac8e], ax
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add dword [0x43acbc], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
add word [0x43ac8a], ax
lea eax, [esi + edi*2 + 1]
pop edi
pop esi
leave
ret 4
Function at 0x4031f9
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [0x43ac7e]
and eax, dword [0x43acbc]
push ebx
push esi
push 0x5171ffff
push dword [0x43acb8]
mov dword [0x43acb4], eax
movsx eax, word [0x43ac90]
or eax, dword [0x43aca0]
mov word [0x43ac8a], 1
add dword [0x43aca8], eax
call fcn.0040b0f0
add word [0x43ac94], ax
movsx eax, byte [0x43ac80]
push eax
push dword [0x43ac9c]
call fcn.0040b037
add word [0x43ac92], ax
xor ebx, ebx
add esp, 0x10
cmp byte [0x43aa88], bl
jne 0x403353
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add byte [0x43ac7d], al
mov ax, word [0x43aca0]
or ax, word [0x43ac94]
push 0xc151ffff
push dword [0x43ac9c]
add word [0x43ac8e], ax
call fcn.0040b037
mov esi, dword [0x43aa44]
mov word [0x43ac8e], ax
pop ecx
mov al, byte [esi]
pop ecx
add al, 0x76
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.00430730
mov eax, esp
push 0x40
push esi
push eax
call fcn.0042d836
pop ecx
pop ecx
push eax
push 0x43aa48
call sub.MSVCRT.dll_memcpy
movsx eax, word [0x43ac90]
push eax
movsx eax, byte [0x43ac81]
push eax
call fcn.0040b002
push 0xf2d1ffff
push 0x4679ffff
mov byte [0x43ac81], al
call fcn.0040af32
add esp, 0x1c
mov dword [0x43aca8], eax
push 0xcf8fffff
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
add dword [0x43aca0], eax
cmp byte [0x43ac7d], bl
mov byte [0x43aa88], 1
setne al
mov byte [0x43ac7e], al
movsx eax, byte [0x43ac7a]
push eax
push dword [0x43acac]
call fcn.0040afcb
xor eax, eax
cmp word [0x43ac86], bx
pop ecx
setne al
pop ecx
mov word [0x43ac82], ax
push 0x3de5ffff
push 0xcb0dffff
call fcn.0040b0f0
add dword [0x43acac], eax
or word [0x43ac84], 0xffff
sub dword [0x43ac98], 0x40480001
pop ecx
pop ecx
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharAlphaA]
mov esi, dword [ebp + 8]
mov word [0x43ac8a], ax
xor eax, eax
cmp byte [0x43ac7c], bl
push 0x6a2bffff
setne al
mov word [0x43ac92], ax
mov ecx, dword [esi]
shr ecx, 0x1a
movsx eax, ax
mov bl, byte [ecx + 0x43aa48]
movsx ecx, byte [0x43ac7d]
or ecx, 0xe0afffff
mov dword [0x43acb0], ecx
mov ecx, dword [0x43aca8]
lea eax, [ecx + eax - 0x21d40001]
mov dword [0x43aca8], eax
movsx eax, word [0x43ac82]
push eax
call fcn.0040b0ac
mov byte [0x43ac7b], al
push 0x8a5bffff
shl dword [esi], 6
movsx eax, byte [0x43ac7a]
push eax
call fcn.0040af32
add esp, 0x10
mov word [0x43ac92], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x43acb8], eax
movsx eax, word [0x43ac88]
push eax
movsx eax, byte [0x43ac79]
push eax
call fcn.0040b002
pop ecx
mov word [0x43ac86], ax
pop ecx
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x4039e1
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov al, byte [0x43aca8]
push ebx
add byte [0x43ac7a], al
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
call fcn.00402eb5
push eax
push esi
push dword [ebp + 0x10]
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x43aca4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp edi, esi
mov byte [0x43ac7e], al
jbe 0x403ba3
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
movsx eax, word [0x43ac8a]
push eax
push 0x1fb3ffff
call fcn.0040b087
add dword [0x43ac9c], eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add byte [0x43ac7e], al
push 0x2e01ffff
movsx eax, byte [0x43ac7b]
push eax
call fcn.0040af32
add dword [0x43acac], eax
mov eax, edi
sub eax, esi
pop ecx
cmp eax, 2
pop ecx
jbe 0x403b3e
push 0x5ccfffff
push 0x12e3ffff
call fcn.0040af94
pop ecx
mov word [0x43ac84], ax
pop ecx
lea eax, [esi + ebx]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push 3
push eax
call fcn.00403437
or al, 0xff
sub al, byte [0x43ac7b]
mov byte [0x43ac78], al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add word [0x43ac82], ax
or al, 0xff
sub al, byte [0x43ac94]
add esi, 3
add byte [0x43ac7d], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x43aca4], eax
movsx eax, byte [0x43ac7e]
push eax
push 0xc775ffff
call fcn.0040b0ac
add word [0x43ac86], ax
add dword [ebp - 4], 4
movsx eax, word [0x43ac90]
add dword [ebp + 0xc], 4
or byte [0x43ac79], 0xff
push eax
push dword [0x43acb0]
call fcn.0040aeeb
add byte [0x43ac81], al
mov ax, word [0x43ac8e]
add word [0x43ac84], ax
add esp, 0x10
cmp esi, edi
jb 0x403a38
jmp 0x403ba3
movsx eax, word [0x43ac94]
or byte [0x43ac7e], 0xff
and word [0x43ac88], 0
push eax
movsx eax, byte [0x43ac7a]
push eax
call fcn.0040af6d
add byte [0x43ac79], al
mov eax, dword [ebp - 4]
pop ecx
sub edi, esi
pop ecx
add esi, ebx
mov ecx, dword [ebp + 0x10]
add eax, ecx
mov ecx, dword [ebp - 8]
push eax
push edi
push esi
call fcn.00403437
push 0x6327ffff
mov dword [0x43acbc], 0x1bffff
push dword [0x43aca0]
call fcn.0040b0ac
add dword [0x43acb4], eax
pop ecx
pop ecx
movsx eax, byte [0x43ac78]
push eax
push 0x88b7ffff
call fcn.0040af94
add dword [0x43ac9c], eax
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4043a0
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x430f6a
call fcn.00430710
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push dword [0x43aca8]
movzx eax, ax
push 0x7c9ffff
mov dword [0x43ac9c], eax
call fcn.0040b087
xor ebx, ebx
pop ecx
mov word [0x43ac8e], ax
cmp dword [esi + 0xa0], ebx
pop ecx
je 0x4044d0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add dword [0x43acbc], eax
lea eax, [ebp - 0x1c]
push 3
push eax
call fcn.00422e98
pop ecx
pop ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
add word [0x43ac8a], ax
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.004056b4
pop ecx
pop ecx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov byte [ebp - 4], 1
push dword [ecx]
lea ecx, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 0x21e1ffff
push 0xea19ffff
call fcn.0040af32
push 0x5c15ffff
push 0xa203ffff
mov byte [0x43ac7b], al
call fcn.0040afcb
push 0x129bffff
mov word [0x43ac90], ax
push dword [0x43acac]
call fcn.0040aeeb
add dword [0x43aca4], eax
mov eax, dword [ebp - 0x18]
add esp, 0x18
cmp eax, ebx
jne 0x40448f
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp + 0xc]
push 4
push ecx
push 4
push ebx
push eax
push dword [esi + 0xa0]
push 0x15
call fcn.0040f588
pop ecx
call eax
push dword [0x43acb0]
push 0xb10dffff
call fcn.0040b002
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov word [0x43ac8e], ax
push 1
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x404f31
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x431029
call fcn.00430710
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
push dword [0x43aca0]
mov dword [ebp - 0x10], ebx
push 0x735bffff
call fcn.0040aeeb
mov word [0x43ac8c], ax
mov eax, dword [ebp + 0xc]
pop ecx
cmp eax, 8
pop ecx
jl 0x404f92
mov edi, dword [ebp + 8]
mov al, byte [ebp + 0xb]
push ebx
mov ecx, edi
mov byte [edi], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov esi, 0x43abc4
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
jmp 0x40501f
mov cl, byte [0x43aca8]
push ebx
add byte [0x43ac7a], cl
lea ecx, [ebp - 0x20]
shl eax, 4
add eax, 0x43aab8
mov esi, eax
mov al, byte [esi]
mov byte [ebp - 0x20], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea ecx, [ebp - 0x20]
push dword [eax]
push ebx
push esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
push 1
lea eax, [ebp - 0x20]
pop esi
push eax
mov dword [ebp - 4], esi
call fcn.0040bd81
pop ecx
mov dword [0x43aca4], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [ebp + 8]
mov byte [0x43ac7e], al
mov al, byte [ebp - 0x20]
push ebx
mov ecx, edi
mov byte [edi], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, edi
push dword [eax]
lea eax, [ebp - 0x20]
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret