joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d8c9
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x41d9cc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41d99f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41d97c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41d95d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x41d97a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00429290
mov dword [eax], 0x66941fc9
jmp 0x41d952
jmp 0x41d99d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x41d99d
push 0xc73
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x41d9ca
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0x3193
push dword [ebp - 0x44]
push 1
push 0x143e
push 0
push 0x19a8
push 1
push 0x18ae
call fcn.00422c71
add esp, 0x20
jmp 0x41d9e9
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
push 0x901
push 0
push 0x383e
call fcn.0041d9ed
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x41f370
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x41f4f4
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41f418
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41f3f3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x5be
push 0x5f2
push 0x668
push 0xde9
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x41f413
push 0
push 0x262
push 0x337
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x41f4f2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41f455
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x41f4f2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41f4a7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 6
jle 0x41f4f2
mov dword [ebp - 0x68], 0x64939e63
push 0x4d6e
push 0x5ac5
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 4]
push dword [ebp - 0x60]
push 0x315
push 0x4bb8
push 0
push dword [ebp - 0x64]
push 1
lea eax, [ebp - 0x68]
push eax
push 0x1491
push 0
call fcn.00422812
add esp, 0x38
jmp 0x41f49c
jmp 0x41f527
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x6c], eax
push 0x147d
push 0x27dd
push 1
push 0x13b1
push 0x3816
push 0x5af0
push dword [ebp - 0x6c]
push 1
push 0x5843
call fcn.0040944f
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x42eced
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x42ed96
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42ed65
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42ed4c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x42ed63
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42ed63
push 0xc73
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x42ed91
push 0x6da9
push 0
push 0xc66
push 1
push 0x3e0
push 1
push 0x4782
push 0x294c
push 0x41a6
call fcn.004364f9
add esp, 0x24
jmp 0x42ee1e
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42ede1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
push 0x7c7
push 0
push dword [ebp - 0x34]
call fcn.0042d9e8
add esp, 0x10
jmp 0x42ee1e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push 0x45bd
push 0
push 1
push 0x5a65
push 0
push 1
push 0x524c
push 1
push dword [ebp - 0x44]
push 0x2ad7
push 0x6ae4
call fcn.0042fc2c
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x42fa90
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x42fba9
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42fb64
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42fb17
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1af5
push 0x1fdd
push 0x1470
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x42fb62
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x42fb45
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x42fb62
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.00429290
mov dword [eax], 0x1d91e66c
jmp 0x42fb3a
jmp 0x42fba7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 1
push 0x96c
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x3174
push 0x17b0
push 0x195c
push 1
push 0x2629
push 0x46d7
push 0
push 0x3ac3
call fcn.0042dfd5
add esp, 0x30
jmp 0x42fbf1
lea eax, [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x42fbe3
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
push 0x34ec
push 0
push 0x4111
push 0x69fa
call fcn.0042f180
add esp, 0x14
jmp 0x42fbf1
push 0
push 0x2251
call fcn.0042d022
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42ff54
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x430010
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42fffd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x42ffbb
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 0xb
jmp 0x42fffb
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffe3
jmp 0x42ffdd
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x19
jl 0x42fffb
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42fff9
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x42ffd2
jmp 0x43000e
push 0
push 0x2800
push 1
call fcn.00430035
add esp, 0xc
jmp 0x430031
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
push 0x7605
push 1
push dword [ebp - 0x38]
call fcn.0042ac32
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x433700
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4337d0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x433777
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43376f
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 0x1f2a
push 0x1ba9
push 0
push 0x4726
call fcn.0043eff6
add esp, 0x18
jmp 0x433775
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x4337ce
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4337ae
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 0x23
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4337ce
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x4337ce
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x433837
lea eax, [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x433811
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
push 0x2bdc
push 0
push 0x57cd
call fcn.004331ca
add esp, 0x10
jmp 0x433837
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 0x53e4
push 0
push dword [ebp - 0x50]
push 0x1023
push dword [ebp - 0x54]
call fcn.0043ac5a
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43c7e1
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x43c8c3
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43c838
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 1
call fcn.0043c94f
pop ecx
pop ecx
jmp 0x43c8be
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43c873
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x43c8be
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43c8a1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x43c8be
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.00429290
mov dword [eax], 0xc93b
jmp 0x43c896
jmp 0x43c94b
lea eax, [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x43c920
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x43c905
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x43c91e
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x43c94b
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
push 0x6527
push 0
push 0x29bc
push dword [ebp - 0x68]
push 0x3db0
push 0x7283
push 1
push 0
call fcn.0043e556
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x43f21f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43f2f9
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43f2c7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43f2bb
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x43f2c5
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x43f2f7
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0x29f6
push 0x2b68
push 0x2d43
push 0x2e2d
push 1
push 0x4c94
push dword [ebp - 0x44]
push 1
push 0
call fcn.00434430
add esp, 0x24
jmp 0x43f374
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x48]
push 0x2215
push dword [ebp - 0x4c]
push 0xdb1
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push 0x11dc
push 0x4dae
push 0x68d2
push 0x557a
push 0x193d
push 0xdfa
push dword [ebp - 0x5c]
push 0
push 0x316f
push 0x321f
push 0x832
call fcn.00432e6f
add esp, 0x48
mov esp, ebp
pop ebp
ret
Function at 0x44105f
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x441146
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4410bc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x6c80
push 1
call fcn.0044116e
add esp, 0xc
jmp 0x441144
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4410fc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4410fa
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x441144
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x44112a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x441144
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.00429290
and dword [eax], 0
jmp 0x44111f
jmp 0x44116a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
push 1
push 0x60db
push 0xae3
push 0x7c40
push 0
push dword [ebp - 0x48]
call fcn.0043f1e3
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x442b91
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x442bec
mov eax, dword [ebp + 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
push 1
push 0x2e5c
push 0x53cb
push 0x133d
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x502a
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
call fcn.00442c98
add esp, 0x28
jmp 0x442c94
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x442c7b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x442c6f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
and dword [ecx + eax], 0
jmp 0x442c79
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x442c94
push 0x563e
push 0
push 0x66da
push 0x5566
call fcn.0043f13a
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4889e1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret