Function at 0x40b8a0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479aed
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x49c068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x40c
cmp ax, cx
jne 0x40bb61
call fcn.00426a40
test al, al
jne 0x40bb61
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov edi, dword [ebp + 0x10]
mov eax, 0x4d4873ed
mov esi, dword [ebp + 0xc]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40bb57
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ecx, edi
mov eax, 0x4d4873ed
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x40b984
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40b960
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov edi, dword [ebp + 0x10]
add esp, 0x14
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, edi
add eax, esi
sub ecx, esi
mov dword [ebp - 0x18], eax
mov eax, 0x4d4873ed
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x40b9ef
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40b9cb
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov edi, dword [ebp + 0x10]
add esp, 0x14
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
sub edi, esi
add eax, esi
mov dword [ebp - 0x14], eax
mov eax, 0x4d4873ed
imul edi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x40ba55
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40ba34
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov esi, dword [ebp + 0xc]
add esp, 0x14
mov edi, dword [ebp - 0x10]
mov edx, str._____Emotet
mov ecx, 0x49d4f8
call fcn.00407d70
mov edx, 0x493944
mov ecx, eax
call fcn.00407d70
mov edx, str._____Nom_du_processus:
mov ecx, eax
call fcn.00407d70
lea edx, [edi + 4]
add edx, esi
cmp dword [edi + esi + 0x18], 0x10
jb 0x40ba8d
mov edx, dword [edx]
push dword [edi + esi + 0x14]
mov ecx, eax
call fcn.0040eeb0
mov ecx, dword [ebp - 0x14]
add esp, 4
mov edx, 0x493944
push dword [ecx + 0x1c]
mov ecx, eax
call fcn.00407d70
mov edx, str._____PID_____________:
mov ecx, eax
call fcn.00407d70
mov ecx, eax
call fcn.00405440
mov edx, 0x493944
mov ecx, eax
call fcn.00407d70
mov edx, str._____Emplacement_____:
mov ecx, eax
call fcn.00407d70
mov ecx, eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x38], 0x10
lea edx, [eax + 0x24]
jb 0x40bae8
mov edx, dword [edx]
push dword [eax + 0x34]
call fcn.0040eeb0
push eax
call fcn.00408020
mov esi, dword [ebp + 0xc]
add edi, 0xd4
mov dword [ebp - 0x10], edi
mov eax, 0x4d4873ed
mov edi, dword [ebp + 0x10]
inc ebx
mov ecx, edi
add esp, 8
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x40b921
mov edx, str._____________________________________________________n
mov ecx, 0x49d4f8
call fcn.00407d70
push eax
call fcn.00408020
add esp, 4
mov edx, str.Emotet_a
mov ecx, 0x49d4f8
call fcn.00407d70
mov edx, 0x4939f4
jmp 0x40bdc4
mov edx, str.Aucune_d
jmp 0x40bdbf
mov edi, dword [ebp + 0x10]
mov eax, 0x4d4873ed
mov esi, dword [ebp + 0xc]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40bdba
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ecx, edi
mov eax, 0x4d4873ed
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x40bbea
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40bbc6
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov edi, dword [ebp + 0x10]
add esp, 0x14
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, edi
add eax, esi
sub ecx, esi
mov dword [ebp - 0x14], eax
mov eax, 0x4d4873ed
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x40bc55
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40bc31
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov edi, dword [ebp + 0x10]
add esp, 0x14
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
sub edi, esi
add eax, esi
mov dword [ebp - 0x18], eax
mov eax, 0x4d4873ed
imul edi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x40bcbb
push str.vector_subscript_out_of_range
push 0x492794
push 0
push 0x75e
push 0x492e88
push 2
call fcn.00431dd0
add esp, 0x18
cmp eax, 1
jne 0x40bc9a
int3
push 0
push 0x75e
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.37.32822include_vector
push 0x4928c4
push str._vector_subscript_out_of_range_
call fcn.00432610
mov esi, dword [ebp + 0xc]
add esp, 0x14
mov edi, dword [ebp - 0x10]
mov edx, str._____Detected
mov ecx, 0x49d4f8
call fcn.00407d70
mov edx, 0x493944
mov ecx, eax
call fcn.00407d70
mov edx, str._____Process_Name:
mov ecx, eax
call fcn.00407d70
lea edx, [edi + 4]
add edx, esi
cmp dword [edi + esi + 0x18], 0x10
jb 0x40bcf3
mov edx, dword [edx]
push dword [edi + esi + 0x14]
mov ecx, eax
call fcn.0040eeb0
mov ecx, dword [ebp - 0x18]
add esp, 4
mov edx, 0x493944
push dword [ecx + 0x1c]
mov ecx, eax
call fcn.00407d70
mov edx, str._____PID_________:
mov ecx, eax
call fcn.00407d70
mov ecx, eax
call fcn.00405440
mov edx, 0x493944
mov ecx, eax
call fcn.00407d70
mov edx, str._____Image_Path__:
mov ecx, eax
call fcn.00407d70
mov ecx, eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x38], 0x10
lea edx, [eax + 0x24]
jb 0x40bd4e
mov edx, dword [edx]
push dword [eax + 0x34]
call fcn.0040eeb0
push eax
call fcn.00408020
mov esi, dword [ebp + 0xc]
add edi, 0xd4
mov dword [ebp - 0x10], edi
mov eax, 0x4d4873ed
mov edi, dword [ebp + 0x10]
inc ebx
mov ecx, edi
add esp, 8
sub ecx, esi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x40bb87
mov edx, str._____________________________________________________n
mov ecx, 0x49d4f8
call fcn.00407d70
push eax
call fcn.00408020
add esp, 4
mov edx, str.Emotet_was_detected._n
mov ecx, 0x49d4f8
call fcn.00407d70
mov edx, str.Please_remove_or_isolate_the_suspicious_execution_file._n
jmp 0x40bdc4
mov edx, str.No_detection._n
mov eax, 0x49d4f8
mov ecx, eax
call fcn.00407d70
push eax
call fcn.00408020
add esp, 4
lea ecx, [ebp + 8]
call fcn.00406720
mov eax, dword [ebp + 8]
push 8
push eax
mov dword [ebp + 8], 0
call fcn.0042b3d0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret