joyce8/EMBER2024-capa huggingface dataset:
Function at 0x643ce5d4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x643e7d28]
and eax, 0x676b09c3
or eax, 0x21000981
mov dword [0x643e7d28], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esp], 0xe6e
call dword [sym.imp.KERNEL32.dll_SetLastError]
add dword [0x643e7d28], 0x567f006b
push eax
mov dword [esp], 0x643e9120
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
push eax
mov eax, dword [0x643e7d28]
sub eax, 0x46a4f39f
imul eax, eax, 0xcce0b8fd
mov dword [0x643e7d28], eax
cmp byte [edx + str.The_specified_storage_reserve_is_not_empty.], 0
je 0x643ce64d
inc edx
cmp edx, 0x131b
jne 0x643ce631
or eax, 0x23a5a769
mov dword [0x643e7d28], eax
mov eax, dword [0x643e7d28]
and eax, 0xc32d209d
or eax, 0x42210009
add eax, 0x3859cd1
xor eax, 0x35a841a1
imul eax, eax, 0xff119c4c
sub eax, 0x28d8d0f0
or eax, 0x4ef533e8
imul eax, eax, 0xf0ed9d99
mov dword [0x643e7d28], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov eax, dword [0x643e7d28]
push edx
xor eax, 0x4c73a615
mov dword [0x643e7d28], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor eax, eax
imul edx, dword [0x643e7d28], 0xeb2c24f5
push ecx
mov dword [0x643e7d28], edx
cmp byte [eax + str.The_specified_storage_reserve_is_not_empty.], 0
je 0x643ce6d3
inc eax
cmp eax, 0x1cf6
jne 0x643ce6b6
or edx, 0x72c1df31
mov dword [0x643e7d28], edx
mov eax, dword [0x643e7d28]
sub eax, 0xa731b20
mov dword [0x643e7d28], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push eax
leave
ret
Function at 0x643ce7dc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str._tIME_Second
mov ebp, esp
push esi
push ebx
sub esp, 0x10
or dword [0x643e7ec0], 0xd9674629
mov al, byte [edx]
test al, al
je 0x643ce80f
sub eax, 0x30
cmp al, 9
jbe 0x643ce80c
mov dword [0x643e7f10], 0x6b937f62
jmp 0x643ce80f
inc edx
jmp 0x643ce7f3
mov dword [0x643e8238], 0xe9e773f7
mov edx, str._tIME_Second
mov al, byte [edx]
test al, al
je 0x643ce83a
sub eax, 0x30
cmp al, 9
jbe 0x643ce837
mov dword [0x643e7ec0], 0xf492ee83
jmp 0x643ce83a
inc edx
jmp 0x643ce81e
or dword [0x643e7ec0], 0xc2bf9452
mov dword [0x643e829c], 0xa7654d7e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, str.JR.Inno.Setup
mov edx, eax
and edx, 0xf97441
mov dword [0x643e829c], edx
mov dl, byte [ecx]
test dl, dl
je 0x643ce88c
sub edx, 0x30
cmp dl, 9
jbe 0x643ce889
mov ebx, dword [0x643e8238]
lea edx, [ebx + 0x58a7285e]
mov dword [0x643e7ec0], edx
jmp 0x643ce88c
inc ecx
jmp 0x643ce867
mov esi, dword [0x643e7ec0]
and eax, 0x294400
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [0x643e7ec0], eax
lea edx, [esi - 0x4f84786]
mov esi, 0x46e
mov dword [0x643e7f10], edx
mov dword [esp], edx
call ebx
push edx
imul eax, dword [0x643e7f10], 0xb15cd3cb
mov dword [0x643e8238], eax
mov eax, dword [0x643e7ec0]
xor eax, 0xd35e01e0
mov dword [0x643e7f10], eax
sub eax, 0x6eb07f71
mov dword [0x643e829c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x643e7ec0]
mov ecx, str.An_attempt_was_made_to_reinitialize_the_ACPI_subsystem
lea edx, [eax + 0x1977f176]
mov dword [0x643e7ec0], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x643ce922
add esi, edx
cmp esi, 0x1bbb
jbe 0x643ce8fd
imul edx, dword [0x643e8238], 0xf589449e
mov dword [0x643e8238], edx
add eax, 0x18805e9
mov dword [0x643e7f10], eax
mov eax, dword [0x643e8238]
xor eax, 0xc796987e
mov dword [0x643e829c], eax
mov dword [esp], 0x26c0
call ebx
push eax
mov eax, dword [0x643e829c]
imul ecx, dword [0x643e7f10], 0xbd45caef
xor eax, 0x2f11174b
and eax, 0x56b1a2ff
lea edx, [eax + 0x418f7156]
sub eax, 0x38b60123
mov dword [0x643e7ec0], ecx
mov dword [0x643e7f10], eax
mov eax, edx
mov dword [0x643e8238], edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x643cf3f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, str.originModule
push edx
call dword [sym.imp.USER32.dll_AnyPopup]
xor dword [0x643e7e60], 0xcf9121b8
and eax, 0xbd25e69f
mov dword [0x643e815c], eax
lea ecx, [eax + 0x357822d9]
mov dl, byte [ebx]
test dl, dl
je 0x643cf43b
sub edx, 0x30
cmp dl, 9
jbe 0x643cf438
xor eax, 0x789c3eb7
mov dword [0x643e815c], eax
jmp 0x643cf43b
inc ebx
jmp 0x643cf41e
mov eax, ecx
or eax, 0x797e25f6
mov dword [0x643e7dd4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, str.The_claim_type_requested_is_not_supported.
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x643cf45e
inc edx
jmp 0x643cf452
mov edx, str.The_flags_field_contains_an_invalid_value.
mov ecx, 0x1af5
movsx eax, byte [edx]
inc edx
test al, al
je 0x643cf489
add ecx, eax
cmp ecx, 0x2298
jbe 0x643cf468
mov eax, dword [0x643e815c]
add eax, 0x1b209cb5
mov dword [0x643e7dd4], eax
mov eax, dword [0x643e815c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
imul edx, dword [0x643e7e60], 0x41a71f20
sub eax, 0xc0f569c
or eax, 0xe59995f5
mov dword [0x643e7e60], eax
mov eax, edx
and eax, 0x6d9984e1
mov dword [0x643e815c], eax
call ebx
imul eax, dword [0x643e7dd4], 0x158fac4c
add dword [0x643e815c], 0x51992a11
mov dword [0x643e7e60], eax
call ebx
add dword [0x643e7dd4], 0x2c1060e4
xor eax, 0xbb991335
and eax, 0xdec7c1cb
or eax, 0x1050f881
mov dword [0x643e7e60], eax
pop eax
pop ebx
pop ebp
ret

Function at 0x643cf4f8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp], 0x1b4a
call dword [sym.imp.USER32.dll_IsZoomed]
push eax
mov eax, dword [0x643e7d8c]
or eax, 0x6abda9b5
mov dword [0x643e7d20], eax
add eax, 0x457c0a90
mov dword [0x643e7d8c], eax
mov dword [esp], 0x643eb298
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
mov edx, 0x643e85a0
mov al, byte [edx]
test al, al
je 0x643cf555
sub eax, 0x30
cmp al, 9
jbe 0x643cf552
and dword [0x643e7d8c], 0xc3cd0104
jmp 0x643cf555
inc edx
jmp 0x643cf539
imul eax, dword [0x643e7d8c], 0x2dc76ab4
mov ecx, str.SdbpGetMatchingTextAttributes
mov ebx, 0x8dd
xor eax, 0xc1ee066
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x643cf580
add ebx, edx
cmp ebx, 0x1695
jbe 0x643cf56e
add eax, 0x2cf898ce
mov ecx, str.image_heic
xor eax, 0xda2e026d
mov dword [0x643e7d20], eax
mov dl, byte [ecx]
test dl, dl
je 0x643cf5b1
sub edx, 0x30
cmp dl, 9
jbe 0x643cf5ae
add eax, 0x16fda3b
mov dword [0x643e7d20], eax
jmp 0x643cf5b1
inc ecx
jmp 0x643cf594
mov edx, dword [0x643e7d20]
mov ecx, 0x643e85a0
mov eax, edx
or eax, 0xbccd781f
mov dword [0x643e7d8c], eax
mov al, byte [ecx]
test al, al
je 0x643cf5e6
sub eax, 0x30
cmp al, 9
jbe 0x643cf5e3
sub edx, 0x3ef8d892
mov dword [0x643e7d8c], edx
jmp 0x643cf5e6
inc ecx
jmp 0x643cf5c8
imul eax, dword [0x643e7d8c], 0xc392935f
mov dword [0x643e7d20], eax
call dword [sym.imp.USER32.dll_AnyPopup]
mov eax, dword [0x643e7d20]
mov ebx, dword [ebp - 4]
and eax, 0x73fa5066
mov dword [0x643e7d20], eax
xor eax, 0x974865a8
mov dword [0x643e7d8c], eax
leave
jmp dword [sym.imp.KERNEL32.dll_GetCommandLineW]
Function at 0x643cf620
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x424
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643cf655
add ecx, eax
cmp ecx, 0x65
jbe 0x643cf634
imul eax, dword [0x643e7da8], 0x68cf9f90
mov dword [0x643e811c], eax
mov eax, dword [0x643e80b0]
mov edx, ebx
xor eax, 0xfb70e725
mov dword [0x643e7da8], eax
mov eax, dword [0x643e811c]
sub eax, 0x97d02a3
mov dword [0x643e8160], eax
mov ax, word [edx]
test ax, ax
je 0x643cf693
sub eax, 0x30
cmp ax, 9
jbe 0x643cf68e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x643cf693
add edx, 2
jmp 0x643cf675
mov eax, dword [0x643e8190]
xor eax, 0xb983db42
mov dword [0x643e811c], eax
xor eax, eax
cmp word [ebx + eax*2], 0
je 0x643cf6c2
inc eax
cmp eax, 0xa6
jne 0x643cf6a4
mov eax, dword [0x643e8160]
and eax, 0x3831da21
mov dword [0x643e811c], eax
imul eax, dword [0x643e7da8], 0x1556e18
mov dword [0x643e80b0], eax
mov eax, dword [0x643e8160]
or eax, 0x6621ec6b
mov dword [0x643e82a0], eax
mov dword [esp], 0x112a
call dword [sym.imp.USER32.dll_GetTopWindow]
sub eax, 0x2e0c45b5
push edx
mov dword [0x643e8190], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, dword [ebp + 8]
mov ecx, 0x23d1
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643cf72a
add ecx, eax
cmp ecx, 0x1213
jbe 0x643cf706
imul eax, dword [0x643e82a0], 0xd40440d4
mov dword [0x643e80b0], eax
mov eax, dword [0x643e82a0]
mov esi, ebx
mov edi, 0x147
mov dword [ebp - 0x1c], eax
mov eax, dword [0x643e8190]
mov edx, eax
or edx, 0x16079eca
lea ecx, [edx + 0x3fb17af8]
mov dword [0x643e8160], ecx
movzx ecx, word [esi]
add esi, 2
test cx, cx
je 0x643cf767
add edi, ecx
cmp edi, 0x265b
jbe 0x643cf752
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp + 8]
sub eax, 0x5666bb57
mov dword [0x643e82a0], eax
and ecx, 0x6040000c
cmp word [edi], 0
mov dword [0x643e811c], ecx
je 0x643cf795
add edx, 0xd4a1708
mov dword [0x643e8160], edx
mov ecx, ebx
mov esi, 0x1a8e
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x643cf7bb
add esi, edx
cmp esi, 0x54b
jbe 0x643cf79c
add dword [0x643e8160], 0x17738c23
mov edx, dword [ebp - 0x1c]
sub edx, 0x49567525
mov dword [0x643e7da8], edx
xor edx, edx
cmp word [ebx + edx*2], 0
je 0x643cf7e6
inc edx
cmp edx, 0x1017
jne 0x643cf7cc
or eax, 0x6aa0ac74
mov dword [0x643e8190], eax
mov eax, dword [0x643e8190]
sub eax, 0x2b038a0c
or eax, 0xeede09d7
mov dword [0x643e8190], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x643d00dc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x14
cmp word [eax + str._iCCP_ProfileName], 0
je 0x643d0108
add eax, 2
cmp eax, 0x1d04
jne 0x643d00e5
mov eax, dword [0x643e7dc8]
and eax, 0xb18bc4ad
mov dword [0x643e7e0c], eax
imul eax, dword [0x643e7e0c], 0xc87848b
mov dword [0x643e7dc8], eax
add eax, 0x566d91a9
xor eax, 0xe8998514
mov dword [0x643e7e0c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esp], 0xa72
xor dword [0x643e7dc8], 0xef8b6c15
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ecx, 0x113
push edx
mov edx, str.FreeLists
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643d0178
add ecx, eax
cmp ecx, 0xb63
jbe 0x643d014e
mov eax, dword [0x643e7e0c]
or eax, 0xb9ad6f06
mov dword [0x643e7dc8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor dword [0x643e7dc8], 0xa3821d8d
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call ebx
mov eax, dword [0x643e7e0c]
mov ecx, str.Specified_video_present_target_set_is_invalid.
and eax, 0xbe36eaab
imul eax, eax, 0x46a59965
mov dword [0x643e7e0c], eax
mov dl, byte [ecx]
test dl, dl
je 0x643d01c1
sub edx, 0x30
cmp dl, 9
jbe 0x643d01be
or eax, 0x4773d33e
mov dword [0x643e7e0c], eax
jmp 0x643d01c1
inc ecx
jmp 0x643d01a4
mov eax, dword [0x643e7e0c]
xor dword [0x643e7dc8], 0xa4d1be02
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
xor edx, edx
push eax
mov eax, dword [0x643e7dc8]
or eax, 0x3010a072
xor eax, 0x1d2b70d2
mov dword [0x643e7dc8], eax
cmp byte [edx + 0x643e83a0], 0
je 0x643d020d
inc edx
cmp edx, 0x6cb
jne 0x643d01f0
imul eax, eax, 0xb8ec870e
mov dword [0x643e7dc8], eax
mov eax, dword [0x643e7dc8]
add eax, 0x235eabe6
mov dword [0x643e7e0c], eax
call ebx
mov ebx, dword [ebp - 4]
mov dword [0x643e7e0c], 0x5b7c5a8c
sub eax, 0x48071373
or eax, 0xc2911906
add eax, 0x368ad19b
imul eax, eax, 0xa0bbab40
and eax, 0x1bfa624d
or eax, 0xdffedfee
mov dword [0x643e7dc8], eax
leave
ret
Function at 0x643d0acc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [0x643e82c4]
add eax, 0x27fe3cf7
mov dword [0x643e824c], eax
xor eax, eax
cmp byte [eax + str.An_internal_error_caused_an_operation_to_fail.], 0
je 0x643d0b0a
inc eax
cmp eax, 0x13aa
jne 0x643d0ae4
mov eax, dword [0x643e7d64]
or eax, 0xbea2519d
mov dword [0x643e8020], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [0x643e8020]
xor eax, 0x8b381b12
add eax, 0x30dc7360
mov dword [0x643e7d64], eax
mov eax, dword [0x643e824c]
sub eax, 0x13b803f8
mov dword [0x643e82c4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [0x643e7d64]
mov ebx, dword [sym.imp.USER32.dll_GetTopWindow]
mov dword [esp], 0x15a9
or dword [0x643e824c], 0x729a9eb8
mov eax, edx
imul edx, edx, 0x55aa3574
xor eax, 0x540dbef3
mov dword [0x643e82c4], eax
sub eax, 0x66bfc009
mov dword [0x643e8020], edx
mov dword [0x643e7d64], eax
call ebx
mov eax, dword [0x643e82c4]
push edx
mov edx, eax
xor eax, 0x22cce4b5
mov dword [0x643e82c4], eax
xor edx, 0x5ac71bc3
imul eax, dword [0x643e7d64], 0x3efa54ac
mov dword [0x643e824c], edx
mov dword [esp], edx
mov dword [0x643e7d64], eax
call ebx
xor eax, eax
push ecx
cmp byte [eax + str.The_current_allocation_cant_be_unswizzled_by_an_aperture.], 0
je 0x643d0bc9
inc eax
cmp eax, 0x1050
jne 0x643d0ba9
mov eax, dword [0x643e7d64]
or eax, 0x232d8fbb
mov dword [0x643e824c], eax
mov edx, dword [0x643e7d64]
imul eax, edx, 0xe420c54d
mov dword [esp], edx
add eax, 0x47062c59
mov dword [0x643e82c4], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edx, dword [0x643e82c4]
mov ebx, dword [ebp - 4]
push eax
imul eax, edx, 0x23c2ac80
add edx, 0x14aa1a3b
mov dword [0x643e7d64], edx
mov dword [0x643e8020], eax
xor eax, 0x5ba9ac73
mov dword [0x643e824c], eax
leave
ret
Function at 0x643d1168
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
je 0x643d1182
xor dword [0x643e81e4], 0x1dfdb102
mov eax, dword [0x643e7d40]
mov edx, dword [0x643e81e4]
mov ecx, ebx
xor eax, 0xc5c133bf
or edx, 0x83a16560
mov dword [0x643e808c], eax
mov dword [0x643e7d40], edx
mov dl, byte [ecx]
test dl, dl
je 0x643d11c4
sub edx, 0x30
cmp dl, 9
jbe 0x643d11c1
lea edx, [eax + 0x14df73b]
mov dword [0x643e7d40], edx
jmp 0x643d11c4
inc ecx
jmp 0x643d11a5
mov ecx, ebx
mov dl, byte [ecx]
test dl, dl
je 0x643d11e9
sub edx, 0x30
cmp dl, 9
jbe 0x643d11e6
sub eax, 0x41c3d7f8
mov dword [0x643e81e4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x643d11e9
inc ecx
jmp 0x643d11c6
mov eax, dword [0x643e7d40]
xor edx, edx
xor eax, 0x5bf81d0f
mov dword [0x643e7d40], eax
cmp byte [ebx + edx], 0
je 0x643d121e
inc edx
cmp edx, 0x13e1
jne 0x643d11fa
imul eax, eax, 0xc03be1b8
mov dword [0x643e81e4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push edx
cmp byte [ebx], 0
je 0x643d122d
and dword [0x643e7d40], 0x3b2460ec
mov edx, dword [0x643e7d40]
mov ecx, ebx
mov esi, 0x409
mov eax, edx
xor eax, 0x9e75badc
mov dword [0x643e808c], eax
movsx eax, byte [ecx]
inc ecx
test al, al
je 0x643d1264
add esi, eax
cmp esi, 0x431
jbe 0x643d1246
mov eax, edx
xor eax, 0xc10adc50
mov dword [0x643e808c], eax
mov eax, dword [0x643e808c]
imul edx, edx, 0x51790680
add eax, 0x64a7b911
mov dword [0x643e7d40], eax
sub edx, 0x4247a0b8
mov dword [0x643e81e4], edx
xor edx, edx
cmp byte [ebx + edx], 0
je 0x643d12aa
inc edx
cmp edx, 0x7d7
jne 0x643d1287
or eax, 0x55111050
mov dword [0x643e7d40], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
mov eax, dword [0x643e808c]
sub eax, 0x6e7ea9a4
mov dword [0x643e81e4], eax
xor eax, 0xf8b5a0e
mov dword [0x643e808c], eax
mov dl, byte [ebx]
test dl, dl
je 0x643d12e7
sub edx, 0x30
cmp dl, 9
jbe 0x643d12e4
imul eax, eax, 0x903c3aa7
mov dword [0x643e81e4], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
jmp 0x643d12e7
inc ebx
jmp 0x643d12c3
mov eax, dword [0x643e7d40]
sub eax, 0x16de2e0b
mov dword [0x643e808c], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, 0xa5414a76
mov dword [0x643e808c], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x643d1810
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov eax, ebx
and eax, 0x367879ba
mov dword [0x643e7fcc], eax
lea eax, [ebx + 0x7c9f6905]
mov dword [0x643e7fdc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp], str.AslFileMappingGetImageTypeEx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x94d
push edx
mov edx, edi
movsx eax, byte [edx]
inc edx
test al, al
je 0x643d1866
add ecx, eax
cmp ecx, 0x2646
jbe 0x643d1854
mov edx, edi
mov ecx, 0x1a76
movsx eax, byte [edx]
inc edx
test al, al
je 0x643d187f
add ecx, eax
cmp ecx, 0x16cf
jbe 0x643d186d
mov eax, dword [0x643e7fdc]
add eax, 0x13d63f9b
mov dword [0x643e7fcc], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor eax, eax
cmp byte [edi + eax], 0
je 0x643d18af
inc eax
cmp eax, 0x26d4
jne 0x643d1896
imul eax, ebx, 0x96ff05db
mov dword [0x643e7fcc], eax
mov eax, dword [0x643e7fcc]
xor eax, 0x5e421393
mov dword [0x643e7fdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, ebx
or eax, 0x98e0a13d
mov dword [0x643e7fdc], eax
lea eax, [ebx - 0x78417ed9]
mov dword [0x643e7fcc], eax
mov dword [esp], str.Debugger_got_control_C.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov ax, word [esi]
test ax, ax
je 0x643d190d
sub eax, 0x30
cmp ax, 9
jbe 0x643d1908
add ebx, 0x20e2ae2e
mov dword [0x643e7fcc], ebx
jmp 0x643d190d
add esi, 2
jmp 0x643d18e9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x643d1d8c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [0x643e8158]
mov ebx, dword [ebp + 8]
lea eax, [edx + 0x3d21ecbb]
mov dword [0x643e7fec], eax
xor eax, eax
cmp byte [ebx + eax], 0
je 0x643d1dcb
inc eax
cmp eax, 0x20ea
jne 0x643d1dab
imul edx, edx, 0x6c7edeb0
mov dword [0x643e81a8], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x643e8158]
or eax, 0xc1f7f9db
mov dword [0x643e7fec], eax
xor eax, 0x41ab86d
cmp byte [ebx], 0
mov dword [0x643e8158], eax
je 0x643d1dfe
mov eax, dword [0x643e81a8]
add eax, 0x34a0dc5
mov dword [0x643e8168], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x643e7df8]
mov ecx, ebx
mov eax, edx
and edx, 0x86499ac5
or edx, 0x82480804
or eax, 0xd2ea2c3c
mov dword [ebp - 0x1c], edx
mov dl, byte [ecx]
test dl, dl
je 0x643d1e41
sub edx, 0x30
cmp dl, 9
jbe 0x643d1e3e
mov edx, dword [0x643e8168]
xor edx, 0x73dbd27
mov dword [0x643e7df8], edx
jmp 0x643d1e41
inc ecx
jmp 0x643d1e1c
mov ecx, eax
mov esi, ebx
xor eax, 0xc540862c
mov edi, 0x4d0
xor ecx, 0x94d9e73f
mov dword [0x643e8168], ecx
movzx edx, byte [esi]
inc esi
test dl, dl
je 0x643d1e6d
add edi, edx
cmp edi, 0x1ccf
jbe 0x643d1e5b
sub eax, 0x56f5c567
mov dword [0x643e7fec], eax
mov eax, dword [ebp - 0x1c]
xor eax, 0x7ff05233
mov dword [0x643e8158], eax
lea eax, [ecx - 0x28b9300d]
mov dword [0x643e81a8], eax
mov dword [esp], ecx
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ecx, 0x1ce
add eax, 0x6f75351e
push edx
mov edx, ebx
mov dword [0x643e8168], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x643d1ecb
add ecx, eax
cmp ecx, 0x1a10
jbe 0x643d1eaa
mov eax, dword [0x643e81a8]
sub eax, 0x2c58dfdf
mov dword [0x643e8168], eax
imul eax, dword [0x643e8158], 0x2aa3e1d2
mov esi, 0xbb0
mov dword [0x643e8158], eax
mov eax, dword [0x643e7fec]
xor eax, 0x2c159230
mov dword [0x643e81a8], eax
call dword [sym.imp.USER32.dll_AnyPopup]
sub eax, 0x335048a3
mov dword [0x643e8158], eax
mov eax, dword [0x643e7fec]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebx
push eax
mov eax, dword [0x643e7df8]
sub eax, 0x3ae6b571
mov dword [0x643e81a8], eax
mov eax, dword [0x643e8158]
or eax, 0x7b1d8836
mov dword [0x643e8158], eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x643d1f3f
add esi, edx
cmp esi, 0x1359
jbe 0x643d1f2d
sub eax, 0x4239c79b
mov dword [0x643e8168], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x643e8168]
mov ecx, dword [0x643e7fec]
lea eax, [edx + 0x39e43d3a]
add edx, 0x403bbc42
xor ecx, 0xf65d4513
mov dword [0x643e81a8], eax
mov dword [0x643e7fec], edx
mov dword [0x643e7df8], ecx
mov ecx, 0x22d2
movzx edx, byte [ebx]
inc ebx
test dl, dl
je 0x643d1f95
add ecx, edx
cmp ecx, 0x2551
jbe 0x643d1f83
xor eax, 0x2fc6426e
mov dword [0x643e8158], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
or dword [0x643e8168], 0xd2dfad97
or eax, 0x3e82e78c
mov dword [0x643e7df8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x643d1fc4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov edx, str.AslStringDuplicate
mov ebp, esp
sub esp, 0x18
mov al, byte [edx]
test al, al
je 0x643d1ff0
sub eax, 0x30
cmp al, 9
jbe 0x643d1fed
mov eax, dword [0x643e7d74]
add eax, 0x7b17c361
mov dword [0x643e810c], eax
jmp 0x643d1ff0
inc edx
jmp 0x643d1fcf
xor eax, eax
cmp byte [eax + str.Log_service_encountered_a_corrupted_metadata_file.], 0
je 0x643d2012
inc eax
cmp eax, 0x1e0a
jne 0x643d1ff2
mov eax, dword [0x643e7e8c]
and eax, 0x190a9a53
mov dword [0x643e810c], eax
mov eax, dword [0x643e810c]
or eax, 0x53283a68
mov dword [0x643e82b0], eax
mov eax, dword [0x643e7d74]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov edx, dword [0x643e7f38]
push eax
lea eax, [edx + 0x58809236]
mov dword [0x643e82b0], eax
xor eax, eax
cmp byte [eax + str.The_combination_of_IPsec_transform_types_is_not_valid.], 0
je 0x643d2060
inc eax
cmp eax, 0x11c3
jne 0x643d2043
xor edx, 0xf8240f
mov dword [0x643e82b0], edx
imul eax, dword [0x643e7e8c], 0x66e00a6e
mov edx, dword [0x643e82b0]
xor edx, 0x58302814
mov dword [0x643e810c], eax
sub eax, 0x20d802a
mov dword [0x643e7d74], edx
mov dword [0x643e82b0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x643e7e8c]
mov edx, eax
and edx, 0x8a332a1e
mov dword [0x643e7f38], edx
mov edx, eax
imul eax, eax, 0xabd2e918
xor edx, 0x5c4c8230
mov dword [0x643e82b0], edx
mov dword [0x643e7d74], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, str.AslStringDuplicate
mov al, byte [edx]
test al, al
je 0x643d20e9
sub eax, 0x30
cmp al, 9
jbe 0x643d20e6
mov eax, dword [0x643e7e8c]
xor eax, 0xe88afead
mov dword [0x643e810c], eax
jmp 0x643d20e9
inc edx
jmp 0x643d20c8
mov eax, dword [0x643e810c]
lea edx, [eax - 0x49075b78]
xor eax, 0x2e07da08
or eax, 0xb2f18b49
mov dword [0x643e810c], edx
sub eax, 0x1fd81bc5
mov dword [0x643e7e8c], eax
mov eax, dword [0x643e82b0]
imul edx, eax, 0x5156c8c0
sub eax, 0x1f8be7c8
mov dword [0x643e7d74], eax
mov dword [0x643e7f38], edx
leave
ret