joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413940
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x38
fldz
mov eax, dword [esp + 0x3c]
push ebx
fstp qword [eax]
push ebp
push esi
push edi
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x17], 0
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov al, byte [esp + 0x38]
test al, al
je 0x413a27
movzx esi, al
lea ebp, [esi*8]
push ebp
mov dword [esp + 0x18], esi
call fcn.0044674b
mov edi, eax
push edi
mov eax, esi
call fcn.00402690
add esp, 8
test al, al
je 0x413a01
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
call fcn.0044674b
mov ebx, eax
push ebx
mov eax, esi
call fcn.00402690
add esp, 8
test al, al
je 0x413a01
test esi, esi
fldz
jle 0x4139f2
fld qword [0x49b758]
mov ecx, ebx
fld1
mov eax, edi
sub ecx, edi
mov edx, dword [ecx + eax]
sub edx, dword [eax]
mov ebp, dword [ecx + eax + 4]
sbb ebp, dword [eax + 4]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ebp
fild qword [esp + 0x18]
add eax, 8
sub esi, 1
fdiv st(2)
fsubr st(1)
faddp st(3)
jne 0x4139c8
fstp st(1)
fstp st(0)
fidiv dword [esp + 0x14]
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x13], 1
fstp qword [eax]
test edi, edi
je 0x413a0e
push edi
call fcn.0044666e
add esp, 4
test ebx, ebx
je 0x413a1b
push ebx
call fcn.0044666e
add esp, 4
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x38
ret

Function at 0x414230
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x90
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebp
mov ebp, dword [esp + 0x98]
mov ecx, ebx
call fcn.00468fc0
lea eax, [esp + 4]
push eax
push 1
push 0
push edi
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4142e3
push 0x7e
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004498f0
add esp, 0xc
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push ebp
push edx
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4142d8
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00469230
pop ebp
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.0044610a
add esp, 0x90
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x90]
pop ebp
xor ecx, esp
call fcn.0044610a
add esp, 0x90
ret
Function at 0x415400
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 0xc]
mov esi, eax
push esi
push ecx
mov dword [0x4ac7c0], 0
xor bl, bl
call fcn.0041f880
add esp, 8
cmp eax, 0xffffffff
je 0x4154d0
test bl, bl
jne 0x4154d0
add eax, 0xffffffc1
cmp eax, 0x35
ja case.0x41545e.64
movzx edx, byte [eax + 0x415518]
jmp dword [edx*4 + 0x4154fc]
or dword [0x4ac7c0], 1
jmp case.0x41545e.64
or dword [0x4ac7c0], 2
jmp case.0x41545e.64
or dword [0x4ac7c0], 4
jmp case.0x41545e.64
or dword [0x4ac7c0], 8
jmp case.0x41545e.64
or dword [0x4ac7c0], 0x10
jmp case.0x41545e.64
push 0x485658
mov ecx, ebp
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
mov ecx, dword [0x4ac7c4]
mov edx, dword [esi + ecx*4 - 4]
push edx
mov ecx, eax
call fcn.0046c360
mov bl, 1
mov eax, dword [esp + 0xc]
push esi
push eax
call fcn.0041f880
add esp, 8
cmp eax, 0xffffffff
jne 0x415447
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
je 0x4154f5
push 0x485664
mov ecx, ebp
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
Function at 0x4159b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x810
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
lea eax, [esp + 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWARESogouInput
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x415a02
xor al, al
pop ebx
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0044610a
add esp, 0x810
ret
push 0x7fe
lea ecx, [esp + 0x16]
push ebx
push ecx
mov word [esp + 0x1c], bx
call fcn.004498f0
add esp, 0xc
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0x483d38
push edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x415a5c
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00469520
mov bl, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x810]
mov al, bl
pop ebx
xor ecx, esp
call fcn.0044610a
add esp, 0x810
ret
Function at 0x417190
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x473b90
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebp
push esi
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
push 0x4a93d0
lea eax, [esp + 0x38]
push eax
push str.UserManager
call fcn.00402f70
add esp, 4
mov ecx, eax
call fcn.0043fa40
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
push str.Popup
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x80], ebp
call fcn.0046e600
lea ecx, [esp + 0x34]
call fcn.0046d3c0
lea ecx, [esp + 0x24]
call fcn.0046d380
push eax
lea ecx, [esp + 0x18]
call fcn.00469560
push 0x485bc8
lea ecx, [esp + 0x18]
mov byte [esp + 0x6c], 3
call fcn.00469230
push 0x4b20a8
lea ecx, [esp + 0x18]
call fcn.00468b10
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4172f1
push 0x4b20a8
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4172ea
jmp 0x417260
push 0x485bd4
push 0x4b20d4
call fcn.00446cee
add esp, 8
test eax, eax
je 0x4172d6
mov eax, 0x4b20d4
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], ebp
mov word [esp + 0x48], bp
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x417290
sub eax, edx
sar eax, 1
push eax
push 0x4b20d4
lea esi, [esp + 0x4c]
call fcn.00401fa0
mov ecx, esi
push ecx
mov esi, ebx
mov byte [esp + 0x6c], 4
call fcn.00418bf0
mov byte [esp + 0x68], 3
cmp dword [esp + 0x5c], 8
jb 0x4172d6
mov edx, dword [esp + 0x48]
push edx
call fcn.00445f7c
add esp, 4
push 0x4b20a8
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x417260
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
call fcn.00468c30
lea ecx, [esp + 0x24]
call fcn.0046d3c0
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x5c
ret
Function at 0x419c40
Capabilities:
Connect to http server
Create http request
Query remote server for available data
Send data
Send http request

Disassembly:
sub esp, 0x630
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x628], eax
mov eax, dword [esp + 0x638]
push ebp
mov ebp, dword [esp + 0x638]
push esi
push edi
push 0
push 0
push 0
push 0
push str.SpeedReport_0.4
mov dword [esp + 0x2c], eax
mov edi, edx
mov dword [esp + 0x28], ecx
call dword [sym.imp.WININET.dll_InternetOpenW]
push 0
push 0
push 3
push 0
push 0
push 0x50
push str.st.pinyin.sogou.com
push eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov edx, dword [str._st_ping2_]
mov ecx, dword [0x485f74]
mov dword [esp + 0x230], edx
mov edx, dword [0x485f78]
mov dword [esp + 0x10], eax
mov eax, dword [0x485f70]
push 0x3ea
mov dword [esp + 0x240], edx
mov dword [esp + 0x238], eax
mov eax, dword [0x485f7c]
mov dword [esp + 0x23c], ecx
mov cx, word [0x485f80]
lea edx, [esp + 0x24a]
push 0
push edx
mov dword [esp + 0x24c], eax
mov word [esp + 0x250], cx
call fcn.004498f0
add esp, 0xc
lea esi, [esp + 0x20]
call fcn.0041de50
push 0
call fcn.004476fc
add esp, 4
push edx
push eax
mov ecx, esi
call fcn.00468ae0
push eax
push ebx
push str.v_sh_sts_d
push 0xff
lea eax, [esp + 0x48]
push 0xff
push eax
call fcn.0044664f
push 0x200
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x258]
push 0x200
push edx
call fcn.0044808c
add esp, 0x30
xor esi, esi
test ebp, ebp
jbe 0x419db3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + esi*4]
push ecx
push esi
push edi
push esi
push str.d_u_st_u_u
push 0xff
lea edx, [esp + 0x48]
push 0xff
push edx
call fcn.0044664f
push 0x200
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x258]
push 0x200
push ecx
call fcn.0044808c
add esi, 1
add esp, 0x30
add edi, 0x400
cmp esi, ebp
jb 0x419d63
mov edx, dword [esp + 0x14]
mov esi, dword [edx]
xor edi, edi
test esi, esi
je 0x419e0d
nop
mov eax, esi
mov esi, dword [esi]
lea ecx, [eax + 8]
call fcn.00468ae0
push eax
push edi
push str.dom_d_s
push 0xff
lea eax, [esp + 0x40]
push 0xff
push eax
call fcn.0044664f
push 0x200
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x250]
push 0x200
push edx
call fcn.0044808c
add esp, 0x28
add edi, 1
test esi, esi
jne 0x419dc0
mov ecx, dword [esp + 0x10]
push 0
push 0x806cc200
push 0
push 0
push 0
lea eax, [esp + 0x244]
push eax
push 0x485ef0
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
push 0
push 0
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
push 0
push 0
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [esp + 0x20]
call fcn.00468c30
mov ecx, dword [esp + 0x634]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0044610a
add esp, 0x630
ret 8
Function at 0x419e90
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x48
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push 0x3f
lea eax, [esp + 0xd]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x14], 0
call fcn.004498f0
add esp, 0xc
push 0
push 0
push 0x40
lea ecx, [esp + 0x14]
push ecx
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [esp + 8]
push edx
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x419f0d
cmp word [eax + 8], 2
jne 0x419f0d
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push ecx
call sub.WS2_32.dll_inet_ntoa
test eax, eax
je 0x419f0d
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x419ef8
sub ecx, esi
je 0x419f0d
push eax
mov ecx, edi
call fcn.00469030
mov ecx, dword [esp + 0x48]
pop esi
xor ecx, esp
call fcn.0044610a
add esp, 0x48
ret
Function at 0x41a5b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4b0e30
sub esp, 0xc
lea edx, [eax + 2]
jmp 0x41a5c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41a5c0
sub eax, edx
sar eax, 1
jne 0x41a64a
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWARESogouInput
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a64a
lea ecx, [esp + 4]
push ecx
push 0x4b0e30
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x10]
push 0x48603c
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41a640
push 0x200
push 0
push 0x4b0e30
call fcn.004498f0
add esp, 0xc
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x4b0e30
add esp, 0xc
ret

Function at 0x41a660
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x818
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x814], eax
lea eax, [esp]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41a798
mov eax, dword [esp]
push ebx
lea ecx, [esp + 0xc]
push ecx
push 0x800
lea edx, [esp + 0x20]
push edx
push 2
xor ebx, ebx
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x41a6d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop ebx
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.0044610a
add esp, 0x818
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 8]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x41a6bb
push esi
xor esi, esi
cmp dword [esp + 0x1c], ebx
jle 0x41a774
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_EqualSid]
push edi
lea edi, [esp + 0x28]
nop
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
push ecx
push edx
call ebp
test eax, eax
jne 0x41a770
add esi, 1
add edi, 8
cmp esi, dword [esp + 0x24]
jl 0x41a730
mov eax, dword [esp + 0x14]
pop edi
pop ebp
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.0044610a
add esp, 0x818
ret
pop edi
mov bl, 1
pop ebp
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.0044610a
add esp, 0x818
ret
mov ecx, dword [esp + 0x814]
xor ecx, esp
xor al, al
call fcn.0044610a
add esp, 0x818
ret
Function at 0x41ce60
Capabilities:
Create http request

Disassembly:
push ecx
push esi
push 0
push 0
push 0
push 0
push str.SOGOU_UPDATER
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
je 0x41ceee
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea eax, [esp + 0xc]
push eax
push 5
push esi
mov dword [esp + 0x18], 0x4e20
call edi
push 4
lea ecx, [esp + 0xc]
push ecx
push 7
push esi
call edi
push 4
lea edx, [esp + 0xc]
push edx
push 2
push esi
call edi
push 4
lea eax, [esp + 0xc]
push eax
push 6
push esi
call edi
push 4
lea ecx, [esp + 0xc]
push ecx
push 8
push esi
call edi
mov edx, dword [esp + 0x10]
push 0
push 0x84000000
push 0
push 0
push edx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
test eax, eax
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x41ceea
push eax
call edi
push esi
call edi
pop edi
pop esi
pop ecx
ret 4

Function at 0x41cf00
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x472fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 4], 0
jne 0x41d02b
lea ecx, [esi + 0x18]
mov byte [esi + 4], 1
call fcn.00468ae0
push eax
lea ecx, [esp + 0x14]
call fcn.00469560
push str.begin1
lea ecx, [esi + 0x28]
call fcn.00468b10
push eax
push 0x4825c0
lea ecx, [esp + 0x1c]
call fcn.00469230
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469230
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [0x4ac7c0], 4
lea ecx, [esp + 0x10]
jne 0x41cf8b
push str.s1
jmp 0x41cf90
push str.s0
call fcn.00469230
mov eax, 0x4afbe0
cmp eax, 0x4afab4
jne 0x41cfa8
mov eax, 1
jmp 0x41cfcb
mov ecx, 0x4afbe0
cmp ecx, 0x4af3d4
jne 0x41cfbc
mov eax, 5
jmp 0x41cfcb
mov edi, 0x4afbe0
mov esi, 0x4ae690
call fcn.00429560
push eax
push str.mod
lea ecx, [esp + 0x18]
call fcn.00469230
mov ecx, eax
call fcn.00469260
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push str.ip
push eax
push str.url
lea ecx, [esp + 0x20]
call fcn.00469230
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469230
lea ecx, [esp + 0x10]
call fcn.00468b10
push eax
call fcn.0041ce60
lea ecx, [esp + 0x10]
call fcn.00468c30
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
Function at 0x41d040
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x472fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
cmp byte [esi + 4], 0
je 0x41d175
lea ecx, [esi + 0x18]
call fcn.00468ae0
push eax
lea ecx, [esp + 0x14]
call fcn.00469560
lea ebx, [esi + 8]
mov ecx, ebx
call fcn.00468bf0
test eax, eax
jbe 0x41d0a5
mov ecx, ebx
call fcn.00468ae0
push eax
lea ecx, [esp + 0x14]
call fcn.00469230
test edi, edi
je 0x41d0d8
push edi
push str.end
lea ecx, [esi + 0x28]
call fcn.00468b10
push eax
push 0x4825c0
lea ecx, [esp + 0x20]
call fcn.00469230
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469230
mov ecx, eax
jmp 0x41d0e1
push str.end1
lea ecx, [esp + 0x14]
call fcn.00469230
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [0x4ac7c0], 4
lea ecx, [esp + 0x10]
jne 0x41d100
push str.s1
jmp 0x41d105
push str.s0
call fcn.00469230
mov eax, 0x4afbe0
cmp eax, 0x4afab4
jne 0x41d11d
mov eax, 1
jmp 0x41d140
mov ecx, 0x4afbe0
cmp ecx, 0x4af3d4
jne 0x41d131
mov eax, 5
jmp 0x41d140
mov edi, 0x4afbe0
mov esi, 0x4ae690
call fcn.00429560
push eax
push str.mod
lea ecx, [esp + 0x18]
call fcn.00469230
mov ecx, eax
call fcn.00469260
lea ecx, [esp + 0x10]
call fcn.00468b10
push eax
call fcn.0041ce60
mov ecx, ebx
call fcn.00468fc0
lea ecx, [esp + 0x10]
call fcn.00468c30
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x41def0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x472c0b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov ecx, edi
mov dword [esp + 8], edi
call fcn.0046da70
push 0x206
lea eax, [esp + 0x22]
push 0
mov dword [esp + 0x238], 0
push eax
mov word [esp + 0x28], 0
call fcn.004498f0
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x41dfd2
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41df73
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x1a], 0x5c
jne 0x41dfa5
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41df91
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0x1a], cx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x24]
call fcn.0046d910
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.0046d7d0
lea ecx, [esp + 0xc]
call fcn.0046d3c0
mov eax, edi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0044610a
add esp, 0x230
ret
Function at 0x41e040
Capabilities:
Get file version info

Disassembly:
sub esp, 0x254
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [esp + 0x258]
push ebp
push esi
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x18], eax
call fcn.0046d3a0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jbe 0x41e191
push edi
push esi
call fcn.00445a98
add esp, 4
mov edi, eax
push edi
push esi
push ebp
mov ecx, ebx
call fcn.0046d3a0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41e187
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x481f7c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41e187
push 0x30
lea ecx, [esp + 0x28]
push ebp
push ecx
mov dword [esp + 0x2c], ebp
call fcn.004498f0
mov edx, dword [esp + 0x18]
push 0x34
push edx
lea eax, [esp + 0x34]
push 0x34
push eax
call fcn.0044608f
add esp, 0x1c
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41e187
mov eax, dword [esp + 0xc]
push 4
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
mov word [esp + 0x20], bp
mov word [esp + 0x22], bp
call fcn.0044608f
push 0x206
lea edx, [esp + 0x6a]
push ebp
push edx
mov word [esp + 0x70], bp
call fcn.004498f0
movzx eax, word [esp + 0x2e]
movzx ecx, word [esp + 0x2c]
push eax
push ecx
push str.StringFileInfo_04x_04xFileVersion
lea edx, [esp + 0x7c]
push 0x104
push edx
call fcn.00446633
add esp, 0x30
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x5c]
push edx
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
push eax
push 0x483350
push 0x40
push ecx
call fcn.00446633
add esp, 0x10
push edi
call fcn.00445f7c
add esp, 4
pop edi
mov ecx, dword [esp + 0x258]
pop esi
pop ebp
xor ecx, esp
call fcn.0044610a
add esp, 0x254
ret
Function at 0x41e1b0
Capabilities:
Enumerate files on windows
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x472fa6
mov eax, dword fs:[0]
push eax
sub esp, 0x710
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x70c], eax
push ebx
push ebp
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x720]
mov dword fs:[0], eax
xor ebp, ebp
push 0x206
lea eax, [esp + 0x51a]
push ebp
push eax
mov word [esp + 0x520], bp
call fcn.004498f0
push 0x206
lea ecx, [esp + 0x31e]
push ebp
push ecx
mov word [esp + 0x324], bp
call fcn.004498f0
add esp, 0x18
push 0x104
lea edx, [esp + 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x30c]
push eax
push str._sSogouPy.ime
lea ecx, [esp + 0x51c]
push 0x104
push ecx
call fcn.00446633
push 0x24c
lea edx, [esp + 0x54]
push ebp
push edx
mov dword [esp + 0x58], ebp
call fcn.004498f0
add esp, 0x1c
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x518]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x41e3c6
mov edi, edi
push ebp
push ebp
push ebp
push ebp
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x320]
push eax
lea ecx, [esp + 0x34]
call fcn.0046d910
push 0x7e
lea ecx, [esp + 0x292]
push ebp
mov dword [esp + 0x730], ebp
push ecx
mov word [esp + 0x298], bp
call fcn.004498f0
lea edx, [esp + 0x298]
push edx
lea ebx, [esp + 0x2c]
call fcn.0041e040
add esp, 0x10
lea eax, [esp + 0x28c]
push eax
lea ecx, [esp + 0x30]
call fcn.00469560
mov byte [esp + 0x728], 1
cmp dword [esi + 0x10], ebp
mov ecx, dword [esi + 4]
mov dword [esp + 0x18], ecx
jne 0x41e350
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 4]
push eax
call edx
add esp, 4
cmp eax, ebp
jne 0x41e320
xor eax, eax
jmp 0x41e328
mov ecx, dword [esi + 0xc]
mov dword [eax], ecx
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0x14]
lea edx, [ecx + ecx*2]
add ecx, 0xffffffff
cmp ecx, ebp
lea eax, [eax + edx*8 - 0x14]
jl 0x41e350
lea esp, [esp]
mov edx, dword [esi + 0x10]
mov dword [eax], edx
mov dword [esi + 0x10], eax
sub eax, 0x18
sub ecx, 1
jns 0x41e340
mov edi, dword [esi + 0x10]
cmp edi, ebp
mov ebx, dword [edi]
je 0x41e366
lea eax, [esp + 0x2c]
push eax
lea ecx, [edi + 8]
call fcn.004695b0
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x10], ebx
mov dword [edi + 4], ecx
mov dword [edi], ebp
mov eax, dword [esi + 4]
add dword [esi + 8], 1
cmp eax, ebp
je 0x41e381
mov dword [eax], edi
jmp 0x41e383
mov dword [esi], edi
lea ecx, [esp + 0x2c]
mov dword [esi + 4], edi
call fcn.00468c30
lea ecx, [esp + 0x1c]
mov dword [esp + 0x728], 0xffffffff
call fcn.0046d3c0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41e290
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x720]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x70c]
xor ecx, esp
call fcn.0044610a
add esp, 0x71c
ret