joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4178dc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4f04c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x244]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x232]
push ebx
push eax
mov word [ebp - 0x234], bx
call fcn.00447440
xor eax, eax
mov word [ebp - 0x2c], bx
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x18], bx
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push 0x4bb4d0
push eax
call fcn.004479ae
movzx eax, word [ebp - 0x23e]
push eax
movzx eax, word [ebp - 0x242]
push eax
movzx eax, word [ebp - 0x244]
push eax
lea eax, [ebp - 0x18]
push str._.4d_.2d_.2d
push eax
call fcn.004479ae
add esp, 0x2c
cmp dword [esi + 0x104], 8
jb 0x417983
mov eax, dword [esi + 0xf0]
jmp 0x417989
lea eax, [esi + 0xf0]
push eax
push ebx
mov ebx, str.LastUseDay
push ebx
mov edi, str.Setting
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx ecx, word [ebp - 0x244]
movzx edx, word [ebp - 0x242]
imul ecx, ecx, 0x64
add ecx, edx
movzx edx, word [ebp - 0x23e]
imul ecx, ecx, 0x64
add ecx, edx
cmp eax, ecx
je 0x417a6e
cmp dword [esi + 0x104], 8
jb 0x4179d5
mov eax, dword [esi + 0xf0]
jmp 0x4179db
lea eax, [esi + 0xf0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, str.UseDayTotal
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.00447992
cmp dword [esi + 0x104], 8
pop ecx
pop ecx
jb 0x417a0d
mov eax, dword [esi + 0xf0]
jmp 0x417a13
lea eax, [esi + 0xf0]
push eax
push 0
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
inc eax
push eax
lea eax, [ebp - 0x18]
push 0x4bb4d0
push eax
call fcn.004479ae
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.00447992
add esp, 0x14
cmp dword [esi + 0x104], 8
jb 0x417a55
mov esi, dword [esi + 0xf0]
jmp 0x417a5b
add esi, 0xf0
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004471af
leave
ret
Function at 0x417dde
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x4f04c0]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
push esi
push edi
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp - 0x6a]
push ebx
push eax
mov esi, ecx
mov word [ebp - 0x6c], bx
call fcn.00447440
push edi
lea eax, [ebp + 0x19e]
push ebx
push eax
mov word [ebp + 0x19c], bx
call fcn.00447440
mov eax, dword [esi + 0x24]
add esp, 0x18
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x78]
call fcn.00424706
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x80]
call fcn.00424706
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x78]
call fcn.0040b5af
test al, al
jne 0x417f9d
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, str.HotKey
lea ecx, [ebp - 0x78]
call fcn.0041dd3f
mov eax, dword [eax + 4]
mov dword [ebp - 0x70], eax
add eax, 0xc
push eax
call fcn.00446b43
test eax, eax
pop ecx
jle 0x417f72
mov eax, dword [ebp - 0x70]
add eax, 0xc
push eax
lea eax, [ebp - 0x6c]
push str.Is_s
push eax
call fcn.004479ae
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x417eb4
mov eax, dword [esi + 0x9c]
jmp 0x417eba
lea eax, [esi + 0x9c]
push eax
push 0x104
lea eax, [ebp + 0x19c]
push eax
push 0x4bbde0
lea eax, [ebp - 0x6c]
push eax
push ebx
call edi
lea eax, [ebp + 0x19c]
push 0x4bbde0
push eax
call fcn.004472c8
test eax, eax
pop ecx
pop ecx
je 0x417eff
lea eax, [ebp + 0x19c]
push eax
call fcn.00447b49
pop ecx
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 4]
mov byte [ecx], al
mov eax, dword [ebp - 0x70]
add eax, 0xc
push eax
lea eax, [ebp - 0x6c]
push str.Use_s
push eax
call fcn.004479ae
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x417f28
mov eax, dword [esi + 0x9c]
jmp 0x417f2e
lea eax, [esi + 0x9c]
push eax
push 0x104
lea eax, [ebp + 0x19c]
push eax
push str.nothing
lea eax, [ebp - 0x6c]
push eax
push ebx
call edi
lea eax, [ebp + 0x19c]
push str.nothing
push eax
call fcn.004472c8
test eax, eax
pop ecx
pop ecx
je 0x417f72
lea eax, [ebp + 0x19c]
push eax
mov eax, dword [ebp - 0x70]
push dword [eax + 8]
call fcn.00447992
pop ecx
pop ecx
lea ecx, [ebp - 0x78]
call fcn.00424609
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x80]
call fcn.00424706
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x78]
call fcn.0040b5af
test al, al
je 0x417e6b
mov ecx, dword [ebp + 0x3a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004471af
add ebp, 0x3a8
leave
ret
Function at 0x417fb5
Capabilities:
Copy file

Disassembly:
push ebp
lea ebp, [esp - 0x3ac]
sub esp, 0x42c
mov eax, dword [0x4f04c0]
xor eax, ebp
mov dword [ebp + 0x3a8], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x70]
call fcn.00424706
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.00424706
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040b5af
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x4180f9
lea ecx, [ebp - 0x70]
call fcn.0041dd3f
mov ebx, dword [eax + 4]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x74], eax
mov eax, dword [ebx + 4]
cmp byte [eax], 0
lea eax, [ebp + 0x1a0]
je 0x418032
push 0x4b9e58
jmp 0x418037
push 0x4ba094
push 0x4b9e74
push eax
call fcn.004479ae
add esp, 0xc
add ebx, 0xc
push ebx
lea eax, [ebp - 0x68]
push str.Is_s
push eax
mov dword [ebp - 0x80], ebx
call fcn.004479ae
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x41806e
mov eax, dword [esi + 0x9c]
jmp 0x418074
lea eax, [esi + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
mov ebx, str.HotKey
push ebx
call edi
push dword [ebp - 0x80]
lea eax, [ebp - 0x68]
push str.Use_s
push eax
call fcn.004479ae
push dword [ebp - 0x74]
lea eax, [ebp + 0x1a0]
push 0x4b9e74
push eax
call fcn.004479ae
add esp, 0x18
cmp dword [esi + 0xb0], 8
jb 0x4180c1
mov eax, dword [esi + 0x9c]
jmp 0x4180c7
lea eax, [esi + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
lea ecx, [ebp - 0x70]
call fcn.00424609
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.00424706
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040b5af
test al, al
je 0x41800c
cmp dword [esi + 0xe8], 8
jb 0x418112
mov eax, dword [esi + 0xd4]
jmp 0x418118
lea eax, [esi + 0xd4]
push eax
push 0x4b9e58
push str.ModifyHotKey
mov ebx, str.SetModify
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x41813c
mov eax, dword [esi + 0xd4]
jmp 0x418142
lea eax, [esi + 0xd4]
push eax
push 0x4b9e58
push str.ModifyHotKey64
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x418161
mov eax, dword [esi + 0xd4]
jmp 0x418167
lea eax, [esi + 0xd4]
push eax
push 0x4b9e58
push str.TempModifyHotKey
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x418186
mov eax, dword [esi + 0xd4]
jmp 0x41818c
lea eax, [esi + 0xd4]
push eax
push 0x4b9e58
push str.TempModifyHotKey64
push ebx
call edi
lea eax, [esi + 0xb4]
cmp dword [eax + 0x18], 8
jb 0x4181ab
mov eax, dword [eax + 4]
jmp 0x4181ae
add eax, 4
add esi, 0x98
cmp dword [esi + 0x18], 8
jb 0x4181bf
mov esi, dword [esi + 4]
jmp 0x4181c2
add esi, 4
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp + 0x3a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004471af
add ebp, 0x3ac
leave
ret
Function at 0x417fd1
Capabilities:
Copy file

Disassembly:
push ebp
lea ebp, [esp - 0x3ac]
sub esp, 0x42c
mov eax, dword [0x4f04c0]
xor eax, ebp
mov dword [ebp + 0x3a8], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x70]
call fcn.00424706
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.00424706
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040b5af
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x4180f9
lea ecx, [ebp - 0x70]
call fcn.0041dd3f
mov ebx, dword [eax + 4]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x74], eax
mov eax, dword [ebx + 4]
cmp byte [eax], 0
lea eax, [ebp + 0x1a0]
je 0x418032
push 0x4b9e58
jmp 0x418037
push 0x4ba094
push 0x4b9e74
push eax
call fcn.004479ae
add esp, 0xc
add ebx, 0xc
push ebx
lea eax, [ebp - 0x68]
push str.Is_s
push eax
mov dword [ebp - 0x80], ebx
call fcn.004479ae
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x41806e
mov eax, dword [esi + 0x9c]
jmp 0x418074
lea eax, [esi + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
mov ebx, str.HotKey
push ebx
call edi
push dword [ebp - 0x80]
lea eax, [ebp - 0x68]
push str.Use_s
push eax
call fcn.004479ae
push dword [ebp - 0x74]
lea eax, [ebp + 0x1a0]
push 0x4b9e74
push eax
call fcn.004479ae
add esp, 0x18
cmp dword [esi + 0xb0], 8
jb 0x4180c1
mov eax, dword [esi + 0x9c]
jmp 0x4180c7
lea eax, [esi + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
lea ecx, [ebp - 0x70]
call fcn.00424609
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.00424706
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040b5af
test al, al
je 0x41800c
cmp dword [esi + 0xe8], 8
jb 0x418112
mov eax, dword [esi + 0xd4]
jmp 0x418118
lea eax, [esi + 0xd4]
push eax
push 0x4b9e58
push str.ModifyHotKey
mov ebx, str.SetModify
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x41813c
mov eax, dword [esi + 0xd4]
jmp 0x418142
lea eax, [esi + 0xd4]
push eax
push 0x4b9e58
push str.ModifyHotKey64
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x418161
mov eax, dword [esi + 0xd4]
jmp 0x418167
lea eax, [esi + 0xd4]
push eax
push 0x4b9e58
push str.TempModifyHotKey
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x418186
mov eax, dword [esi + 0xd4]
jmp 0x41818c
lea eax, [esi + 0xd4]
push eax
push 0x4b9e58
push str.TempModifyHotKey64
push ebx
call edi
lea eax, [esi + 0xb4]
cmp dword [eax + 0x18], 8
jb 0x4181ab
mov eax, dword [eax + 4]
jmp 0x4181ae
add eax, 4
add esi, 0x98
cmp dword [esi + 0x18], 8
jb 0x4181bf
mov esi, dword [esi + 4]
jmp 0x4181c2
add esi, 4
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp + 0x3a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004471af
add ebp, 0x3ac
leave
ret
Function at 0x41bd04
Capabilities:
Terminate thread

Disassembly:
push 8
mov eax, 0x4b4255
call fcn.004471be
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CDictBar.5.0
mov dword [esi + 0x4a0], 0x4bdfac
mov dword [esi + 0x4f4], 0x4bdfa4
mov dword [esi + 0x504], 0x4bdf9c
mov dword [esi + 0x508], 0x4bdf4c
mov dword [esi + 0x518], 0x4bdf40
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea edi, [esi + 0x6b4]
push dword [edi]
mov dword [ebp - 4], 3
call ebx
push dword [ebp - 0x10]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [edi], 0
lea eax, [ebp - 0x10]
push eax
lea edi, [esi + 0x6b8]
push dword [edi]
call ebx
push dword [ebp - 0x10]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [edi], 0
push 0
push 1
lea ecx, [esi + 0x698]
call fcn.00401b15
lea ecx, [esi + 0x688]
call fcn.0041b385
lea ecx, [esi + 0x530]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CMarkup::destructor_void_]
lea ecx, [esi + 0x51c]
mov dword [esi + 0x518], 0x4bdf38
call fcn.0041b385
lea ecx, [esi + 0x508]
mov byte [ebp - 4], 1
call fcn.00425502
lea ecx, [esi + 0x4f4]
mov byte [ebp - 4], 0
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CNotifyPump::destructor_void_]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [sym.imp.DuiLib32.dll_public_virtual:_void___thiscall_DuiLib::CContainerUI::destructor_void_]
call fcn.00447296
ret
Function at 0x41c508
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x68
lea ebp, [esp - 4]
mov eax, dword [0x4f04c0]
xor eax, ebp
mov dword [ebp + 0x68], eax
push 0x38
mov eax, 0x4b43b9
call fcn.004471be
call fcn.0040361f
mov ecx, eax
call fcn.004017ae
mov esi, eax
mov eax, dword [esi + 4]
push esi
push eax
lea ecx, [ebp + 0x44]
mov dword [ebp + 0x38], esi
call fcn.0041bca1
mov eax, dword [esi + 8]
push esi
push eax
lea ecx, [ebp + 0x3c]
call fcn.0041bca1
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp + 0x44]
call fcn.0040b5af
xor ebx, ebx
inc ebx
jmp 0x41c6c3
lea ecx, [ebp + 0x44]
call fcn.00403545
mov esi, dword [eax]
push 0x4b9d60
lea ecx, [ebp + 0x1c]
call fcn.004021c0
mov eax, dword [esi]
and dword [ebp - 4], 0
lea ecx, [ebp + 0x1c]
push ecx
mov ecx, esi
call dword [eax + 0x1c]
or dword [ebp - 4], 0xffffffff
push 0
push ebx
lea ecx, [ebp + 0x1c]
mov edi, eax
call fcn.00401b15
call fcn.0040361f
mov ecx, eax
call fcn.00408f78
push eax
lea ecx, [ebp + 0x4c]
call fcn.004021c0
push str.Dict
lea ecx, [ebp + 0x4c]
mov dword [ebp - 4], ebx
call fcn.00404055
push 0x4ba098
lea ecx, [ebp + 0x4c]
call fcn.00404055
cmp dword [edi + 0x18], 8
jb 0x41c5d9
mov edi, dword [edi + 4]
jmp 0x41c5dc
add edi, 4
push edi
lea ecx, [ebp + 0x4c]
call fcn.00404055
push str..dcel
lea ecx, [ebp + 0x4c]
call fcn.00404055
cmp dword [ebp + 0x64], 8
mov eax, dword [ebp + 0x50]
jae 0x41c5fe
lea eax, [ebp + 0x50]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c64a
push 0x4b9e58
lea ecx, [ebp - 0x28]
call fcn.004021c0
push 0x4b9d20
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call fcn.004021c0
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp + 0x1c]
push ecx
mov ecx, esi
mov byte [ebp - 4], 3
call dword [eax + 8]
push 0
push ebx
lea ecx, [ebp + 0x1c]
call fcn.00401b15
lea ecx, [ebp - 0x28]
jmp 0x41c689
push 0x4ba094
lea ecx, [ebp - 0x44]
call fcn.004021c0
push 0x4b9d20
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.004021c0
mov eax, dword [esi]
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp]
push ecx
mov ecx, esi
mov byte [ebp - 4], 5
call dword [eax + 8]
push 0
push ebx
lea ecx, [ebp]
call fcn.00401b15
lea ecx, [ebp - 0x44]
push 0
push ebx
call fcn.00401b15
or dword [ebp - 4], 0xffffffff
push 0
push ebx
lea ecx, [ebp + 0x4c]
call fcn.00401b15
lea ecx, [ebp + 0x44]
call fcn.0041bbee
mov eax, dword [ebp + 0x38]
push eax
push dword [eax + 8]
lea ecx, [ebp + 0x3c]
call fcn.0041bca1
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp + 0x44]
call fcn.0040b5af
test al, al
je 0x41c565
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x68]
xor ecx, ebp
call fcn.004471af
add ebp, 0x6c
leave
ret

Function at 0x41d4c9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x41d49a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x6b8], eax
pop esi
leave
ret 4
Function at 0x41d9e2
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov esi, ecx
mov ecx, dword [esi + 0x514]
push str.dictbar_commonusedict
call edi
mov ecx, dword [esi + 0x514]
push str.dictbar_recommenddict
mov dword [esi + 0x680], eax
call edi
mov ecx, dword [esi + 0x514]
push str.dictbar_commonusedict_setheight
mov dword [esi + 0x684], eax
call edi
mov ecx, dword [esi + 0x514]
push str.dictbar_recommenddict_setheight
mov dword [esi + 0x678], eax
call edi
lea ecx, [esi + 0x508]
mov dword [esi + 0x67c], eax
call fcn.004252d6
mov ecx, esi
call fcn.0041bbdf
pop edi
mov ecx, esi
pop esi
jmp fcn.0041d9ba
Function at 0x41f2e8
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov esi, ecx
mov ecx, dword [esi + 0x4ec]
push str.OnCandidateNum
call edi
mov ecx, dword [esi + 0x4ec]
push str.generalbar_wbinput
mov dword [esi + 0x644], eax
call edi
mov ecx, dword [esi + 0x4ec]
push str.generalbar_pyinput
mov dword [esi + 0x64c], eax
call edi
mov ecx, dword [esi + 0x4ec]
push str.generalbar_spinput
mov dword [esi + 0x650], eax
call edi
mov ecx, dword [esi + 0x4ec]
push str.generalbar_wbpyinput
mov dword [esi + 0x658], eax
call edi
mov ecx, dword [esi + 0x4ec]
push str.generaldefaultinput
mov dword [esi + 0x654], eax
call edi
mov ecx, dword [esi + 0x4ec]
push str.generalbar_use_pinyin_fuzzy
mov dword [esi + 0x660], eax
call edi
mov ecx, dword [esi + 0x4ec]
push str.generalbar_ck_use_sp
mov dword [esi + 0x664], eax
call edi
mov ecx, dword [esi + 0x4ec]
push str.pinyinfuzzy
mov dword [esi + 0x65c], eax
call edi
mov ecx, dword [esi + 0x4ec]
push 0x4be520
mov dword [esi + 0x66c], eax
call edi
mov ecx, dword [esi + 0x4ec]
push str.OnSelectSPMode
mov dword [esi + 0x668], eax
call edi
lea ecx, [esi + 0x4e0]
mov dword [esi + 0x648], eax
call fcn.004252d6
mov ecx, esi
call fcn.0041dc99
mov ecx, esi
call fcn.0041dd0e
mov ecx, esi
call fcn.0041e8b0
xor eax, eax
push eax
push eax
push esi
push 0x41f250
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret

Function at 0x422968
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x422f3d
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x422f53
push 0x80004005
call fcn.004035b2
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x422f56
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8
Function at 0x422f85
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4f04c0]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.00422933
mov edi, eax
cmp edi, esi
je 0x422fed
lea ecx, [ebp - 0x70]
call fcn.004228ce
mov eax, edi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004471af
add ebp, 0x198
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x423005
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00422f85
cmp eax, esi
jne 0x423038
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x422ff5
lea ecx, [ebp - 0x70]
call fcn.004228ce
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.004228ce
mov eax, esi
jmp 0x422fd3
Function at 0x423f22
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x4f04c0]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x20
mov eax, 0x4b4f2e
call fcn.004471f1
mov edi, ecx
mov eax, dword [ebp + 0x414]
mov ebx, dword [ebp + 0x410]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x18], eax
call dword [0x4f1a64]
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], esi
mov dword [ebp], esi
push 2
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x1c], ebx
jne 0x423f9a
call fcn.00422cf9
mov esi, eax
jmp 0x424094
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x423fb7
call fcn.00422cf9
jmp 0x424089
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [ebp - 0x18], eax
je 0x423fad
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
mov dword [ebp - 0x14], edi
jae 0x42401e
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x423fea
lea ecx, [ebp]
call fcn.00422e94
mov esi, 0x8007000e
lea ecx, [ebp - 0x20]
call fcn.00422ee3
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.004471af
add ebp, 0x408
leave
ret 0x10
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.004233ce
mov dword [ebp - 4], 1
jmp 0x424047
mov ebx, dword [ebp]
cmp ebx, esi
jne 0x424055
mov esi, 0x8007000e
jmp 0x42408b
call dword [0x4f1a64]
push edi
push ebx
push edi
push dword [ebp - 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x423fad
mov ecx, dword [ebp]
push dword [ebp + 0x41c]
mov word [ecx + eax*2], si
push dword [ebp]
lea ecx, [ebp - 0x28]
call fcn.00423e01
mov esi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x423fef
lea ecx, [ebp]
call fcn.00422e94
jmp 0x423fef

Function at 0x42468a
Capabilities:
Copy file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x34]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
call fcn.0040557e
mov ecx, eax
pop esi
jmp fcn.0041739a

Function at 0x4246a6
Capabilities:
Copy file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x3c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x40]
call fcn.0040557e
mov ecx, eax
pop esi
jmp fcn.0041739a
Function at 0x42ae1d
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x1380]
mov eax, 0x1400
call fcn.00447a80
mov eax, dword [0x4f04c0]
xor eax, ebp
mov dword [ebp + 0x137c], eax
push ebx
push esi
mov esi, dword [ebp + 0x1388]
push esi
lea eax, [ebp + 0x1d4]
push str._s.
push eax
mov dword [ebp - 0x80], ecx
call fcn.004479ae
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1d4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42af1b
lea eax, [ebp - 0x7c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x42af1b
cmp word [ebp - 0x50], 0x2e
je 0x42ae78
cmp word [ebp - 0x4e], 0
je 0x42ae78
cmp word [ebp - 0x4e], 0x2e
jne 0x42aea7
cmp word [ebp - 0x4c], 0
je 0x42ae78
test byte [ebp - 0x7c], 0x10
je 0x42aef0
and word [ebp + 0x1174], 0
push 0x206
lea eax, [ebp + 0x1176]
push 0
push eax
call fcn.00447440
lea eax, [ebp - 0x50]
push eax
push esi
lea eax, [ebp + 0x1174]
push 0x4b9de0
push eax
call fcn.004479ae
mov ecx, dword [ebp - 0x80]
add esp, 0x1c
lea eax, [ebp + 0x1174]
push eax
call fcn.0042ae1d
lea eax, [ebp - 0x50]
push eax
push esi
lea eax, [ebp + 0x9a4]
push 0x4b9e68
push eax
call fcn.004479ae
add esp, 0x10
lea eax, [ebp + 0x9a4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42ae78
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x137c]
pop esi
xor ecx, ebp
pop ebx
call fcn.004471af
add ebp, 0x1380
leave
ret 4