joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fe00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c9b70
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0xc], vtable.t_mutex::t_locker.0
xor ebx, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], 0
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
push eax
push 0x50d850
mov byte [esp + 0x30], 1
call fcn.00435ff0
test al, al
je 0x44fe6c
mov dword [esp + 0x10], vtable.t_criticalSection.0
mov edi, dword [esp + 0x10]
mov eax, dword [esi]
cmp eax, ebx
mov dword [esi + 0xc], ebx
jle 0x44fe9c
lea edi, [esi + 4]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x44fe8c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0xffffffff
inc ebx
add edi, 4
cmp ebx, dword [esi]
jl 0x44fe78
mov edi, dword [esp + 0x10]
xor ebx, ebx
mov dword [esi], ebx
lea ecx, [esi + 0x20]
push ecx
call fcn.00450d20
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
cmp edi, ebx
je 0x44fec6
push edi
call fcn.00436110
mov dword [esp + 0x10], ebx
mov edi, ebx
lea ecx, [esp + 0x14]
call fcn.0042c930
mov dword [esp + 0x28], 0xffffffff
cmp edi, ebx
je 0x44fee1
push edi
call fcn.00436110
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450a20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c9166
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x150]
mov dword fs:[0], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], vtable.t_reg.0
call fcn.00430920
xor ebx, ebx
mov eax, str.MACHINE
lea edx, [esp + 0x28]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00430b00
mov dword [esp + 0x158], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
push 1
push ebx
push ebx
push 0x4eef0c
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x16c], 1
call fcn.00431bf0
lea ecx, [esp + 0xc]
test al, al
jne 0x450b05
call fcn.0042c930
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], vtable.t_reg.0
cmp eax, ebx
je 0x450ad7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], vtable.t_str.0
cmp byte [esp + 0x144], bl
jne 0x450b01
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x450b01
push eax
call fcn.004a4a7f
add esp, 4
xor al, al
jmp 0x450b5d
push 4
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
mov eax, str.NeedGetProId
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 4
call fcn.00431db0
lea ecx, [esp + 0xc]
test al, al
jne 0x450b46
call fcn.0042c930
lea ecx, [esp + 0x1c]
call fcn.00431ba0
xor al, al
jmp 0x450b5d
cmp dword [esp + 0x14], ebx
setne bl
call fcn.0042c930
lea ecx, [esp + 0x1c]
call fcn.00431ba0
mov al, bl
mov ecx, dword [esp + 0x150]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.004a4a25
add esp, 0x154
ret
Function at 0x454e70
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x50d608], 0
je 0x454ec5
mov eax, dword [0x50d610]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x454ec5
cmp dword [eax], 0x12
jbe 0x454ec5
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x48]
test eax, eax
je 0x454ec5
push 0
push 0x50ef38
push 0x50ed44
push 0
push eax
call fcn.004ae5ec
add esp, 0x14
test eax, eax
je 0x454ec5
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov al, 1
ret
xor al, al
ret

Function at 0x454ed0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x50d608], 0
push esi
push edi
mov esi, eax
je 0x454f19
mov eax, dword [0x50d610]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
test eax, eax
je 0x454f19
cmp dword [eax], 0x12
jbe 0x454f19
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + 0x48]
test ecx, ecx
jne 0x454f46
push 8
call fcn.004a5359
add esp, 4
test eax, eax
je 0x454f1e
mov dword [eax + 4], esi
mov dword [eax], vtable.t_visualDataItemPtr_struct_t_hklManager_InstallWrap_.0
mov esi, eax
jmp 0x454f20
pop edi
xor al, al
pop esi
ret
xor esi, esi
cmp dword [0x50d608], 0
je 0x454f4e
mov edx, dword [0x50d610]
push edx
call edi
test eax, eax
je 0x454f4e
cmp dword [eax], 0x12
jbe 0x454f4e
mov eax, dword [eax + 8]
mov dword [eax + 0x48], esi
pop edi
mov al, 1
pop esi
ret
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push esi
call eax
pop edi
mov al, 1
pop esi
ret

Function at 0x455150
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x210
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
mov edi, ecx
mov eax, 0x40
cmp ax, word [edi]
jne 0x45517d
add edi, 2
push 0x2c
push edi
call fcn.004a5d20
mov esi, eax
add esp, 8
test esi, esi
jne 0x4551a8
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004a4a25
add esp, 0x210
ret
push 0xa
lea ecx, [esp + 0x10]
push ecx
lea edx, [esi + 2]
push edx
mov dword [esp + 0x18], 0
call fcn.004aa732
mov dword [ebp], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x26]
push ecx
mov word [esp + 0x28], ax
call fcn.004a7380
sub esi, edi
sar esi, 1
push esi
push edi
lea edx, [esp + 0x30]
push 0x104
push edx
call fcn.004a5f71
add esp, 0x28
push 0x104
push ebx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [esp + 0x218]
pop edi
test eax, eax
pop esi
setne al
pop ebp
xor ecx, esp
call fcn.004a4a25
add esp, 0x210
ret
Function at 0x456a90
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x3c
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x34], eax
cmp byte [esp + 0x44], 0
mov eax, dword [esp + 0x40]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
je 0x456ace
push ecx
push eax
call fcn.00456320
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004a4a25
add esp, 0x3c
ret
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
call esi
mov ebp, eax
lea eax, [ebp*4]
push eax
call fcn.004a4b5c
add esp, 4
mov ebx, eax
push ebx
push ebp
call esi
xor edi, edi
test ebp, ebp
jle 0x456b72
push 0x2c
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.004a7380
mov esi, dword [ebx + edi*4]
mov eax, esi
and eax, 0xf0000000
add esp, 0xc
mov dword [esp + 0x14], esi
cmp eax, 0xe0000000
jne 0x456b24
mov dword [esp + 0x1c], esi
jmp 0x456b5b
cmp eax, 0xf0000000
mov eax, esi
je 0x456b41
shr eax, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x456b5b
movzx edx, si
mov dword [esp + 0x1c], edx
jmp 0x456b5b
shr eax, 0x10
and eax, 0xfff
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00462550
add esp, 8
test al, al
je 0x456b60
mov word [esp + 0x20], si
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
call fcn.00460c90
inc edi
cmp edi, ebp
jl 0x456af8
push ebx
call fcn.004a4a7f
mov ecx, dword [esp + 0x48]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.004a4a25
add esp, 0x3c
ret
Function at 0x458b30
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x4caa96
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebp
push esi
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
push str.Keyboard_LayoutPreload
push reloc.WS2_32.dll_accept
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebp, vtable.t_reg.0
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], ebp
call fcn.00430920
xor edi, edi
mov eax, str.CURRENT_USER
lea edx, [esp + 0x38]
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], reloc.WS2_32.dll_accept
call fcn.00430b00
push 1
push 1
push 1
push str.Keyboard_LayoutPreload
push ebx
lea ecx, [esp + 0x40]
mov dword [esp + 0x17c], edi
call fcn.00431bf0
test al, al
jne 0x458c2a
mov ecx, ebx
call fcn.0042c990
push 0x4f7168
push 0x4f0ffc
mov edx, eax
call fcn.00430eb0
mov eax, dword [esp + 0x38]
add esp, 8
mov dword [esp + 0x2c], ebp
cmp eax, edi
je 0x458bf8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x154], 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], vtable.t_str.0
jne 0x458c23
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x44]
cmp eax, ecx
je 0x458c23
push eax
call fcn.004a4a7f
add esp, 4
xor al, al
jmp 0x458d38
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.0045c2d0
mov byte [esp + 0x168], 1
mov ecx, dword [esp + 0x24]
mov edx, ecx
sub edx, dword [esp + 0x20]
mov eax, 0x2aaaaaab
imul edx
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, edi
mov dword [esp + 0x10], 1
jle 0x458cc3
xor ebp, ebp
jmp 0x458c74
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x458c92
call fcn.004a68c5
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
lea eax, [ecx + ebp]
push edx
lea ecx, [esp + 0x30]
mov edx, ebx
call fcn.00458ab0
add esp, 4
test al, al
je 0x458cb4
inc dword [esp + 0x10]
inc edi
add ebp, 0x30
cmp edi, esi
jl 0x458c70
xor edi, edi
mov ebp, vtable.t_reg.0
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x458cdf
push eax
call fcn.004a4a1a
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.004a4a1a
mov eax, dword [esp + 0x34]
add esp, 4
mov dword [esp + 0x2c], ebp
cmp eax, edi
je 0x458d0b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x154], 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], vtable.t_str.0
jne 0x458d36
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
cmp eax, edx
je 0x458d36
push eax
call fcn.004a4a7f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.004a4a25
add esp, 0x15c
ret
Function at 0x459860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c9a58
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebp
push esi
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, word [ebx + 0xc]
push eax
lea ecx, [esp + 0x18]
xor ebp, ebp
push ecx
mov dword [esp + 0x1c], ebp
call fcn.004597b0
test al, al
jne 0x459901
lea edx, [esp + 0x18]
push edx
call fcn.00402e70
mov eax, ebx
lea edi, [esp + 0x18]
mov dword [esp + 0x38], ebp
call fcn.0045c3e0
mov eax, edi
push eax
mov edi, esi
call fcn.0045c8d0
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4598d5
push eax
call fcn.004a4a1a
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.004a4a1a
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
push edx
mov eax, esi
call fcn.0045c830
mov edi, eax
mov eax, ebx
call fcn.0045c3e0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
Function at 0x461b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c6a98
mov eax, dword fs:[0]
push eax
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.exclude
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004a4b5c
mov dword [eax + 0x24], fcn.004a50d2
mov dword [eax + 0x28], fcn.004a4a7f
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configImeProtect::t_exclude_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x462060
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x210
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push ebx
push ebp
mov ebp, dword [esp + 0x220]
mov dword [esp + 8], eax
push esi
xor eax, eax
push edi
mov edi, ecx
cmp dword [ebp + 0x120], eax
je 0x46209c
mov dword [ebp + 0x120], eax
lea esi, [ebp + 8]
mov ecx, 1
mov dword [ebp + 4], eax
call fcn.00431260
cmp byte [esi + 0x114], 0
je 0x4620ba
add esi, 4
jmp 0x4620bc
mov esi, dword [esi]
xor ecx, ecx
xor edx, edx
mov word [esi + 4], cx
cmp dx, word [edi]
je 0x462139
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop
push 0x25
push edi
call fcn.004a5d20
add esp, 8
mov esi, eax
push edi
mov edx, ebp
push 0x4f0ffc
test esi, esi
je 0x462154
xor eax, eax
mov word [esi], ax
add esi, 2
call fcn.00430eb0
push 0x25
push esi
call fcn.004a5d20
add esp, 0x10
test eax, eax
je 0x46215e
push 0x104
lea edx, [esp + 0x18]
push edx
xor ecx, ecx
push esi
mov word [eax], cx
lea edi, [eax + 2]
call ebx
test eax, eax
je 0x46217f
lea eax, [esp + 0x14]
push eax
push 0x4f0ffc
mov edx, ebp
call fcn.00430eb0
xor ecx, ecx
add esp, 8
cmp cx, word [edi]
jne 0x4620d0
mov al, 1
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a4a25
add esp, 0x210
ret
call fcn.00430eb0
add esp, 8
jmp 0x462139
mov ecx, dword [esp + 0x10]
call fcn.0042c990
push 0x4f79e4
push 0x4f0ffc
mov edx, eax
call fcn.00430eb0
add esp, 8
xor al, al
jmp 0x46213b
mov ecx, dword [esp + 0x10]
call fcn.0042c990
mov edi, eax
push 0x4f79f4
push 0x4f0ffc
mov edx, edi
call fcn.00430eb0
push esi
push 0x4f0ffc
mov edx, edi
call fcn.00430eb0
add esp, 0x10
xor al, al
jmp 0x46213b
Function at 0x464300
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4c8c41
mov eax, dword fs:[0]
push eax
sub esp, 0x37c
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x378], eax
push esi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x384]
mov dword fs:[0], eax
mov ecx, 0x105
mov esi, 0x51e7e8
mov dword [0x51e900], ecx
call fcn.00431260
cmp byte [0x51e8fc], 0
mov eax, 0x51e7ec
jne 0x464360
mov eax, dword [0x51e7e8]
push 0
push 0x1a
add eax, 4
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, 0x51e7e0
cmp eax, 1
je 0x464386
call fcn.00429940
xor al, al
jmp 0x46455b
call fcn.00429eb0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x464559
push str.GetLocaleInfoEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x464559
lea ecx, [esp + 0x25c]
call fcn.00429ba0
lea eax, [esp + 0x25c]
push eax
mov ecx, 0x51e7e0
mov dword [esp + 0x390], 0
call fcn.0042b500
test al, al
jne 0x464415
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
cmp byte [esp + 0x378], al
jne 0x46440e
mov eax, dword [esp + 0x264]
lea ecx, [esp + 0x268]
cmp eax, ecx
je 0x46440e
push eax
call fcn.004a4a7f
add esp, 4
xor al, al
jmp 0x46455b
mov dword [esp + 8], str.LocalLow
mov dword [esp + 0xc], str.Roaming
mov dword [esp + 0x10], str.Local
xor esi, esi
nop
cmp byte [esp + 0x378], 0
lea eax, [esp + 0x268]
jne 0x464448
mov eax, dword [esp + 0x264]
mov edx, dword [esp + esi*4 + 8]
lea ecx, [eax + 4]
call fcn.004641b0
test al, al
jne 0x46446e
inc esi
cmp esi, 3
jb 0x464430
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jmp 0x464534
mov esi, dword [esp + esi*4 + 8]
test esi, esi
jne 0x464486
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jmp 0x464534
lea ecx, [esp + 0x14]
call fcn.00430920
mov eax, esi
lea edx, [esp + 0x14]
call fcn.00430b00
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x13c]
push ecx
lea ecx, [esp + 0x264]
mov byte [esp + 0x394], 2
call fcn.0042a040
cmp byte [eax + 0x11c], 0
je 0x4644c9
add eax, 0xc
jmp 0x4644cc
mov eax, dword [eax + 8]
add eax, 4
mov edx, 0x51e7e0
call fcn.00430b00
cmp byte [esp + 0x254], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x138], esi
jne 0x46450a
mov eax, dword [esp + 0x140]
lea edx, [esp + 0x144]
cmp eax, edx
je 0x46450a
push eax
call fcn.004a4a7f
add esp, 4
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], esi
jne 0x46452d
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x46452d
push eax
call fcn.004a4a7f
add esp, 4
mov dword [esp + 0x25c], esi
cmp byte [esp + 0x378], 0
jne 0x464559
mov eax, dword [esp + 0x264]
lea edx, [esp + 0x268]
cmp eax, edx
je 0x464559
push eax
call fcn.004a4a7f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x384]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x378]
xor ecx, esp
call fcn.004a4a25
add esp, 0x388
ret
Function at 0x464ed0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c6a98
mov eax, dword fs:[0]
push eax
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], 0x4f7b2c
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 0x20], fcn.004a4b5c
mov dword [eax + 0x24], fcn.004a50d2
mov dword [eax + 0x28], fcn.004a4a7f
mov dword [eax], vtable.n_config::t_arraySection_class_t_parserImeRepair::t_imeItem_.0
mov dword [eax + 0x2c], 1
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x465110
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
push 0x1fe
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004a7380
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push 0x4f3208
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x465181
xor al, al
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004a4a25
add esp, 0x210
ret
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push esi
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x465169
lea eax, [esp + 0x10]
mov edx, edi
call fcn.00430b00
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov al, 1
call fcn.004a4a25
add esp, 0x210
ret
Function at 0x465980
Capabilities:
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x4cc876
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x27c]
xor bl, bl
push eax
lea ecx, [esp + 0x144]
mov byte [esp + 0x17], bl
call fcn.00430a60
lea ecx, [esp + 0x18]
call fcn.00430920
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
je 0x465ab5
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea eax, [esp + 0x18]
push eax
push 2
push esi
mov dword [esp + 0x24], 0xbb8
call edi
push 4
lea ecx, [esp + 0x18]
push ecx
push 5
push esi
call edi
push 4
lea edx, [esp + 0x18]
push edx
push 6
push esi
call edi
push 4
lea eax, [esp + 0x18]
push eax
push 8
push esi
call edi
mov ecx, dword [esp + 0x144]
mov eax, 0x800
test ecx, ecx
jbe 0x465a74
cmp ecx, eax
jae 0x465a4b
mov eax, ecx
cmp byte [esp + 0x25c], 0
lea ecx, [esp + 0x14c]
jne 0x465a63
mov ecx, dword [esp + 0x148]
add ecx, 4
push ecx
lea ebx, [esp + 0x1c]
call fcn.00430b60
mov bl, byte [esp + 0x13]
cmp byte [esp + 0x134], 0
lea eax, [esp + 0x24]
jne 0x465a86
mov eax, dword [esp + 0x20]
push 0
push 0x84200000
push 0
push 0
add eax, 4
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x465ab2
push eax
mov byte [esp + 0x17], 1
call edi
mov bl, byte [esp + 0x13]
push esi
call edi
cmp byte [esp + 0x134], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x18], esi
jne 0x465add
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
cmp eax, ecx
je 0x465add
push eax
call fcn.004a4a7f
add esp, 4
cmp byte [esp + 0x25c], 0
mov dword [esp + 0x140], esi
jne 0x465b09
mov eax, dword [esp + 0x148]
lea edx, [esp + 0x14c]
cmp eax, edx
je 0x465b09
push eax
call fcn.004a4a7f
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.004a4a25
add esp, 0x268
ret
Function at 0x465f60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cc1b6
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x150]
mov dword fs:[0], eax
xor ebx, ebx
lea ecx, [esp + 0x28]
mov byte [esi], bl
mov byte [esi + 1], bl
mov dword [esp + 0x1c], vtable.t_reg.0
call fcn.00430920
mov eax, str.CURRENT_USER
lea edx, [esp + 0x28]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], reloc.WS2_32.dll_accept
call fcn.00430b00
mov dword [esp + 0x158], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
push 1
push 1
push ebx
push str.SOFTWARESogouInput
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x16c], 1
call fcn.00431bf0
test al, al
je 0x466041
push 4
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
mov eax, str.SendUserExperience
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 4
call fcn.00431db0
test al, al
jne 0x466037
lea ecx, [esp + 0xc]
call fcn.0042c9e0
jmp 0x466041
cmp dword [esp + 0x14], ebx
setne cl
mov byte [esi + 1], cl
xor edx, edx
lea ecx, [esp + 0xc]
mov word [esi + 2], dx
call fcn.0042c930
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], vtable.t_reg.0
cmp eax, ebx
je 0x466067
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], vtable.t_str.0
cmp byte [esp + 0x144], bl
jne 0x466091
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x466091
push eax
call fcn.004a4a7f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x150]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.004a4a25
add esp, 0x154
ret

Function at 0x466c70
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x466d14
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x466ce5
cmp word [ecx + 0xa], 4
jne 0x466ce5
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x466ce5
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.00466c00
mov dword [esi], eax
test eax, eax
je 0x466d08
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x466cc0
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.004a649e
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x466d24.11001
jmp dword [eax*4 + 0x466d48]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18