joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ff10
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x804
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
mov ebx, dword [esp + 0x818]
push ebp
mov ebp, dword [esp + 0x818]
push esi
mov esi, dword [esp + 0x814]
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004f2770
push esi
push str._s.
lea edx, [esp + 0x24]
call fcn.00411b30
add esp, 0x14
push 0x576320
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4600a6
mov ecx, 0x546720
mov eax, 0x57634c
jmp 0x45ff90
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45ffb6
test dx, dx
je 0x45ffb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45ffb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x45ff90
xor eax, eax
jmp 0x45ffbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46008b
mov ecx, 0x546724
mov eax, 0x57634c
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45fff6
test dx, dx
je 0x45fff2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45fff6
add eax, 4
add ecx, 4
test dx, dx
jne 0x45ffd0
xor eax, eax
jmp 0x45fffb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46008b
push esi
lea eax, [esp + 0x14]
push 0x400
push eax
call fcn.004ee6af
push 0x5463d8
lea ecx, [esp + 0x20]
push 0x400
push ecx
call fcn.004eef2d
push 0x57634c
lea edx, [esp + 0x2c]
push 0x400
push edx
call fcn.004eef2d
lea eax, [esp + 0x34]
push 0x5762f0
push eax
call fcn.004eea16
add esp, 0x2c
test eax, eax
jne 0x46008b
mov ecx, 0x4000
test word [0x5762f6], cx
je 0x46007c
mov eax, dword [esp + 0x81c]
test al, al
je 0x46008b
push ebx
push ebp
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.0045ff10
add esp, 0x10
jmp 0x460087
lea eax, [esp + 0x10]
push ebx
push eax
call ebp
add esp, 8
test eax, eax
je 0x4600c4
push 0x576320
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45ff81
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ecddb
add esp, 0x804
ret
xor eax, eax
jmp 0x4600ab
Function at 0x464660
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x50dd58
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x290]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
lea ebx, [edi + edi + 2]
cmp ebx, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], edi
jge 0x464700
mov ecx, ebx
imul ecx, ecx, 0x258
lea eax, [ecx + ebp]
lea edx, [eax - 0x258]
push edx
push eax
call dword [esp + 0x1c]
add esp, 8
test al, al
je 0x4646d1
dec ebx
mov esi, ebx
imul edi, edi, 0x258
imul esi, esi, 0x258
add esi, ebp
add edi, ebp
call fcn.0045b120
mov dword [esp + 0x30], ebx
mov edi, dword [esp + 0x30]
lea ebx, [ebx + ebx + 2]
cmp ebx, dword [esp + 0x34]
jl 0x4646b2
mov eax, dword [esp + 0x34]
cmp ebx, eax
jne 0x464725
imul eax, eax, 0x258
imul edi, edi, 0x258
lea esi, [eax + ebp - 0x258]
add edi, ebp
call fcn.0045b120
mov eax, dword [esp + 0x34]
dec eax
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x14]
push ecx
sub esp, 0x258
lea esi, [esp + 0x294]
mov edi, esp
mov dword [esp + 0x270], esp
call fcn.0045a630
mov edx, dword [esp + 0x274]
mov ecx, dword [esp + 0x28c]
push edx
push ebp
call fcn.00464800
add esp, 0x264
cmp byte [esp + 0x278], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x15c], esi
jne 0x464791
mov eax, dword [esp + 0x164]
lea ecx, [esp + 0x168]
cmp eax, ecx
je 0x464791
push eax
call fcn.004ed7b6
add esp, 4
cmp byte [esp + 0x154], 0
mov dword [esp + 0x38], esi
jne 0x4647b4
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
cmp eax, edx
je 0x4647b4
push eax
call fcn.004ed7b6
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x467900
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x50d2b2
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
push 1
mov eax, edi
call fcn.00405f90
lea esi, [edi + 0x58]
mov dword [esp + 0x14], 0
push esi
mov edx, 0x54fb54
mov dword [edi], vtable.t_configImeProtect.0
call fcn.00405f00
mov dword [esi], vtable.t_configImeProtect::t_config.0
lea eax, [edi + 0x20]
mov dword [esi + 0x28], eax
mov ecx, 0x5495b0
mov byte [esi + 0x30], 0
mov dword [esi + 0x34], str.version
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x2c], vtable.n_config::t_str.0
push eax
lea esi, [edi + 0x98]
mov byte [esp + 0x18], 1
call fcn.00467a00
mov ecx, edi
mov byte [esp + 0x14], 2
call fcn.004679b0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x4681f0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x210
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
mov edi, ecx
mov eax, 0x40
cmp ax, word [edi]
jne 0x46821d
add edi, 2
push 0x2c
push edi
call fcn.004ef15a
mov esi, eax
add esp, 8
test esi, esi
jne 0x468248
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004ecddb
add esp, 0x210
ret
push 0xa
lea ecx, [esp + 0x10]
push ecx
lea edx, [esi + 2]
push edx
mov dword [esp + 0x18], 0
call fcn.004ed75f
mov dword [ebp], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x26]
push ecx
mov word [esp + 0x28], ax
call fcn.004f2770
sub esi, edi
sar esi, 1
push esi
push edi
lea edx, [esp + 0x30]
push 0x104
push edx
call fcn.004f0240
add esp, 0x28
push 0x104
push ebx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [esp + 0x218]
pop edi
test eax, eax
pop esi
setne al
pop ebp
xor ecx, esp
call fcn.004ecddb
add esp, 0x210
ret

Function at 0x469b30
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x38
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x3c]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push edi
push 0
push 0
mov dword [esp + 0x18], eax
call esi
mov ebx, eax
lea ecx, [ebx*4]
push ecx
call fcn.004ed893
add esp, 4
mov ebp, eax
push ebp
push ebx
call esi
xor edi, edi
test ebx, ebx
jle 0x469be7
push 0x2c
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.004f2770
mov esi, dword [ebp + edi*4]
mov eax, esi
and eax, 0xf0000000
add esp, 0xc
mov dword [esp + 0x14], esi
cmp eax, 0xe0000000
jne 0x469ba1
mov dword [esp + 0x1c], esi
jmp 0x469bd0
cmp eax, 0xf0000000
je 0x469bb3
mov eax, esi
shr eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x469bd0
mov ecx, esi
shr ecx, 0x10
and ecx, 0xfff
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.0046ff30
add esp, 8
test al, al
je 0x469bd5
mov word [esp + 0x20], si
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
call fcn.00471a40
inc edi
cmp edi, ebx
jl 0x469b74
push ebp
call fcn.004ed7b6
mov ecx, dword [esp + 0x48]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.004ecddb
add esp, 0x38
ret
Function at 0x46a5d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x515eb8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x7c]
lea eax, [esp + 0x1c]
push eax
mov edi, ecx
call fcn.00461920
lea ecx, [esp + 0x1c]
xor esi, esi
push ecx
mov eax, edi
mov dword [esp + 0x78], esi
call fcn.0046d580
test al, al
jne 0x46a62f
mov ecx, edi
call fcn.00416480
push edi
mov ecx, ebp
call fcn.0046a140
add esp, 4
test al, al
je 0x46a657
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x46a695
push ebp
call fcn.00469b30
add esp, 4
test al, al
jne 0x46a695
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x46a675
push eax
call fcn.004ed1ab
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.004ed1ab
add esp, 4
xor al, al
jmp 0x46a7bf
push ebp
lea ebx, [esp + 0x20]
call fcn.00471e10
push 0x2c
lea edx, [esp + 0x3c]
push esi
push edx
mov dword [esp + 0x40], esi
call fcn.004f2770
add esp, 0xc
lea esi, [esp + 0x34]
mov eax, edi
call fcn.00469580
test al, al
je 0x46a791
call fcn.0046f9f0
test al, al
je 0x46a700
mov eax, esi
push eax
lea ecx, [esp + 0x1c]
push ecx
mov edi, ebx
mov dword [esp + 0x20], 0xffffffff
call fcn.00471ab0
test al, al
je 0x46a700
mov edi, dword [esp + 0x18]
mov esi, ebx
call fcn.00466e60
mov esi, eax
lea edi, [esp + 0x34]
call fcn.00467f20
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x46a791
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x46a744
call fcn.004f21c6
mov esi, dword [ebp + 0xc]
movzx eax, word [ebx + esi + 0xc]
mov cx, word [esp + 0x40]
cmp ax, cx
jb 0x46a804
ja 0x46a804
mov eax, dword [ebx + esi + 8]
test eax, eax
je 0x46a7de
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x46a7de
cmp eax, ecx
jb 0x46a804
ja 0x46a804
cmp edi, 0xffffffff
je 0x46a791
test edi, edi
je 0x46a791
mov ecx, edi
neg ecx
push ebp
call fcn.00471b60
mov eax, dword [esp + 0x28]
xor esi, esi
cmp eax, esi
je 0x46a7a4
push eax
call fcn.004ed1ab
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.004ed1ab
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004ecddb
add esp, 0x64
ret
lea edx, [ebx + esi + 0x10]
lea ecx, [esp + 0x44]
call fcn.0046f980
test eax, eax
jne 0x46a804
lea edx, [ebx + esi + 0x20]
lea ecx, [esp + 0x54]
call fcn.0046f980
test eax, eax
je 0x46a77e
inc edi
add ebx, 0x30
cmp edi, dword [esp + 0x18]
jl 0x46a725
jmp 0x46a791
Function at 0x46add0
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x5119f6
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebp
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
push str.Keyboard_LayoutPreload
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebp, vtable.t_reg.0
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], ebp
call fcn.004174b0
xor edi, edi
mov eax, str.HKEY_CURRENT_USER
lea edx, [esp + 0x38]
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], VariantClear
call fcn.00417710
push 1
push 1
push str.Keyboard_LayoutPreload
push ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x178], edi
call fcn.00418930
test al, al
jne 0x46aec8
mov ecx, ebx
call fcn.00416430
push 0x54ffbc
push 0x549858
mov edx, eax
call fcn.00417ed0
mov eax, dword [esp + 0x38]
add esp, 8
mov dword [esp + 0x2c], ebp
cmp eax, edi
je 0x46ae96
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x154], 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], vtable.t_str.0
jne 0x46aec1
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x44]
cmp eax, ecx
je 0x46aec1
push eax
call fcn.004ed7b6
add esp, 4
xor al, al
jmp 0x46afd8
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.0046d980
mov byte [esp + 0x168], 1
mov ecx, dword [esp + 0x24]
mov edx, ecx
sub edx, dword [esp + 0x20]
mov eax, 0x2aaaaaab
imul edx
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, edi
mov dword [esp + 0x10], 1
jle 0x46af63
xor ebp, ebp
jmp 0x46af14
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x46af32
call fcn.004f21c6
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
lea eax, [ecx + ebp]
push edx
lea ecx, [esp + 0x30]
mov edx, ebx
call fcn.0046ad50
add esp, 4
test al, al
je 0x46af54
inc dword [esp + 0x10]
inc edi
add ebp, 0x30
cmp edi, esi
jl 0x46af10
xor edi, edi
mov ebp, vtable.t_reg.0
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x46af7f
push eax
call fcn.004ed1ab
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.004ed1ab
mov eax, dword [esp + 0x34]
add esp, 4
mov dword [esp + 0x2c], ebp
cmp eax, edi
je 0x46afab
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x154], 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], vtable.t_str.0
jne 0x46afd6
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
cmp eax, edx
je 0x46afd6
push eax
call fcn.004ed7b6
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.004ecddb
add esp, 0x15c
ret
Function at 0x46bb00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x510328
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebp
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, word [ebx + 0xc]
push eax
lea ecx, [esp + 0x18]
xor ebp, ebp
push ecx
mov dword [esp + 0x1c], ebp
call fcn.0046ba50
test al, al
jne 0x46bba1
lea edx, [esp + 0x18]
push edx
call fcn.00461920
mov eax, ebx
lea edi, [esp + 0x18]
mov dword [esp + 0x38], ebp
call fcn.00466e90
mov eax, edi
push eax
mov edi, esi
call fcn.0046dbd0
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x46bb75
push eax
call fcn.004ed1ab
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.004ed1ab
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
push edx
mov eax, esi
call fcn.0046db30
mov edi, eax
mov eax, ebx
call fcn.00466e90
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
Function at 0x46fa40
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x210
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push ebx
push ebp
mov ebp, dword [esp + 0x220]
mov dword [esp + 8], eax
push esi
xor eax, eax
push edi
mov edi, ecx
cmp dword [ebp + 0x120], eax
je 0x46fa7c
mov dword [ebp + 0x120], eax
lea esi, [ebp + 8]
mov ecx, 1
mov dword [ebp + 4], eax
call fcn.00418590
cmp byte [esi + 0x114], 0
je 0x46fa9a
add esi, 4
jmp 0x46fa9c
mov esi, dword [esi]
xor ecx, ecx
xor edx, edx
mov word [esi + 4], cx
cmp dx, word [edi]
je 0x46fb19
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop
push 0x25
push edi
call fcn.004ef15a
add esp, 8
mov esi, eax
push edi
mov edx, ebp
push 0x549858
test esi, esi
je 0x46fb34
xor eax, eax
mov word [esi], ax
add esi, 2
call fcn.00417ed0
push 0x25
push esi
call fcn.004ef15a
add esp, 0x10
test eax, eax
je 0x46fb3e
push 0x104
lea edx, [esp + 0x18]
push edx
xor ecx, ecx
push esi
mov word [eax], cx
lea edi, [eax + 2]
call ebx
test eax, eax
je 0x46fb5f
lea eax, [esp + 0x14]
push eax
push 0x549858
mov edx, ebp
call fcn.00417ed0
xor ecx, ecx
add esp, 8
cmp cx, word [edi]
jne 0x46fab0
mov al, 1
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ecddb
add esp, 0x210
ret
call fcn.00417ed0
add esp, 8
jmp 0x46fb19
mov ecx, dword [esp + 0x10]
call fcn.00416430
push 0x5503dc
push 0x549858
mov edx, eax
call fcn.00417ed0
add esp, 8
xor al, al
jmp 0x46fb1b
mov ecx, dword [esp + 0x10]
call fcn.00416430
mov edi, eax
push 0x5503ec
push 0x549858
mov edx, edi
call fcn.00417ed0
push esi
push 0x549858
mov edx, edi
call fcn.00417ed0
add esp, 0x10
xor al, al
jmp 0x46fb1b
Function at 0x470950
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x510291
mov eax, dword fs:[0]
push eax
sub esp, 0x384
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x380], eax
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x390]
mov dword fs:[0], eax
mov ecx, 0x105
mov esi, 0x577150
mov dword [0x577268], ecx
call fcn.00418590
cmp byte [0x577264], 0
mov eax, 0x577154
jne 0x4709b1
mov eax, dword [0x577150]
push 0
push 0x1a
add eax, 4
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, 0x577148
cmp eax, 1
je 0x4709d7
call fcn.00417680
xor al, al
jmp 0x470ba9
call fcn.0041e220
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x470ba7
push str.GetLocaleInfoEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x470ba7
lea ecx, [esp + 0x264]
call fcn.0041dc00
lea eax, [esp + 0x264]
push eax
mov ecx, 0x577148
mov dword [esp + 0x39c], 0
call fcn.0041fbf0
test al, al
jne 0x470a66
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
cmp byte [esp + 0x380], al
jne 0x470a5f
mov eax, dword [esp + 0x26c]
lea ecx, [esp + 0x270]
cmp eax, ecx
je 0x470a5f
push eax
call fcn.004ed7b6
add esp, 4
xor al, al
jmp 0x470ba9
mov dword [esp + 0x10], str.LocalLow
mov dword [esp + 0x14], str.Roaming
mov dword [esp + 0x18], str.Local
xor edi, edi
cmp byte [esp + 0x380], 0
lea eax, [esp + 0x270]
jne 0x470a98
mov eax, dword [esp + 0x26c]
mov esi, dword [esp + edi*4 + 0x10]
lea ecx, [eax + 4]
call fcn.0041b740
test al, al
jne 0x470abe
inc edi
cmp edi, 3
jb 0x470a80
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jmp 0x470b82
mov edi, esi
test edi, edi
jne 0x470ad4
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jmp 0x470b82
lea ecx, [esp + 0x1c]
call fcn.004174b0
mov eax, edi
lea edx, [esp + 0x1c]
call fcn.00417710
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x144]
push ecx
lea ecx, [esp + 0x26c]
mov byte [esp + 0x3a0], 2
call fcn.0041e3b0
cmp byte [eax + 0x11c], 0
je 0x470b17
add eax, 0xc
jmp 0x470b1a
mov eax, dword [eax + 8]
add eax, 4
mov edx, 0x577148
call fcn.00417710
cmp byte [esp + 0x25c], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x140], esi
jne 0x470b58
mov eax, dword [esp + 0x148]
lea edx, [esp + 0x14c]
cmp eax, edx
je 0x470b58
push eax
call fcn.004ed7b6
add esp, 4
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], esi
jne 0x470b7b
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x470b7b
push eax
call fcn.004ed7b6
add esp, 4
mov dword [esp + 0x264], esi
cmp byte [esp + 0x380], 0
jne 0x470ba7
mov eax, dword [esp + 0x26c]
lea edx, [esp + 0x270]
cmp eax, edx
je 0x470ba7
push eax
call fcn.004ed7b6
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x390]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x380]
xor ecx, esp
call fcn.004ecddb
add esp, 0x390
ret
Function at 0x4754b0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x51358c
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x490], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x4a8]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], ebx
lea esi, [esp + 0x14c]
mov dword [esp + 0x4b0], ebx
call fcn.00425230
mov ebp, vtable.t_fileRead.0
mov dword [esp + 0x14c], ebp
mov dword [esp + 0x498], 0x54bd20
mov dword [esp + 0x49c], ebx
mov dword [esp + 0x4a0], ebx
lea ecx, [esp + 0x24]
call fcn.004174b0
mov eax, edi
lea edx, [esp + 0x24]
call fcn.00417710
push ebx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x2c]
mov ecx, esi
mov byte [esp + 0x4b8], 3
call fcn.00425360
test al, al
je 0x47565b
mov edx, dword [esp + 0x150]
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47558e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
je 0x47558e
xor edi, edi
mov dword [esp + 0x49c], edi
sub edi, dword [esp + 0x4a0]
push edi
call fcn.004ed893
add esp, 4
push edi
mov esi, eax
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x4a4]
call fcn.004277f0
test al, al
je 0x47565b
call fcn.00475400
mov edx, dword [eax]
push edi
mov ecx, eax
mov eax, dword [edx + 8]
push esi
call eax
push esi
mov edi, eax
call fcn.004ed7b6
add esp, 4
mov dword [esp + 0x24], vtable.t_str.0
cmp byte [esp + 0x140], bl
jne 0x475603
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
cmp eax, ecx
je 0x475603
push eax
call fcn.004ed7b6
add esp, 4
mov byte [esp + 0x4b0], bl
lea ecx, [esp + 0x14c]
mov dword [esp + 0x14c], ebp
mov dword [esp + 0x498], 0x54bd40
call fcn.004252a0
lea ecx, [esp + 0x18]
call fcn.004163d0
mov eax, edi
mov ecx, dword [esp + 0x4a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x490]
xor ecx, esp
call fcn.004ecddb
add esp, 0x4a0
ret
mov dword [esp + 0x24], vtable.t_str.0
cmp byte [esp + 0x140], bl
jne 0x475681
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
cmp eax, ecx
je 0x475681
push eax
call fcn.004ed7b6
add esp, 4
mov byte [esp + 0x4b0], bl
lea ecx, [esp + 0x14c]
mov dword [esp + 0x14c], ebp
mov dword [esp + 0x498], 0x54bd40
call fcn.004252a0
lea ecx, [esp + 0x18]
call fcn.004163d0
xor eax, eax
jmp 0x475633
Function at 0x4778d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50dcca
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xa
mov dword [esi + 0x18], fcn.004ed893
mov dword [esi + 0x1c], fcn.004ee443
mov dword [esi + 0x20], fcn.004ed7b6
mov dword [esi + 0x24], eax
mov dword [esp + 0x14], eax
xor edx, edx
mov dword [esi], vtable.SogouPluginableModuleDirectoryManager.0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x238], al
mov word [esi + 0x30], dx
call fcn.00477980
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4