joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4359c2
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x5a68ee
call fcn.0043caa9
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x435baf
inc ebp
or byte [ebx], dh
fisttp dword [ecx - 0x28b63]
inc dword [ebp - 0x347bf040]
add dword [eax], eax
add byte [eax - 0x73], dl
dec ebp
shr al, 0x13
invalid
push eax
lea ecx, [ebp - 0x40]
call fcn.00403700
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.0042a914
mov edi, 0x22c
lea eax, [ebp - 0x284]
push edi
push 0
push eax
call fcn.00447ad0
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x28c], esi
cmp esi, 0xffffffff
je 0x435b9f
call fcn.004264bb
test al, al
je 0x435a44
ja 0x435a25
cdq
pop eax
int1
dec ecx
in al, dx
sbb eax, 0x2d07ca8e
push esi
jbe 0x435a84
jno 0x4359d2
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], edi
push eax
push esi
test dword [ebp + edi*8 - 1], edi
dec dword [ecx - 0x28343]
call dword [eax + 0x56]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x435b1c
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x435a83
lea eax, [ebp - 0x260]
push eax
call fcn.004561c7
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402110
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0042a914
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00428511
test eax, eax
je 0x435ad7
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00429f00
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.00428511
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x435ade
mov byte [ebp - 0x285], 1
test bl, 1
je 0x435af2
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.004254f0
cmp byte [ebp - 0x285], 0
jne 0x435bb5
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004254f0
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x435a5c
call fcn.004265cf
test al, al
je 0x435b4c
or eax, ecx
sbb edx, dword [eax]
stosd dword es:[edi], eax
int3
in eax, dx
xor al, 0xd5
jl 0x435b83
mov ebp, 0xf42699f
jle 0x435b46
movd ebp, mm7
outsb dx, byte [esi]
mov eax, dword [0x51ae809]
invalid
call fcn.0042606b
test al, al
je 0x435b6e
pop es
adc eax, 0xdf0f9af6
mov ecx, 0x6bd240c4
mov byte [0x1545d621], al
test byte [edi + 0xf], al
bound ebp, qword [edx]
stosd dword es:[edi], eax
mov eax, dword [0xaae819fb]
pop es
invalid
call fcn.0042631d
test al, al
je 0x435b93
adc dword [ebx], eax
sti
loope 0x435b3d
movsd dword es:[edi], dword [esi]
push ecx
sub dword [eax], esi
dec esi
and al, 0xe9
cwde
je 0x435b4c
add al, 0xc0
inc ecx
xchg edx, eax
xchg ebp, eax
mov eax, dword [0x1e80b152]
sbb eax, edx
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.004254f0
mov eax, esi
call fcn.0043ca64
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.004254f0
jmp 0x435ba1
Function at 0x435bd0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00426026
test al, al
je 0x435bf5
push edi
ja 0x435c21
xchg ebx, eax
or ecx, ecx
out dx, al
and byte [ebp + 0x1dcfbe26], cl
lodsb al, byte [esi]
clc
push dword [ebp + 8]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x435c28
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
xor ecx, ecx
inc ecx
test eax, eax
push esi
cmovne ebx, ecx
mov dword [ebp - 4], ebx
cld
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00426659
test al, al
je 0x435c44
sub al, 0xcf
arpl word [ebp - 0x34], dx
pop ss
cmpsd dword [esi], dword es:[edi]
wait
mov dword [0xf6813009], eax
mov dword [0x5d8baa04], eax
cld
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435cb1
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 0xc]
push edi
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00403700
call fcn.0042d000
and dword [ebp - 0x24], 0
lea edi, [ebp - 0x20]
add esp, 0x18
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x614
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x435e7b
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x42c
mov eax, 0x5a6e1a
call fcn.0043caa9
mov edi, ecx
mov esi, 0x208
lea eax, [ebp - 0x420]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00447ad0
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00447ad0
add esp, 0x18
lea eax, [ebp - 0x438]
mov ecx, edi
push eax
call fcn.00436614
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push str.Dict
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
push 0x5ac958
push eax
call fcn.00408eb0
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00456213
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.004561e2
lea eax, [ebp - 0x218]
push 0x5a9ce8
push eax
call fcn.004561e2
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
add esp, 0x28
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x435de7
push 0
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00435cb1
call fcn.0042589f
mov ecx, eax
call fcn.00437239
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00456213
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.004561e2
lea eax, [ebp - 0x218]
push 0x5a9ce8
push eax
call fcn.004561e2
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x435e51
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00435cb1
push 0
push 1
lea ecx, [ebp - 0x438]
call fcn.004254f0
call fcn.0043ca64
ret
jmp 0x435d0a

Function at 0x435e80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.00447ad0
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00447ad0
add esp, 0x18
call fcn.0042589f
mov ecx, eax
call fcn.00437249
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00456213
lea eax, [ebp - 0x414]
push str.WnWizard.exe
push eax
call fcn.004561e2
mov esi, 0x5ab5a0
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00456213
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004561e2
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004561e2
lea eax, [ebp - 0x20c]
push str._RunAutoLoadDict
push eax
call fcn.004561e2
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435f4f
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00434b09
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043c551
mov esp, ebp
pop ebp
ret
Function at 0x43602c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.00447ad0
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00447ad0
add esp, 0x18
call fcn.0042589f
mov ecx, eax
call fcn.00437249
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00456213
lea eax, [ebp - 0x414]
push str.WnDictManager.exe
push eax
call fcn.004561e2
mov esi, 0x5ab5a0
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00456213
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004561e2
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004561e2
lea eax, [ebp - 0x20c]
push str._CheckSysMb
push eax
call fcn.004561e2
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4360fb
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00434b09
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043c551
mov esp, ebp
pop ebp
ret
Function at 0x43610b
Capabilities:
Check if file exists

Disassembly:
push 0x658
mov eax, 0x5a6eb9
call fcn.0043caa9
push str.DoRunRegImeInterFace
call fcn.00425182
pop ecx
lea ecx, [ebp - 0x664]
call fcn.0042de74
xor ebx, ebx
lea ecx, [ebp - 0x664]
mov dword [ebp - 4], ebx
call fcn.0042df3a
mov dword [ebp - 0x630], ebx
push 7
pop esi
mov dword [ebp - 0x62c], esi
test eax, eax
je 0x43617b
xor eax, eax
mov edi, str.WnRegIme64.exe
push edi
mov word [ebp - 0x640], ax
call fcn.004561c7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x640]
call fcn.00402110
mov byte [ebp - 4], 1
jmp 0x4361a1
xor eax, eax
mov edi, str.WnRegIme32.exe
push edi
mov word [ebp - 0x640], ax
call fcn.004561c7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x640]
call fcn.00402110
mov byte [ebp - 4], 2
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
call fcn.0042589f
mov ecx, eax
call fcn.00437249
push eax
lea eax, [ebp - 0x218]
push 0x5ac1bc
push eax
call fcn.00408eb0
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x640]
push ebx
push 1
call fcn.004254f0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4362d4
mov dword [ebp - 0x62c], esi
xor eax, eax
mov esi, str._InstallIME
mov dword [ebp - 0x630], ebx
push esi
mov word [ebp - 0x640], ax
call fcn.004561c7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x640]
call fcn.00402110
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x640]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00408eb0
pop ecx
pop ecx
call fcn.0042db31
test eax, eax
lea eax, [ebp - 0x420]
je 0x436287
push 0xffffffffffffffff
push ebx
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00434524
lea eax, [ebp - 0x420]
push eax
push str.DoRunRegImeInterFace_Parameter__s
call fcn.00425182
add esp, 0x18
jmp 0x4362c4
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___s
push eax
call fcn.00408eb0
lea eax, [ebp - 0x628]
push eax
push str.DoRunRegImeInterFace_Cmd__s
call fcn.00425182
push ebx
push ebx
push ebx
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.00434b09
add esp, 0x2c
push ebx
push 1
lea ecx, [ebp - 0x640]
call fcn.004254f0
jmp 0x4362e7
lea eax, [ebp - 0x218]
push eax
push str.PathFileExists_false_file___s
call fcn.00425182
pop ecx
pop ecx
lea ecx, [ebp - 0x664]
call fcn.0042de87
call fcn.0043ca64
ret
Function at 0x4362f8
Capabilities:
Check if file exists

Disassembly:
push 0x640
mov eax, 0x5a6eec
call fcn.0043caa9
mov esi, 0x208
lea eax, [ebp - 0x628]
push esi
xor edi, edi
push edi
push eax
call fcn.00447ad0
push esi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00447ad0
push esi
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00447ad0
add esp, 0x24
lea ecx, [ebp - 0x64c]
call fcn.0042de74
lea ecx, [ebp - 0x64c]
mov dword [ebp - 4], edi
call fcn.0042df3a
test eax, eax
je 0x43635f
push str.WnRegIme64.exe
jmp 0x436364
push str.WnRegIme32.exe
call fcn.0042589f
mov ecx, eax
call fcn.00437249
push eax
lea eax, [ebp - 0x218]
push 0x5ac1bc
push eax
call fcn.00408eb0
add esp, 0x10
lea eax, [ebp - 0x420]
push str._UnInstallIME
push eax
call fcn.00408eb0
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4363f9
call fcn.0042db31
test eax, eax
lea eax, [ebp - 0x420]
je 0x4363cd
push 0xffffffffffffffff
push edi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00434524
add esp, 0x10
jmp 0x4363f9
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___s
push eax
call fcn.00408eb0
push edi
push edi
push edi
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.00434b09
add esp, 0x24
lea ecx, [ebp - 0x64c]
call fcn.0042de87
call fcn.0043ca64
ret

Function at 0x43640a
Capabilities:
Check if file exists
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00435e7b
mov ecx, esi
call fcn.0043602c
mov ecx, esi
call fcn.00436027
mov ecx, esi
call fcn.0043610b
mov ecx, esi
pop esi
jmp 0x4364e1
push 0x23c
mov eax, 0x5a7769
call fcn.0043caa9
call fcn.0042589f
mov ecx, eax
call fcn.00437249
push eax
lea ecx, [ebp - 0x230]
call fcn.00403700
mov esi, str.WanNengWBInfo.ini
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.004561c7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.004052c0
mov esi, 0x5a9ce8
push esi
call fcn.004561c7
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x230]
call fcn.0042954e
cmp eax, 0xffffffff
je 0x436600
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00414110
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push edi
push eax
call fcn.00447ad0
add esp, 0xc
lea eax, [ebp - 0x218]
push edi
push 0x1c
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push str.VirtualStore_
push eax
call fcn.004561e2
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004561e2
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4365f2
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x218]
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
push eax
call fcn.00427154
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x248]
call fcn.004254f0
push edi
push 1
lea ecx, [ebp - 0x230]
call fcn.004254f0
call fcn.0043ca64
ret
Function at 0x436bfe
Capabilities:
Read .ini file

Disassembly:
push 0x26c
mov eax, 0x5a705f
call fcn.0043caa9
mov esi, ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test ebx, ebx
jne 0x436c20
xor al, al
jmp 0x436da7
lea eax, [ebp - 0x260]
push eax
call fcn.00436e17
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.00447ad0
add esp, 0xc
lea eax, [ebp - 0x248]
mov ecx, esi
push ebx
push eax
call fcn.004370a5
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x260]
mov ebx, 0x5a98a4
cmp dword [ebp - 0x234], 8
push eax
cmovae ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x218]
push 0x104
push eax
push ebx
push ecx
push 0x5ae9cc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00456235
pop ecx
pop ecx
test eax, eax
jne 0x436d47
and dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x230]
push ecx
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x248]
mov ecx, esi
push eax
push 0x5ae9cc
call fcn.004255c8
test al, al
jne 0x436d11
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.004254f0
xor bl, bl
jmp 0x436d87
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00456213
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.004254f0
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.00436f64
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 3
cmp edi, eax
je 0x436d76
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.00401ff0
push 0
push 1
lea ecx, [ebp - 0x278]
mov bl, 1
call fcn.004254f0
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.004254f0
push 0
push 1
lea ecx, [ebp - 0x260]
call fcn.004254f0
mov al, bl
call fcn.0043ca64
ret 8

Function at 0x436daf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.00436b94
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.UserID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x436df5
mov dword [esi], eax
mov bl, 1
jmp 0x436df7
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004254f0
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c551
mov esp, ebp
pop ebp
ret 4
Function at 0x436e97
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00436b94
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.UserID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
lea ecx, [ebp - 0x1c]
push 0
push 1
setg bl
call fcn.004254f0
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0043c551
mov esp, ebp
pop ebp
ret

Function at 0x4372c6
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43740a
push ebx
push edi
xor edi, edi
xor ebx, ebx
push edi
push 0x80
push 4
push edi
inc ebx
mov dword [ebp - 0x10c], edi
push ebx
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x437327
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10c], eax
jmp 0x43732d
mov eax, dword [ebp - 0x10c]
lea esi, [eax + 1]
push esi
call fcn.0043c562
and dword [ebp - 0x11c], 0
pop ecx
push 0
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x118], eax
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00447ad0
lea eax, [ebp - 0x108]
push str.identifierBegin:abcdefghijklmnopqrstuvwxyz:identifierEnd
push eax
call fcn.00456310
lea eax, [ebp - 0x108]
push eax
call fcn.00456280
mov edi, dword [ebp - 0x10c]
add esp, 0x18
mov dword [ebp - 0x114], eax
xor eax, eax
mov dword [ebp - 0x110], eax
test edi, edi
jle 0x4373f8
mov edx, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x108]
cmp byte [edx], cl
jne 0x4373ec
xor ecx, ecx
xor esi, esi
cmp dword [ebp - 0x114], ecx
jle 0x4373e6
mov al, byte [edx + ecx]
cmp al, byte [ebp + ecx - 0x108]
jne 0x4373e0
mov eax, dword [ebp - 0x114]
inc esi
cmp esi, eax
je 0x4373fa
inc ecx
cmp ecx, eax
jl 0x4373c4
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x108]
inc eax
inc edx
mov dword [ebp - 0x110], eax
cmp eax, edi
jl 0x4373b4
xor ebx, ebx
push dword [ebp - 0x118]
call fcn.0043c56b
pop ecx
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043c551
mov esp, ebp
pop ebp
ret

Function at 0x43a101
Capabilities:
Check if file exists

Disassembly:
push 0x20
mov eax, 0x5a7681
call fcn.0043caa9
mov esi, ecx
lea eax, [ebp - 0x28]
push eax
call fcn.0043a372
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a157
mov ecx, esi
call fcn.0043a449
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00403700
call fcn.0042d000
add esp, 0x18
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004254f0
call fcn.0043ca64
ret
Function at 0x43a449
Capabilities:
Check if file exists

Disassembly:
push 0x83c
mov eax, 0x5a483b
call fcn.0043caa9
mov esi, ecx
lea eax, [ebp - 0x848]
push eax
call fcn.0043a372
and dword [ebp - 4], 0
lea eax, [ebp - 0x848]
cmp dword [ebp - 0x834], 8
cmovae eax, dword [ebp - 0x848]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a56a
push 0x104
lea eax, [ebp - 0x830]
mov ecx, esi
push eax
call fcn.0043a3e2
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
push str.WnImeBroker.exe
cmovae eax, dword [ebp - 0x848]
mov esi, 0x5ac1bc
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00408eb0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___Unregister
push eax
call fcn.00408eb0
lea eax, [ebp - 0x628]
push eax
call int.004351d5
lea eax, [ebp - 0x628]
push eax
push str.ImeBroker_cmd1___s
call fcn.0042b43b
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
push str.WnImeBrokerPS.dll
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00408eb0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x628]
push str.__s_regsvr32___u__s___s_
push eax
call fcn.00408eb0
add esp, 0x48
lea eax, [ebp - 0x628]
push eax
call int.004351d5
lea eax, [ebp - 0x628]
push eax
push str.ImeBroker_cmd2___s
call fcn.00425182
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x848]
call fcn.004254f0
call fcn.0043ca64
ret

Function at 0x43a57f
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x5a75bb
call fcn.0043caa9
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x43a623
test esi, esi
je 0x43a623
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a623
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a623
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00403700
lea eax, [ebp - 0x40]
push eax
call fcn.00427d68
add esp, 4
xor edi, edi
mov ecx, esp
mov dword [ebp - 4], edi
push esi
call fcn.00403700
lea eax, [ebp - 0x28]
push eax
call fcn.00427d68
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.00453f5f
add esp, 0x24
lea ecx, [ebp - 0x28]
neg eax
sbb esi, esi
push edi
push 1
call fcn.004254f0
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.004254f0
lea eax, [esi + 1]
jmp 0x43a625
xor eax, eax
call fcn.0043ca64
ret 8