joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c90d
Capabilities:
Check if file exists

Disassembly:
push 0x640
mov eax, 0x5a28bf
call fcn.004348d9
mov esi, 0x208
lea eax, [ebp - 0x628]
push esi
xor edi, edi
push edi
push eax
call fcn.00445350
push esi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00445350
push esi
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00445350
add esp, 0x24
lea ecx, [ebp - 0x64c]
call fcn.0042e856
lea ecx, [ebp - 0x64c]
mov dword [ebp - 4], edi
call fcn.0042e91c
test eax, eax
je 0x42c974
push str.WnRegIme64.exe
jmp 0x42c979
push str.WnRegIme32.exe
call fcn.0041f447
mov ecx, eax
call fcn.0042c2b6
push eax
lea eax, [ebp - 0x218]
push 0x5a5f0c
push eax
call fcn.00407470
add esp, 0x10
lea eax, [ebp - 0x420]
push str._UnInstallIME
push eax
call fcn.00407470
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42ca0e
call fcn.00424bf9
test eax, eax
lea eax, [ebp - 0x420]
je 0x42c9e2
push 0xffffffffffffffff
push edi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0042581c
add esp, 0x10
jmp 0x42ca0e
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___s
push eax
call fcn.00407470
push edi
push edi
push edi
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.004258a2
add esp, 0x24
lea ecx, [ebp - 0x64c]
call fcn.0042e869
call fcn.00434894
ret

Function at 0x42ca1f
Capabilities:
Check if file exists
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0042c490
mov ecx, esi
call fcn.0042c641
mov ecx, esi
call fcn.0042c63c
mov ecx, esi
call fcn.0042c720
mov ecx, esi
pop esi
jmp 0x42caf6
push 0x23c
mov eax, 0x5a3226
call fcn.004348d9
call fcn.0041f447
mov ecx, eax
call fcn.0042c2b6
push eax
lea ecx, [ebp - 0x230]
call fcn.00401870
mov esi, str.WanNengWBInfo.ini
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.004532f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.004054d0
mov esi, 0x620760
push esi
call fcn.004532f1
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x230]
call fcn.004233fd
cmp eax, 0xffffffff
je 0x42cc15
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.004216e6
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push edi
push eax
call fcn.00445350
add esp, 0xc
lea eax, [ebp - 0x218]
push edi
push 0x1c
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push str.VirtualStore_
push eax
call fcn.00452fa8
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00452fa8
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42cc07
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x218]
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
push eax
call fcn.0042198d
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x248]
call fcn.004019a0
push edi
push 1
lea ecx, [ebp - 0x230]
call fcn.004019a0
call fcn.00434894
ret
Function at 0x42d1a9
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x5a2a1c
call fcn.004348d9
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
and dword [ebp - 0x24c], 0
push 0x208
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00445350
add esp, 0xc
call fcn.0043a80c
test al, al
je 0x42d1fc
or ebx, ebp
arpl word [ebp - 0x65], di
mov dl, 0xd4
lcall 0xb747, 0x5b52eafa
xor dword [edx - 0x64], edi
insb byte es:[edi], dx
push 0x104
lea eax, [ebp - 0x218]
xor esi, esi
push eax
push esi
jmp 0x42d304
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42d2f6
call fcn.0043a8db
test al, al
je 0x42d246
imul eax, dword [ebx + 0x5512163f], 0xda8c8a14
adc eax, 0x10b2d96d
add al, 0x83
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x42d276
movsd dword es:[edi], dword [esi]
loopne 0x42d247
invalid
lea eax, [ebp - 0x218]
push eax
call fcn.004532f1
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00401a60
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00421362
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.004019a0
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push dword [ebp - 0x250]
call fcn.004271b1
pop ecx
pop ecx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.00401c80
push 0x104
lea eax, [ebp - 0x218]
inc esi
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x42d210
call fcn.00434894
ret
Function at 0x42df2e
Capabilities:
Set registry value

Disassembly:
cmp eax, sym.imp.ADVAPI32.dll_RegCloseKey
add bh, bh
jne 0x42df18
push dword [ebp - 8]
call edi
push dword [ebp - 4]
call edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
clc
add byte [ebx + 0x5300fc65], al
push esi
push edi
call fcn.0043ab03
test al, al
je 0x42df5f
bound ebx, qword [esi]
aam 0xc5
invalid
call fcn.0043aa79
test al, al
je 0x42df83
rol dword [0x6466764b], 1
dec esp
retf 0x6ad0
call fcn.0043aa34
test al, al
je 0x42dfa5
je 0x42dfd8
xchg ebx, eax
jb 0x42df1c
xor eax, dword [ebp + 0x38]
popfd
mov cl, 0x7a
jae 0x42df39
test al, 0xd1
cdq
insb byte es:[edi], dx
aaa
dec ebx
pop ecx
or byte [edx], al
loopne 0x42dfa2
adc byte [ebp - 0x24cc0bbb], cl
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0xf013f
push ebx
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e0fa
call fcn.0043aa34
test al, al
je 0x42dff0
cmp edx, esp
sbb byte [edi + 7], cl
xor bh, ah
cld
jge 0x42dfa5
xchg edi, eax
not byte [ebx - 0x63dc2c81]
mov esp, dword [edx + 0x3438e0ca]
mov ebx, 0xfe06a9d
xor byte [ebx], 0xdb
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42e01c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42e0fa
call fcn.0043ab03
test al, al
je 0x42e042
pop ebx
mov byte [ecx], dh
adc edx, dword [eax]
pushal
sub eax, 0xc744b008
dec eax
cmpsd dword [esi], dword es:[edi]
ret
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42e073
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x42e0f8
call fcn.0043a55a
test al, al
je 0x42e09c
sti
sbb eax, 0x1fbaf99f
adc eax, 0x5c2a1903
cmp eax, 0x97cf2e3c
test al, 0xd8
pop ecx
loope 0x42e097
sub al, byte [eax]
pop esi
mov ah, 0xc0
rcl bh, 0x14
sbb eax, ebp
dec esi
leave
add byte [eax], al
rol al, 0xd7
adc al, 0x19
call fcn.0043a9ef
test al, al
je 0x42e0c1
pushal
rcr byte [esi], 0x92
int1
invalid
push dword [ebp + 0x14]
call fcn.004532f1
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e16b
Capabilities:
Read .ini file

Disassembly:
push 0x26c
mov eax, 0x5a2b09
call fcn.004348d9
mov esi, ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test ebx, ebx
jne 0x42e18d
xor al, al
jmp 0x42e314
lea eax, [ebp - 0x260]
push eax
call fcn.0042e48a
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.00445350
add esp, 0xc
lea eax, [ebp - 0x248]
mov ecx, esi
push ebx
push eax
call fcn.0042e718
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x260]
mov ebx, 0x61f778
cmp dword [ebp - 0x234], 8
push eax
cmovae ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x218]
push 0x104
push eax
push ebx
push ecx
push 0x5a76c4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00453520
pop ecx
pop ecx
test eax, eax
jne 0x42e2b4
and dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x230]
push ecx
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x248]
mov ecx, esi
push eax
push 0x5a76c4
call fcn.0042e31c
test al, al
jne 0x42e27e
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.004019a0
xor bl, bl
jmp 0x42e2f4
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00452fd9
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.004019a0
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0042e5d7
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 3
cmp edi, eax
je 0x42e2e3
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.00401b60
push 0
push 1
lea ecx, [ebp - 0x278]
mov bl, 1
call fcn.004019a0
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.004019a0
push 0
push 1
lea ecx, [ebp - 0x260]
call fcn.004019a0
mov al, bl
call fcn.00434894
ret 8

Function at 0x42e422
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62b0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.0042e101
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.UserID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x42e468
mov dword [esi], eax
mov bl, 1
jmp 0x42e46a
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004019a0
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00433ee3
mov esp, ebp
pop ebp
ret 4
Function at 0x42e50a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62b0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.0042e101
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.UserID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
lea ecx, [ebp - 0x1c]
push 0
push 1
setg bl
call fcn.004019a0
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00433ee3
mov esp, ebp
pop ebp
ret

Function at 0x42e992
Capabilities:
Link many functions at runtime

Disassembly:
add byte [ebx], dh
rol byte [ebx + 0x5e01fc7d], 0xf
xchg esp, eax
rcr byte [ebx - 0x75], 0xe5
pop ebp
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push str.kernel32.dll
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
call fcn.0043a9ef
test al, al
je 0x42e9c5
lodsb al, byte [esi]
arpl bp, bp
sub dl, bl
shl dh, 1
push ebp
push esp
add eax, 0x9c19a340
add bl, ah
mov ecx, 0xbd2ee8
add byte [eax + eax*8 + 0xc231f74], al
mov ebp, 0x1adc5bbc
call fcn.0043a6f8
test al, al
je 0x42e9ed
and ecx, dword [edi*4 + 0x1adc5bbc]
pop es
xor al, 0x36
ja 0x42e961
outsd dx, dword [esi]
mov eax, dword [0xd95624fa]
imul ebx, dword [ecx - 0x73], 0x63
stosb byte es:[edi], al
rep lodsb al, byte [esi]
pop ds
adc eax, 0x8d212d76
call fcn.0043a515
test al, al
je 0x42ea0c
xchg ebp, eax
jno 0x42e9ce
jno 0x42e9a3
cdq
xchg ebp, eax
push ss
int3
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x42ea1b
xor eax, eax
jmp 0x42eae5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5a63d4
push dword [ebx]
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
loopne 0x42ea91
pop edx
add bh, bh
xor ecx, dword [ecx - 0x2900f7bd]
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0x18], eax
call esi
push str.GetSystemWow64DirectoryW
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
push str.advapi32.dll
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
call fcn.0043a6f8
test al, al
je 0x42ea8f
mov dh, bh
jge 0x42ea2b
cdq
ret 0x4f19
call fcn.0043a59f
test al, al
mov ebx, 0xc0840000
je 0x42eab6
movsb byte es:[edi], byte [esi]
iretd
mov esi, dword [ebp - 4]
cmp dword [esi + 4], 0
je 0x42ea14
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431d5e
Capabilities:
Check if file exists

Disassembly:
push 0x20
mov eax, 0x5a38a1
call fcn.004348d9
mov esi, ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00431fd0
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431db4
mov ecx, esi
call fcn.004320a7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401870
call fcn.004241e6
add esp, 0x18
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004019a0
call fcn.00434894
ret

Function at 0x431dc6
Capabilities:
Check if file exists

Disassembly:
push 0xc54
mov eax, 0x5a301f
call fcn.004348d9
mov esi, ecx
push str.CImeBrokerReg::DoRun
call fcn.0041f592
pop ecx
call fcn.00424d2e
test eax, eax
je 0x431fc9
push 0x104
lea eax, [ebp - 0x830]
mov ecx, esi
push eax
call fcn.00432040
push 0x6207f4
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x218]
push str._sIME_s_
push eax
call fcn.00407470
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x431e40
lea eax, [ebp - 0x218]
push eax
call fcn.004235d5
pop ecx
lea eax, [ebp - 0xc58]
push 0
push eax
call fcn.0042389a
and dword [ebp - 4], 0
lea eax, [ebp - 0xc58]
cmp dword [ebp - 0xc44], 8
mov esi, str.WnImeBroker.exe
push esi
cmovae eax, dword [ebp - 0xc58]
mov edi, 0x5a5f0c
push eax
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.00407470
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00407470
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.0042198d
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc40]
push str.__s___RegServer
push eax
call fcn.00407470
lea eax, [ebp - 0xc40]
push eax
call fcn.00425f6e
add esp, 0x40
lea eax, [ebp - 0xc40]
push eax
push str.ImeBroker_cmd1___s
call fcn.0041f592
cmp dword [ebp - 0xc44], 8
lea eax, [ebp - 0xc58]
mov esi, str.WnImeBrokerPS.dll
cmovae eax, dword [ebp - 0xc58]
push esi
push eax
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.00407470
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00407470
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.0042198d
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0xc40]
push str.__s_regsvr32___s___s_
push eax
call fcn.00407470
add esp, 0x40
lea eax, [ebp - 0xc40]
push eax
call fcn.00425f6e
lea eax, [ebp - 0xc40]
push eax
push str.ImeBroker_cmd2___s
call fcn.0041f592
add esp, 0xc
lea ecx, [ebp - 0xc5c]
call fcn.0043378e
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x218]
mov ecx, esp
push eax
call fcn.00401870
lea ecx, [ebp - 0xc5c]
call fcn.00433c4c
lea eax, [ebp - 0x218]
push eax
push str.AddInstallEveryonePower_path___s
call fcn.0041f592
pop ecx
pop ecx
lea ecx, [ebp - 0xc5c]
call fcn.004337a9
push 0
push 1
lea ecx, [ebp - 0xc58]
call fcn.004019a0
call fcn.00434894
ret
Function at 0x4320a7
Capabilities:
Check if file exists

Disassembly:
push 0x83c
mov eax, 0x5a3075
call fcn.004348d9
mov esi, ecx
lea eax, [ebp - 0x848]
push eax
call fcn.00431fd0
and dword [ebp - 4], 0
lea eax, [ebp - 0x848]
cmp dword [ebp - 0x834], 8
cmovae eax, dword [ebp - 0x848]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4321c8
push 0x104
lea eax, [ebp - 0x830]
mov ecx, esi
push eax
call fcn.00432040
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
push str.WnImeBroker.exe
cmovae eax, dword [ebp - 0x848]
mov esi, 0x5a5f0c
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00407470
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___Unregister
push eax
call fcn.00407470
lea eax, [ebp - 0x628]
push eax
call fcn.00425f6e
lea eax, [ebp - 0x628]
push eax
push str.ImeBroker_cmd1___s
call fcn.0043ad76
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
push str.WnImeBrokerPS.dll
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00407470
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x628]
push str.__s_regsvr32___u__s___s_
push eax
call fcn.00407470
add esp, 0x48
lea eax, [ebp - 0x628]
push eax
call fcn.00425f6e
lea eax, [ebp - 0x628]
push eax
push str.ImeBroker_cmd2___s
call fcn.0041f592
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x848]
call fcn.004019a0
call fcn.00434894
ret

Function at 0x4321dd
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x5a30a5
call fcn.004348d9
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x432281
test esi, esi
je 0x432281
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x432281
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x432281
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00401870
lea eax, [ebp - 0x40]
push eax
call int.004225a1
add esp, 4
xor edi, edi
mov ecx, esp
mov dword [ebp - 4], edi
push esi
call fcn.00401870
lea eax, [ebp - 0x28]
push eax
call int.004225a1
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.0045330c
add esp, 0x24
lea ecx, [ebp - 0x28]
neg eax
sbb esi, esi
push edi
push 1
call fcn.004019a0
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.004019a0
lea eax, [esi + 1]
jmp 0x432283
xor eax, eax
call fcn.00434894
ret 8
Function at 0x43228b
Capabilities:
Check if file exists

Disassembly:
push 0x634
mov eax, 0x5a30d5
call fcn.004348d9
mov esi, ecx
call fcn.0041f447
mov ecx, eax
call fcn.0042c2b6
mov ebx, eax
call fcn.0041f447
mov ecx, eax
call fcn.0042c296
push 0x208
mov edi, eax
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00445350
push edi
lea eax, [ebp - 0x628]
push str._sEUDC_
push eax
call fcn.00407470
add esp, 0x18
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4322f8
xor eax, eax
jmp 0x4323fc
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00445350
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00445350
push edi
lea eax, [ebp - 0x218]
push str._sEUDCEUDC.EUF
push eax
call fcn.00407470
push ebx
lea eax, [ebp - 0x420]
push str._sEUDCEUDC.EUF
push eax
call fcn.00407470
add esp, 0x30
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004321dd
test eax, eax
je 0x4322f1
push edi
mov edi, str._sEUDCEUDC.TTE
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00407470
push ebx
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00407470
add esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004321dd
test eax, eax
je 0x4322f1
xor ebx, ebx
mov dword [ebp - 0x62c], 7
xor eax, eax
mov dword [ebp - 0x630], ebx
mov word [ebp - 0x640], ax
lea eax, [ebp - 0x640]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.0043274f
test eax, eax
je 0x4323ea
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x640]
call fcn.0041fa57
test eax, eax
jne 0x4323ea
xor esi, esi
inc esi
jmp 0x4323ec
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x640]
call fcn.004019a0
mov eax, esi
call fcn.00434894
ret

Function at 0x432566
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x62b0b8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push esi
push eax
push 0xf003f
push 0
push str.EUDC936
push reloc.WS2_32.dll_accept
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4325d1
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.004326e4
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004019a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00433ee3
mov esp, ebp
pop ebp
ret
Function at 0x4325e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x22c
mov eax, 0x5a3108
call fcn.004348d9
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x234]
push eax
push 0xf003f
xor ebx, ebx
mov dword [ebp - 0x238], 0x208
push ebx
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x234], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43262e
xor eax, eax
jmp 0x4326dc
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.004326e4
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.00445350
add esp, 0xc
lea ecx, [ebp - 0x238]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x234]
test eax, eax
je 0x432699
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
jmp 0x4326cc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x218], 0
jne 0x4326ad
mov eax, ebx
jmp 0x4326ba
lea eax, [ebp - 0x218]
push eax
call fcn.004532f1
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401a60
xor esi, esi
inc esi
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.004019a0
mov eax, esi
call fcn.00434894
ret 4

Function at 0x43274f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x62b0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0xf003f
xor esi, esi
mov ebx, 0x208
push esi
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4327a0
xor eax, eax
jmp 0x432814
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00445350
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push str.SystemDefaultEUDCFont
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
test eax, eax
je 0x4327e4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43279c
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x20c], si
je 0x432802
lea eax, [ebp - 0x20c]
push eax
call fcn.004532f1
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00401a60
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00433ee3
mov esp, ebp
pop ebp
ret 4