joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5091b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b22e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov ebx, 1
mov dword [esp + 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi], 0x6c4668
mov dword [esp + 0x1c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
lea ecx, [esi + 0x4c]
mov byte [esp + 0x1c], 2
call fcn.004230b0
lea ebp, [esi + 0x114]
mov ecx, ebp
mov byte [esp + 0x1c], 3
call fcn.00527000
lea ecx, [esi + 0x6ec]
mov byte [esp + 0x1c], 4
call fcn.00527000
lea ecx, [esi + 0xcc4]
mov byte [esp + 0x1c], 5
call fcn.00527000
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x3f800000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f800000
push edi
mov eax, 0xff
push 0x3f000000
mov byte [esp + 0x5c], 6
mov dword [esi + 0x20], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x159
mov dword [esi + 0xfc], edi
mov byte [esi + 0x100], al
mov byte [esi + 0x101], bl
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
mov byte [esi + 0x102], al
mov byte [esi + 0x103], bl
push 0x3e800000
push 0x3f800000
fld dword [0x70aeac]
push edi
push 0x3e800000
push edi
push ebx
push 0x20
push 0x80
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
call fcn.005cd414
fld dword [0x70aea8]
push eax
call fcn.005cd414
push eax
push edi
push edi
mov ecx, ebp
call fcn.00528830
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x129c], edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x50a6d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6b23d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea ebx, [esi + 0x30]
mov dword [esi], 0x6c4864
mov dword [esp + 0x1c], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
lea ebp, [esi + 0x40]
mov dword [ebp + 4], edi
mov dword [ebp], edi
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], edi
lea ecx, [esi + 0x54]
mov byte [esp + 0x1c], 2
call fcn.004230b0
push 0x80
mov eax, 0x64
push 0x100
mov dword [esi + 4], eax
mov dword [esi + 8], eax
or eax, 0xffffffff
push str.party.tga
push str.data_interface
mov ecx, ebx
mov byte [esp + 0x2c], 3
mov dword [esi + 0xc], 0xa5
mov dword [esi + 0x10], edi
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], eax
call fcn.005497a0
push 0x20
push 2
push str.party_graph.tga
push str.data_interface
mov ecx, ebp
call fcn.005497a0
push edi
push edi
push str.party_icon.tga
mov ecx, 0x220364c
mov dword [esi + 0x50], edi
call fcn.0052aaa0
mov dword [esi + 0x50], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov ecx, esi
call fcn.00526820
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x50db70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b245a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov edi, 1
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi], 0x6c48d4
mov dword [esp + 0x18], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 5
call fcn.00527000
lea ecx, [esi + 0x654]
mov byte [esp + 0x18], 6
call fcn.004230b0
mov dword [esi + 0x92c], edi
mov byte [0x86db68], bl
cmp dword [esi + 0x92c], ebx
mov byte [esi + 0x708], 1
mov byte [esi + 0x709], 0xff
mov byte [esi + 0x70a], bl
mov dword [esi + 0x70c], ebx
mov dword [esi + 0x820], edi
mov dword [esi + 0x704], ebx
mov dword [esi + 0x824], ebx
je 0x50dc67
mov dword [esi + 0xc], 0x14d
mov dword [esi + 0x10], 0x17c
jmp 0x50dc75
mov dword [esi + 0xc], 0xfb
mov dword [esi + 0x10], 0x152
xor eax, eax
lea edi, [esi + 0x82c]
mov ecx, 0x20
rep stosd dword es:[edi], eax
lea edi, [esi + 0x8ac]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x510eb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b262c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], ebx
call fcn.00527000
lea ecx, [esi + 0x60c]
mov byte [esp + 0x14], 1
call fcn.00527000
lea ecx, [esi + 0xbe4]
mov byte [esp + 0x14], 2
call fcn.00527000
lea ecx, [esi + 0x11bc]
mov byte [esp + 0x14], 3
call fcn.00527000
lea ecx, [esi + 0x1794]
mov byte [esp + 0x14], 4
call fcn.00527000
lea ecx, [esi + 0x1d6c]
mov byte [esp + 0x14], 5
call fcn.00527000
mov ecx, esi
mov byte [esp + 0x14], 6
call fcn.00510780
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xffffffe0
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2344], eax
mov byte [esi + 0x18], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x1a], bl
mov byte [esi + 0x1b], bl
mov byte [esi + 0x1c], bl
mov dword [esi + 0x20], ebx
mov byte [esi + 0x19], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x513260
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b26fa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov eax, 1
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi], 0x6c4a24
mov dword [esp + 0x14], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], al
call fcn.004230b0
lea ecx, [esi + 0xf8]
mov byte [esp + 0x14], 2
call fcn.00527000
lea ecx, [esi + 0x6d0]
mov byte [esp + 0x14], 3
call fcn.00527000
lea ecx, [esi + 0xca8]
mov byte [esp + 0x14], 4
call fcn.00527000
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x1284], ebx
mov dword [esi + 0x1280], ebx
mov dword [esi + 0x1288], ebx
mov dword [esi + 0x128c], ebx
mov dword [esi + 0x1294], ebx
mov dword [esi + 0x1290], ebx
mov dword [esi + 0x1298], ebx
mov dword [esi + 0x129c], ebx
mov dword [esi + 0xf0], ebx
mov byte [esi + 0xf4], bl
mov byte [esi + 0xf5], bl
mov byte [esi + 0xf6], bl
mov dword [esi + 0x12a0], ebx
mov dword [esi + 0x12a4], ebx
mov byte [esi + 0xec], 0xff
mov dword [esi + 0xc], 0xc7
mov dword [esi + 0x10], 0x1e9
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x51a330
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b2a2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi], 0x6c4bf0
mov dword [esp + 0x14], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
push fcn.00527170
push fcn.00527000
push 2
push 0x5d8
lea eax, [esi + 0x5c]
push eax
mov byte [esp + 0x28], 3
call fcn.005ce6bb
lea ecx, [esi + 0xc0c]
mov byte [esp + 0x14], 4
call fcn.0052d480
lea ecx, [esi + 0xc7c]
mov byte [esp + 0x14], 5
call fcn.0052b880
lea ecx, [esi + 0x1ee4]
mov byte [esp + 0x14], 6
call fcn.00527000
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x1edc], edi
mov dword [esi + 0x25c4], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x51c9a0
Capabilities:
Access peb ldr_data
Get ntdll base address
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x6b3056
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x6c4dac
lea ebp, [esi + 0x40]
mov ecx, ebp
mov dword [esp + 0x18], 1
call fcn.005270f0
mov eax, dword [esi + 0x30]
xor ebx, ebx
cmp eax, ebx
je 0x51c9e9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x51c9f9
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x34], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_DestroyWindow]
je 0x51ca0a
push eax
call edi
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x51ca14
push eax
call edi
mov ecx, ebp
mov dword [esi + 0x618], 0x67452301
mov dword [esi + 0x61c], 0xefcdab89
mov dword [esi + 0x620], 0x98badcfe
mov dword [esi + 0x624], 0x10325476
mov dword [esi + 0x628], 0xc3d2e1f0
mov dword [esi + 0x62c], ebx
mov dword [esi + 0x630], ebx
mov byte [esp + 0x1c], bl
call fcn.00527170
mov eax, dword [esi + 0x30]
cmp eax, ebx
mov dword [esp + 0x1c], 0xffffffff
pop edi
je 0x51ca76
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x51ca86
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x34], ebx
mov ecx, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x51c9b8
Capabilities:
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x6b3056
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x6c4dac
lea ebp, [esi + 0x40]
mov ecx, ebp
mov dword [esp + 0x18], 1
call fcn.005270f0
mov eax, dword [esi + 0x30]
xor ebx, ebx
cmp eax, ebx
je 0x51c9e9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x51c9f9
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x34], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_DestroyWindow]
je 0x51ca0a
push eax
call edi
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x51ca14
push eax
call edi
mov ecx, ebp
mov dword [esi + 0x618], 0x67452301
mov dword [esi + 0x61c], 0xefcdab89
mov dword [esi + 0x620], 0x98badcfe
mov dword [esi + 0x624], 0x10325476
mov dword [esi + 0x628], 0xc3d2e1f0
mov dword [esi + 0x62c], ebx
mov dword [esi + 0x630], ebx
mov byte [esp + 0x1c], bl
call fcn.00527170
mov eax, dword [esi + 0x30]
cmp eax, ebx
mov dword [esp + 0x1c], 0xffffffff
pop edi
je 0x51ca76
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x51ca86
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x34], ebx
mov ecx, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x524120
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x114
mov edx, dword [esp + 0x118]
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x52422a
lea ecx, [esp + 8]
call fcn.00524030
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x52422e
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x5241e4
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.00524120
mov edi, eax
test edi, edi
jne 0x524246
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x5241a6
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x5241fd
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x124]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x52421c
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x524239
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x524255
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x114
ret 4
Function at 0x5246c0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x5246d2
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x5266d0
Capabilities:
Access peb ldr_data
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x6b3056
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi], 0x6c4dac
mov dword [esp + 8], esi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.00527000
mov ecx, esi
mov byte [esp + 0x14], 1
call fcn.0051ab50
mov eax, dword [0x70859c]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x190
mov dword [esi + 0xc], eax
mov eax, dword [0x7085a0]
cdq
sub eax, edx
sar eax, 1
add eax, 0xfffffecd
mov dword [esi + 0x10], eax
cmp dword [0x70859c], 0x320
jne 0x52675c
cmp dword [0x7085a0], 0x258
jne 0x52675c
add eax, 0x1e
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
add ecx, 0x1a
add eax, 0xa
mov dword [esi + 0x1c], ecx
mov byte [esi + 0x14], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x18], eax
mov edx, dword [0x719a40]
push ebx
push edx
push 0x2203378
mov ecx, 0x220339c
call fcn.0051aa80
lea eax, [esi + 0x698]
mov dword [esi + 0x6d8], eax
mov dword [esi + 0x618], 0x67452301
mov dword [esi + 0x61c], 0xefcdab89
mov dword [esi + 0x620], 0x98badcfe
mov dword [esi + 0x624], 0x10325476
mov dword [esi + 0x628], 0xc3d2e1f0
mov dword [esi + 0x62c], ebx
mov dword [esi + 0x630], ebx
mov eax, dword [0x2209400]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x50]
test eax, eax
jne 0x5267f0
mov ecx, esi
call fcn.00526160
mov edx, dword [0x719a3c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x15], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x52fe60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x80]
test al, al
je 0x52feda
fld dword [esi + 0x60]
fcomp dword [0x6bb5fc]
fnstsw ax
test ah, 0x41
jnp 0x52feec
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + 0x74]
mov ecx, dword [esi + 0x7c]
sub eax, edx
cmp eax, ecx
jbe 0x52fe9f
fld dword [esp + 0xc]
fadd st(0), st(0)
fsubr dword [esi + 0x60]
fstp dword [esi + 0x60]
pop esi
ret 8
fld dword [esi + 0x60]
fcomp dword [0x6bc4dc]
fnstsw ax
test ah, 5
jp 0x52febf
fld dword [esp + 0xc]
fmul dword [0x6bca1c]
fadd dword [esi + 0x60]
fstp dword [esi + 0x60]
fld dword [esi + 0x60]
fcomp dword [0x6bc4dc]
fnstsw ax
test ah, 1
jne 0x52fef0
mov dword [esi + 0x60], 0x3f800000
pop esi
ret 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + 0x74]
mov ecx, dword [esi + 0x7c]
sub eax, edx
cmp eax, ecx
jbe 0x52fef0
mov byte [esi + 0x78], 1
pop esi
ret 8
Function at 0x531af0
Capabilities:
Get common file path

Disassembly:
mov ecx, 0x2207124
jmp 0x535ea0
sub esp, 0x108
push esi
push 0x105
lea eax, [esp + 8]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x535f41
push edi
lea edi, [esp + 8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x535ec7
mov ecx, dword [0x6c59d4]
mov edx, dword [0x6c59d8]
mov ax, word [0x6c59dc]
mov dword [edi], ecx
mov cl, byte [0x6c59de]
mov dword [edi + 4], edx
lea edx, [esp + 8]
mov word [edi + 8], ax
push edx
mov byte [edi + 0xa], cl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 4], eax
je 0x535f40
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmLockIMC
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
push str.ImmUnlockIMC
push eax
call edi
mov ecx, dword [esi + 4]
push str.ImmLockIMCC
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi + 4]
push str.ImmUnlockIMCC
push edx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0x14], eax
pop edi
pop esi
add esp, 0x108
ret
Function at 0x531b40
Capabilities:
Get file version info

Disassembly:
sub esp, 0x40c
push edi
mov edi, ecx
mov eax, dword [edi + 0x3614]
cmp eax, 0xe0080404
mov dword [edi + 0x362c], 0
mov dword [edi + 0x3628], 0
je 0x531b7c
cmp eax, 0xe0090404
je 0x531b7c
cmp eax, 0xe00e0804
jne 0x531d2a
push 0x3ff
lea ecx, [esp + 0x14]
push ecx
push eax
call sub.IMM32.dll_ImmGetIMEFileNameA
test eax, eax
je 0x531d2a
mov eax, dword [edi + 0x3638]
test eax, eax
push esi
jne 0x531c39
mov esi, dword [sym.imp.KERNEL32.dll_CompareStringA]
push 0xffffffffffffffff
push str.TINTLGNT.IME
push 0xffffffffffffffff
lea edx, [esp + 0x20]
push edx
push 1
push 0x409
call esi
cmp eax, 2
je 0x531c39
push 0xffffffffffffffff
push str.CINTLGNT.IME
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x531c39
push 0xffffffffffffffff
push str.MSTCIPHA.IME
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
push ecx
push 1
push 0x409
call esi
cmp eax, 2
je 0x531c39
push 0xffffffffffffffff
push str.PINTLGNT.IME
push 0xffffffffffffffff
lea edx, [esp + 0x20]
push edx
push 1
push 0x409
call esi
cmp eax, 2
je 0x531c39
push 0xffffffffffffffff
push str.MSSCIPYA.IME
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
push 1
push 0x409
call esi
cmp eax, 2
jne 0x531d29
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x531d29
push ebx
push esi
call fcn.005cfade
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x10]
push ebx
push esi
push eax
lea ecx, [esp + 0x24]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x531d28
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x6bb608
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x531d28
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 8]
xor ecx, ecx
mov ch, al
and eax, 0xffff0000
or ecx, eax
shl ecx, 8
mov eax, ecx
mov ecx, dword [edi + 0x3638]
test ecx, ecx
jne 0x531d10
mov cx, word [edi + 0x3618]
cmp cx, 0x404
jne 0x531cf4
cmp eax, 0x4020000
je 0x531d10
cmp eax, 0x4030000
je 0x531d10
cmp eax, 0x4040000
je 0x531d10
cmp eax, 0x5000000
je 0x531d10
cmp eax, 0x5010000
je 0x531d10
cmp eax, 0x5020000
je 0x531d10
cmp eax, 0x6000000
je 0x531d10
cmp cx, 0x804
jne 0x531d28
cmp eax, 0x4010000
je 0x531d10
cmp eax, 0x4020000
je 0x531d10
cmp eax, 0x5030000
jne 0x531d28
movzx ecx, word [edi + 0x3618]
or ecx, eax
mov dword [edi + 0x3628], ecx
mov edx, dword [edx + 0xc]
mov dword [edi + 0x362c], edx
pop ebx
pop esi
pop edi
add esp, 0x40c
ret
Function at 0x531e00
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 0x3614]
sub esp, 0x114
cmp eax, 0xe00e0804
je 0x531f31
cmp eax, 0xe0090404
je 0x531f31
mov eax, dword [ecx + 0x3628]
test eax, eax
je 0x531f31
mov ecx, eax
push ebx
and ecx, 0xffff
xor bl, bl
cmp ecx, 0x404
jne 0x531f3a
push ebp
push esi
push edi
mov ecx, 0xa
mov esi, str.softwaremicrosoftwindowscurrentversion_
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
and eax, 0xffff0000
movsw word es:[edi], word [esi]
mov ebp, eax
cmp ebp, 0x5010000
movsb byte es:[edi], byte [esi]
mov eax, str.MSTCIPH
jae 0x531e76
mov eax, str.TINTLGNT
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x531e78
lea edi, [esp + 0x20]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x531e86
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x10]
push edx
push 0x20019
mov ecx, eax
push 0
lea eax, [esp + 0x2c]
push eax
and ecx, 3
push Ordinal_3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x531f24
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.Keyboard_Mapping
push ecx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x531f19
cmp ebp, 0x5000000
mov al, byte [esp + 0x14]
ja 0x531eff
cmp al, 0x22
je 0x531f17
cmp al, 0x23
je 0x531f17
cmp ebp, 0x5010000
je 0x531f0f
cmp ebp, 0x5020000
jne 0x531f19
cmp al, 0x22
jb 0x531f19
cmp al, 0x24
ja 0x531f19
mov bl, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x114
ret
mov al, 1
add esp, 0x114
ret
mov al, bl
pop ebx
add esp, 0x114
ret