Function at 0x424540
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52cf5c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c6150]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [0x5c6ad0]
mov dword [edx], eax
mov dword [ebp - 4], 0
mov eax, dword [0x5c6ad0]
mov dword [edx + 4], eax
mov eax, dword [0x5c6ad0]
mov dword [edx + 8], eax
mov eax, dword [0x5c6ad0]
mov dword [edx + 0xc], eax
mov eax, dword [0x5c6ad0]
lea ebx, [edx + 0x10]
mov dword [ebx], eax
mov eax, dword [0x5c6ad0]
mov dword [edx + 0x14], eax
mov eax, dword [0x5c6ad0]
mov dword [edx + 0x18], eax
mov eax, dword [0x5c6ad0]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [edx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [edx + 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [edx + 0x30], eax
mov eax, dword [0x5c6ad0]
mov dword [edx + 0x34], eax
mov eax, dword [0x5c6ad0]
mov dword [edx + 0x38], eax
mov eax, dword [0x5c6ad0]
mov dword [edx + 0x3c], eax
mov eax, dword [0x5c6ad0]
mov dword [edx + 0x40], eax
mov eax, dword [0x5c6ad0]
mov dword [edx + 0x44], eax
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 0xc
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x42460e
xor edi, edi
jmp 0x424613
push eax
call esi
mov edi, eax
push edi
mov ecx, ebx
call fcn.00413c20
test eax, eax
je 0x424643
lea esi, [edi + edi]
push esi
push dword [ebp + 0x10]
push dword [ebx]
call fcn.004d9a60
mov eax, dword [ebx]
add esp, 0xc
xor ecx, ecx
mov dword [eax - 8], edi
mov eax, dword [ebx]
mov word [esi + eax], cx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x42464e
xor edi, edi
jmp 0x424653
push ebx
call esi
mov edi, eax
mov esi, dword [ebp - 0x10]
push edi
lea ecx, [esi + 0x14]
call fcn.00413c20
test eax, eax
je 0x424687
lea esi, [edi + edi]
push esi
push ebx
mov ebx, dword [ebp - 0x10]
push dword [ebx + 0x14]
call fcn.004d9a60
mov eax, dword [ebx + 0x14]
add esp, 0xc
xor ecx, ecx
mov dword [eax - 8], edi
mov eax, dword [ebx + 0x14]
mov word [esi + eax], cx
mov esi, ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x424692
xor edi, edi
jmp 0x42469b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
lea ecx, [esi + 0x18]
call fcn.00413c20
test eax, eax
je 0x4246cc
lea esi, [edi + edi]
push esi
push ebx
mov ebx, dword [ebp - 0x10]
push dword [ebx + 0x18]
call fcn.004d9a60
mov eax, dword [ebx + 0x18]
add esp, 0xc
xor ecx, ecx
mov dword [eax - 8], edi
mov eax, dword [ebx + 0x18]
mov word [esi + eax], cx
mov esi, ebx
push str.SogouPinyin.exe
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea ebx, [esi + 0x1c]
push edi
mov ecx, ebx
call fcn.00413c20
test eax, eax
je 0x42471f
lea esi, [edi + edi]
push esi
push str.SogouPinyin.exe
push dword [ebx]
call fcn.004d9a60
mov eax, dword [ebx]
add esp, 0xc
xor ecx, ecx
mov dword [eax - 8], edi
mov eax, dword [ebx]
mov word [esi + eax], cx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20