joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432fdc
Capabilities:
Copy file

Disassembly:
push 0x28
mov eax, 0x5a4679
call fcn.0043a209
mov ebx, dword [ebp + 8]
mov ecx, ebx
and dword [ebp - 4], 0
mov edi, dword [ebp + 0xc]
and dword [ebp - 0x2c], 0
push 0x5a6500
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
call fcn.00407220
and dword [ebp - 4], 0
mov esi, dword [edi + 0x10]
mov dword [ebp - 0x2c], 1
jmp 0x43304d
push 1
lea eax, [esi - 1]
mov ecx, edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00414130
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.00406e60
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0040c1a0
dec esi
test esi, esi
jg 0x433018
call fcn.0043d5f4
test al, al
je 0x433077
retf
call fcn.0043d708
test al, al
je 0x43309e
mov byte [esi - 0x486cde3], cl
lcall 0xf433, 0x2e337d72
cmp dword [ebp - 0x59], 0xffffffa6
jge 0x4330e2
cmp eax, eax
jmp 0x1f75fcc0
mov eax, dword [ebp - 0x30]
call fcn.0043a1c4
ret 8
stosw word es:[edi], ax
mov eax, 0x614
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x18], esi
or byte [ecx + 0x458de445], cl
fcom qword [eax - 0x77]
jne 0x4330d5
mov dword [ebp - 0x20], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4330a9
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 0xc]
push edi
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00403820
call fcn.00429e73
and dword [ebp - 0x24], 0
lea edi, [ebp - 0x20]
add esp, 0x18
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
Function at 0x433273
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x42c
mov eax, 0x5a46a9
call fcn.0043a209
mov edi, ecx
mov esi, 0x208
lea eax, [ebp - 0x420]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00446360
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00446360
add esp, 0x18
lea eax, [ebp - 0x438]
mov ecx, edi
push eax
call fcn.00433a0c
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push str.Dict
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
push 0x5a92fc
push eax
call fcn.00408fc0
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00454a23
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.004549f2
lea eax, [ebp - 0x218]
push 0x5a6c98
push eax
call fcn.004549f2
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
add esp, 0x28
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4331df
push 0
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004330a9
call fcn.004257a1
mov ecx, eax
call fcn.00434631
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00454a23
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.004549f2
lea eax, [ebp - 0x218]
push 0x5a6c98
push eax
call fcn.004549f2
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x433249
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004330a9
push 0
push 1
lea ecx, [ebp - 0x438]
call fcn.004253f2
call fcn.0043a1c4
ret
jmp 0x433102

Function at 0x433278
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.00446360
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00446360
add esp, 0x18
call fcn.004257a1
mov ecx, eax
call fcn.00434641
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00454a23
lea eax, [ebp - 0x414]
push str.WnWizard.exe
push eax
call fcn.004549f2
mov esi, 0x5a8550
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00454a23
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004549f2
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004549f2
lea eax, [ebp - 0x20c]
push str._RunAutoLoadDict
push eax
call fcn.004549f2
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x433347
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0042f725
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00439cb7
mov esp, ebp
pop ebp
ret
Function at 0x433424
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.00446360
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00446360
add esp, 0x18
call fcn.004257a1
mov ecx, eax
call fcn.00434641
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00454a23
lea eax, [ebp - 0x414]
push str.WnDictManager.exe
push eax
call fcn.004549f2
mov esi, 0x5a8550
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00454a23
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004549f2
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004549f2
lea eax, [ebp - 0x20c]
push str._CheckSysMb
push eax
call fcn.004549f2
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4334f3
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0042f725
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00439cb7
mov esp, ebp
pop ebp
ret
Function at 0x433503
Capabilities:
Check if file exists

Disassembly:
push 0x658
mov eax, 0x5a4748
call fcn.0043a209
push str.DoRunRegImeInterFace
call fcn.00425084
pop ecx
lea ecx, [ebp - 0x664]
call fcn.0042abc9
xor ebx, ebx
lea ecx, [ebp - 0x664]
mov dword [ebp - 4], ebx
call fcn.0042ac8f
mov dword [ebp - 0x630], ebx
push 7
pop esi
mov dword [ebp - 0x62c], esi
test eax, eax
je 0x433573
xor eax, eax
mov edi, str.WnRegIme64.exe
push edi
mov word [ebp - 0x640], ax
call fcn.004549d7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x640]
call fcn.004020c0
mov byte [ebp - 4], 1
jmp 0x433599
xor eax, eax
mov edi, str.WnRegIme32.exe
push edi
mov word [ebp - 0x640], ax
call fcn.004549d7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x640]
call fcn.004020c0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
call fcn.004257a1
mov ecx, eax
call fcn.00434641
push eax
lea eax, [ebp - 0x218]
push 0x5a916c
push eax
call fcn.00408fc0
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x640]
push ebx
push 1
call fcn.004253f2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4336cc
mov dword [ebp - 0x62c], esi
xor eax, eax
mov esi, str._InstallIME
mov dword [ebp - 0x630], ebx
push esi
mov word [ebp - 0x640], ax
call fcn.004549d7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x640]
call fcn.004020c0
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x640]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00408fc0
pop ecx
pop ecx
call fcn.0042a886
test eax, eax
lea eax, [ebp - 0x420]
je 0x43367f
push 0xffffffffffffffff
push ebx
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0042f164
lea eax, [ebp - 0x420]
push eax
push str.DoRunRegImeInterFace_Parameter__s
call fcn.00425084
add esp, 0x18
jmp 0x4336bc
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___s
push eax
call fcn.00408fc0
lea eax, [ebp - 0x628]
push eax
push str.DoRunRegImeInterFace_Cmd__s
call fcn.00425084
push ebx
push ebx
push ebx
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.0042f725
add esp, 0x2c
push ebx
push 1
lea ecx, [ebp - 0x640]
call fcn.004253f2
jmp 0x4336df
lea eax, [ebp - 0x218]
push eax
push str.PathFileExists_false_file___s
call fcn.00425084
pop ecx
pop ecx
lea ecx, [ebp - 0x664]
call fcn.0042abdc
call fcn.0043a1c4
ret
Function at 0x4336f0
Capabilities:
Check if file exists

Disassembly:
push 0x640
mov eax, 0x5a477b
call fcn.0043a209
mov esi, 0x208
lea eax, [ebp - 0x628]
push esi
xor edi, edi
push edi
push eax
call fcn.00446360
push esi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00446360
push esi
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00446360
add esp, 0x24
lea ecx, [ebp - 0x64c]
call fcn.0042abc9
lea ecx, [ebp - 0x64c]
mov dword [ebp - 4], edi
call fcn.0042ac8f
test eax, eax
je 0x433757
push str.WnRegIme64.exe
jmp 0x43375c
push str.WnRegIme32.exe
call fcn.004257a1
mov ecx, eax
call fcn.00434641
push eax
lea eax, [ebp - 0x218]
push 0x5a916c
push eax
call fcn.00408fc0
add esp, 0x10
lea eax, [ebp - 0x420]
push str._UnInstallIME
push eax
call fcn.00408fc0
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4337f1
call fcn.0042a886
test eax, eax
lea eax, [ebp - 0x420]
je 0x4337c5
push 0xffffffffffffffff
push edi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0042f164
add esp, 0x10
jmp 0x4337f1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___s
push eax
call fcn.00408fc0
push edi
push edi
push edi
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.0042f725
add esp, 0x24
lea ecx, [ebp - 0x64c]
call fcn.0042abdc
call fcn.0043a1c4
ret

Function at 0x433802
Capabilities:
Check if file exists
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00433273
mov ecx, esi
call fcn.00433424
mov ecx, esi
call fcn.0043341f
mov ecx, esi
call fcn.00433503
mov ecx, esi
pop esi
jmp 0x4338d9
push 0x23c
mov eax, 0x5a47ec
call fcn.0043a209
call fcn.004257a1
mov ecx, eax
call fcn.00434641
push eax
lea ecx, [ebp - 0x230]
call fcn.00403820
mov esi, str.WanNengWBInfo.ini
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.004549d7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.004053e0
mov esi, 0x5a6c98
push esi
call fcn.004549d7
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x230]
call fcn.00427735
cmp eax, 0xffffffff
je 0x4339f8
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00414170
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push edi
push eax
call fcn.00446360
add esp, 0xc
lea eax, [ebp - 0x218]
push edi
push 0x1c
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push str.VirtualStore_
push eax
call fcn.004549f2
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004549f2
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4339ea
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x218]
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
push eax
call fcn.00425c4f
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x248]
call fcn.004253f2
push edi
push 1
lea ecx, [ebp - 0x230]
call fcn.004253f2
call fcn.0043a1c4
ret
Function at 0x433ff6
Capabilities:
Read .ini file

Disassembly:
push 0x26c
mov eax, 0x5a492c
call fcn.0043a209
mov esi, ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test ebx, ebx
jne 0x434018
xor al, al
jmp 0x43419f
lea eax, [ebp - 0x260]
push eax
call fcn.0043420f
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.00446360
add esp, 0xc
lea eax, [ebp - 0x248]
mov ecx, esi
push ebx
push eax
call fcn.0043449d
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x260]
mov ebx, 0x5a6864
cmp dword [ebp - 0x234], 8
push eax
cmovae ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x218]
push 0x104
push eax
push ebx
push ecx
push 0x5ab60c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00454bdb
pop ecx
pop ecx
test eax, eax
jne 0x43413f
and dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x230]
push ecx
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x248]
mov ecx, esi
push eax
push 0x5ab60c
call fcn.004254ca
test al, al
jne 0x434109
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.004253f2
xor bl, bl
jmp 0x43417f
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00454a23
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.004253f2
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0043435c
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 3
cmp edi, eax
je 0x43416e
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.00401fa0
push 0
push 1
lea ecx, [ebp - 0x278]
mov bl, 1
call fcn.004253f2
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.004253f2
push 0
push 1
lea ecx, [ebp - 0x260]
call fcn.004253f2
mov al, bl
call fcn.0043a1c4
ret 8

Function at 0x4341a7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.00433f8c
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.UserID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4341ed
mov dword [esi], eax
mov bl, 1
jmp 0x4341ef
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004253f2
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret 4
Function at 0x43428f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00433f8c
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.UserID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
lea ecx, [ebp - 0x1c]
push 0
push 1
setg bl
call fcn.004253f2
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret

Function at 0x437867
Capabilities:
Check if file exists

Disassembly:
push 0x20
mov eax, 0x5a4e6b
call fcn.0043a209
mov esi, ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00437ad8
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4378bd
mov ecx, esi
call fcn.00437baf
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00403820
call fcn.00429e73
add esp, 0x18
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004253f2
call fcn.0043a1c4
ret
Function at 0x4378cf
Capabilities:
Check if file exists

Disassembly:
push 0xc54
mov eax, 0x5a4ea6
call fcn.0043a209
mov esi, ecx
push str.CImeBrokerReg::DoRun
call fcn.00425084
pop ecx
call int.0042a9bb
test eax, eax
je 0x437ad2
push 0x104
lea eax, [ebp - 0x830]
mov ecx, esi
push eax
call fcn.00437b48
push 0x5a6d2c
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x218]
push str._sIME_s_
push eax
call fcn.00408fc0
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x437949
lea eax, [ebp - 0x218]
push eax
call fcn.00429262
pop ecx
lea eax, [ebp - 0xc58]
push 0
push eax
call fcn.00429527
and dword [ebp - 4], 0
lea eax, [ebp - 0xc58]
cmp dword [ebp - 0xc44], 8
mov esi, str.WnImeBroker.exe
push esi
cmovae eax, dword [ebp - 0xc58]
mov edi, 0x5a916c
push eax
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.00408fc0
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00408fc0
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.00425c4f
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc40]
push str.__s___RegServer
push eax
call fcn.00408fc0
lea eax, [ebp - 0xc40]
push eax
call fcn.0042fdf1
add esp, 0x40
lea eax, [ebp - 0xc40]
push eax
push str.ImeBroker_cmd1___s
call fcn.00425084
cmp dword [ebp - 0xc44], 8
lea eax, [ebp - 0xc58]
mov esi, str.WnImeBrokerPS.dll
cmovae eax, dword [ebp - 0xc58]
push esi
push eax
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.00408fc0
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00408fc0
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.00425c4f
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0xc40]
push str.__s_regsvr32___s___s_
push eax
call fcn.00408fc0
add esp, 0x40
lea eax, [ebp - 0xc40]
push eax
call fcn.0042fdf1
lea eax, [ebp - 0xc40]
push eax
push str.ImeBroker_cmd2___s
call fcn.00425084
add esp, 0xc
lea ecx, [ebp - 0xc5c]
call fcn.00439296
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x218]
mov ecx, esp
push eax
call fcn.00403820
lea ecx, [ebp - 0xc5c]
call fcn.00439754
lea eax, [ebp - 0x218]
push eax
push str.AddInstallEveryonePower_path___s
call fcn.00425084
pop ecx
pop ecx
lea ecx, [ebp - 0xc5c]
call fcn.004392b1
push 0
push 1
lea ecx, [ebp - 0xc58]
call fcn.004253f2
call fcn.0043a1c4
ret
Function at 0x437baf
Capabilities:
Check if file exists

Disassembly:
push 0x83c
mov eax, 0x5a232b
call fcn.0043a209
mov esi, ecx
lea eax, [ebp - 0x848]
push eax
call fcn.00437ad8
and dword [ebp - 4], 0
lea eax, [ebp - 0x848]
cmp dword [ebp - 0x834], 8
cmovae eax, dword [ebp - 0x848]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x437cd0
push 0x104
lea eax, [ebp - 0x830]
mov ecx, esi
push eax
call fcn.00437b48
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
push str.WnImeBroker.exe
cmovae eax, dword [ebp - 0x848]
mov esi, 0x5a916c
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00408fc0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___Unregister
push eax
call fcn.00408fc0
lea eax, [ebp - 0x628]
push eax
call fcn.0042fdf1
lea eax, [ebp - 0x628]
push eax
push str.ImeBroker_cmd1___s
call fcn.0043e7a1
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
push str.WnImeBrokerPS.dll
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00408fc0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x628]
push str.__s_regsvr32___u__s___s_
push eax
call fcn.00408fc0
add esp, 0x48
lea eax, [ebp - 0x628]
push eax
call fcn.0042fdf1
lea eax, [ebp - 0x628]
push eax
push str.ImeBroker_cmd2___s
call fcn.00425084
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x848]
call fcn.004253f2
call fcn.0043a1c4
ret

Function at 0x437ce5
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x5a4ef9
call fcn.0043a209
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x437d89
test esi, esi
je 0x437d89
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x437d89
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x437d89
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00403820
lea eax, [ebp - 0x40]
push eax
call fcn.00426863
add esp, 4
xor edi, edi
mov ecx, esp
mov dword [ebp - 4], edi
push esi
call fcn.00403820
lea eax, [ebp - 0x28]
push eax
call fcn.00426863
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.0045276e
add esp, 0x24
lea ecx, [ebp - 0x28]
neg eax
sbb esi, esi
push edi
push 1
call fcn.004253f2
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.004253f2
lea eax, [esi + 1]
jmp 0x437d8b
xor eax, eax
call fcn.0043a1c4
ret 8
Function at 0x437d93
Capabilities:
Check if file exists

Disassembly:
push 0x634
mov eax, 0x5a4f29
call fcn.0043a209
mov esi, ecx
call fcn.004257a1
mov ecx, eax
call fcn.00434641
mov ebx, eax
call fcn.004257a1
mov ecx, eax
call fcn.00434621
push 0x208
mov edi, eax
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00446360
push edi
lea eax, [ebp - 0x628]
push str._sEUDC_
push eax
call fcn.00408fc0
add esp, 0x18
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x437e00
xor eax, eax
jmp 0x437f04
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00446360
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00446360
push edi
lea eax, [ebp - 0x218]
push str._sEUDCEUDC.EUF
push eax
call fcn.00408fc0
push ebx
lea eax, [ebp - 0x420]
push str._sEUDCEUDC.EUF
push eax
call fcn.00408fc0
add esp, 0x30
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00437ce5
test eax, eax
je 0x437df9
push edi
mov edi, str._sEUDCEUDC.TTE
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00408fc0
push ebx
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00408fc0
add esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00437ce5
test eax, eax
je 0x437df9
xor ebx, ebx
mov dword [ebp - 0x62c], 7
xor eax, eax
mov dword [ebp - 0x630], ebx
mov word [ebp - 0x640], ax
lea eax, [ebp - 0x640]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.00438257
test eax, eax
je 0x437ef2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x640]
call fcn.00425671
test eax, eax
jne 0x437ef2
xor esi, esi
inc esi
jmp 0x437ef4
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x640]
call fcn.004253f2
mov eax, esi
call fcn.0043a1c4
ret

Function at 0x43806e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push esi
push eax
push 0xf003f
push 0
push str.EUDC936
push reloc.WS2_32.dll_accept
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4380d9
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.004381ec
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004253f2
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00439cb7
mov esp, ebp
pop ebp
ret