joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d0e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52c6b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
lea esi, [esp + 0x1c]
call fcn.004013f0
push eax
lea eax, [esp + 0x1c]
push eax
mov ebx, str.GoogleGoogle_Pinyin
mov dword [esp + 0x38], 0
call fcn.004036c0
add esp, 8
lea edi, [ebp + 0x14]
mov byte [esp + 0x30], 1
call fcn.00401dd0
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or esi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d163
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x30], esi
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d186
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push edi
push ecx
mov ebx, str.userdict.lib
call fcn.004036c0
add esp, 8
lea edi, [ebp + 0x18]
mov dword [esp + 0x30], 2
call fcn.00401dd0
mov dword [esp + 0x30], esi
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41d1cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
xor ebx, ebx
push ebx
push eax
call fcn.00501abc
add esp, 8
cmp eax, esi
jne 0x41d1e5
mov eax, esi
jmp 0x41d292
mov edi, dword [edi]
push 0x53709c
push edi
call fcn.00501b96
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x41d203
or eax, 0xffffffff
jmp 0x41d292
push ebx
push 8
push esi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], ebx
call fcn.005015da
push esi
push 4
lea ecx, [esp + 0x4c]
push 1
push ecx
call fcn.005018fb
add esp, 0x1c
cmp dword [esp + 0x38], ebx
jne 0x41d234
xor eax, eax
jmp 0x41d292
push ebx
push 0xc
push esi
call fcn.005015da
push esi
push 4
lea edx, [esp + 0x38]
push 1
push edx
call fcn.005018fb
push ebx
push 0x14
push esi
call fcn.005015da
push esi
push 4
lea eax, [esp + 0x44]
push 1
push eax
call fcn.005018fb
add esp, 0x38
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, 0x535ef0
call fcn.00402550
mov edx, dword [esp + 0x1c]
push edx
mov ecx, ebp
call fcn.0041c490
push esi
call fcn.00501c1b
mov eax, dword [ebp + 8]
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x41da80
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [eax]
sub esp, 8
lea ecx, [esp]
push ecx
push eax
push 0x80000001
call dword [0x531018]
test eax, eax
je 0x41daab
mov dword [edi], 0
mov dword [esi], 0
xor eax, eax
add esp, 8
ret
mov eax, dword [esp]
push ebx
mov ebx, dword [0x531040]
lea edx, [esp + 8]
push edx
push esi
push 0
push 0
push 0x5422c0
push eax
mov dword [esp + 0x20], 4
call ebx
test eax, eax
jne 0x41daf3
lea edx, [esp + 8]
push edx
push edi
push eax
push eax
mov eax, dword [esp + 0x14]
push str.Virtual_Key
push eax
mov dword [esp + 0x20], 4
call ebx
test eax, eax
je 0x41db11
mov ecx, dword [esp + 4]
mov dword [edi], 0
push ecx
mov dword [esi], 0
call dword [0x531004]
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x41db20
push eax
call dword [0x531004]
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x41db80
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [eax]
push esi
mov esi, ecx
lea ecx, [esp + 4]
push ecx
push eax
push 0x80000001
call dword [0x53101c]
test eax, eax
je 0x41dbac
mov dword [edi], 0
mov dword [esi], 0
xor eax, eax
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push 4
push esi
mov esi, dword [0x531010]
push 3
push 0
push 0x5422c0
push edx
call esi
test eax, eax
je 0x41dbd9
mov eax, dword [esp + 4]
push eax
call dword [0x531004]
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esp + 4]
push 4
push edi
push 3
push 0
push str.Virtual_Key
push ecx
call esi
test eax, eax
je 0x41dc00
mov edx, dword [esp + 4]
push edx
call dword [0x531004]
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esp + 4]
push 4
lea eax, [esp + 0x10]
push eax
push 3
push 0
push str.Target_IME
push ecx
call esi
test eax, eax
jne 0x41dbf0
mov eax, dword [esp + 4]
test eax, eax
je 0x41dc2a
push eax
call dword [0x531004]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x41e670
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x52c630
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str.QQPinyin.ime
call fcn.00402550
call fcn.0041dc40
mov esi, eax
or edi, 0xffffffff
add esp, 4
cmp esi, edi
je 0x41e6f2
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.0041df30
add esp, 8
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], ecx
jne 0x41e706
add eax, 0xfffffff0
mov dword [esp + 0x24], edi
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x41e6f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
push 0x417
push ecx
call dword [0x5313fc]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
call fcn.0041db30
add esp, 4
test eax, eax
jne 0x41e768
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x41e6f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
push esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
lea edi, [esp + 0x18]
call fcn.0041db80
add esp, 4
test eax, eax
jne 0x41e79e
lea ecx, [esp + 0xc]
call fcn.00402660
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
mov dword [edx], ecx
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov edx, dword [0x5759e8]
mov eax, dword [edx + 0xc]
mov ecx, 0x5759e8
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push esi
push str._08x
lea edi, [esp + 0x20]
mov byte [esp + 0x2c], 1
call fcn.00401f20
mov ecx, dword [esp + 0x20]
add esp, 8
push 0x10
push ecx
call dword [0x5314d4]
mov ecx, edi
call fcn.00402660
lea ecx, [esp + 0xc]
call fcn.00402660
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x41e820
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x528b08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push eax
mov ecx, str.QQPinyin.ime
call fcn.00402550
call fcn.0041dc40
add esp, 4
cmp eax, 0xffffffff
je 0x41e8aa
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0041df30
add esp, 8
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ecx
jne 0x41e8bf
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e8aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
lea eax, [esp + 0x14]
lea esi, [esp + 0x1c]
lea edi, [esp + 0x18]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
call fcn.0041da80
test eax, eax
je 0x41e8f1
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x41e8f1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41e8f1
mov dword [ebx], eax
mov dword [ebp], ecx
mov ecx, dword [esp + 0x14]
push ecx
push 0x80000001
call dword [0x531014]
mov edx, dword [esp + 0x30]
mov edi, dword [ebx]
mov esi, dword [ebp]
push 0x417
push edx
call dword [0x5313fc]
and edi, 0xffff3fff
push 0
mov eax, edi
call fcn.0041eb00
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e950
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x41f680
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x52db64
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 8], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi], vtable.CImeOptionToolDlg.0
mov dword [esi + 4], vtable.CImeOptionToolDlg.1.0
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], vtable.CHotKeyBox.0
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov byte [esp + 0x14], 3
call fcn.00426ce0
mov dword [esi + 0x54], eax
mov byte [eax + 0x61], 1
mov eax, dword [esi + 0x54]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x54]
mov dword [eax], eax
mov eax, dword [esi + 0x54]
mov dword [eax + 8], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x5c], 0x100000
push 0xffffff
mov dword [esi + 0x2c], edi
call dword [0x5310a4]
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x41fce0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
cmp eax, 0x416
push ebx
push ebp
push esi
push edi
ja 0x41fd84
je 0x41fcfc
sub eax, 1
jmp 0x41fe2b
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 8]
mov edi, dword [0x5313fc]
push 0x416
push eax
call edi
push 0
push 0
push 0xf0
push eax
call dword [0x531444]
test eax, eax
je 0x41fd55
mov dword [0x576ffc], 1
mov ecx, dword [esi + 0x38]
push 1
push ecx
call dword [0x5314c0]
mov esi, dword [0x577004]
mov eax, dword [0x577000]
push 1
call fcn.0041eb00
add esp, 4
jmp 0x41fe2b
mov dword [0x576ffc], 0
mov edx, dword [esi + 0x38]
push 0
push edx
call dword [0x5314c0]
mov eax, dword [esi + 8]
push 0x419
push eax
call edi
push 0
push eax
call dword [0x53143c]
jmp 0x41fe2b
cmp eax, 0x429
jne 0x41fe2b
mov ebp, dword [esp + 0x20]
mov ecx, dword [ebp + 0x3c]
push 0
push 0
push 0xf0
push ecx
call dword [0x531444]
test eax, eax
jne 0x41fe2b
mov edx, dword [ebp + 0x54]
mov ebx, dword [edx]
add ebp, 0x50
mov esi, ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
test esi, esi
mov edi, dword [ebp + 4]
je 0x41fdcb
cmp esi, ebp
je 0x41fdd0
call fcn.00500ad0
cmp ebx, edi
je 0x41fe22
test esi, esi
jne 0x41fddd
call fcn.00500ad0
cmp ebx, dword [esi + 4]
jne 0x41fde7
call fcn.00500ad0
cmp ebx, dword [esi + 4]
lea edi, [ebx + 0xc]
jne 0x41fdf4
call fcn.00500ad0
lea eax, [edi + 4]
push eax
push ecx
push 0x576724
mov ecx, edi
call fcn.00425910
add esp, 4
mov ebx, eax
call fcn.0041f040
lea esi, [esp + 0x10]
call fcn.00426dc0
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
jmp 0x41fdc0
mov ecx, dword [esp + 0x20]
call fcn.00422a60
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x420900
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x529d5b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x56b1dc]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov eax, dword [0x5759e8]
mov edx, dword [eax + 0xc]
mov ebp, dword [esp + 0x240]
mov esi, ecx
mov ecx, 0x5759e8
xor ebx, ebx
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x238], ebx
mov eax, dword [esi]
push eax
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts_08x_
lea edi, [esp + 0x1c]
call fcn.00401f20
mov esi, dword [esp + 0x1c]
add esp, 8
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push esi
push 0x80000002
call dword [section..rdata]
test eax, eax
jne 0x4209f3
push 0x206
lea edx, [esp + 0x2a]
push ebx
push edx
mov word [esp + 0x30], bx
call fcn.00508d80
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push str.Layout_Text
push eax
mov dword [esp + 0x34], 0x208
call dword [0x531040]
test eax, eax
jne 0x4209e8
lea edx, [esp + 0x24]
mov edi, ebp
lea ebx, [eax + 1]
call fcn.00402760
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x531004]
lea eax, [esi - 0x10]
mov dword [esp + 0x238], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420a1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004ff939
add esp, 0x228
ret 4
Function at 0x422e50
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5267f8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
sub eax, 0x10
call fcn.004020b0
add eax, 0x10
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x14], 0
call fcn.0040d1b0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi - 0xc]
test eax, eax
jl 0x422ef5
push str.imsc12.ime
push esi
call fcn.0050016e
add esp, 8
test eax, eax
je 0x422ef5
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x422ef5
lea ecx, [esp + 0x1c]
push ecx
push str.SoftwareMicrosoftCTFTIP157E7179_6C00_44A9_808F_1E9B5F83A226LanguageProfile0x00000804F3BA9077_6C7E_11D4_97FA_0080C882687E_
push 0x80000001
call dword [0x531018]
mov eax, dword [esp + 0x1c]
push 4
lea edx, [esp + 0x24]
push edx
push 4
push 0
push str.Enable
push eax
call dword [0x531010]
mov ecx, dword [esp + 0x1c]
push ecx
jmp 0x422f6c
cmp dword [esi - 0xc], 0
jl 0x422f72
push str.pintlgnt.ime
push esi
call fcn.0050016e
add esp, 8
test eax, eax
je 0x422f16
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x422f37
cmp dword [esi - 0xc], 0
jl 0x422f72
push str.imsc40a.ime
push esi
call fcn.0050016e
add esp, 8
test eax, eax
je 0x422f72
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x422f72
lea edx, [esp + 0x1c]
push edx
push str.SoftwareMicrosoftCTFTIPF3BA9074_6C7E_11D4_97FA_0080C882687ELanguageProfile0x00000804F3BA9077_6C7E_11D4_97FA_0080C882687E_
push 0x80000001
call dword [0x531018]
mov ecx, dword [esp + 0x1c]
push 4
lea eax, [esp + 0x24]
push eax
push 4
push 0
push str.Enable
push ecx
call dword [0x531010]
mov edx, dword [esp + 0x1c]
push edx
call dword [0x531004]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422f96
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x4272d0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0xc
push esi
push edi
xor edi, edi
call fcn.0045cc30
test eax, eax
jne 0x42737a
call fcn.0045ccd0
test eax, eax
jne 0x42737a
push 2
lea eax, [esp + 0x10]
push eax
push edi
push 0x59
mov dword [esp + 0x1c], 0xffffffff
call dword [0x5313c8]
test eax, eax
je 0x42733b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ecx
mov ecx, str.qqpinyin.ime
call fcn.00402550
lea esi, [ebx + 4]
push esi
call fcn.004296b0
mov eax, dword [esp + 0xc]
cmp eax, dword [esi]
jne 0x42733f
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x427360
cmp eax, 0x804
je 0x427360
cmp eax, 0x8040804
je 0x427360
cmp eax, 0x404
je 0x427360
cmp eax, 0x4040404
jne 0x427330
push ebx
call fcn.004283a0
push 0
push 0
mov edi, eax
call dword [0x5314c8]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
push ecx
mov edx, esp
mov dword [esp + 0x14], esp
push edx
mov ecx, str.qqpinyin.ime
call fcn.00402550
lea esi, [ebx + 4]
push esi
call fcn.004296b0
test eax, eax
je 0x4273a3
mov eax, dword [esi]
push eax
call fcn.004273c0
mov edi, eax
push 0
push 0
call dword [0x5314c8]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x42c905
Capabilities:
Hide graphical window

Disassembly:
cmp eax, 0x405
push esi
mov esi, ecx
je 0x42c983
cmp eax, 0x205
je 0x42c983
cmp eax, 0x202
je 0x42c983
cmp eax, 0x203
je 0x42c983
cmp eax, 0x404
jne 0x42c943
mov edx, dword [esp + 8]
mov dword [esi + 0x848], 0
mov dword [edx], 1
mov eax, 1
pop esi
ret 4
cmp eax, 0x200
jne 0x42c9dd
cmp dword [esi + 0x848], 0
jne 0x42c9dd
mov dword [esi + 0x848], 1
add esi, 0x48c
call fcn.00430520
mov edx, dword [esp + 8]
mov dword [edx], 1
mov eax, 1
pop esi
ret 4
mov dword [0x572e94], 1
call fcn.0042c150
mov eax, dword [esi + 4]
push 1
push eax
call dword [0x53143c]
mov ecx, dword [esi + 4]
push ecx
call dword [0x53148c]
add esi, 0x48c
cmp dword [esi + 4], 0
je 0x42c9dd
push esi
push 2
call dword [0x5313b8]
push 0x3b8
push 0
push esi
call fcn.00508d80
add esp, 0xc
mov dword [esi], 0x3b8
mov dword [esi + 0x3b8], 0
mov edx, dword [esp + 8]
mov dword [edx], 1
mov eax, 1
pop esi
ret 4
Function at 0x42ced0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x484]
sub esp, 8
push ebx
push ebp
push edi
push 1
push eax
call dword [0x5314c0]
mov edi, dword [esi + 0x860]
test edi, edi
mov ebx, dword [esi + 0x864]
jne 0x42cefa
call fcn.00500ad0
mov ebx, dword [ebx + 4]
cmp ebx, dword [edi + 4]
mov dword [esp + 0x10], ebx
jne 0x42cf0b
call fcn.00500ad0
mov eax, dword [esi + 0x858]
mov ebp, dword [eax + 4]
cmp ebp, eax
lea ebx, [esi + 0x854]
jne 0x42cf23
call fcn.00500ad0
cmp edi, ebx
je 0x42cf2c
call fcn.00500ad0
cmp dword [esp + 0x10], ebp
je 0x42cf44
mov ecx, dword [esi + 0x480]
push 0x5431a4
push ecx
call dword [0x53142c]
cmp dword [esi + 0x860], 0
jne 0x42cf52
call fcn.00500ad0
mov edx, dword [esi + 0x860]
mov eax, dword [esi + 0x864]
cmp eax, dword [edx + 4]
jne 0x42cf68
call fcn.00500ad0
mov ecx, dword [esi + 0x864]
mov edx, dword [ecx + 8]
mov eax, dword [edx]
mov ebp, dword [0x53143c]
push 0
push eax
call ebp
test edi, edi
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x860], edi
mov dword [esi + 0x864], ecx
jne 0x42cf97
call fcn.00500ad0
mov edx, dword [esi + 0x860]
mov eax, dword [esi + 0x864]
cmp eax, dword [edx + 4]
jne 0x42cfad
call fcn.00500ad0
mov ecx, dword [esi + 0x864]
mov edx, dword [ecx + 8]
mov eax, dword [edx]
push 1
push eax
call ebp
cmp edi, ebx
mov ecx, dword [ebx + 4]
mov ebp, dword [ecx]
je 0x42cfcb
call fcn.00500ad0
cmp dword [esp + 0x10], ebp
mov ebx, dword [0x5314c0]
jne 0x42cfef
mov edx, dword [esi + 0x484]
push 0
push edx
call ebx
mov eax, dword [esi + 0x480]
push eax
call dword [0x5313cc]
lea ecx, [esi + 0x1d4]
test ecx, ecx
je 0x42d001
lea edi, [esi + 0x1dc]
jmp 0x42d003
xor edi, edi
cmp dword [esi + 0x860], 0
jne 0x42d011
call fcn.00500ad0
mov edx, dword [esi + 0x860]
mov eax, dword [esi + 0x864]
cmp eax, dword [edx + 4]
jne 0x42d027
call fcn.00500ad0
mov ecx, dword [esi + 0x864]
cmp dword [ecx + 8], edi
mov edx, dword [esi + 4]
jne 0x42d06d
push 0
push 0x64
push 0x64
push edx
call dword [0x5314a4]
mov eax, dword [esi + 0x210]
push 0
push 0
push 0xf0
push eax
call dword [0x531444]
test eax, eax
jne 0x42d081
mov ecx, dword [esi + 0x480]
push eax
push ecx
call ebx
pop edi
pop ebp
pop ebx
add esp, 8
ret
push 0x64
push edx
call dword [0x5314b0]
mov eax, dword [esi + 0x480]
push 1
push eax
call ebx
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x42e920
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52c2ce
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi], vtable.COptionDlg.0
mov dword [esi + 4], vtable.COptionDlg.1.0
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], 0xa
mov dword [esi + 0x70], eax
push 0xffffff
mov byte [esp + 0x18], 2
call dword [0x5310a4]
mov dword [esi + 0x74], eax
call fcn.004683e0
mov dword [esi + 0x48], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x430e60
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x52c23a
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [edi + 8], esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], esi
mov byte [esp + 0x1c], 1
mov dword [edi], vtable.CSkinChoose.0
mov dword [edi + 4], vtable.CSkinChoose.1.0
mov dword [edi + 0x24], esi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], esi
mov dword [edi + 0x30], esi
mov eax, dword [0x5759e8]
mov edx, dword [eax + 0xc]
mov ecx, 0x5759e8
call edx
add eax, 0x10
mov dword [edi + 0x34], eax
mov byte [esp + 0x1c], 2
mov eax, dword [0x5759e8]
mov edx, dword [eax + 0xc]
mov ecx, 0x5759e8
lea ebp, [edi + 0x38]
call edx
add eax, 0x10
mov dword [ebp], eax
mov byte [esp + 0x1c], 3
mov eax, dword [0x5759e8]
mov edx, dword [eax + 0xc]
mov ecx, 0x5759e8
call edx
add eax, 0x10
mov dword [edi + 0x3c], eax
mov dword [edi + 0x44], esi
mov dword [edi + 0x48], esi
mov dword [edi + 0x4c], esi
mov dword [edi + 0x64], esi
mov dword [edi + 0x68], esi
mov dword [edi + 0x6c], esi
lea esi, [edi + 0x70]
call fcn.004037a0
mov dword [esi], vtable.WTL::CHyperLink.0
push 0x535ef0
xor ebx, ebx
mov eax, ebp
mov byte [esp + 0x20], 6
call fcn.004026c0
push 0xffffff
call dword [0x5310a4]
mov dword [edi + 0x24], eax
call fcn.004683e0
mov dword [edi + 0x2c], eax
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4