joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x805c34
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805c3a
pop ebp
sub ebp, 6
sub ebp, 0x405c34
jmp 0x805c98
jmp 0x805ca1
mov eax, 0x405c34
add eax, ebp
add eax, 0x93
mov ecx, 0x610
mov edx, 0x19746963
xor byte [eax], dl
inc eax
dec ecx
jne 0x805cb8
jmp 0x805ccb
or dword [ebx], esp
or esp, dword [ebx + 0x73]
arpl word [ebx + 0xb], sp
arpl word [edi - 0x5caf9cb1], bp
xor ebx, dword [esi + esi*8 + 0x6355b263]
xor ebp, eax
scasb al, byte es:[edi]
call 0x63e3bcd2
arpl dx, sp
mov byte [0x6363639b], al
pushal
scasb al, byte es:[edi]
invalid
Function at 0x401650
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x43a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], 0xffffffff
mov eax, 1
test eax, eax
je 0x401753
lea ecx, [ebp - 0x14]
push ecx
call fcn.0041aaa0
add esp, 4
lea edx, [ebp - 0x14]
push edx
push 0
push 0x800
push 0x800
push 0xff
push 6
push 3
push 0x431450
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041ab60
add esp, 4
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4016c3
xor eax, eax
jmp 0x401758
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x4016dc
mov dword [ebp - 0x20], 1
jmp 0x4016ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x4016f2
mov dword [ebp - 0x1c], 1
jmp 0x4016f9
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x401744
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
push 0x401790
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x401738
xor eax, eax
jmp 0x401758
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40174e
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40166a
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d2df
mov esp, ebp
pop ebp
ret
Function at 0x4090f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c8], 0
jne 0x40910a
jmp 0x409267
movzx ecx, word [ebp + 0xc]
cmp ecx, 0x2d
je 0x409125
movzx edx, word [ebp + 0xc]
cmp edx, 0x5b
je 0x409125
cmp dword [ebp + 8], 0x88
jne 0x40912c
mov dword [ebp + 8], 0x21
movzx eax, word [ebp + 0xc]
cmp eax, 0x3d
je 0x409147
movzx ecx, word [ebp + 0xc]
cmp ecx, 0x5d
je 0x409147
cmp dword [ebp + 8], 0x89
jne 0x40914e
mov dword [ebp + 8], 0x22
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, 9
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f
ja case.0x409171.1
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x409280]
jmp dword [edx*4 + 0x409270]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00408df0
jmp 0x409221
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10a]
and edx, 0x40000
mov eax, dword [ecx + 0x10e]
and eax, 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0x40000
jne 0x4091e5
cmp dword [ebp - 0xc], 0
jne 0x4091e5
mov dword [ebp + 8], 0x22
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
je 0x4091d7
mov dword [ebp + 8], 0x21
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00408f70
jmp 0x40920f
mov dword [ebp + 8], 0x28
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x409203
mov dword [ebp + 8], 0x26
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00408df0
jmp 0x409221
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00408f70
jmp 0x409221
jmp 0x409267
mov eax, dword [ebp - 4]
mov dword [eax + 0xc8], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10a]
and edx, 0
mov eax, dword [ecx + 0x10e]
and eax, 0x40000
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 0
jne 0x409267
cmp dword [ebp - 0x14], 0x40000
jne 0x409267
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc8], 2
mov esp, ebp
pop ebp
ret 8

Function at 0x40c870
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x40c8a0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x40c8c0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x40c906
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xffffffff
mov ecx, dword [ebp - 4]
add ecx, 0x598
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c906
mov edx, dword [ebp - 4]
add edx, 0x598
push edx
call fcn.00419200
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x40cb30
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x598
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.Iime_stc.map
mov ecx, dword [ebp - 4]
add ecx, 0x598
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 4]
add edx, 0x598
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40cb85
mov eax, dword [ebp - 4]
add eax, 0x598
push eax
call fcn.00419200
add esp, 4
push 0
push 2
push 2
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp - 4]
add ecx, 0x598
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x40cbba
xor eax, eax
jmp 0x40cc83
push str.Iime_STTrie_Codetable
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x574]
push edx
push 0
push 4
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x40cc06
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xffffffff
xor eax, eax
jmp 0x40cc83
push 0
push 0
push 0
push 0xf001f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x40cc5f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0xffffffff
xor eax, eax
jmp 0x40cc83
mov ecx, dword [ebp - 4]
add ecx, 0x580
call fcn.004028a0
push eax
mov ecx, dword [ebp - 4]
call fcn.0040cca0
test eax, eax
jne 0x40cc7e
xor eax, eax
jmp 0x40cc83
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40ebc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x40ebee
push 0x8000
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
je 0x40ec17
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x40ec37
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0xffffffff
je 0x40ec7c
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
add edx, 0x6fc
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ec7c
mov eax, dword [ebp - 4]
add eax, 0x6fc
push eax
call fcn.00419200
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x904], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x90c], 0
mov esp, ebp
pop ebp
ret
Function at 0x410f80
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
mov eax, dword [ebp - 0x210]
add eax, 0x6fc
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.Iime_imc.map
mov ecx, dword [ebp - 0x210]
add ecx, 0x6fc
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 0x210]
add edx, 0x6fc
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410ff3
mov eax, dword [ebp - 0x210]
add eax, 0x6fc
push eax
call fcn.00419200
add esp, 4
push 0
push 2
push 2
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp - 0x210]
add ecx, 0x6fc
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 0x210]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x210]
cmp dword [eax + 4], 0xffffffff
jne 0x411031
xor eax, eax
jmp 0x4111a0
push str.Iime_Trie_Codetable
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + 0x904]
push edx
push 0
push 4
push 0
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 0x210]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x210]
cmp dword [eax + 8], 0
jne 0x411092
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x210]
mov dword [eax + 4], 0xffffffff
xor eax, eax
jmp 0x4111a0
push 0
push 0
push 0
push 0xf001f
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x210]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x210]
cmp dword [edx + 0xc], 0
jne 0x411103
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x210]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x210]
mov dword [edx + 4], 0xffffffff
xor eax, eax
jmp 0x4111a0
push 0
mov ecx, dword [ebp - 0x210]
add ecx, 0x6e4
call fcn.004028a0
push eax
mov ecx, dword [ebp - 0x210]
call fcn.004111b0
test eax, eax
jne 0x41112a
xor eax, eax
jmp 0x4111a0
mov eax, dword [ebp - 0x210]
cmp dword [eax + 0x6c8], 0
je 0x411148
mov ecx, dword [ebp - 0x210]
cmp dword [ecx + 0x6c8], 2
jne 0x41119b
push 0x208
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.0041ec10
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.00418e90
add esp, 4
push 0x431ff4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp - 0x210]
call fcn.004111b0
test eax, eax
jne 0x41119b
xor eax, eax
jmp 0x4111a0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d2df
mov esp, ebp
pop ebp
ret
Function at 0x416cc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x416cf0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x416d10
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x416d56
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
add ecx, 0x6dc
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416d56
mov edx, dword [ebp - 4]
add edx, 0x6dc
push edx
call fcn.00419200
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x417090
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x6dc
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.Iime_enc.map
mov ecx, dword [ebp - 4]
add ecx, 0x6dc
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 4]
add edx, 0x6dc
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4170e5
mov eax, dword [ebp - 4]
add eax, 0x6dc
push eax
call fcn.00419200
add esp, 4
push 0
push 2
push 2
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp - 4]
add ecx, 0x6dc
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x41711a
xor eax, eax
jmp 0x4171e3
push str.Iime_EnTrie_Codetable
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x8e4]
push edx
push 0
push 4
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x417166
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xffffffff
xor eax, eax
jmp 0x4171e3
push 0
push 0
push 0
push 0xf001f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x4171bf
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0xffffffff
xor eax, eax
jmp 0x4171e3
mov ecx, dword [ebp - 4]
add ecx, 0x6c4
call fcn.004028a0
push eax
mov ecx, dword [ebp - 4]
call fcn.004171f0
test eax, eax
jne 0x4171de
xor eax, eax
jmp 0x4171e3
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4184a0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4184c2
xor eax, eax
jmp 0x418522
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4184eb
xor eax, eax
jmp 0x418522
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 8]
push edx
push 0x564
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d2df
mov esp, ebp
pop ebp
ret

Function at 0x418530
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x43a040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41855a
xor eax, eax
jmp 0x41862e
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
jne 0x41858c
xor eax, eax
jmp 0x41862e
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 8]
push edx
push 0x564
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x160], eax
mov edx, dword [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15c], 0
cmp dword [ebp + 0x570], 0
je 0x418628
push 0x14e
push 0
lea eax, [ebp - 0x158]
push eax
call fcn.0041ec10
add esp, 0xc
lea ecx, [ebp - 0x158]
push ecx
call fcn.00418640
add esp, 4
mov edx, 1
mov word [ebp - 0x13a], dx
sub esp, 0x150
mov ecx, 0x53
lea esi, [ebp - 0x158]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00418790
add esp, 0x150
mov eax, dword [ebp - 0x160]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d2df
mov esp, ebp
pop ebp
ret
Function at 0x418640
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43a040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0041ec10
add esp, 0xc
push 0xf
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00418f70
add esp, 8
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4186c1
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00418870
add esp, 8
mov esi, dword [ebp + 8]
sub esp, 0x150
mov ecx, 0x53
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00418790
add esp, 0x150
mov eax, 1
jmp 0x4186d4
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004186f0
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d2df
mov esp, ebp
pop ebp
ret

Function at 0x4186f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43a040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x418729
xor eax, eax
jmp 0x418775
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0x14e
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x34]
cmp edx, 0xa
jne 0x418761
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx + 0x34], ax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d2df
mov esp, ebp
pop ebp
ret

Function at 0x418790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x43a040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0041ec10
add esp, 0xc
push 0xf
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00418f70
add esp, 8
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x418856
mov dword [ebp - 0x210], 0
mov eax, 0x14e
mov word [ebp + 8], ax
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x14e
lea edx, [ebp + 8]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x214], 0
push 0
push 0
push 0x10
call fcn.0041ab90
add esp, 0xc
mov eax, 1
jmp 0x418858
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d2df
mov esp, ebp
pop ebp
ret
Function at 0x418be0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x43a040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x20219
push 0
push str.SoftwareIime
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x418c27
xor eax, eax
jmp 0x418e45
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0041ec10
add esp, 0xc
mov dword [ebp - 0x210], 0x208
mov dword [ebp - 0x214], 1
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
push ecx
push 0
push str.Clsid
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418c90
push str.83DB39EE_30A2_4143_9062_0C4FD8274968
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.004198d0
add esp, 8
mov dword [ebp - 0x210], 0x208
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0
push str.Guid
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418cf6
push str.F0970D4D_3985_46B0_B882_0EC7BA3D3BD1
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 8]
add edx, 0x10
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.004198d0
add esp, 8
mov dword [ebp - 0x210], 0x208
mov dword [ebp - 0x214], 1
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x214]
push eax
push 0
push str.SetupLocation
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418d5c
lea edx, [ebp - 0x20c]
push edx
call fcn.00419020
add esp, 4
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x20
call fcn.004028c0
mov dword [ebp - 0x210], 0x208
mov dword [ebp - 0x214], 1
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x214]
push eax
push 0
push str.DataLocation
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418dda
mov ecx, dword [ebp + 8]
add ecx, 0x20
call fcn.004028a0
push eax
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.IimeData
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x38
call fcn.004028c0
mov edx, dword [ebp + 8]
mov dword [edx + 0x50], 0
mov dword [ebp - 0x210], 4
mov dword [ebp - 0x214], 4
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x50
push ecx
lea edx, [ebp - 0x214]
push edx
push 0
push str.Portable
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d2df
mov esp, ebp
pop ebp
ret