joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4665a4
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x42c
mov eax, 0x5e4fe0
call fcn.0046d2ba
mov edi, ecx
mov esi, 0x208
lea eax, [ebp - 0x420]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.004830b0
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004830b0
add esp, 0x18
lea eax, [ebp - 0x438]
mov ecx, edi
push eax
call fcn.00466e2e
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push str.Dict
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
push 0x5ed890
push eax
call fcn.00407e70
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004917a3
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.00491772
lea eax, [ebp - 0x218]
push 0x5e8aa0
push eax
call fcn.00491772
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
add esp, 0x28
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x466510
push 0
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004663da
call fcn.004538e0
mov ecx, eax
call fcn.00467acc
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004917a3
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.00491772
lea eax, [ebp - 0x218]
push 0x5e8aa0
push eax
call fcn.00491772
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x46657a
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004663da
push 0
push 1
lea ecx, [ebp - 0x438]
call fcn.0041f8c0
call fcn.0046d264
ret
jmp 0x466433

Function at 0x4665a9
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.004830b0
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004830b0
add esp, 0x18
call fcn.004538e0
mov ecx, eax
call fcn.00467adc
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004917a3
lea eax, [ebp - 0x414]
push str.Wizard.exe
push eax
call fcn.00491772
mov esi, 0x5ea424
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004917a3
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00491772
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00491772
lea eax, [ebp - 0x20c]
push str._RunAutoLoadDict
push eax
call fcn.00491772
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x466678
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0045b658
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
Function at 0x466755
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.004830b0
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004830b0
add esp, 0x18
call fcn.004538e0
mov ecx, eax
call fcn.00467adc
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004917a3
lea eax, [ebp - 0x414]
push str.MBManager.exe
push eax
call fcn.00491772
mov esi, 0x5ea424
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004917a3
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00491772
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00491772
lea eax, [ebp - 0x20c]
push str._CheckSysMb
push eax
call fcn.00491772
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x466824
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0045b658
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
Function at 0x466834
Capabilities:
Check if file exists

Disassembly:
push 0x658
mov eax, 0x5e507f
call fcn.0046d2ba
push str.DoRunRegImeInterFace
call fcn.004533d4
pop ecx
lea ecx, [ebp - 0x664]
call fcn.00464ae4
xor ebx, ebx
lea ecx, [ebp - 0x664]
mov dword [ebp - 4], ebx
call fcn.00464bb1
mov dword [ebp - 0x630], ebx
push 7
pop esi
mov dword [ebp - 0x62c], esi
test eax, eax
je 0x4668a4
xor eax, eax
mov edi, str.RegIme64.exe
push edi
mov word [ebp - 0x640], ax
call fcn.00491757
pop ecx
push eax
push edi
lea ecx, [ebp - 0x640]
call fcn.00402650
mov byte [ebp - 4], 1
jmp 0x4668ca
xor eax, eax
mov edi, str.RegIme32.exe
push edi
mov word [ebp - 0x640], ax
call fcn.00491757
pop ecx
push eax
push edi
lea ecx, [ebp - 0x640]
call fcn.00402650
mov byte [ebp - 4], 2
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
call fcn.004538e0
mov ecx, eax
call fcn.00467adc
push eax
lea eax, [ebp - 0x218]
push 0x5ebf3c
push eax
call fcn.00407e70
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x640]
push ebx
push 1
call fcn.0041f8c0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4669fd
mov dword [ebp - 0x62c], esi
xor eax, eax
mov esi, str._InstallIME
mov dword [ebp - 0x630], ebx
push esi
mov word [ebp - 0x640], ax
call fcn.00491757
pop ecx
push eax
push esi
lea ecx, [ebp - 0x640]
call fcn.00402650
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x640]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00407e70
pop ecx
pop ecx
call fcn.0045ac09
test eax, eax
lea eax, [ebp - 0x420]
je 0x4669b0
push 0xffffffffffffffff
push ebx
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0045b5d2
lea eax, [ebp - 0x420]
push eax
push str.DoRunRegImeInterFace_Parameter__s
call fcn.004533d4
add esp, 0x18
jmp 0x4669ed
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___s
push eax
call fcn.00407e70
lea eax, [ebp - 0x628]
push eax
push str.DoRunRegImeInterFace_Cmd__s
call fcn.004533d4
push ebx
push ebx
push ebx
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.0045b658
add esp, 0x2c
push ebx
push 1
lea ecx, [ebp - 0x640]
call fcn.0041f8c0
jmp 0x466a10
lea eax, [ebp - 0x218]
push eax
push str.PathFileExists_false_file___s
call fcn.004533d4
pop ecx
pop ecx
lea ecx, [ebp - 0x664]
call fcn.00464af7
call fcn.0046d264
ret
Function at 0x466b33
Capabilities:
Check if file exists
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.004665a4
mov ecx, esi
call fcn.00466755
mov ecx, esi
call fcn.00466750
mov ecx, esi
call fcn.00466834
mov ecx, esi
pop esi
jmp 0x466c0a
push 0x23c
mov eax, 0x5e5149
call fcn.0046d2ba
call fcn.004538e0
mov ecx, eax
call fcn.00467adc
push eax
lea ecx, [ebp - 0x230]
call fcn.00403b30
mov esi, str.ZhiNengPYInfo.ini
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.00491757
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.00405710
mov esi, 0x5e8aa0
push esi
call fcn.00491757
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x230]
call fcn.00456193
cmp eax, 0xffffffff
je 0x466d29
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0041a1e0
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push edi
push eax
call fcn.004830b0
add esp, 0xc
lea eax, [ebp - 0x218]
push edi
push 0x1c
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push str.VirtualStore_
push eax
call fcn.00491772
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00491772
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x466d1b
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x218]
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
push eax
call fcn.004541b8
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x248]
call fcn.0041f8c0
push edi
push 1
lea ecx, [ebp - 0x230]
call fcn.0041f8c0
call fcn.0046d264
ret

Function at 0x466d3d
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2214
call fcn.0046cf20
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.004830b0
add esp, 0xc
lea eax, [ebp - 0x2210]
push eax
push 0x1000
lea eax, [ebp - 0x120c]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x466e16
push esi
push edi
xor edi, edi
test dword [ebp - 0x2210], 0xfffffffc
jbe 0x466e12
push dword [ebp + edi*4 - 0x120c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x2214]
push eax
push 0x1000
lea eax, [ebp - 0x220c]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
push 0x208
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x220c]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
cmp dword [ebx + 0x14], 8
jb 0x466def
mov eax, dword [ebx]
jmp 0x466df1
mov eax, ebx
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0048f8c1
pop ecx
pop ecx
test eax, eax
je 0x466e25
mov eax, dword [ebp - 0x2210]
inc edi
shr eax, 2
cmp edi, eax
jl 0x466d9e
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + edi*4 - 0x120c]
jmp 0x466e14
Function at 0x466e9f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
call fcn.00466d3d
pop ecx
push eax
xor esi, esi
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x466ec4
xor al, al
jmp 0x466ef9
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x466ef7
push esi
push esi
lea eax, [ebp - 4]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x467642
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.00467321
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.UserID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x467688
mov dword [esi], eax
mov bl, 1
jmp 0x46768a
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0041f8c0
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4

Function at 0x46772a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00467321
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.UserID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
lea ecx, [ebp - 0x1c]
push 0
push 1
setg bl
call fcn.0041f8c0
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
Function at 0x46b04a
Capabilities:
Check if file exists

Disassembly:
push 0x83c
mov eax, 0x5e57ee
call fcn.0046d2ba
mov esi, ecx
lea eax, [ebp - 0x848]
push eax
call fcn.0046af73
and dword [ebp - 4], 0
lea eax, [ebp - 0x848]
cmp dword [ebp - 0x834], 8
cmovae eax, dword [ebp - 0x848]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46b16b
push 0x104
lea eax, [ebp - 0x830]
mov ecx, esi
push eax
call fcn.0046afe3
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
push str.ZNImeBroker.exe
cmovae eax, dword [ebp - 0x848]
mov esi, 0x5ebf3c
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00407e70
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___Unregister
push eax
call fcn.00407e70
lea eax, [ebp - 0x628]
push eax
call int.0045bd50
lea eax, [ebp - 0x628]
push eax
push str.ImeBroker_cmd1___s
call fcn.0047507a
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
push str.ZNImeBrokerPS.dll
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00407e70
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x628]
push str.__s_regsvr32___u__s___s_
push eax
call fcn.00407e70
add esp, 0x48
lea eax, [ebp - 0x628]
push eax
call int.0045bd50
lea eax, [ebp - 0x628]
push eax
push str.ImeBroker_cmd2___s
call fcn.004533d4
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x848]
call fcn.0041f8c0
call fcn.0046d264
ret

Function at 0x46b180
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x5e581e
call fcn.0046d2ba
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x46b224
test esi, esi
je 0x46b224
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46b224
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46b224
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00403b30
lea eax, [ebp - 0x40]
push eax
call fcn.00454e4a
add esp, 4
xor edi, edi
mov ecx, esp
mov dword [ebp - 4], edi
push esi
call fcn.00403b30
lea eax, [ebp - 0x28]
push eax
call fcn.00454e4a
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.0048f8c1
add esp, 0x24
lea ecx, [ebp - 0x28]
neg eax
sbb esi, esi
push edi
push 1
call fcn.0041f8c0
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.0041f8c0
lea eax, [esi + 1]
jmp 0x46b226
xor eax, eax
call fcn.0046d264
ret 8
Function at 0x46b22e
Capabilities:
Check if file exists

Disassembly:
push 0x634
mov eax, 0x5e584e
call fcn.0046d2ba
mov esi, ecx
call fcn.004538e0
mov ecx, eax
call fcn.00467adc
mov ebx, eax
call fcn.004538e0
mov ecx, eax
call fcn.00467abc
push 0x208
mov edi, eax
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.004830b0
push edi
lea eax, [ebp - 0x628]
push str._sEUDC_
push eax
call fcn.00407e70
add esp, 0x18
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46b29b
xor eax, eax
jmp 0x46b39f
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004830b0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004830b0
push edi
lea eax, [ebp - 0x218]
push str._sEUDCEUDC.EUF
push eax
call fcn.00407e70
push ebx
lea eax, [ebp - 0x420]
push str._sEUDCEUDC.EUF
push eax
call fcn.00407e70
add esp, 0x30
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0046b180
test eax, eax
je 0x46b294
push edi
mov edi, str._sEUDCEUDC.TTE
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00407e70
push ebx
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00407e70
add esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0046b180
test eax, eax
je 0x46b294
xor ebx, ebx
mov dword [ebp - 0x62c], 7
xor eax, eax
mov dword [ebp - 0x630], ebx
mov word [ebp - 0x640], ax
lea eax, [ebp - 0x640]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.0046b6f2
test eax, eax
je 0x46b38d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x640]
call fcn.00429920
test eax, eax
jne 0x46b38d
xor esi, esi
inc esi
jmp 0x46b38f
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x640]
call fcn.0041f8c0
mov eax, esi
call fcn.0046d264
ret

Function at 0x46b509
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push esi
push eax
push 0xf003f
push 0
push str.EUDC936
push reloc.WS2_32.dll_accept
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46b574
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.0046b687
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0041f8c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
Function at 0x46b583
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x22c
mov eax, 0x5e5881
call fcn.0046d2ba
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x234]
push eax
push 0xf003f
xor ebx, ebx
mov dword [ebp - 0x238], 0x208
push ebx
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x234], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x46b5d1
xor eax, eax
jmp 0x46b67f
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0046b687
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.004830b0
add esp, 0xc
lea ecx, [ebp - 0x238]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x234]
test eax, eax
je 0x46b63c
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
jmp 0x46b66f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x218], 0
jne 0x46b650
mov eax, ebx
jmp 0x46b65d
lea eax, [ebp - 0x218]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402650
xor esi, esi
inc esi
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.0041f8c0
mov eax, esi
call fcn.0046d264
ret 4

Function at 0x46b6f2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0xf003f
xor esi, esi
mov ebx, 0x208
push esi
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x46b743
xor eax, eax
jmp 0x46b7b7
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004830b0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push str.SystemDefaultEUDCFont
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
test eax, eax
je 0x46b787
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46b73f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x20c], si
je 0x46b7a5
lea eax, [ebp - 0x20c]
push eax
call fcn.00491757
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00402650
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4
Function at 0x46b8f1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
xor edi, edi
push eax
push 0xf003f
push edi
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46b99c
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004830b0
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004917a3
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push str.SystemDefaultEUDCFont
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
test eax, eax
je 0x46b9bd
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, edi
push edi
push 1
lea ecx, [ebp + 8]
call fcn.0041f8c0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
inc esi
jmp 0x46b99e

Function at 0x46bcee
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x418]
mov ebx, str.ZNImeDictFile
push eax
push ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x46be41
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push eax
push ebx
push 1
push 0x5e87f0
push dword [ebp - 0x418]
call edi
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004830b0
add esp, 0xc
mov ebx, str.DictInst.exe
push ebx
call fcn.004538e0
mov ecx, eax
call fcn.00467adc
push eax
lea eax, [ebp - 0x414]
push 0x5ebf3c
push eax
call fcn.00407e70
add esp, 0x10
lea eax, [ebp - 0x414]
push 0x104
push eax
push 1
push str.DefaultIcon
push dword [ebp - 0x418]
call edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004830b0
add esp, 0xc
push ebx
call fcn.004538e0
mov ecx, eax
call fcn.00467adc
push eax
lea eax, [ebp - 0x20c]
push str.__s_s___install
push eax
call fcn.00407e70
lea eax, [ebp - 0x20c]
push 0x5f0e38
push eax
call fcn.00491772
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 1
push str.shellopencommand_
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x41c]
push eax
push str..zncel
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x46be40
push 0x104
push str.ZNImeDictFile
push 1
push 0x5e87f0
push dword [ebp - 0x41c]
call edi
push dword [ebp - 0x41c]
call ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret

Function at 0x46be50
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
call fcn.0046be60
mov ecx, esi
pop esi
jmp fcn.0046bcee