joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458d00
Capabilities:
Read file on windows

Disassembly:
mov cl, byte [esi]
push ebp
mov ebp, dword [esp + 8]
push edi
test cl, cl
jne 0x458da9
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x458d25
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x458d36
mov eax, dword [ecx + 0x38]
push eax
push 1
push 1
push esi
call fcn.005025e3
add esp, 0x10
cmp eax, 1
je 0x458d4a
pop edi
mov dword [0x5896b4], 0x66
xor eax, eax
pop ebp
ret
mov al, byte [esi]
test al, al
jne 0x458d5f
pop edi
mov dword [0x5896b4], 0x70
xor eax, eax
pop ebp
ret
mov ecx, dword [ebx + 0x38]
mov edx, dword [ecx + 0x3c]
lea edi, [esi + 1]
test edx, edx
je 0x458d79
movzx ecx, al
push ecx
push edi
push ebx
call edx
add esp, 0xc
jmp 0x458d8c
mov edx, dword [ecx + 0x38]
push edx
movzx eax, al
push eax
push 1
push edi
call fcn.005025e3
add esp, 0x10
mov cl, byte [esi]
movzx edx, cl
cmp eax, edx
jne 0x458d3b
mov al, byte [edi]
mov byte [edi], 2
mov byte [ebp], al
dec cl
pop edi
mov byte [esi], cl
mov eax, 1
pop ebp
ret
mov al, byte [esi + 1]
movzx edx, al
mov dl, byte [edx + esi]
inc al
dec cl
pop edi
mov byte [ebp], dl
mov byte [esi + 1], al
mov byte [esi], cl
mov eax, 1
pop ebp
ret

Function at 0x45b7a0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x68
push ebx
push ebp
push edi
call dword [0x531534]
xor ebp, ebp
cmp eax, ebp
je 0x45b7e5
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], ebp
call dword [0x53152c]
test eax, eax
je 0x45b7e5
push 2
lea edx, [esp + 0x1c]
push edx
call dword [0x531420]
cmp eax, ebp
jne 0x45b816
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call dword [0x531450]
test eax, eax
jne 0x45b804
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 2
push ecx
push edx
call dword [0x531498]
lea ecx, [esp + 0x48]
push ecx
push eax
mov dword [esp + 0x50], 0x28
call dword [0x5314a4]
test eax, eax
je 0x45b850
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi], edx
mov edx, dword [esp + 0x68]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop edi
pop ebp
pop ebx
add esp, 0x68
ret
mov edi, dword [0x531490]
push ebp
call edi
push 1
mov ebx, eax
call edi
xor ecx, ecx
xor edx, edx
mov dword [esi], ecx
mov dword [esi + 4], edx
push ebp
mov dword [esi + 8], ebx
push 0x562a50
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ebx
mov dword [esi + 0xc], eax
call dword [0x5314dc]
cmp eax, ebp
je 0x45b8c0
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [0x53152c]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [0x5314a0]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call dword [0x53149c]
pop edi
pop ebp
pop ebx
add esp, 0x68
ret
Function at 0x45d190
Capabilities:
Hide graphical window

Disassembly:
mov eax, esi
call fcn.0045d340
test eax, eax
jne 0x45d19e
xor al, al
ret
mov eax, dword [eax + 0x14c]
push 8
push eax
call dword [0x531454]
cmp byte [esi + 0x1d0], 0
je 0x45d1bf
cmp byte [esi + 0x1d1], 0
je 0x45d1f3
cmp byte [esi + 0x1c8], 0
je 0x45d1da
mov ecx, dword [esi + 0x28]
push 0x53
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
jmp 0x45d1ed
mov edx, dword [esi + 0x28]
push 0x257
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edx
call dword [0x53144c]
cmp byte [esi + 0x1d0], 0
je 0x45d218
cmp byte [esi + 0x1d1], 0
je 0x45d218
mov eax, dword [esi + 0x28]
push 0
push 0xa
push 0x10a
push eax
call dword [0x531510]
mov al, 1
ret

Function at 0x466a40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51e688
mov eax, dword fs:[0]
push eax
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.skin
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004fe6e3
mov dword [eax + 0x24], fcn.004ff2b3
mov dword [eax + 0x28], fcn.004fe606
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configSkinRecommendFile::t_recommend_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8
Function at 0x46a080
Capabilities:
Check http status code
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
sub esp, 0x138
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
push ebp
mov ebp, dword [esp + 0x144]
push esi
push edi
xor ebx, ebx
push 0xff
lea eax, [esp + 0x45]
push ebx
push eax
mov edi, ecx
mov dword [esp + 0x3c], ebp
xor esi, esi
mov byte [esp + 0x1f], bl
mov dword [esp + 0x20], ebx
mov dword [esp + 0x40], 4
mov byte [esp + 0x4c], bl
call fcn.00503d40
add esp, 0xc
push 0x80
push ebp
call dword [0x5311d0]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push ebp
call dword [0x531158]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x46a102
xor al, al
jmp 0x46a2d6
push 0
push 0
push 0
push 0
push str.SogouIMEMiniSetup_skinchannel
call dword [0x53156c]
mov ebp, eax
mov dword [esp + 0x38], ebp
test ebp, ebp
je 0x46a29f
mov esi, dword [0x531568]
push 4
lea ecx, [esp + 0x20]
push ecx
push 2
push ebp
mov dword [esp + 0x2c], 0x4e20
call esi
push 4
lea edx, [esp + 0x20]
push edx
push 5
push ebp
call esi
push 4
lea eax, [esp + 0x20]
push eax
push 6
push ebp
call esi
push 0
push 0x84000000
push 0
push 0
push edi
push ebp
call dword [0x531570]
mov esi, eax
test esi, esi
je 0x46a29f
mov edi, dword [0x53157c]
push 0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x28]
push edx
push 0x20000013
push esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], 4
call edi
test eax, eax
je 0x46a29f
cmp dword [esp + 0x20], 0xc8
jne 0x46a29f
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x48]
push ecx
push 1
push esi
mov dword [esp + 0x50], 0xff
call edi
push 0
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x20000005
push esi
call edi
test eax, eax
jne 0x46a1e5
mov dword [esp + 0x14], ebx
jmp 0x46a210
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x46a210
mov eax, 0x51eb851f
mul ecx
mov ebp, edx
shr ebp, 4
cmp ebp, 0x400
jae 0x46a208
mov ebp, 0x400
jmp 0x46a215
cmp ebp, 0x100000
jbe 0x46a215
mov ebp, 0x100000
push ebp
push 0
call dword [0x531274]
push eax
call dword [0x53126c]
mov ebx, eax
xor eax, eax
mov dword [esp + 0x24], eax
test eax, eax
jbe 0x46a24d
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x30]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x40], 0
call dword [0x531148]
lea eax, [esp + 0x24]
push eax
push ebp
push ebx
push esi
call dword [0x531574]
mov edi, eax
test edi, edi
je 0x46a269
mov eax, dword [esp + 0x24]
test eax, eax
ja 0x46a231
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x531398]
mov ebp, dword [esp + 0x30]
push 1
push 0x10000000
push 1
push ebp
call fcn.00427080
push 1
push ebp
call fcn.00427420
mov ebp, dword [esp + 0x50]
add esp, 0x18
test edi, edi
setne byte [esp + 0x13]
jmp 0x46a2aa
mov edx, dword [esp + 0x18]
push edx
call dword [0x531398]
mov edi, dword [0x531580]
test esi, esi
je 0x46a2b7
push esi
call edi
test ebp, ebp
je 0x46a2be
push ebp
call edi
test ebx, ebx
je 0x46a2d2
push ebx
push 0
call dword [0x531274]
push eax
call dword [0x531270]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fdc2b
add esp, 0x138
ret
Function at 0x46a2f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51f210
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0x10], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], fcn.004fe6e3
mov dword [esp + 0x20], fcn.004ff2b3
mov dword [esp + 0x24], fcn.004fe606
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x1fff8
mov dword [esp + 0x18], vtable.t_heap.0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x48], 1
push str.UserManager
mov dword [esp + 0x20], ebx
mov esi, 0x558ca4
call fcn.00405910
add esp, 4
mov ecx, eax
call fcn.004b7ec0
test al, al
je 0x46a396
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x46a396
mov esi, dword [eax + 4]
jmp 0x46a39f
lea ecx, [esp + 0x10]
call fcn.00417c50
mov edx, dword [esp + 0x40]
mov eax, esi
call fcn.00418b90
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], vtable.allocator_unsigned_char__class_TAllocDefault_.0
cmp eax, ebx
je 0x46a3d7
mov edi, edi
mov ecx, dword [eax + 4]
push eax
mov dword [esp + 0x2c], ecx
call dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
add esp, 4
cmp eax, ebx
jne 0x46a3c0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], ebx
call fcn.00417ba0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x470b70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x51ff88
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x290]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
lea ebx, [edi + edi + 2]
cmp ebx, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], edi
jge 0x470c10
mov ecx, ebx
imul ecx, ecx, 0x258
lea eax, [ecx + ebp]
lea edx, [eax - 0x258]
push edx
push eax
call dword [esp + 0x1c]
add esp, 8
test al, al
je 0x470be1
dec ebx
mov esi, ebx
imul edi, edi, 0x258
imul esi, esi, 0x258
add esi, ebp
add edi, ebp
call fcn.00467580
mov dword [esp + 0x30], ebx
mov edi, dword [esp + 0x30]
lea ebx, [ebx + ebx + 2]
cmp ebx, dword [esp + 0x34]
jl 0x470bc2
mov eax, dword [esp + 0x34]
cmp ebx, eax
jne 0x470c35
imul eax, eax, 0x258
imul edi, edi, 0x258
lea esi, [eax + ebp - 0x258]
add edi, ebp
call fcn.00467580
mov eax, dword [esp + 0x34]
dec eax
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x14]
push ecx
sub esp, 0x258
lea esi, [esp + 0x294]
mov edi, esp
mov dword [esp + 0x270], esp
call fcn.00466ac0
mov edx, dword [esp + 0x274]
mov ecx, dword [esp + 0x28c]
push edx
push ebp
call fcn.00470ce0
add esp, 0x264
cmp byte [esp + 0x278], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x15c], esi
jne 0x470ca1
mov eax, dword [esp + 0x164]
lea ecx, [esp + 0x168]
cmp eax, ecx
je 0x470ca1
push eax
call fcn.004fe606
add esp, 4
cmp byte [esp + 0x154], 0
mov dword [esp + 0x38], esi
jne 0x470cc4
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
cmp eax, edx
je 0x470cc4
push eax
call fcn.004fe606
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x471990
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51e688
mov eax, dword fs:[0]
push eax
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.channel
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 0x20], fcn.004fe6e3
mov dword [eax + 0x24], fcn.004ff2b3
mov dword [eax + 0x28], fcn.004fe606
mov dword [eax], vtable.n_config::t_arraySection_class_t_configSkinChannelFile::t_channel_.0
mov dword [eax + 0x2c], 1
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8
Function at 0x474510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51e688
mov eax, dword fs:[0]
push eax
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.exclude
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004fe6e3
mov dword [eax + 0x24], fcn.004ff2b3
mov dword [eax + 0x28], fcn.004fe606
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configImeProtect::t_exclude_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x476260
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x38
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x3c]
push ebx
push ebp
push esi
mov esi, dword [0x531530]
push edi
push 0
push 0
mov dword [esp + 0x18], eax
call esi
mov ebx, eax
lea ecx, [ebx*4]
push ecx
call fcn.004fe6e3
add esp, 4
mov ebp, eax
push ebp
push ebx
call esi
xor edi, edi
test ebx, ebx
jle 0x476317
push 0x2c
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.00503d40
mov esi, dword [ebp + edi*4]
mov eax, esi
and eax, 0xf0000000
add esp, 0xc
mov dword [esp + 0x14], esi
cmp eax, 0xe0000000
jne 0x4762d1
mov dword [esp + 0x1c], esi
jmp 0x476300
cmp eax, 0xf0000000
je 0x4762e3
mov eax, esi
shr eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x476300
mov ecx, esi
shr ecx, 0x10
and ecx, 0xfff
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.0047c5a0
add esp, 8
test al, al
je 0x476305
mov word [esp + 0x20], si
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
call fcn.0047e070
inc edi
cmp edi, ebx
jl 0x4762a4
push ebp
call fcn.004fe606
mov ecx, dword [esp + 0x48]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.004fdc2b
add esp, 0x38
ret
Function at 0x476d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x529548
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x7c]
lea eax, [esp + 0x1c]
push eax
mov edi, ecx
call fcn.0046dde0
lea ecx, [esp + 0x1c]
xor esi, esi
push ecx
mov eax, edi
mov dword [esp + 0x78], esi
call fcn.00479cb0
test al, al
jne 0x476d5f
mov ecx, edi
call fcn.00417c50
push edi
mov ecx, ebp
call fcn.00476870
add esp, 4
test al, al
je 0x476d87
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x476dc5
push ebp
call fcn.00476260
add esp, 4
test al, al
jne 0x476dc5
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x476da5
push eax
call fcn.004fdffb
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.004fdffb
add esp, 4
xor al, al
jmp 0x476eef
push ebp
lea ebx, [esp + 0x20]
call fcn.0047e440
push 0x2c
lea edx, [esp + 0x3c]
push esi
push edx
mov dword [esp + 0x40], esi
call fcn.00503d40
add esp, 0xc
lea esi, [esp + 0x34]
mov eax, edi
call fcn.00475cb0
test al, al
je 0x476ec1
call fcn.0047c060
test al, al
je 0x476e30
mov eax, esi
push eax
lea ecx, [esp + 0x1c]
push ecx
mov edi, ebx
mov dword [esp + 0x20], 0xffffffff
call fcn.0047e0e0
test al, al
je 0x476e30
mov edi, dword [esp + 0x18]
mov esi, ebx
call fcn.00473360
mov esi, eax
lea edi, [esp + 0x34]
call fcn.00474600
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x476ec1
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x476e74
call fcn.00503036
mov esi, dword [ebp + 0xc]
movzx eax, word [ebx + esi + 0xc]
mov cx, word [esp + 0x40]
cmp ax, cx
jb 0x476f34
ja 0x476f34
mov eax, dword [ebx + esi + 8]
test eax, eax
je 0x476f0e
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x476f0e
cmp eax, ecx
jb 0x476f34
ja 0x476f34
cmp edi, 0xffffffff
je 0x476ec1
test edi, edi
je 0x476ec1
mov ecx, edi
neg ecx
push ebp
call fcn.0047e190
mov eax, dword [esp + 0x28]
xor esi, esi
cmp eax, esi
je 0x476ed4
push eax
call fcn.004fdffb
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.004fdffb
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004fdc2b
add esp, 0x64
ret
lea edx, [ebx + esi + 0x10]
lea ecx, [esp + 0x44]
call fcn.0047bff0
test eax, eax
jne 0x476f34
lea edx, [ebx + esi + 0x20]
lea ecx, [esp + 0x54]
call fcn.0047bff0
test eax, eax
je 0x476eae
inc edi
add ebx, 0x30
cmp edi, dword [esp + 0x18]
jl 0x476e55
jmp 0x476ec1
Function at 0x477500
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x5229a6
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebp
push esi
push edi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
push str.Keyboard_LayoutPreload
push 0x80000001
mov esi, ecx
call dword [0x53105c]
mov ebp, vtable.t_reg.0
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], ebp
call fcn.00418990
xor edi, edi
mov eax, str.HKEY_CURRENT_USER
lea edx, [esp + 0x38]
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 0x80000001
call fcn.00418b90
push 1
push 1
push str.Keyboard_LayoutPreload
push ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x178], edi
call fcn.00419dc0
test al, al
jne 0x4775f8
mov ecx, ebx
call fcn.00417c00
push 0x5652e4
push 0x55e008
mov edx, eax
call fcn.00419360
mov eax, dword [esp + 0x38]
add esp, 8
mov dword [esp + 0x2c], ebp
cmp eax, edi
je 0x4775c6
push eax
call dword [0x531050]
cmp byte [esp + 0x154], 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], vtable.t_str.0
jne 0x4775f1
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x44]
cmp eax, ecx
je 0x4775f1
push eax
call fcn.004fe606
add esp, 4
xor al, al
jmp 0x477708
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.0047a0b0
mov byte [esp + 0x168], 1
mov ecx, dword [esp + 0x24]
mov edx, ecx
sub edx, dword [esp + 0x20]
mov eax, 0x2aaaaaab
imul edx
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, edi
mov dword [esp + 0x10], 1
jle 0x477693
xor ebp, ebp
jmp 0x477644
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x477662
call fcn.00503036
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
lea eax, [ecx + ebp]
push edx
lea ecx, [esp + 0x30]
mov edx, ebx
call fcn.00477480
add esp, 4
test al, al
je 0x477684
inc dword [esp + 0x10]
inc edi
add ebp, 0x30
cmp edi, esi
jl 0x477640
xor edi, edi
mov ebp, vtable.t_reg.0
mov eax, dword [esp + 0x30]
push eax
call dword [0x531008]
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x4776af
push eax
call fcn.004fdffb
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.004fdffb
mov eax, dword [esp + 0x34]
add esp, 4
mov dword [esp + 0x2c], ebp
cmp eax, edi
je 0x4776db
push eax
call dword [0x531050]
cmp byte [esp + 0x154], 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], vtable.t_str.0
jne 0x477706
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
cmp eax, edx
je 0x477706
push eax
call fcn.004fe606
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.004fdc2b
add esp, 0x15c
ret
Function at 0x478230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x521d78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebp
push esi
push edi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, word [ebx + 0xc]
push eax
lea ecx, [esp + 0x18]
xor ebp, ebp
push ecx
mov dword [esp + 0x1c], ebp
call fcn.00478180
test al, al
jne 0x4782d1
lea edx, [esp + 0x18]
push edx
call fcn.0046dde0
mov eax, ebx
lea edi, [esp + 0x18]
mov dword [esp + 0x38], ebp
call fcn.00473390
mov eax, edi
push eax
mov edi, esi
call fcn.0047a300
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4782a5
push eax
call fcn.004fdffb
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.004fdffb
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
push edx
mov eax, esi
call fcn.0047a260
mov edi, eax
mov eax, ebx
call fcn.00473390
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
Function at 0x47cfc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x521ce1
mov eax, dword fs:[0]
push eax
sub esp, 0x384
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x380], eax
push esi
push edi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0x390]
mov dword fs:[0], eax
mov ecx, 0x105
mov esi, 0x5906b0
mov dword [0x5907c8], ecx
call fcn.00419a20
cmp byte [0x5907c4], 0
mov eax, 0x5906b4
jne 0x47d021
mov eax, dword [0x5906b0]
push 0
push 0x1a
add eax, 4
push eax
push 0
call dword [0x5313f0]
mov ecx, 0x5906a8
cmp eax, 1
je 0x47d047
call fcn.0041ebd0
xor al, al
jmp 0x47d219
call fcn.0041f450
push str.kernel32.dll
call dword [0x531394]
test eax, eax
je 0x47d217
push str.GetLocaleInfoEx
push eax
call dword [0x531390]
test eax, eax
je 0x47d217
lea ecx, [esp + 0x264]
call fcn.0041ee30
lea eax, [esp + 0x264]
push eax
mov ecx, 0x5906a8
mov dword [esp + 0x39c], 0
call fcn.00420e50
test al, al
jne 0x47d0d6
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
cmp byte [esp + 0x380], al
jne 0x47d0cf
mov eax, dword [esp + 0x26c]
lea ecx, [esp + 0x270]
cmp eax, ecx
je 0x47d0cf
push eax
call fcn.004fe606
add esp, 4
xor al, al
jmp 0x47d219
mov dword [esp + 0x10], str.LocalLow
mov dword [esp + 0x14], str.Roaming
mov dword [esp + 0x18], str.Local
xor edi, edi
cmp byte [esp + 0x380], 0
lea eax, [esp + 0x270]
jne 0x47d108
mov eax, dword [esp + 0x26c]
mov esi, dword [esp + edi*4 + 0x10]
lea ecx, [eax + 4]
call fcn.0041ccb0
test al, al
jne 0x47d12e
inc edi
cmp edi, 3
jb 0x47d0f0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jmp 0x47d1f2
mov edi, esi
test edi, edi
jne 0x47d144
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jmp 0x47d1f2
lea ecx, [esp + 0x1c]
call fcn.00418990
mov eax, edi
lea edx, [esp + 0x1c]
call fcn.00418b90
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x144]
push ecx
lea ecx, [esp + 0x26c]
mov byte [esp + 0x3a0], 2
call fcn.0041f5e0
cmp byte [eax + 0x11c], 0
je 0x47d187
add eax, 0xc
jmp 0x47d18a
mov eax, dword [eax + 8]
add eax, 4
mov edx, 0x5906a8
call fcn.00418b90
cmp byte [esp + 0x25c], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x140], esi
jne 0x47d1c8
mov eax, dword [esp + 0x148]
lea edx, [esp + 0x14c]
cmp eax, edx
je 0x47d1c8
push eax
call fcn.004fe606
add esp, 4
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], esi
jne 0x47d1eb
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x47d1eb
push eax
call fcn.004fe606
add esp, 4
mov dword [esp + 0x264], esi
cmp byte [esp + 0x380], 0
jne 0x47d217
mov eax, dword [esp + 0x26c]
lea edx, [esp + 0x270]
cmp eax, edx
je 0x47d217
push eax
call fcn.004fe606
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x390]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x380]
xor ecx, esp
call fcn.004fdc2b
add esp, 0x390
ret