joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a325
Capabilities:
Check if file exists
Copy file
Move file

Disassembly:
push 0x20
mov eax, 0x4bc0f2
call fcn.00460420
xor ebx, ebx
push 0x4df45c
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], ebx
call fcn.00405839
mov esi, dword [ebp + 8]
mov word [ebp - 0x24], bx
xor eax, eax
lea edi, [ebp - 0x22]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
mov byte [ebp - 4], 2
stosw word es:[edi], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a3ef
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x40a3e4
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push 0x4c4cf4
push eax
call fcn.00460936
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.00409a21
push str..bak
lea ecx, [ebp - 0x28]
call fcn.004056fb
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
call fcn.004056fb
lea ecx, [ebp - 0x28]
call fcn.00409974
push eax
lea ecx, [ebp + 0xc]
call fcn.00409974
push eax
call fcn.00461bc4
pop ecx
pop ecx
push 5
push ebx
lea ecx, [ebp - 0x28]
call fcn.00409974
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0x2c], 0xa
jge 0x40a3ef
inc dword [ebp - 0x2c]
push ebx
push dword [ebp + 0xc]
push esi
call edi
test eax, eax
je 0x40a377
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00404ff6
lea ecx, [esi - 0x10]
call fcn.00404ff6
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00404ff6
call fcn.004604a3
ret 8

Function at 0x40ed46
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
push edi
lea eax, [ebp - 0x80]
push eax
xor esi, esi
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40edf4
push esi
lea eax, [ebp - 0x7c]
push eax
push esi
push edi
push esi
push esi
push esi
push str.SmartCloudInput
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40edf4
push 0x206
lea eax, [ebp - 0x76]
push esi
push eax
mov word [ebp - 0x78], si
call fcn.0045fa70
add esp, 0xc
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6cc
push eax
lea eax, [ebp - 0x78]
push 0x4c3d68
push eax
call fcn.00460936
add esp, 0xc
push 0x104
lea eax, [ebp - 0x78]
push eax
push 1
push esi
push str.InstallPath
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp + 0x190]
pop edi
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x194
leave
ret
Function at 0x40ee0b
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x398], eax
push esi
lea eax, [ebp - 0x7c]
push eax
mov esi, str.SmartCloudPYImeSkinFile
push esi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40ef4d
push ebx
push edi
xor edi, edi
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push 1
push 0x4df45c
push dword [ebp - 0x7c]
call esi
push 0x206
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.0045fa70
add esp, 0xc
mov ebx, str.SCSkinInst.exe
push ebx
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x78]
push 0x4c3cf0
push eax
call fcn.00460936
add esp, 0x10
mov edi, 0x104
push edi
lea eax, [ebp - 0x78]
push eax
push 1
push str.DefaultIcon
push dword [ebp - 0x7c]
call esi
and word [ebp + 0x190], 0
push 0x206
lea eax, [ebp + 0x192]
push 0
push eax
call fcn.0045fa70
add esp, 0xc
push ebx
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp + 0x190]
push str.__s_s___install
push eax
call fcn.00460936
lea eax, [ebp + 0x190]
push 0x4c667c
push eax
call fcn.0045fd1a
add esp, 0x18
push edi
lea eax, [ebp + 0x190]
push eax
push 1
push str.shellopencommand_
push dword [ebp - 0x7c]
call esi
push dword [ebp - 0x7c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x80]
push eax
push str..znpf
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40ef4b
push edi
push str.SmartCloudPYImeSkinFile
push 1
push 0x4df45c
push dword [ebp - 0x80]
call esi
push dword [ebp - 0x80]
call ebx
pop edi
pop ebx
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x39c
leave
ret
Function at 0x40ef63
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x398], eax
push esi
lea eax, [ebp - 0x7c]
push eax
mov esi, str.SmartCloudPYImeDictFile
push esi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40f0a5
push ebx
push edi
xor edi, edi
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push 1
push 0x4df45c
push dword [ebp - 0x7c]
call esi
push 0x206
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.0045fa70
add esp, 0xc
mov ebx, str.SCDictInst.exe
push ebx
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x78]
push 0x4c3cf0
push eax
call fcn.00460936
add esp, 0x10
mov edi, 0x104
push edi
lea eax, [ebp - 0x78]
push eax
push 1
push str.DefaultIcon
push dword [ebp - 0x7c]
call esi
and word [ebp + 0x190], 0
push 0x206
lea eax, [ebp + 0x192]
push 0
push eax
call fcn.0045fa70
add esp, 0xc
push ebx
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp + 0x190]
push str.__s_s___install
push eax
call fcn.00460936
lea eax, [ebp + 0x190]
push 0x4c667c
push eax
call fcn.0045fd1a
add esp, 0x18
push edi
lea eax, [ebp + 0x190]
push eax
push 1
push str.shellopencommand_
push dword [ebp - 0x7c]
call esi
push dword [ebp - 0x7c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x80]
push eax
push str..zncel
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40f0a3
push edi
push str.SmartCloudPYImeDictFile
push 1
push 0x4df45c
push dword [ebp - 0x80]
call esi
push dword [ebp - 0x80]
call ebx
pop edi
pop ebx
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x39c
leave
ret
push esi
mov esi, ecx
call fcn.0040ed46
mov ecx, esi
call fcn.0040f0bb
mov ecx, esi
call fcn.0040ee0b
mov ecx, esi
pop esi
jmp 0x40ef63
Function at 0x40f32f
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x398], eax
push esi
lea eax, [ebp - 0x7c]
push eax
mov esi, str.SmartCloudPYImeDictFile
push esi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40f0a5
push ebx
push edi
xor edi, edi
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push 1
push 0x4df45c
push dword [ebp - 0x7c]
call esi
push 0x206
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.0045fa70
add esp, 0xc
mov ebx, str.SCDictInst.exe
push ebx
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x78]
push 0x4c3cf0
push eax
call fcn.00460936
add esp, 0x10
mov edi, 0x104
push edi
lea eax, [ebp - 0x78]
push eax
push 1
push str.DefaultIcon
push dword [ebp - 0x7c]
call esi
and word [ebp + 0x190], 0
push 0x206
lea eax, [ebp + 0x192]
push 0
push eax
call fcn.0045fa70
add esp, 0xc
push ebx
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp + 0x190]
push str.__s_s___install
push eax
call fcn.00460936
lea eax, [ebp + 0x190]
push 0x4c667c
push eax
call fcn.0045fd1a
add esp, 0x18
push edi
lea eax, [ebp + 0x190]
push eax
push 1
push str.shellopencommand_
push dword [ebp - 0x7c]
call esi
push dword [ebp - 0x7c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x80]
push eax
push str..zncel
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40f0a3
push edi
push str.SmartCloudPYImeDictFile
push 1
push 0x4df45c
push dword [ebp - 0x80]
call esi
push dword [ebp - 0x80]
call ebx
pop edi
pop ebx
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x39c
leave
ret
push esi
mov esi, ecx
call fcn.0040ed46
mov ecx, esi
call fcn.0040f0bb
mov ecx, esi
call fcn.0040ee0b
mov ecx, esi
pop esi
jmp 0x40ef63

Function at 0x40f83a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x20a]
push esi
push eax
mov edi, ecx
mov word [ebp - 0x20c], si
call fcn.0045fa70
add esp, 0xc
cmp dword [ebp + 8], esi
je 0x40f897
push esi
push 0x19
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40f897
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0040f711
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045fa14
leave
ret 4

Function at 0x40f8a7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.0045fa70
add esp, 0xc
push 0
push 0xb
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40f900
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0040f711
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0045fa14
leave
ret
Function at 0x40f90d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.0045fa70
add esp, 0xc
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0040f7c2
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0045fa14
leave
ret

Function at 0x40f96f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.0045fa70
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40f9db
lea eax, [ebp - 0x20c]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.0045fd1a
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0040f711
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0045fa14
leave
ret

Function at 0x40fae1
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x188], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x194]
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x7e]
push ebx
push eax
mov word [ebp - 0x80], bx
call fcn.0045fa70
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
push edi
call esi
test eax, eax
jne 0x40fbba
push edi
lea eax, [ebp - 0x80]
push 0x4c3d68
push eax
call fcn.00460936
lea eax, [ebp - 0x80]
push str..del
push eax
call fcn.00460605
add esp, 0x14
test eax, eax
je 0x40fb58
push 5
push ebx
push edi
jmp 0x40fbb4
test ebx, ebx
lea eax, [ebp - 0x80]
jne 0x40fb70
push edi
push str._s.del
push eax
call fcn.00460936
add esp, 0xc
jmp 0x40fb80
push ebx
push edi
push str._s.del_d
push eax
call fcn.00460936
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fba0
lea eax, [ebp - 0x80]
push eax
call esi
test eax, eax
jne 0x40fba0
cmp ebx, 0xa
jg 0x40fbba
inc ebx
jmp 0x40fb58
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.00461bc4
pop ecx
pop ecx
push 5
push 0
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp + 0x188]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x18c
leave
ret 4

Function at 0x40fbd4
Capabilities:
Delete file

Disassembly:
push 0
mov eax, 0x4bc98d
call fcn.004603b7
mov edi, ecx
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40fbf9
lea ecx, [esi - 0x10]
jmp 0x40fc0f
lea ecx, [ebp + 8]
call fcn.00409974
push eax
mov ecx, edi
call fcn.0040fae1
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404ff6
xor eax, eax
inc eax
call fcn.0046048f
ret 4
Function at 0x40fc1f
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
sub esp, 0x660
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x660], eax
push 0x10
mov eax, 0x4bc9c3
call fcn.004603b7
mov edi, ecx
mov esi, dword [ebp + 0x66c]
push esi
lea eax, [ebp + 0x250]
push 0x4c6ad0
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00460936
add esp, 0xc
lea eax, [ebp]
push eax
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x40fd83
lea eax, [ebp]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
je 0x40fd83
cmp word [ebp + 0x2c], 0x2e
je 0x40fc82
cmp word [ebp + 0x2e], bx
je 0x40fc82
cmp word [ebp + 0x2e], 0x2e
jne 0x40fcb1
cmp word [ebp + 0x30], bx
je 0x40fc82
call fcn.00449f2e
push eax
lea ecx, [ebp - 0x10]
call fcn.00419547
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x10]
push 0x4c3d68
push eax
mov byte [ebp - 4], 1
call fcn.00407eb1
add esp, 0xc
test byte [ebp], 0x10
je 0x40fd29
push 0x206
lea eax, [ebp + 0x45a]
push ebx
push eax
mov word [ebp + 0x458], bx
call fcn.0045fa70
push dword [ebp - 0x10]
lea eax, [ebp + 0x458]
push esi
push 0x4c582c
push eax
call fcn.00460936
add esp, 0x18
lea eax, [ebp + 0x458]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00405839
mov ecx, edi
call fcn.0040fc1f
jmp 0x40fd70
call fcn.00449f2e
push eax
lea ecx, [ebp - 0x14]
call fcn.00419547
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push esi
push 0x4c3cf0
push eax
mov byte [ebp - 4], 2
call fcn.00407eb1
add esp, 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.004082f2
mov ecx, edi
call fcn.0040fbd4
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404ff6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00404ff6
jmp 0x40fc82
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40fda1
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esi - 0x10]
call fcn.00404ff6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x660]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x664
leave
ret 4

Function at 0x40ff0f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0045fa70
add esp, 0xc
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6e0
push eax
lea eax, [ebp - 0x20c]
push str._sConfigConfig.ini
push eax
call fcn.00460936
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call esi
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x20c]
push str._sConfig.ini
push eax
call fcn.00460936
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045fa14
leave
ret
Function at 0x40ffa8
Capabilities:
Check if file exists
Get common file path
Get program files directory
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x5a0]
sub esp, 0x620
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x59c], eax
push ebx
push esi
push edi
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp + 0x396]
push ebx
push eax
mov dword [ebp - 0x80], ecx
mov word [ebp + 0x394], bx
call fcn.0045fa70
push edi
lea eax, [ebp + 0x18e]
push ebx
push eax
mov word [ebp + 0x18c], bx
call fcn.0045fa70
add esp, 0x18
push ebx
push 0x2b
lea eax, [ebp + 0x394]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, 0x4df450
lea eax, [ebp + 0x394]
push esi
push eax
call fcn.0045fd1a
lea eax, [ebp + 0x394]
push str.SmartCloudInput
push eax
call fcn.0045fd1a
lea eax, [ebp + 0x394]
push esi
push eax
call fcn.0045fd1a
lea eax, [ebp + 0x394]
push str.SmartCloud
push eax
call fcn.0045fd1a
lea eax, [ebp + 0x394]
push str..ini
push eax
call fcn.0045fd1a
add esp, 0x28
lea eax, [ebp + 0x394]
push eax
push 0x104
push dword [ebp - 0x80]
push 0x4df45c
push str.InstallPath
push str.Globals
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [ebp - 0x80]
lea eax, [ebp + 0x18c]
push eax
call fcn.0045fd44
lea eax, [ebp + 0x18c]
push str.1.0.6.1224
push eax
call fcn.0045fd1a
lea eax, [ebp + 0x18c]
push esi
push eax
call fcn.0045fd1a
add esp, 0x18
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410106
push edi
lea eax, [ebp - 0x7a]
push ebx
push eax
mov word [ebp - 0x7c], bx
call fcn.0045fa70
lea eax, [ebp + 0x18c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x7c]
push str.SCConfig.exe
push eax
call fcn.0045fd1a
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x410130
mov edi, dword [ebp - 0x80]
push ebx
push 0x26
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
push edi
call fcn.0045fd1a
push str.SmartCloudInput
push edi
call fcn.0045fd1a
push esi
push edi
call fcn.0045fd1a
add esp, 0x18
mov ecx, dword [ebp + 0x59c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x5a0
leave
ret
Function at 0x410fba
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x414], 0
push esi
mov esi, 0x206
push esi
lea eax, [ebp - 0x412]
push 0
push eax
call fcn.0045fa70
and word [ebp - 0x20c], 0
push esi
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0045fa70
add esp, 0x18
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x414]
push str.SCMBManager.exe
push eax
call fcn.0045fd1a
mov esi, 0x4c6d40
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0045fd44
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push str._CheckSysMb
push eax
call fcn.0045fd1a
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop esi
je 0x411093
lea eax, [ebp - 0x20c]
push eax
call fcn.0042c6af
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045fa14
leave
ret

Function at 0x41109f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x414], 0
push esi
mov esi, 0x206
push esi
lea eax, [ebp - 0x412]
push 0
push eax
call fcn.0045fa70
and word [ebp - 0x20c], 0
push esi
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0045fa70
add esp, 0x18
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x414]
push str.SCImeManager.exe
push eax
call fcn.0045fd1a
mov esi, 0x4c6d40
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0045fd44
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push str._SetDefaultIme
push eax
call fcn.0045fd1a
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop esi
je 0x411178
lea eax, [ebp - 0x20c]
push eax
call fcn.0042c6af
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045fa14
leave
ret
Function at 0x411184
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
push str.DoRunRegImeInterFace
call fcn.00430a48
pop ecx
call fcn.00407611
mov ecx, eax
call fcn.00451a87
mov ecx, eax
call fcn.004070c1
test eax, eax
je 0x4111c0
push str.SCPower64.exe
jmp 0x4111c5
push str.SCPower32.exe
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x20c]
push 0x4c3cf0
push eax
call fcn.00460936
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41127e
push str.znySrf
lea eax, [ebp - 0x414]
push str._InstallIME__s
push eax
call fcn.00460936
add esp, 0xc
call fcn.00404dc4
mov ecx, eax
call fcn.0042d0a3
test eax, eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
je 0x41124d
call fcn.0042c7fd
lea eax, [ebp - 0x414]
push eax
push str.DoRunRegImeInterFace_Parameter__s
call fcn.00430859
add esp, 0x10
jmp 0x41127e
lea eax, [ebp - 0x61c]
push str.__s___s
push eax
call fcn.00460936
lea eax, [ebp - 0x61c]
push eax
push str.DoRunRegImeInterFace_Cmd__s
call fcn.00430859
lea eax, [ebp - 0x61c]
push eax
call fcn.0042c6af
add esp, 0x1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045fa14
leave
ret

Function at 0x41128a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x414], 0
push esi
mov esi, 0x206
push esi
lea eax, [ebp - 0x412]
push 0
push eax
call fcn.0045fa70
and word [ebp - 0x20c], 0
push esi
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0045fa70
add esp, 0x18
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x414]
push str.SCWizard.exe
push eax
call fcn.0045fd1a
mov esi, 0x4c6d40
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0045fd44
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push str._RunAutoLoadDict
push eax
call fcn.0045fd1a
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop esi
je 0x411363
lea eax, [ebp - 0x20c]
push eax
call fcn.0042c6af
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045fa14
leave
ret

Function at 0x411431
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
call fcn.00410fba
mov ecx, esi
pop esi
jmp fcn.00411184