joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466d54
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x466d7c
xor al, al
jmp 0x466e49
call fcn.00453ae6
test al, al
je 0x466da5
std
pop esp
js 0x466d81
or dl, byte [ecx + 0x5f]
mov ah, 0x66
mov eax, dword [0x14ea0cf1]
mov edx, es
adc al, 0x8c
ret 0xd46e
outsb dx, byte [esi]
aam 0xcf
lodsd eax, dword [esi]
dec esp
int3
call fcn.004538be
test al, al
je 0x466dce
aas
or al, 0xec
xor byte [esi + 0x79ec4e43], ah
jns 0x466e09
adc eax, 0x8ad46110
xchg edi, eax
dec eax
dec esp
stc
pop ebp
xor dword [edx], edi
pop edi
leave
jae 0x466d93
outsb dx, byte [esi]
in al, dx
loope fcn.00466d54
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ecx], eax
call fcn.0047071d
mov esi, eax
mov dword [ebp - 8], esi
pop ecx
test esi, esi
je 0x466d75
call fcn.00453c3f
test al, al
je 0x466e23
mov eax, dword [0xe1bf7bda]
mov edx, ebx
and byte [0xe69bbef], bl
jnp 0x466dca
loope 0x466d96
fisub dword [eax]
sbb eax, 0xe69bbef
jmp 0x9db5389a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 0x18]
push dword [ecx]
push eax
push esi
call fcn.00482230
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x467953
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x5e6755
call fcn.00470bca
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
and dword [ebp - 0x24c], 0
push 0x208
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00483520
Function at 0x467f8d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x5e8259
call fcn.00470b96
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0046671d
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004667e3
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x467fcd
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46802d
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x468008
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46802d
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00466730
call fcn.00470b5f
ret
Function at 0x468f3e
Capabilities:
Set registry value

Disassembly:
hlt
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0xc]
call edi
call fcn.00453b70
test al, al
je 0x468edf
xor esp, ebp
jae 0x468f24
mov edi, 0xf67ac3bd
jge 0x468e88
pop esp
dec edx
idiv dword [edx]
invalid
call fcn.004538be
test al, al
je 0x468eff
fsub dword [ebp + 0x4e]
pop edi
sti
adc dword [ebx - 0x4b43a5f], ecx
dec edi
mov eax, 0x4ba11f96
push ebp
loope 0x468f62
xor ebx, dword [edi - 0x17]
call fcn.004537aa
test al, al
je 0x468f2d
xor dl, byte [ebp + 0x3177d55a]
out 0x92, al
xchg edx, eax
push ds
ja 0x468ea9
pop edi
mov esp, 0xfeab431e
sub dword [esi], eax
cmpsd dword [esi], dword es:[edi]
push ebx
insb byte es:[edi], dx
sti
lcall 0xb92, 0xd878cd8b
mov byte [ebx + 0x5e90003d], cl
xchg edx, eax
or ecx, dword [eax - 0x6fffc275]
pop esi
cmp eax, sym.imp.ADVAPI32.dll_RegCloseKey
add bh, bh
jne 0x468f28
push dword [ebp - 8]
call edi
push dword [ebp - 4]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.00453cc9
test al, al
je 0x468f78
jnp 0x468f0f
sar dword [edx], cl
lahf
int1
movsb byte es:[edi], byte [esi]
and dword [edi], ecx
or eax, 0x21bf121d
or eax, 0x779e3415
and al, 0x2a
int1
adc dword [edi + ebp*4 - 0x29], eax
jmp 0x468faa
lea eax, [ebp - 0xc]
mov esi, 0xf013f
push eax
push esi
push ebx
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4690ae
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4690a5
hlt
call fcn.00453b2b
test al, al
je 0x468fd4
scasb al, byte es:[edi]
pushfd
not dword [esi - 0x544e0741]
push esp
lahf
adc al, 0x1a
ret 0x15f6
call fcn.004537ef
test al, al
je 0x468ff8
invalid
call fcn.004537ef
test al, al
je 0x46901c
test dword [ecx - 0x512ab251], ebp
pushfd
and eax, 0x8c2afda0
invalid
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf013f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x46904e
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
jmp 0x4690ae
push dword [ebp + 0x14]
call fcn.00491bc7
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00453720
test al, al
je 0x46909c
push ebp
push esi
ljmp 0xcb05
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4690b5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.00453cc9
test al, al
je 0x4690eb
push edi
out dx, eax
mov dword [0x5da1fb0], eax
ret 0x5862
lea eax, [ebp - 4]
mov esi, 0xf013f
push eax
push esi
push ebx
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4691ef
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x469136
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4691ef
call fcn.00453b2b
test al, al
je 0x469151
sal dword [edi + 0x46], 0xd3
retf 0x817a
call fcn.004537ef
test al, al
je 0x469175
dec ebx
lds edx, [eax - 0x45]
jge 0x4691a1
mov ebp, 0x425b8a8d
jne 0x4691ab
and eax, 0x809d31c1
lodsb al, byte [esi]
mov ecx, 0x22af019d
inc ebx
pop ecx
inc edx
call fcn.004537ef
test al, al
je 0x469199
jle 0x469136
add al, 0xce
inc ecx
fcomp st(2)
wait
sti
xchg edi, eax
push esi
mov al, byte [0xf4bd382a]
pop es
xchg edx, eax
into
cwde
dec ebx
adc byte [ebx - 0x1c], cl
wait
xchg ebx, eax
push dword ss:[ebp + 0x10]
push dword [ebp + 0x10]
call fcn.00491bc7
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x10]
jne 0x4691bd
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.00453720
test al, al
je 0x4691df
jae 0x469198
pop esi
and eax, 0xd7440948
add al, 0xf5
jno 0x4691fe
cmp bh, byte [ebx + 0x7c]
enter 0x4e6a, 0xffffffffffffff96
dec ebx
retf
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
hlt
Function at 0x4691f6
Capabilities:
Set registry value

Disassembly:
inc esp
xlatb
jne 0x4691da
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
call fcn.00453cc9
test al, al
je 0x469227
lahf
push esi
jge 0x4691cc
pop eax
and eax, 0x3e110d89
mov eax, 0x3689f7de
sahf
pop ebx
mov byte [0xfeaa13e8], al
inc dword [eax + eax*8 - 0x7a33e48c]
or byte [ebx], 3
call fcn.00453c3f
test al, al
je 0x46924b
stosb byte es:[edi], al
invalid
int3
jnp 0x469257
add eax, 0x3eef8127
cmp dword [ebx - 0x177e797d], ecx
inc ecx
mov eax, dword [ebx + 0x41e88186]
aaa
ja 0x4691e0
dec ebp
push es
jp 0x46929e
call fcn.00453bfa
test al, al
je 0x46926d
daa
mov ebp, dword [edx - 0x13a171b1]
dec edi
mov ds, word [esi - 0x14]
push ebx
dec esi
fstp dword [ecx]
and byte ds:[eax], bh
test dword [edx - 0x5da73e30], edi
push es
pop eax
loope 0x469229
fisttp qword [ebp - 0x24cc0bbb]
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0xf013f
push ebx
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4693c2
call fcn.00453bfa
test al, al
je 0x4692b8
jle 0x46923d
ja 0x469318
jns 0x469235
xchg ebp, eax
mov edx, 0x191a8f6c
sbb dword [ecx - 0x63faa05c], 0xffffffac
stc
fcom dword [edx + 0x14609e68]
les esi, [ebx + 0x2e]
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4692e4
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4693c2
call fcn.00453cc9
test al, al
je 0x46930a
push 0xffffffffffffffe3
aaa
sbb dword [esi], edi
std
mov al, byte [0x2572ee2a]
xchg edi, eax
push ebx
test byte [edi - 0xbd8913f], al
sti
ret
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x46933b
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x4693c0
call fcn.00453720
test al, al
je 0x469364
cmpsb byte [esi], byte es:[edi]
or byte [edx + eax*8 + 0x14], bh
cwde
push ecx
add eax, 0x63676b80
dec esi
invalid
call fcn.00453bb5
test al, al
je 0x469389
ljmp 0x94eb:0xc3b2306b
push dword [ebp + 0x14]
call fcn.00491bc7
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4699cb
Capabilities:
Read file via mapping

Disassembly:
push 0x28
mov eax, 0x5df898
call fcn.00470bca
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x1c], eax
je 0x469a21
mov ebx, str.Global_
push ebx
call fcn.00491bc7
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00402b90
xor ebx, ebx
cmp word [esi], bx
jne 0x469a2a
mov eax, ebx
jmp 0x469a31
push esi
call fcn.00491bc7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00405d30
lea eax, [ebp - 0x28]
cmp edi, eax
je 0x469a4d
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
call fcn.00402a70
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
test edi, edi
je 0x469ae3
xor eax, eax
push eax
push eax
push eax
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x469a87
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x469ae3
push 0
push dword [ebp - 0x2c]
lea eax, [esi + 4]
push eax
call fcn.0045808a
add esp, 0xc
test al, al
je 0x469ad5
push dword [esi]
call fcn.0047071d
mov dword [ebp - 0x2c], eax
pop ecx
test eax, eax
je 0x469ad5
push dword [esi]
push 0
push eax
call fcn.00483520
push dword [esi]
mov ebx, dword [ebp - 0x2c]
lea eax, [esi + 0x28]
push eax
push ebx
call fcn.00482230
mov eax, dword [ebp - 0x30]
add esp, 0x18
mov ecx, dword [ebp - 0x34]
mov dword [eax], ebx
mov bl, 1
mov eax, dword [esi]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0041ed70
mov al, bl
call fcn.00470b74
ret

Function at 0x469eae
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 0xc]
push edi
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00404170
call fcn.0045c14c
and dword [ebp - 0x24], 0
lea edi, [ebp - 0x20]
add esp, 0x18
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x614
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x46a078
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x42c
mov eax, 0x5e6aa8
call fcn.00470bca
mov edi, ecx
mov esi, 0x208
lea eax, [ebp - 0x420]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00483520
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00483520
add esp, 0x18
lea eax, [ebp - 0x438]
mov ecx, edi
push eax
call fcn.0046a811
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push str.Dict
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
push 0x5eeb20
push eax
call fcn.00407e80
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00491c13
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.00491be2
lea eax, [ebp - 0x218]
push 0x5e9bd4
push eax
call fcn.00491be2
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
add esp, 0x28
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x469fe4
push 0
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00469eae
call fcn.00452f01
mov ecx, eax
call fcn.0046b436
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00491c13
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.00491be2
lea eax, [ebp - 0x218]
push 0x5e9bd4
push eax
call fcn.00491be2
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x46a04e
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00469eae
push 0
push 1
lea ecx, [ebp - 0x438]
call fcn.0041ed70
call fcn.00470b74
ret
jmp 0x469f07

Function at 0x46a07d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.00483520
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00483520
add esp, 0x18
call fcn.00452f01
mov ecx, eax
call fcn.0046b446
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00491c13
lea eax, [ebp - 0x414]
push str.WnWizard.exe
push eax
call fcn.00491be2
mov esi, 0x5eb488
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00491c13
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00491be2
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00491be2
lea eax, [ebp - 0x20c]
push str._RunAutoLoadDict
push eax
call fcn.00491be2
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46a14c
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
call int.0045e6c6
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x46a229
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.00483520
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00483520
add esp, 0x18
call fcn.00452f01
mov ecx, eax
call fcn.0046b446
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00491c13
lea eax, [ebp - 0x414]
push str.WnDictManager.exe
push eax
call fcn.00491be2
mov esi, 0x5eb488
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00491c13
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00491be2
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00491be2
lea eax, [ebp - 0x20c]
push str._CheckSysMb
push eax
call fcn.00491be2
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46a2f8
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
call int.0045e6c6
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x46a308
Capabilities:
Check if file exists

Disassembly:
push 0x658
mov eax, 0x5e6b47
call fcn.00470bca
push str.DoRunRegImeInterFace
call fcn.0045292f
pop ecx
lea ecx, [ebp - 0x664]
call fcn.0046671d
xor ebx, ebx
lea ecx, [ebp - 0x664]
mov dword [ebp - 4], ebx
call fcn.004667e3
mov dword [ebp - 0x630], ebx
push 7
pop esi
mov dword [ebp - 0x62c], esi
test eax, eax
je 0x46a378
xor eax, eax
mov edi, str.WnRegIme64.exe
push edi
mov word [ebp - 0x640], ax
call fcn.00491bc7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x640]
call fcn.00402b90
mov byte [ebp - 4], 1
jmp 0x46a39e
xor eax, eax
mov edi, str.WnRegIme32.exe
push edi
mov word [ebp - 0x640], ax
call fcn.00491bc7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x640]
call fcn.00402b90
mov byte [ebp - 4], 2
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
call fcn.00452f01
mov ecx, eax
call fcn.0046b446
push eax
lea eax, [ebp - 0x218]
push 0x5ecf50
push eax
call fcn.00407e80
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x640]
push ebx
push 1
call fcn.0041ed70
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46a4d1
mov dword [ebp - 0x62c], esi
xor eax, eax
mov esi, str._InstallIME
mov dword [ebp - 0x630], ebx
push esi
mov word [ebp - 0x640], ax
call fcn.00491bc7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x640]
call fcn.00402b90
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x640]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00407e80
pop ecx
pop ecx
call fcn.0045d198
test eax, eax
lea eax, [ebp - 0x420]
je 0x46a484
push 0xffffffffffffffff
push ebx
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0045e61c
lea eax, [ebp - 0x420]
push eax
push str.DoRunRegImeInterFace_Parameter__s
call fcn.0045292f
add esp, 0x18
jmp 0x46a4c1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___s
push eax
call fcn.00407e80
lea eax, [ebp - 0x628]
push eax
push str.DoRunRegImeInterFace_Cmd__s
call fcn.0045292f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x628]
push ebx
push eax
call int.0045e6c6
add esp, 0x2c
push ebx
push 1
lea ecx, [ebp - 0x640]
call fcn.0041ed70
jmp 0x46a4e4
lea eax, [ebp - 0x218]
push eax
push str.PathFileExists_false_file___s
call fcn.0045292f
pop ecx
pop ecx
lea ecx, [ebp - 0x664]
call fcn.00466730
call fcn.00470b74
ret
Function at 0x46a607
Capabilities:
Check if file exists
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0046a078
mov ecx, esi
call fcn.0046a229
mov ecx, esi
call fcn.0046a224
mov ecx, esi
call fcn.0046a308
mov ecx, esi
pop esi
jmp 0x46a6de
push 0x23c
mov eax, 0x5e6beb
call fcn.00470bca
call fcn.00452f01
mov ecx, eax
call fcn.0046b446
push eax
lea ecx, [ebp - 0x230]
call fcn.00404170
mov esi, str.WanNengWBInfo.ini
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.00491bc7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.00405d30
mov esi, 0x5e9bd4
push esi
call fcn.00491bc7
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x230]
call fcn.0045727e
cmp eax, 0xffffffff
je 0x46a7fd
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.004198f0
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push edi
push eax
call fcn.00483520
add esp, 0xc
lea eax, [ebp - 0x218]
push edi
push 0x1c
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push str.VirtualStore_
push eax
call fcn.00491be2
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00491be2
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46a7ef
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x218]
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
push eax
call fcn.00454bbd
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x248]
call fcn.0041ed70
push edi
push 1
lea ecx, [ebp - 0x230]
call fcn.0041ed70
call fcn.00470b74
ret

Function at 0x46afac
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.0046ad91
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.UserID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x46aff2
mov dword [esi], eax
mov bl, 1
jmp 0x46aff4
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0041ed70
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret 4

Function at 0x46b094
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.0046ad91
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.UserID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
lea ecx, [ebp - 0x1c]
push 0
push 1
setg bl
call fcn.0041ed70
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret