joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42546b
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.00437070
mov eax, dword [0x62e10c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x200c], edi
mov dword [ebp - 0x2008], eax
call fcn.00425328
test eax, eax
je 0x425615
xor ebx, ebx
push ebx
call fcn.00449e5c
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2018]
push eax
mov dword [ebp - 0x2014], edx
call fcn.00452bb3
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0x2008]
mov ecx, dword [esi + 0x10]
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00425159
add esp, 0x28
call fcn.00424e1d
test al, al
je 0x425523
mov bl, 0xf9
invalid
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
inc esi
test eax, eax
cmovne ebx, esi
mov dword [ebp - 0x200c], ebx
call fcn.0042508a
test al, al
je 0x425554
hlt
push 0x5a7f80
push edi
call fcn.004530ad
mov ebx, eax
mov dword [ebp - 0x2010], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x425615
cmp dword [ebp - 0x200c], 0
jne 0x425597
push ebx
push 2
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0xfeff
push esi
push eax
call fcn.004548f3
add esp, 0x10
call fcn.00424fbb
test al, al
je 0x4255b8
dec eax
adc eax, dword [edi + esi - 0x6c2c986b]
insb byte es:[edi], dx
push ds
lodsd eax, dword [esi]
pop ebp
js 0x42561a
mov edx, 0x9d8b192e
invalid
lea eax, [ebp - 0x2004]
push eax
call fcn.004549af
push ebx
add eax, eax
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call fcn.004548f3
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xd
push 1
push eax
call fcn.004548f3
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xa
push 1
push eax
call fcn.004548f3
push ebx
call fcn.00452eab
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043671f
mov esp, ebp
pop ebp
ret
Function at 0x426902
Capabilities:
Get common file path

Disassembly:
push 0x138
mov eax, 0x5a435e
call fcn.00437119
mov al, byte [0x6330a9]
test al, al
jne 0x4269cb
push 0x104
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.00446a10
add esp, 0xc
lea eax, [ebp - 0x114]
xor edi, edi
inc edi
push edi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4269c6
push str.config_systemprofile
lea ecx, [ebp - 0x12c]
call fcn.004019a0
lea eax, [ebp - 0x114]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x144]
call fcn.004019a0
push dword [ebp - 0x11c]
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
push esi
cmovae eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x144]
push eax
call fcn.00409280
movzx ecx, byte [0x6330a9]
cmp eax, 0xffffffff
push esi
cmovne ecx, edi
mov byte [0x6330a9], cl
lea ecx, [ebp - 0x144]
push edi
call fcn.00401ce0
push esi
push edi
lea ecx, [ebp - 0x12c]
call fcn.00401ce0
mov al, byte [0x6330a9]
call fcn.004370d4
ret
Function at 0x427c51
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x62e10c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00446a10
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.00424eec
test al, al
je 0x427cc4
pop esi
sbb dl, bl
imul ebp, dword [ebp - 0x3d], 0x33cc96cd
mov dl, 0x2e
cmp eax, 0x51084118
rcr dword [ecx + 0x19], 1
xor dl, byte [edi]
push 0x67
add dword [ebx + 0x37e8fa6d], edx
sar edi, cl
inc dword [eax + eax*8 - 0x174de18c]
call fcn.00425000
test al, al
je 0x427ceb
mov dl, 0xe8
inc esp
pop ebp
mov dl, al
push eax
add eax, 0x2a4959eb
push es
mov ecx, 0x4e89033f
mov dl, 0xf4
test eax, 0xa473b700
js 0x427c82
cmp dword [ebp - 0x75], ecx
mov ebp, 0xfffffee4
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x118]
call fcn.00424bb0
test al, al
je 0x427d1f
push 0x78da9a11
xor al, 0xb1
or bh, byte [edx + 0x16]
retf 0x5113
cmp edi, 5
jg 0x427d2e
cmp esi, 2
jg 0x427d2e
xor eax, eax
inc eax
jmp 0x427d30
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043671f
mov esp, ebp
pop ebp
ret
Function at 0x4285f8
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x5a4569
call fcn.00437119
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x4287e5
push eax
lea ecx, [ebp - 0x40]
call fcn.004018d0
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.004216ec
mov edi, 0x22c
lea eax, [ebp - 0x284]
push edi
push 0
push eax
call fcn.00446a10
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x28c], esi
cmp esi, 0xffffffff
je 0x4287d5
call fcn.00424eec
test al, al
je 0x42867a
arpl word [edx - 0xf6b4ada], bx
push 0x56e2d127
pop ecx
aaa
xchg bh, al
pop es
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x428752
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x4286b9
lea eax, [ebp - 0x260]
push eax
call fcn.004549af
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00401ac0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.004216ec
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403040
test eax, eax
je 0x42870d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00427df1
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.00403040
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x428714
mov byte [ebp - 0x285], 1
test bl, 1
je 0x428728
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.00401a00
cmp byte [ebp - 0x285], 0
jne 0x4287eb
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00401a00
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x428692
call fcn.00425000
test al, al
je 0x428782
adc al, 0xb
outsb dx, byte [esi]
xlatb
leave
add al, 0xd3
stc
xor eax, 0x10c374a3
xor ch, byte [esi - 0x4644d9cb]
ror byte [edi - 0x4405bd58], 0xe3
inc edi
insd dword es:[edi], dx
pop edi
pop ss
psubsb mm2, qword [0x84ffffc3]
sal byte [ecx + ebx - 0x4c], 0x90
call fcn.00424a9c
test al, al
je 0x4287a4
mov ah, 0x90
stosb byte es:[edi], al
dec ebx
sbb al, 0x20
pushfd
and dl, byte [edx - 0x6674f729]
cmpsb byte [esi], byte es:[edi]
add al, 0x9e
popfd
cmp cl, bl
sbb al, 0x29
cmp dword [ebx + edx - 0x3a5a17e0], ecx
invalid
call fcn.00424d4e
test al, al
je 0x4287c9
popal
mov dword [ecx - 0x2f], ebp
out dx, al
jbe 0x428735
cmp al, 0xb0
or dword [eax + 0x24d3d975], eax
out dx, al
invalid
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00401a00
mov eax, esi
call fcn.004370d4
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00401a00
jmp 0x4287d7
Function at 0x428e0b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.00446a10
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x2c], eax
mov eax, 0x200
lea ecx, [eax + 0x40]
cmovne eax, ecx
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], eax
call fcn.00427c51
test eax, eax
mov ecx, str.runas
lea eax, [ebp - 0x3c]
cmovne ecx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x428e7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, edi
cmove eax, ecx
jmp 0x428e91
cmp dword [ebp + 0x10], 0
je 0x428e8f
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x429562
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x62e10c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x82c]
push edi
push 0x44
xor ebx, ebx
push ebx
push eax
call fcn.00446a10
push 0x10
lea eax, [ebp - 0x7e4]
mov dword [ebp - 0x82c], 0x44
push ebx
push eax
call fcn.00446a10
add esp, 0x18
call fcn.00424bb0
test al, al
je 0x4295d2
dec ecx
mov ah, 0xfc
sbb al, 0x57
stc
sub dword [ebx + 0x691db211], ecx
or ebp, dword [esi - 0x69]
lea eax, [eax]
dec ebx
sub dh, dl
and byte [ecx], ch
and ebp, 0xb9e55966
cmp byte [edx - 0x54], dl
xor ebx, ebx
push esi
lea eax, [ebp - 0x7d4]
push 0x5a8194
push eax
call fcn.004074d0
add esp, 0xc
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x82c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x429694
push 0xffffffffffffffff
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x7e8]
push eax
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call fcn.00424d09
test al, al
je 0x429657
pop ecx
add ebx, dword [ebp - 0x79114ea1]
xor eax, dword [edi - 0x11]
aaa
pop ecx
push esp
test al, 0xf6
cmp eax, 0xb22ef391
fiadd word [ebx - 0x16a451bd]
pop esp
call fcn.00424bb0
test al, al
je 0x42967e
invalid
mov eax, 0xe73bb5bb
xlatb
mov ebp, fs
jl 0x42965a
jae 0x429602
mov dh, 0xb4
pop esp
ret
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043671f
mov esp, ebp
pop ebp
ret
Function at 0x42e98c
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x5a4e3b
call fcn.00437119
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
and dword [ebp - 0x24c], 0
or al, 0x8b
pop ebp
or byte [ebx - 0x24b5b], al
inc dword [eax]
push 0x208
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00446a10
add esp, 0xc
call fcn.00424e1d
test al, al
je 0x42e9df
leave
pop ss
xor byte [edi + 0x16], bh
adc eax, 0x87216ecf
vpcmpgtd ymm0, ymm6, ymm2
jae 0x42e99d
adc eax, 0x10468
add byte [ebp - 0x2177b], cl
push dword [ebx]
not byte [eax + 0x56]
push 0x104
lea eax, [ebp - 0x218]
xor esi, esi
push eax
push esi
jmp 0x42eae7
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42ead9
call fcn.00424eec
test al, al
je 0x42ea29
sub eax, 0x6fb92df0
outsb dx, byte [esi]
cwde
std
push 0xa8c9a4b7
insb byte es:[edi], dx
shl cl, 1
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x42ea59
lea eax, [ebp - 0x218]
push eax
call fcn.004549af
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00401ac0
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.004284b6
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00401a00
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push dword [ebp - 0x250]
call fcn.0042a45b
pop ecx
pop ecx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.00401ce0
push 0x104
lea eax, [ebp - 0x218]
inc esi
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x42e9f3
call fcn.004370d4
ret

Function at 0x42efc6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x5a640b
call fcn.004370e5
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.004315e4
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004316aa
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x42f006
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42f066
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42f041
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42f066
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.004315f7
call fcn.004370bf
ret
Function at 0x42fcb1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
call fcn.00425114
test al, al
je 0x42fce2
xor al, 0x3b
push ebp
xchg edx, eax
sahf
sub eax, 0xa986601e
invalid
call fcn.0042508a
test al, al
je 0x42fd06
mov dword [0x7c71afaf], eax
pop ss
dec esp
cmp eax, eax
xchg dword es:[ebx], ecx
xorps xmm0, xmm3
mov dword [0x8fd4a109], eax
adc byte [edx + 0x18], bh
cmp eax, 0xe88ae652
cmp dl, byte [ebx - 1]
inc dword [eax + eax*8 + 0x57661974]
ret
call fcn.00425045
test al, al
je 0x42fd28
push di
mov byte [esi - 0x14], dl
outsb dx, byte [esi]
test al, 0xaa
mov ah, 0x8f
mov byte [ebx - 0xbf62c1b], dl
sal dword [edx], 0x4e
pushfd
arpl word [esi + ebx + 1], bp
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0xf013f
push ebx
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42fe7d
call fcn.00425045
test al, al
je 0x42fd73
xchg edx, esi
mov dword [ecx - 0x5d], edi
push ebp
jg 0x42fcf9
in eax, 0xa5
sub dh, bh
sti
ficom dword [esi - 0x40e9a602]
cld
xor dl, byte [0x1ba3a4f3]
and al, 0x33
fist dword [ebx - 0x73]
inc ebp
clc
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42fd9f
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42fe7d
call fcn.00425114
test al, al
je 0x42fdc5
mov al, 0xd
stosd dword es:[edi], eax
loope 0x42fd7e
push edi
aaa
adc ecx, dword [esp + 0x3b]
out 0x69, al
jo 0x42fddc
arpl word [ebx + 0x7496bf93], bx
inc ebx
pop esi
adc al, 0x25
mov ecx, 0x53db33ca
push ebx
lea eax, [ebp - 4]
inc ebp
cld
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42fdf6
jo 0x42fe38
add byte [ebp - 0xec8b40], al
jne 0x42fdde
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x42fe7b
call fcn.00424b6b
test al, al
je 0x42fe1f
xor byte [0xbdfb682e], bl
salc
invalid
call fcn.00425000
test al, al
je 0x42fe44
int1
inc esp
jp 0x42fe51
loopne 0x42fdc7
mov dl, dl
mov esp, 0x7be3c8b3
mov dl, 0x5b
adc ah, cl
sub bl, byte [eax]
inc edx
int 0x37
mov ch, 0xd3
nop
sub edi, edi
jne 0x42fe5b
int3
push dword [ebp + 0x14]
call fcn.004549af
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
add byte [eax], al
add byte [eax - 1], dl
jne 0x42fe6c
push 1
push 0
push dword [ebp + 0x10]
add bh, bh
jne 0x42fe6f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, sym.imp.ADVAPI32.dll_RegCloseKey
pop edx
add bh, bh
salc
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fe84
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 0xc]
push edi
sub esp, 0x18
mov ecx, esp
push esi
call fcn.004018d0
call fcn.00426f9d
and dword [ebp - 0x24], 0
lea edi, [ebp - 0x20]
add esp, 0x18
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x614
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x43004e
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x42c
mov eax, 0x5a4fa8
call fcn.00437119
mov edi, ecx
mov esi, 0x208
lea eax, [ebp - 0x420]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00446a10
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00446a10
add esp, 0x18
lea eax, [ebp - 0x438]
mov ecx, edi
push eax
call fcn.004307e7
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push str.Dict
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
push 0x5a83e0
push eax
call fcn.004074d0
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00454699
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.00454668
lea eax, [ebp - 0x218]
push 0x623448
push eax
call fcn.00454668
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
add esp, 0x28
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42ffba
push 0
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0042fe84
call fcn.0041f4e7
mov ecx, eax
call fcn.0042e96c
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00454699
lea eax, [ebp - 0x218]
push str.BackMB
push eax
call fcn.00454668
lea eax, [ebp - 0x218]
push 0x623448
push eax
call fcn.00454668
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x430024
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0042fe84
push 0
push 1
lea ecx, [ebp - 0x438]
call fcn.00401a00
call fcn.004370d4
ret
jmp 0x42fedd
Function at 0x430053
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x62e10c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.00446a10
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00446a10
add esp, 0x18
call fcn.0041f4e7
mov ecx, eax
call fcn.0042e97c
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00454699
lea eax, [ebp - 0x414]
push str.WnWizard.exe
push eax
call fcn.00454668
mov esi, 0x5a8080
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00454699
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00454668
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00454668
lea eax, [ebp - 0x20c]
push str._RunAutoLoadDict
push eax
call fcn.00454668
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x430122
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00428e96
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043671f
mov esp, ebp
pop ebp
ret

Function at 0x4301ff
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x62e10c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.00446a10
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00446a10
add esp, 0x18
call fcn.0041f4e7
mov ecx, eax
call fcn.0042e97c
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00454699
lea eax, [ebp - 0x414]
push str.WnDictManager.exe
push eax
call fcn.00454668
mov esi, 0x5a8080
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00454699
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00454668
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00454668
lea eax, [ebp - 0x20c]
push str._CheckSysMb
push eax
call fcn.00454668
add esp, 0x30
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4302ce
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00428e96
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043671f
mov esp, ebp
pop ebp
ret
Function at 0x4302de
Capabilities:
Check if file exists

Disassembly:
push 0x658
mov eax, 0x5a5047
call fcn.00437119
push str.DoRunRegImeInterFace
call fcn.0041f690
pop ecx
lea ecx, [ebp - 0x664]
call fcn.004315e4
xor ebx, ebx
lea ecx, [ebp - 0x664]
mov dword [ebp - 4], ebx
call fcn.004316aa
mov dword [ebp - 0x630], ebx
push 7
pop esi
mov dword [ebp - 0x62c], esi
test eax, eax
je 0x43034e
xor eax, eax
mov edi, str.WnRegIme64.exe
push edi
mov word [ebp - 0x640], ax
call fcn.004549af
pop ecx
push eax
push edi
lea ecx, [ebp - 0x640]
call fcn.00401ac0
mov byte [ebp - 4], 1
jmp 0x430374
xor eax, eax
mov edi, str.WnRegIme32.exe
push edi
mov word [ebp - 0x640], ax
call fcn.004549af
pop ecx
push eax
push edi
lea ecx, [ebp - 0x640]
call fcn.00401ac0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
call fcn.0041f4e7
mov ecx, eax
call fcn.0042e97c
push eax
lea eax, [ebp - 0x218]
push 0x5a7f4c
push eax
call fcn.004074d0
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x640]
push ebx
push 1
call fcn.00401a00
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4304a7
mov dword [ebp - 0x62c], esi
xor eax, eax
mov esi, str._InstallIME
mov dword [ebp - 0x630], ebx
push esi
mov word [ebp - 0x640], ax
call fcn.004549af
pop ecx
push eax
push esi
lea ecx, [ebp - 0x640]
call fcn.00401ac0
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x640]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004074d0
pop ecx
pop ecx
call fcn.004279fe
test eax, eax
lea eax, [ebp - 0x420]
je 0x43045a
push 0xffffffffffffffff
push ebx
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00428dec
lea eax, [ebp - 0x420]
push eax
push str.DoRunRegImeInterFace_Parameter__s
call fcn.0041f690
add esp, 0x18
jmp 0x430497
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push str.__s___s
push eax
call fcn.004074d0
lea eax, [ebp - 0x628]
push eax
push str.DoRunRegImeInterFace_Cmd__s
call fcn.0041f690
push ebx
push ebx
push ebx
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.00428e96
add esp, 0x2c
push ebx
push 1
lea ecx, [ebp - 0x640]
call fcn.00401a00
jmp 0x4304ba
lea eax, [ebp - 0x218]
push eax
push str.PathFileExists_false_file___s
call fcn.0041f690
pop ecx
pop ecx
lea ecx, [ebp - 0x664]
call fcn.004315f7
call fcn.004370d4
ret