joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b5a0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x38]
push esi
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionImeJapanIMEJPDictionaries
push eax
xor esi, esi
call fcn.0040b110
add esp, 0xc
test eax, eax
je 0x40b766
push 0x5c
push ebx
call fcn.0041a520
add esp, 8
test eax, eax
jne 0x40b75b
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 8]
push edi
push ecx
push 0x20019
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionImeJapanIMEJPDirectories
push 0x80000002
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b65a
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0x431ab0
push 0
push 0
push str.UsrDictPath
push eax
mov dword [esp + 0x28], 0x104
call edi
test eax, eax
jne 0x40b64f
push 0x104
push 0x431ab0
call fcn.00411ca0
push 0x431ab0
call fcn.0040a990
add esp, 4
push ebx
push 0x431ab0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x14]
push edx
push 0x431ab0
call fcn.0041b23f
add esp, 8
test eax, eax
je 0x40b74e
mov ebx, dword [esp + 0x44]
mov byte [0x431ab0], 0
test ebx, ebx
jne 0x40b6c1
lea eax, [esp + 0x3c]
push eax
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 0x3c]
push 0x431ab0
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x40b71f
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x3c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x40b71f
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push ecx
call esi
test eax, eax
jne 0x40b71f
lea edx, [esp + 0x44]
mov dword [esp + 0x44], 0x104
push edx
push 0x431ab0
push eax
push eax
mov eax, dword [esp + 0x1c]
push str.AppData
push eax
call edi
test eax, eax
jne 0x40b714
push ebx
push 0x104
push 0x431ab0
call fcn.0040b460
add esp, 0xc
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x431ab0
call fcn.0040a990
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
push str.MicrosoftIMEIMEJP_
push 0x431ab0
call esi
mov edx, dword [esp + 0x40]
push edx
push 0x431ab0
call esi
mov ebx, dword [esp + 0x40]
push 0x431ab0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2c
ret
mov eax, esi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x40b770
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x38]
push esi
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionImeJapanIME98Dictionaries
push eax
xor esi, esi
call fcn.0040b110
add esp, 0xc
test eax, eax
je 0x40b936
push 0x5c
push ebx
call fcn.0041a520
add esp, 8
test eax, eax
jne 0x40b92b
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 8]
push edi
push ecx
push 0x20019
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionImeJapanIME98Directories
push 0x80000002
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b82a
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0x431dbc
push 0
push 0
push str.UsrDictPath
push eax
mov dword [esp + 0x28], 0x104
call edi
test eax, eax
jne 0x40b81f
push 0x104
push 0x431dbc
call fcn.00411ca0
push 0x431dbc
call fcn.0040a990
add esp, 4
push ebx
push 0x431dbc
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x14]
push edx
push 0x431dbc
call fcn.0041b23f
add esp, 8
test eax, eax
je 0x40b91e
mov ebx, dword [esp + 0x44]
mov byte [0x431dbc], 0
test ebx, ebx
jne 0x40b891
lea eax, [esp + 0x3c]
push eax
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 0x3c]
push 0x431dbc
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x40b8ef
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x3c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x40b8ef
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push ecx
call esi
test eax, eax
jne 0x40b8ef
lea edx, [esp + 0x44]
mov dword [esp + 0x44], 0x104
push edx
push 0x431dbc
push eax
push eax
mov eax, dword [esp + 0x1c]
push str.AppData
push eax
call edi
test eax, eax
jne 0x40b8e4
push ebx
push 0x104
push 0x431dbc
call fcn.0040b460
add esp, 0xc
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x431dbc
call fcn.0040a990
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
push str.MicrosoftIMEIMEJP98_
push 0x431dbc
call esi
mov edx, dword [esp + 0x40]
push edx
push 0x431dbc
call esi
mov ebx, dword [esp + 0x40]
push 0x431dbc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2c
ret
mov eax, esi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x40b940
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push str.SoftwareMicrosoftIMEmsime97Dictionaries
push eax
xor edi, edi
call fcn.0040b110
add esp, 0xc
test eax, eax
je 0x40b9ab
push 0x5c
push esi
call fcn.0041a520
add esp, 8
test eax, eax
jne 0x40b9a3
push 0x104
push 0x4318a8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4318a8
call fcn.0040a990
add esp, 4
push esi
push 0x4318a8
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4318a8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
mov eax, 1
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x40e010
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x204
push ebx
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
lea eax, [esp + 0x10]
push 0x42cdf0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x10]
push ecx
call ebx
mov edx, dword [esp + 0x218]
mov ecx, dword [esp + 0x214]
lea eax, [esp + eax + 0x10]
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea edx, [esp + 0x10]
push str.
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
push eax
call ebx
mov edx, dword [0x432d70]
lea ecx, [esp + 0x10]
push eax
push ecx
shl edx, 4
push edx
push 0
push edi
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [0x432d70]
mov ecx, eax
inc eax
cmp ecx, 0x32
mov dword [0x432d70], eax
jle 0x40e0a7
mov dword [0x432d70], 0
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push str.WHSETUP.LOG
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov esi, eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0xc]
push 0
lea eax, [esp + 0x14]
push edx
push eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x18]
push eax
push ecx
push esi
call ebx
lea edx, [esp + 0xc]
push 0
push edx
push 2
push 0x42cdd4
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
add esp, 0x204
ret
Function at 0x40e820
Capabilities:
Delete registry key

Disassembly:
push ecx
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e867
mov ecx, dword [esp + 4]
push str.imejp98
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x40e85c
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x40e870
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0xf003f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall4303A9B0_9D72_11D1_B11A_00C04FDDB82E
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e8cb
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push eax
push str.SystemComponent
push edx
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40e8c0
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x40e8e0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x31c
push ebp
push esi
mov esi, dword [esp + 0x328]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 8
je 0x40e906
pop esi
xor eax, eax
pop ebp
add esp, 0x31c
ret
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esi + 4]
lea ecx, [esp + 0x10]
push eax
push ecx
call ebp
lea edx, [esp + 0x10]
push str.0411
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40e936
pop esi
xor eax, eax
pop ebp
add esp, 0x31c
ret
push ebx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], bl
push str.SystemCurrentControlSetControlKeyboard_Layouts_
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x24]
push eax
call ebp
lea ecx, [esp + 0x20]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ecx
call esi
lea edx, [esp + 0x20]
push edx
push str.IsZonbieIME_szKey_s
call fcn.0040dff0
add esp, 8
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push 0x20019
push ebx
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ea5a
mov ecx, 0x40
lea edi, [esp + 0x125]
mov byte [esp + 0x124], bl
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0x14]
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x128]
mov dword [esp + 0x14], 0x104
push eax
push ebx
push ebx
push str.Ime_File
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ea5a
mov eax, dword [esp + 0x334]
cmp eax, ebx
je 0x40e9f6
lea edx, [esp + 0x124]
push edx
push eax
call ebp
lea eax, [esp + 0x228]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x228]
push 0x42b908
push ecx
call esi
lea edx, [esp + 0x124]
lea eax, [esp + 0x228]
push edx
push eax
call esi
lea ecx, [esp + 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
lea edx, [esp + 0x228]
push esi
push edx
push str.IsZonbieIME_file_s_dw_d
call fcn.0040dff0
add esp, 0xc
cmp esi, 0xffffffff
jne 0x40ea5a
mov ebx, 1
push ebx
push str.IsZonbieIME_fRet_d
call fcn.0040dff0
add esp, 8
mov eax, ebx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x31c
ret
Function at 0x40ea80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x218
lea eax, [esp]
push ebp
xor ebp, ebp
push eax
push 0x20019
push ebp
push str.SystemCurrentControlSetControlKeyboard_Layouts
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40eba7
push esi
push str.RemoveZombieHKLFromHKLList
call fcn.0040dff0
add esp, 4
lea ecx, [esp + 0x10]
xor esi, esi
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push esi
push esi
push esi
lea eax, [esp + 0x28]
push edx
push eax
push esi
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x40eb9b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
lea edx, [esp + 0x124]
lea eax, [esp + 0x20]
push edx
push eax
call fcn.0040e8e0
add esp, 8
test eax, eax
je 0x40eb64
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x40eb64
push 0x80000002
mov ebp, 1
call edi
lea eax, [esp + 0x124]
or esi, 0xffffffff
push eax
push str.RemoveZombieHKLFromHKLList_file_s
call fcn.0040dff0
add esp, 8
lea ecx, [esp + 0x124]
push str.imejp.ime
push ecx
call ebx
test eax, eax
jne 0x40eb64
call fcn.0040e870
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x30]
inc esi
push eax
push ecx
push esi
push edx
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x40eafb
pop edi
pop ebx
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
push ebp
push str.RemoveZombieHKLFromHKLList_fRemoved_d
call fcn.0040dff0
add esp, 8
call fcn.0040e870
call fcn.0040e820
mov eax, ebp
pop ebp
add esp, 0x218
ret
Function at 0x40ebd0
Capabilities:
Get common file path
Set registry value

Disassembly:
sub esp, 0x20c
lea eax, [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14]
push 0x42b908
push ecx
call esi
lea edx, [esp + 0x14]
push str.imeimjp8_1Help
push edx
call esi
lea eax, [esp + 0x14]
push 0x42b908
push eax
call esi
mov eax, dword [0x42bd10]
test eax, eax
je 0x40ecca
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x42bd10
mov esi, eax
cmp dword [eax], 1
jne 0x40ec4e
lea ecx, [esp + 0x118]
push str.SOFTWAREMicrosoftWindowsHelp
push ecx
jmp 0x40ec60
cmp dword [esi], 2
jne 0x40ecca
lea edx, [esp + 0x118]
push str.SOFTWAREMicrosoftWindowsHTML_Help
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
lea ecx, [esp + 0x130]
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40ecb4
lea edx, [esp + 0x14]
push edx
call ebx
mov edx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x18]
lea ecx, [esi + 4]
push eax
push 1
push 0
push ecx
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esi + 0x108]
add esi, 0x108
test ecx, ecx
mov eax, esi
jne 0x40ec3a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x40ed50
Capabilities:
Enumerate gui resources

Disassembly:
push esi
push edi
push str.imjp81.ime
call fcn.004023e0
add esp, 4
mov edi, eax
push 0
push str.Progman
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push edi
push esi
push str.SwitchKLToSatori___change_kl___hWnd_x__hKL_x
call fcn.0040dff0
add esp, 0xc
test esi, esi
je 0x40ed8f
push edi
push 1
push 0x50
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
push 0x40ed10
call dword [sym.imp.USER32.dll_EnumWindows]
pop edi
pop esi
test eax, eax
je 0x40edaf
push str.SwitchKLToSatori___Enum_proc_succeeded
call fcn.0040dff0
add esp, 4
ret
push str.SwitchKLToSatori___Enum_proc_failed
call fcn.0040dff0
pop ecx
ret
Function at 0x40f440
Capabilities:
Set registry value

Disassembly:
sub esp, 0x69c
push ebp
push str.imjp8.ime
call fcn.004023e0
xor ebp, ebp
add esp, 4
cmp eax, ebp
je 0x40f468
push eax
push 0x80000001
call fcn.00402040
add esp, 8
push ebx
push esi
push edi
mov ecx, 0x1e
mov esi, str.SoftwareMicrosoftCTFTIP_sLanguageProfile0x00000411_s
lea edi, [esp + 0x1c]
lea eax, [esp + 0x4a4]
push 0x104
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.ole32.dll_StringFromGUID2]
push eax
push 0x425630
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call esi
lea ecx, [esp + 0x29c]
push 0x104
push ecx
push 0x425640
call esi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0x29c]
lea eax, [esp + 0x4a4]
push edx
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x9c]
push ecx
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push eax
push ecx
push ebp
push 0xf003f
push ebp
push ebp
lea edx, [esp + 0xac]
push ebp
push edx
push 0x80000001
call ebx
test eax, eax
jne 0x40f52e
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 4
push eax
push 4
push ebp
push str.Enable
push ecx
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x29c]
push 0x104
push eax
push 0x425650
call esi
lea ecx, [esp + 0x29c]
lea edx, [esp + 0x4a4]
push ecx
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x9c]
push eax
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x94]
push edx
push eax
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push ecx
push 0x80000001
call ebx
pop edi
pop esi
test eax, eax
pop ebx
jne 0x40f5b6
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push 4
push edx
push 4
push ebp
push str.Enable
push eax
mov dword [esp + 0x20], ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
add esp, 0x69c
ret
Function at 0x40fe00
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xe8
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push esi
xor esi, esi
push eax
push 0xf003f
push esi
push str.keyboard_layoutpreload
push 0x80000001
mov dword [esp + 0x2c], esi
call ebp
test eax, eax
jne 0x410008
push ebx
push edi
call fcn.004116f0
test eax, eax
je 0x40fef7
lea ecx, [esp + 0x18]
lea edx, [esp + 0x30]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xor edi, edi
push ecx
push edx
mov edx, dword [esp + 0x1c]
push edi
lea eax, [esp + 0x1c]
push edi
lea ecx, [esp + 0xa4]
push eax
push ecx
mov esi, 0x64
push edi
push edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], esi
call ebx
cmp eax, 0x103
je 0x40ffee
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x30]
push eax
push str._08x
push ecx
call fcn.0041ac3e
mov eax, dword [esp + 0x28]
add esp, 0xc
mov edx, eax
shr edx, 0x10
test dx, dx
je 0x40febf
cmp ax, 0x411
jne 0x40febf
push eax
call fcn.00410020
add esp, 4
test eax, eax
jne 0x40ffe6
lea eax, [esp + 0x18]
lea ecx, [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push 0
lea edx, [esp + 0x1c]
push 0
lea eax, [esp + 0xa4]
inc edi
push edx
push eax
push edi
push ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], esi
call ebx
cmp eax, 0x103
jne 0x40fe83
jmp 0x40ffee
lea edx, [esp + 0x28]
xor edi, edi
push edx
mov edx, dword [esp + 0x18]
push edi
push edi
lea eax, [esp + 0x1c]
push edi
lea ecx, [esp + 0xa4]
push eax
push ecx
mov esi, 0x64
push edi
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x40ffee
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push 0xf003f
lea ecx, [esp + 0x9c]
push 0
push ecx
push edx
call ebp
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x30]
push eax
push ecx
push 0
push 0
push 0x4313e8
push edx
mov dword [esp + 0x30], esi
call ebx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
push ecx
push str._08x
push edx
call fcn.0041ac3e
mov eax, dword [esp + 0x30]
add esp, 0xc
mov ecx, eax
shr ecx, 0x10
test cx, cx
je 0x40ffb0
cmp ax, 0x411
jne 0x40ffb0
push eax
call fcn.00410020
add esp, 4
test eax, eax
jne 0x40ffe6
lea edx, [esp + 0x28]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
lea ecx, [esp + 0xa4]
inc edi
push eax
push ecx
push edi
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x40ff34
jmp 0x40ffee
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0xe8
ret
mov eax, esi
pop esi
pop ebp
add esp, 0xe8
ret
Function at 0x410020
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x210
lea ecx, [esp + 8]
push esi
push eax
push str.SystemCurrentControlSetcontrolkeyboard_layouts_08x
push ecx
xor esi, esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push 0xf003f
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4100af
lea ecx, [esp + 8]
lea edx, [esp + 0x110]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.IME_File
push eax
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4100a4
lea ecx, [esp + 0x110]
push ecx
call fcn.004100c0
add esp, 4
test eax, eax
jne 0x4100a4
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x210
ret

Function at 0x4101c0
Capabilities:
Query or enumerate registry value

Disassembly:
call fcn.004116f0
test eax, eax
je 0x4101ee
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
call ebx
lea eax, [eax + eax + 2]
push eax
call fcn.0041a4fe
add esp, 4
mov esi, eax
push 0
push 0
push edi
call ebx
inc eax
push eax
push esi
push 0xffffffffffffffff
push edi
push 0x200
push 0x3a4
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov edi, eax
call fcn.0041a61a
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x410260
Capabilities:
Set registry value

Disassembly:
call fcn.004116f0
test eax, eax
je 0x41028e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
call ebx
lea eax, [eax + eax + 2]
push eax
call fcn.0041a4fe
add esp, 4
mov esi, eax
push 0
push 0
push edi
call ebx
inc eax
push eax
push esi
push 0xffffffffffffffff
push edi
push 0x200
push 0x3a4
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call fcn.0041a61a
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
ret