joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cef0
Capabilities:
Create http request

Disassembly:
push ecx
push esi
push 0
push 0
push 0
push 0
push str.SOGOU_UPDATER
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
je 0x41cf7e
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea eax, [esp + 0xc]
push eax
push 5
push esi
mov dword [esp + 0x18], 0x4e20
call edi
push 4
lea ecx, [esp + 0xc]
push ecx
push 7
push esi
call edi
push 4
lea edx, [esp + 0xc]
push edx
push 2
push esi
call edi
push 4
lea eax, [esp + 0xc]
push eax
push 6
push esi
call edi
push 4
lea ecx, [esp + 0xc]
push ecx
push 8
push esi
call edi
mov edx, dword [esp + 0x10]
push 0
push 0x84000000
push 0
push 0
push edx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
test eax, eax
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x41cf7a
push eax
call edi
push esi
call edi
pop edi
pop esi
pop ecx
ret 4

Function at 0x41cf90
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x472b48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 4], 0
jne 0x41d0bb
lea ecx, [esi + 0x18]
mov byte [esi + 4], 1
call fcn.00468640
push eax
lea ecx, [esp + 0x14]
call fcn.004690c0
push str.begin1
lea ecx, [esi + 0x28]
call fcn.00468670
push eax
push 0x4825c0
lea ecx, [esp + 0x1c]
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [0x4ac7a0], 4
lea ecx, [esp + 0x10]
jne 0x41d01b
push str.s1
jmp 0x41d020
push str.s0
call fcn.00468d90
mov eax, 0x4afbac
cmp eax, 0x4afa80
jne 0x41d038
mov eax, 1
jmp 0x41d05b
mov ecx, 0x4afbac
cmp ecx, 0x4af3a0
jne 0x41d04c
mov eax, 5
jmp 0x41d05b
mov edi, 0x4afbac
mov esi, 0x4ae670
call fcn.00429650
push eax
push str.mod
lea ecx, [esp + 0x18]
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push str.ip
push eax
push str.url
lea ecx, [esp + 0x20]
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
lea ecx, [esp + 0x10]
call fcn.00468670
push eax
call fcn.0041cef0
lea ecx, [esp + 0x10]
call fcn.00468790
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
Function at 0x41d0d0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x472b48
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
cmp byte [esi + 4], 0
je 0x41d205
lea ecx, [esi + 0x18]
call fcn.00468640
push eax
lea ecx, [esp + 0x14]
call fcn.004690c0
lea ebx, [esi + 8]
mov ecx, ebx
call fcn.00468750
test eax, eax
jbe 0x41d135
mov ecx, ebx
call fcn.00468640
push eax
lea ecx, [esp + 0x14]
call fcn.00468d90
test edi, edi
je 0x41d168
push edi
push str.end
lea ecx, [esi + 0x28]
call fcn.00468670
push eax
push 0x4825c0
lea ecx, [esp + 0x20]
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
mov ecx, eax
jmp 0x41d171
push str.end1
lea ecx, [esp + 0x14]
call fcn.00468d90
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [0x4ac7a0], 4
lea ecx, [esp + 0x10]
jne 0x41d190
push str.s1
jmp 0x41d195
push str.s0
call fcn.00468d90
mov eax, 0x4afbac
cmp eax, 0x4afa80
jne 0x41d1ad
mov eax, 1
jmp 0x41d1d0
mov ecx, 0x4afbac
cmp ecx, 0x4af3a0
jne 0x41d1c1
mov eax, 5
jmp 0x41d1d0
mov edi, 0x4afbac
mov esi, 0x4ae670
call fcn.00429650
push eax
push str.mod
lea ecx, [esp + 0x18]
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
lea ecx, [esp + 0x10]
call fcn.00468670
push eax
call fcn.0041cef0
mov ecx, ebx
call fcn.00468b20
lea ecx, [esp + 0x10]
call fcn.00468790
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x41df80
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4727cb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov ecx, edi
mov dword [esp + 8], edi
call fcn.0046d5d0
push 0x206
lea eax, [esp + 0x22]
push 0
mov dword [esp + 0x238], 0
push eax
mov word [esp + 0x28], 0
call fcn.00449450
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x41e062
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e003
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x1a], 0x5c
jne 0x41e035
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e021
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0x1a], cx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x24]
call fcn.0046d470
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.0046d330
lea ecx, [esp + 0xc]
call fcn.0046cf20
mov eax, edi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00445c6a
add esp, 0x230
ret
Function at 0x41e0d0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x254
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [esp + 0x258]
push ebp
push esi
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x18], eax
call fcn.0046cf00
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jbe 0x41e221
push edi
push esi
call fcn.004455f8
add esp, 4
mov edi, eax
push edi
push esi
push ebp
mov ecx, ebx
call fcn.0046cf00
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41e217
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x481f7c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41e217
push 0x30
lea ecx, [esp + 0x28]
push ebp
push ecx
mov dword [esp + 0x2c], ebp
call fcn.00449450
mov edx, dword [esp + 0x18]
push 0x34
push edx
lea eax, [esp + 0x34]
push 0x34
push eax
call fcn.00445bef
add esp, 0x1c
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41e217
mov eax, dword [esp + 0xc]
push 4
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
mov word [esp + 0x20], bp
mov word [esp + 0x22], bp
call fcn.00445bef
push 0x206
lea edx, [esp + 0x6a]
push ebp
push edx
mov word [esp + 0x70], bp
call fcn.00449450
movzx eax, word [esp + 0x2e]
movzx ecx, word [esp + 0x2c]
push eax
push ecx
push str.StringFileInfo_04x_04xFileVersion
lea edx, [esp + 0x7c]
push 0x104
push edx
call fcn.00446193
add esp, 0x30
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x5c]
push edx
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
push eax
push 0x483350
push 0x40
push ecx
call fcn.00446193
add esp, 0x10
push edi
call fcn.00445adc
add esp, 4
pop edi
mov ecx, dword [esp + 0x258]
pop esi
pop ebp
xor ecx, esp
call fcn.00445c6a
add esp, 0x254
ret
Function at 0x41e240
Capabilities:
Enumerate files on windows
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x472b06
mov eax, dword fs:[0]
push eax
sub esp, 0x710
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x70c], eax
push ebx
push ebp
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x720]
mov dword fs:[0], eax
xor ebp, ebp
push 0x206
lea eax, [esp + 0x51a]
push ebp
push eax
mov word [esp + 0x520], bp
call fcn.00449450
push 0x206
lea ecx, [esp + 0x31e]
push ebp
push ecx
mov word [esp + 0x324], bp
call fcn.00449450
add esp, 0x18
push 0x104
lea edx, [esp + 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x30c]
push eax
push str._sSogouPy.ime
lea ecx, [esp + 0x51c]
push 0x104
push ecx
call fcn.00446193
push 0x24c
lea edx, [esp + 0x54]
push ebp
push edx
mov dword [esp + 0x58], ebp
call fcn.00449450
add esp, 0x1c
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x518]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x41e456
mov edi, edi
push ebp
push ebp
push ebp
push ebp
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x320]
push eax
lea ecx, [esp + 0x34]
call fcn.0046d470
push 0x7e
lea ecx, [esp + 0x292]
push ebp
mov dword [esp + 0x730], ebp
push ecx
mov word [esp + 0x298], bp
call fcn.00449450
lea edx, [esp + 0x298]
push edx
lea ebx, [esp + 0x2c]
call fcn.0041e0d0
add esp, 0x10
lea eax, [esp + 0x28c]
push eax
lea ecx, [esp + 0x30]
call fcn.004690c0
mov byte [esp + 0x728], 1
cmp dword [esi + 0x10], ebp
mov ecx, dword [esi + 4]
mov dword [esp + 0x18], ecx
jne 0x41e3e0
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 4]
push eax
call edx
add esp, 4
cmp eax, ebp
jne 0x41e3b0
xor eax, eax
jmp 0x41e3b8
mov ecx, dword [esi + 0xc]
mov dword [eax], ecx
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0x14]
lea edx, [ecx + ecx*2]
add ecx, 0xffffffff
cmp ecx, ebp
lea eax, [eax + edx*8 - 0x14]
jl 0x41e3e0
lea esp, [esp]
mov edx, dword [esi + 0x10]
mov dword [eax], edx
mov dword [esi + 0x10], eax
sub eax, 0x18
sub ecx, 1
jns 0x41e3d0
mov edi, dword [esi + 0x10]
cmp edi, ebp
mov ebx, dword [edi]
je 0x41e3f6
lea eax, [esp + 0x2c]
push eax
lea ecx, [edi + 8]
call fcn.00469110
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x10], ebx
mov dword [edi + 4], ecx
mov dword [edi], ebp
mov eax, dword [esi + 4]
add dword [esi + 8], 1
cmp eax, ebp
je 0x41e411
mov dword [eax], edi
jmp 0x41e413
mov dword [esi], edi
lea ecx, [esp + 0x2c]
mov dword [esi + 4], edi
call fcn.00468790
lea ecx, [esp + 0x1c]
mov dword [esp + 0x728], 0xffffffff
call fcn.0046cf20
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41e320
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x720]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x70c]
xor ecx, esp
call fcn.00445c6a
add esp, 0x71c
ret
Function at 0x41e480
Capabilities:
Access peb ldr_data
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x473037
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x2b0], eax
push ebp
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x2c4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2d4]
push 0
push 0
push 0
push 0
push 0
call fcn.004655d0
mov ecx, eax
call fcn.00464950
push eax
lea ecx, [esp + 0x44]
call fcn.0046e160
lea ecx, [esp + 0xc]
mov dword [esp + 0x2cc], 0
call fcn.0046d5d0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x2d0], 1
call fcn.0046dd50
push 0x24c
lea ecx, [esp + 0x74]
push 0
push ecx
mov dword [esp + 0x78], 0
call fcn.00449450
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0x48631c
lea ecx, [esp + 0x64]
call fcn.0046d470
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2d4], 2
call fcn.0046e5c0
lea ecx, [esp + 0x6c]
push ecx
mov ecx, eax
call fcn.0046cf00
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [esp + 0x5c]
mov edi, eax
call fcn.0046cf20
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2cc], 1
call fcn.0046cf20
cmp edi, 0xffffffff
je 0x41e6bc
mov ecx, 0x48277c
lea eax, [esp + 0x98]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41e5c6
test dx, dx
je 0x41e5c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41e5c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x41e5a0
xor eax, eax
jmp 0x41e5cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41e6a1
mov ecx, 0x486324
lea eax, [esp + 0x98]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41e606
test dx, dx
je 0x41e602
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41e606
add eax, 4
add ecx, 4
test dx, dx
jne 0x41e5e0
xor eax, eax
jmp 0x41e60b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41e6a1
test byte [esp + 0x6c], 0x10
je 0x41e6a1
lea edx, [esp + 0x98]
push 0x48277c
push edx
call fcn.0044684e
add esp, 8
test eax, eax
je 0x41e6a1
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x34]
call fcn.0046e160
lea ecx, [esp + 0x1c]
call fcn.0046d1f0
test al, al
je 0x41e690
lea edx, [esp + 0x98]
push edx
lea ecx, [esp + 0x40]
call fcn.004690c0
lea eax, [esp + 0x3c]
push eax
mov eax, ebp
mov byte [esp + 0x2d0], 4
call fcn.0041c4b0
lea ecx, [esp + 0x3c]
call fcn.00468790
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2cc], 1
call fcn.0046cf20
lea ecx, [esp + 0x6c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41e591
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0xc]
call fcn.0046cf20
lea ecx, [esp + 0x2c]
call fcn.0046cf20
mov ecx, dword [esp + 0x2c4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00445c6a
add esp, 0x2c4
ret
Function at 0x41f0c0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
xor ebp, ebp
push eax
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov al, byte [esp + 0x2c]
test al, al
jne 0x41f0ea
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
movzx ebx, al
lea esi, [ebx*8]
push esi
call fcn.004462ab
mov edi, eax
push edi
mov eax, ebx
mov dword [esp + 0x1c], edi
call fcn.00402660
add esp, 8
test al, al
je 0x41f17e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.004462ab
mov dword [esp + 0x14], eax
push eax
mov eax, ebx
call fcn.00402660
add esp, 8
test al, al
je 0x41f17e
test ebx, ebx
jle 0x41f17e
mov esi, edi
mov edi, dword [esp + 0x10]
sub edi, esi
nop
mov ecx, dword [edi + esi]
sub ecx, dword [esi]
mov edx, dword [edi + esi + 4]
sbb edx, dword [esi + 4]
push 0
push 0x64
push edx
push ecx
call fcn.0044f240
push 0
push 0x989680
push edx
push eax
call fcn.0044ea50
mov ecx, 0x64
sub ecx, eax
cmp ecx, ebp
jbe 0x41f172
mov ebp, ecx
add esi, 8
sub ebx, 1
jne 0x41f140
mov edi, dword [esp + 0x14]
test edi, edi
je 0x41f18b
push edi
call fcn.004461ce
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41f19c
push eax
call fcn.004461ce
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x4212d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x4212e3
push 0x80004005
call fcn.00403520
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4212f0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x421330
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x224
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x234]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x10]
mov esi, eax
test esi, esi
jne 0x42139e
test ecx, ecx
je 0x421390
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x18]
mov esi, eax
mov dword [esp + 0x10], ecx
je 0x4213ac
test ecx, ecx
je 0x421451
push ecx
jmp 0x42144b
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x3c]
push edx
push 0
push ecx
mov dword [esp + 0x34], 0x100
call esi
test eax, eax
jne 0x42141e
jmp 0x4213e0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.00421330
mov edi, eax
test edi, edi
jne 0x42146d
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
push ecx
mov dword [esp + 0x34], 0x100
call esi
test eax, eax
je 0x4213e0
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x421435
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x421451
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00445c6a
add esp, 0x224
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42147c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x421453
Function at 0x421910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x474330
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4a7534]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x414]
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x14], eax
call dword [fcn.004a738c]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x410]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp], eax
push 2
push eax
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp - 0x18], edi
jne 0x421999
call fcn.00421090
mov esi, eax
jmp 0x421a7f
mov edx, dword [ebp - 0x14]
push edx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4219b5
call fcn.00421090
jmp 0x421a76
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x4219ce
call fcn.00421090
jmp 0x421a76
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, ebx
mov dword [ebp - 0x14], ebx
jae 0x421a04
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4219f2
lea eax, [ebp]
call fcn.00423a70
lea esi, [ebp - 0x1c]
call fcn.004238d0
mov eax, 0x8007000e
jmp 0x421a92
lea esi, [ebp]
mov byte [ebp - 4], 2
call fcn.004239b0
mov dword [ebp - 4], 1
jmp 0x421a2c
mov esi, dword [ebp]
test esi, esi
jne 0x421a3a
mov esi, 0x8007000e
jmp 0x421a78
call dword [fcn.004a738c]
mov ecx, dword [ebp - 0x20]
push ebx
push esi
push ebx
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x421a5b
call fcn.00421090
jmp 0x421a76
mov edx, dword [ebp]
mov word [edx + eax*2], 0
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea edx, [ebp - 0x28]
call fcn.00422660
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x421a90
lea eax, [ebp]
call fcn.00423a70
nop
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00445c6a
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428af0
Capabilities:
Create directory

Disassembly:
sub esp, 0x244
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x23c], eax
push 0x206
lea eax, [esp + 0x36]
push 0
push eax
mov word [esp + 0x3c], 0
call fcn.00449450
add esp, 0xc
mov ecx, esi
call fcn.0046cf00
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.004276c0
lea edx, [esp + 0x38]
push 0x5c
push edx
call fcn.00425fd0
add esp, 0x10
test eax, eax
jne 0x428b6f
mov ecx, esi
call fcn.0046cee0
push eax
push 0x49723c
push edi
call fcn.0046c2c0
add esp, 0xc
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.00445c6a
add esp, 0x244
ret
mov word [eax], 0
lea eax, [esp]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.00449a94
add esp, 8
test eax, eax
je 0x428be2
push 0
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x428bc2
lea eax, [esp + 0x30]
push eax
push 0x497250
push edi
call fcn.0046c2c0
add esp, 0xc
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.00445c6a
add esp, 0x244
ret
push 0x10000000
lea ecx, [esp + 0x34]
push 1
push ecx
call fcn.00466440
lea edx, [esp + 0x3c]
push 1
push edx
call fcn.004666f0
add esp, 0x14
mov ecx, dword [esp + 0x23c]
xor ecx, esp
mov al, 1
call fcn.00445c6a
add esp, 0x244
ret

Function at 0x429000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ea0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [esp + 0x30]
push ecx
xor esi, esi
push str.UserManager
mov dword [esp + 0x14], esi
call fcn.00402f60
add esp, 4
mov ecx, eax
call fcn.0043f540
push esi
push esi
push esi
push esi
push esi
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x60], esi
call fcn.0046e160
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 2
call fcn.0046cf20
push esi
push esi
push esi
push esi
push esi
push 0x497264
lea ecx, [esp + 0x34]
call fcn.0046d470
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x10]
call fcn.0046e140
lea ecx, [esp + 0x1c]
call fcn.0046cf20
push esi
push esi
push esi
push esi
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.0046e160
lea ecx, [esp + 0xc]
call fcn.0046cf20
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42c2c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x21c], eax
push 0x206
lea eax, [esp + 0x16]
push 0
push eax
mov word [esp + 0x1c], 0
call fcn.00449450
add esp, 0xc
cmp word [esp + 0x10], 0
jne 0x42c348
push 0x104
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42c348
lea edx, [esp + 0x10]
push str.SogouPY.ime
push edx
call fcn.00427640
add esp, 8
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
call fcn.0046d470
lea ecx, [esp]
push ecx
mov ecx, esi
call fcn.0046d330
lea ecx, [esp]
call fcn.0046cf20
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00445c6a
add esp, 0x224
ret