joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c3c0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58482b
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov esi, ecx
push str.DeleteRegICMProfile
push 0
lea ecx, [ebp - 0x638]
call fcn.0044ca70
add esp, 0xc
push esi
push str.lpszFileName___s
lea eax, [ebp - 0x638]
push 1
push eax
mov dword [ebp - 4], 0
call fcn.0044cd10
push 0x208
lea ecx, [ebp - 0x218]
push 0
push ecx
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x630], 0
call fcn.0055ca80
add esp, 0x1c
push 0x208
lea edx, [ebp - 0x628]
push 0
push edx
call fcn.0055ca80
add esp, 0xc
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0055ca80
add esp, 0xc
test esi, esi
jne 0x41c4ab
push esi
push str.return___08x
lea ecx, [ebp - 0x638]
push 2
push ecx
call fcn.0044cd10
add esp, 0x10
lea ecx, [ebp - 0x638]
mov dword [ebp - 4], 0xffffffff
call fcn.0044cc70
xor eax, eax
jmp 0x41c5fe
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMmntr
lea edx, [ebp - 0x628]
push 0x104
push edx
call fcn.005579b2
add esp, 0xc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMprtr
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.005579b2
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x218]
push ecx
call esi
lea edx, [ebp - 0x218]
push 0x5c
push edx
call fcn.005589fd
add esp, 8
test eax, eax
je 0x41c50f
add eax, 2
push eax
lea eax, [ebp - 0x218]
push eax
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x62c]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x628]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c56b
mov ecx, dword [ebp - 0x62c]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push ecx
call ebx
test eax, eax
jne 0x41c56b
mov eax, dword [ebp - 0x62c]
lea edx, [ebp - 0x218]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x630]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x420]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x41c5b7
mov ecx, dword [ebp - 0x630]
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x218]
push eax
push ecx
call ebx
test eax, eax
jne 0x41c5b7
mov eax, dword [ebp - 0x630]
lea edx, [ebp - 0x218]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x62c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [ebp - 0x630]
push edx
call esi
push 1
push str.return___08x
lea eax, [ebp - 0x638]
push 2
push eax
call fcn.0044cd10
add esp, 0x10
lea ecx, [ebp - 0x638]
mov dword [ebp - 4], 0xffffffff
call fcn.0044cc70
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
Function at 0x423660
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5845e8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5eb770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push str.Tool_GetProcType64
push 0
lea ecx, [ebp - 0x14]
call fcn.0044ca70
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push str.return___08x
lea ecx, [ebp - 0x14]
push 2
push ecx
call fcn.0044cd10
add esp, 0x10
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.0044cc70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x425ed0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5864c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5eb770]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
push str.Tool_CleanupCAPModuleAndRegistry
push 0
lea ecx, [esp + 0x20]
call fcn.0044ca70
add esp, 0xc
push str.SOFTWARECANON_
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov ebx, 1
call fcn.00403340
xor esi, esi
mov byte [esp + 0x28], bl
call fcn.00427880
test eax, eax
jne 0x425f3d
xor ebx, ebx
mov ecx, SysReAllocStringLen
call fcn.00426280
test eax, eax
jne 0x425f4d
xor ebx, ebx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00426280
test eax, eax
jne 0x425f5d
xor ebx, ebx
call fcn.00426540
test eax, eax
jne 0x425f68
xor ebx, ebx
mov edi, dword [esp + 0x10]
mov esi, SysReAllocStringLen
call fcn.0041a290
test eax, eax
je 0x425f86
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push ebx
push str.return___08x
lea ecx, [esp + 0x1c]
push 2
push ecx
call fcn.0044cd10
mov byte [esp + 0x38], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x425fc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.0044cc70
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427690
Capabilities:
Check if file exists
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58434b
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
mov esi, ecx
push str.Tool_DeleteSMModule
push 0
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x430], eax
call fcn.0044ca70
add esp, 0xc
mov ecx, dword [ebp - 0x430]
push ecx
push ebx
push edi
push esi
push str.pRegRoot___s__pSubKey___s__pValueName___s__pModuleName___s
lea edx, [ebp - 0x440]
push 1
push edx
mov dword [ebp - 4], 0
call fcn.0044cd10
add esp, 0x1c
xor ecx, ecx
mov eax, 1
push 0x204
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x428], eax
push ecx
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x434], 0x104
mov dword [ebp - 0x21c], ecx
call fcn.0055ca80
add esp, 0xc
push 0x204
lea ecx, [ebp - 0x420]
push 0
push ecx
mov dword [ebp - 0x424], 0
call fcn.0055ca80
add esp, 0xc
push esi
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
lea eax, [ebp - 0x424]
push eax
call esi
lea ecx, [ebp - 0x42c]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x424]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42782a
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x42c]
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x438]
push edx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x427815
mov ecx, dword [ebp - 0x430]
push ecx
lea edx, [ebp - 0x21c]
push edx
call esi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x427815
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x427815
mov edx, dword [ebp - 0x42c]
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42783a
mov edx, dword [ebp - 0x42c]
mov esi, dword [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42783a
mov dword [ebp - 0x428], 1
mov esi, dword [ebp - 0x428]
push esi
push str.return___08x
lea eax, [ebp - 0x440]
push 2
push eax
call fcn.0044cd10
add esp, 0x10
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 0xffffffff
call fcn.0044cc70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
Function at 0x427880
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584320
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push edi
mov eax, dword [0x5eb770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push str.Tool_DeletePSWRegistry
push ebx
lea ecx, [ebp - 0x18]
call fcn.0044ca70
add esp, 0xc
push esi
push str.lpszPrinter___s
lea eax, [ebp - 0x18]
push 1
push eax
mov dword [ebp - 4], ebx
call fcn.0044cd10
add esp, 0x10
call fcn.0046d2d8
mov edi, dword [eax + 4]
push str.SOFTWARECANON_
lea ecx, [ebp - 0x10]
call fcn.00403340
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x65c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040fb30
test esi, esi
je 0x427918
mov ecx, dword [ebp - 0x10]
push esi
push ecx
lea edx, [ebp - 0x10]
push str._s_s
push edx
call fcn.0040a740
add esp, 0x10
mov eax, dword [ebp - 0x10]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x427930
cmp eax, 2
jne 0x427935
mov ebx, 1
push ebx
push str.return___08x
lea ecx, [ebp - 0x18]
push 2
push ecx
call fcn.0044cd10
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42796c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.0044cc70
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427bb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5842db
mov eax, dword fs:[0]
push eax
sub esp, 0x648
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push str.Tool_GetDriverColorProfilesReg
push ebx
lea ecx, [ebp - 0x648]
mov esi, edx
mov dword [ebp - 0x64c], eax
call fcn.0044ca70
add esp, 0xc
push edi
push esi
push str.lpcDriverName___s__cVer___08x
lea ecx, [ebp - 0x648]
push 1
push ecx
mov dword [ebp - 4], ebx
call fcn.0044cd10
add esp, 0x14
cmp esi, ebx
je 0x427dac
push 0x616
lea ecx, [ebp - 0x632]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x634], ax
call fcn.0055ca80
add esp, 0xc
mov eax, edi
sub eax, 3
push esi
je 0x427c83
sub eax, 2
je 0x427c6b
push str.SystemCurrentControlSetControlPrintEnvironmentsWindows_NT_x86DriversVersion_3
push str._s_s
push 0x30c
lea edx, [ebp - 0x634]
push edx
jmp 0x427c99
push str.SystemCurrentControlSetControlPrintEnvironmentsWindows_x64DriversVersion_3
push str._s_s
push 0x30c
lea eax, [ebp - 0x634]
push eax
jmp 0x427c99
push str.SystemCurrentControlSetControlPrintEnvironmentsWindows_NT_x86DriversVersion_3
push str._s_s
push 0x30c
lea ecx, [ebp - 0x634]
push ecx
call fcn.005578c0
add esp, 0x14
lea edx, [ebp - 0x638]
push edx
push 0x20019
push ebx
lea eax, [ebp - 0x634]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x640], 7
mov dword [ebp - 0x63c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x427dac
mov eax, dword [ebp - 0x638]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x63c]
push ecx
push ebx
lea edx, [ebp - 0x640]
push edx
push ebx
push str.ColorProfiles
push eax
call edi
cmp eax, ebx
jne 0x427d99
cmp dword [ebp - 0x63c], ebx
jbe 0x427d99
xor ecx, ecx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x63c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00461caa
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x427d7a
mov edx, dword [ebp - 0x638]
lea eax, [ebp - 0x63c]
push eax
push esi
lea ecx, [ebp - 0x640]
push ecx
push ebx
push str.ColorProfiles
push edx
call edi
test eax, eax
jne 0x427d71
mov eax, dword [ebp - 0x64c]
push eax
push esi
call fcn.00427e00
add esp, 8
push esi
call fcn.00461cb5
add esp, 4
mov dword [ebp - 4], ebx
jmp 0x427d99
mov ecx, dword [ebp - 0x638]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x638], ebx
push ebx
push str.return___08x
lea edx, [ebp - 0x648]
push 2
push edx
call fcn.0044cd10
add esp, 0x10
lea ecx, [ebp - 0x648]
mov dword [ebp - 4], 0xffffffff
call fcn.0044cc70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
Function at 0x430930
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
test esi, esi
je 0x430a1b
push esi
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x430983
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4309a6
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 1
jne 0x430a1b
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0055ca80
add esp, 0xc
push str.Global_
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [edi]
mov edx, dword [edx + 0x110]
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call edx
test eax, eax
je 0x430a1d
pop edi
pop esi
or eax, 0x80000000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret 8
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055649d
mov esp, ebp
pop ebp
ret 8

Function at 0x430a30
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push str.h_PrinterDriverUnInstaller_PrevInstance
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x430a60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x430a59
cmp eax, 5
jne 0x430a68
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 2
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x430a70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
xor edi, edi
mov word [ebp - 0x20c], ax
call fcn.0055ca80
add esp, 0xc
push str.Global_
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.gh_Canon_OIP_PrinterDriverCommonMutex
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x20c]
push ecx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x430af7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x430af0
cmp eax, 5
jne 0x430b0c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0055649d
mov esp, ebp
pop ebp
ret
Function at 0x430b20
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
mov esi, ecx
test edi, edi
jne 0x430b5c
mov edi, dword [esi + 0x694]
test edi, edi
je 0x430b56
call fcn.0046d2d8
mov dword [eax + 0xc], edi
mov eax, dword [esi + 0x698]
test eax, eax
je 0x430b56
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x698], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
ret
mov eax, dword [esi + 0x698]
test eax, eax
je 0x430b73
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x698], ebx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x430bbb
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x698], eax
test eax, eax
je 0x430bb2
call fcn.0046d2d8
mov eax, dword [eax + 8]
mov dword [esi + 0x694], eax
mov esi, dword [esi + 0x698]
call fcn.0046d2d8
pop edi
mov dword [eax + 0xc], esi
pop esi
mov eax, ebx
pop ebx
ret
pop edi
pop esi
mov eax, 0x21
pop ebx
ret
pop edi
pop esi
mov eax, 0x20
pop ebx
ret

Function at 0x430bd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, 1
test esi, esi
je 0x430bf1
test edi, edi
jne 0x430c04
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x5d0], 0
je 0x430c2b
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [ebp - 0x20c]
push edx
jmp 0x430c8a
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x61c]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.005599dd
push 0
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x61c]
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00558c88
add esp, 0x2c
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push edi
lea edx, [ebp - 0x20c]
push edx
push 0x5b7940
push 0xffffffffffffffff
push 0x104
push esi
call fcn.005578de
add esp, 0x18
test eax, eax
js 0x430bf1
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0055649d
mov esp, ebp
pop ebp
ret 4
Function at 0x4368e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58604b
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push esi
mov edi, ecx
push str.CUNINSTALLERDlg::DeleteSurvivalPrinterRegKey
push esi
lea ecx, [ebp - 0x42c]
call fcn.0044ca70
add esp, 0xc
push edi
push str.lpszPrinter___s
lea eax, [ebp - 0x42c]
push 1
push eax
mov dword [ebp - 4], esi
call fcn.0044cd10
add esp, 0x10
lea ecx, [ebp - 0x424]
push ecx
push 0xf003f
push esi
push edi
push SysReAllocStringLen
lea ebx, [esi + 1]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x436a3c
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0x410
lea edx, [ebp - 0x420]
push 0
push edx
mov dword [ebp - 0x430], 0x208
call fcn.0055ca80
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
mov eax, dword [ebp - 0x424]
push 0
push 0
push 0
lea ecx, [ebp - 0x430]
push ecx
lea edx, [ebp - 0x420]
push edx
push esi
push eax
call edi
inc esi
test eax, eax
je 0x4369c0
cmp eax, 0x103
je 0x436a28
xor ebx, ebx
jmp 0x436a11
lea ecx, [ebp - 0x420]
push ecx
call fcn.00436a90
test eax, eax
jne 0x43696b
mov eax, dword [ebp - 0x424]
lea edx, [ebp - 0x420]
push edx
push eax
call fcn.0041a0a0
add esp, 8
cmp eax, 1
jne 0x436a2d
mov edx, dword [ebp - 0x424]
lea ecx, [ebp - 0x420]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x436a0f
cmp eax, 2
je 0x436a0f
xor ebx, ebx
mov eax, 0x103
xor esi, esi
test eax, eax
je 0x43696b
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x436a43
mov ebx, 1
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x436a43
cmp eax, 2
je 0x436a43
xor ebx, ebx
push ebx
push str.return___08x
lea ecx, [ebp - 0x42c]
push 2
push ecx
call fcn.0044cd10
add esp, 0x10
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], 0xffffffff
call fcn.0044cc70
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
Function at 0x445270
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x581b8b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5eb770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0057521a
push 4
mov dword [ebp - 4], 0
call fcn.00461c7b
mov edi, eax
add esp, 4
test edi, edi
je 0x4452ec
call fcn.005750f2
mov dword [edi], eax
call fcn.00574eb1
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.005751db
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4452e2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00575203
jmp 0x4452ee
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44cd10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor ebx, ebx
lea eax, [edx - 1]
xor edi, edi
mov dword [ebp - 4], ebx
cmp eax, 6
ja case.default.0x44cd35
movzx eax, byte [eax + 0x44ce10]
jmp dword [eax*4 + 0x44ce08]
cmp dword [0x60a33c], ebx
je case.default.0x44cd35
jmp 0x44cd4f
cmp dword [0x60a33c], 2
jne case.default.0x44cd35
mov ebx, 1
lea eax, [edx - 3]
cmp eax, 3
ja case.default.0x44cd5c
jmp dword [eax*4 + 0x44ce18]
mov ecx, dword [0x5ed950]
and ecx, 4
cmp cl, 4
jmp 0x44cd89
mov eax, dword [0x5ed950]
and eax, 2
cmp al, 2
jmp 0x44cd89
mov ecx, dword [0x5ed950]
and ecx, 1
cmp cl, 1
jne case.default.0x44cd5c
mov edi, 1
test ebx, ebx
jne 0x44cd98
test edi, edi
je 0x44ce00
test esi, esi
je 0x44cdf1
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ecx]
push eax
push edx
lea edx, [ebp - 4]
mov ecx, esi
call fcn.0044d790
mov esi, eax
test esi, esi
je 0x44cdee
test ebx, ebx
je 0x44cdd7
cmp dword [0x60a344], 0
je 0x44cdd0
mov ecx, dword [ebp - 4]
push ecx
push esi
call fcn.0044dd90
jmp 0x44cdd7
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test edi, edi
je 0x44cde5
mov edx, dword [ebp + 0xc]
push esi
push edx
call fcn.0044dbf0
push esi
call fcn.00461cb5
add esp, 4
mov edx, dword [ebp + 0xc]
cmp edx, 2
jne 0x44ce00
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret