joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401045
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x4e9bb0
call fcn.00401cde
mov ecx, esi
push str.EBWebViewx86EmbeddedBrowserWebView.dll
call fcn.00401cde
mov ecx, esi
call fcn.00401d9c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop esi
pop ebp
ret

Function at 0x4019c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x230
mov esi, edx
mov edi, ecx
mov eax, dword [0x513010]
xor eax, ebp
mov dword [esp + 0x228], eax
lea eax, [esp + 0x20]
push 0x208
push 0xff
push eax
call fcn.004b8c50
add esp, 0xc
mov dword [esp + 0xc], 0x104
lea eax, [esp + 8]
mov dword [eax], 0xffffffff
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
sub ecx, esi
push eax
push 0x20219
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x401abd
lea eax, [esp + 0xc]
push eax
lea edi, [esp + 0x24]
push edi
push ebx
push ebx
push str.EBWebView
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401abb
cmp dword [esp + 0xc], 3
mov ebx, 0
jb 0x401abd
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.00401c0e
mov ecx, esi
call fcn.00401d9c
push 0x5c
push eax
call fcn.004b8ba7
add esp, 8
test eax, eax
je 0x401abb
mov edi, eax
add edi, 2
pcmpeqd xmm0, xmm0
lea edx, [esp + 0x10]
movdqa xmmword [edx], xmm0
mov ecx, edi
call fcn.004018f0
test al, al
je 0x401abb
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x401aac
push edi
call fcn.00401c0e
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.00401ad5
mov ebx, eax
jmp 0x401abd
xor ebx, ebx
mov ecx, dword [esp + 0x228]
xor ecx, ebp
call fcn.004b7879
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401ad5
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
xor eax, eax
mov edx, dword [eax + 0x4e9e88]
cmp dword [ecx + eax], edx
ja 0x401af3
jb 0x401afe
add eax, 4
cmp eax, 0x10
jne 0x401ade
push esi
call fcn.00401045
add esp, 4
jmp 0x401b1e
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Loader_skipped_an_incompatible_version:
call edi
mov ecx, esi
call fcn.00401d9c
push eax
call edi
push 0x4e9eea
call edi
xor eax, eax
pop esi
pop edi
pop ebp
ret
Function at 0x4022b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x402331
mov dword [ebp - 0x1c], ecx
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push ecx
push eax
push 0x10
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x40234b
mov ecx, edi
mov edx, esi
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
push esi
call fcn.00402375
add esp, 8
test al, al
je 0x40235b
mov eax, dword [esi]
test eax, eax
je 0x402371
push 0xa
push 0
push eax
call fcn.004c5dce
add esp, 0xc
cmp eax, 1
jmp 0x40234f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b7879
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00402375
cmp dword [ebp - 0x14], 1
sete al
movzx eax, al
mov dword [ebx], eax
mov bl, 1
jmp 0x40235d
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b7879
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x402352

Function at 0x402375
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea edi, [ebp - 0x218]
push 0x208
push ebx
push edi
call fcn.004b8c50
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push edi
push ebx
push 2
push esi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x4023ec
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.00401c0e
mov ecx, edi
call fcn.00401d9c
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b7879
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41ba9e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 4], esi
lea ebx, [esi + 0x14]
mov dword [esi], 0x4f3f64
mov ecx, ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.00462261
mov edx, ebx
mov dword [ebx + 0x2c], edi
call fcn.0046b8f3
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], ecx
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x38]
mov dword [ebp + 8], eax
test eax, eax
jle 0x41bb1f
mov esi, ecx
push edi
mov ecx, esi
call fcn.00461555
push ecx
push 0
inc edi
mov ecx, ebx
push edi
push eax
call fcn.0046baa1
xor al, 1
mov cl, al
call fcn.00413f3a
cmp edi, dword [ebp + 8]
jl 0x41baf9
mov esi, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x41df90
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov byte [ebp - 0x431], dl
xor bl, bl
mov dword [ebp - 0x43c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41dfd1
mov al, 1
jmp 0x41e092
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x41e089
xor edi, edi
inc edi
or edx, 0xffffffff
lea ecx, [ebp - 0x410]
call fcn.00462810
mov edx, str.winex11.drv
mov dword [ebp - 0x438], eax
mov ecx, eax
call fcn.0045f52b
test al, al
movzx ebx, bl
lea ecx, [ebp - 0x210]
cmovne ebx, edi
or edx, 0xffffffff
call fcn.00462810
cmp byte [ebp - 0x431], 0
mov edi, eax
je 0x41e04a
mov ecx, dword [0x519c5c]
test ecx, ecx
je 0x41e04a
mov edx, edi
call fcn.0045f70a
test eax, eax
jne 0x41e070
push edi
push dword [ebp - 0x438]
push dword [ebp - 0x418]
push dword [ebp - 0x41c]
push str.Module:__p__06X___16s__s_n
push dword [ebp - 0x43c]
call fcn.00460583
add esp, 0x18
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
push 1
pop edi
test eax, eax
jne 0x41dff4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x41eafa
Capabilities:
Get geographical location
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xac]
mov ebx, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x98]
push str.Number_Of_Processors:__d_n
push ebx
call fcn.00460583
add esp, 0xc
mov esi, str.ProcessorNameString
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov edx, str.HARDWAREDESCRIPTIONSystemCentralProcessor
mov ecx, edi
push esi
call fcn.004644ae
pop ecx
test eax, eax
jne 0x41eb61
push esi
mov edx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov ecx, edi
call fcn.004644ae
pop ecx
test eax, eax
je 0x41eb70
push eax
push str.Processor:__s_n
push ebx
call fcn.00460583
add esp, 0xc
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push dword [ebp - 0x84]
mov edx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x70]
call fcn.004e5d90
mov edx, dword [ebp - 0x7c]
cvtsd2ss xmm0, xmm0
push ecx
push ecx
mov ecx, dword [ebp - 0x80]
mulss xmm0, dword [0x506f20]
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.004e5d90
cvtsd2ss xmm0, xmm0
push ecx
push ecx
mulss xmm0, dword [0x506f20]
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
push str.Physical_Memory:__.2f_GB_nCommit_Charge_Limit:__.2f_GB_nMemory_Used:__d___n
push ebx
call fcn.00460583
add esp, 0x1c
mov ecx, ebx
call fcn.0041e9cf
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea edi, [ebp - 0x24]
push 8
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 8
pop ecx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
push 0x1f
lea eax, [ebp - 0x24]
mov edi, 0x400
push eax
push 0x5a
push edi
call esi
push 0x1f
lea eax, [ebp - 0x44]
push eax
push 0x59
push edi
call esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
push str.Lang:__s__s_n
push ebx
call fcn.00460583
add esp, 0x10
mov ecx, ebx
call fcn.0041ea43
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x41edde
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov edi, edx
cmp dword [0x519c64], ebx
jne 0x41edff
mov cl, bl
cmp dword [0x519c74], ebx
je 0x41ee01
mov cl, 1
call fcn.00413f3a
test esi, esi
jne 0x41ee1b
mov ecx, str.InstallCrashHandler:_skipping_because__crashDumpPath_n
xor dl, dl
call fcn.00461f14
jmp 0x41ef8f
mov ecx, dword [ebp + 8]
call fcn.0041eced
test al, al
jne 0x41ee2e
mov ecx, str.InstallCrashHandler:_skipping_because__SetSymbolsDir___n
jmp 0x41ee0f
push dword [ebp + 8]
push edi
push esi
push str.InstallCrashHandler_crashDumpPath:__s_ncrashFilePath:__s_nsymDir:__s_n
call fcn.004620b3
push 0xffffffffffffffff
mov edx, esi
xor ecx, ecx
call fcn.0045f484
add esp, 0x14
mov dword [0x519c70], eax
mov edx, edi
xor ecx, ecx
push 0xffffffffffffffff
call fcn.0045f484
pop ecx
mov dword [0x518b78], eax
call fcn.0041ec45
test al, al
je 0x41ee71
mov ecx, str.InstallCrashHandler:_skipping_because_isWine_n
jmp 0x41ee0f
call fcn.00415628
call fcn.0041ec95
push 8
call fcn.004b7b0e
pop ecx
push ebx
mov esi, eax
push 0x20000
push ebx
mov dword [esi], 0x4f6844
call dword [sym.imp.KERNEL32.dll_HeapCreate]
cmp byte [0x5191ca], bl
mov edx, str.https:__www.sumatrapdfreader.org_dl_prerel_PRE_RELEASE_VER_SumatraPDF_prerel
mov dword [esi + 4], eax
mov eax, str.https:__www.sumatrapdfreader.org_dl_rel_SumatraPDF_3.5.2
cmove edx, eax
mov dword [0x519c50], esi
push ebx
push str._32.pdb.lzsa
xor ecx, ecx
call fcn.0045f798
mov dword [0x519c68], eax
call fcn.004147f6
push ebx
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0046311e
mov edi, dword [ebp - 0xc]
add esp, 0xc
test edi, edi
je 0x41ef19
push ecx
mov edx, edi
mov ecx, 0x4f25f0
call fcn.0046ee8f
mov esi, eax
pop ecx
push ebx
mov edx, esi
lea ecx, [ebp - 0xc]
mov byte [esi + 0x174], bl
call fcn.004299c2
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [0x519c60], ecx
mov ecx, esi
call fcn.00429ab7
push edi
call fcn.004c5e5a
pop ecx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x519c64], eax
test eax, eax
jne 0x41ef36
mov ecx, str.InstallCrashHandler:_skipping_because__gDumpEvent_n
jmp 0x41ee0f
push ebx
push ebx
push ebx
push 0x41e769
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x519c74], eax
test eax, eax
jne 0x41ef59
mov ecx, str.InstallCrashHandler:_skipping_because__gDumpThread_n
jmp 0x41ee0f
push 0x41e84c
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x41e7bd
push 1
mov dword [0x519c4c], eax
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0x41edc6
push 0x16
call fcn.004c7631
push 0x41edd9
call fcn.004c71b2
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424cf5
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
call fcn.0045532b
xor ebx, ebx
cmp dword [eax + 0x1c], ebx
sete cl
call fcn.00413f3a
mov eax, dword [edi + 0x94]
test eax, eax
je 0x424d34
push 0x53
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x424eb4
mov ebx, 0x200
push ebx
call fcn.004b7b0e
pop ecx
push ebx
mov esi, eax
push 0
push esi
call fcn.004b8c50
add esp, 0xc
mov ecx, esi
call fcn.00424eb9
lea ecx, [ebp - 0x60]
mov ebx, eax
call fcn.0041dbcd
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 1
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xeeeeee
call fcn.00455361
mov ecx, 0x4f6fa8
mov esi, eax
call fcn.00453983
push esi
push 0x4f6fa4
mov edi, eax
call fcn.0046265e
mov edx, edi
mov ecx, eax
call fcn.0045f798
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
mov ecx, ebx
lea eax, [ebp - 0x60]
mov byte [ebp - 0x34], 0
push eax
call fcn.0045b181
mov ecx, ebx
call fcn.004240e7
mov esi, dword [ebp - 4]
mov ecx, ebx
mov dword [ebx + 0x78], esi
mov dword [esi + 0x94], ebx
call fcn.00423f44
add esi, 0x98
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 4]
test edi, edi
jne 0x424e04
mov edx, dword [esi + 8]
lea ecx, [ebp - 0x24]
mov edi, 0x2d0
mov edx, dword [edx + 0xc]
call fcn.00464093
cmp dword [ebp - 0x18], 0
jle 0x424e1c
mov edi, dword [ebp - 0x18]
cmp edi, 0x400
jle 0x424e1c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xd8], 0xe
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x424e2d
cmp dword [ebp - 8], 0
je 0x424e2d
xor al, al
jmp 0x424e2f
mov al, 1
mov ecx, dword [ebx + 0x7c]
push dword [ebx + 0x34]
push edi
test al, al
je 0x424e56
mov edx, 0x208
call fcn.0045a162
mov edx, dword [esi + 8]
pop ecx
pop ecx
mov ecx, dword [ebx + 0x34]
mov edx, dword [edx + 8]
call fcn.00466aa9
jmp 0x424e8c
call fcn.0045a162
mov edx, dword [ebx + 0x34]
lea esi, [ebp - 0x14]
push ecx
push ecx
mov edi, esp
lea ecx, [ebp - 0x24]
push 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00465018
add esp, 0x14
xor eax, eax
push 5
push eax
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push eax
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebx + 0x78]
mov edx, dword [eax + 0xb0]
test edx, edx
setne al
mov byte [ebx + 0x15c], al
test edx, edx
je 0x424eab
mov ecx, ebx
call fcn.00423d12
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429ca2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004b8c50
add esp, 0xc
lea eax, [ebp - 0x20c]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x429d12
cmp esi, edi
sbb cl, cl
inc cl
call fcn.00413f3a
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00462810
test eax, eax
je 0x429d12
push str.sumatra_install_log.txt
mov edx, eax
xor ecx, ecx
call fcn.0046297c
jmp 0x429d20
push 0xffffffffffffffff
mov edx, str.sumatra_install_log.txt
xor ecx, ecx
call fcn.0045f484
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b7879
leave
ret

Function at 0x42b2b4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push 0x30
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.004b8c50
add esp, 0xc
lea ecx, [ebp - 0x30]
mov edx, str.SUMATRA_PDF_INSTALLER_FRAME
push 0x42b181
call fcn.0046404b
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 1
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx esi, ax
test si, si
sete cl
call fcn.00413f3a
test si, si
jne 0x42b31e
push str.CreateInstallerWindow:_RegisterClassExW___failed_n
call fcn.004620b3
pop ecx
xor al, al
jmp 0x42b369
call fcn.0042b0b3
mov ecx, eax
mov dword [0x518b94], ecx
test ecx, ecx
je 0x42b31a
mov eax, dword [0x51aa94]
mov dword [eax], ecx
push dword [0x4f30d4]
mov ecx, dword [0x518b88]
call fcn.0042bcaf
pop ecx
mov ecx, dword [0x51aa94]
xor edx, edx
mov ecx, dword [ecx]
call fcn.00465380
mov ecx, dword [0x51aa94]
push 5
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
leave
ret

Function at 0x42b44a
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x518b98]
cmp byte [eax + 0x151], 0
je 0x42b469
or edx, 0xffffffff
call fcn.00462810
xor dl, dl
mov ecx, eax
jmp fcn.00461f14
push 0
push 0x4f8c44
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
ret
Function at 0x42bd47
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call fcn.0042bcc7
mov dword [edi], eax
test eax, eax
jne 0x42bd69
and dword [edi + 4], eax
mov ecx, str.GetPreviousInstallInfo:_not_installed_n
xor dl, dl
pop edi
pop esi
pop ebx
jmp fcn.00461f14
call fcn.00437242
mov byte [edi + 8], al
call fcn.004370e2
mov byte [edi + 9], al
call fcn.0042bc33
mov esi, eax
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
push str.InstallLocation
mov edx, esi
call fcn.0046459c
mov edx, esi
mov dword [esp], str.InstallLocation
mov ecx, SysReAllocString
mov ebx, eax
call fcn.0046459c
pop ecx
test ebx, ebx
je 0x42bdbc
test eax, eax
je 0x42bdb4
push 3
pop eax
jmp 0x42bdbf
test ebx, ebx
je 0x42bdbc
push 2
jmp 0x42bdb1
xor eax, eax
inc eax
push eax
mov dword [edi + 4], eax
movzx eax, byte [edi + 9]
push eax
movzx eax, byte [edi + 8]
push eax
push dword [edi]
push str.GetPreviousInstallInfo:_dir__s__search_filter:__d__preview:__d__typ:__d_n
call fcn.004620b3
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x42be9b
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x513010]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [esp + 0xc], ebx
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x42bf8b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x42bf8b
test ebx, ebx
jne 0x42bee5
test edi, edi
je 0x42bf8b
push esi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42bef9
xor bl, bl
jmp 0x42bf77
push 0x424
xor ebx, ebx
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.004b8c50
add esp, 0xc
mov dword [esp + 0x18], 0x428
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x42bf6f
or edx, 0xffffffff
lea ecx, [esp + 0x238]
call fcn.00462810
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
test eax, eax
je 0x42bf52
mov edx, ecx
mov ecx, eax
call fcn.00462d5a
test al, al
jne 0x42bf75
mov ecx, dword [esp + 0x14]
test edi, edi
je 0x42bf63
mov edx, ecx
mov ecx, edi
call fcn.00462d5a
test al, al
jne 0x42bf75
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x42bf24
jmp 0x42bf77
mov bl, 1
test esi, esi
je 0x42bf87
cmp esi, 0xffffffff
je 0x42bf87
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x42bf8d
xor al, al
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b7879
mov esp, ebp
pop ebp
ret
Function at 0x42bfa5
Capabilities:
Print debug messages

Disassembly:
push esi
xor dl, dl
mov ecx, str.UninstallBrowserPlugin___n
call fcn.00461f14
mov ecx, str.npPdfViewer.dll
call fcn.0042bde0
mov esi, eax
mov ecx, esi
call fcn.0046330d
test al, al
jne 0x42bfe5
mov edx, str.Path
mov ecx, str.SoftwareMozillaPlugins_mozilla.zeniko.ch_SumatraPDF_Browser_Plugin
call fcn.004645d2
mov esi, eax
mov ecx, esi
call fcn.0046330d
test al, al
je 0x42c028
mov ecx, esi
call fcn.0046330d
test al, al
je 0x42c01b
push ecx
mov ecx, esi
call fcn.00465f07
pop ecx
test al, al
jne 0x42c01b
xor dl, dl
mov ecx, str.__failed_to_uninstall_browser_plugin_n
call fcn.00461f14
mov ecx, str.Couldnt_uninstall_browser_plugin
call fcn.004539bd
mov ecx, eax
pop esi
jmp fcn.0042bc4e
xor dl, dl
mov ecx, str.__did_uninstall_browser_plugin_n
pop esi
jmp fcn.00461f14
pop esi
ret

Function at 0x42c172
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x513010]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
push ecx
push 8
mov edi, edx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x42c202
cmp esi, 0xffffffff
je 0x42c202
push 0x424
xor ebx, ebx
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.004b8c50
add esp, 0xc
mov dword [esp + 0x10], 0x428
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x42c1f8
or edx, 0xffffffff
lea ecx, [esp + 0x230]
call fcn.00462810
mov edx, eax
mov ecx, edi
call fcn.00462d5a
test al, al
jne 0x42c1fe
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x42c1d0
jmp 0x42c20d
mov bl, 1
jmp 0x42c204
xor bl, bl
test esi, esi
je 0x42c214
cmp esi, 0xffffffff
je 0x42c214
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x43c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b7879
mov esp, ebp
pop ebp
ret
Function at 0x42c22b
Capabilities:
Enumerate processes
Find taskbar
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push edi
push str.KillProcessesWithModule:__s_n
mov dword [ebp - 0x23c], edi
call fcn.004620b3
pop ecx
pop ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x42c350
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x42c350
xor ebx, ebx
mov eax, dword [ebp - 0x230]
mov edx, edi
mov ecx, eax
mov dword [ebp - 0x240], eax
call fcn.0042c172
test al, al
je 0x42c316
push edi
mov edi, dword [ebp - 0x240]
push edi
push str.KillProcWithIdAndModule___processId_d__modulePath_s_n
call fcn.004620b3
add esp, 0xc
push edi
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42c310
cmp edi, 0xffffffff
je 0x42c310
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x42c2ea
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42c310
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x230]
push str.__killed_process_with_id__d_n
call fcn.004620b3
pop ecx
pop ecx
inc ebx
mov edi, dword [ebp - 0x23c]
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x42c28d
test ebx, ebx
jle 0x42c353
push str.Shell_TrayWnd
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
jmp 0x42c353
or ebx, 0xffffffff
test esi, esi
je 0x42c363
cmp esi, 0xffffffff
je 0x42c363
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret