joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f0f8
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x54b1b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x28], ebx
cmp edi, 0x4e
jne 0x49f123
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp edi, 8
jne 0x49f1f0
push ebx
push str.SysMonthCal32
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49f1aa
push 0x20
pop esi
push esi
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.004c24e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x100e
push edi
mov dword [ebp - 0x24], esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x18], 0x1010003
jne 0x49f18d
xor eax, eax
inc eax
jmp 0x49f199
cmp dword [ebp - 0x18], 0x2010003
je 0x49f188
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ba3af
leave
ret 0xc
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x14]
jl 0x49f1d8
cmp eax, dword [ebp - 0xc]
jg 0x49f1d8
cmp eax, dword [ebp - 0x10]
jl 0x49f1d8
cmp eax, dword [ebp - 8]
jle 0x49f196
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push 8
call fcn.0049ee8c
mov dword [ebp - 0x28], eax
jmp 0x49f196
mov ecx, dword [ebp + 0xc]
mov eax, 0x101
cmp edi, eax
jne 0x49f261
cmp ecx, 0x2e
je 0x49f206
cmp ecx, 8
jne 0x49f23d
push dword [ebp + 0x10]
push ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov edi, eax
mov eax, dword [esi + 0x10]
mov dword [eax + 0x14f4], 2
mov ecx, dword [esi + 0x10]
call sym.Update.exe_public:_void___thiscall_DuiLib::CDateTimeUI::UpdateText_void_
push ebx
push ebx
push 0x10
mov ecx, esi
call sym.Update.exe_public:_long_int___thiscall_DuiLib::CWindowWnd::PostMessageW_unsigned_int__unsigned_int__long_int_
mov eax, edi
jmp 0x49f199
cmp ecx, 0x1b
jne 0x49f261
push dword [ebp + 0x10]
push ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esi + 0x10]
mov dword [ecx + 0x14f4], 3
mov edi, eax
jmp 0x49f22b
push dword [ebp + 0x10]
push ecx
push edi
mov ecx, esi
call sym.Update.exe_protected_virtual:_long_int___thiscall_DuiLib::CWindowWnd::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x49f199
Function at 0x4a3b26
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x54b1b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
and dword [ebx + 0x368], 0
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x1c]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x28], ecx
mov ecx, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebx + 0x364], eax
mov dword [ebx + 0x36c], ecx
test eax, eax
jne 0x4a3b8e
call sym.Update.exe_public:_static_class_DuiLib::ObserverImpl____cdecl_DuiLib::CMenuWnd::GetGlobalContextMenuObserver_void_
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0xc]
test esi, esi
je 0x4a3b8e
call sym.Update.exe_public:_static_class_DuiLib::ObserverImpl____cdecl_DuiLib::CMenuWnd::GetGlobalContextMenuObserver_void_
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 0x14]
lea esi, [ebx + 0x10]
call sym.Update.exe_public:_static_class_DuiLib::ObserverImpl____cdecl_DuiLib::CMenuWnd::GetGlobalContextMenuObserver_void_
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx]
mov ecx, dword [ebx + 0x364]
test ecx, ecx
jne 0x4a3bab
mov ecx, edi
jmp 0x4a3bb2
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call sym.Update.exe_public:_struct_HWND______thiscall_DuiLib::CPaintManagerUI::GetPaintWindow_void_const
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call sym.Update.exe_public:_void___thiscall_DuiLib::CDuiRect::constructor_void_
push 0
sub esp, 0x10
mov edi, esp
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x88
push SysReAllocString
movsd dword es:[edi], dword [esi]
push 0
push dword [ebp - 0x18]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
call sym.Update.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__struct_tagRECT__struct_HMENU____
mov edi, dword [ebx + 4]
mov esi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x4a3bf5
push edi
call esi
mov edi, eax
push edi
call esi
test eax, eax
jne 0x4a3bf0
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ba3af
leave
ret 0x1c
Function at 0x4addb1
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x90
mov eax, 0x4eb868
call fcn.004bf4a7
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
call sym.Update.exe_public:_static_class_DuiLib::CDuiString_const____cdecl_DuiLib::CPaintManagerUI::GetResourcePath_void_
push eax
lea ecx, [ebp - 0x94]
call sym.Update.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_class_DuiLib::CDuiString_const__
xor edi, edi
push ebx
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], edi
call sym.Update.exe_public:_class_DuiLib::CDuiString_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call sym.Update.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::GetData_void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ade28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call sym.Update.exe_public:_void___thiscall_DuiLib::CDuiString::destructor_void_
xor eax, eax
call fcn.004bf52a
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi], eax
cmp eax, edi
je 0x4ade11
push eax
mov dword [ebp - 0x9c], edi
call fcn.00473ed3
pop ecx
push edi
lea ecx, [ebp - 0x9c]
push ecx
push dword [esi]
mov dword [ebp - 0x98], eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x9c]
cmp eax, dword [esi]
je 0x4ade8b
push dword [ebp - 0x98]
call fcn.004bba63
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call sym.Update.exe_public:_void___thiscall_DuiLib::CDuiString::destructor_void_
mov eax, edi
jmp 0x4ade22
mov edi, dword [ebp - 0x98]
jmp 0x4ade78

Function at 0x4ae028
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.Update.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4ae049
xor eax, eax
jmp 0x4ae0a7
push edi
call sym.Update.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4ae066
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4ae045
push esi
push edi
call sym.Update.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x4ae0a6
push ebx
push eax
call fcn.00473ed3
pop ecx
push dword [esi]
mov ebx, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebx
call fcn.004bec60
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop ebx
pop esi
pop edi
leave
ret
Function at 0x4ae0aa
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4ae0d7
xor eax, eax
jmp 0x4ae127
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
cmp eax, ebx
jne 0x4ae0ed
xor eax, eax
jmp 0x4ae126
push eax
mov dword [ebp - 8], ebx
call fcn.00473ed3
pop ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push dword [esi]
mov dword [ebp - 4], eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
cmp eax, dword [esi]
je 0x4ae123
push dword [ebp - 4]
call fcn.004bba63
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x4b4958
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x4b497d
cmp eax, esi
jge 0x4b4975
mov eax, edi
call fcn.004b4375
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
mov esi, dword [edi + 8]
xor ecx, ecx
test esi, esi
jle 0x4b49aa
mov eax, dword [edi + 0xc]
push ebx
mov dl, byte [edi + 0xc]
sub esi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, esi
inc ecx
mov dword [edi + 0xc], eax
test ebx, ebx
jg 0x4b498a
mov dword [edi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x4b49c6
mov esi, dword [edi + 4]
mov eax, dword [edi]
cmp eax, esi
jb 0x4b49b7
xor dl, dl
jmp 0x4b49bc
mov dl, byte [eax]
inc eax
mov dword [edi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x4b49ad
movzx esi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl esi, 8
add esi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, esi
xor ecx, 0xffff
cmp eax, ecx
je 0x4b49f8
mov eax, str.zlib_corrupt
call fcn.004afc1e
jmp 0x4b4a34
mov eax, dword [edi]
add eax, esi
cmp eax, dword [edi + 4]
jbe 0x4b4a08
mov eax, str.read_past_buffer
jmp 0x4b49f1
mov eax, dword [edi + 0x10]
lea ecx, [eax + esi]
cmp ecx, dword [edi + 0x18]
jbe 0x4b4a1e
push esi
call fcn.004b44b8
pop ecx
test eax, eax
je 0x4b4a34
push esi
push dword [edi]
push dword [edi + 0x10]
call fcn.004bec60
add dword [edi], esi
add dword [edi + 0x10], esi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x4ba3af
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x54b1b4]
jne 0x4ba3b9
repz ret
jmp fcn.004c6b24
Function at 0x4d5516
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4d553d
call fcn.004c209d
mov dword [eax], esi
call fcn.004c208a
push 0x16
pop esi
mov dword [eax], esi
call fcn.004c74c0
mov eax, esi
jmp 0x4d5592
test dword [ebp + 0xc], 0xfffffff9
jne 0x4d5523
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4d556a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004c20b0
pop ecx
call fcn.004c208a
mov eax, dword [eax]
jmp 0x4d5592
test al, 0x10
jne 0x4d5590
test al, 1
je 0x4d5590
test byte [ebp + 0xc], 2
je 0x4d5590
call fcn.004c209d
mov dword [eax], 5
call fcn.004c208a
mov dword [eax], 0xd
jmp 0x4d5561
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4e0ef6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x54b1b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004cad69
and dword [ebp - 0x14], 0
cmp dword [0x54ee40], 0
mov dword [ebp - 0x18], eax
jne 0x4e0fa9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4e1051
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x50b524
push ebx
call edi
test eax, eax
je 0x4e1051
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x54ee40], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x54ee44], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x54ee48], eax
call edi
push eax
call esi
mov dword [0x54ee50], eax
test eax, eax
je 0x4e0fa9
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x54ee4c], eax
mov eax, dword [0x54ee4c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4e1002
cmp dword [0x54ee50], ecx
je 0x4e1002
push eax
call esi
push dword [0x54ee50]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4e1002
test ebx, ebx
je 0x4e1002
call edi
test eax, eax
je 0x4e0ff9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4e0ff9
test byte [ebp - 8], 1
jne 0x4e1002
or dword [ebp + 0x10], 0x200000
jmp 0x4e1035
mov eax, dword [0x54ee44]
cmp eax, dword [ebp - 0x18]
je 0x4e1035
push eax
call esi
test eax, eax
je 0x4e1035
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4e1035
mov eax, dword [0x54ee48]
cmp eax, dword [ebp - 0x18]
je 0x4e1035
push eax
call esi
test eax, eax
je 0x4e1035
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x54ee40]
call esi
test eax, eax
je 0x4e1051
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4e1053
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ba3af
leave
ret
Function at 0x10003630
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push str.Softwareprojonepodlp_smprule_
push 0x80000002
mov dword [esp + 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1000367a
cmp dword [esp + 4], 4
jne 0x1000367a
mov eax, dword [esp + 8]
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
add esp, 0xc
ret
xor eax, eax
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
add esp, 0xc
ret
Function at 0x10003e70
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x1003f688
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1004e060]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1004e060]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [esp + 0x48]
mov ebp, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0x1c]
call fcn.100147b0
add esp, 4
xor esi, esi
mov dword [esp + 0x40], esi
mov eax, dword [esp + 0x1c]
mov ebx, 8
cmp dword [esp + 0x30], ebx
jae 0x10003ed0
lea eax, [esp + 0x1c]
push eax
push str._procmgr__msiexec_command:_ls
call fcn.1001a534
mov eax, dword [esp + 0x24]
add esp, 8
mov dword [esp + 0x14], esi
cmp dword [esp + 0x30], ebx
jae 0x10003ef0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x14], 3
mov edi, eax
jl 0x10003f7b
mov eax, dword [edi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x10003f1e
push 0x10043cf8
push eax
call ebx
test eax, eax
je 0x10003f31
mov eax, dword [edi + 4]
cmp eax, esi
je 0x10003f76
push 0x10043d00
push eax
call ebx
test eax, eax
jne 0x10003f76
mov eax, dword [edi + 8]
mov ecx, eax
lea ebx, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, si
jne 0x10003f40
sub ecx, ebx
sar ecx, 1
push ecx
mov esi, ebp
call fcn.100023a0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x30], 8
jb 0x10003f72
mov edx, dword [esp + 0x1c]
push edx
call fcn.1002889e
add esp, 4
mov al, 1
jmp 0x10003f97
mov ebx, 8
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x30], ebx
jb 0x10003f95
mov eax, dword [esp + 0x1c]
push eax
call fcn.1002889e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100283ef
add esp, 0x30
ret 8
Function at 0x100040b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov eax, dword [0x1004e060]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push ebp
mov ebp, dword [esp + 0x110]
cmp dword [ebp + 0x18], 8
push esi
push edi
lea ebx, [ebp + 4]
jb 0x100040dc
mov edi, dword [ebx]
jmp 0x100040de
mov edi, ebx
test edi, edi
je 0x10004118
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.msiexec.exe
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, esi
jg 0x10004118
sub esi, eax
push str.msiexec.exe
lea eax, [edi + esi*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb eax, eax
add eax, 1
je 0x10004118
xor al, al
jmp 0x1000416d
push 0x80
lea edx, [esp + 0x14]
xor ecx, ecx
push edx
mov word [esp + 0x18], cx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebp + 0x18], 8
jb 0x10004139
mov esi, dword [ebx]
jmp 0x1000413b
mov esi, ebx
test esi, esi
je 0x10004166
cmp word [esp + 0x10], 0
je 0x10004166
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
neg eax
sbb eax, eax
inc eax
jmp 0x10004168
xor eax, eax
test eax, eax
setne al
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100283ef
add esp, 0x104
ret 4
Function at 0x10005020
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x1003fbc8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1004e060]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
push str.SoftwareprojonepodlpinstallMgr_
push 0x80000002
mov dword [esp + 0x14], vtable.RegHandleHolder.0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x10005087
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
push eax
push eax
push eax
push str.SoftwareprojonepodlpinstallMgr_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], 0
test eax, eax
je 0x100050fb
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [esp + 4]
cmp eax, 0x1000
jbe 0x100050e4
push eax
push str.procmgr_delete_cache__count:_d
call fcn.10019f9c
add esp, 8
push str.SoftwareprojonepodlpinstallMgr_
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [esp + 0xc]
mov dword [esp + 8], vtable.RegHandleHolder.0
test eax, eax
je 0x100050fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
add esp, 0x18
ret
Function at 0x100080d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100404c0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x1004e060]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x30], ebx
and dword [esp + 0x14], 0xfffffe00
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
lea eax, [esp + 0xc]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0xffffffffffffffff
mov byte [esp + 0x54], 2
push ebx
lea edx, [esp + 0x64]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.10001ce0
mov eax, dword [esp + 0x58]
push eax
call fcn.1000bfc0
add esp, 0x24
cmp al, bl
je 0x100081f2
cmp byte [esp + 0x14], 7
jne 0x100081f2
push str.value_bool
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x1004447a
call fcn.1001decf
mov ecx, eax
call fcn.1001e2d3
test al, al
jne 0x1000819a
lea esi, [esp + 0xc]
mov byte [esp + 0x30], bl
call fcn.1001d289
cmp dword [esp + 0x54], 0x10
jb 0x10008213
mov edx, dword [esp + 0x40]
push edx
jmp 0x1000820b
push str.value_bool
lea eax, [esp + 0x10]
push eax
mov ecx, 0x1004447a
call fcn.1001decf
mov esi, eax
call fcn.1001d4ee
cmp eax, 1
sete cl
lea esi, [esp + 0xc]
mov byte [edi], cl
mov byte [esp + 0x30], bl
call fcn.1001d289
cmp dword [esp + 0x54], 0x10
jb 0x100081de
mov edx, dword [esp + 0x40]
push edx
call fcn.1002889e
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
lea esi, [esp + 0xc]
mov byte [esp + 0x30], bl
call fcn.1001d289
cmp dword [esp + 0x54], 0x10
jb 0x10008213
mov eax, dword [esp + 0x40]
push eax
call fcn.1002889e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x100082d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push edi
sub esp, 0x1c
mov ecx, esp
xor ebx, ebx
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
mov dword [esp + 0x54], ebx
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push esi
mov byte [esp + 0x5c], bl
lea edi, [esp + 0x5c]
mov byte [ecx + 4], bl
call fcn.10001ce0
mov eax, dword [esp + 0x4c]
push eax
call fcn.100080d0
add esp, 0x20
lea edi, [ebx + 8]
test ebp, ebp
je 0x1000831f
mov eax, ebp
jmp 0x1000833e
push esi
lea ecx, [esp + 0x14]
call fcn.10002c90
add esp, 4
mov ebx, 1
cmp dword [eax + 0x18], edi
jb 0x1000833b
mov eax, dword [eax + 4]
jmp 0x1000833e
add eax, 4
xor ecx, ecx
cmp byte [esp + 0x34], cl
push 4
lea edx, [esp + 0x38]
push edx
push 4
setne cl
push eax
push str.Softwareprojonepodlp_smprule_
push 0x80000002
mov dword [esp + 0x4c], ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test bl, 1
je 0x1000837d
cmp dword [esp + 0x28], edi
jb 0x1000837d
mov eax, dword [esp + 0x14]
push eax
call fcn.1002889e
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0x20
ret