joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d7c0
Capabilities:
Read .ini file

Disassembly:
push 0x224
mov eax, 0x5575da
call fcn.0052faf2
mov edi, ecx
mov dword [ebp - 0x230], edi
call fcn.0042b589
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040217f
and dword [ebp - 4], 0
push edi
push 0x589618
lea eax, [ebp - 0x21c]
push str._s_d
push eax
call fcn.004034f1
lea ecx, [ebp - 0x228]
call fcn.00409c58
push str.EventSetting.ini
push eax
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 1
call fcn.004016d7
add esp, 0x1c
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.004021a7
push dword [ebp - 0x224]
push 0x3c
push str.Time
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push dword [ebp - 0x224]
mov ebx, eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x587cac
push str.FolderPath
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.00429758
pop ecx
test eax, eax
je 0x40d991
cmp word [ebp - 0x218], 0
je 0x40d991
push edi
mov eax, esi
call fcn.0040d79a
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x40d93b
push 0xd4
call fcn.0042b4e8
pop ecx
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x40d8f1
push edi
push ecx
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
call fcn.00401daf
push dword [ebp - 0x220]
call fcn.0040cb1f
jmp 0x40d8f3
xor eax, eax
mov byte [ebp - 4], 3
mov edi, dword [esi + 4]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
push dword [edi + 4]
push edi
call fcn.0040a205
mov ecx, dword [esi + 8]
mov edx, 0x3ffffffe
sub edx, ecx
cmp edx, 1
jae 0x40d929
push str.list_T__too_long
call fcn.00546b6c
inc ecx
mov dword [esi + 8], ecx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
mov edi, dword [ebp - 0x230]
mov dword [ecx], eax
mov eax, dword [esi]
imul ebx, ebx, 0x3e8
push 0
push ebx
push edi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push ecx
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
call fcn.00401daf
mov ecx, dword [ebp - 0x220]
call fcn.0040ce70
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.004021a7
xor eax, eax
inc eax
jmp 0x40d9af
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.004021a7
xor eax, eax
call fcn.0052fb75
ret
Function at 0x410b5f
Capabilities:
Read .ini file

Disassembly:
push 0x60
mov eax, 0x555da3
call fcn.0052faf2
lea ecx, [ebp - 0x6c]
call fcn.0042d64f
and dword [ebp - 4], 0
call fcn.0042b589
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040217f
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00409aa7
push str.Epson_SoftwareCommonEventInfo.plg
mov eax, esi
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.004016d7
add esp, 0xc
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.00401ee1
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.004021a7
mov edi, dword [ebp - 0x4c]
push 0
push edi
lea ecx, [ebp - 0x6c]
call fcn.0042d6f6
test eax, eax
jne 0x410c08
lea ecx, [ebp - 0x6c]
call fcn.0042d1bb
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.004021a7
lea ecx, [edi - 0x10]
call fcn.004021a7
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.0042d681
mov eax, esi
call fcn.0052fb75
ret
call fcn.0042b589
push eax
lea ecx, [ebp - 0x48]
call fcn.0040217f
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 4
call fcn.0042d2a1
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x6c]
call fcn.0042d939
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.00401ee1
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.004021a7
push 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x48]
call fcn.00406fff
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 6
call fcn.0040c88d
push 0x58a190
lea ecx, [ebp - 0x40]
call fcn.00408932
test eax, eax
je 0x410c8e
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.004021a7
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
jmp 0x410d02
mov esi, dword [ebp - 0x48]
push esi
push 0xa
lea eax, [ebp - 0x38]
push eax
push 0x587cac
push str.EventID
push str.Event
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401daf
push 0x58a1b8
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.00408932
test eax, eax
je 0x410d14
lea ecx, [ebp - 0x6c]
call fcn.0042d611
test eax, eax
jne 0x410ce5
mov eax, dword [ebp - 0x6c]
push 0x10
lea ecx, [ebp - 0x6c]
call dword [eax + 0x38]
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.004021a7
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 2
call fcn.004021a7
test ebx, ebx
jne 0x410c08
jmp 0x410bdf
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.004021a7
lea ecx, [esi - 0x10]
call fcn.004021a7
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.004021a7
lea ecx, [edi - 0x10]
call fcn.004021a7
xor esi, esi
inc esi
jmp 0x410bf4
Function at 0x411a38
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x553459
call fcn.0052faf2
and dword [ebp - 4], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], edi
call fcn.0042b589
push eax
mov ecx, edi
call fcn.0040217f
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
push str.SoftwareEPSONFastFoto
push SysReAllocString
mov dword [ebp - 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x411aba
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push str.LastConnectDS
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411ab1
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.0040210b
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0052fb75
ret

Function at 0x411ac2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x553459
call fcn.0052faf2
and dword [ebp - 4], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], edi
call fcn.0042b589
push eax
mov ecx, edi
call fcn.0040217f
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
push str.SoftwareEPSONEpsonScanManager
push SysReAllocString
mov dword [ebp - 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x411b44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push str.LastConnectDS
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411b3b
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.0040210b
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0052fb75
ret
Function at 0x411b4c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x70
mov eax, 0x555b34
call fcn.0052fa89
xor esi, esi
push str.ScanButtonConfig.exe
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.004070b3
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.00409b98
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00401680
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004021a7
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push str.___DSName:
push eax
call fcn.0040704f
push 0x588908
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 4
call fcn.004016d7
mov ecx, dword [ebp - 0x20]
add esp, 0x18
add ecx, 0xfffffff0
call fcn.004021a7
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.0052bfd0
push dword [ebp - 0x18]
mov dword [ebp - 0x7c], 0x44
call fcn.0052cd58
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x411c1d
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
push edi
call fcn.0052b484
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004021a7
call fcn.0052fb61
ret
Function at 0x41238e
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0x9c
mov eax, 0x555a96
call fcn.0052faf2
mov esi, ecx
lea ecx, [ebp - 0xa8]
call fcn.00409c58
push str.EventSetting.ini
push eax
lea eax, [ebp - 0xa4]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004016d7
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa8]
add ecx, 0xfffffff0
call fcn.004021a7
push dword [ebp - 0xa4]
push 1
push str.bShow
push 0x58a4e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 0x20019
push ebx
push str.SOFTWAREEPSONDocument_Capture
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x98], ebx
mov byte [ebp - 0x91], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esi + 0xd7c], ebx
cmp eax, ebx
jne 0x4124c4
lea eax, [ebp - 0xa0]
push eax
push ebx
lea eax, [ebp - 0x9c]
push eax
push ebx
push str.InstallPath
push dword [ebp - 0x98]
mov dword [ebp - 0xa0], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412460
cmp edi, ebx
je 0x412460
mov dword [esi + 0xd7c], 1
mov edi, 0x80
push edi
lea eax, [ebp - 0x90]
push ebx
push eax
call fcn.0052bfd0
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push ebx
push str.Version
push dword [ebp - 0x98]
mov dword [ebp - 0xa0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4124b8
cmp word [ebp - 0x90], 0x32
jb 0x4124b8
mov byte [ebp - 0x91], 1
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [ebp - 0x9c], esp
cmp dword [esi + 0xd7c], ebx
je 0x4124fb
mov ecx, esp
push 0x58a588
call fcn.00401daf
add esi, 0x1f0
cmp byte [ebp - 0x91], bl
je 0x4124f4
push 0x84
jmp 0x412511
push 0x83
jmp 0x412511
mov edi, esp
call fcn.0042b589
push eax
mov ecx, edi
call fcn.0040217f
push ebx
add esi, 0x1f0
push esi
call fcn.0042875a
mov ecx, dword [ebp - 0xa4]
add ecx, 0xfffffff0
call fcn.004021a7
call fcn.0052fb75
ret
Function at 0x4135d8
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x2c4
mov eax, 0x556ea3
call fcn.0052faf2
mov eax, dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
push str.SoftwareEPSONEPSON_Scan
lea ecx, [ebp - 0x2a4]
mov dword [ebp - 0x2ac], eax
mov dword [edi], ebx
call fcn.00401daf
lea eax, [ebp - 0x2b0]
push eax
push 0x20019
push ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x2a4]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41369d
mov dword [ebp - 0x2a0], ebx
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
mov dword [ebp - 0x2b4], esi
call fcn.0052bfd0
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x2a0]
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x2a8], eax
cmp eax, ebx
jne 0x41368f
mov ecx, dword [ebp - 0x2ac]
inc dword [edi]
lea eax, [ebp - 0x218]
push eax
call fcn.0042c816
inc dword [ebp - 0x2a0]
cmp dword [ebp - 0x2a8], ebx
je 0x413636
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xa
lea ecx, [ebp - 0x2d0]
call fcn.0042c48a
lea eax, [ebp - 0x2d0]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.004070f7
mov ecx, eax
call fcn.0040715b
mov esi, dword [ebp - 0x2cc]
jmp 0x413786
mov eax, esi
cmp esi, ebx
je 0x4137b2
mov eax, dword [eax + 8]
mov esi, dword [esi]
sub eax, 0x10
push eax
call fcn.00401e83
lea edi, [eax + 0x10]
pop ecx
mov dword [ebp - 0x2a8], edi
lea eax, [ebp - 0x298]
push 3
mov byte [ebp - 4], 2
mov dword [ebp - 0x29c], eax
push edi
lea eax, [ebp - 0x29c]
push eax
call fcn.00404273
lea eax, [ebp - 0x2a0]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x29c]
push eax
call fcn.00416b9d
pop ecx
lea eax, [ebp - 0x298]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x29c], eax
je 0x41374f
push dword [ebp - 0x29c]
call fcn.0052b484
pop ecx
mov eax, dword [ebp - 0x2a0]
cmp dword [eax - 0xc], ebx
jle 0x41376c
mov ecx, dword [ebp - 0x2ac]
lea eax, [ebp - 0x2a0]
push eax
call fcn.0042c6d5
mov ecx, dword [ebp - 0x2a0]
add ecx, 0xfffffff0
call fcn.004021a7
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 1
call fcn.004021a7
cmp esi, ebx
jne 0x4136d9
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], bl
call fcn.0042c5b8
mov ecx, dword [ebp - 0x2a4]
add ecx, 0xfffffff0
call fcn.004021a7
call fcn.0052fb75
ret 4
call fcn.0042c2ad
int3
Function at 0x414b70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x553459
call fcn.0052faf2
and dword [ebp - 4], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], edi
call fcn.0042b589
push eax
mov ecx, edi
call fcn.0040217f
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
push str.SoftwareEPSONEpsonScanManager
push SysReAllocString
mov dword [ebp - 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x414bf2
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push str.LastUSBConnectDS
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x414be9
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.0040210b
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0052fb75
ret
Function at 0x415f71
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0xc], 4
mov dword [ebp - 4], edi
je 0x415f8b
cmp dword [ebp + 0xc], 5
jne 0x415fa8
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push edi
push edi
call esi
cmp dword [ebp + 0xc], 5
mov ebx, eax
jne 0x415fa8
push edi
push edi
push edi
push edi
call esi
mov dword [ebp - 4], eax
cmp dword [0x5bc160], edi
je 0x415fe6
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp - 4]
mov dword [ebp + 0xc], edi
push ebx
push dword [ebp + 0x10]
call fcn.0040e187
add esp, 0xc
push eax
push 0x40e291
push edi
push edi
call fcn.0052d4ff
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x415fe9
push 8
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x416438
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4164a1
cmp dword [ebp + 0x10], 1
je 0x416479
cmp dword [ebp + 0x10], 2
je 0x416479
push 0xd
pop eax
jmp 0x4164a1
mov eax, dword [ebp - 4]
test edi, edi
je 0x41649b
test eax, eax
je 0x416496
test al, 1
jne 0x416474
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x41649b
jmp 0x416474
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x416fd5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5b3db0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x5bc5cc]
xor eax, eax
mov dword [ebp - 0x210], eax
cmp dword [ecx - 0xc], eax
jne 0x41702c
push 1
push 0x1a
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0052ba99
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
mov ecx, 0x5bc5cc
call fcn.00401e12
mov eax, dword [0x5bc5cc]
add eax, 0xfffffff0
push eax
call fcn.00401e83
add eax, 0x10
pop ecx
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov eax, esi
call fcn.0052b424
leave
ret
Function at 0x41747b
Capabilities:
Get file version info

Disassembly:
push 0xa0
mov eax, 0x556e21
call fcn.0052faf2
mov eax, dword [ebp + 8]
push 3
push eax
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x94]
push eax
xor esi, esi
mov dword [ebp - 0x98], ecx
call fcn.00404273
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x98]
call fcn.00416e6a
or dword [ebp - 4], 0xffffffff
mov bl, al
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x98], eax
je 0x4174d8
push dword [ebp - 0x98]
call fcn.0052b484
pop ecx
test bl, bl
je 0x4174e5
xor eax, eax
inc eax
call fcn.0052fb75
ret
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_Pathsestcfg.exe
lea ecx, [ebp - 0xa0]
call fcn.00401daf
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
call fcn.0042b589
push eax
lea ecx, [ebp - 0x9c]
call fcn.0040217f
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xa0]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0xa8], esp
mov edi, esp
push eax
call fcn.00401e83
add eax, 0x10
mov dword [edi], eax
pop ecx
lea eax, [ebp - 0x9c]
push eax
call fcn.00429900
pop ecx
pop ecx
test eax, eax
jne 0x417563
mov ecx, dword [ebp - 0x9c]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0xa0]
add ecx, 0xfffffff0
call fcn.004021a7
xor eax, eax
jmp 0x4174df
push 0
push dword [ebp - 0x9c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x41759c
xor esi, esi
mov ecx, dword [ebp - 0x9c]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0xa0]
add ecx, 0xfffffff0
call fcn.004021a7
mov eax, esi
jmp 0x4174df
push edi
call fcn.0042b522
pop ecx
push eax
push edi
push 0
push dword [ebp - 0x9c]
mov dword [ebp - 0xa4], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x417616
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa8]
push eax
push 0x5881b8
push dword [ebp - 0xa4]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x417616
mov eax, dword [ebp - 0xa8]
movzx ecx, word [eax + 0xa]
movzx edx, word [eax + 8]
movzx esi, word [eax + 0xe]
cmp ecx, 3
jle 0x4175fb
mov esi, ebx
jmp 0x417616
jge 0x417601
xor esi, esi
jmp 0x417616
cmp edx, 7
jg 0x4175f7
jl 0x4175fd
cmp esi, 5
jg 0x4175f7
jl 0x4175fd
cmp word [eax + 0xc], bx
sbb esi, esi
inc esi
push dword [ebp - 0xa4]
call fcn.0042b517
pop ecx
jmp 0x417579
Function at 0x417980
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push 0x4f4
mov eax, 0x556d63
call fcn.0052faf2
mov esi, ecx
call fcn.0042b589
push eax
lea ecx, [ebp - 0x4b8]
call fcn.0040217f
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0042b589
push eax
lea ecx, [ebp - 0x4bc]
call fcn.0040217f
mov byte [ebp - 4], 1
mov eax, dword [esi]
push 3
push eax
lea eax, [ebp - 0x4ac]
lea ecx, [ebp - 0x4a8]
push eax
mov dword [ebp - 0x4ac], ecx
call fcn.00404273
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4ac]
call fcn.00416e6a
mov byte [ebp - 0x4ad], al
lea eax, [ebp - 0x4a8]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x4ac], eax
je 0x417a0c
push dword [ebp - 0x4ac]
call fcn.0052b484
pop ecx
lea eax, [ebp - 0x4b8]
cmp byte [ebp - 0x4ad], bl
je 0x417ad3
push dword [esi]
push str._TEMP_DNAME___s__IP_LOCAL
push eax
call fcn.004034f1
add esp, 0xc
lea eax, [ebp - 0x4b4]
push eax
push 0x20019
push ebx
push 0x58adb4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417b53
lea eax, [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x4c4]
push eax
push ebx
push str.BaseModulePath
push dword [ebp - 0x4b4]
mov dword [ebp - 0x4c0], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x417ac2
push 0xffffffffffffffff
push str.Corees2utility.exe
lea eax, [ebp - 0x424]
push 0x208
push eax
call fcn.0052f1fe
lea eax, [ebp - 0x424]
push eax
call fcn.0052ba99
add esp, 0x14
push eax
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.00401e12
push dword [ebp - 0x4b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x417b53
push dword [esi]
push str._T:__s__L
push eax
call fcn.004034f1
add esp, 0xc
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_Pathsestcfg.exe
lea ecx, [ebp - 0x4b4]
call fcn.00401daf
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x4b4]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x4c4], esp
mov esi, esp
push eax
call fcn.00401e83
add eax, 0x10
mov dword [esi], eax
pop ecx
lea eax, [ebp - 0x4bc]
push eax
call fcn.00429900
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4b4]
add ecx, 0xfffffff0
cmp eax, ebx
jne 0x417b4e
call fcn.004021a7
mov ecx, dword [ebp - 0x4bc]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x4b8]
add ecx, 0xfffffff0
jmp 0x417bc3
call fcn.004021a7
push 0x38
lea eax, [ebp - 0x4fc]
push ebx
push eax
call fcn.0052bfd0
mov esi, dword [ebp - 0x4bc]
mov edi, dword [ebp - 0x4b8]
add esp, 0xc
lea eax, [ebp - 0x500]
push eax
mov dword [ebp - 0x500], 0x3c
mov dword [ebp - 0x4fc], 0x40
mov dword [ebp - 0x4f0], esi
mov dword [ebp - 0x4ec], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x4c8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x4c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.004021a7
lea ecx, [edi - 0x10]
call fcn.004021a7
call fcn.0052fb75
ret
Function at 0x418127
Capabilities:
Read .ini file

Disassembly:
push 0x30
mov eax, 0x5545d0
call fcn.0052fa89
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], edi
call fcn.0042b589
mov ecx, dword [ebp + 8]
push eax
call fcn.0040217f
xor esi, esi
mov dword [ebp - 4], edi
inc esi
mov dword [ebp - 0x1c], esi
call fcn.0042b589
push eax
lea ecx, [ebp - 0x14]
call fcn.0040217f
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push str._04x
push eax
mov dword [ebp - 4], esi
call fcn.004034f1
add esp, 0xc
call fcn.0042b589
push eax
lea ecx, [ebp - 0x10]
call fcn.0040217f
mov byte [ebp - 4], 2
lea esi, [ebp + 0x10]
cmp dword [ebp + 0x10], edi
je 0x4181b3
call fcn.00416fd5
mov byte [ebp - 4], 3
push dword [ebp - 0x14]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10]
push 0x58b148
push eax
call fcn.004034f1
add esp, 0x10
jmp 0x4181cf
call fcn.00416fd5
mov byte [ebp - 4], 4
push dword [eax]
lea eax, [ebp - 0x10]
push str._sEpsonDocument_CaptureAppInfo1_
push eax
call fcn.004034f1
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.004021a7
lea ecx, [ebp - 0x3c]
call fcn.0042d64f
push 0x58b1e8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 5
call fcn.004016d7
add esp, 0xc
push edi
mov byte [ebp - 4], 6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3c]
call fcn.0042d6f6
cmp eax, edi
je 0x4182b6
call fcn.0042b589
push eax
lea ecx, [ebp + 0x10]
call fcn.0040217f
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.0042d2a1
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0042d939
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 8
call fcn.00401ee1
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004021a7
mov esi, dword [ebp + 0x10]
push esi
push edi
push str.ProjectID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, dword [ebp + 0x14]
je 0x4182a2
lea ecx, [ebp - 0x3c]
call fcn.0042d611
test eax, eax
jne 0x41828c
mov eax, dword [ebp - 0x3c]
push 0x10
lea ecx, [ebp - 0x3c]
call dword [eax + 0x38]
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 6
call fcn.004021a7
cmp ebx, edi
jne 0x418217
jmp 0x4182b6
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
call fcn.00401ee1
lea ecx, [esi - 0x10]
call fcn.004021a7
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004021a7
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.0042d681
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004021a7
mov eax, dword [ebp + 8]
call fcn.0052fb61
ret