joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013fe
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push edi
je 0x40151d
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x40151d
cmp byte [edi], bl
je 0x40151d
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00405830
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00405830
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.softwareEPSONSTM3Profile
push 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x401517
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x31c]
push eax
mov dword [ebp - 0x10], esi
call edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
jne 0x401517
cmp byte [ebp - 0x114], bl
je 0x401517
lea eax, [ebp - 0x114]
push eax
push esi
lea eax, [ebp - 0x218]
push eax
push 0x40c294
push str.DRVNAME
push str.Install
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, ebx
je 0x4014fa
cmp eax, 0x102
je 0x4014fa
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0xc]
call edi
jmp 0x401510
push str.EPSON
push dword [ebp + 0xc]
call edi
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
pop esi
jmp 0x40151f
xor eax, eax
pop edi
pop ebx
leave
ret

Function at 0x40156f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
cmp dword [ebp + 8], eax
push esi
push edi
je 0x4015c0
mov ebx, dword [ebp + 0x10]
cmp dword [ebx], eax
je 0x4015c0
cmp dword [ebp + 0x14], eax
je 0x4015c0
push dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
push edi
push dword [ebp + 8]
push str.Language
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov esi, eax
test esi, esi
je 0x4015c0
add edi, 0xfffffffe
cmp edi, esi
jne 0x4015af
push 0xfffffffffffffffc
pop eax
jmp 0x4015c3
push esi
push dword [ebp + 8]
call fcn.004013e0
pop ecx
mov dword [ebx], eax
pop ecx
mov eax, esi
jmp 0x4015c3
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401655
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
and dword [ebp - 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
mov dword [ebp - 4], 1
mov edi, dword [ebp - 4]
imul edi, edi, 0x104
inc dword [ebp - 4]
cmp dword [ebp - 8], 0
je 0x40169e
push dword [ebp - 8]
call esi
push eax
call ebx
push dword [ebp - 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [ebp - 8], eax
je 0x401701
push dword [ebp + 0x10]
lea ecx, [ebp - 4]
push ecx
push edi
push eax
call fcn.0040156f
add esp, 0x10
test eax, eax
mov dword [ebp - 0xc], eax
je 0x401678
mov edi, dword [ebp - 4]
lea eax, [edi + edi*2]
shl eax, 2
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x401708
push dword [ebp - 8]
call esi
push eax
call ebx
push dword [ebp - 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0xfffffffffffffffd
jmp 0x4017dd
push edi
push dword [ebp - 0xc]
push dword [ebp - 8]
push eax
call fcn.004012f3
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00405830
and dword [ebp - 4], 0
add esp, 0x1c
test edi, edi
jle 0x40179e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x114]
push 0x104
push eax
mov eax, dword [ebp - 0xc]
push 0x40c294
push str.ResDll
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jl 0x401777
push dword [ebp + 0x10]
lea eax, [ebp - 0x114]
push eax
call fcn.00401523
cmp eax, 1
pop ecx
pop ecx
je 0x401785
inc dword [ebp - 4]
add dword [ebp - 0xc], 0xc
cmp dword [ebp - 4], edi
jl 0x401739
jmp 0x40179e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
lea eax, [eax + eax*2]
push dword [ecx + eax*4]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x10]
call esi
push eax
call ebx
push dword [ebp - 0x10]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
call edi
push dword [ebp - 8]
call esi
push eax
call ebx
push dword [ebp - 8]
call esi
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 0xc]
inc eax
cmp dword [ecx], eax
mov dword [ecx], eax
jae 0x4017e0
push 0xfffffffffffffffc
pop eax
jmp 0x4017f2
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401905
Capabilities:
Identify system language via api
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x401a28
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x401a28
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x401a28
cmp byte [ebx], 0
je 0x401a28
mov eax, dword [edi]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, 0x104
push esi
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00405830
push dword [ebp - 4]
push ebx
push edi
push dword [ebp + 8]
call fcn.004017f7
add esp, 0x1c
test eax, eax
jl 0x401a2b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
lea eax, [ebp - 0x10c]
push eax
push 0x40c294
push str.ResDll
push dword [ebp + 8]
call ebx
test eax, eax
mov dword [ebp - 4], eax
jl 0x401a2b
push dword [ebp + 0x10]
lea eax, [ebp - 0x10c]
push eax
call fcn.00401523
test eax, eax
pop ecx
pop ecx
jne 0x401a21
mov eax, dword [ebp - 8]
push 0x409
push dword [ebp + 0x10]
mov dword [edi], eax
push edi
push dword [ebp + 8]
call fcn.004017f7
add esp, 0x10
test eax, eax
jl 0x401a2b
push dword [ebp + 0x10]
lea eax, [ebp - 0x10c]
push esi
push eax
push 0x40c294
push str.ResDll
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jl 0x401a24
push dword [ebp + 0x10]
lea eax, [ebp - 0x10c]
push eax
call fcn.00401523
test eax, eax
pop ecx
pop ecx
jne 0x401a24
push dword [ebp + 0x10]
mov eax, dword [ebp - 8]
push edi
push dword [ebp + 8]
mov dword [edi], eax
call fcn.00401655
add esp, 0xc
test eax, eax
mov dword [ebp - 4], eax
jge 0x401a21
jmp 0x401a2b
mov esi, dword [ebp - 4]
mov eax, esi
jmp 0x401a2b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401a30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 4], 0x104
call fcn.00401905
add esp, 0xc
test eax, eax
jge 0x401a5f
or eax, 0xffffffff
leave
ret
mov eax, dword [ebp + 0x10]
push esi
push dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x108]
push esi
push 0x40c294
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x401a8a
or eax, 0xffffffff
jmp 0x401a96
cmp byte [esi], 0
jne 0x401a94
push 0xfffffffffffffffe
pop eax
jmp 0x401a96
xor eax, eax
pop esi
leave
ret
Function at 0x401a99
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
lea eax, [ebp - 4]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push str.softwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401ae6
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401b63
cmp dword [ebp + 0xc], ebx
je 0x401b63
mov dword [ebp - 8], ebx
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x104
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
cmp edi, ebx
jne 0x401b3c
push dword [ebp + 0xc]
lea eax, [ebp - 0x114]
push eax
call fcn.00405a40
test eax, eax
pop ecx
pop ecx
jne 0x401b49
cmp edi, 0x103
je 0x401b59
inc dword [ebp - 8]
jmp 0x401aef
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
leave
ret

Function at 0x40203c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push 0x104
xor ebx, ebx
lea eax, [ebp - 0x108]
push ebx
push eax
mov esi, ecx
call fcn.00405830
lea eax, [esi + 0x210]
add esp, 0xc
cmp byte [eax], bl
jne 0x402079
lea eax, [ebp - 0x108]
push eax
push 1
add esi, 8
push esi
jmp 0x402082
lea ecx, [ebp - 0x108]
push ecx
push ebx
push eax
call fcn.00404f93
add esp, 0xc
cmp byte [ebp - 0x108], bl
jne 0x402096
xor eax, eax
jmp 0x4020e1
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x4020da
push 4
push ebx
push 4
push ebx
push str.TrayIconEnable
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop ebx
leave
ret
Function at 0x4022aa
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push esi
push edi
mov edi, 0x104
xor ebx, ebx
push edi
lea eax, [ebp - 0x114]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 4], ebx
call fcn.00405830
push edi
lea eax, [ebp - 0x31c]
push ebx
push eax
call fcn.00405830
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea eax, [esi + 0x10c]
push eax
lea eax, [esi + 8]
push eax
lea eax, [esi + 0x210]
push eax
mov dword [ebp - 0x10], ebx
call fcn.004057ad
add esp, 0x2c
cmp byte [ebp - 0x114], bl
je 0x402322
lea eax, [ebp - 0x114]
push eax
lea eax, [esi + 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x114]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov edi, str.TrayIconSelected
jne 0x40238a
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xc]
push eax
lea eax, [esi + 0xb50]
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x4023aa
lea eax, [esi + 0xcb8]
cmp byte [eax], bl
je 0x4023aa
push eax
push ebx
push edi
lea eax, [esi + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esi + 0xb50], eax
lea eax, [esi + 0x10c]
push eax
lea eax, [esi + 0x314]
push eax
add esi, 0xbb4
push esi
call fcn.004040e5
add esp, 0xc
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x4023cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
mov esi, ecx
xor ebx, ebx
push ebx
lea eax, [esi + 0x418]
push eax
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40244e
push edi
lea eax, [ebp - 8]
push eax
lea edi, [esi + 0xb50]
push edi
push ebx
push ebx
push str.TrayIconSelected
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
jne 0x40243c
push ebx
push dword [edi]
mov ecx, esi
call fcn.0040216c
push dword [esi + 0x620]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
pop edi
jmp 0x402450
xor eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x402690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00405830
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x54], edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
cmp edi, esi
je 0x4026dc
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x402913
Capabilities:
Delete file
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push edi
mov edi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0xc]
lea eax, [edi + 0x210]
push ecx
push eax
mov dword [ebp - 0xc], ebx
call fcn.00401207
add esp, 0xc
test eax, eax
je 0x40294d
push dword [ebp - 0xc]
call sub.WINSPOOL.DRV_ClosePrinter
xor eax, eax
inc eax
jmp 0x402a1c
push esi
lea esi, [edi + 0xdbc]
mov eax, dword [esi]
cmp eax, ebx
je 0x402969
push eax
push dword [edi + 0x620]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi], ebx
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
push str.softwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402a09
lea eax, [edi + 0x210]
cmp byte [eax], bl
mov dword [ebp - 0x10], 0x104
jne 0x40299e
lea eax, [edi + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4029f4
lea eax, [ebp - 0x114]
test eax, eax
je 0x4029f4
push 0x22
push eax
call fcn.00405950
mov esi, eax
lea eax, [ebp - 0x114]
push 0x22
push eax
call fcn.00405a10
add esp, 0x10
cmp esi, ebx
je 0x4029f4
cmp esi, eax
jae 0x4029f4
push esi
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push 0x10
push dword [edi + 0x620]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x402efc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, ecx
lea ebx, [esi + 0x314]
push ebx
push str.softwareEPSONSTM3Driver_
lea eax, [ebp - 0x314]
push str._s_sMenu
push eax
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x40c4c0
push eax
call edi
and dword [ebp - 4], 0
add esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x314]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402feb
mov eax, 0x104
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.00405830
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x10c], 0
je 0x402feb
lea eax, [esi + 8]
push eax
push ebx
lea eax, [esi + 0x10c]
push eax
lea eax, [esi + 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x51c]
push str._s__P___s___M___s___D___s___O___s_
push eax
call edi
add esp, 0x1c
lea eax, [ebp - 0x51c]
push eax
mov ecx, esi
call fcn.00402690
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402ff2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
sub eax, 0x203
push ebx
push esi
push edi
mov esi, ecx
je 0x4030f4
dec eax
jne 0x40310a
call fcn.00402913
test eax, eax
jne 0x403034
push 0
push 0
push 0x10
push dword [esi + 0x620]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
jmp 0x40310c
push dword [esi + 0x620]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x620]
call dword [sym.imp.USER32.dll_SetFocus]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
push 0x10
mov ebx, eax
call edi
push 0x20
mov dword [ebp + 0xc], eax
call edi
xor edi, edi
cmp bx, di
jge 0x40308a
cmp word [ebp + 0xc], di
jge 0x40308a
cmp ax, di
jge 0x40308a
push edi
push edi
push 0x10
push dword [esi + 0x620]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40310a
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push edi
push dword [esi + 0x624]
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edi, dword [esi + 0x620]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp + 0xc], eax
jmp 0x4030ba
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
push 0xfffffffffffffff0
push edi
call ebx
test eax, 0x40000000
push edi
jne 0x4030b2
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor ebx, ebx
push ebx
push edi
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
push 2
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push dword [esi + 0x620]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40310a
mov ecx, esi
call fcn.00402913
test eax, eax
je 0x40301a
mov ecx, esi
call fcn.00402e56
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x403b94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
jne 0x403bad
xor eax, eax
jmp 0x403cbf
push edi
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x403cbc
cmp byte [edi], bl
je 0x403cbc
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x403cbc
cmp byte [eax], bl
je 0x403cbc
mov esi, 0x104
push esi
lea eax, [ebp - 0x51c]
push ebx
push eax
call fcn.00405830
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00405830
push esi
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.00405830
add esp, 0x24
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x210]
push eax
call edi
push str.softwareEPSONSTM3Driver_
lea eax, [ebp - 0x10c]
push eax
call edi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x10c]
push eax
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403cbc
push esi
lea eax, [ebp - 0x314]
push ebx
push eax
call fcn.00405830
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x418]
push eax
mov dword [ebp - 8], esi
call edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push ebx
push ebx
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x403cb3
lea eax, [ebp - 0x314]
push eax
push dword [ebp + 8]
call edi
xor eax, eax
cmp esi, ebx
sete al
jmp 0x403cbe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403f13
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x403f2b
xor eax, eax
jmp 0x40401d
mov eax, dword [ebp + 0xc]
cmp eax, ebx
push edi
je 0x40400c
cmp byte [eax], bl
je 0x40400c
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x40400c
cmp byte [edi], bl
je 0x40400c
push edi
push eax
push 0x40c294
push str.Profile
push dword [ebp + 8]
call fcn.00403e1b
add esp, 0x14
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x404007
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x314]
push ebx
push eax
mov dword [ebp - 8], ebx
call fcn.00405830
push esi
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.00405830
add esp, 0x18
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.softwareEPSONSTM3Profile
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404006
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 1
pop esi
mov eax, dword [ebp - 4]
jmp 0x40401c
push 0x40c294
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop edi
pop ebx
leave
ret

Function at 0x404020
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00405830
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push eax
call fcn.00403f13
add esp, 0x18
test eax, eax
je 0x4040e0
cmp byte [ebp - 0x104], 0
je 0x4040e0
lea eax, [ebp - 0x104]
push eax
push esi
lea eax, [ebp - 0x30c]
push eax
push 0x40c294
push str.PrnDll
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4040e0
cmp eax, 0x102
je 0x4040e0
push dword [ebp + 0x10]
lea eax, [ebp - 0x208]
push dword [ebp + 0xc]
push eax
call fcn.00403cc3
add esp, 0xc
test eax, eax
jne 0x4040bc
push 0x40c520
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x208]
push eax
push 0x40c508
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
add esp, 0x10
inc eax
jmp 0x4040e2
xor eax, eax
pop esi
leave
ret
Function at 0x40436a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
lea eax, [ebp - 0x104]
push eax
push 0x104
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jne 0x40439a
push 0x40c54c
jmp 0x4043a1
lea eax, [ebp - 0x104]
push eax
lea eax, [edi + 0x108]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
push 0
push 0x40c548
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4043db
push 0x40c294
add edi, 0x734
push edi
call esi
xor eax, eax
jmp 0x4043fc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x208]
push eax
add edi, 0x734
push edi
call esi
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x404873
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push edi
lea edi, [ecx + 0x324]
xor ebx, ebx
cmp byte [edi], bl
jne 0x404891
xor eax, eax
jmp 0x404917
push esi
lea esi, [ecx + 0x52c]
cmp byte [esi], bl
je 0x4048a1
xor eax, eax
inc eax
jmp 0x404916
push str.softwareEPSONSTM3Driver_
lea eax, [ebp - 0x10c]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 0x104
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x10c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4048ef
xor eax, eax
jmp 0x404916
lea eax, [ebp - 8]
push eax
push esi
push ebx
push ebx
push str.ModelID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop edi
pop ebx
leave
ret