joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414e2d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c9030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
cmp eax, 2
jne 0x414ef1
push dword [esi + 8]
push 0xffffffffffffffff
push str.ActionID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x38], eax
cmp eax, 0x384
jne 0x414e80
mov ecx, esi
call fcn.00414bc8
test eax, eax
jne 0x414e8e
jmp 0x414f94
cmp eax, 0xffffffff
je 0x414e8e
mov ecx, esi
call fcn.00414700
jmp 0x414e77
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00538a20
add esp, 0xc
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x5990a0
push str.ProjectAppName
push str.Event_Launch_Win
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esp
mov dword [ebp - 0x210], esp
push eax
call fcn.00402358
mov ecx, esi
call fcn.00413f1c
jmp 0x414f91
cmp eax, 3
jl 0x414f91
push dword [esi + 8]
push 0xffffffffffffffff
push str.ActionID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x38], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00538a20
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x5990a0
push str.ExtActionUid
mov ebx, str.Event_Launch_Win
push ebx
call edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x58]
call fcn.00402332
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x5990a0
push str.ExtActionTypeId
push ebx
call edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x5c]
call fcn.00402332
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00537e11
leave
ret
Function at 0x4166d0
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x56475e
call fcn.0053d330
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x41677b
lea eax, [ebp + 8]
lea ecx, [esi + 8]
push eax
call fcn.0040248a
push dword [ebp + 8]
call fcn.00435de9
test eax, eax
mov eax, dword [ebp + 8]
pop ecx
je 0x41677b
cmp dword [eax - 0xc], ebx
je 0x41677b
push 1
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x14], esp
mov edi, esp
push eax
call fcn.0040242c
add eax, 0x10
mov dword [edi], eax
pop ecx
mov edi, esi
call fcn.004167e3
mov dword [esi + 0x10], eax
call fcn.0041678d
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push 0x416534
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov dword [esi + 0x14], eax
call fcn.00402728
xor eax, eax
inc eax
jmp 0x416785
lea ecx, [eax - 0x10]
call fcn.00402728
xor eax, eax
call fcn.0053d408
ret 4
Function at 0x4167e3
Capabilities:
Enumerate files on windows

Disassembly:
push 0x264
mov eax, 0x564cc1
call fcn.0053d399
lea eax, [edi + 0xbc]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x26c], esi
cmp dword [ebp + 0xc], esi
je 0x416817
lea ecx, [edi + 0x24]
call fcn.00438f6f
push 1
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp + 8]
call fcn.0040ef71
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x41684a
cmp ecx, esi
jge 0x416840
push 0x80070057
call fcn.0040270e
cmp word [eax], 0x5c
jne 0x41684a
xor bl, bl
jmp 0x41684c
mov bl, 1
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.00402728
test bl, bl
je 0x416868
push 0x5c
lea ecx, [ebp + 8]
call fcn.00416faf
push 0x59b84c
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.00401943
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x264]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402728
cmp esi, 0xffffffff
je 0x416995
test byte [ebp - 0x264], 0x12
jne 0x416978
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x268]
call fcn.00402358
push str.desktop.ini
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 1
call fcn.00410c4d
test eax, eax
je 0x416966
push str.Thumbs.db
lea ecx, [ebp - 0x268]
call fcn.00410c4d
test eax, eax
je 0x416966
push str.__.___
lea ecx, [ebp - 0x268]
call fcn.00410c4d
test eax, eax
je 0x416966
push str.________.___
lea ecx, [ebp - 0x268]
call fcn.00410c4d
test eax, eax
je 0x416966
push str..
lea ecx, [ebp - 0x268]
call fcn.00410c4d
test eax, eax
je 0x416966
push 0
push str.fio12_
lea ecx, [ebp - 0x268]
call fcn.0040ef12
cmp eax, 0xffffffff
jne 0x416966
inc dword [ebp - 0x26c]
cmp dword [ebp + 0xc], 0
je 0x416966
lea eax, [ebp - 0x268]
push eax
lea ecx, [edi + 0x24]
call fcn.004390d2
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.00402728
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4168a9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [edi + 0xb4]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402728
mov eax, dword [ebp - 0x26c]
call fcn.0053d41c
ret 8
Function at 0x4169b9
Capabilities:
Enumerate files on windows

Disassembly:
push 0x470
mov eax, 0x564c86
call fcn.0053d399
mov esi, ecx
push 1
lea eax, [ebp - 0x474]
xor ebx, ebx
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0040ef71
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x416a04
cmp ecx, ebx
jge 0x4169f8
push 0x80070057
call fcn.0040270e
cmp word [eax], 0x5c
mov byte [ebp - 0x46d], bl
je 0x416a0b
mov byte [ebp - 0x46d], 1
mov ecx, dword [ebp - 0x474]
add ecx, 0xfffffff0
call fcn.00402728
cmp byte [ebp - 0x46d], bl
je 0x416a2b
push 0x5c
lea ecx, [ebp + 8]
call fcn.00416faf
push 0x59b84c
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.00401943
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x468]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x47c]
add ecx, 0xfffffff0
mov dword [ebp - 0x478], eax
call fcn.00402728
cmp dword [ebp - 0x478], 0xffffffff
je 0x416c08
test byte [ebp - 0x468], 0x12
jne 0x416be1
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x46c]
call fcn.00402358
push str.desktop.ini
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 1
call fcn.00410c4d
test eax, eax
je 0x416bd0
push str.Thumbs.db
lea ecx, [ebp - 0x46c]
call fcn.00410c4d
test eax, eax
je 0x416bd0
push str.__.___
lea ecx, [ebp - 0x46c]
call fcn.00410c4d
test eax, eax
je 0x416bd0
push str.________.___
lea ecx, [ebp - 0x46c]
call fcn.00410c4d
test eax, eax
je 0x416bd0
push str..
lea ecx, [ebp - 0x46c]
call fcn.00410c4d
test eax, eax
je 0x416bd0
push ebx
push str.fio12_
lea ecx, [ebp - 0x46c]
call fcn.0040ef12
cmp eax, 0xffffffff
jne 0x416bd0
lea eax, [esi + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push dword [ebp - 0x46c]
lea ecx, [esi + 0x24]
call fcn.00438ec8
test eax, eax
jne 0x416bc5
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00538a20
add esp, 0xc
lea eax, [ebp - 0x46c]
push eax
lea ecx, [esi + 0x24]
call fcn.004390d2
push dword [ebp - 0x46c]
lea eax, [ebp - 0x218]
push dword [ebp + 8]
push 0x59a4dc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x474]
call fcn.00402358
lea edi, [ebp - 0x474]
mov byte [ebp - 4], 2
call fcn.00416c1d
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x474]
add ecx, 0xfffffff0
call fcn.00402728
lea ecx, [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x46c]
add ecx, 0xfffffff0
call fcn.00402728
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x416a74
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402728
xor eax, eax
call fcn.0053d41c
ret 4
Function at 0x416c1d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x416c69
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416c69
push ebx
lea eax, [esi + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi]
push 0
push eax
lea ecx, [esi + 0x40]
call fcn.00438ec8
test eax, eax
jne 0x416c59
push edi
lea ecx, [esi + 0x40]
call fcn.004390d2
lea ecx, [esi + 0x94]
mov eax, dword [ecx]
call dword [eax + 0x14]
xor eax, eax
inc eax
pop ebx
ret
xor eax, eax
ret

Function at 0x416c6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x18
mov eax, 0x563e92
call fcn.0053d330
xor ebx, ebx
cmp dword [esi + 0x4c], ebx
jle 0x416d80
lea eax, [esi + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00437f60
push eax
lea ecx, [ebp - 0x10]
call fcn.0042a551
mov dword [ebp - 4], ebx
mov edi, dword [esi + 0x44]
lea ecx, [ebp - 0x24]
call fcn.0043fb3b
mov byte [ebp - 4], 1
jmp 0x416d13
mov eax, edi
cmp edi, ebx
je 0x416d6b
mov edi, dword [edi]
add eax, 8
push eax
lea ecx, [ebp - 0x10]
call fcn.0040248a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416d13
push ebx
push ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.0043ffab
test eax, eax
lea eax, [ebp - 0x10]
push eax
je 0x416d0b
lea ecx, [esi + 0x5c]
call fcn.004390d2
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004390d2
lea ecx, [ebp - 0x24]
call fcn.0043fad6
jmp 0x416d13
lea ecx, [esi + 0x78]
call fcn.004390d2
cmp edi, ebx
jne 0x416cb2
lea ecx, [esi + 0x40]
call fcn.00438f6f
cmp dword [esi + 0x84], ebx
jle 0x416d3c
lea ebx, [esi + 0x78]
push ebx
lea ecx, [esi + 0x40]
call fcn.0043910b
mov ecx, ebx
call fcn.00438f6f
xor ebx, ebx
lea ecx, [esi + 0x94]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
cmp dword [eax + 0xc], ebx
jle 0x416d70
call fcn.0043fc6b
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402728
xor eax, eax
inc eax
jmp 0x416d82
call fcn.00438caa
call fcn.0043fc6b
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402728
xor eax, eax
call fcn.0053d408
ret 4
Function at 0x417002
Capabilities:
Read .ini file

Disassembly:
push 0x224
mov eax, 0x568559
call fcn.0053d399
mov edi, ecx
mov dword [ebp - 0x230], edi
call fcn.00437f60
push eax
lea ecx, [ebp - 0x21c]
call fcn.0042a551
and dword [ebp - 4], 0
push edi
push 0x59b8e8
lea eax, [ebp - 0x21c]
push str._s_d
push eax
call fcn.0040a7ee
lea ecx, [ebp - 0x228]
call fcn.00412621
push str.EventSetting.ini
push eax
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 1
call fcn.00401943
add esp, 0x1c
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.00402728
push dword [ebp - 0x224]
push 0x3c
push str.Time
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push dword [ebp - 0x224]
mov ebx, eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x5990a0
push str.FolderPath
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.00435de9
pop ecx
test eax, eax
je 0x4171d3
cmp word [ebp - 0x218], 0
je 0x4171d3
push edi
mov eax, esi
call fcn.00416fdc
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x41717d
push 0xd4
call fcn.00437ebf
pop ecx
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x417133
push edi
push ecx
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
call fcn.00402358
push dword [ebp - 0x220]
call fcn.0041637f
jmp 0x417135
xor eax, eax
mov byte [ebp - 4], 3
mov edi, dword [esi + 4]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
push dword [edi + 4]
push edi
call fcn.0041722e
mov ecx, dword [esi + 8]
mov edx, 0x3ffffffe
sub edx, ecx
cmp edx, 1
jae 0x41716b
push str.list_T__too_long
call fcn.00556241
inc ecx
mov dword [esi + 8], ecx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
mov edi, dword [ebp - 0x230]
mov dword [ecx], eax
mov eax, dword [esi]
imul ebx, ebx, 0x3e8
push 0
push ebx
push edi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push ecx
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
call fcn.00402358
mov ecx, dword [ebp - 0x220]
call fcn.004166d0
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402728
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00402728
xor eax, eax
inc eax
jmp 0x4171f1
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402728
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00402728
xor eax, eax
call fcn.0053d41c
ret
Function at 0x41abe3
Capabilities:
Read .ini file

Disassembly:
push 0x60
mov eax, 0x566722
call fcn.0053d399
lea ecx, [ebp - 0x6c]
call fcn.0043a04c
and dword [ebp - 4], 0
call fcn.00437f60
push eax
lea ecx, [ebp - 0x4c]
call fcn.0042a551
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00412470
push str.Epson_SoftwareCommonEventInfo.plg
mov eax, esi
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00401943
add esp, 0xc
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.0040248a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402728
mov edi, dword [ebp - 0x4c]
push 0
push edi
lea ecx, [ebp - 0x6c]
call fcn.0043a0f3
test eax, eax
jne 0x41ac8c
lea ecx, [ebp - 0x6c]
call fcn.00439bb8
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00402728
lea ecx, [edi - 0x10]
call fcn.00402728
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.0043a07e
mov eax, esi
call fcn.0053d41c
ret
call fcn.00437f60
push eax
lea ecx, [ebp - 0x48]
call fcn.0042a551
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 4
call fcn.00439c9e
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x6c]
call fcn.0043a336
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.0040248a
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.00402728
push 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040ef71
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 6
call fcn.004155e9
push 0x59c5d0
lea ecx, [ebp - 0x40]
call fcn.00410c4d
test eax, eax
je 0x41ad12
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00402728
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
jmp 0x41ad86
mov esi, dword [ebp - 0x48]
push esi
push 0xa
lea eax, [ebp - 0x38]
push eax
push 0x5990a0
push str.EventID
push str.Event
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00402358
push 0x59c5f8
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.00410c4d
test eax, eax
je 0x41ad98
lea ecx, [ebp - 0x6c]
call fcn.0043a00e
test eax, eax
jne 0x41ad69
mov eax, dword [ebp - 0x6c]
push 0x10
lea ecx, [ebp - 0x6c]
call dword [eax + 0x38]
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402728
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00402728
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 2
call fcn.00402728
test ebx, ebx
jne 0x41ac8c
jmp 0x41ac63
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402728
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00402728
lea ecx, [esi - 0x10]
call fcn.00402728
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00402728
lea ecx, [edi - 0x10]
call fcn.00402728
xor esi, esi
inc esi
jmp 0x41ac78
Function at 0x41babe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x5638f8
call fcn.0053d399
and dword [ebp - 4], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], edi
call fcn.00437f60
push eax
mov ecx, edi
call fcn.0042a551
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
push str.SoftwareEPSONFastFoto
push SysReAllocString
mov dword [ebp - 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41bb40
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push str.LastConnectDS
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41bb37
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.004026b4
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0053d41c
ret

Function at 0x41bb48
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x5638f8
call fcn.0053d399
and dword [ebp - 4], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], edi
call fcn.00437f60
push eax
mov ecx, edi
call fcn.0042a551
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
push str.SoftwareEPSONEpsonScanManager
push SysReAllocString
mov dword [ebp - 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41bbca
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push str.LastConnectDS
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41bbc1
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.004026b4
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0053d41c
ret
Function at 0x41bbd2
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x70
mov eax, 0x5664b3
call fcn.0053d330
xor esi, esi
push str.ScanButtonConfig.exe
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0040f025
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.00412561
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004018ec
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402728
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push str.___DSName:
push eax
call fcn.0040efc1
push 0x59a2b0
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 4
call fcn.00401943
mov ecx, dword [ebp - 0x20]
add esp, 0x18
add ecx, 0xfffffff0
call fcn.00402728
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00538a20
push dword [ebp - 0x18]
mov dword [ebp - 0x7c], 0x44
call fcn.0053c021
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41bca3
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
push edi
call fcn.00537e71
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402728
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402728
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402728
call fcn.0053d408
ret
Function at 0x41c414
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0x9c
mov eax, 0x566415
call fcn.0053d399
mov esi, ecx
lea ecx, [ebp - 0xa8]
call fcn.00412621
push str.EventSetting.ini
push eax
lea eax, [ebp - 0xa4]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00401943
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa8]
add ecx, 0xfffffff0
call fcn.00402728
push dword [ebp - 0xa4]
push 1
push str.bShow
push 0x59c924
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 0x20019
push ebx
push str.SOFTWAREEPSONDocument_Capture
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x98], ebx
mov byte [ebp - 0x91], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esi + 0xd7c], ebx
cmp eax, ebx
jne 0x41c54a
lea eax, [ebp - 0xa0]
push eax
push ebx
lea eax, [ebp - 0x9c]
push eax
push ebx
push str.InstallPath
push dword [ebp - 0x98]
mov dword [ebp - 0xa0], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c4e6
cmp edi, ebx
je 0x41c4e6
mov dword [esi + 0xd7c], 1
mov edi, 0x80
push edi
lea eax, [ebp - 0x90]
push ebx
push eax
call fcn.00538a20
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push ebx
push str.Version
push dword [ebp - 0x98]
mov dword [ebp - 0xa0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c53e
cmp word [ebp - 0x90], 0x32
jb 0x41c53e
mov byte [ebp - 0x91], 1
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [ebp - 0x9c], esp
cmp dword [esi + 0xd7c], ebx
je 0x41c581
mov ecx, esp
push 0x59c9c8
call fcn.00402358
add esi, 0x1f0
cmp byte [ebp - 0x91], bl
je 0x41c57a
push 0x84
jmp 0x41c597
push 0x83
jmp 0x41c597
mov edi, esp
call fcn.00437f60
push eax
mov ecx, edi
call fcn.0042a551
push ebx
add esi, 0x1f0
push esi
call fcn.00434deb
mov ecx, dword [ebp - 0xa4]
add ecx, 0xfffffff0
call fcn.00402728
call fcn.0053d41c
ret
Function at 0x41d39b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56a43a
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push edi
mov eax, dword [0x5c9030]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esi + 0xdc8]
xor edi, edi
cmp eax, edi
je 0x41d3ed
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xdc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xdc8], edi
push 0xa
lea ecx, [esp + 0x24]
call fcn.00438e87
mov dword [esp + 0x48], edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edi
call fcn.00412621
push 0x59a6d0
push eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x54], 1
call fcn.00401943
add esp, 0xc
mov byte [esp + 0x48], 3
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00402728
call fcn.0040f452
mov ecx, eax
call fcn.0040f069
test eax, eax
je 0x41d487
lea ebx, [esi + 0xdcc]
mov ecx, ebx
call fcn.00438f6f
push ebx
lea ecx, [esp + 0x1c]
call fcn.0041d4b3
mov ecx, ebx
call fcn.00428fa7
call fcn.0041d9db
cmp dword [esi + 0xdc8], edi
jne 0x41d487
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push 0x41dc52
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xdc8], eax
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00402728
or dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00438fb5
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret