joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51e818
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5896f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0051350b
and dword [ebp - 0x14], 0
cmp dword [0x5912cc], 0
mov dword [ebp - 0x18], eax
jne 0x51e8cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x51e973
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x55bda8
push ebx
call edi
test eax, eax
je 0x51e973
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x55bd98
push ebx
mov dword [0x5912cc], eax
call edi
push eax
call esi
push 0x55bd84
push ebx
mov dword [0x5912d0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5912d4], eax
call edi
push eax
call esi
mov dword [0x5912dc], eax
test eax, eax
je 0x51e8cb
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5912d8], eax
mov eax, dword [0x5912d8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x51e924
cmp dword [0x5912dc], ecx
je 0x51e924
push eax
call esi
push dword [0x5912dc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x51e924
test ebx, ebx
je 0x51e924
call edi
test eax, eax
je 0x51e91b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x51e91b
test byte [ebp - 8], 1
jne 0x51e924
or dword [ebp + 0x10], 0x200000
jmp 0x51e957
mov eax, dword [0x5912d0]
cmp eax, dword [ebp - 0x18]
je 0x51e957
push eax
call esi
test eax, eax
je 0x51e957
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x51e957
mov eax, dword [0x5912d4]
cmp eax, dword [ebp - 0x18]
je 0x51e957
push eax
call esi
test eax, eax
je 0x51e957
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5912cc]
call esi
test eax, eax
je 0x51e973
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x51e975
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050bbf7
leave
ret
Function at 0x417c20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x417c42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417c49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417c38
mov eax, 1
add ebx, ebx
jne 0x417c5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417c50
jne 0x417c6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417c50
xor ecx, ecx
sub eax, 3
jb 0x417c80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417cf2
mov ebp, eax
add ebx, ebx
jne 0x417c8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417c98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417cbc
inc ecx
add ebx, ebx
jne 0x417ca8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417c9d
jne 0x417cb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417c9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417cdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417ccd
jmp 0x417c3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417cdc
add edi, ecx
jmp 0x417c3e
pop esi
mov edi, esi
mov ecx, 0xfb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417cfa
cmp byte [edi], 7
jne 0x417cfa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x417cff
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417d77
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x177c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417d2c
mov ecx, edi
jns 0x417d5b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1784c]
or eax, eax
je 0x417d71
mov dword [ebx], eax
add ebx, 4
jmp 0x417d49
call dword [esi + 0x17848]
mov ebp, dword [esi + 0x17850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417dab
sub esp, 0xffffff80
jmp 0x4012fd
Function at 0x10001b50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
jmp 0x10001b8f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x10], ecx
jge 0x10001cab
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x10001c1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jle 0x10001c17
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x34]
push eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001bf0
xor eax, eax
jmp 0x10001cb0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.10001930
add esp, 0xc
jmp 0x10001b7d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10001b30
add esp, 8
test eax, eax
jne 0x10001c3d
xor eax, eax
jmp 0x10001cb0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x34]
push edx
push 4
push 0x1000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001c74
xor eax, eax
jmp 0x10001cb0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10001980
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
jmp 0x10001b7d
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100027b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x1cc00
mov ecx, dword [ebp - 4]
push ecx
push 0x10004070
call fcn.10001000
add esp, 8
mov dword [ebp - 0xc], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402230
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x670
mov eax, dword [0x41605c]
xor eax, esp
mov dword [esp + 0x66c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x680]
lea eax, [esp + 0x264]
mov ebp, esi
mov ecx, eax
push edi
mov dword [esp + 0x14], esi
mov edx, 0x208
sub ebp, ecx
movzx ecx, word [eax + ebp]
test cx, cx
je 0x40227b
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x402265
jmp 0x40227f
test edx, edx
jne 0x402282
sub eax, 2
push str..
mov edx, 0x208
lea edi, [esp + 0x26c]
mov word [eax], 0
call fcn.00403cb0
add esp, 4
lea edx, [esp + 0x18]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402418
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
nop
lea ecx, [esp + 0x44]
push ecx
push 0x413d60
call edi
test eax, eax
je 0x4023f9
lea edx, [esp + 0x44]
push edx
push 0x413d64
call edi
test eax, eax
je 0x4023f9
mov edx, 0x208
lea eax, [esp + 0x268]
movzx ecx, word [eax + ebp]
test cx, cx
je 0x40230a
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4022f4
jmp 0x40230e
test edx, edx
jne 0x402311
sub eax, 2
mov word [eax], 0
lea eax, [esp + 0x268]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402320
sub eax, edx
sar eax, 1
cmp eax, 0x208
ja 0x402372
mov edx, 0x208
sub edx, eax
lea eax, [esp + eax*2 + 0x268]
je 0x402372
mov esi, 0x413cd8
sub esi, eax
lea ecx, [ecx]
movzx ecx, word [esi + eax]
test cx, cx
je 0x402366
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x402350
jmp 0x40236a
test edx, edx
jne 0x40236d
sub eax, 2
mov word [eax], 0
lea eax, [esp + 0x268]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402380
sub eax, edx
sar eax, 1
cmp eax, 0x208
ja 0x4023d2
mov edx, 0x208
sub edx, eax
lea eax, [esp + eax*2 + 0x268]
je 0x4023d2
lea esi, [esp + 0x44]
sub esi, eax
lea esp, [esp]
movzx ecx, word [esi + eax]
test cx, cx
je 0x4023c6
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4023b0
jmp 0x4023ca
test edx, edx
jne 0x4023cd
sub eax, 2
mov word [eax], 0
test byte [esp + 0x18], 0x10
je 0x4023eb
lea eax, [esp + 0x268]
push eax
call fcn.00402230
add esp, 4
jmp 0x4023f9
lea ecx, [esp + 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x18]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4022c0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403dac
add esp, 0x670
ret
Function at 0x402440
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x878
mov eax, dword [0x41605c]
xor eax, esp
mov dword [esp + 0x874], eax
mov eax, dword [esp + 0x884]
mov ecx, dword [esp + 0x880]
push ebx
mov ebx, dword [esp + 0x880]
push ebp
push esi
mov dword [esp + 0x10], eax
mov eax, ecx
push edi
xor ebp, ebp
lea esi, [eax + 2]
jmp 0x402480
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x402480
sub eax, esi
sar eax, 1
cmp eax, 2
mov dl, 0x81
mov esi, 0x5c
jl 0x4024b0
cmp byte [ecx + eax*2 - 4], dl
jae 0x4024b0
cmp word [ecx + eax*2 - 2], si
jne 0x4024b0
push ecx
push 0x413d24
jmp 0x4024d0
cmp eax, 3
jl 0x4024ca
cmp byte [ecx + eax*2 - 6], dl
jb 0x4024ca
cmp word [ecx + eax*2 - 2], si
jne 0x4024ca
push ecx
push 0x413d24
jmp 0x4024d0
push ecx
push 0x413d6c
mov eax, 0x104
lea edi, [esp + 0x270]
call fcn.00403d00
mov ecx, edi
add esp, 8
push ecx
push str._s.
mov eax, 0x104
lea edi, [esp + 0x680]
call fcn.00403d00
add esp, 8
lea edx, [esp + 0x18]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x4025e1
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
lea ecx, [esp + 0x44]
push ecx
push 0x413d60
call esi
test eax, eax
je 0x402598
lea edx, [esp + 0x44]
push edx
push 0x413d64
call esi
test eax, eax
je 0x402598
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x26c]
push ecx
push str._s_s
mov eax, 0x104
lea edi, [esp + 0x47c]
call fcn.00403d00
add esp, 0xc
test byte [esp + 0x18], 0x10
je 0x402588
mov edx, dword [esp + 0x14]
push edx
mov eax, edi
push eax
push ebx
call fcn.00402440
mov ebp, eax
add esp, 0xc
cmp ebp, 1
je 0x4025d6
jmp 0x402598
lea ecx, [esp + 0x44]
push ecx
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4025b2
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402521
jmp 0x4025d6
mov edi, dword [esp + 0x14]
push ebx
lea ecx, [esp + 0x26c]
push ecx
push str._s_s
mov eax, 0x104
call fcn.00403d00
add esp, 0xc
mov ebp, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x884]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00403dac
add esp, 0x878
ret
Function at 0x4033f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 1
push 0
push str.SoftwareCanonEasy_WebPrint_EXdownload
push SysReAllocStringLen
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403446
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0x413f30
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40344c
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 8
ret

Function at 0x403460
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x628
mov eax, dword [0x41605c]
xor eax, esp
mov dword [esp + 0x624], eax
push ebp
mov ebp, dword [esp + 0x630]
push edi
lea eax, [esp + 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftInternet_Explorer
push SysReAllocStringLen
mov edi, ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4034df
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x428]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.Version
push ecx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4034f8
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x624]
xor ecx, esp
call fcn.00403dac
add esp, 0x628
ret
mov eax, dword [esp + 8]
push ebx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x224]
lea esi, [esp + 0x42c]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
movzx ecx, word [esi + eax]
test cx, cx
je 0x403536
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x403520
jmp 0x40353a
test edx, edx
jne 0x40353d
sub eax, 2
mov ebx, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x2e
lea edx, [esp + 0x228]
push edx
mov word [eax], 0
call ebx
mov esi, eax
lea eax, [esp + 0x224]
push eax
mov word [esi], 0
call fcn.00403f4c
mov dword [edi], eax
lea eax, [esp + 0x20]
lea edx, [esi + 2]
mov ecx, eax
add esp, 4
mov edi, 0x104
sub edx, ecx
lea ecx, [ecx]
movzx ecx, word [edx + eax]
test cx, cx
je 0x403596
mov word [eax], cx
add eax, 2
sub edi, 1
jne 0x403580
jmp 0x40359a
test edi, edi
jne 0x40359d
sub eax, 2
push 0x2e
lea edx, [esp + 0x20]
push edx
mov word [eax], 0
call ebx
mov word [eax], 0
lea eax, [esp + 0x1c]
push eax
call fcn.00403f4c
mov ecx, dword [esp + 0x638]
add esp, 4
pop esi
pop ebx
mov dword [ebp], eax
pop edi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00403dac
add esp, 0x628
ret
Function at 0x4035e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x628
mov eax, dword [0x41605c]
xor eax, esp
mov dword [esp + 0x624], eax
push ebp
mov ebp, dword [esp + 0x630]
push edi
lea eax, [esp + 8]
push eax
push 1
push 0
push str.SoftwareCanonEasy_WebPrint_EX
push SysReAllocStringLen
mov edi, ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40365f
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x428]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.Version
push ecx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x403678
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x624]
xor ecx, esp
call fcn.00403dac
add esp, 0x628
ret
mov eax, dword [esp + 8]
push ebx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x224]
lea esi, [esp + 0x42c]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
movzx ecx, word [esi + eax]
test cx, cx
je 0x4036b6
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4036a0
jmp 0x4036ba
test edx, edx
jne 0x4036bd
sub eax, 2
mov ebx, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x2e
lea edx, [esp + 0x228]
push edx
mov word [eax], 0
call ebx
mov esi, eax
lea eax, [esp + 0x224]
push eax
mov word [esi], 0
call fcn.00403f4c
mov dword [edi], eax
lea eax, [esp + 0x20]
lea edx, [esi + 2]
mov ecx, eax
add esp, 4
mov edi, 0x104
sub edx, ecx
lea ecx, [ecx]
movzx ecx, word [edx + eax]
test cx, cx
je 0x403716
mov word [eax], cx
add eax, 2
sub edi, 1
jne 0x403700
jmp 0x40371a
test edi, edi
jne 0x40371d
sub eax, 2
push 0x2e
lea edx, [esp + 0x20]
push edx
mov word [eax], 0
call ebx
mov word [eax], 0
lea eax, [esp + 0x1c]
push eax
call fcn.00403f4c
mov ecx, dword [esp + 0x638]
add esp, 4
pop esi
pop ebx
mov dword [ebp], eax
pop edi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00403dac
add esp, 0x628
ret

Function at 0x403760
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
mov eax, dword [esi]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push str.NoBaloon
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x403798
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret
mov edx, dword [esi]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 8
ret
Function at 0x4037b0
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 2
push 0
push 0x413d50
push 0
push str.SoftwareCanonEasy_WebPrint_EXdownload
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403808
mov edx, dword [esp]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push eax
push str.NoBaloon
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40380c
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x403820
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 2
push 0
push 0x413d50
push 0
push str.SoftwareCanonEasy_WebPrint_EXdownload
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40388c
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403856
sub eax, edx
mov edx, dword [esp]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push str.DEVICEID
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x403890
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x403ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x41605c]
xor eax, esp
mov dword [esp + 0xc], eax
movsx eax, bl
push eax
call fcn.00404310
add esp, 4
test eax, eax
je 0x403b0f
xor eax, eax
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00403dac
add esp, 0x10
ret
xor eax, eax
mov byte [esp], 0x2d
mov byte [esp + 1], 0x5f
mov byte [esp + 2], 0x2e
mov byte [esp + 3], 0x21
mov byte [esp + 4], 0x5e
mov byte [esp + 5], 0x2a
mov byte [esp + 6], 0x27
mov byte [esp + 7], 0x28
mov byte [esp + 8], 0x29
mov byte [esp + 9], al
cmp bl, byte [esp + eax]
je 0x403afe
add eax, 1
cmp eax, 0xa
jl 0x403b41
mov ecx, dword [esp + 0xc]
xor ecx, esp
mov eax, 1
call fcn.00403dac
add esp, 0x10
ret

Function at 0x403dac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41605c]
jne 0x403db6
repz ret
jmp fcn.00404a87
Function at 0x408383
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x416940]
je 0x40839e
inc edi
cmp edi, 0x17
jb 0x40838f
cmp edi, 0x17
jae 0x40851e
push ebp
push 3
call fcn.0040bf3e
cmp eax, 1
pop ecx
je 0x4084ea
push 3
call fcn.0040bf3e
test eax, eax
pop ecx
jne 0x4083d2
cmp dword [0x416058], 1
je 0x4084ea
cmp ebx, 0xfc
je 0x40851d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x417970
push ebp
call fcn.00408e9c
add esp, 0xc
test eax, eax
je 0x408408
push esi
push esi
push esi
push esi
push esi
call fcn.00406984
add esp, 0x14
push 0x104
mov esi, 0x417989
push esi
push 0
mov byte [0x417a8d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40844c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00408e9c
add esp, 0xc
test eax, eax
je 0x40844c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00406984
add esp, 0x14
push esi
call fcn.00408f10
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x408491
push esi
call fcn.00408f10
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x417c84
push 0x412a74
sub ecx, eax
push ecx
push eax
call fcn.0040a866
add esp, 0x14
test eax, eax
je 0x408491
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00406984
add esp, 0x14
jmp 0x408493
xor esi, esi
push 0x412a70
push ebx
push ebp
call fcn.0040a7a0
add esp, 0xc
test eax, eax
je 0x4084b3
push esi
push esi
push esi
push esi
push esi
call fcn.00406984
add esp, 0x14
push dword [edi*8 + 0x416944]
push ebx
push ebp
call fcn.0040a7a0
add esp, 0xc
test eax, eax
je 0x4084d5
push esi
push esi
push esi
push esi
push esi
call fcn.00406984
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0040bd81
add esp, 0xc
jmp 0x40851d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40851d
cmp ebp, 0xffffffff
je 0x40851d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x416944]
push dword [esi]
call fcn.00408f10
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret