joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ac72e
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x68ab7b
call fcn.005bea6f
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x5ac84b
cmp byte [ebx + 0x3e], 0
je 0x5ac84b
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.0052c975
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x5ac77a
xor al, al
jmp 0x5ac84d
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004bbcc7
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x5ac7aa
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.0052c975
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x5ac7df
sub eax, 1
je 0x5ac7e3
dec eax
sub eax, 1
je 0x5ac839
xor bl, bl
jmp 0x5ac83b
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x5ac7f3
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x5ac81b
cmp eax, 0x10
jae 0x5ac802
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.005f948a
add esp, 0x10
cmp esi, eax
jne 0x5ac7db
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x5ac839
test esi, esi
jne 0x5ac79e
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0041e061
jmp 0x5ac798
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0041cadb
mov al, bl
jmp 0x5ac84d
mov al, 1
call fcn.005bea19
ret

Function at 0x5c20c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68c114
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x93500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0xffffffff
xor eax, eax
mov dword [edx + 0x18], 7
mov dword [edx + 0x14], 0
mov word [edx + 4], ax
mov dword [ebp - 4], eax
mov dword [edx + 0x30], 7
mov dword [edx + 0x2c], eax
mov word [edx + 0x1c], ax
mov byte [ebp - 4], 1
lea ecx, [edx + 0x38]
lea eax, [ecx + 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov byte [eax], 0
mov byte [ebp - 4], 3
mov ax, word [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 6
mov dword [ecx + 0xc], 0
mov word [ecx + 0x10], ax
mov dword [ecx + 0x14], 0x201
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov byte [ebp - 4], 4
mov dword [edx + 0x68], 0xffffffff
mov dword [edx + 0x6c], SysReAllocString
mov dword [edx + 0x70], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5c65d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
mov dword [ebp + 0xc], eax
jb 0x5c65ef
mov esi, dword [edi]
jmp 0x5c65f1
mov esi, edi
lea ebx, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x5c6611
nop
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x5c6600
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0xc]
and eax, edx
mov ebx, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
mov edx, dword [esi + 4]
mov dword [ebp - 4], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], edx
jne 0x5c663d
mov eax, edx
jmp 0x5c6641
mov eax, dword [eax]
mov eax, dword [eax]
cmp ebx, eax
je 0x5c6719
cmp dword [edi + 0x14], 8
jb 0x5c6653
mov edx, dword [edi]
jmp 0x5c6655
mov edx, edi
cmp dword [ebx + 0x1c], 8
jb 0x5c6660
mov ecx, dword [ebx + 8]
jmp 0x5c6663
lea ecx, [ebx + 8]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebp + 0xc]
cmp eax, esi
mov dword [ebp - 0xc], eax
cmovb esi, eax
test esi, esi
jne 0x5c6691
xor eax, eax
test eax, eax
jne 0x5c6687
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
jb 0x5c6687
jbe 0x5c66b2
mov ebx, dword [ebx]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
jmp 0x5c6634
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x5c66a4
add ecx, 2
add edx, 2
sub esi, 1
jmp 0x5c6673
movzx eax, word [ecx]
cmp ax, word [edx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x5c6677
cmp dword [ebx + 0x1c], 8
jb 0x5c66bd
mov ecx, dword [ebx + 8]
jmp 0x5c66c0
lea ecx, [ebx + 8]
cmp dword [edi + 0x14], 8
jb 0x5c66c8
mov edi, dword [edi]
mov esi, dword [ebx + 0x18]
mov edx, esi
cmp dword [ebp + 0xc], esi
cmovb edx, dword [ebp + 0xc]
test edx, edx
jne 0x5c66f8
xor eax, eax
test eax, eax
jne 0x5c66e7
mov eax, dword [ebp + 0xc]
cmp eax, esi
jb 0x5c66e7
jbe 0x5c66ea
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ax, word [edi]
cmp ax, word [ecx]
jne 0x5c670b
add edi, 2
add ecx, 2
sub edx, 1
jmp 0x5c66d6
movzx eax, word [edi]
cmp ax, word [ecx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x5c66da
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x5cc8f0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x5ccac1
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x5ccac0
cmp eax, 0x29
jne 0x5cc928
cmp dword [esi + 0x10], 0
jne 0x5ccac0
test dword [esi + 0x50], 0x10000000
je 0x5ccac5
cmp eax, 0x2e
jne 0x5cc985
push 5
lea ecx, [esi + 0x24]
call fcn.005cf130
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x5cc979
cmp word [eax], 0x5c
jne 0x5cc976
add eax, 2
cmp eax, ecx
je 0x5cc976
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x5cc962
movzx edx, word [eax]
cmp edx, 0x28
je 0x5cc974
cmp edx, 0x29
je 0x5cc974
test cl, 0x10
jne 0x5cc976
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x5cc974
cmp ecx, 0x7d
jne 0x5cc976
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.005cfaf0
jmp 0x5ccaad
cmp eax, 0x5c
jne 0x5cc9ec
mov ecx, esi
call fcn.005cf1e0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x5cc9b8
cmp word [esi + 0x48], 0x62
jne 0x5cc9b8
push 4
lea ecx, [esi + 0x24]
call fcn.005cf130
mov ecx, esi
call fcn.005cf1e0
jmp 0x5ccab4
test eax, eax
je 0x5cc9e0
cmp word [esi + 0x48], 0x42
jne 0x5cc9e0
push 4
lea ecx, [esi + 0x24]
call fcn.005cf130
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.005cf1e0
jmp 0x5ccab4
mov ecx, esi
call fcn.005ccaf0
jmp 0x5ccaad
cmp eax, 0x5b
jne 0x5cca0f
mov ecx, esi
call fcn.005cf1e0
mov ecx, esi
call fcn.005cd230
push 4
push 0x5d
mov ecx, esi
call fcn.005cea70
jmp 0x5ccaad
cmp eax, 0x28
jne 0x5cca39
mov ecx, esi
call fcn.005cf1e0
mov ecx, esi
call fcn.005cfca0
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.005cea70
test bl, bl
je 0x5ccab4
jmp 0x5ccaad
cmp eax, 0x5e
jne 0x5cca51
push 2
lea ecx, [esi + 0x24]
call fcn.005cf130
mov ecx, esi
call fcn.005cf1e0
jmp 0x5ccab4
cmp eax, 0x24
jne 0x5cca69
push 3
lea ecx, [esi + 0x24]
call fcn.005cf130
mov ecx, esi
call fcn.005cf1e0
jmp 0x5ccab4
cmp eax, 0x2a
je 0x5ccada
cmp eax, 0x2b
je 0x5ccada
cmp eax, 0x3f
je 0x5ccada
cmp eax, 0x7b
je 0x5ccada
cmp eax, 0x7d
jne 0x5cca8b
test dword [esi + 0x50], 0x10000000
je 0x5ccacc
cmp eax, 0x5d
jne 0x5cca99
test dword [esi + 0x50], 0x10000000
je 0x5ccad3
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.005cbe80
mov ecx, esi
call fcn.005cf1e0
mov ecx, esi
call fcn.005cf230
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x5cc900
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.005abb15
push 6
call fcn.005abb15
push 4
call fcn.005abb15
push 0xa
call fcn.005abb15
int3
Function at 0x5d0cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edx, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x10], edx
cmp edx, 8
jb 0x5d0cf0
mov esi, dword [ecx]
jmp 0x5d0cf2
mov esi, ecx
lea edi, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x5d0d11
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x5d0d00
mov ecx, dword [ebx + 0x18]
and ecx, edx
mov edx, dword [ebx + 0xc]
mov ebx, dword [ebx + 4]
mov dword [ebp - 4], ebx
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 8], esi
lea ecx, [edx + ecx*4]
mov dword [ebp - 0xc], ecx
cmp esi, ebx
jne 0x5d0d39
mov ecx, ebx
jmp 0x5d0d3d
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x5d0e5e
cmp dword [ebp - 0x10], 8
mov edi, dword [ebp + 0xc]
jb 0x5d0d52
mov esi, dword [edi]
jmp 0x5d0d54
mov esi, edi
cmp dword [eax + 0x1c], 8
jb 0x5d0d5f
mov edx, dword [eax + 8]
jmp 0x5d0d62
lea edx, [eax + 8]
mov ecx, dword [edi + 0x10]
mov edi, ecx
mov ebx, dword [eax + 0x18]
cmp ebx, ecx
cmovb edi, ebx
test edi, edi
jne 0x5d0d92
xor ecx, ecx
test ecx, ecx
jne 0x5d0d85
mov ecx, dword [ebp + 0xc]
mov esi, dword [ecx + 0x10]
cmp ebx, esi
jb 0x5d0d85
jbe 0x5d0db3
mov eax, dword [eax]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
jmp 0x5d0d31
mov cx, word [edx]
cmp cx, word [esi]
jne 0x5d0da5
add edx, 2
add esi, 2
sub edi, 1
jmp 0x5d0d71
movzx ecx, word [edx]
cmp cx, word [esi]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x5d0d75
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0xc]
nop dword [eax + eax]
mov ebx, dword [ebp - 4]
cmp dword [ebp - 8], ebx
jne 0x5d0dcc
mov edx, ebx
jmp 0x5d0dd3
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov edx, dword [edx]
cmp eax, edx
je 0x5d0e44
cmp dword [eax + 0x1c], 8
jb 0x5d0de2
mov edi, dword [eax + 8]
jmp 0x5d0de5
lea edi, [eax + 8]
cmp dword [ecx + 0x14], 8
jb 0x5d0def
mov esi, dword [ecx]
jmp 0x5d0df1
mov esi, ecx
mov edx, dword [eax + 0x18]
mov ebx, edx
cmp dword [ecx + 0x10], edx
mov dword [ebp + 0xc], edx
cmovb ebx, dword [ecx + 0x10]
test ebx, ebx
jne 0x5d0e20
xor edx, edx
test edx, edx
jne 0x5d0e41
mov edx, dword [ebp + 0xc]
mov esi, dword [ecx + 0x10]
cmp esi, edx
jb 0x5d0e41
ja 0x5d0e41
mov eax, dword [eax]
jmp 0x5d0dc0
mov dx, word [esi]
cmp dx, word [edi]
jne 0x5d0e33
add esi, 2
add edi, 2
sub ebx, 1
jmp 0x5d0e02
movzx edx, word [esi]
cmp dx, word [edi]
sbb edx, edx
and edx, 0xfffffffe
inc edx
jmp 0x5d0e06
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
je 0x5d0e5e
mov edx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [edx + 4], eax
mov eax, edx
mov dword [edx], ecx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
mov dword [eax + 4], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5d2530
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68ea10
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x93500c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
cmp byte [0x12f8890], 0
jne 0x5d26cf
mov byte [ebp - 4], 1
call fcn.005d20b0
push 0x20a
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.005e1980
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x20a
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.005e1980
add esp, 0xc
push str.HPPDSMQ
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x220]
push eax
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
call esi
lea eax, [ebp - 0x220]
push eax
mov ecx, 0x12f8830
call fcn.0041bc62
cmp dword [0x12f8844], 8
mov eax, dword [0x12f8830]
jae 0x5d25fe
mov eax, 0x12f8830
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x5d262f
cmp dword [0x12f8844], 8
mov eax, dword [0x12f8830]
jae 0x5d261c
mov eax, 0x12f8830
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x5d26f2
cmp dword [0x12f8844], 8
mov eax, dword [0x12f8830]
jae 0x5d2642
mov eax, 0x12f8830
push str.Pdsmq.Error.txt
push eax
lea eax, [ebp - 0x220]
push eax
call esi
lea eax, [ebp - 0x220]
push eax
mov ecx, 0x12f8878
call fcn.0041bc62
cmp dword [0x12f8844], 8
mov eax, dword [0x12f8830]
jae 0x5d2675
mov eax, 0x12f8830
push str.Pdsmq.Data.txt
push eax
lea eax, [ebp - 0x220]
push eax
call esi
lea eax, [ebp - 0x220]
push eax
mov ecx, 0x12f8860
call fcn.0041bc62
cmp dword [0x12f8844], 8
mov eax, dword [0x12f8830]
jae 0x5d26a8
mov eax, 0x12f8830
push str.Pdsmq.Log.txt
push eax
lea eax, [ebp - 0x220]
push eax
call esi
lea eax, [ebp - 0x220]
push eax
mov ecx, 0x12f8848
call fcn.0041bc62
mov byte [0x12f8890], 1
mov dword [ebp - 4], 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.005d2790
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052bbde
mov esp, ebp
pop ebp
ret
Function at 0x5d5620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68f174
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x93500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x10]
mov dword [esi], vtable.HP::Pdsmq::Extra::Eventing::EventingEvent.0
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov eax, dword [edx + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edx + 0x10]
mov dword [ebp + 8], ecx
push eax
mov dword [ebp - 0x14], ecx
call fcn.005c1020
mov dword [ebp - 4], 3
lea ecx, [esi + 0x30]
mov dword [esi], vtable.HP::Pdsmq::Extra::Eventing::CompletionEvent.0
xor eax, eax
push 0x11
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push str.app_event_details
mov word [ecx], ax
call fcn.0041c91b
mov byte [ebp - 4], 4
lea ecx, [esi + 0x48]
push 0xd
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x6fad50
mov word [ecx], ax
call fcn.0041c91b
mov byte [ebp - 4], 5
lea ecx, [esi + 0x60]
push 0xb
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push str.task_result
mov word [ecx], ax
call fcn.0041c91b
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5dd960
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x690950
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x93500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.005dfeb0
add esp, 8
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x5dda9f
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
push 0
cmovae eax, dword [ebp - 0x30]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x18]
mov word [ebp - 0x14], 0x100
push eax
mov dword [ebp - 0x38], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x5dda9f
mov eax, dword [ebp - 0x38]
xorps xmm0, xmm0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x34]
push eax
push 0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x58], xmm0
push eax
push 1
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x58], 0x1fffff
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x34], 0
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x5dda96
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
push 0
push dword [ebp - 0x34]
cmovae eax, dword [ebp - 0x30]
push 0
push 0
push 4
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp eax, 8
jb 0x5ddab8
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.00417554
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x5ddae8
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00417554
xor eax, eax
mov dword [ebp + 0x1c], 7
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052bbde
mov esp, ebp
pop ebp
ret
Function at 0x5ddca0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x690a0d
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x93500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x264], esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x260], 1
call fcn.005dfb50
test al, al
je 0x5dde67
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], 1
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x5ddde5
push str.SHGetKnownFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5dddcc
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x25c], 0
push ecx
push 0
push 0
push 0x709e78
call eax
test eax, eax
js 0x5dddb3
push dword [ebp - 0x25c]
mov ecx, esi
call fcn.0041bc62
push dword [ebp - 0x25c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x5dddf7
push str.Call_to_SHGetKnownFolderPath_failed
lea ecx, [ebp - 0x234]
call fcn.0041bc62
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x5dddf7
push str.Unable_to_get_address_of_SHGetKnownFolderPath_function
lea ecx, [ebp - 0x234]
call fcn.0041bc62
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x5dddf7
push 0x1a
push str.Unable_to_load_shell32.dll
lea ecx, [ebp - 0x234]
call fcn.0041c91b
cmp dword [ebp - 0x224], 0
je 0x5dde23
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x258]
call fcn.005c25b0
push 0x9281ec
lea eax, [ebp - 0x258]
push eax
call fcn.005e2735
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x220]
cmp eax, 8
jb 0x5dde45
inc eax
lea ecx, [ebp - 0x234]
push eax
push dword [ebp - 0x234]
call fcn.00417554
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
jmp 0x5ddeee
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.005e1980
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x5ddeb5
push str.Unable_to_retrieve_the_directory_that_contains_application_data_for_all_users.
lea ecx, [ebp - 0x258]
call fcn.005dd060
push 0x9281ec
lea eax, [ebp - 0x258]
push eax
call fcn.005e2735
cmp word [ebp - 0x21c], 0
jne 0x5ddec3
xor ecx, ecx
jmp 0x5ddedf
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5dded0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.0041c91b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052bbde
mov esp, ebp
pop ebp
ret

Function at 0x6073db
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0060709b
Function at 0x6079a3
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006078a8

Function at 0x60c3a3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0060c066

Function at 0x60c3ae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0060c1e7

Function at 0x615bd9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x6334f2
Capabilities:
Print debug messages

Disassembly:
push 0xa0
mov eax, 0x692c95
call fcn.005bea6f
mov ebx, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xa0]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 0
push 0
push 0x2ae
push str.NGDeviceModel::CScanDataAdaptorEscl::GetPreScanInfoEscl
push 0x12f9bcc
push dword [0x12fa300]
mov dword [ebp - 0xa8], eax
call fcn.004203f9
xor eax, eax
lea ecx, [ebp - 0x28]
mov dword [esi], eax
mov dword [edi + 4], eax
push dword [0x12fede8]
mov dword [ebp - 4], eax
mov dword [ebp - 0xa4], eax
call fcn.0041bcf1
push dword [ebp + 0x14]
mov ecx, dword [ebx + 0x30]
lea edx, [ebp - 0xa4]
push 0
push edx
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov eax, dword [ecx]
push edx
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0
call fcn.0041746a
cmp dword [ebp - 0x98], 0
jl 0x63368d
push esi
sub esp, 0x18
mov ecx, esp
push dword [ebp - 0xa8]
call fcn.0041bd4a
push dword [ebp - 0xa4]
mov ecx, ebx
call fcn.00631862
mov dword [ebp - 0x98], eax
test eax, eax
js 0x633657
push 7
push 6
push 5
push 4
push 3
push 2
push 1
push dword [esi]
lea eax, [ebp - 0xa0]
push str.CScanDataAdaptorEscl::_GetPreScanInfoEscl:_eJobState___d___d:Aborted___d:Cancelled___d:Completed___d:Pending___d__PendingHeld___d:Processing___d:ProcessingStopped
push 0x2bf
push 0x11
push eax
call fcn.0042077f
add esp, 0x30
cmp dword [esi], 6
jne 0x633629
lea ecx, [ebp - 0x24]
call fcn.00645228
push edi
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0064557e
push str._n_CFWJobRecEscl::EFJS_Processing
mov dword [ebp - 0x98], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.0064528a
jmp 0x633676
cmp dword [esi], 4
jne 0x633635
push str._n_CFWJobRecEscl::EFJS_Pending
jmp 0x63363f
cmp dword [esi], 5
jne 0x633647
push str._n_CFWJobRecEscl::EFJS_PendingHeld
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x633676
push dword [esi]
push str.GetPreScanInfoEscl:_JobState___d__5:canceled__6:completed
push 0x2d2
push 0x11
jmp 0x633667
push eax
push str.GetPreScanInfoEscl:_EvaluateJobState_failed__HR_0x_08x
push 0x2d7
push 0x80
lea eax, [ebp - 0xa0]
push eax
call fcn.0042077f
add esp, 0x14
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax]
jmp 0x6336b1
push dword [ebp - 0x98]
lea eax, [ebp - 0xa0]
push str.GetPreScanInfoEscl:_m_pIXmlDocumentCache__GetDocument_failed__HR_0x_08x
push 0x2dd
push 0x80
push eax
call fcn.0042077f
add esp, 0x14
mov esi, dword [ebp - 0x98]
lea ecx, [ebp - 0xa0]
call fcn.004204d2
mov eax, esi
call fcn.005bea19
ret 0x10