joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428293
Capabilities:
Read .ini file

Disassembly:
push 0xb0
mov eax, 0x569b7f
call fcn.0053da79
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb4], eax
call fcn.00438647
push eax
lea ecx, [ebp - 0xac]
call fcn.0042a80d
and dword [ebp - 4], 0
and dword [ebp - 0xa0], 0
lea eax, [ebp - 0x9c]
push eax
push ecx
mov esi, esp
mov eax, ebx
lea edi, [ebp - 0xb0]
mov dword [ebp - 0x9c], esp
call fcn.0042cc73
mov ecx, edi
call fcn.00423136
pop ecx
pop ecx
mov dword [ebp - 0x98], 0xc9
push dword [ebp - 0x98]
lea eax, [ebp - 0xac]
push 0x599d24
push eax
call fcn.0040a7c3
add esp, 0xc
cmp dword [ebp - 0x98], 0xc9
jne 0x428329
mov dword [ebp - 0xa8], 0x2bd
jmp 0x42836b
lea esi, [ebp - 0xbc]
mov eax, ebx
call fcn.0042cc73
mov byte [ebp - 4], 1
push dword [ebp - 0xb0]
mov eax, dword [eax]
push eax
push 1
push dword [ebp - 0x98]
call fcn.0042557c
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0xbc]
add esp, 0x10
add ecx, 0xfffffff0
mov dword [ebp - 0xa8], eax
call fcn.00402722
lea edi, [ebp - 0x9c]
call fcn.00412677
mov edi, eax
lea esi, [ebp - 0xa4]
mov eax, ebx
mov byte [ebp - 4], 2
call fcn.0042cc73
push eax
lea eax, [ebp - 0xb8]
push str.DCEX.
push eax
mov byte [ebp - 4], 3
call fcn.0040f116
mov edi, dword [edi]
mov eax, dword [eax]
add esp, 0xc
push edi
push dword [ebp - 0xa8]
mov edi, dword [ebp - 0xac]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0xb8]
mov esi, eax
test esi, esi
setg byte [ebp - 0x91]
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, dword [ebp - 0xa4]
add ecx, 0xfffffff0
call fcn.00402722
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x9c]
add ecx, 0xfffffff0
call fcn.00402722
cmp byte [ebp - 0x91], 0
je 0x428410
mov eax, dword [ebp - 0xa0]
inc dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x90], esi
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0xe6
jle 0x4282f7
lea esi, [ebp - 0xa4]
mov eax, ebx
call fcn.0042cc73
mov esi, eax
lea eax, [ebp - 0x9c]
push ebx
push eax
mov byte [ebp - 4], 4
call fcn.0042628e
pop ecx
pop ecx
lea ecx, [ebp - 0x90]
push ecx
push dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xb4]
mov byte [ebp - 4], 5
push dword [esi]
mov edx, dword [eax]
call fcn.00402eba
mov ecx, dword [ebp - 0x9c]
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, dword [ebp - 0xa4]
add ecx, 0xfffffff0
call fcn.00402722
lea ecx, [edi - 0x10]
call fcn.00402722
call fcn.0053dafc
ret 4
Function at 0x428494
Capabilities:
Read .ini file

Disassembly:
push 0x1c
mov eax, 0x569307
call fcn.0053da10
call fcn.00438647
push eax
lea ecx, [ebp - 0x14]
call fcn.0042a80d
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp + 8]
push ecx
mov esi, esp
lea edi, [ebp - 0x18]
mov dword [ebp - 0x28], esp
call fcn.0042cc73
mov ecx, edi
call fcn.00423136
pop ecx
pop ecx
mov dword [ebp - 0x10], 0xc9
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x599d24
push eax
call fcn.0040a7c3
add esp, 0xc
cmp dword [ebp - 0x10], 0xc9
jne 0x4284fb
mov ebx, 0x2bd
jmp 0x42852e
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x1c]
call fcn.0042cc73
mov byte [ebp - 4], 1
push dword [ebp - 0x18]
mov eax, dword [eax]
push eax
push 1
push dword [ebp - 0x10]
call fcn.0042557c
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
add esp, 0x10
add ecx, 0xfffffff0
mov ebx, eax
call fcn.00402722
lea edi, [ebp - 0x28]
call fcn.00412677
mov edi, eax
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0042cc73
push eax
lea eax, [ebp - 0x20]
push str.DCEX.
push eax
mov byte [ebp - 4], 3
call fcn.0040f116
mov edi, dword [edi]
mov eax, dword [eax]
add esp, 0xc
push edi
mov edi, dword [ebp - 0x14]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x20]
mov esi, eax
test esi, esi
setg bl
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402722
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00402722
test bl, bl
je 0x4285ab
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x54]
mov dword [eax + ecx*4 + 0x58], esi
inc dword [eax + 0x54]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe6
jle 0x4284d7
lea ecx, [edi - 0x10]
call fcn.00402722
call fcn.0053dae8
ret
Function at 0x428b90
Capabilities:
Create thread

Disassembly:
push 0x1c
mov eax, 0x569ab8
call fcn.0053da10
mov ebx, ecx
lea eax, [ebp - 0x18]
push eax
push ecx
mov esi, esp
mov eax, ebx
lea edi, [ebp - 0x14]
mov dword [ebp - 0x20], esp
call fcn.0042cc73
mov ecx, edi
call fcn.00423136
push dword [ebp - 0x14]
call fcn.0042881f
add esp, 0xc
push 0x1004
call fcn.004385a6
pop ecx
test eax, eax
je 0x428bde
mov esi, eax
call fcn.00427f97
mov edi, eax
jmp 0x428be0
xor edi, edi
lea esi, [ebp - 0x18]
mov eax, ebx
call fcn.0042cc73
and dword [ebp - 4], 0
lea ecx, [edi + 4]
push eax
call fcn.0040248f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402722
lea esi, [ebp - 0x18]
mov eax, ebx
call fcn.00412fac
lea ecx, [edi + 8]
push eax
mov dword [ebp - 4], 1
call fcn.0040248f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402722
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.0042628e
pop ecx
pop ecx
push eax
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.0040248f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402722
and dword [edi + 0x54], 0
and dword [edi + 0x50], 0
push ecx
mov esi, esp
mov eax, ebx
mov dword [ebp - 0x18], esp
call fcn.0042cc73
call fcn.00423a38
pop ecx
test al, al
jne 0x428c95
push ecx
mov esi, esp
mov eax, ebx
mov dword [ebp - 0x18], esp
call fcn.0042cc73
call fcn.00423661
pop ecx
test al, al
jne 0x428c95
xor esi, esi
xor eax, eax
jmp 0x428c9a
xor eax, eax
inc eax
xor esi, esi
push edi
push ebx
mov byte [edi + 0x1000], al
call fcn.00428494
push dword [ebp - 0x14]
mov edx, edi
mov ecx, ebx
call fcn.004285c9
add esp, 0xc
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push esi
push esi
push esi
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x24], eax
push 8
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0xff4]
push eax
call fcn.005387a0
add esp, 0xc
test byte [ebx + 0x48], 0x10
jbe 0x428d26
mov eax, dword [ebx + 0x30]
cmp eax, 0xca
jl 0x428d01
mov dword [edi + 0xffc], 0x22
jmp 0x428d26
cmp eax, 0xc8
jl 0x428d14
mov dword [edi + 0xffc], 0x20
jmp 0x428d26
xor ecx, ecx
cmp eax, 0x70
setge cl
lea ecx, [ecx + ecx + 0x1a]
mov dword [edi + 0xffc], ecx
lea eax, [ebp - 0x20]
push eax
push esi
push edi
push 0x427fdf
push esi
push esi
mov dword [ebp - 0x20], esi
call fcn.0053cd1d
add esp, 0x18
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x733c
push esi
lea eax, [ebp - 0x28]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x428d62
mov ebx, dword [ebx + 0x4c]
jmp 0x428d65
mov ebx, dword [ebx + 0x50]
cmp ebx, esi
je 0x428d70
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
call fcn.0053dae8
ret
Function at 0x429c50
Capabilities:
Read .ini file

Disassembly:
push 0
mov eax, 0x564358
call fcn.0053da10
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00402431
pop ecx
push dword [0x5d1ad4]
lea esi, [eax + 0x10]
push 1
push str.FirstRun
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.00402722
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402722
mov eax, edi
call fcn.0053dae8
ret

Function at 0x429ca1
Capabilities:
Read .ini file

Disassembly:
push 0
mov eax, 0x564358
call fcn.0053da10
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00402431
pop ecx
push dword [0x5d1ad8]
lea esi, [eax + 0x10]
push 1
push str.FirstRun
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.00402722
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402722
mov eax, edi
call fcn.0053dae8
ret
Function at 0x429fa6
Capabilities:
Read .ini file

Disassembly:
push 0x248
mov eax, 0x5688cb
call fcn.0053da79
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x228], eax
xor esi, esi
xor eax, eax
inc esi
push 0x206
mov dword [ebp - 4], esi
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.00539100
add esp, 0xc
lea ecx, [ebp - 0x220]
call fcn.004127e0
mov eax, dword [eax]
push str.CopyCusPro.ini
push eax
mov ebx, 0x59a4bc
lea eax, [ebp - 0x21c]
push ebx
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x220]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00402722
lea eax, [ebp - 0x21c]
push eax
push esi
push str.FirstRun
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x42a1e3
call fcn.00438647
push eax
lea ecx, [ebp - 0x220]
call fcn.0042a80d
mov byte [ebp - 4], 2
call fcn.00412720
mov eax, dword [eax]
push str.Devices
push str.Resources
push eax
lea eax, [ebp - 0x220]
push 0x59de0c
push eax
call fcn.0040a7c3
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
add esp, 0x14
push eax
call fcn.00402431
lea esi, [eax + 0x10]
pop ecx
mov dword [ebp - 0x22c], esi
mov byte [ebp - 4], 3
cmp dword [esi - 0xc], 0
jne 0x42a0a7
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x22c]
call fcn.0040248f
mov esi, dword [ebp - 0x22c]
call fcn.00438647
push eax
lea ecx, [ebp - 0x224]
call fcn.0042a80d
mov byte [ebp - 4], 4
mov edi, dword [ebp - 0x220]
push esi
push edi
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.0040a7c3
add esp, 0x10
lea ecx, [ebp - 0x254]
call fcn.0043a735
mov byte [ebp - 4], 5
mov ebx, dword [ebp - 0x224]
push 0
push ebx
lea ecx, [ebp - 0x254]
call fcn.0043a7dc
lea ecx, [ebp - 0x254]
test eax, eax
jne 0x42a122
mov byte [ebp - 4], 4
call fcn.0043a767
lea ecx, [ebx - 0x10]
call fcn.00402722
lea ecx, [esi - 0x10]
call fcn.00402722
lea ecx, [edi - 0x10]
jmp 0x42a1de
call fcn.0043a2a1
push dword [ebp - 0x228]
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x228], esp
mov ebx, esp
push eax
call fcn.00402431
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 6
add esi, 0xfffffff0
mov dword [ebp - 0x230], esp
mov ebx, esp
push esi
call fcn.00402431
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x234], esp
call fcn.004127e0
push ecx
add edi, 0xfffffff0
mov dword [ebp - 0x238], esp
mov ebx, esp
push edi
mov byte [ebp - 4], 8
call fcn.00402431
add eax, 0x10
mov dword [ebx], eax
pop ecx
mov byte [ebp - 4], 5
call fcn.00428fff
add esp, 0x14
test eax, eax
je 0x42a1b8
lea eax, [ebp - 0x21c]
push eax
push 0x59c8d8
push str.FirstRun
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 4
call fcn.0043a767
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, esi
call fcn.00402722
mov ecx, edi
call fcn.00402722
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402722
call fcn.0053dafc
ret
Function at 0x42cd8f
Capabilities:
Read .ini file

Disassembly:
push 0x58
mov eax, 0x5690a8
call fcn.0053da10
mov edi, ecx
mov dword [ebp - 4], 2
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x42cdb6
lea ecx, [eax - 0x10]
jmp 0x42cedb
mov eax, dword [ebp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x10], esp
mov esi, esp
push eax
call fcn.00402431
add eax, 0x10
pop ecx
mov dword [esi], eax
push edi
lea eax, [ebp - 0x64]
push eax
call fcn.004102cc
lea eax, [ebp + 8]
lea ecx, [ebx + 0x20]
push eax
mov byte [ebp - 4], 3
call fcn.0040248f
lea ecx, [ebp - 0x64]
mov dword [ebx + 8], edi
call fcn.0041088d
lea ecx, [ebp - 0x64]
mov dword [ebx + 0xc], eax
call fcn.004107f9
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x64]
call fcn.00410455
push dword [ebp - 0x58]
movzx eax, al
push 0
push str.SupportsEpsonScanSetting
push dword [ebp - 0x5c]
mov dword [ebx + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
neg eax
sbb eax, eax
neg eax
lea edi, [ebp - 0x10]
lea esi, [ebp - 0x64]
mov dword [ebx + 0x18], eax
call fcn.0041091e
lea ecx, [ebx + 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.0040248f
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402722
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.00410994
lea ecx, [ebx + 0x28]
push eax
mov byte [ebp - 4], 5
call fcn.0040248f
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402722
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.00410a8a
lea ecx, [ebx + 0x2c]
push eax
mov byte [ebp - 4], 6
call fcn.0040248f
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, esi
call fcn.00410b7f
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
je 0x42cecd
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x10], esp
mov esi, esp
push eax
call fcn.00402431
add eax, 0x10
mov dword [esi], eax
pop ecx
mov esi, ebx
call fcn.0042cefe
lea ecx, [ebp - 0x64]
call fcn.0041042b
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402722
call fcn.0053dae8
ret 0xc
Function at 0x432145
Capabilities:
Enumerate files on windows

Disassembly:
push 0x260
mov eax, 0x564d0a
call fcn.0053da79
and dword [ebp - 4], 0
and dword [ebp - 0x268], 0
mov ecx, edi
call fcn.00439658
push 1
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp + 8]
call fcn.0040f0c6
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x432199
test ecx, ecx
jns 0x43218f
push 0x80070057
call fcn.00402708
cmp word [eax], 0x5c
jne 0x432199
xor bl, bl
jmp 0x43219b
mov bl, 1
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.00402722
test bl, bl
je 0x4321b7
push 0x5c
lea ecx, [ebp + 8]
call fcn.004171f0
push 0x59b804
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.0040193e
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402722
cmp esi, 0xffffffff
je 0x4322d9
test byte [ebp - 0x260], 0x12
jne 0x4322bc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x264]
call fcn.0040235d
push str.desktop.ini
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 1
call fcn.00410e1f
test eax, eax
je 0x4322aa
push str.Thumbs.db
lea ecx, [ebp - 0x264]
call fcn.00410e1f
test eax, eax
je 0x4322aa
push str.__.___
lea ecx, [ebp - 0x264]
call fcn.00410e1f
test eax, eax
je 0x4322aa
push str.________.___
lea ecx, [ebp - 0x264]
call fcn.00410e1f
test eax, eax
je 0x4322aa
push str..
lea ecx, [ebp - 0x264]
call fcn.00410e1f
test eax, eax
je 0x4322aa
push 0
push str.fio12_
lea ecx, [ebp - 0x264]
call fcn.0040f067
cmp eax, 0xffffffff
jne 0x4322aa
inc dword [ebp - 0x268]
lea eax, [ebp - 0x264]
push eax
mov ecx, edi
call fcn.004397bb
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.00402722
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4321f8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402722
mov eax, dword [ebp - 0x268]
call fcn.0053dafc
ret 4
Function at 0x4322f2
Capabilities:
Enumerate files on windows

Disassembly:
push 0x26c
mov eax, 0x564ccf
call fcn.0053da79
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x278], eax
and dword [ebp - 4], 0
mov ecx, edi
call fcn.00439658
push 1
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp + 8]
call fcn.0040f0c6
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x432348
test ecx, ecx
jns 0x43233e
push 0x80070057
call fcn.00402708
cmp word [eax], 0x5c
jne 0x432348
xor bl, bl
jmp 0x43234a
mov bl, 1
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.00402722
test bl, bl
je 0x432366
push 0x5c
lea ecx, [ebp + 8]
call fcn.004171f0
push 0x59b804
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.0040193e
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x264]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402722
cmp esi, 0xffffffff
je 0x432510
test byte [ebp - 0x264], 0x12
jne 0x4324f3
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x268]
call fcn.0040235d
push str.desktop.ini
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 1
call fcn.00410e1f
test eax, eax
je 0x4324e1
push str.Thumbs.db
lea ecx, [ebp - 0x268]
call fcn.00410e1f
test eax, eax
je 0x4324e1
push str.__.___
lea ecx, [ebp - 0x268]
call fcn.00410e1f
test eax, eax
je 0x4324e1
push str.________.___
lea ecx, [ebp - 0x268]
call fcn.00410e1f
test eax, eax
je 0x4324e1
push str..
lea ecx, [ebp - 0x268]
call fcn.00410e1f
test eax, eax
je 0x4324e1
push 0
push str.fio12_
lea ecx, [ebp - 0x268]
call fcn.0040f067
cmp eax, 0xffffffff
jne 0x4324e1
mov ecx, dword [ebp - 0x278]
push 0
push dword [ebp - 0x268]
call fcn.004395b1
test eax, eax
jne 0x4324e1
call fcn.00438647
push eax
lea ecx, [ebp - 0x26c]
call fcn.0042a80d
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x274]
push eax
mov byte [ebp - 4], 2
call fcn.004018e7
add esp, 0xc
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
call fcn.0040248f
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x274]
add ecx, 0xfffffff0
call fcn.00402722
lea eax, [ebp - 0x26c]
push eax
mov ecx, edi
call fcn.004397bb
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.00402722
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.00402722
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4323a7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402722
xor eax, eax
inc eax
call fcn.0053dafc
ret 8
Function at 0x434198
Capabilities:
Read .ini file

Disassembly:
push 0x214
mov eax, 0x564bd2
call fcn.0053da79
mov eax, dword [ebp + 8]
and dword [ebp - 0x214], 0
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], ecx
and dword [ebp - 4], 0
push dword [edi + 4]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x100
lea edx, [ebp - 0x210]
push edx
push dword [ebp + 0xc]
push ecx
push eax
call esi
cmp eax, 0xff
je 0x4341f4
lea eax, [ebp - 0x210]
push eax
mov ecx, ebx
call fcn.0040235d
jmp 0x434263
push 0x1000
call fcn.004385d5
pop ecx
push dword [edi + 4]
mov dword [ebp - 0x218], eax
push 0x400
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
call esi
push dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
call fcn.0040235d
push dword [ebp - 0x218]
mov byte [ebp - 4], 1
call fcn.004385e0
mov eax, dword [ebp - 0x214]
add eax, 0xfffffff0
push eax
call fcn.00402431
pop ecx
pop ecx
mov ecx, dword [ebp - 0x214]
add eax, 0x10
add ecx, 0xfffffff0
mov dword [ebx], eax
call fcn.00402722
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402722
mov eax, ebx
call fcn.0053dafc
ret 8

Function at 0x4344d6
Capabilities:
Read .ini file

Disassembly:
push 0xdc
mov eax, 0x565f6a
call fcn.0053da79
mov eax, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xdc], ebx
call fcn.00438647
push eax
lea ecx, [ebp - 0xd4]
call fcn.0042a80d
and dword [ebp - 4], 0
call fcn.00412720
push str.EventGUID.ini
push dword [eax]
lea eax, [ebp - 0xd4]
push 0x59a4bc
push eax
call fcn.0040a7c3
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0x10
push dword [ebp - 0xd4]
mov edi, str.GUID
push 0
push str.ButtonCount
push edi
call esi
push dword [ebp - 0xd4]
mov dword [ebp - 0xd8], eax
push ebx
push str.GUIDGroupNum
push edi
call esi
cmp dword [ebp - 0xd8], 0
mov dword [ebp - 0xe8], eax
jle 0x43461f
test eax, eax
jle 0x43461f
and dword [ebp - 0xe0], 0
mov edi, ebx
cmp eax, ebx
jl 0x43461f
cmp dword [ebp - 0xe0], 0
jne 0x43461f
mov esi, ebx
cmp dword [ebp - 0xd8], ebx
jl 0x434612
push esi
lea eax, [ebp - 0x24]
push 0x599d24
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
lea eax, [ebp - 0x4c]
push str.GUID_d
push eax
call fcn.00434b29
add esp, 0x18
push dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
push 0x41
push eax
push 0x5990a0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0xe4]
call fcn.00539477
pop ecx
pop ecx
test eax, eax
je 0x434606
inc esi
cmp esi, dword [ebp - 0xd8]
jle 0x43459f
jmp 0x434612
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xe0], ebx
inc edi
cmp edi, dword [ebp - 0xe8]
jle 0x434588
mov ecx, dword [ebp - 0xd4]
add ecx, 0xfffffff0
call fcn.00402722
mov eax, dword [ebp - 0xdc]
call fcn.0053dafc
ret 4
Function at 0x43463b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x5642f1
call fcn.0053da79
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x4347b7
mov ecx, dword [ebp + 0xc]
cmp dword [ecx - 0xc], ebx
je 0x4347b7
call fcn.00438647
push eax
lea ecx, [ebp - 0x21c]
call fcn.0042a80d
mov byte [ebp - 4], 2
call fcn.00438647
push eax
lea ecx, [ebp - 0x224]
call fcn.0042a80d
mov byte [ebp - 4], 3
push dword [ebp + 8]
lea eax, [ebp - 0x224]
push str.SOFTWAREEPSONEPSON_Scan_s
push eax
call fcn.0040a7c3
mov esi, dword [ebp - 0x224]
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 1
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4346ed
lea ecx, [esi - 0x10]
call fcn.00402722
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
jmp 0x4347ba
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00539100
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push str.Supported
push dword [ebp - 0x220]
mov dword [ebp - 0x228], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x220]
test eax, eax
je 0x434748
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4346cc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
call fcn.00538bc9
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004023c0
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x21c]
call fcn.0040f067
lea ecx, [esi - 0x10]
cmp eax, 0xffffffff
je 0x4346cf
call fcn.00402722
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402722
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402722
xor eax, eax
inc eax
jmp 0x4347cc
lea ecx, [eax - 0x10]
call fcn.00402722
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402722
xor eax, eax
call fcn.0053dafc
ret 8