joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416c03
Capabilities:
Read .ini file

Disassembly:
push 0x224
mov eax, 0x568190
call fcn.0053cea9
mov edi, ecx
mov dword [ebp - 0x230], edi
call fcn.00437a9e
push eax
lea ecx, [ebp - 0x21c]
call fcn.00402723
and dword [ebp - 4], 0
push edi
push 0x59b670
lea eax, [ebp - 0x21c]
push str._s_d
push eax
call fcn.0040a0e9
lea ecx, [ebp - 0x228]
call fcn.00412182
push str.EventSetting.ini
push eax
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 1
call fcn.0040193e
add esp, 0x1c
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.0040274b
push dword [ebp - 0x224]
push 0x3c
push str.Time
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push dword [ebp - 0x224]
mov ebx, eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x598e70
push str.FolderPath
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.00435a0a
pop ecx
test eax, eax
je 0x416dd4
cmp word [ebp - 0x218], 0
je 0x416dd4
push edi
mov eax, esi
call fcn.00416bdd
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x416d7e
push 0xd4
call fcn.004379fd
pop ecx
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x416d34
push edi
push ecx
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
call fcn.0040235d
push dword [ebp - 0x220]
call fcn.00415f62
jmp 0x416d36
xor eax, eax
mov byte [ebp - 4], 3
mov edi, dword [esi + 4]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
push dword [edi + 4]
push edi
call fcn.00416e0a
mov ecx, dword [esi + 8]
mov edx, 0x3ffffffe
sub edx, ecx
cmp edx, 1
jae 0x416d6c
push str.list_T__too_long
call fcn.00555e45
inc ecx
mov dword [esi + 8], ecx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
mov edi, dword [ebp - 0x230]
mov dword [ecx], eax
mov eax, dword [esi]
imul ebx, ebx, 0x3e8
push 0
push ebx
push edi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push ecx
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
call fcn.0040235d
mov ecx, dword [ebp - 0x220]
call fcn.004162b3
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.0040274b
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.0040274b
xor eax, eax
inc eax
jmp 0x416df2
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.0040274b
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.0040274b
xor eax, eax
call fcn.0053cf2c
ret
Function at 0x41a7a5
Capabilities:
Read .ini file

Disassembly:
push 0x60
mov eax, 0x5662ee
call fcn.0053cea9
lea ecx, [ebp - 0x6c]
call fcn.00439b5e
and dword [ebp - 4], 0
call fcn.00437a9e
push eax
lea ecx, [ebp - 0x4c]
call fcn.00402723
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00411fd1
push str.Epson_SoftwareCommonEventInfo.plg
mov eax, esi
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.0040193e
add esp, 0xc
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.0040248f
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0040274b
mov edi, dword [ebp - 0x4c]
push 0
push edi
lea ecx, [ebp - 0x6c]
call fcn.00439c05
test eax, eax
jne 0x41a84e
lea ecx, [ebp - 0x6c]
call fcn.004396ca
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0040274b
lea ecx, [edi - 0x10]
call fcn.0040274b
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.00439b90
mov eax, esi
call fcn.0053cf2c
ret
call fcn.00437a9e
push eax
lea ecx, [ebp - 0x48]
call fcn.00402723
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 4
call fcn.004397b0
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00439e48
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.0040248f
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.0040274b
push 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040ea6c
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 6
call fcn.0041526a
push 0x59c358
lea ecx, [ebp - 0x40]
call fcn.004107c5
test eax, eax
je 0x41a8d4
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0040274b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
jmp 0x41a948
mov esi, dword [ebp - 0x48]
push esi
push 0xa
lea eax, [ebp - 0x38]
push eax
push 0x598e70
push str.EventID
push str.Event
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040235d
push 0x59c380
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.004107c5
test eax, eax
je 0x41a95a
lea ecx, [ebp - 0x6c]
call fcn.00439b20
test eax, eax
jne 0x41a92b
mov eax, dword [ebp - 0x6c]
push 0x10
lea ecx, [ebp - 0x6c]
call dword [eax + 0x38]
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0040274b
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0040274b
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 2
call fcn.0040274b
test ebx, ebx
jne 0x41a84e
jmp 0x41a825
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0040274b
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0040274b
lea ecx, [esi - 0x10]
call fcn.0040274b
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0040274b
lea ecx, [edi - 0x10]
call fcn.0040274b
xor esi, esi
inc esi
jmp 0x41a83a
Function at 0x41b67e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x563594
call fcn.0053cea9
and dword [ebp - 4], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], edi
call fcn.00437a9e
push eax
mov ecx, edi
call fcn.00402723
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
push str.SoftwareEPSONFastFoto
push SysReAllocString
mov dword [ebp - 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41b700
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push str.LastConnectDS
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41b6f7
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.004026b9
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0053cf2c
ret

Function at 0x41b708
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x563594
call fcn.0053cea9
and dword [ebp - 4], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], edi
call fcn.00437a9e
push eax
mov ecx, edi
call fcn.00402723
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
push str.SoftwareEPSONEpsonScanManager
push SysReAllocString
mov dword [ebp - 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41b78a
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push str.LastConnectDS
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41b781
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.004026b9
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0053cf2c
ret
Function at 0x41b792
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x70
mov eax, 0x56607f
call fcn.0053ce40
xor esi, esi
push str.ScanButtonConfig.exe
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0040eb20
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.004120c2
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004018e7
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040274b
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push str.___DSName:
push eax
call fcn.0040eabc
push 0x59a080
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 4
call fcn.0040193e
mov ecx, dword [ebp - 0x20]
add esp, 0x18
add ecx, 0xfffffff0
call fcn.0040274b
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00538530
push dword [ebp - 0x18]
mov dword [ebp - 0x7c], 0x44
call fcn.0053bb31
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41b863
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
push edi
call fcn.0053798d
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040274b
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040274b
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040274b
call fcn.0053cf18
ret
Function at 0x41bfd4
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0x9c
mov eax, 0x565fb3
call fcn.0053cea9
mov esi, ecx
lea ecx, [ebp - 0xa8]
call fcn.00412182
push str.EventSetting.ini
push eax
lea eax, [ebp - 0xa4]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040193e
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa8]
add ecx, 0xfffffff0
call fcn.0040274b
push dword [ebp - 0xa4]
push 1
push str.bShow
push 0x59c6ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 0x20019
push ebx
push str.SOFTWAREEPSONDocument_Capture
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x98], ebx
mov byte [ebp - 0x91], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esi + 0xd7c], ebx
cmp eax, ebx
jne 0x41c10a
lea eax, [ebp - 0xa0]
push eax
push ebx
lea eax, [ebp - 0x9c]
push eax
push ebx
push str.InstallPath
push dword [ebp - 0x98]
mov dword [ebp - 0xa0], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c0a6
cmp edi, ebx
je 0x41c0a6
mov dword [esi + 0xd7c], 1
mov edi, 0x80
push edi
lea eax, [ebp - 0x90]
push ebx
push eax
call fcn.00538530
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push ebx
push str.Version
push dword [ebp - 0x98]
mov dword [ebp - 0xa0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c0fe
cmp word [ebp - 0x90], 0x32
jb 0x41c0fe
mov byte [ebp - 0x91], 1
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [ebp - 0x9c], esp
cmp dword [esi + 0xd7c], ebx
je 0x41c141
mov ecx, esp
push 0x59c750
call fcn.0040235d
add esi, 0x1f0
cmp byte [ebp - 0x91], bl
je 0x41c13a
push 0x84
jmp 0x41c157
push 0x83
jmp 0x41c157
mov edi, esp
call fcn.00437a9e
push eax
mov ecx, edi
call fcn.00402723
push ebx
add esi, 0x1f0
push esi
call fcn.00434a0c
mov ecx, dword [ebp - 0xa4]
add ecx, 0xfffffff0
call fcn.0040274b
call fcn.0053cf2c
ret
Function at 0x41cf5b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56a0f0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push edi
mov eax, dword [0x5c9030]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esi + 0xdc8]
xor edi, edi
cmp eax, edi
je 0x41cfad
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xdc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xdc8], edi
push 0xa
lea ecx, [esp + 0x24]
call fcn.00438999
mov dword [esp + 0x48], edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edi
call fcn.00412182
push 0x59a468
push eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x54], 1
call fcn.0040193e
add esp, 0xc
mov byte [esp + 0x48], 3
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0040274b
call fcn.0040ef5f
push eax
call fcn.0040eb64
test eax, eax
je 0x41d046
lea ebx, [esi + 0xdcc]
mov ecx, ebx
call fcn.00438a81
push ebx
lea ecx, [esp + 0x1c]
call fcn.0041d072
mov ecx, ebx
call fcn.00428abc
call fcn.0041d59a
cmp dword [esi + 0xdc8], edi
jne 0x41d046
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push 0x41d811
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xdc8], eax
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0040274b
or dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00438ac7
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d072
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x2c8
mov eax, 0x568075
call fcn.0053cea9
mov eax, dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
push str.SoftwareEPSONEPSON_Scan
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 0x2b0], eax
mov dword [edi], ebx
call fcn.0040235d
lea eax, [ebp - 0x2b4]
push eax
push 0x20019
push ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x2a8]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41d137
mov dword [ebp - 0x2a4], ebx
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
mov dword [ebp - 0x2b8], esi
call fcn.00538530
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x2a4]
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x2ac], eax
cmp eax, ebx
jne 0x41d129
mov ecx, dword [ebp - 0x2b0]
inc dword [edi]
lea eax, [ebp - 0x218]
push eax
call fcn.00438d25
inc dword [ebp - 0x2a4]
cmp dword [ebp - 0x2ac], ebx
je 0x41d0d0
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xa
lea ecx, [ebp - 0x2d4]
call fcn.00438999
lea eax, [ebp - 0x2d4]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.0040ef5f
mov ecx, eax
call fcn.0040efc3
mov esi, dword [ebp - 0x2d0]
jmp 0x41d220
mov eax, esi
cmp esi, ebx
je 0x41d24c
mov eax, dword [eax + 8]
mov esi, dword [esi]
sub eax, 0x10
push eax
call fcn.00402431
lea edi, [eax + 0x10]
pop ecx
mov dword [ebp - 0x2ac], edi
lea eax, [ebp - 0x29c]
push 3
mov byte [ebp - 4], 2
mov dword [ebp - 0x2a0], eax
push edi
lea eax, [ebp - 0x2a0]
push eax
call fcn.0040affe
lea eax, [ebp - 0x2a4]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2a0]
push eax
call fcn.00420d45
pop ecx
lea eax, [ebp - 0x29c]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x2a0], eax
je 0x41d1e9
push dword [ebp - 0x2a0]
call fcn.0053798d
pop ecx
mov eax, dword [ebp - 0x2a4]
cmp dword [eax - 0xc], ebx
jle 0x41d206
mov ecx, dword [ebp - 0x2b0]
lea eax, [ebp - 0x2a4]
push eax
call fcn.00438be4
mov ecx, dword [ebp - 0x2a4]
add ecx, 0xfffffff0
call fcn.0040274b
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 1
call fcn.0040274b
cmp esi, ebx
jne 0x41d173
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], bl
call fcn.00438ac7
mov ecx, dword [ebp - 0x2a8]
add ecx, 0xfffffff0
call fcn.0040274b
call fcn.0053cf2c
ret 4
call fcn.004387df
int3
Function at 0x41eac1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x563594
call fcn.0053cea9
and dword [ebp - 4], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], edi
call fcn.00437a9e
push eax
mov ecx, edi
call fcn.00402723
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
push str.SoftwareEPSONEpsonScanManager
push SysReAllocString
mov dword [ebp - 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41eb43
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push str.LastUSBConnectDS
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41eb3a
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.004026b9
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0053cf2c
ret
Function at 0x41ffe4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0xc], 4
mov dword [ebp - 4], edi
je 0x41fffe
cmp dword [ebp + 0xc], 5
jne 0x42001b
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push edi
push edi
call esi
cmp dword [ebp + 0xc], 5
mov ebx, eax
jne 0x42001b
push edi
push edi
push edi
push edi
call esi
mov dword [ebp - 4], eax
cmp dword [0x5d1694], edi
je 0x420059
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp - 4]
mov dword [ebp + 0xc], edi
push ebx
push dword [ebp + 0x10]
call fcn.004179a5
add esp, 0xc
push eax
push 0x417aaf
push edi
push edi
call fcn.0053c14d
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x42005c
push 8
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4204af
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420518
cmp dword [ebp + 0x10], 1
je 0x4204f0
cmp dword [ebp + 0x10], 2
je 0x4204f0
push 0xd
pop eax
jmp 0x420518
mov eax, dword [ebp - 4]
test edi, edi
je 0x420512
test eax, eax
je 0x42050d
test al, 1
jne 0x4204eb
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x420512
jmp 0x4204eb
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x42117d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c9030]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x5d1ac0]
xor eax, eax
mov dword [ebp - 0x210], eax
cmp dword [ecx - 0xc], eax
jne 0x4211d4
push 1
push 0x1a
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00537ff9
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
mov ecx, 0x5d1ac0
call fcn.004023c0
mov eax, dword [0x5d1ac0]
add eax, 0xfffffff0
push eax
call fcn.00402431
add eax, 0x10
pop ecx
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov eax, esi
call fcn.0053792d
leave
ret
Function at 0x422322
Capabilities:
Read .ini file

Disassembly:
push 0x30
mov eax, 0x5646b7
call fcn.0053ce40
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], edi
call fcn.00437a9e
mov ecx, dword [ebp + 8]
push eax
call fcn.00402723
xor esi, esi
mov dword [ebp - 4], edi
inc esi
mov dword [ebp - 0x1c], esi
call fcn.00437a9e
push eax
lea ecx, [ebp - 0x14]
call fcn.00402723
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push str._04x
push eax
mov dword [ebp - 4], esi
call fcn.0040a0e9
add esp, 0xc
call fcn.00437a9e
push eax
lea ecx, [ebp - 0x10]
call fcn.00402723
mov byte [ebp - 4], 2
lea esi, [ebp + 0x10]
cmp dword [ebp + 0x10], edi
je 0x4223ae
call fcn.0042117d
mov byte [ebp - 4], 3
push dword [ebp - 0x14]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10]
push 0x59d480
push eax
call fcn.0040a0e9
add esp, 0x10
jmp 0x4223ca
call fcn.0042117d
mov byte [ebp - 4], 4
push dword [eax]
lea eax, [ebp - 0x10]
push str._sEpsonDocument_CaptureAppInfo1_
push eax
call fcn.0040a0e9
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040274b
lea ecx, [ebp - 0x3c]
call fcn.00439b5e
push 0x59d520
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 5
call fcn.0040193e
add esp, 0xc
push edi
mov byte [ebp - 4], 6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3c]
call fcn.00439c05
cmp eax, edi
je 0x4224b1
call fcn.00437a9e
push eax
lea ecx, [ebp + 0x10]
call fcn.00402723
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.004397b0
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00439e48
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 8
call fcn.0040248f
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040274b
mov esi, dword [ebp + 0x10]
push esi
push edi
push str.ProjectID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, dword [ebp + 0x14]
je 0x42249d
lea ecx, [ebp - 0x3c]
call fcn.00439b20
test eax, eax
jne 0x422487
mov eax, dword [ebp - 0x3c]
push 0x10
lea ecx, [ebp - 0x3c]
call dword [eax + 0x38]
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 6
call fcn.0040274b
cmp ebx, edi
jne 0x422412
jmp 0x4224b1
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
call fcn.0040248f
lea ecx, [esi - 0x10]
call fcn.0040274b
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040274b
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00439b90
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040274b
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040274b
mov eax, dword [ebp + 8]
call fcn.0053cf18
ret
Function at 0x422539
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x818
mov eax, 0x564636
call fcn.0053cea9
xor edi, edi
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x820], edi
call fcn.00538530
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push 0x20019
push edi
push str.SOFTWAREEPSONDocument_Capture
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4225d2
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push edi
push str.InstallFolder
push dword [ebp - 0x814]
mov dword [ebp - 0x81c], 0x800
mov dword [ebp - 0x818], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00437a9e
push eax
mov ecx, ebx
call fcn.00402723
lea eax, [ebp - 0x810]
mov dword [ebp - 4], edi
push eax
mov ecx, ebx
mov dword [ebp - 0x820], 1
call fcn.0040b0b8
push str.JobRunner.exe
push ebx
call fcn.00429a3a
mov eax, ebx
call fcn.0053cf2c
ret