joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414bfe
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c9030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
cmp eax, 2
jne 0x414cc2
push dword [esi + 8]
push 0xffffffffffffffff
push str.ActionID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x38], eax
cmp eax, 0x384
jne 0x414c51
mov ecx, esi
call fcn.00414999
test eax, eax
jne 0x414c5f
jmp 0x414d65
cmp eax, 0xffffffff
je 0x414c5f
mov ecx, esi
call fcn.004144d1
jmp 0x414c48
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00538410
add esp, 0xc
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x599080
push str.ProjectAppName
push str.Event_Launch_Win
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esp
mov dword [ebp - 0x210], esp
push eax
call fcn.00402372
mov ecx, esi
call fcn.00413d02
jmp 0x414d62
cmp eax, 3
jl 0x414d62
push dword [esi + 8]
push 0xffffffffffffffff
push str.ActionID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x38], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00538410
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x599080
push str.ExtActionUid
mov ebx, str.Event_Launch_Win
push ebx
call edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x58]
call fcn.0040234c
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x599080
push str.ExtActionTypeId
push ebx
call edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x5c]
call fcn.0040234c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053780e
leave
ret
Function at 0x4163ee
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x56417d
call fcn.0053cd20
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x416499
lea eax, [ebp + 8]
lea ecx, [esi + 8]
push eax
call fcn.004024a4
push dword [ebp + 8]
call fcn.004357f2
test eax, eax
mov eax, dword [ebp + 8]
pop ecx
je 0x416499
cmp dword [eax - 0xc], ebx
je 0x416499
push 1
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x14], esp
mov edi, esp
push eax
call fcn.00402446
add eax, 0x10
mov dword [edi], eax
pop ecx
mov edi, esi
call fcn.00416501
mov dword [esi + 0x10], eax
call fcn.004164ab
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push 0x416252
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov dword [esi + 0x14], eax
call fcn.00402760
xor eax, eax
inc eax
jmp 0x4164a3
lea ecx, [eax - 0x10]
call fcn.00402760
xor eax, eax
call fcn.0053cdf8
ret 4
Function at 0x416501
Capabilities:
Enumerate files on windows

Disassembly:
push 0x264
mov eax, 0x5646e0
call fcn.0053cd89
lea eax, [edi + 0xbc]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x26c], esi
cmp dword [ebp + 0xc], esi
je 0x416535
lea ecx, [edi + 0x24]
call fcn.0043897e
push 1
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp + 8]
call fcn.0040ee16
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x416568
cmp ecx, esi
jge 0x41655e
push 0x80070057
call fcn.0040271e
cmp word [eax], 0x5c
jne 0x416568
xor bl, bl
jmp 0x41656a
mov bl, 1
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.00402760
test bl, bl
je 0x416586
push 0x5c
lea ecx, [ebp + 8]
call fcn.00416ccd
push 0x59b7fc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.0040195d
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x264]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402760
cmp esi, 0xffffffff
je 0x4166b3
test byte [ebp - 0x264], 0x12
jne 0x416696
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x268]
call fcn.00402372
push str.desktop.ini
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 1
call fcn.00410a55
test eax, eax
je 0x416684
push str.Thumbs.db
lea ecx, [ebp - 0x268]
call fcn.00410a55
test eax, eax
je 0x416684
push str.__.___
lea ecx, [ebp - 0x268]
call fcn.00410a55
test eax, eax
je 0x416684
push str.________.___
lea ecx, [ebp - 0x268]
call fcn.00410a55
test eax, eax
je 0x416684
push str..
lea ecx, [ebp - 0x268]
call fcn.00410a55
test eax, eax
je 0x416684
push 0
push str.fio12_
lea ecx, [ebp - 0x268]
call fcn.0040edb7
cmp eax, 0xffffffff
jne 0x416684
inc dword [ebp - 0x26c]
cmp dword [ebp + 0xc], 0
je 0x416684
lea eax, [ebp - 0x268]
push eax
lea ecx, [edi + 0x24]
call fcn.00438ae1
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.00402760
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4165c7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [edi + 0xb4]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402760
mov eax, dword [ebp - 0x26c]
call fcn.0053ce0c
ret 8
Function at 0x4166d7
Capabilities:
Enumerate files on windows

Disassembly:
push 0x470
mov eax, 0x5646a5
call fcn.0053cd89
mov esi, ecx
push 1
lea eax, [ebp - 0x474]
xor ebx, ebx
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0040ee16
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x416722
cmp ecx, ebx
jge 0x416716
push 0x80070057
call fcn.0040271e
cmp word [eax], 0x5c
mov byte [ebp - 0x46d], bl
je 0x416729
mov byte [ebp - 0x46d], 1
mov ecx, dword [ebp - 0x474]
add ecx, 0xfffffff0
call fcn.00402760
cmp byte [ebp - 0x46d], bl
je 0x416749
push 0x5c
lea ecx, [ebp + 8]
call fcn.00416ccd
push 0x59b7fc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.0040195d
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x468]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x47c]
add ecx, 0xfffffff0
mov dword [ebp - 0x478], eax
call fcn.00402760
cmp dword [ebp - 0x478], 0xffffffff
je 0x416926
test byte [ebp - 0x468], 0x12
jne 0x4168ff
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x46c]
call fcn.00402372
push str.desktop.ini
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 1
call fcn.00410a55
test eax, eax
je 0x4168ee
push str.Thumbs.db
lea ecx, [ebp - 0x46c]
call fcn.00410a55
test eax, eax
je 0x4168ee
push str.__.___
lea ecx, [ebp - 0x46c]
call fcn.00410a55
test eax, eax
je 0x4168ee
push str.________.___
lea ecx, [ebp - 0x46c]
call fcn.00410a55
test eax, eax
je 0x4168ee
push str..
lea ecx, [ebp - 0x46c]
call fcn.00410a55
test eax, eax
je 0x4168ee
push ebx
push str.fio12_
lea ecx, [ebp - 0x46c]
call fcn.0040edb7
cmp eax, 0xffffffff
jne 0x4168ee
lea eax, [esi + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push dword [ebp - 0x46c]
lea ecx, [esi + 0x24]
call fcn.004388d7
test eax, eax
jne 0x4168e3
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00538410
add esp, 0xc
lea eax, [ebp - 0x46c]
push eax
lea ecx, [esi + 0x24]
call fcn.00438ae1
push dword [ebp - 0x46c]
lea eax, [ebp - 0x218]
push dword [ebp + 8]
push 0x59a49c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x474]
call fcn.00402372
lea edi, [ebp - 0x474]
mov byte [ebp - 4], 2
call fcn.0041693b
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x474]
add ecx, 0xfffffff0
call fcn.00402760
lea ecx, [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x46c]
add ecx, 0xfffffff0
call fcn.00402760
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x416792
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402760
xor eax, eax
call fcn.0053ce0c
ret 4
Function at 0x41693b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x416987
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416987
push ebx
lea eax, [esi + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi]
push 0
push eax
lea ecx, [esi + 0x40]
call fcn.004388d7
test eax, eax
jne 0x416977
push edi
lea ecx, [esi + 0x40]
call fcn.00438ae1
lea ecx, [esi + 0x94]
mov eax, dword [ecx]
call dword [eax + 0x14]
xor eax, eax
inc eax
pop ebx
ret
xor eax, eax
ret

Function at 0x41698a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x18
mov eax, 0x5638b1
call fcn.0053cd20
xor ebx, ebx
cmp dword [esi + 0x4c], ebx
jle 0x416a9e
lea eax, [esi + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00437969
push eax
lea ecx, [ebp - 0x10]
call fcn.00402738
mov dword [ebp - 4], ebx
mov edi, dword [esi + 0x44]
lea ecx, [ebp - 0x24]
call fcn.0043f524
mov byte [ebp - 4], 1
jmp 0x416a31
mov eax, edi
cmp edi, ebx
je 0x416a89
mov edi, dword [edi]
add eax, 8
push eax
lea ecx, [ebp - 0x10]
call fcn.004024a4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416a31
push ebx
push ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.0043f994
test eax, eax
lea eax, [ebp - 0x10]
push eax
je 0x416a29
lea ecx, [esi + 0x5c]
call fcn.00438ae1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00438ae1
lea ecx, [ebp - 0x24]
call fcn.0043f4bf
jmp 0x416a31
lea ecx, [esi + 0x78]
call fcn.00438ae1
cmp edi, ebx
jne 0x4169d0
lea ecx, [esi + 0x40]
call fcn.0043897e
cmp dword [esi + 0x84], ebx
jle 0x416a5a
lea ebx, [esi + 0x78]
push ebx
lea ecx, [esi + 0x40]
call fcn.00438b1a
mov ecx, ebx
call fcn.0043897e
xor ebx, ebx
lea ecx, [esi + 0x94]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
cmp dword [eax + 0xc], ebx
jle 0x416a8e
call fcn.0043f654
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402760
xor eax, eax
inc eax
jmp 0x416aa0
call fcn.00438697
call fcn.0043f654
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402760
xor eax, eax
call fcn.0053cdf8
ret 4
Function at 0x416d20
Capabilities:
Read .ini file

Disassembly:
push 0x224
mov eax, 0x567f01
call fcn.0053cd89
mov edi, ecx
mov dword [ebp - 0x230], edi
call fcn.00437969
push eax
lea ecx, [ebp - 0x21c]
call fcn.00402738
and dword [ebp - 4], 0
push edi
push 0x59b898
lea eax, [ebp - 0x21c]
push str._s_d
push eax
call fcn.0040a7d8
lea ecx, [ebp - 0x228]
call fcn.004123b4
push str.EventSetting.ini
push eax
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 1
call fcn.0040195d
add esp, 0x1c
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.00402760
push dword [ebp - 0x224]
push 0x3c
push str.Time
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push dword [ebp - 0x224]
mov ebx, eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x599080
push str.FolderPath
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.004357f2
pop ecx
test eax, eax
je 0x416ef1
cmp word [ebp - 0x218], 0
je 0x416ef1
push edi
mov eax, esi
call fcn.00416cfa
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x416e9b
push 0xd4
call fcn.004378c8
pop ecx
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x416e51
push edi
push ecx
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
call fcn.00402372
push dword [ebp - 0x220]
call fcn.0041609d
jmp 0x416e53
xor eax, eax
mov byte [ebp - 4], 3
mov edi, dword [esi + 4]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
push dword [edi + 4]
push edi
call fcn.00412b12
mov ecx, dword [esi + 8]
mov edx, 0x3ffffffe
sub edx, ecx
cmp edx, 1
jae 0x416e89
push str.list_T__too_long
call fcn.00555c19
inc ecx
mov dword [esi + 8], ecx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
mov edi, dword [ebp - 0x230]
mov dword [ecx], eax
mov eax, dword [esi]
imul ebx, ebx, 0x3e8
push 0
push ebx
push edi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push ecx
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
call fcn.00402372
mov ecx, dword [ebp - 0x220]
call fcn.004163ee
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402760
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00402760
xor eax, eax
inc eax
jmp 0x416f0f
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402760
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00402760
xor eax, eax
call fcn.0053ce0c
ret
Function at 0x41a884
Capabilities:
Read .ini file

Disassembly:
push 0x60
mov eax, 0x56614d
call fcn.0053cd89
lea ecx, [ebp - 0x6c]
call fcn.00439a5b
and dword [ebp - 4], 0
call fcn.00437969
push eax
lea ecx, [ebp - 0x4c]
call fcn.00402738
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00412203
push str.Epson_SoftwareCommonEventInfo.plg
mov eax, esi
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.0040195d
add esp, 0xc
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.004024a4
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402760
mov edi, dword [ebp - 0x4c]
push 0
push edi
lea ecx, [ebp - 0x6c]
call fcn.00439b02
test eax, eax
jne 0x41a92d
lea ecx, [ebp - 0x6c]
call fcn.004395c7
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00402760
lea ecx, [edi - 0x10]
call fcn.00402760
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.00439a8d
mov eax, esi
call fcn.0053ce0c
ret
call fcn.00437969
push eax
lea ecx, [ebp - 0x48]
call fcn.00402738
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 4
call fcn.004396ad
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00439d45
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.004024a4
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.00402760
push 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040ee16
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 6
call fcn.004153a5
push 0x59c580
lea ecx, [ebp - 0x40]
call fcn.00410a55
test eax, eax
je 0x41a9b3
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00402760
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
jmp 0x41aa27
mov esi, dword [ebp - 0x48]
push esi
push 0xa
lea eax, [ebp - 0x38]
push eax
push 0x599080
push str.EventID
push str.Event
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00402372
push 0x59c5a8
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.00410a55
test eax, eax
je 0x41aa39
lea ecx, [ebp - 0x6c]
call fcn.00439a1d
test eax, eax
jne 0x41aa0a
mov eax, dword [ebp - 0x6c]
push 0x10
lea ecx, [ebp - 0x6c]
call dword [eax + 0x38]
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402760
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00402760
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 2
call fcn.00402760
test ebx, ebx
jne 0x41a92d
jmp 0x41a904
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402760
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00402760
lea ecx, [esi - 0x10]
call fcn.00402760
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00402760
lea ecx, [edi - 0x10]
call fcn.00402760
xor esi, esi
inc esi
jmp 0x41a919
Function at 0x41b75d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x5632e8
call fcn.0053cd89
and dword [ebp - 4], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], edi
call fcn.00437969
push eax
mov ecx, edi
call fcn.00402738
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
push str.SoftwareEPSONFastFoto
push SysReAllocString
mov dword [ebp - 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41b7df
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push str.LastConnectDS
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41b7d6
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.004026ce
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0053ce0c
ret

Function at 0x41b7e7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x5632e8
call fcn.0053cd89
and dword [ebp - 4], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], edi
call fcn.00437969
push eax
mov ecx, edi
call fcn.00402738
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
push str.SoftwareEPSONEpsonScanManager
push SysReAllocString
mov dword [ebp - 0x5c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41b869
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push str.LastConnectDS
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41b860
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.004026ce
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0053ce0c
ret
Function at 0x41b871
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x70
mov eax, 0x565ede
call fcn.0053cd20
xor esi, esi
push str.ScanButtonConfig.exe
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0040eeca
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.004122f4
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00401906
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402760
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push str.___DSName:
push eax
call fcn.0040ee66
push 0x59a290
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 4
call fcn.0040195d
mov ecx, dword [ebp - 0x20]
add esp, 0x18
add ecx, 0xfffffff0
call fcn.00402760
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00538410
push dword [ebp - 0x18]
mov dword [ebp - 0x7c], 0x44
call fcn.0053ba11
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41b942
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
push edi
call fcn.0053786e
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402760
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402760
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402760
call fcn.0053cdf8
ret
Function at 0x41c0b3
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0x9c
mov eax, 0x565e40
call fcn.0053cd89
mov esi, ecx
lea ecx, [ebp - 0xa8]
call fcn.004123b4
push str.EventSetting.ini
push eax
lea eax, [ebp - 0xa4]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040195d
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa8]
add ecx, 0xfffffff0
call fcn.00402760
push dword [ebp - 0xa4]
push 1
push str.bShow
push 0x59c8d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea eax, [ebp - 0x98]
push eax
push 0x20019
push ebx
push str.SOFTWAREEPSONDocument_Capture
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x98], ebx
mov byte [ebp - 0x91], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esi + 0xd7c], ebx
cmp eax, ebx
jne 0x41c1e9
lea eax, [ebp - 0xa0]
push eax
push ebx
lea eax, [ebp - 0x9c]
push eax
push ebx
push str.InstallPath
push dword [ebp - 0x98]
mov dword [ebp - 0xa0], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c185
cmp edi, ebx
je 0x41c185
mov dword [esi + 0xd7c], 1
mov edi, 0x80
push edi
lea eax, [ebp - 0x90]
push ebx
push eax
call fcn.00538410
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push ebx
push str.Version
push dword [ebp - 0x98]
mov dword [ebp - 0xa0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c1dd
cmp word [ebp - 0x90], 0x32
jb 0x41c1dd
mov byte [ebp - 0x91], 1
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [ebp - 0x9c], esp
cmp dword [esi + 0xd7c], ebx
je 0x41c220
mov ecx, esp
push 0x59c978
call fcn.00402372
add esi, 0x1f0
cmp byte [ebp - 0x91], bl
je 0x41c219
push 0x84
jmp 0x41c236
push 0x83
jmp 0x41c236
mov edi, esp
call fcn.00437969
push eax
mov ecx, edi
call fcn.00402738
push ebx
add esi, 0x1f0
push esi
call fcn.004347f4
mov ecx, dword [ebp - 0xa4]
add ecx, 0xfffffff0
call fcn.00402760
call fcn.0053ce0c
ret
Function at 0x41d03a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x569d5b
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push edi
mov eax, dword [0x5c9030]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esi + 0xdc8]
xor edi, edi
cmp eax, edi
je 0x41d08c
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xdc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xdc8], edi
push 0xa
lea ecx, [esp + 0x24]
call fcn.00438896
mov dword [esp + 0x48], edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edi
call fcn.004123b4
push 0x59a678
push eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x54], 1
call fcn.0040195d
add esp, 0xc
mov byte [esp + 0x48], 3
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00402760
call fcn.0040f268
push eax
call fcn.0040ef0e
test eax, eax
je 0x41d125
lea ebx, [esi + 0xdcc]
mov ecx, ebx
call fcn.0043897e
push ebx
lea ecx, [esp + 0x1c]
call fcn.0041d151
mov ecx, ebx
call fcn.00428b17
call fcn.0041d679
cmp dword [esi + 0xdc8], edi
jne 0x41d125
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push 0x41d8f0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xdc8], eax
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00402760
or dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.004389c4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret