joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40318a
Capabilities:
Link many functions at runtime

Disassembly:
push 0x214
mov eax, 0x46aef1
call fcn.004517f7
mov dword [ebp - 0x220], esi
xor ebx, ebx
push 0x12c
mov dword [ebp - 4], ebx
lea eax, [esi + 0x38]
push ebx
push eax
mov dword [esi], vtable.PanelDriver.0
mov dword [esi + 0x30], ebx
mov byte [esi + 0x164], bl
call fcn.0044de40
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x34], eax
cmp dword [0x490c40], ebx
jne 0x40326e
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.0044de40
add esp, 0xc
call fcn.0042ba11
mov eax, dword [eax + 8]
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0044deba
pop ecx
pop ecx
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004024c3
push str.espd01.dll
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.00403c3c
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
mov dword [0x490c40], eax
call fcn.0040285d
mov eax, dword [0x490c40]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
cmp eax, ebx
je 0x40332e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PDOpen
push eax
call edi
push str.PDClose
push dword [0x490c40]
mov dword [esi + 8], eax
call edi
push str.PDLock
push dword [0x490c40]
mov dword [esi + 0xc], eax
call edi
push str.PDUnLock
push dword [0x490c40]
mov dword [esi + 0x10], eax
call edi
push str.PDSendJobData
push dword [0x490c40]
mov dword [esi + 0x14], eax
call edi
push str.PDRecvJobData
push dword [0x490c40]
mov dword [esi + 0x18], eax
call edi
push str.PDSendJobData2
push dword [0x490c40]
mov dword [esi + 0x20], eax
call edi
push str.PDDecodeData
push dword [0x490c40]
mov dword [esi + 0x1c], eax
call edi
push str.PDCreateJobData
push dword [0x490c40]
mov dword [esi + 0x24], eax
call edi
push str.PDCreateJobData2
push dword [0x490c40]
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov byte [esi + 4], bl
mov eax, esi
call fcn.0045187a
ret

Function at 0x403ef5
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi + 0x1c]
mov dword [edi], vtable.Project.0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [edi + 0x30]
call fcn.004046eb
mov ecx, dword [edi + 0x2c]
push 0x10
pop esi
sub ecx, esi
call fcn.0040285d
mov ecx, dword [edi + 0x28]
sub ecx, esi
call fcn.0040285d
mov ecx, dword [edi + 0x24]
sub ecx, esi
call fcn.0040285d
mov ecx, dword [edi + 0x20]
sub ecx, esi
call fcn.0040285d
mov ecx, dword [edi + 0x1c]
sub ecx, esi
call fcn.0040285d
mov ecx, dword [edi + 0x14]
sub ecx, esi
call fcn.0040285d
mov ecx, dword [edi + 0xc]
pop edi
sub ecx, esi
pop esi
jmp fcn.0040285d
Function at 0x403fca
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xc3c
mov eax, 0x46c5fe
call fcn.004517f7
mov eax, dword [ebp + 8]
and dword [ebp - 0xc38], 0
mov esi, ecx
lea edi, [ebp - 0xc38]
mov dword [ebp - 0xc3c], eax
call fcn.00403f5b
and dword [ebp - 4], 0
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0xc34]
call fcn.00402773
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
mov byte [ebp - 4], 1
call fcn.0044de40
mov eax, 0x104
push eax
lea ecx, [ebp - 0x628]
push ecx
push eax
lea ecx, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0xc30]
push ecx
push eax
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.0044e556
add esp, 0x30
mov eax, edi
push eax
lea ecx, [ebp - 0xc34]
call fcn.0040270e
push 0x4778ac
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0xc40]
push eax
call fcn.004017f8
lea ecx, [ebp - 0x218]
push ecx
push eax
lea eax, [ebp - 0xc48]
push eax
mov byte [ebp - 4], 2
call fcn.004017f8
push 0x477894
push eax
lea eax, [ebp - 0xc44]
push eax
mov byte [ebp - 4], 3
call fcn.004017f8
add esp, 0x24
push eax
lea ecx, [ebp - 0xc34]
mov byte [ebp - 4], 4
call fcn.0040270e
mov ecx, dword [ebp - 0xc44]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0xc48]
add ecx, 0xfffffff0
call fcn.0040285d
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xc40]
add ecx, 0xfffffff0
call fcn.0040285d
mov esi, dword [ebp - 0xc34]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404121
push esi
push 0x200
lea eax, [ebp - 0xa28]
push eax
push 0x47741c
push 0x4778b0
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xa28]
push eax
jmp 0x404126
push 0x4778d0
mov ecx, dword [ebp - 0xc3c]
call fcn.004024c3
lea ecx, [esi - 0x10]
call fcn.0040285d
mov ecx, dword [ebp - 0xc38]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, dword [ebp - 0xc3c]
call fcn.0045187a
ret 4
Function at 0x404155
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x11c
mov eax, 0x46d315
call fcn.004517f7
mov eax, dword [ebp + 8]
and dword [ebp - 0x124], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, ecx
push esi
push 0x80
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x110]
push eax
push 0x47741c
push str.ProjectUid
push str.Launch
call ebx
lea edi, [ebp - 0x11c]
call fcn.00403f5b
and dword [ebp - 4], 0
push 0x4778ac
mov eax, edi
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.004017f8
lea ecx, [ebp - 0x110]
push ecx
push eax
lea eax, [ebp - 0x128]
push eax
mov byte [ebp - 4], 1
call fcn.004017f8
push 0x477894
push eax
lea eax, [ebp - 0x118]
push eax
mov byte [ebp - 4], 2
call fcn.004017f8
add esp, 0x24
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.0040285d
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.0040285d
push dword [ebp - 0x118]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404255
push dword [ebp - 0x118]
lea eax, [ebp - 0x110]
push 0x80
push eax
push 0x47741c
push 0x4778b0
push str.String
call ebx
mov ecx, dword [ebp - 0x114]
lea eax, [ebp - 0x110]
push eax
call fcn.004024c3
jmp 0x404287
lea eax, [ebp - 0x120]
push eax
mov ecx, esi
call fcn.00403fca
mov ecx, dword [ebp - 0x114]
lea eax, [ebp - 0x120]
push eax
mov byte [ebp - 4], 6
call fcn.0040283c
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, dword [ebp - 0x114]
call fcn.0045187a
ret 4
Function at 0x40441b
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x424
mov eax, 0x46dedb
call fcn.004517f7
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0xc]
mov ebx, edx
lea esi, [edi + 0xc]
mov ecx, esi
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x428], eax
mov dword [edi], vtable.Project.0
call fcn.0040279b
and dword [ebp - 4], 0
lea ecx, [edi + 0x14]
call fcn.0040279b
lea ecx, [edi + 0x1c]
call fcn.0040279b
lea ecx, [edi + 0x20]
call fcn.0040279b
lea ecx, [edi + 0x24]
call fcn.0040279b
lea ecx, [edi + 0x28]
call fcn.0040279b
lea ecx, [edi + 0x2c]
call fcn.0040279b
lea eax, [edi + 0x30]
push eax
mov byte [ebp - 4], 6
call fcn.0040465b
mov byte [ebp - 4], 7
push dword [ebp - 0x428]
and dword [edi + 8], 0
mov ecx, esi
call fcn.004024ae
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x2bc
push str.ProjectID
mov esi, str.Launch
push esi
call ebx
push dword [ebp - 0x424]
mov dword [edi + 0x10], eax
push 0
push str.OrderHint
push esi
call ebx
push dword [ebp - 0x424]
mov dword [edi + 8], eax
push 0x104
lea eax, [ebp - 0x420]
push eax
push 0x47741c
push str.ScanSetting
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404528
push dword [edi + 0x10]
lea edx, [ebp - 0x420]
lea ecx, [edi + 0x30]
call fcn.00404883
jmp 0x404533
mov ecx, dword [ebp - 0x424]
call fcn.004042b1
push dword [ebp - 0x424]
push 0
push str.DeleteFileAfterSent
push esi
call ebx
push dword [ebp - 0x424]
test eax, eax
push 0
push str.PanelOperationLock
setne al
push esi
mov byte [edi + 0x18], al
call ebx
push dword [ebp - 0x424]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
setne al
push 0x104
mov byte [edi + 0x19], al
lea eax, [ebp - 0x218]
push eax
push 0x47741c
push str.ExtActionUid
mov esi, str.Event_Launch_Win
push esi
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [edi + 0x24]
call fcn.0040247a
push dword [ebp - 0x424]
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x47741c
push str.ExtActionTypeId
push esi
call ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [edi + 0x28]
call fcn.0040247a
mov ecx, dword [ebp - 0x424]
lea eax, [ebp - 0x428]
push eax
call fcn.00404155
push eax
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040275e
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x428]
add ecx, 0xfffffff0
call fcn.0040285d
push dword [ebp - 0x42c]
lea ecx, [edi + 0x20]
call fcn.004024ae
push dword [ebp - 0x424]
lea ecx, [edi + 0x2c]
call fcn.004024ae
mov eax, edi
call fcn.0045187a
ret 8
Function at 0x404721
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x48c7d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ecx
push 0x80
lea ecx, [ebp - 0x10c]
push ecx
push 0x47741c
push eax
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x10c]
push eax
call fcn.0044d316
pop ecx
test eax, eax
jne 0x40476b
fld qword [ebp + 0xc]
jmp 0x404794
fldz
lea eax, [ebp - 0x114]
push eax
fstp qword [ebp - 0x114]
lea eax, [ebp - 0x10c]
push 0x477aac
push eax
call fcn.0044e7e6
fld qword [ebp - 0x114]
add esp, 0xc
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044d1dc
leave
ret

Function at 0x4047a0
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push 0x418
mov eax, 0x46ae90
call fcn.004517f7
xor esi, esi
mov dword [ebp - 0x424], esi
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x424]
call fcn.00402773
push 0x410
lea eax, [ebp - 0x420]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.0044de40
mov eax, dword [ebp + 8]
add esp, 0xc
sub eax, esi
je 0x40484a
dec eax
dec eax
lea eax, [ebp - 0x420]
je 0x4047fb
push eax
push esi
push esi
push 0x8027
jmp 0x404858
push ebx
push 0x104
push eax
push 0x47741c
push str.TargetFolder
push str.Save
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x420]
push eax
je 0x4047f2
lea ecx, [ebp - 0x424]
call fcn.0040247a
lea eax, [ebp - 0x424]
push eax
mov ecx, edi
call fcn.0040283c
jmp 0x40486d
lea eax, [ebp - 0x420]
push eax
push esi
push esi
push 0x8005
push esi
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
lea eax, [ebp - 0x420]
push eax
mov ecx, edi
call fcn.004024c3
mov ecx, dword [ebp - 0x424]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, edi
call fcn.0045187a
ret
Function at 0x405f6d
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x46e643
call fcn.004517f7
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x224], ebx
cmp dword [esi], edi
jne 0x405f9c
call fcn.0040279b
mov eax, ebx
jmp 0x40617e
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x228]
call fcn.00402773
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x230]
call fcn.00402773
lea eax, [ebp - 0x21c]
push eax
mov byte [ebp - 4], 2
call fcn.00427d51
mov dword [esp], 0x478048
push 0x478068
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x228]
push 0x478074
push eax
call fcn.0040314f
add esp, 0x14
push 0x478084
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.004017f8
add esp, 0xc
mov byte [ebp - 4], 3
push dword [ebp - 0x22c]
mov eax, dword [esi]
mov eax, dword [eax + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.MajorNum
push eax
call edi
push dword [ebp - 0x22c]
mov dword [ebp - 0x220], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0
push str.MinorNum
push eax
call edi
cmp dword [ebp - 0x220], 2
jne 0x40605d
cmp eax, 0x46
jge 0x406066
cmp dword [ebp - 0x220], 3
jl 0x4060cd
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x234]
call fcn.00402773
mov byte [ebp - 4], 4
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x20]
add eax, 0x14
push eax
lea ecx, [ebp - 0x220]
call fcn.0040283c
push ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 5
call fcn.0040283c
push dword [ebp - 0x224]
push esi
call fcn.004059ff
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x234]
jmp 0x406146
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x20]
add eax, 8
mov edi, 0x47741c
push edi
mov ecx, eax
call fcn.0040247a
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x220]
call fcn.00402773
lea eax, [ebp - 0x248]
push eax
mov byte [ebp - 4], 6
call fcn.00425761
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 7
mov edx, dword [esi]
push eax
lea ecx, [ebp - 0x248]
call fcn.004258bb
mov ecx, dword [ebp - 0x224]
push edi
call fcn.004024c3
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x238], ebx
mov byte [ebp - 4], 6
call fcn.004257e6
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, dword [ebp - 0x224]
call fcn.0045187a
ret
Function at 0x4065b4
Capabilities:
Read .ini file

Disassembly:
push 0x230
mov eax, 0x46ad86
call fcn.004517f7
and dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push eax
call fcn.00427d2a
pop ecx
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x22c]
call fcn.00402773
push str.Resources
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x22c]
push 0x477fb8
push eax
mov byte [ebp - 4], 1
call fcn.0040314f
add esp, 0x10
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x224]
call fcn.00402773
mov byte [ebp - 4], 2
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x230]
call fcn.00402773
mov byte [ebp - 4], 3
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x228]
call fcn.00402773
and dword [ebp - 0x234], 0
mov dword [ebp - method.CLcMgrStub.virtual_0], vtable.CLcMgrStub.0
push ecx
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.string
call fcn.004024c3
push ecx
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x23c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 6
call fcn.0040283c
lea esi, [ebp - 0x238]
mov byte [ebp - 4], 5
call fcn.0040beed
push dword [ebp + 8]
lea ebx, [ebp - 0x220]
call fcn.0040bf42
push eax
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 7
call fcn.0040270e
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0040285d
lea eax, [ebp - 0x220]
push eax
mov eax, dword [edi + 4]
call fcn.0040b445
push dword [eax]
lea eax, [ebp - 0x21c]
push 0x104
push eax
push 0x47741c
push str.ProjectAppName
push str.Event_Launch_Win
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0040285d
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x230]
push 0x4774a8
push eax
call fcn.0040314f
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 0x20]
mov ebx, dword [ebp - 0x230]
add eax, 0x18
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x406745
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
call dword [eax + 0x20]
push dword [eax + 0x18]
jmp 0x40674c
cmp dword [ebx - 0xc], 0
je 0x406763
push ebx
push dword [ebp - 0x224]
lea eax, [ebp - 0x228]
push eax
call fcn.0040314f
add esp, 0xc
jmp 0x40679b
lea eax, [ebp - 0x220]
push eax
mov eax, dword [edi + 4]
call fcn.00414857
mov byte [ebp - 4], 8
push dword [eax]
lea eax, [ebp - 0x228]
push dword [ebp - 0x224]
push eax
call fcn.0040314f
mov ecx, dword [ebp - 0x220]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040285d
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [ebp - 0x228]
push 0x30
push 0x47817c
push esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 4
call fcn.0040bedc
lea ecx, [esi - 0x10]
call fcn.0040285d
lea ecx, [ebx - 0x10]
call fcn.0040285d
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040285d
call fcn.0045187a
ret 4
Function at 0x406aa7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46acf8
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x48c7d0]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push esi
mov eax, dword [0x48c7d0]
xor eax, esp
push eax
lea eax, [esp + 0x248]
mov dword fs:[0], eax
cmp byte [edi + 0x30], 0
je 0x406b12
xor eax, eax
inc eax
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.0044d1dc
mov esp, ebp
pop ebp
ret
call fcn.0042a8d7
push eax
lea ecx, [esp + 0x10]
call fcn.00402773
and dword [esp + 0x250], 0
lea ebx, [esp + 0x10]
call fcn.004084ad
mov byte [esp + 0x250], 1
mov eax, dword [eax]
push 0x478084
push eax
lea eax, [esp + 0x14]
push 0x477fb8
push eax
call fcn.0040314f
mov byte [esp + 0x260], 0
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040285d
lea ecx, [esp + 0x1c]
call fcn.0042be99
xor ebx, ebx
push ebx
mov byte [esp + 0x254], 2
push dword [esp + 0x10]
lea ecx, [esp + 0x24]
call fcn.0042bf31
test eax, eax
je 0x406b97
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x1c]
call fcn.0042ba95
push ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x14], esp
mov ecx, esp
push eax
call fcn.0040283c
call fcn.004291c0
pop ecx
push edi
call fcn.0040707c
push dword [esp + 0xc]
mov esi, str.AllEpsonDS
push ebx
push str.Count
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x406c04
cmp dword [edi + 0x5c], ebx
jne 0x406c04
lea ecx, [esp + 0x1c]
mov byte [esp + 0x250], 0
call fcn.0042bec2
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, ebx
jmp 0x406aef
call fcn.0042a8d7
push eax
lea ecx, [esp + 0x1c]
call fcn.00402773
lea ebx, [edi + 0x34]
mov ecx, ebx
mov byte [esp + 0x250], 3
call fcn.0042aeae
and dword [esp + 0x14], 0
cmp dword [esp + 0x10], 0
jle 0x406c84
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push str.name
push str._s_d
push eax
call fcn.0040314f
add esp, 0x10
push dword [esp + 0xc]
lea eax, [esp + 0x38]
push 0x104
push eax
push 0x47741c
push dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x34]
push eax
mov ecx, ebx
call fcn.0042b052
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
jl 0x406c31
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
mov byte [edi + 0x30], 1
call fcn.0040285d
xor ebx, ebx
inc ebx
jmp 0x406be0

Function at 0x407480
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push ecx
push 0
push str.ModelDependency
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
setne al
ret
Function at 0x4074e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x48c7d0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0044de40
add esp, 0xc
push dword [esi + 0xc]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x47741c
push str.ShortTranslation
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.004024c3
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, edi
call fcn.0044d1dc
leave
ret

Function at 0x407556
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x48c7d0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0044de40
add esp, 0xc
push dword [esi + 0xc]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x47741c
push str.DeviceSettingAlias
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.004024c3
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, edi
call fcn.0044d1dc
leave
ret

Function at 0x4075cc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x48c7d0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0044de40
add esp, 0xc
push dword [esi + 0xc]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x47741c
push str.DevInfAlias
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.004024c3
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, edi
call fcn.0044d1dc
leave
ret
Function at 0x4082ab
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x214
mov eax, 0x469156
call fcn.004517f7
xor esi, esi
push esi
push 0x26
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 4], esi
push esi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.004024c3
mov dword [ebp - 4], esi
push str.Epson_SoftwareCommon_
mov ecx, edi
mov dword [ebp - 0x21c], 1
call fcn.00403c3c
mov eax, edi
call fcn.0045187a
ret

Function at 0x40830b
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x48c7d0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push eax
push 0x26
lea ecx, [ebp - 0x20c]
push ecx
push eax
mov dword [ebp - 0x210], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.004024c3
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.0044d1dc
leave
ret

Function at 0x408353
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x469674
call fcn.004517f7
and dword [ebp - 0x21c], 0
call fcn.00408262
add eax, 4
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x4083da
push 1
push 0x1a
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004024c3
and dword [ebp - 4], 0
push str.EPSONEvent_ManagerMappingTable.ini
lea ecx, [ebp - 0x21c]
call fcn.00403c3c
call fcn.00408262
lea ecx, [ebp - 0x21c]
add eax, 4
push ecx
mov ecx, eax
call fcn.0040270e
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.0040285d
call fcn.00408262
add eax, 4
push eax
mov ecx, edi
call fcn.00402877
mov eax, edi
call fcn.0045187a
ret

Function at 0x4084ad
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x210
mov eax, 0x469674
call fcn.004517f7
xor edi, edi
mov dword [ebp - 0x21c], edi
call fcn.00408262
add eax, 0xc
mov eax, dword [eax]
cmp dword [eax - 0xc], edi
jne 0x40855e
push 1
push 0x1a
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004024c3
push str.Epson
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.00403c3c
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push dword [ebp - 0x21c]
call esi
push 0x478048
lea ecx, [ebp - 0x21c]
call fcn.00403c3c
push edi
push dword [ebp - 0x21c]
call esi
call fcn.00408262
lea ecx, [ebp - 0x21c]
add eax, 0xc
push ecx
mov ecx, eax
call fcn.0040270e
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.0040285d
call fcn.00408262
add eax, 0xc
push eax
mov ecx, ebx
call fcn.00402877
mov eax, ebx
call fcn.0045187a
ret