joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e8c63
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x18], 0
jne 0x5e8db7
cmp dword [ebp + 0xc], 0
jne 0x5e8db7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x5e8caa
sub eax, dword [ebp + 0x10]
js 0x5e8db7
je 0x5e8db7
cmp eax, dword [ebp + 0x14]
jl 0x5e8db7
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e8db7
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e8db7
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x122d1ee7]
pop edi
test eax, eax
je 0x5e8db7
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124ad01a]
push eax
call fcn.005e7ccb
pop edi
test eax, eax
je 0x5e8db7
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124ad01e]
push eax
call fcn.005e7ccb
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e8daa
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x5e8db7
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e8d97
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e8d65
push dword [ebp + 8]
call fcn.005e9b59
jmp 0x5e8dbe
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x5e9149
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5e9238
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5e9238
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5e91e4
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5e9238
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x124ad17a]
pop edi
pop ecx
test eax, eax
jne 0x5e919d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5e91ea
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5e9238
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5e9238
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5e9238
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5e9238
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005e9092
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x19015c8c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x20687c70
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10001440
Capabilities:
Read .ini file

Disassembly:
mov ecx, 0x100113d8
jmp 0x10003540
sub esp, 0x12c
add ecx, 4
lea eax, [esp]
push ecx
push 0x12c
push eax
push 0x100113d4
push str.UninstallComp
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov cl, byte [esp]
xor eax, eax
test cl, cl
setne al
add esp, 0x12c
ret

Function at 0x10001470
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov di, ax
mov eax, dword [esi + 0xd0]
and edi, 0xffff
test eax, eax
je 0x1000148f
mov edi, eax
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
shr esi, 4
inc esi
push ebx
push ebp
mov ebp, dword [esp + 0x14]
and esi, 0xffff
push edi
push esi
push 6
push ebp
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
jne 0x100014f7
mov ebx, 1
cmp ebx, 0x32
jae 0x100014e4
mov ecx, edi
mov edx, ebx
and ecx, 0x3ff
shl edx, 0xa
or ecx, edx
push ecx
push esi
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
inc ebx
test eax, eax
je 0x100014be
jmp 0x100014f7
test eax, eax
jne 0x100014f7
push 0x409
push esi
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x1c]
pop ebp
and ecx, 0xf
pop ebx
mov edx, esi
and edx, 0xffff
cmp edx, ecx
je 0x1000153f
xor edx, edx
inc esi
mov dx, word [eax]
cmp si, 0x10
lea eax, [eax + edx*2 + 2]
jb 0x10001513
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x10]
pop edi
pop esi
ret 0xc
mov si, word [eax]
mov edx, dword [esp + 0x10]
add eax, 2
test edx, edx
je 0x10001567
mov cx, si
add esi, 0xffff
test cx, cx
je 0x10001567
mov cl, byte [eax]
add eax, 2
mov byte [edx], cl
inc edx
test cl, cl
jne 0x10001549
push edi
mov byte [edx], 0
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x10]
pop edi
pop esi
ret 0xc
Function at 0x10001580
Capabilities:
Get geographical location
Identify system language via api
Read .ini file

Disassembly:
sub esp, 0x70
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov bp, ax
mov eax, dword [esp + 0x88]
and ebp, 0xffff
cmp eax, 1
jne 0x100015bb
xor eax, eax
mov cl, byte [eax + str.Name]
mov byte [esp + eax + 0x1c], cl
inc eax
test cl, cl
jne 0x100015aa
jmp 0x100015cc
xor eax, eax
mov cl, byte [eax + str.Description]
mov byte [esp + eax + 0x1c], cl
inc eax
test cl, cl
jne 0x100015bd
mov eax, dword [edi + 0xd0]
test eax, eax
je 0x100015d8
mov ebp, eax
mov esi, dword [esp + 0x84]
lea ecx, [esp + 0x14]
xor eax, eax
push 8
push ecx
mov dword [esp + 0x1c], eax
push 3
push ebp
mov byte [esi], 0
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov al, byte [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test al, al
mov byte [esp + 0x17], 0
je 0x10001646
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x54]
push str._s__s
push ecx
call fcn.10004341
add esp, 0x10
add edi, 4
lea edx, [esp + 0x4c]
push edi
push 0xc8
push esi
push 0x100113d4
push edx
push str.Component
call ebx
cmp byte [esi], 0
jne 0x10001710
mov edi, 1
cmp edi, 0x32
jae 0x100016ec
xor eax, eax
mov edx, ebp
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov byte [esp + 0x14], al
mov eax, edi
and edx, 0x3ff
and eax, 0xffff
push 8
shl eax, 0xa
push ecx
or edx, eax
push 3
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov al, byte [esp + 0x14]
mov byte [esp + 0x17], 0
test al, al
je 0x100016d7
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x54]
push str._s__s
push eax
call fcn.10004341
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ecx, 4
lea edx, [esp + 0x4c]
push ecx
push 0xc8
push esi
push 0x100113d4
push edx
push str.Component
call ebx
mov al, byte [esi]
inc edi
test al, al
je 0x10001654
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8
cmp byte [esi], 0
jne 0x10001710
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
add eax, 4
push eax
push 0xc8
push esi
push 0x100113d4
push ecx
push str.Component
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8

Function at 0x10001780
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push 0xffffffffffffffff
push str.CheckCard
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x100017b5
mov ecx, dword [esi + 0x500]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
ret 4
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x100017c0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push 0xffffffffffffffff
push str.CheckATICard
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x10001802
mov ecx, dword [esi + 0x648]
push str.Not_Detected
push ecx
call fcn.1000b960
add esp, 8
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret 4
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x10001810
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push 0xffffffffffffffff
push str.CheckFGL
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x10001845
mov ecx, dword [esi + 0x6b8]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
ret 4
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x10001850
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push 0xffffffffffffffff
push str.CheckAGP
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x100018a3
mov edx, dword [esi + 0x64c]
xor eax, eax
xor ecx, ecx
test edx, edx
jle 0x100018a5
add esi, 0x550
cmp dword [esi], 8
je 0x10001899
inc ecx
add esi, 4
cmp ecx, edx
jl 0x10001887
pop edi
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x100018b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x57c
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov byte [esp + 0x1a4], al
mov esi, dword [esp + 0x590]
lea eax, [ebp + 4]
lea ecx, [esp + 0x1a4]
push eax
push 0x3e8
push ecx
push 0x100113d4
push str.Req_ASIC
push str.Component
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x1a4]
test al, al
je 0x100019b5
lea edx, [esp + 0x14]
push 0x64
lea eax, [esp + 0x1a8]
push edx
push eax
call fcn.10001af0
add esp, 0xc
test eax, eax
jle 0x100019b5
xor ebx, ebx
xor esi, esi
test eax, eax
jle 0x100019a6
cmp dword [esp + esi*4 + 0x14], 1
je 0x10001994
mov edi, dword [ebp + 0x64c]
xor edx, edx
test edi, edi
jle 0x1000198a
mov ecx, dword [esp + esi*4 + 0x14]
test cl, cl
jne 0x1000196d
mov ebp, dword [ebp + edx*4 + 0x500]
and ecx, 0xffff
and ebp, 0xff00
cmp ebp, ecx
mov ebp, dword [esp + 0x10]
jmp 0x1000197a
and ecx, 0xffff
cmp dword [ebp + edx*4 + 0x500], ecx
jne 0x10001985
mov ebx, 1
mov edx, edi
mov esi, eax
inc edx
cmp edx, edi
jl 0x1000194a
inc esi
cmp esi, eax
jl 0x10001937
cmp ebx, 1
jne 0x100019a6
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x57c
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x57c
ret 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x57c
ret 4
Function at 0x100019d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x2c0
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x140]
rep stosd dword es:[edi], eax
mov byte [esp + 0x14], al
mov edi, dword [esp + 0x2d4]
lea eax, [ebp + 4]
lea ecx, [esp + 0x14]
push eax
push 0x12c
push ecx
push 0x100113d4
push str._Req_ASIC
push str.Component
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x14]
test al, al
je 0x10001adb
lea edx, [esp + 0x140]
push 0x64
lea eax, [esp + 0x18]
push edx
push eax
call fcn.10001af0
add esp, 0xc
test eax, eax
jle 0x10001adb
xor ebx, ebx
xor esi, esi
test eax, eax
jle 0x10001adb
cmp dword [esp + esi*4 + 0x140], 1
je 0x10001ab8
mov edi, dword [ebp + 0x64c]
xor edx, edx
test edi, edi
jle 0x10001aae
mov ecx, dword [esp + esi*4 + 0x140]
test cl, cl
jne 0x10001a91
mov ebp, dword [ebp + edx*4 + 0x500]
and ecx, 0xffff
and ebp, 0xff00
cmp ebp, ecx
mov ebp, dword [esp + 0x10]
jmp 0x10001a9e
and ecx, 0xffff
cmp dword [ebp + edx*4 + 0x500], ecx
jne 0x10001aa9
mov ebx, 1
mov edx, edi
mov esi, eax
inc edx
cmp edx, edi
jl 0x10001a6b
inc esi
cmp esi, eax
jl 0x10001a55
cmp ebx, 1
jne 0x10001ac7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c0
ret 4
mov eax, dword [esp + 0x2d4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c0
ret 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c0
ret 4

Function at 0x10001b50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x578
push esi
push edi
mov esi, ecx
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov byte [esp + 0x198], al
mov edi, dword [esp + 0x584]
lea eax, [esi + 4]
lea ecx, [esp + 0x198]
push eax
push 0x3e8
push ecx
push 0x100113d4
push str.NBDI
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x198]
test al, al
je 0x10001c06
lea edx, [esp + 8]
lea eax, [esp + 0x198]
push edx
push eax
call fcn.10001af0
add esp, 8
test eax, eax
jle 0x10001c06
xor edx, edx
xor ecx, ecx
test eax, eax
jle 0x10001bf9
mov esi, dword [esi + 0x5a0]
mov edi, dword [esp + ecx*4 + 8]
and edi, 0xffff
cmp esi, edi
jne 0x10001be2
mov edx, 1
mov ecx, eax
inc ecx
cmp ecx, eax
jl 0x10001bcd
cmp edx, 1
jne 0x10001bf9
pop edi
mov eax, edx
pop esi
add esp, 0x578
ret 4
pop edi
xor eax, eax
pop esi
add esp, 0x578
ret 4
mov eax, edi
pop edi
pop esi
add esp, 0x578
ret 4
Function at 0x10001c20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x578
push esi
push edi
mov esi, ecx
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov byte [esp + 0x198], al
mov edi, dword [esp + 0x584]
lea eax, [esi + 4]
lea ecx, [esp + 0x198]
push eax
push 0x3e8
push ecx
push 0x100113d4
push str.SBDI
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x198]
test al, al
je 0x10001cd6
lea edx, [esp + 8]
lea eax, [esp + 0x198]
push edx
push eax
call fcn.10001af0
add esp, 8
test eax, eax
jle 0x10001cd6
xor edx, edx
xor ecx, ecx
test eax, eax
jle 0x10001cc9
mov esi, dword [esi + 0x5a4]
mov edi, dword [esp + ecx*4 + 8]
and edi, 0xffff
cmp esi, edi
jne 0x10001cb2
mov edx, 1
mov ecx, eax
inc ecx
cmp ecx, eax
jl 0x10001c9d
cmp edx, 1
jne 0x10001cc9
pop edi
mov eax, edx
pop esi
add esp, 0x578
ret 4
pop edi
xor eax, eax
pop esi
add esp, 0x578
ret 4
mov eax, edi
pop edi
pop esi
add esp, 0x578
ret 4

Function at 0x10001cf0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x2bc
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x13c]
rep stosd dword es:[edi], eax
mov byte [esp + 0x10], al
mov esi, dword [esp + 0x2d0]
lea eax, [ebx + 4]
lea ecx, [esp + 0x10]
push eax
push 0x12c
push ecx
push 0x100113d4
push str.Req_SubsystemId
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x10]
test al, al
je 0x10001dc6
lea edx, [esp + 0x13c]
push 0x64
lea eax, [esp + 0x14]
push edx
push eax
call fcn.10001af0
add esp, 0xc
test eax, eax
jle 0x10001dc6
xor edi, edi
xor ecx, ecx
test eax, eax
jle 0x10001db7
cmp dword [esp + ecx*4 + 0x13c], 1
je 0x10001da5
mov esi, dword [ebx + 0x64c]
test esi, esi
jle 0x10001d9b
lea edx, [ebx + 0x65c]
mov ebp, dword [edx]
cmp ebp, dword [esp + ecx*4 + 0x13c]
jne 0x10001d95
mov edi, 1
mov ecx, eax
add edx, 4
dec esi
jne 0x10001d83
inc ecx
cmp ecx, eax
jl 0x10001d69
cmp edi, 1
jne 0x10001db7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2bc
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2bc
ret 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2bc
ret 4
Function at 0x10001de0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x2bc
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x13c]
rep stosd dword es:[edi], eax
mov byte [esp + 0x10], al
mov esi, dword [esp + 0x2d0]
lea eax, [ebx + 4]
lea ecx, [esp + 0x10]
push eax
push 0x12c
push ecx
push 0x100113d4
push str._Req_SubsystemId
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x10]
test al, al
je 0x10001eba
lea edx, [esp + 0x13c]
push 0x64
lea eax, [esp + 0x14]
push edx
push eax
call fcn.10001af0
add esp, 0xc
test eax, eax
jle 0x10001eba
xor edi, edi
xor edx, edx
test eax, eax
jle 0x10001eba
cmp dword [esp + edx*4 + 0x13c], 1
je 0x10001e97
mov esi, dword [ebx + 0x64c]
xor ecx, ecx
test esi, esi
jle 0x10001e8d
mov ebp, dword [ebx + ecx*4 + 0x65c]
cmp ebp, dword [esp + edx*4 + 0x13c]
jne 0x10001e88
mov edi, 1
mov ecx, esi
mov edx, eax
inc ecx
cmp ecx, esi
jl 0x10001e6f
inc edx
cmp edx, eax
jl 0x10001e59
cmp edi, 1
jne 0x10001ea6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2bc
ret 4
mov eax, dword [esp + 0x2d0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2bc
ret 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2bc
ret 4

Function at 0x10001ed0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x2bc
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x13c]
rep stosd dword es:[edi], eax
mov byte [esp + 0x10], al
mov esi, dword [esp + 0x2d0]
lea eax, [ebx + 4]
lea ecx, [esp + 0x10]
push eax
push 0x12c
push ecx
push 0x100113d4
push str.Req_CaptureSubSystemId
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x10]
test al, al
je 0x10001fa8
lea edx, [esp + 0x13c]
push 0x64
lea eax, [esp + 0x14]
push edx
push eax
call fcn.10001af0
add esp, 0xc
test eax, eax
jle 0x10001fa8
xor edi, edi
xor edx, edx
test eax, eax
jle 0x10001f99
cmp dword [esp + edx*4 + 0x13c], 1
je 0x10001f87
mov esi, dword [ebx + 0x650]
xor ecx, ecx
test esi, esi
jle 0x10001f7d
mov ebp, dword [ebx + ecx*4 + 0x45c]
cmp ebp, dword [esp + edx*4 + 0x13c]
jne 0x10001f78
mov edi, 1
mov ecx, esi
mov edx, eax
inc ecx
cmp ecx, esi
jl 0x10001f5f
inc edx
cmp edx, eax
jl 0x10001f49
cmp edi, 1
jne 0x10001f99
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2bc
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2bc
ret 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2bc
ret 4
Function at 0x10001fc0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x2bc
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x13c]
rep stosd dword es:[edi], eax
mov byte [esp + 0x10], al
mov esi, dword [esp + 0x2d0]
lea eax, [ebx + 4]
lea ecx, [esp + 0x10]
push eax
push 0x12c
push ecx
push 0x100113d4
push str._Req_CaptureSubSystemId
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x10]
test al, al
je 0x1000209a
lea edx, [esp + 0x13c]
push 0x64
lea eax, [esp + 0x14]
push edx
push eax
call fcn.10001af0
add esp, 0xc
test eax, eax
jle 0x1000209a
xor edi, edi
xor edx, edx
test eax, eax
jle 0x1000209a
cmp dword [esp + edx*4 + 0x13c], 1
je 0x10002077
mov esi, dword [ebx + 0x650]
xor ecx, ecx
test esi, esi
jle 0x1000206d
mov ebp, dword [ebx + ecx*4 + 0x45c]
cmp ebp, dword [esp + edx*4 + 0x13c]
jne 0x10002068
mov edi, 1
mov ecx, esi
mov edx, eax
inc ecx
cmp ecx, esi
jl 0x1000204f
inc edx
cmp edx, eax
jl 0x10002039
cmp edi, 1
jne 0x10002086
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2bc
ret 4
mov eax, dword [esp + 0x2d0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2bc
ret 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2bc
ret 4

Function at 0x100020b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x2c0
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov byte [esp + 0x1a4], al
mov esi, dword [esp + 0x2d4]
lea eax, [ebp + 4]
lea ecx, [esp + 0x1a4]
push eax
push 0x12c
push ecx
push 0x100113d4
push str.Req_Capture
push str.Component
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x1a4]
test al, al
je 0x100021bf
lea edx, [esp + 0x14]
push 0x64
lea eax, [esp + 0x1a8]
push edx
push eax
call fcn.10001af0
add esp, 0xc
test eax, eax
jle 0x100021bf
xor ebx, ebx
xor esi, esi
test eax, eax
jle 0x100021b0
cmp dword [esp + esi*4 + 0x14], 1
je 0x1000219e
mov edi, dword [ebp + 0x650]
xor ecx, ecx
test edi, edi
jle 0x10002194
mov edx, dword [esp + esi*4 + 0x14]
test edx, 0xffff0000
jne 0x10002160
or edx, 0x10020000
mov dword [esp + esi*4 + 0x14], edx
mov edx, dword [esp + esi*4 + 0x14]
test dl, dl
jne 0x1000217d
mov ebp, dword [ebp + ecx*4 + 0x5a8]
and ebp, 0xffffff00
cmp ebp, edx
mov ebp, dword [esp + 0x10]
jmp 0x10002184
cmp dword [ebp + ecx*4 + 0x5a8], edx
jne 0x1000218f
mov ebx, 1
mov ecx, edi
mov esi, eax
inc ecx
cmp ecx, edi
jl 0x1000214a
inc esi
cmp esi, eax
jl 0x10002137
cmp ebx, 1
jne 0x100021b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c0
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c0
ret 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c0
ret 4