joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 4]
lea edx, [esp + 8]
push edx
push 0
push str.ProductName
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10004f06
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop ecx
ret 4
cmp dword [esp], 1
sete al
pop ecx
ret 4
Function at 0x1000d820
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x1014195e
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
mov eax, 1
test byte [0x101c1c78], al
jne 0x1000d883
or dword [0x101c1c78], eax
mov ecx, 0x101c1c5c
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push 0x1014bce0
call fcn.10130f6d
add esp, 4
mov dword [esp + 0x1c], 0xffffffff
push 0
push ebp
mov dword [esp + 0x2c], 0x34
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x1000d91f
lea ecx, [ecx]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x1000d8a0
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000d90a
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x101520e4
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000d90a
mov eax, dword [esp + 0x10]
movzx edx, word [eax + 0x16]
movzx ecx, word [eax + 0x10]
push edx
movzx edx, word [eax + 0x12]
push ecx
push edx
push str._d._d._d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push esi
mov ecx, 0x101c1c5c
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [0x101c1c74], 8
mov eax, dword [0x101c1c60]
jae 0x1000d932
mov eax, 0x101c1c60
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
Function at 0x1000dae0
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1014313b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x42c], eax
push edi
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
call fcn.100031b0
lea ecx, [esp + 8]
mov edi, eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push 0x206
lea eax, [esp + 0x2a]
push 0
mov dword [esp + 0x448], 0
push eax
mov word [esp + 0x30], 0
call sub.MSVCR80.dll_memset
push 0x206
lea ecx, [esp + 0x23e]
push 0
push ecx
mov word [esp + 0x244], 0
call sub.MSVCR80.dll_memset
add esp, 0x18
lea edx, [esp + 0x24]
push edx
call fcn.10016690
lea eax, [esp + 0x24]
push eax
push str._sVersion.ini
lea edx, [esp + 0x234]
call fcn.10003f90
add esp, 8
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x1000dbb1
lea eax, [esp + 0xc]
push eax
push 0
push 0x1015322c
push 0x10153230
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [edi - 1]
cmp ecx, 0xf
ja case.default.0x1000dbd0
jmp dword [ecx*4 + 0x1000dd14]
push str.beta
jmp 0x1000dcd1
push 0x10153274
jmp 0x1000dcd1
push 0x10153278
jmp 0x1000dcd1
push 0x10153f90
jmp 0x1000dcd1
push 0x10153280
jmp 0x1000dcd1
push str.tech
jmp 0x1000dcd1
push str.techp
jmp 0x1000dcd1
add eax, 0xfffffffe
cmp eax, 0xf
ja case.0x1000dc29.6
jmp dword [eax*4 + 0x1000dd54]
push str.pro_trial
jmp 0x1000dcd1
push str.srv_trial
jmp 0x1000dcd1
push str.tech_trial
jmp 0x1000dcd1
push str.techp_trial
jmp 0x1000dcd1
push str.ws_trial
jmp 0x1000dcd1
push str.agent_Trial
jmp 0x1000dcd1
push str.stand_cn
jmp 0x1000dcd1
push str.pro_trial_cn
jmp 0x1000dcd1
push str.enterprise_trial_cn
jmp 0x1000dcd1
push str.agent_Trial_cn
jmp 0x1000dcd1
push str.home_Trial
jmp 0x1000dcd1
cmp eax, 0xa
mov ecx, esi
jne 0x1000dc94
push str.agent_unreg
jmp 0x1000dcd3
push str.formal
jmp 0x1000dcd3
push str.agent_pro
jmp 0x1000dcd1
push str.agent_srv
jmp 0x1000dcd1
push str.std_cn
jmp 0x1000dcd1
push str.pro_cn
jmp 0x1000dcd1
push str.srv_cn
jmp 0x1000dcd1
push str.enterprise_cn
jmp 0x1000dcd1
push str.home
jmp 0x1000dcd1
push str.unknown
mov ecx, esi
call dword [0x1014c530]
lea ecx, [esp + 8]
mov dword [esp + 0x440], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.10130e50
add esp, 0x43c
ret
Function at 0x10016500
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x101460ab
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebx
push esi
push edi
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea eax, [esp + 0x23a]
push edi
push eax
mov word [esp + 0x240], di
call sub.MSVCR80.dll_memset
push 0x206
lea ecx, [esp + 0x3e]
push edi
push ecx
mov word [esp + 0x44], di
call sub.MSVCR80.dll_memset
add esp, 0x18
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea edx, [esp + 0x234]
push edx
mov dword [esp + 0x44c], edi
call fcn.10016690
mov esi, eax
cmp esi, edi
jne 0x100165cb
push 0xab3
call fcn.1000d370
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edi
push ebx
push str.GetModuleDir_NULL__stCurDir__sizeof_stCurDir__sizeof_stCurDir_0___
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
jmp 0x10016650
lea eax, [esp + 0x234]
push eax
push str._sOther.ini
lea edx, [esp + 0x34]
call fcn.10003f90
add esp, 8
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10016638
lea ecx, [esp + 0x2c]
call fcn.10016830
mov esi, eax
cmp esi, edi
jne 0x10016638
push 0xabb
call fcn.1000d370
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push edi
push ebx
push str.CreateAndInitOtherIni_FALSE__stCfgFile_
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
jmp 0x10016650
lea ecx, [esp + 0x2c]
push ecx
push edi
push str.ExperienceValue
push str.UserExperience
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x448], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.10130e50
add esp, 0x43c
ret
Function at 0x10016830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x424
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x22a]
push ebx
push eax
mov edi, ecx
mov esi, 1
mov word [esp + 0x230], bx
call sub.MSVCR80.dll_memset
push 0x206
lea ecx, [esp + 0x2e]
push ebx
push ecx
mov word [esp + 0x34], bx
call sub.MSVCR80.dll_memset
add esp, 0x18
cmp edi, ebx
jne 0x100168ea
lea edx, [esp + 0x224]
push edx
call fcn.10016690
mov esi, eax
cmp esi, ebx
jne 0x100168cf
push 0xaee
call fcn.1000d370
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edi
push ebx
push str.GetModuleDir_NULL__stCurDir__sizeof_stCurDir__sizeof_stCurDir_0___
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
jmp 0x1001694d
lea eax, [esp + 0x224]
push eax
push str._sOther.ini
lea edx, [esp + 0x24]
call fcn.10003f90
add esp, 8
jmp 0x100168fe
push edi
lea ecx, [esp + 0x20]
push 0x104
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1001694d
xor eax, eax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov word [esp + 0x1a], ax
lea eax, [esp + 0x1c]
push eax
push 8
lea ecx, [esp + 0x14]
push ecx
push ebx
mov word [esp + 0x1c], bx
call dword [sym.imp.MSVCR80.dll__itow]
add esp, 0xc
push eax
push str.ExperienceValue
push str.UserExperience
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [esp + 0x42c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.10130e50
add esp, 0x424
ret

Function at 0x10016b70
Capabilities:
Get disk information

Disassembly:
sub esp, 0x14
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [0x10152a58]
mov ecx, dword [0x10152a5c]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 0xc], ecx
mov word [esp + 8], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 5
sete cl
mov eax, ecx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10130e50
add esp, 0x14
ret

Function at 0x10016bc0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x14
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [0x10152a58]
mov ecx, dword [0x10152a5c]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 0xc], ecx
mov word [esp + 8], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10130e50
add esp, 0x14
ret
Function at 0x10016c10
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [0x10152a58]
mov ecx, dword [0x10152a5c]
push ebx
lea edx, [esp + 4]
mov dword [esp + 4], eax
push edx
mov dword [esp + 0xc], ecx
mov word [esp + 8], si
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x10016c6a
mov ecx, esi
call fcn.10016c80
cmp eax, 7
jne 0x10016c6a
mov al, 1
movzx eax, al
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.10130e50
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
movzx eax, bl
pop ebx
xor ecx, esp
call fcn.10130e50
add esp, 0x10
ret
Function at 0x10016c80
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x24c
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x244], eax
mov eax, dword [str._:]
mov edx, dword [0x101529ac]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ecx, dword [0x101529a8]
push 0x1fa
xor edi, edi
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], eax
mov ax, word [0x101529b0]
lea ecx, [esp + 0x5a]
push edi
push ecx
xor ebp, ebp
mov dword [esp + 0x5c], edx
mov word [esp + 0x60], ax
call sub.MSVCR80.dll_memset
xor eax, eax
add esp, 0xc
cmp si, 0x41
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
jb 0x10016d1f
cmp si, 0x5a
jbe 0x10016d2c
lea edx, [esi - 0x61]
cmp dx, 0x19
ja 0x10016e03
push edi
push 0x80
push 3
push edi
push 3
push SysReAllocString
lea eax, [esp + 0x60]
push eax
mov word [esp + 0x6c], si
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10016d8a
push 0xb7f
call fcn.1000d370
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push edi
push str.hDrv_INVALID_HANDLE_VALUE
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
mov eax, ebp
jmp 0x10016e05
push edi
lea eax, [esp + 0x14]
push eax
push 0x28
lea ecx, [esp + 0x2c]
push ecx
push 0xc
lea edx, [esp + 0x28]
push edx
push 0x2d1400
push esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10016df4
push 0xb89
call fcn.1000d370
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edi
push ebx
push str.DeviceIoControl_hDrv___IOCTL_STORAGE_QUERY_PROPERTY___ProQuery__sizeof_ProQuery____DevDesc__sizeof_DevDesc____ulBytesResult___NULL_
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
jmp 0x10016e05
mov ebp, dword [esp + 0x3c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
jmp 0x10016e05
xor eax, eax
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10130e50
add esp, 0x24c
ret
Function at 0x10017500
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x10143001
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 4]
push eax
mov dword [esp + 0x4c], 0
call fcn.10003040
add esp, 4
push 0x10153118
lea ecx, [esp + 8]
call dword [0x1014c4e8]
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [esp + 0x48], 1
cmp dword [esp + 0x1c], 8
mov eax, dword [esp + 8]
jae 0x1001757a
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x10017594
lea eax, [esp + 0x24]
push eax
push 0
push str.Password
push str.BackupParam
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
mov ecx, edi
je 0x100175b4
push str.encrypt1
jmp 0x100175b9
push str.encrypt0
call dword [0x1014c530]
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 4]
mov dword [esp + 0x48], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10130e50
add esp, 0x48
ret
Function at 0x10017640
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x10143001
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 4]
push eax
mov dword [esp + 0x4c], 0
call fcn.10003040
add esp, 4
push 0x10153118
lea ecx, [esp + 8]
call dword [0x1014c4e8]
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [esp + 0x48], 1
cmp dword [esp + 0x1c], 8
mov eax, dword [esp + 8]
jae 0x100176ba
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x100176d4
lea eax, [esp + 0x24]
push eax
push 0
push str.SplitMethod
push str.BackupParam
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
mov ecx, edi
jne 0x100176f4
push str.auto_split
jmp 0x100176f9
push str.manual_split
call dword [0x1014c530]
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 4]
mov dword [esp + 0x48], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10130e50
add esp, 0x48
ret
Function at 0x10017740
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x10143001
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 4]
push eax
mov dword [esp + 0x4c], 0
call fcn.10003040
add esp, 4
push 0x10153118
lea ecx, [esp + 8]
call dword [0x1014c4e8]
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [esp + 0x48], 1
cmp dword [esp + 0x1c], 8
mov eax, dword [esp + 8]
jae 0x100177ba
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x100177d4
lea eax, [esp + 0x24]
push eax
push 1
push str.UseVSS
push str.BackupParam
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
mov ecx, esi
jne 0x100177f5
push str.vss1
jmp 0x100177fa
push str.vss0
call dword [0x1014c530]
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 4]
mov dword [esp + 0x48], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10130e50
add esp, 0x48
ret
Function at 0x10017840
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x10143001
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10177024]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [0x10177024]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 4]
push eax
mov dword [esp + 0x4c], 0
call fcn.10003040
add esp, 4
push 0x10153118
lea ecx, [esp + 8]
call dword [0x1014c4e8]
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [esp + 0x48], 1
cmp dword [esp + 0x1c], 8
mov eax, dword [esp + 8]
jae 0x100178ba
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x100178d4
lea eax, [esp + 0x24]
push eax
push 0
push str.SecBySec
push str.BackupParam
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
mov ecx, edi
jne 0x100178f5
push str.sbs1
jmp 0x100178fa
push str.sbs0
call dword [0x1014c530]
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 4]
mov dword [esp + 0x48], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10130e50
add esp, 0x48
ret