joyce8/EMBER2024-capa huggingface dataset:
Function at 0x524b77
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov dword [ebp - 0x394], ecx
mov dword [ebp - 0x310], 0
lea eax, [ebp - 0x104]
push eax
call fcn.0053534c
add esp, 4
push str.UFD_MPSetting.set
lea ecx, [ebp - 0x104]
push ecx
call fcn.0054bed0
add esp, 8
lea edx, [ebp - 0x104]
push edx
push 0x104
lea eax, [ebp - 0x30c]
push eax
push str.D:Summary
push str.FINISHREPORTFOLDER
push str.INITIAL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [0x5c5d10], 0
jne 0x524beb
xor eax, eax
jmp 0x524e4e
lea ecx, [ebp - 0x30c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x524c0c
push 0
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x5b6af4
lea eax, [ebp - 0x30c]
push eax
call fcn.0054bed0
add esp, 8
push 0x104
push 0
lea ecx, [ebp - 0x208]
push ecx
call fcn.0054bfb0
add esp, 0xc
cmp dword [0x5c5d10], 2
jne 0x524cda
push 0x5c5e18
lea edx, [ebp - 0x30c]
push edx
call fcn.0054bed0
add esp, 8
push 0x5b6af8
lea eax, [ebp - 0x30c]
push eax
call fcn.0054bed0
add esp, 8
push 0x5c5d14
lea ecx, [ebp - 0x208]
push ecx
call fcn.0054bec0
add esp, 8
push 0x5b6b00
lea edx, [ebp - 0x208]
push edx
call fcn.0054bed0
add esp, 8
push 0x5c5e18
lea eax, [ebp - 0x208]
push eax
call fcn.0054bed0
add esp, 8
cmp dword [0x5c5d0c], 0
je 0x524cc6
push str..Txt
lea ecx, [ebp - 0x208]
push ecx
call fcn.0054bed0
add esp, 8
jmp 0x524cda
push 0x5b6b0c
lea edx, [ebp - 0x208]
push edx
call fcn.0054bed0
add esp, 8
lea eax, [ebp - 0x208]
push eax
call fcn.0054c3e0
add esp, 4
test eax, eax
ja 0x524e0a
lea ecx, [ebp - 0x208]
push ecx
call fcn.0053534c
add esp, 4
cmp dword [0x5be048], 0
je 0x524de2
push 0
lea edx, [ebp - 0x390]
push edx
call fcn.00536f18
add esp, 8
test eax, eax
je 0x524db8
push str.UFD_MPTestlog_
lea eax, [ebp - 0x208]
push eax
call fcn.0054bed0
add esp, 8
lea ecx, [ebp - 0x390]
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.0054bed0
add esp, 8
push str..log
lea eax, [ebp - 0x208]
push eax
call fcn.0054bed0
add esp, 8
push 0x5c5d14
lea ecx, [ebp - 0x30c]
push ecx
call fcn.0054bed0
add esp, 8
push 0x5b6b30
lea edx, [ebp - 0x30c]
push edx
call fcn.0054bed0
add esp, 8
lea eax, [ebp - 0x390]
push eax
lea ecx, [ebp - 0x30c]
push ecx
call fcn.0054bed0
add esp, 8
push str..Log
lea edx, [ebp - 0x30c]
push edx
call fcn.0054bed0
add esp, 8
jmp 0x524de0
push str.UFD_MPTestLog.log
lea eax, [ebp - 0x208]
push eax
call fcn.0054bed0
add esp, 8
push 0x5b6b50
lea ecx, [ebp - 0x30c]
push ecx
call fcn.0054bed0
add esp, 8
jmp 0x524e0a
push str.UFD_MPTestLog.Log
lea edx, [ebp - 0x208]
push edx
call fcn.0054bed0
add esp, 8
push str.TestLog.Log
lea eax, [ebp - 0x30c]
push eax
call fcn.0054bed0
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x524e3e
push 0
lea edx, [ebp - 0x30c]
push edx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x310], 1
jmp 0x524e48
mov dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x310]
mov esp, ebp
pop ebp
ret
Function at 0x524fc4
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571e9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x118], 0
push 0x104
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.0054bfb0
add esp, 0xc
mov ecx, dword [0x5be050]
mov dword [ebp - 0x118], ecx
mov edx, dword [0x5be04c]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x52518e
mov eax, dword [ebp - 0x12c]
add eax, 0x14ff0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x525062
mov ecx, dword [ebp - 0x12c]
add ecx, 0x14ff0
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x12c]
add edx, 0x150f4
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x52515b
lea ecx, [ebp - 0x124]
call fcn.004013e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x12c]
add eax, 0x150f4
push eax
push 0x5b6bfc
lea ecx, [ebp - 0x124]
push ecx
call fcn.0055ea77
add esp, 0xc
push 0x5b6c00
lea ecx, [ebp - 0x124]
call fcn.0055e6f1
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x120]
push edx
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x124]
call fcn.0055e657
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x134], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x134]
push edx
lea ecx, [ebp - 0x124]
call fcn.00560fda
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x128]
call fcn.00560ea1
push 0
lea ecx, [ebp - 0x124]
call fcn.00401440
push eax
mov eax, dword [ebp - 0x12c]
add eax, 0x150f4
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x12c]
add ecx, 0x150f4
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.00560ea1
cmp dword [ebp - 0x118], 0
jne 0x52518e
mov edx, dword [ebp - 0x12c]
add edx, 0x151f8
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x52518e
mov eax, dword [ebp - 0x12c]
add eax, 0x151f8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x52e15e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x108], ecx
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0x15324]
mov dword [ebp - 0x104], ecx
mov edx, 1
test edx, edx
je 0x52e360
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x108]
cmp dword [ecx + eax*4 + 0x15328], 0
je 0x52e1a7
jmp 0x52e360
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + edx*4 + 0x194d0]
add ecx, 1
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x108]
mov dword [eax + edx*4 + 0x194d0], ecx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + ecx*4 + 0x194d0]
sub eax, 1
cdq
mov ecx, 0x3c
idiv ecx
push edx
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + edx*4 + 0x194d0]
sub eax, 1
cdq
mov ecx, 0x3c
idiv ecx
cdq
mov ecx, 0x3c
idiv ecx
push edx
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + edx*4 + 0x194d0]
sub eax, 1
cdq
mov ecx, 0xe10
idiv ecx
push eax
push str._.2d:_.2d:_.2d
lea edx, [ebp - 0x100]
push edx
call fcn.0054c45b
add esp, 0x14
lea eax, [ebp - 0x100]
push eax
mov ecx, dword [ebp - 0x104]
imul ecx, ecx, 0x3c
mov edx, dword [ebp - 0x108]
lea ecx, [edx + ecx + 0x126c]
call fcn.0056432f
mov eax, dword [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x108]
call fcn.0052191b
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + ecx*4 + 0x194d0]
cmp eax, dword [0x5be9c0]
jle 0x52e350
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + ecx*4 + 0x13070]
mov dword [eax + 0x1e8], 1
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + ecx*4 + 0x13070]
push eax
call fcn.004f9a17
add esp, 4
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x108]
mov dword [edx + ecx*4 + 0x10f70], 0x30
push 0x5b779c
mov eax, dword [ebp - 0x104]
imul eax, eax, 0x3c
mov ecx, dword [ebp - 0x108]
lea ecx, [ecx + eax + 0xaec]
call fcn.0056432f
push str.Time_Out__
mov edx, dword [ebp - 0x104]
push edx
mov ecx, dword [ebp - 0x108]
call fcn.00521b20
push str.DoCheckHandlerTestResult__:TIMEOUT_FAIL
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x108]
mov dword [ecx + eax*4 + 0x19604], 0x30
mov ecx, dword [ebp - 0x108]
call fcn.00520570
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x52e17f
mov esp, ebp
pop ebp
ret
Function at 0x5320d7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x108], 1
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x1284], ecx
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x190]
mov ecx, dword [eax + 0x1284]
push ecx
call fcn.004016bb
add esp, 8
cmp dword [ebp + 8], 1
jne 0x53214b
mov ecx, dword [ebp - 0x190]
add ecx, 0x1064
call fcn.00406af0
test eax, eax
jne 0x532149
push 1
mov ecx, dword [ebp - 0x190]
add ecx, 0x1064
call fcn.00406b20
jmp 0x53218e
cmp dword [ebp + 8], 2
jne 0x53217b
mov ecx, dword [ebp - 0x190]
add ecx, 0x10a0
call fcn.00406af0
test eax, eax
jne 0x532179
push 1
mov ecx, dword [ebp - 0x190]
add ecx, 0x10a0
call fcn.00406b20
jmp 0x53218e
push 1
mov ecx, dword [ebp - 0x190]
add ecx, 0x1028
call fcn.00406b20
push 0x5b7f78
lea edx, [ebp - 0x18c]
push edx
call fcn.0054c45b
add esp, 8
mov eax, dword [ebp - 0x190]
mov ecx, dword [eax + 0x1284]
push ecx
mov edx, dword [ebp - 0x190]
push edx
push 0xa
push 0x5b7d40
lea eax, [ebp - 0x18c]
push eax
call fcn.0040171c
add esp, 0x14
mov dword [ebp - 0x10c], 0
jmp 0x5321e7
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0xb
jae 0x532232
lea edx, [ebp - 0x104]
push edx
push 0x20
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax*8 + 0x5b7ce8]
shl ecx, 5
add ecx, 0x5cf1b0
push ecx
push 0x5dcd1c
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx*8 + 0x5b7cec]
push eax
lea ecx, [ebp - 0x18c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x5321d8
mov edx, dword [ebp - 0x190]
add edx, 0x8e0c
push edx
mov ecx, dword [ebp - 0x190]
add ecx, 0x19c
call fcn.00414346
push 0x2c
mov eax, dword [ebp - 0x190]
mov ecx, dword [eax + 0x1f0]
push ecx
mov edx, dword [ebp - 0x190]
add edx, 0x8e0c
push edx
call fcn.0054c980
add esp, 0xc
push 2
mov ecx, dword [ebp - 0x190]
call fcn.005323a9
push 1
mov ecx, dword [ebp - 0x190]
call fcn.004089e0
mov eax, dword [ebp - 0x108]
mov esp, ebp
pop ebp
ret 4
Function at 0x53271b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572118
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
mov dword [ebp - 0x23c], ecx
mov eax, dword [ebp + 8]
sub eax, 0x2bb
mov ecx, dword [ebp - 0x23c]
mov dword [ecx + 0x1280], eax
lea ecx, [ebp - 0x224]
call fcn.00438b80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00426870
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax + 0x1284]
push ecx
call fcn.004016bb
add esp, 8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x238]
call fcn.00438b60
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], edx
push 0x81
lea ecx, [ebp - 0x224]
call fcn.00438ce0
push 0x5dcd24
push 0
push 0x400
push 0
lea ecx, [ebp - 0x224]
call fcn.00438cb0
push 0
lea ecx, [ebp - 0x224]
call fcn.00438c80
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x114], 0
jmp 0x532807
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x21c]
call fcn.00438c40
cmp dword [ebp - 0x114], eax
jge 0x5328a0
mov ecx, dword [ebp - 0x114]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.00438c60
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
je 0x53289b
cmp dword [ebp - 0x114], 3
jae 0x53289b
lea edx, [ebp - 0x218]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
push 0x5dcd28
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx*8 + 0x5b7d94]
push edx
push str.SMIMPToolDlg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
push 0
mov edx, dword [ebp - 0x230]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.00438cb0
jmp 0x5327f8
push 0
lea ecx, [ebp - 0x224]
call fcn.00438c80
mov dword [ebp - 0x10], eax
push 0
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
push 0
mov ecx, dword [ebp - 0x10]
call fcn.005624a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00438be0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x532f49
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 4], 0xff
cmp dword [ebp + 8], 0xffffffff
je 0x532fb1
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push 0xc
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0x2d1080
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x532f90
mov al, byte [ebp - 0x14]
mov byte [ebp - 4], al
jmp 0x532fb1
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x535290
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov dword [ebp - 4], 0
push 0x80
push 0
lea eax, [ebp - 0x188]
push eax
call fcn.0054bfb0
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [ebp - 0x108]
push edx
call fcn.0054c3e0
add esp, 4
mov dword [ebp - 8], eax
jmp 0x5352e5
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x535308
mov ecx, dword [ebp - 8]
movsx edx, byte [ebp + ecx - 0x108]
cmp edx, 0x5c
jne 0x535306
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x535308
jmp 0x5352dc
lea ecx, [ebp - 0x108]
push ecx
call fcn.0054c3e0
add esp, 4
sub eax, dword [ebp - 4]
push eax
mov edx, dword [ebp - 4]
lea eax, [ebp + edx - 0x108]
push eax
lea ecx, [ebp - 0x188]
push ecx
call fcn.0054c980
add esp, 0xc
lea edx, [ebp - 0x188]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0054bec0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x53543c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0x28000000
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x535484
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x535494
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5355b9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x10c]
push eax
call fcn.0053534c
add esp, 4
push 0x5b87fc
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0054bed0
add esp, 8
push 0x20
push 0
lea edx, [ebp - 0x12c]
push edx
call fcn.0054bfb0
add esp, 0xc
mov dword [ebp - 0x130], 0
jmp 0x535613
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 4
jge 0x535650
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x130]
xor edx, edx
mov dl, byte [ecx]
push edx
push 0x5b8810
lea eax, [ebp - 8]
push eax
call fcn.0054c45b
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x12c]
push edx
call fcn.0054bed0
add esp, 8
jmp 0x535604
lea eax, [ebp - 0x10c]
push eax
push 0
lea ecx, [ebp - 0x12c]
push ecx
push str.SIZE4BYTES
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x535685
mov eax, dword [ebp - 0x144]
jmp 0x5358a3
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx + 1]
push eax
push 0x5b8824
lea ecx, [ebp - 0x140]
push ecx
call fcn.0054c45b
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x140]
push eax
push 0x5b882c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x5356d7
mov eax, dword [ebp - 0x144]
jmp 0x5358a3
mov ecx, dword [ebp + 8]
xor edx, edx
mov dl, byte [ecx + 1]
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x148]
sub eax, 1
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xf0
ja case.0x535712.20
mov edx, dword [ebp - 0x148]
xor ecx, ecx
mov cl, byte [edx + 0x5358fb]
jmp dword [ecx*4 + 0x5358a7]
mov dword [ebp - 0x144], 8
jmp 0x53589d
mov dword [ebp - 0x144], 0x10
jmp 0x53589d
mov dword [ebp - 0x144], 0x20
jmp 0x53589d
mov dword [ebp - 0x144], 0x40
jmp 0x53589d
mov dword [ebp - 0x144], 0x80
jmp 0x53589d
mov dword [ebp - 0x144], 0x80
jmp 0x53589d
mov dword [ebp - 0x144], pe_nt_image_headers32
jmp 0x53589d
mov dword [ebp - 0x144], 0x200
jmp 0x53589d
mov dword [ebp - 0x144], 0x80
jmp 0x53589d
mov dword [ebp - 0x144], 0x400
jmp 0x53589d
mov dword [ebp - 0x144], 0x800
jmp 0x53589d
mov dword [ebp - 0x144], 0x1000
jmp 0x53589d
mov dword [ebp - 0x144], 0x2000
jmp 0x53589d
mov dword [ebp - 0x144], pe_nt_image_headers32
jmp 0x53589d
mov dword [ebp - 0x144], 0x200
jmp 0x53589d
mov dword [ebp - 0x144], 0x200
jmp 0x53589d
mov dword [ebp - 0x144], 0x800
jmp 0x53589d
mov dword [ebp - 0x144], 0x1000
jmp 0x53589d
mov dword [ebp - 0x144], 0x2000
jmp 0x53589d
mov dword [ebp - 0x144], 0x2000
jmp 0x53589d
lea eax, [ebp - 0x10c]
push eax
call fcn.0053534c
add esp, 4
push str.UFD_MPDBSIZE.INI
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0054bed0
add esp, 8
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx + 1]
push eax
push str._.2X
lea ecx, [ebp - 0x140]
push ecx
call fcn.0054c45b
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x140]
push eax
push str.SIZE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
mov esp, ebp
pop ebp
ret
Function at 0x535b1d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
lea eax, [ebp - 0x124]
push eax
call fcn.0053534c
add esp, 4
push str.Capacity.ini
lea ecx, [ebp - 0x124]
push ecx
call fcn.0054bed0
add esp, 8
mov edx, dword [ebp + 8]
push edx
push str.CAPA__dM
lea eax, [ebp - 0x20]
push eax
call fcn.0054c45b
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x130], ecx
cmp dword [ebp - 0x130], 0x1000
jg 0x535c0e
cmp dword [ebp - 0x130], 0x1000
je 0x535cd2
cmp dword [ebp - 0x130], 0x200
jg 0x535be9
cmp dword [ebp - 0x130], 0x200
je 0x535cae
cmp dword [ebp - 0x130], 0x40
je 0x535c84
cmp dword [ebp - 0x130], 0x80
je 0x535c93
cmp dword [ebp - 0x130], 0x100
je 0x535ca2
jmp 0x535d24
cmp dword [ebp - 0x130], 0x400
je 0x535cba
cmp dword [ebp - 0x130], 0x800
je 0x535cc6
jmp 0x535d24
cmp dword [ebp - 0x130], 0x10000
jg 0x535c5f
cmp dword [ebp - 0x130], 0x10000
je 0x535d02
cmp dword [ebp - 0x130], 0x2000
je 0x535cde
cmp dword [ebp - 0x130], 0x4000
je 0x535cea
cmp dword [ebp - 0x130], 0x8000
je 0x535cf6
jmp 0x535d24
cmp dword [ebp - 0x130], 0x20000
je 0x535d0e
cmp dword [ebp - 0x130], 0x40000
je 0x535d1a
jmp 0x535d24
mov dword [ebp - 0x128], 0x33
jmp 0x535d24
mov dword [ebp - 0x128], 0x70
jmp 0x535d24
mov dword [ebp - 0x128], 0xea
jmp 0x535d24
mov dword [ebp - 0x128], 0x1d8
jmp 0x535d24
mov dword [ebp - 0x128], 0x3ba
jmp 0x535d24
mov dword [ebp - 0x128], 0x774
jmp 0x535d24
mov dword [ebp - 0x128], 0xee7
jmp 0x535d24
mov dword [ebp - 0x128], 0x1dce
jmp 0x535d24
mov dword [ebp - 0x128], 0x3b9b
jmp 0x535d24
mov dword [ebp - 0x128], 0x7736
jmp 0x535d24
mov dword [ebp - 0x128], 0xef10
jmp 0x535d24
mov dword [ebp - 0x128], 0x1de20
jmp 0x535d24
mov dword [ebp - 0x128], 0x3bc40
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x128]
push eax
lea ecx, [ebp - 0x20]
push ecx
push str.CAPACITY
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov esp, ebp
pop ebp
ret
Function at 0x536f18
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 4], 0x80
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp dword [ebp + 0xc], 0
je 0x536f52
lea edx, [ebp - 0x8c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054bec0
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 8], 2
mov edx, dword [ebp - 4]
add edx, 1
push edx
call fcn.0054cea3
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x536f82
or eax, 0xffffffff
jmp 0x5370e3
mov eax, dword [ebp - 4]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0054bfb0
add esp, 0xc
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x8c]
push eax
call fcn.0054c3e0
add esp, 4
mov dword [ebp - 0x90], eax
jmp 0x536fc6
mov ecx, dword [ebp - 0x90]
sub ecx, 1
mov dword [ebp - 0x90], ecx
cmp dword [ebp - 0x90], 0
jl 0x537084
mov edx, dword [ebp - 0x90]
movsx eax, byte [ebp + edx - 0x8c]
cmp eax, 0x30
jl 0x537072
mov ecx, dword [ebp - 0x90]
movsx edx, byte [ebp + ecx - 0x8c]
cmp edx, 0x39
jg 0x537072
cmp dword [ebp - 0x94], 0
jle 0x537072
cmp dword [ebp - 8], 0
jle 0x537072
mov eax, dword [ebp - 0xc]
push eax
call fcn.0054c3e0
add esp, 4
mov dword [ebp - 0x98], eax
jmp 0x53702f
mov ecx, dword [ebp - 0x98]
sub ecx, 1
mov dword [ebp - 0x98], ecx
cmp dword [ebp - 0x98], 0
jl 0x537051
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x98]
mov cl, byte [eax]
mov byte [edx + 1], cl
jmp 0x537020
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x90]
mov cl, byte [ebp + eax - 0x8c]
mov byte [edx], cl
cmp dword [ebp - 8], 2
jne 0x537070
mov dword [ebp - 8], 1
jmp 0x53707f
cmp dword [ebp - 8], 1
jne 0x53707f
mov dword [ebp - 8], 0
jmp 0x536fb7
cmp dword [ebp - 8], 2
je 0x53709b
mov edx, dword [ebp - 0xc]
push edx
call fcn.0054c538
add esp, 4
mov dword [ebp - 8], eax
jmp 0x5370a2
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 0xc]
push eax
call fcn.0054c543
add esp, 4
cmp dword [ebp - 8], 0
jl 0x5370d0
mov ecx, dword [ebp - 8]
push ecx
push 0x5b88e4
mov edx, dword [ebp + 8]
push edx
call fcn.0054c45b
add esp, 0xc
mov eax, 1
jmp 0x5370e3
push 0x5dd114
mov eax, dword [ebp + 8]
push eax
call fcn.0054bec0
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret