joyce8/EMBER2024-capa huggingface dataset:
Function at 0x247d681
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x4011e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401168
mov esi, 0x247b6d0
push 3
lea eax, [ebp - 0x30]
xor edi, edi
push esi
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x84], edi
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xe0], edi
mov dword [ebp - 0xe4], edi
mov dword [ebp - 0xe8], edi
mov dword [ebp - 0xec], edi
mov dword [ebp - 0xf0], edi
call sub.MSVBVM60.DLL___vbaAryConstruct2
push 3
lea eax, [ebp - 0x58]
push esi
push eax
call sub.MSVBVM60.DLL___vbaAryConstruct2
push 0x11
lea eax, [ebp - 0x7c]
push 0x247b6ec
push eax
call sub.MSVBVM60.DLL___vbaAryConstruct2
push 3
lea eax, [ebp - 0x9c]
push esi
push eax
call sub.MSVBVM60.DLL___vbaAryConstruct2
mov esi, dword [ebp + 8]
push edi
push 0xffffffffffffffff
push 1
push edi
push 0x247b6c0
push dword [esi]
call sub.MSVBVM60.DLL_rtcReplace
mov edx, eax
mov ecx, esi
call sub.MSVBVM60.DLL___vbaStrMove
push edi
push 0xffffffffffffffff
push 1
push edi
push 0x247b6c8
push dword [esi]
call sub.MSVBVM60.DLL_rtcReplace
mov edx, eax
mov ecx, esi
call sub.MSVBVM60.DLL___vbaStrMove
push dword [esi]
call sub.MSVBVM60.DLL___vbaLenBstr
push 4
cdq
pop ecx
idiv ecx
cmp edx, edi
jne 0x247dcf4
push 0x3d
call sub.MSVBVM60.DLL_rtcBstrFromAnsi
mov edx, eax
lea ecx, [ebp - 0xb8]
call sub.MSVBVM60.DLL___vbaStrMove
push 0x3d
call sub.MSVBVM60.DLL_rtcBstrFromAnsi
mov edx, eax
lea ecx, [ebp - 0xbc]
call sub.MSVBVM60.DLL___vbaStrMove
mov edx, dword [ebp - 0xb8]
mov ebx, dword [ebp - 0xbc]
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xbc], edi
call sub.MSVBVM60.DLL___vbaStrMove
push eax
mov edx, ebx
lea ecx, [ebp - 0xb0]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0xb4]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push dword [esi]
call sub.MSVBVM60.DLL_rtcInStrRev
mov ebx, eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb0]
neg ebx
push eax
lea eax, [ebp - 0xac]
sbb ebx, ebx
push eax
neg ebx
push 5
neg ebx
call sub.MSVBVM60.DLL___vbaFreeStrList
add esp, 0x18
cmp bx, di
je 0x247d855
mov dword [ebp - 0x64], 2
jmp 0x247d8b9
push 0x3d
call sub.MSVBVM60.DLL_rtcBstrFromAnsi
mov edx, eax
lea ecx, [ebp - 0xb0]
call sub.MSVBVM60.DLL___vbaStrMove
mov edx, dword [ebp - 0xb0]
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xb0], edi
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push dword [esi]
call sub.MSVBVM60.DLL_rtcInStrRev
mov ebx, eax
lea eax, [ebp - 0xb0]
neg ebx
push eax
lea eax, [ebp - 0xac]
sbb ebx, ebx
push eax
neg ebx
push 2
neg ebx
call sub.MSVBVM60.DLL___vbaFreeStrList
add esp, 0xc
or al, 0x66
cmp ebx, edi
Function at 0x100013f3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, ecx
mov dword [esi], eax
test edx, edx
je 0x1000141f
mov eax, dword [ebp + 8]
lea ecx, [esi + 8]
push ecx
push 0x40
push edx
push eax
mov dword [esi + 4], edx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
mov byte [esi + 0xc], al
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x10001c15
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
je 0x10001c6b
push ebx
push edi
push 0x1006d374
push dword [esi + 8]
call fcn.10044ad4
mov ebx, eax
xor eax, eax
push eax
push eax
push ebx
call fcn.10045505
push ebx
push dword [esi]
xor edi, edi
inc edi
push edi
push dword [ebp + 8]
call fcn.1004e1d0
xor ecx, ecx
add esp, 0x24
cmp ecx, dword [esi + 4]
ja 0x10001c5c
jb 0x10001c5e
cmp eax, dword [esi]
jbe 0x10001c5e
mov edi, ecx
push ebx
call fcn.10044f79
pop ecx
mov eax, edi
pop edi
pop ebx
jmp 0x10001c6d
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x10003e74
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x10002b39
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000562e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
mov edx, dword [ebp + 8]
push edi
mov edi, ecx
not edx
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10073e68]
inc edi
sub esi, 1
jne 0x1000563c
pop edi
not edx
pop esi
mov eax, edx
pop ebp
ret

Function at 0x1000565c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov edx, ebx
test edi, edi
je 0x100056c0
mov al, byte [esi]
dec edi
inc esi
cmp al, 0x23
jne 0x10005688
cmp edi, 2
jb 0x10005688
cmp byte [esi], al
jne 0x10005688
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10073e68]
test edi, edi
jne 0x10005671
jmp 0x100056c7
cmp al, 0x23
jne 0x100056ae
cmp byte [esi], al
jne 0x100056ae
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10073e68]
mov al, byte [esi]
inc esi
test al, al
jne 0x100056a0
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x1000582c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x1000584f
push 0x8d1
push str.E:Visual_Studio_ProjectsMGRRMGRModLoaderMGRModLoaderimguiimgui.cpp
push str.filename__mode
call fcn.1004e9c4
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10005859
and dword [edi], 0
mov edx, 0x1006d374
mov ecx, esi
call fcn.100056d0
mov esi, eax
test esi, esi
je 0x100058c1
mov ecx, esi
call fcn.100057d3
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100058ba
mov ecx, ebx
call fcn.10009090
mov dword [ebp + 8], eax
test eax, eax
je 0x100058ba
push esi
push ebx
push 1
push eax
call fcn.1004e1d0
add esp, 0x10
push esi
cmp eax, ebx
je 0x100058a9
call fcn.10044f79
pop ecx
mov ecx, dword [ebp + 8]
call fcn.100090c2
jmp 0x100058c1
call fcn.10044f79
pop ecx
test edi, edi
je 0x100058b5
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x100058c3
push esi
call fcn.10044f79
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1002251d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10022537
mov dword [esi + 4], edi
mov dword [esi], edi
call fcn.100090c2
mov dword [esi + 8], edi
lea ecx, [esi + 0xc]
call fcn.10004250
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10022554
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
call fcn.100090c2
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x10022575
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], edi
call fcn.100090c2
mov dword [esi + 0x78], edi
mov ecx, dword [esi + 0x84]
test ecx, ecx
je 0x10022593
mov dword [esi + 0x80], edi
mov dword [esi + 0x7c], edi
call fcn.100090c2
mov dword [esi + 0x84], edi
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x100225a8
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
call fcn.100090c2
mov dword [esi + 0x40], edi
pop edi
lea ecx, [esi + 0x5c]
pop esi
jmp fcn.100249a9
Function at 0x100299d3
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push esi
call fcn.100299be
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x100299fe
and dword [esi], eax
pop esi
ret
Function at 0x1003e630
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x10087b2c]
push esi
xor esi, esi
jmp 0x1003e642
cmp dword [edx + 4], esi
jne 0x1003e68e
mov edx, dword [edx]
test edx, edx
jne 0x1003e63b
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x1003e69b
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x1003e669
mov eax, dword [0x10087b2c]
pop edi
mov dword [edx], eax
mov dword [0x10087b2c], edx
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret
xor eax, eax
pop esi
ret

Function at 0x1003eef5
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10083040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003efd5
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1003efce
push ebx
cmp dword [ebp - 0x20], 0x10
jb 0x1003efb3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1003efb3
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1003efb3
mov edx, dword [esi]
test edx, edx
jne 0x1003ef81
push 0x200
push edx
push dword [0x10087354]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1003efcd
lea ebx, [esi + 8]
jmp 0x1003efa9
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x1003efa9
shl eax, 3
push eax
push edx
push 0
push dword [0x10087354]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1003efcd
shl dword [esi + 4], 1
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1003ef39
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10040b6d
leave
ret
Function at 0x1003efe3
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1003eef5
cmp dword [esi], ebx
je 0x1003f043
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x1003f042
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1003f039
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.1003eda1
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x1003f009
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003f047
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1003f093
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1003f082
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1003f07b
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1003f058
pop ebx
push dword [esi]
push 0
push dword [0x10087354]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret

Function at 0x1003f095
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10083040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x10087b20]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1003f0df
push 0xa
pop eax
jmp 0x1003f11e
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1003f0fa
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10040b6d
leave
ret
Function at 0x1003f9ac
Capabilities:
Enumerate files on windows

Disassembly:
push 0x250
mov eax, 0x100665a9
call fcn.100623e7
mov esi, ecx
push str._Mod_Loader___INFO___Reading_profiles...
call fcn.10001e8e
push esi
lea eax, [ebp - 0x114]
xor ebx, ebx
push str._s
push eax
call fcn.10001371
add esp, 0x10
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1003fa0a
mov byte [0x100876cf], 1
mov eax, str._Mod_Loader___ERROR__Reading_failed_
jmp 0x1003fb37
test byte [ebp - 0x254], 0x10
je 0x1003fb15
cmp byte [ebp - 0x228], 0x2e
je 0x1003fb15
cmp byte [ebp - 0x227], 0x2e
je 0x1003fb15
lea ecx, [ebp - 0x228]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003fa3a
sub ecx, edx
cmp ecx, 0x40
jae 0x1003fb02
push 0x38
call fcn.10040c35
mov esi, eax
pop ecx
mov dword [ebp - 0x25c], esi
xor eax, eax
mov ecx, esi
mov dword [ebp - 4], eax
mov dword [esi], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x228]
push eax
call fcn.10001a34
xor eax, eax
mov ecx, 0x10085108
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
or dword [esi + 8], 0xffffffff
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
lea eax, [ebp - 0x258]
push eax
mov word [esi + 0xc], 1
mov dword [ebp - 0x258], esi
call fcn.10003985
cmp dword [esi], 0
mov eax, 0x1006d324
mov ecx, esi
cmovne eax, dword [esi]
push eax
call fcn.1004023e
mov edx, dword [esi + 8]
cmp edx, 0xffffffff
jne 0x1003fad3
mov dword [esi + 8], ebx
mov edx, ebx
inc ebx
mov eax, str.Disabled
cmp byte [esi + 0xc], 0
mov ecx, str.Enabled
push edx
cmove ecx, eax
cmp dword [esi], 0
mov eax, 0x1006d324
cmovne eax, dword [esi]
push ecx
push eax
push str._Mod_Loader___INFO___Loading__s__s___d_
call fcn.10001e8e
add esp, 0x10
jmp 0x1003fb15
lea eax, [ebp - 0x228]
push eax
push str._Mod_Loader___INFO___Profile_name_exceeds_64_characters__simplify_the_name_for__s_
call fcn.10001e8e
pop ecx
pop ecx
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1003fa0a
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, str._Mod_Loader___INFO___Profiles_reading_done_
push eax
call fcn.10001e8e
pop ecx
call fcn.100623a5
ret
Function at 0x1003fb44
Capabilities:
Get common file path

Disassembly:
push 0x144
mov eax, 0x100665e3
call fcn.100623e7
cmp byte [0x100876cc], 0
jne 0x1003fc24
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str._Mod_Loader___INFO___Loading_scripts...
call fcn.10001e8e
mov ebx, dword [0x1008510c]
mov eax, dword [0x10085110]
pop ecx
xor ecx, ecx
mov dword [ebp - 0x118], ecx
lea eax, [ebx + eax*4]
mov dword [ebp - 0x11c], eax
cmp ebx, eax
je 0x1003fc17
mov edx, dword [ebx]
cmp byte [edx + 0xc], 0
je 0x1003fc0a
lea eax, [ebp - 0x118]
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x128], eax
lea esi, [ebp - 0x128]
lea eax, [ebp - 0x114]
mov dword [ebp - method.std::_Func_impl_no_alloc_class__void___cdecl_openScripts_void_::_8::_lambda_1___void__struct_ModLoader::ModProfile::File__.virtual_0], vtable.std::_Func_impl_no_alloc_class__void___cdecl_openScripts_void_::_8::_lambda_1___void__struct_ModLoader::ModProfile::File__.0
mov dword [ebp - 0x120], eax
lea edi, [ebp - 0x14c]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x150]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 4], ecx
mov ecx, edx
push eax
call fcn.10001dcf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10003840
mov eax, dword [ebp - 0x11c]
xor ecx, ecx
add ebx, 4
cmp ebx, eax
jne 0x1003fb9d
mov ecx, dword [ebp - 0x118]
push ecx
push str._Mod_Loader___INFO____d_scripts_loaded_
call fcn.10001e8e
pop ecx
pop ecx
call fcn.100623a5
ret

Function at 0x1003fc2a
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x5c
mov edi, ecx
push dword [esi + 8]
call fcn.10042150
pop ecx
pop ecx
cmp byte [eax + 1], 0x2e
je 0x1003fcfa
push 0x5c
push dword [esi + 8]
call fcn.10042150
pop ecx
pop ecx
cmp byte [eax + 2], 0x2e
je 0x1003fcfa
mov edx, dword [esi + 8]
mov ecx, edx
push ebx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003fc69
sub ecx, ebx
add edx, 0xfffffffc
add ecx, edx
call fcn.1003f65b
mov ebx, str..asi
xor edx, edx
movzx ecx, byte [eax + edx]
cmp cl, byte [ebx + edx]
jne 0x1003fcf9
inc edx
cmp edx, 5
jne 0x1003fc83
cmp byte [esi + 0xc], 0
jne 0x1003fcf9
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1003fcd6
push str.InitializeASI
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1003fcb7
call eax
push 0x5c
push dword [esi + 8]
call fcn.10042150
inc eax
push eax
push str._Mod_Loader___INFO___Loading__s_plugin...
call fcn.10001e8e
mov eax, dword [edi]
add esp, 0x10
inc dword [eax]
jmp 0x1003fcf0
mov eax, dword [edi + 4]
push dword [esi + 8]
mov eax, dword [eax]
push dword [eax + 4]
push dword [eax]
push str._Mod_Loader___ERROR___s____Failed_to_load__s_
call fcn.10001e8e
add esp, 0x10
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x1003fd00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x10083040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
push str._s
push eax
mov dword [ebp - 0x360], esi
call fcn.10001371
add esp, 0xc
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
or ecx, 0xffffffff
mov dword [ebp - 0x35c], eax
cmp eax, ecx
jne 0x1003fd6b
push esi
push str._Mod_Loader___ERROR__Cannot_read_files_for__s
call fcn.10001e8e
pop ecx
pop ecx
jmp 0x1003febd
test byte [ebp - 0x358], 0x10
jne 0x1003fe56
cmp byte [ebp - 0x32c], 0x2e
je 0x1003fe9a
cmp byte [ebp - 0x32b], 0x2e
je 0x1003fe9a
push 0x10
call fcn.10040c35
mov esi, eax
xor eax, eax
pop ecx
mov dword [ebp - 0x364], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov byte [esi + 0xc], al
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x360]
lea eax, [ebp - 0x110]
push str._s_s
push eax
call fcn.10001371
mov ecx, dword [ebp - 0x33c]
add esp, 0x10
mov eax, dword [ebp - 0x338]
and dword [esi + 8], 0
mov dword [esi + 4], ecx
lea ecx, [ebp - 0x110]
mov dword [esi], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003fdee
sub ecx, edx
push 0xffffffffffffffff
add ecx, 1
pop eax
cmovb ecx, eax
push ecx
call fcn.100514b2
pop ecx
mov ecx, eax
mov dword [esi + 8], ecx
test ecx, ecx
je 0x1003fe20
lea edx, [ebp - 0x110]
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
test al, al
jne 0x1003fe16
mov ecx, dword [esi + 8]
call fcn.10001ae9
mov al, byte [ebp + 0xc]
mov byte [esi + 0xc], al
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003fe43
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 8]
jae 0x1003fe43
mov dword [ecx + eax*4], esi
inc dword [edi + 0xc]
mov eax, dword [esi]
add dword [ebx + 0x28], eax
mov eax, dword [esi + 4]
adc dword [ebx + 0x2c], eax
mov esi, dword [ebp - 0x360]
jmp 0x1003fe94
cmp byte [ebp - 0x32c], 0x2e
je 0x1003fe9a
cmp byte [ebp - 0x32b], 0x2e
je 0x1003fe9a
lea eax, [ebp - 0x32c]
push eax
push esi
lea eax, [ebp - 0x110]
push str._s_s
push eax
call fcn.10001371
push 1
push ebx
mov edx, edi
lea ecx, [ebp - 0x110]
call fcn.1003fd00
add esp, 0x18
mov eax, dword [ebp - 0x35c]
lea ecx, [ebp - 0x358]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
mov eax, dword [ebp - 0x35c]
jne 0x1003fd6b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10040b6d
leave
ret
Function at 0x1004023e
Capabilities:
Read .ini file

Disassembly:
push 0x18
mov eax, 0x100666e6
call fcn.100623e7
mov ebx, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
xor esi, esi
mov dword [ebp - 0x14], esi
call fcn.100401f1
push str.profiles.ini
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
push ecx
mov ecx, eax
call fcn.1003f5b8
mov ecx, 0x1006d324
cmp dword [eax], esi
cmovne ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.1003f3ac
push dword [ebp - 0x1c]
call fcn.10040b7b
push dword [ebp - 0x24]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call fcn.10040b7b
pop ecx
pop ecx
push 1
push str.Enabled
push edi
lea ecx, [ebp - 0x14]
call fcn.1003f4fb
mov esi, dword [ebp - 0x14]
push esi
push 0xffffffffffffffff
push 0x1006da38
push edi
mov byte [ebx + 0xc], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebx + 8], eax
test esi, esi
je 0x100402cd
push esi
call fcn.1004abde
pop ecx
call fcn.100623a5
ret 4