joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411812
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419364]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b9d2
and dword [ebp - 0x14], 0
cmp dword [0x430088], 0
mov dword [ebp - 0x18], eax
jne 0x4118c5
push 0x403e58
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41196d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e4c
push ebx
call edi
test eax, eax
je 0x41196d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e3c
push ebx
mov dword [0x430088], eax
call edi
push eax
call esi
push 0x403e28
push ebx
mov dword [0x43008c], eax
call edi
push eax
call esi
push 0x403e0c
push ebx
mov dword [0x430090], eax
call edi
push eax
call esi
mov dword [0x430098], eax
test eax, eax
je 0x4118c5
push 0x403df4
push ebx
call edi
push eax
call esi
mov dword [0x430094], eax
mov eax, dword [0x430094]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41191e
cmp dword [0x430098], ecx
je 0x41191e
push eax
call esi
push dword [0x430098]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41191e
test ebx, ebx
je 0x41191e
call edi
test eax, eax
je 0x411915
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411915
test byte [ebp - 8], 1
jne 0x41191e
or dword [ebp + 0x10], 0x200000
jmp 0x411951
mov eax, dword [0x43008c]
cmp eax, dword [ebp - 0x18]
je 0x411951
push eax
call esi
test eax, eax
je 0x411951
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411951
mov eax, dword [0x430090]
cmp eax, dword [ebp - 0x18]
je 0x411951
push eax
call esi
test eax, eax
je 0x411951
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x430088]
call esi
test eax, eax
je 0x41196d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41196f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004092fb
leave
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x70d71205
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x30e152b2
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x406830
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41dbdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4045bc
call fcn.004093a4
push 4
mov dword [esp + 0x18], 0
call fcn.0040aa46
mov edi, eax
add esp, 4
test edi, edi
je 0x4068a4
push ebx
call fcn.0040919f
mov dword [edi], eax
call fcn.00408f5e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409365
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406898
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040938d
pop ebx
jmp 0x4068a6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b53e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4213dc]
jne 0x40b548
repz ret
jmp fcn.004114dc
Function at 0x416bd3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4213dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f9be
and dword [ebp - 0x14], 0
cmp dword [0x438ad4], 0
mov dword [ebp - 0x18], eax
jne 0x416c86
push 0x403ff0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416d2e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fe4
push ebx
call edi
test eax, eax
je 0x416d2e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fd4
push ebx
mov dword [0x438ad4], eax
call edi
push eax
call esi
push 0x403fc0
push ebx
mov dword [0x438ad8], eax
call edi
push eax
call esi
push 0x403fa4
push ebx
mov dword [0x438adc], eax
call edi
push eax
call esi
mov dword [0x438ae4], eax
test eax, eax
je 0x416c86
push 0x403f8c
push ebx
call edi
push eax
call esi
mov dword [0x438ae0], eax
mov eax, dword [0x438ae0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416cdf
cmp dword [0x438ae4], ecx
je 0x416cdf
push eax
call esi
push dword [0x438ae4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416cdf
test ebx, ebx
je 0x416cdf
call edi
test eax, eax
je 0x416cd6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x416cd6
test byte [ebp - 8], 1
jne 0x416cdf
or dword [ebp + 0x10], 0x200000
jmp 0x416d12
mov eax, dword [0x438ad8]
cmp eax, dword [ebp - 0x18]
je 0x416d12
push eax
call esi
test eax, eax
je 0x416d12
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416d12
mov eax, dword [0x438adc]
cmp eax, dword [ebp - 0x18]
je 0x416d12
push eax
call esi
test eax, eax
je 0x416d12
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x438ad4]
call esi
test eax, eax
je 0x416d2e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416d30
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b53e
leave
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x6b641fb6
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x6df04166
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100031d6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esp + 0x28]
call fcn.1001a9a6
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1000333e
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push esi
mov ebx, eax
call sym.glib_lite.dll_Ordinal_105
pop ecx
cmp ebx, 0xffffffff
je 0x1000333e
mov ecx, dword [esp + 0x1c]
test cl, 0x10
jne 0x1000332b
test cl, 1
je 0x1000322c
test bl, 0x50
je 0x1000332b
test cl, 4
je 0x1000323a
test bl, 0x10
jne 0x1000332b
test cl, 8
je 0x1000333e
push 0x2e
push dword [esp + 0x1c]
call sub.vcruntime140.dll_strrchr
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1000333e
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
push str..exe
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1000332b
push str..cmd
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1000332b
push str..bat
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1000332b
push str..com
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1000332b
push str.PATHEXT
call sym.glib_lite.dll_Ordinal_113
pop ecx
test eax, eax
je 0x1000333e
push 0xffffffffffffffff
push eax
call fcn.1001b776
push 0xffffffffffffffff
push esi
mov ebp, eax
call fcn.1001b776
mov ebx, eax
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 0x14
mov dword [esp + 0x10], eax
mov edi, ebp
push 0x3b
push edi
call sub.vcruntime140.dll_strchr
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100032f8
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
lea esi, [edi + eax]
mov ecx, dword [esp + 0x10]
mov eax, esi
sub eax, edi
cmp ecx, eax
jne 0x10003313
push ecx
push edi
push ebx
call sub.vcruntime140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1000331d
cmp byte [esi], 0
je 0x10003330
lea edi, [esi + 1]
jmp 0x100032de
push ebp
call sym.glib_lite.dll_Ordinal_105
push ebx
call sym.glib_lite.dll_Ordinal_105
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x10003340
push ebp
call sym.glib_lite.dll_Ordinal_105
push ebx
call sym.glib_lite.dll_Ordinal_105
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10003346
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 2
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
push 2
push esi
call sym.glib_lite.dll_Ordinal_197
pop ecx
pop ecx
mov ebp, eax
push ebp
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
lea ecx, [esi - 1]
cmp eax, ecx
jne 0x10003386
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebp
call sym.glib_lite.dll_Ordinal_433
add esp, 0x14
mov ebx, eax
push ebp
call sym.glib_lite.dll_Ordinal_105
pop ecx
test ebx, ebx
jne 0x1000339e
push 0x100408f8
call sym.glib_lite.dll_Ordinal_348
pop ecx
mov ebx, eax
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x10003c4b
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esi + 4]
call sym.glib_lite.dll_Ordinal_105
mov eax, dword [esi]
pop ecx
xor ecx, ecx
mov dword [esi + 4], ecx
sub eax, ecx
je 0x10003ca9
sub eax, 1
je 0x10003c9d
sub eax, 1
je 0x10003c8f
sub eax, 1
je 0x10003c84
sub eax, 1
jne 0x10003ccb
lea eax, [esi + 8]
push eax
call fcn.100081da
pop ecx
pop esi
ret
lea eax, [esi + 8]
push eax
call fcn.10008438
jmp 0x10003c81
lea eax, [esi + 8]
push eax
call fcn.100058e1
add esp, 4
pop esi
ret
mov dword [esi + 0x18], 0xc3d2e1f0
mov dword [esi + 0x20], ecx
jmp 0x10003cac
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 8], 0x67452301
pop esi
ret
Function at 0x100058e1
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x24], 0
and dword [eax + 0x20], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x100081da
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov byte [eax + 0xc0], cl
mov dword [eax + 0xc8], ecx
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], ecx
ret

Function at 0x10008438
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov byte [eax + 0xc0], cl
mov dword [eax + 0xc8], ecx
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], ecx
ret
Function at 0x10008f5b
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
test esi, esi
jne 0x10009018
push 0x1008f374
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov esi, dword [edi]
test esi, esi
jne 0x1000900d
push ebp
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
xor ebp, ebp
cmp esi, 0xffffffff
jne 0x10008f9d
push 0x10040d90
push ebp
call fcn.10009235
pop ecx
pop ecx
cmp dword [edi + 4], ebp
je 0x10008ff3
push ebx
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x10008fc6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push 0x10040d9c
push dword [eax]
call fcn.10009235
pop ecx
pop ecx
mov dword [ebx], esi
lea ecx, [ebx + 8]
mov eax, dword [edi + 4]
mov edx, 0x1008f370
mov dword [ebx + 4], eax
mov eax, dword [0x1008f370]
mov dword [ecx], eax
lock cmpxchg dword [edx], ebx
pop ebx
cmp eax, dword [ecx]
je 0x10008ff3
push str.g_private_get_impl_1_
push ebp
call fcn.10009235
pop ecx
pop ecx
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x1000900c
push str.g_private_get_impl_2_
push ebp
call fcn.10009235
pop ecx
pop ecx
pop ebp
push 0x1008f374
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
ret

Function at 0x1000901d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.10008f5b
pop ecx
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10009042
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x10009042
push eax
call ecx
pop ecx
push dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop edi
pop esi
ret
Function at 0x1000c5ae
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1008f304]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call edi
xor ebp, ebp
mov dword [eax], ebp
test esi, esi
jne 0x1000c5eb
call edi
mov dword [eax], 0xe
xor eax, eax
jmp 0x1000c6f1
cmp word [esi], bp
jne 0x1000c5fa
call edi
mov dword [eax], 0x14
jmp 0x1000c5e4
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000c610
call edi
mov dword [eax], 2
jmp 0x1000c5e4
test al, 0x10
je 0x1000c5f0
push ebx
push 0x104
lea eax, [esp + 0x14]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wfullpath]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
push 0x10042264
call ebx
push 0x10042260
mov esi, eax
call ebx
add esi, eax
lea eax, [esp + 0x24]
push eax
call ebx
add eax, esi
lea eax, [eax*2 + 0x452]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x1000c66d
call edi
mov dword [eax], 0xc
xor eax, eax
jmp 0x1000c6f0
lea eax, [esp + 0x10]
push eax
lea edi, [esi + 0x448]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
cmp word [edi], bp
mov ebp, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
pop ecx
pop ecx
je 0x1000c6b4
push edi
call ebx
pop ecx
cmp word [esi + eax*2 + 0x446], 0x2f
je 0x1000c6b4
push edi
call ebx
pop ecx
cmp word [esi + eax*2 + 0x446], 0x5c
je 0x1000c6b4
push 0x10042260
push edi
call ebp
pop ecx
pop ecx
push 0x10042264
push edi
call ebp
or dword [esi + 0x440], 0xffffffff
xor ecx, ecx
xor eax, eax
mov dword [esi + 0x444], ecx
push 0x104
mov dword [esi + 0x234], eax
lea eax, [esi + 0x238]
push ecx
push eax
mov dword [esi + 0x230], ecx
call sub.vcruntime140.dll_memset
add esp, 0x14
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1003c212
add esp, 0x20c
ret
Function at 0x1000da09
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
mov edi, 0x1008f4c8
push edi
call sym.glib_lite.dll_Ordinal_235
xor esi, esi
inc esi
pop ecx
test eax, eax
je 0x1000da44
push str.G_MAIN_POLL_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ecx, dword [0x1008f4a8]
test eax, eax
push esi
cmovne ecx, esi
push edi
mov dword [0x1008f4a8], ecx
call sym.glib_lite.dll_Ordinal_236
add esp, 0xc
push ebx
push 0x70
push esi
call sym.glib_lite.dll_Ordinal_196
mov edi, eax
push edi
call sym.glib_lite.dll_Ordinal_207
lea ecx, [edi + 8]
push ecx
call sym.glib_lite.dll_Ordinal_48
xor ebx, ebx
push ebx
push ebx
call sym.glib_lite.dll_Ordinal_124
mov dword [edi + 0x24], eax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], esi
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], ebx
mov dword [edi + 0x5c], 0x1001bb93
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
call fcn.10001640
mov dword [edi + 0x28], eax
mov dword [edi + 0x68], ebx
call fcn.1001bf14
lea esi, [edi + 0x50]
mov dword [edi + 0x4c], eax
push esi
push eax
call fcn.1001bf00
push esi
push ebx
push edi
call fcn.1000d57e
mov esi, 0x1008f4bc
push esi
call sym.glib_lite.dll_Ordinal_208
push edi
push dword [0x1008f4c4]
call sym.glib_lite.dll_Ordinal_318
add esp, 0x38
mov dword [0x1008f4c4], eax
cmp dword [0x1008f4a8], 0
pop ebx
je 0x1000dae1
push edi
push str.created_context_p_n
call fcn.1003d210
pop ecx
pop ecx
push esi
call sym.glib_lite.dll_Ordinal_209
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x1000f2a1
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x1008f304]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
lea eax, [ebp - 0x80]
xor esi, esi
push eax
push dword [ebp + 0x19c]
mov dword [ebp - 0x80], esi
push esi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x1000f303
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1000f2fa
push esi
push esi
push esi
lea eax, [ebp - 0x7c]
push 0xffffffffffffffff
push eax
call sym.glib_lite.dll_Ordinal_433
add esp, 0x14
mov esi, eax
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x190]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1003c212
add ebp, 0x194
leave
ret
Function at 0x1000f39e
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esp + 0x28]
call fcn.1001a9a6
mov ebp, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
add esp, 0x14
mov ebx, eax
lea eax, [esp + 0x10]
push 2
pop esi
push esi
push eax
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x1000f402
push ebx
call sym.glib_lite.dll_Ordinal_105
pop ecx
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xcb
jne 0x1000f3eb
xor eax, eax
jmp 0x1000f4af
push 0x100405e0
call sym.glib_lite.dll_Ordinal_273
push eax
call sym.glib_lite.dll_Ordinal_275
pop ecx
pop ecx
jmp 0x1000f4af
cmp edi, 1
push esi
cmove edi, esi
push edi
call sym.glib_lite.dll_Ordinal_197
pop ecx
pop ecx
push edi
mov esi, eax
push esi
push ebx
call ebp
lea ecx, [edi - 1]
cmp eax, ecx
je 0x1000f42f
push ebx
call sym.glib_lite.dll_Ordinal_105
push esi
call sym.glib_lite.dll_Ordinal_105
pop ecx
pop ecx
jmp 0x1000f3e4
push 0x25
push esi
call sub.vcruntime140.dll_wcschr
pop ecx
pop ecx
test eax, eax
je 0x1000f47d
push 2
lea eax, [esp + 0x14]
mov edi, esi
push eax
push esi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test ebp, ebp
jle 0x1000f47d
push 2
push ebp
call sym.glib_lite.dll_Ordinal_197
pop ecx
pop ecx
push ebp
mov esi, eax
push esi
push edi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
je 0x1000f476
push esi
call sym.glib_lite.dll_Ordinal_105
mov esi, edi
jmp 0x1000f47c
push edi
call sym.glib_lite.dll_Ordinal_105
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
call sym.glib_lite.dll_Ordinal_433
push ebx
mov edi, eax
call sym.glib_lite.dll_Ordinal_105
push esi
call sym.glib_lite.dll_Ordinal_105
push edi
call sym.glib_lite.dll_Ordinal_274
push edi
mov esi, eax
call sym.glib_lite.dll_Ordinal_105
push esi
call sym.glib_lite.dll_Ordinal_275
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1000fc49
Capabilities:
Hash data using djb2

Disassembly:
mov edx, dword [esp + 4]
mov ecx, 0x1505
jmp 0x1000fc5d
imul ecx, ecx, 0x21
movsx eax, al
add ecx, eax
inc edx
mov al, byte [edx]
test al, al
jne 0x1000fc54
mov eax, ecx
ret