joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61f2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 0xa8]
cmp eax, 0xffffffff
je 0x61f36c
cmp eax, 0x40
jbe 0x61f31a
push esi
lea ecx, [esi + 0x40]
call fcn.005c0380
mov dword [esi + 0xa8], 0x14
mov eax, dword [esi + 0xa8]
mov ecx, 0x40
sub ecx, eax
push ecx
add eax, esi
push 0
push eax
call fcn.005236f0
add esp, 0xc
xor eax, eax
jmp 0x61f340
xor dword [esi + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x61f340
push edi
lea ecx, [esi + 0x40]
call fcn.005bf480
push 0x40
push esi
lea ecx, [esi + 0x40]
call fcn.005bfaa0
mov dword [esi + 0xa8], 0xffffffff
pop edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x61f380
mov edx, dword [ebp + 8]
push eax
push edx
lea ecx, [esi + 0x40]
call fcn.005bfaa0
pop esi
pop ebp
ret

Function at 0x61f390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0xa8], 0xffffffff
je 0x61f3be
push esi
push 0
push 0
call fcn.0061f2f0
add esp, 0xc
push edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0x40]
call fcn.005c0380
xor eax, eax
lea ecx, [ecx]
xor dword [esi + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x61f3d0
lea ecx, [esi + 0x40]
call fcn.005bf480
push 0x40
push esi
lea ecx, [esi + 0x40]
call fcn.005bfaa0
push 0x14
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [esi + 0x40]
call fcn.005bfaa0
lea edx, [ebp - 0x18]
push edx
lea ecx, [esi + 0x40]
call fcn.005c0380
mov eax, dword [ebp + 0xc]
pop edi
test eax, eax
je 0x61f420
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
call fcn.00523380
add esp, 0xc
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00521602
mov esp, ebp
pop ebp
ret
Function at 0xb56f60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section....._1
lea edi, [esi - 0x59a000]
push edi
jmp 0xb56f7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xb56f81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb56f70
mov eax, 1
add ebx, ebx
jne 0xb56f93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xb56fa4
jne 0xb56fc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb56fc3
dec eax
add ebx, ebx
jne 0xb56fb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xb56f88
add ebx, ebx
jne 0xb56fbf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xb57015
xor ecx, ecx
sub eax, 3
jb 0xb56fdb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xb5704a
sar eax, 1
mov ebp, eax
jmp 0xb56fe6
add ebx, ebx
jne 0xb56fe6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb56fb4
inc ecx
add ebx, ebx
jne 0xb56ff4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb56fb4
add ebx, ebx
jne 0xb57001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xb56ff6
jne 0xb57012
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xb56ff6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xb57034
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xb57026
jmp 0xb56f76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xb57034
add edi, ecx
jmp 0xb56f76
pop esi
mov edi, esi
mov ecx, 0x48f6f9
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xb5706f
cmp byte [edi], 0x4d
jne 0xb57054
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xb57052
lea edi, [esi + 0x72c000]
mov eax, dword [edi]
or eax, eax
je 0xb570c0
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7a0fbc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7a1144]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xb57075
mov ecx, edi
jns 0xb570a4
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7a114c]
or eax, eax
je 0xb570ba
mov dword [ebx], eax
add ebx, 4
jmp 0xb57092
call dword [esi + 0x7a1148]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xb570f1
cmp al, 0xef
ja 0xb570e4
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xb570c6
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xb570d3
mov ebp, dword [esi + 0x7a1150]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xb57125
sub esp, 0xffffff80
jmp 0x858c20
Function at 0x10019832
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10019854
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10019904
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10019877
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10019879
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100198f5
jg 0x1001988c
test esi, esi
je 0x100198f5
test eax, eax
jl 0x100198cc
jg 0x10019896
test ebp, ebp
je 0x100198cc
cmp edi, eax
jg 0x100198a6
jl 0x100198a0
cmp esi, ebp
jae 0x100198a6
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100198d0
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100198f5
jg 0x100198da
test esi, esi
je 0x100198f5
cmp dword [ebx + 0x4c], 0
je 0x100198f5
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1001a978
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1001a987
pop dword [ebp - 0x30]
mov eax, 0x6d4b3183
add eax, 0xa2b67804
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x39476
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xeb924674
sub ecx, 0xeb91fdad
mov edi, eax
mov edx, 0xdc37440a
add edx, 0x33ccf9f6
add edx, dword [ebp - 0x30]
mov esi, 0xd781d508
mov dword [ebp - 0x14], 0xb7c68e35
mov ebx, dword [edx]
xor dword [ebp - 0x18], 0xb38bfb45
xor ebx, esi
xor dword [ebp - 0x14], eax
mov dword [edi], ebx
sub dword [ebp - 0x20], ecx
add edi, 0x1250eb74
sub edi, 0x1250eb70
add edx, 0xa4b589d7
add edx, 0x5b4a762d
loop 0x1001a9db
add eax, 0x8bb5f0bb
sub eax, 0x8bb4dacc
mov ebx, eax
add eax, 0x530634bf
add eax, 0xacf9cb46
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4245a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c000]
push edi
or ebp, 0xffffffff
jmp 0x4245c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4245c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4245b8
mov eax, 1
add ebx, ebx
jne 0x4245db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4245d0
jne 0x4245ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4245d0
xor ecx, ecx
sub eax, 3
jb 0x424600
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x424672
mov ebp, eax
add ebx, ebx
jne 0x42460b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x424618
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42463c
inc ecx
add ebx, ebx
jne 0x424628
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42461d
jne 0x424639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42461d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42465c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42464d
jmp 0x4245be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42465c
add edi, ecx
jmp 0x4245be
pop esi
lea edi, [esi + 0x22000]
mov eax, dword [edi]
or eax, eax
je 0x4246c4
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x264f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2658c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x424679
mov ecx, edi
jns 0x4246a8
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x26594]
or eax, eax
je 0x4246be
mov dword [ebx], eax
add ebx, 4
jmp 0x424696
call dword [esi + 0x26590]
mov ebp, dword [esi + 0x26598]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4246f8
sub esp, 0xffffff80
jmp 0x4018b7
Function at 0x40481d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40482c
pop dword [ebp - 0x48]
mov eax, 0x40482c
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x1314fe7e
sub dword [ebp - 0x58], 0xc4c2b933
mov dword [ebp - 0x54], 0x80b5ef04
add dword [ebp - 0x54], 0xb17d5d41
mov dword [ebp - 0x50], 0x4c0504e3
add dword [ebp - 0x50], 0x473f4b
mov dword [ebp - 0x4c], 0x2289b20b
add dword [ebp - 0x4c], 0xdd764df5
lea eax, [ebp - 0x58]
push eax
mov eax, 0xb3193d30
sub eax, 0xb2d70cbc
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xe72b4c68
add dword [ebp - 0x58], 0x8d471cee
mov dword [ebp - 0x54], 0x6017e8fa
sub dword [ebp - 0x54], 0x1eab8785
mov dword [ebp - 0x50], 0x121ed86b
sub dword [ebp - 0x50], 0xaeaf6bff
mov dword [ebp - 0x4c], 0x3e85d2eb
add dword [ebp - 0x4c], 0xc17a2d15
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3b38d
push 0
call eax
mov ecx, 0x8b9872ff
sub ecx, 0x8b983504
mov edi, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x48]
mov esi, 0x99451310
sub esi, 0xd74bb5fa
add dword [ebp - 0x1c], esi
mov edx, dword [ebx]
xor dword [ebp - 0x38], esi
sub edx, esi
xor dword [ebp - 0x28], ebx
mov dword [edi], edx
add dword [ebp - 0x20], 0x24c07043
add edi, 0xfd320bd7
sub edi, 0xfd320bd3
add ebx, 0x279dbfb4
sub ebx, 0x279dbfb0
loop 0x40493e
add eax, 0xab1a455c
add eax, 0x54e6a563
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x18b2cea5
sub ecx, 0x1872cea5
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x513d80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x110000]
push edi
jmp 0x513d9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x513da1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x513d90
mov eax, 1
add ebx, ebx
jne 0x513db3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x513da8
jne 0x513dc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x513da8
xor ecx, ecx
sub eax, 3
jb 0x513dd8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x513e4a
mov ebp, eax
add ebx, ebx
jne 0x513de3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x513df0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x513e14
inc ecx
add ebx, ebx
jne 0x513e00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x513df5
jne 0x513e11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x513df5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x513e34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x513e25
jmp 0x513d96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x513e34
add edi, ecx
jmp 0x513d96
pop esi
mov edi, esi
mov ecx, 0x36
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x513e52
cmp byte [edi], 1
jne 0x513e52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x513e57
lea edi, [esi + 0x111000]
mov eax, dword [edi]
or eax, eax
je 0x513ec6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x117880]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x117900]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x513e84
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x117908]
or eax, eax
je 0x513ec0
mov dword [ebx], eax
add ebx, 4
jmp 0x513ea1
call dword [esi + 0x117904]
mov ebp, dword [esi + 0x11790c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x513efa
sub esp, 0xffffff80
jmp 0x4016a7
Function at 0x46878c
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468603

Function at 0x1002df80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1002e144
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
or ebp, 0xffffffff
jmp 0x1002dfaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1002dfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1002dfa0
mov eax, 1
add ebx, ebx
jne 0x1002dfc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1002dfb8
jne 0x1002dfd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002dfb8
xor ecx, ecx
sub eax, 3
jb 0x1002dfe8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1002e05a
mov ebp, eax
add ebx, ebx
jne 0x1002dff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1002e000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1002e024
inc ecx
add ebx, ebx
jne 0x1002e010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1002e005
jne 0x1002e021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002e005
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1002e044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1002e035
jmp 0x1002dfa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1002e044
add edi, ecx
jmp 0x1002dfa6
pop esi
mov edi, esi
mov ecx, 0xc42
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1002e062
cmp byte [edi], 0x11
jne 0x1002e062
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1002e067
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x1002e0d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e44c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e49c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1002e094
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e4a0]
or eax, eax
je 0x1002e0d0
mov dword [ebx], eax
add ebx, 4
jmp 0x1002e0b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1002e107
cmp al, 0xef
ja 0x1002e0fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1002e0dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1002e0e9
mov ebp, dword [esi + 0x2e4a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1002e13b
sub esp, 0xffffff80
jmp 0x10013194
Function at 0x1000da09
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
mov edi, 0x1008f4c8
push edi
call sym.glib_lite.dll_Ordinal_235
xor esi, esi
inc esi
pop ecx
test eax, eax
je 0x1000da44
push str.G_MAIN_POLL_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ecx, dword [0x1008f4a8]
test eax, eax
push esi
cmovne ecx, esi
push edi
mov dword [0x1008f4a8], ecx
call sym.glib_lite.dll_Ordinal_236
add esp, 0xc
push ebx
push 0x70
push esi
call sym.glib_lite.dll_Ordinal_196
mov edi, eax
push edi
call sym.glib_lite.dll_Ordinal_207
lea ecx, [edi + 8]
push ecx
call sym.glib_lite.dll_Ordinal_48
xor ebx, ebx
push ebx
push ebx
call sym.glib_lite.dll_Ordinal_124
mov dword [edi + 0x24], eax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], esi
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], ebx
mov dword [edi + 0x5c], 0x1001bb93
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
call fcn.10001640
mov dword [edi + 0x28], eax
mov dword [edi + 0x68], ebx
call fcn.1001bf14
lea esi, [edi + 0x50]
mov dword [edi + 0x4c], eax
push esi
push eax
call fcn.1001bf00
push esi
push ebx
push edi
call fcn.1000d57e
mov esi, 0x1008f4bc
push esi
call sym.glib_lite.dll_Ordinal_208
push edi
push dword [0x1008f4c4]
call sym.glib_lite.dll_Ordinal_318
add esp, 0x38
mov dword [0x1008f4c4], eax
cmp dword [0x1008f4a8], 0
pop ebx
je 0x1000dae1
push edi
push str.created_context_p_n
call fcn.10005737
pop ecx
pop ecx
push esi
call sym.glib_lite.dll_Ordinal_209
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x1000f2a1
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x1008f304]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
lea eax, [ebp - 0x80]
xor esi, esi
push eax
push dword [ebp + 0x19c]
mov dword [ebp - 0x80], esi
push esi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x1000f303
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1000f2fa
push esi
push esi
push esi
lea eax, [ebp - 0x7c]
push 0xffffffffffffffff
push eax
call sym.glib_lite.dll_Ordinal_433
add esp, 0x14
mov esi, eax
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x190]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1003c212
add ebp, 0x194
leave
ret
Function at 0x10010879
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1040
call fcn.1003c310
mov eax, dword [0x1008f304]
xor eax, esp
mov dword [esp + 0x103c], eax
and dword [esp], 0
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x1048]
push edi
mov edi, dword [esp + 0x1058]
push eax
push dword [esp + 0x1054]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64]
pop ecx
pop ecx
test eax, eax
jns 0x100108eb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [eax]
push esi
call sym.glib_lite.dll_Ordinal_353
pop ecx
push eax
push esi
call fcn.10002ff5
pop ecx
push eax
call fcn.100030eb
push eax
push edi
call fcn.10005737
add esp, 0x10
xor eax, eax
jmp 0x100109ca
test dword [esp + 0x12], 0x8000
jne 0x10010903
push str.Not_a_regular_file
push 1
call fcn.100102cf
jmp 0x100108da
push ebx
mov bl, byte [esi + 0x14]
push esi
call fcn.10010253
push esi
call fcn.10010717
mov eax, dword [esp + 0x1060]
pop ecx
pop ecx
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], eax
push ebp
push 0x1000
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1060]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [eax]
test ebp, ebp
je 0x10010996
jns 0x10010978
cmp ebx, 4
je 0x1001098c
cmp ebx, 0xb
je 0x1001098c
push ebx
call sym.glib_lite.dll_Ordinal_353
pop ecx
push eax
push ebx
call fcn.10002ff5
pop ecx
push eax
call fcn.100030eb
push eax
push edi
call fcn.10005737
add esp, 0x10
jmp 0x100109c1
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x54]
push eax
push esi
call fcn.10010c32
add esp, 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10010923
jmp 0x1001099e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100109a1
push eax
jmp 0x100109b9
lea eax, [esp + 0x10]
push eax
push esi
call fcn.10005737
cmp dword [esp + 0x18], 0
pop ecx
pop ecx
je 0x100109c5
push dword [esp + 0x10]
push edi
call fcn.10005737
pop ecx
pop ecx
xor eax, eax
jmp 0x100109c8
xor eax, eax
inc eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x1044]
pop edi
pop esi
xor ecx, esp
call fcn.1003c212
add esp, 0x1040
ret
Function at 0x100296d3
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [edi + 0x74]
push eax
xor eax, eax
push eax
push edi
push dword [esp + 0x20]
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test esi, esi
jne 0x1002971a
push dword [eax]
call sym.glib_lite.dll_Ordinal_353
push eax
push str.Error_creating_thread:__s.
push 0x10
push str.Glib
call sym.glib_lite.dll_Ordinal_182
add esp, 0x14
jmp 0x1002974e
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1002974e
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10005737
mov esi, eax
push esi
push str.Error_closing_thread_handle:__s.
push 0x10
push str.Glib
call sym.glib_lite.dll_Ordinal_182
push esi
call sym.glib_lite.dll_Ordinal_105
add esp, 0x18
push 0xffffffffffffffff
push dword [edi + 0x8c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
pop edi
pop esi
ret