joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b7a1
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.1000de50
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.1001b703
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.1001b703
push 0x10038198
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.1001b703
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.1000de50
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000b846
sub ecx, edx
cmp ecx, 6
jbe 0x1000b86d
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.1001b703
pop ecx
pop ecx
test eax, eax
jne 0x1000b86d
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000b874
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10036ae3
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.1001b703
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.1000d8d0
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000b8ee
mov ax, word [0x100381c4]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x824
ret

Function at 0x1001b703
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1001b712
pop dword [ebp - 0x18]
mov eax, 0x876578a7
add eax, 0x889c3e6b
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3c608
push 0
mov eax, 0x91643d35
add eax, 0x7e9e845f
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x65918b99
add ecx, 0x9a6eafaa
mov edx, eax
mov ebx, 0xed5dabde
sub ebx, 0xdd594bde
add ebx, dword [ebp - 0x18]
mov edi, 0x5e440053
sub edi, 0x7d1fe343
mov esi, dword [ebx]
sub dword [ebp - 0xc], 0xe4a40060
xor esi, edi
sub dword [ebp - 0x14], edi
mov dword [edx], esi
xor dword [ebp - 4], 0x92585375
add edx, 4
add ebx, 0xa54cd157
sub ebx, 0xa54cd153
loop 0x1001b771
add eax, 0x4377e8a3
sub eax, 0x437708c4
mov ebx, eax
add eax, 0x98113fdd
add eax, 0x67eec028
mov ecx, 0x53b3d40c
add ecx, 0xbc4c2bf4
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10016d00
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003a428
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10043330]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10016e99
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.10016f70
mov dword [esp + 0x20], vtable.MemoryControl.0
mov dword [esp + 0x24], 0
mov dword [esp + 0x38], 0
mov edx, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
call fcn.1002b1c0
mov edi, eax
lea eax, [esp + 0x14]
push eax
push edi
mov ecx, esi
mov dword [esp + 0x24], edi
call fcn.10016f70
test al, al
je 0x10016e88
mov eax, 0x4ec4ec4f
mul dword [esp + 0x14]
shr edx, 5
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edx
je 0x10016e88
add edi, 7
mov edx, dword [ebp + 8]
mov eax, 0x10
lea ecx, [edi - 3]
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x10016dd8
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x10016dc0
test eax, eax
je 0x10016e35
movzx esi, byte [edx]
movzx ebx, byte [ecx]
sub esi, ebx
jne 0x10016e27
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10016e35
movzx esi, byte [edx]
movzx ebx, byte [ecx]
sub esi, ebx
jne 0x10016e27
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10016e35
movzx esi, byte [edx]
movzx ebx, byte [ecx]
sub esi, ebx
jne 0x10016e27
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10016e35
movzx esi, byte [edx]
movzx ecx, byte [ecx]
sub esi, ecx
je 0x10016e35
test esi, esi
mov eax, 1
jg 0x10016e37
or eax, 0xffffffff
jmp 0x10016e37
xor eax, eax
test eax, eax
jne 0x10016e70
xor ecx, ecx
lea ecx, [ecx]
movzx esi, byte [edi + eax - 1]
movzx edx, byte [edi + eax - 2]
add edx, esi
movzx esi, byte [edi + eax - 3]
add edx, esi
movzx esi, byte [edi + eax + 1]
add edx, esi
movzx esi, byte [edi + eax]
add esi, ecx
add eax, 5
cmp eax, 0x64
lea ecx, [esi + edx]
jl 0x10016e40
cmp ecx, dword [edi - 7]
je 0x10016eb0
mov eax, dword [esp + 0x18]
add eax, 1
add edi, 0x68
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
jb 0x10016db5
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10016e99
push eax
call fcn.1002c6d7
add esp, 4
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 0xc]
push 0x68
push 0
push edi
call fcn.1002fb20
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
imul esi, esi, 0x68
add esi, dword [esp + 0x28]
add esp, 0xc
test eax, eax
mov ecx, 0x1a
rep movsd dword es:[edi], dword [esi]
je 0x10016ee3
push eax
call fcn.1002c6d7
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10017bc0
Capabilities:
Check os version
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1003a39d
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x10043330]
xor eax, esp
mov dword [esp + 0x338], eax
push ebx
push ebp
push esi
mov eax, dword [0x10043330]
xor eax, esp
push eax
lea eax, [esp + 0x34c]
mov dword fs:[0], eax
xor ebx, ebx
push 0x1fe
mov dword [esp + 0x358], ebx
lea eax, [esp + 0x14e]
push ebx
mov dword [esp + 0x18], ebx
push eax
mov dword [esp + 0x20], edi
mov word [esp + 0x154], bx
call fcn.1002fb20
add esp, 0xc
push 0x100
lea ecx, [esp + 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ebp, [edi + 4]
lea eax, [esp + 0x148]
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov word [ebp], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10017c57
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x14c]
push edx
mov esi, edi
call fcn.100031f0
mov dword [esp + 0x354], ebx
push edi
mov ecx, 3
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], 1
call fcn.10016b90
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov dword [esp + 0x35c], 1
call fcn.10003860
mov esi, 8
mov byte [esp + 0x354], bl
cmp dword [esp + 0x30], esi
jb 0x10017cc8
mov eax, dword [esp + 0x1c]
push eax
call fcn.1002b322
add esp, 4
mov ecx, dword [esp + 0x35c]
cmp byte [ecx], bl
je 0x10017d21
push 0x11
push str.WindowsSystem32_
mov ecx, edi
call fcn.10003120
mov edx, dword [esp + 0x35c]
mov eax, dword [edx + 4]
sub eax, ebx
je 0x10017d15
sub eax, 1
je 0x10017d09
sub eax, 1
jne 0x10017da8
push 0xf
push str.AnBakConfig.dat
jmp 0x10017da1
push 0xf
push str.PaBakConfig.dat
jmp 0x10017da1
push 0xf
push str.AbBakConfig.dat
jmp 0x10017da1
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x38], 6
mov ecx, edi
jb 0x10017d46
push 0x11
push str.ProgramDataAomei
jmp 0x10017d4d
push 0x37
push str.Documents_and_SettingsAll_UsersApplication_DataAomei
call fcn.10003120
cmp dword [edi + 0x18], esi
jb 0x10017d5a
mov ebp, dword [ebp]
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x1003f190
mov ecx, edi
call fcn.10003120
mov ecx, dword [esp + 0x35c]
mov eax, dword [ecx + 4]
sub eax, ebx
je 0x10017d9a
sub eax, 1
je 0x10017d91
sub eax, 1
jne 0x10017da8
push 0xc
push str.AnConfig.dat
jmp 0x10017da1
push 0xc
push str.PaConfig.dat
jmp 0x10017da1
push 0xc
push str.AbConfig.dat
mov ecx, edi
call fcn.10003120
mov eax, edi
mov ecx, dword [esp + 0x34c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x338]
xor ecx, esp
call fcn.1002b6af
add esp, 0x348
ret 4
Function at 0x100186d0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x121c
call fcn.10037c50
mov eax, dword [0x10043330]
xor eax, esp
mov dword [esp + 0x1218], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..PhysicalDrive0
mov edi, ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x10018758
call fcn.10018cf0
push 0x206
mov esi, eax
lea eax, [esp + 0x26]
push ebx
push eax
mov word [esp + 0x2c], bx
call fcn.1002fb20
push esi
push str..PhysicalDrive_d
lea edx, [esp + 0x34]
call fcn.10001000
add esp, 0x14
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
lea ecx, [esp + 0x38]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x100187b2
push 0xfff
lea edx, [esp + 0x22d]
push ebx
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x234], bl
call fcn.1002fb20
add esp, 0xc
push ebx
lea eax, [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x234]
push ecx
push 0xc
lea edx, [esp + 0x28]
push edx
push 0x2d1400
push esi
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
push esi
jne 0x100187b6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100187e4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x23c]
lea eax, [esp + eax + 0x228]
call fcn.10018800
push eax
push str._08X
mov ecx, 0xc
call fcn.10004080
add esp, 8
mov al, 1
mov ecx, dword [esp + 0x1228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002b6af
add esp, 0x121c
ret
Function at 0x10018cf0
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x10
xor eax, eax
push eax
push 0x80
push 3
push eax
push 3
push 0x80000000
push str..C:
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10018d34
or eax, 0xffffffff
add esp, 0x10
ret
push 0
lea ecx, [esp + 4]
push ecx
push 0xc
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x2d1080
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10018d2d
mov eax, dword [esp + 8]
add esp, 0x10
ret

Function at 0x10019b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10039eb8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10043330]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x30]
lea ecx, [eax*4]
push ecx
push 1
call fcn.1002c883
mov edx, dword [esp + 0x38]
mov edi, eax
add esp, 8
lea eax, [edx*4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x10019c07
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x10019c07
cmp dword [esp + 0x34], 0x10
mov eax, dword [esp + 0x20]
jae 0x10019ba2
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x38]
add ecx, ecx
add ecx, ecx
push ecx
push edi
push 0xffffffffffffffff
push eax
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10019bc0
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.100031f0
push edi
call fcn.1002c6d7
add esp, 4
cmp dword [esp + 0x34], 0x10
jb 0x10019bf3
mov eax, dword [esp + 0x20]
push eax
call fcn.1002b322
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret
cmp dword [esp + 0x34], 0x10
jb 0x10019c1b
mov ecx, dword [esp + 0x20]
push ecx
call fcn.1002b322
add esp, 4
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x10027050
Capabilities:
Read .ini file

Disassembly:
push ecx
mov eax, dword [0x10043330]
xor eax, esp
mov dword [esp], eax
push 0x400
push 0x10058c20
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x10058c20
call fcn.1002cb34
add esp, 8
test eax, eax
je 0x10027085
mov word [eax], 0
push esi
push edi
mov edi, 0x10058c20
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10027090
mov ecx, 6
mov esi, str.Version.ini
rep movsd dword es:[edi], dword [esi]
push 0x10058c20
push 0
push 0x1003e008
push 0x1003e00c
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
pop edi
pop esi
jne 0x100270cc
mov eax, 3
mov ecx, dword [esp]
xor ecx, esp
call fcn.1002b6af
pop ecx
ret

Function at 0x100270e0
Capabilities:
Read .ini file

Disassembly:
push ecx
mov eax, dword [0x10043330]
xor eax, esp
mov dword [esp], eax
push 0x400
push 0x10059020
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x10059020
call fcn.1002cb34
add esp, 8
test eax, eax
je 0x10027115
mov word [eax], 0
push esi
push edi
mov edi, 0x10059020
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10027120
mov ecx, 6
mov esi, str.Version.ini
rep movsd dword es:[edi], dword [esi]
push 0x10059020
push 0
push str.versionCode
push str.VersionInfo
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
pop edi
pop esi
jne 0x1002715c
mov eax, 7
mov ecx, dword [esp]
xor ecx, esp
call fcn.1002b6af
pop ecx
ret
Function at 0x100292d0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2d8
mov eax, dword [0x10043330]
xor eax, esp
mov dword [esp + 0x2d0], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edi
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x98
lea ecx, [esp + 0x38]
push 0
push ecx
call fcn.1002fb20
add esp, 0xc
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x34], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10029374
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push 0x1ff
lea ecx, [esp + 0xd5]
push 0
push ecx
mov byte [esp + 0xdc], 0
call fcn.1002fb20
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push edx
push eax
push ecx
push str.Version___d._d._d_r_n
mov ecx, 0x200
lea edi, [esp + 0xec]
call fcn.10004080
add esp, 0x1c
mov edi, esi
call fcn.10016af0
push 0xe
push str._SystemInfo__r_n
mov ecx, esi
call fcn.10002fc0
lea eax, [esp + 0xd0]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100293d7
sub eax, edx
push eax
lea edx, [esp + 0xd4]
push edx
mov eax, esi
call fcn.10015ee0
cmp dword [esp + 8], 0
push 0x14
mov eax, esi
je 0x10029404
push str.SystemType__64Bit_r_n
jmp 0x10029409
push str.SystemType__32Bit_r_n
call fcn.10015ee0
push 0x200
lea eax, [esp + 0xd4]
push 0
push eax
call fcn.1002fb20
mov ecx, dword [esp + 0x2c]
push ecx
push str.NumberOfProcessors:___d_r_n
mov ecx, 0x200
lea edi, [esp + 0xe4]
call fcn.10004080
mov eax, edi
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10029445
sub eax, edx
push eax
lea edx, [esp + 0xd4]
push edx
mov eax, esi
call fcn.10015ee0
push 4
push str._r_n_r_n
mov eax, esi
call fcn.10015ee0
mov ecx, dword [esp + 0x2d4]
pop edi
xor ecx, esp
call fcn.1002b6af
add esp, 0x2d8
ret

Function at 0x10029490
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x759350f2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..text_1
mov ebx, 0x42f314
nop
nop
mov ecx, 0x6a6424de
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1000bf58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x80], edi
je 0x1000bf6f
push esi
call sym.gstreamer_lite.dll_Ordinal_11
pop ecx
push dword [esi + 0xc]
call fcn.1002a864
jmp 0x1000bf88
push eax
call sym.gstreamer_lite.dll_Ordinal_94
push dword [esi + 0xc]
call fcn.1002a864
pop ecx
pop ecx
test eax, eax
jne 0x1000bf79
or eax, 0xffffffff
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x58], edi
pop edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x5c], eax
pop esi
ret
Function at 0x10036915
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push esi
mov esi, dword [esp + 0x10]
push edi
push 0xc
pop edi
mov ebx, dword [esi + 0x3c]
push edi
push ebx
push dword [esi + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
test eax, eax
jns 0x10036950
call ebp
cmp dword [eax], 0xb
je 0x10036954
call ebp
cmp dword [eax], 4
je 0x10036954
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
sub edi, eax
add ebx, eax
test edi, edi
jne 0x10036929
mov edi, dword [esi + 0x3c]
lea eax, [edi + 8]
push eax
call fcn.100362b3
pop ecx
cmp eax, 0xbefec0ae
jne 0x10036949
lea eax, [edi + 4]
push eax
call fcn.100362b3
mov ebp, eax
pop ecx
lea ebx, [ebp + 0xc]
cmp ebx, 0x2000000
ja 0x10036949
movzx ecx, byte [edi + 1]
movzx edx, byte [edi + 2]
movzx eax, byte [edi + 3]
shl ecx, 8
or edx, ecx
shl edx, 8
or edx, eax
mov dword [esp + 0x14], edx
test ebp, ebp
je 0x100369fd
cmp ebx, dword [esi + 0x40]
jb 0x100369bb
lea eax, [ebp + 0x20c]
push eax
push edi
mov dword [esi + 0x40], eax
call sub.glib_lite.dll_Ordinal_313
pop ecx
pop ecx
mov dword [esi + 0x3c], eax
mov edi, dword [esi + 0x3c]
mov ebx, ebp
add edi, 0xc
push ebx
push edi
push dword [esi + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
test eax, eax
jns 0x100369f1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0xb
je 0x100369f5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
jne 0x10036949
jmp 0x100369f5
sub ebx, eax
add edi, eax
test ebx, ebx
jne 0x100369c3
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x3c]
push ebp
lea eax, [ecx + 0xc]
push eax
movzx eax, byte [ecx]
push edx
push eax
push esi
call fcn.100364c1
add esp, 0x14
jmp 0x1003694b
Function at 0x1006185a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10061869
pop dword [ebp - 8]
mov eax, 0x10061869
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x39b0d5e
add dword [ebp - 0x18], 0x4ab737ed
mov dword [ebp - 0x14], 0x1efce580
sub dword [ebp - 0x14], 0xecc9993b
mov dword [ebp - 0x10], 0xa94bf15
add dword [ebp - 0x10], 0x41b78519
mov dword [ebp - 0xc], 0x91895b78
add dword [ebp - 0xc], 0x6e76a488
lea eax, [ebp - 0x18]
push eax
mov eax, 0xe2eb6ed6
add eax, 0x2d1d7152
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb76d778a
sub dword [ebp - 0x18], 0x42fb0e34
mov dword [ebp - 0x14], 0x6001a16b
sub dword [ebp - 0x14], 0x1e953ff6
mov dword [ebp - 0x10], 0xb5cbb491
sub dword [ebp - 0x10], 0x525c4825
mov dword [ebp - 0xc], 0x1a50ce83
add dword [ebp - 0xc], 0xe5af317d
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xda992b3b
add eax, 0x356fb50d
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3b7a3
push 0
call eax
mov ecx, 0x3f21
xor edx, edx
add edx, eax
mov ebx, 0x100c4400
add ebx, dword [ebp - 8]
mov esi, 0x26f47911
mov edi, dword [ebx]
xor dword [ebp - 4], 0xb6a583
sub edi, esi
mov dword [ebp - 4], 0xcc961b1
mov dword [edx], edi
add dword [ebp - 4], ecx
add edx, 0x51288b57
sub edx, 0x51288b53
add ebx, 0x520273d
add ebx, 0xfadfd8c7
loop 0x10061976
add eax, 0x501d086d
add eax, 0xafe3e6ea
mov ebx, eax
add eax, 0x39d3ab4a
sub eax, 0x39d3ab45
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10074e22
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push ebx
push esi
call fcn.1007370c
mov ebx, dword [esp + 0x3c]
push eax
push ebx
call sub.glib_lite.dll_Ordinal_427
mov esi, eax
pop ecx
pop ecx
mov eax, dword [esi + 0x74]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x10074e4d
xor eax, eax
jmp 0x10074fd6
cmp eax, dword [esi + 0x1f0]
je 0x10074e46
push ebp
lea ebp, [esi + 0xc]
push ebp
call sub.glib_lite.dll_Ordinal_220
pop ecx
push edi
push dword [esp + 0x48]
push ebx
call fcn.1002d150
pop ecx
pop ecx
test eax, eax
jne 0x10074fca
push ebp
call sub.glib_lite.dll_Ordinal_219
mov eax, dword [esi + 0x1f8]
push ebp
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x18], eax
call sub.glib_lite.dll_Ordinal_220
push ebx
call fcn.1002e103
mov ecx, eax
add esp, 0xc
mov eax, dword [esp + 0x10]
cmp eax, edx
jb 0x10074eaf
ja 0x10074ea9
cmp edi, ecx
jbe 0x10074eaf
sub edi, ecx
sbb eax, edx
jmp 0x10074ec0
xorps xmm0, xmm0
movlpd qword [esp + 0x1c], xmm0
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
push ecx
push eax
push edi
push ebx
call fcn.100305be
add esp, 0x10
mov dword [esp + 0x14], eax
cmp eax, 4
je 0x10074ef3
cmp dword [ebx + 0x168], 0
jne 0x10074fca
cmp eax, 2
je 0x10074e61
call fcn.1008affe
push eax
push dword [esi + 0x1f0]
call sub.glib_lite.dll_Ordinal_427
push eax
call fcn.1008afcd
add esp, 0xc
push edx
push eax
call fcn.1008affe
push eax
push dword [esi + 0x1f0]
call sub.glib_lite.dll_Ordinal_427
pop ecx
pop ecx
push eax
call fcn.1008aee4
push ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], edx
call sub.glib_lite.dll_Ordinal_219
mov ebx, dword [esi + 0x7c]
add esp, 0x10
add edi, dword [esi + 0x78]
adc ebx, dword [esp + 0x10]
cmp dword [esp + 0x14], 1
jne 0x10074f52
add edi, dword [esp + 0x28]
adc ebx, dword [esp + 0x2c]
push esi
call fcn.1007322b
lea eax, [esp + 0x34]
xor ebp, ebp
push eax
lea eax, [esp + 0x40]
push eax
push ebp
push ebp
push dword [esi + 0x1f0]
call fcn.10031e60
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push ebx
push edi
push dword [esp + 0x48]
push dword [esp + 0x50]
push dword [esi + 0x1f0]
call fcn.1006185a
mov eax, dword [esi + 0x1f8]
add esp, 0x3c
cmp dword [eax + 8], ebp
jne 0x10074fb5
push dword [esp + 0x24]
push dword [esi + 0x1f0]
call fcn.1003238d
pop ecx
pop ecx
push esi
call fcn.10074682
push 3
push esi
call fcn.10072ca2
add esp, 0xc
xor eax, eax
jmp 0x10074fd4
push ebp
call sub.glib_lite.dll_Ordinal_219
pop ecx
push 0xfffffffffffffffe
pop eax
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x30
ret