joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6862efe0
Capabilities:
Create thread

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x20
lea eax, [eax + 0x74]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.__beginthreadex
test eax, eax
je 0x6862f080
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
test eax, eax
jne 0x6862f05d
call sym._GetLastError_0
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_win32_error_message
mov edx, str.Error_closing_thread_handle:__s.
mov dword [esp + 8], edx
mov dword [esp], 0x6869cf88
mov esi, eax
mov dword [esp + 0xc], eax
mov eax, 0x10
mov dword [esp + 4], eax
call sym.libglib_2.0_0.dll_g_log
mov dword [esp], esi
call sym.libglib_2.0_0.dll_g_free
mov eax, dword [ebx + 0x8c]
mov ecx, 0xffffffff
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
call sym.__errno
mov esi, str.Error_creating_thread:__s.
mov eax, dword [eax]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_strerror
mov ecx, 0x10
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov dword [esp], 0x6869cf88
mov dword [esp + 0xc], eax
call sym.libglib_2.0_0.dll_g_log
jmp 0x6862f05d
Function at 0x686309b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
lea edi, [ebp - 0x20]
mov eax, dword [eax + 0x40]
mov dword [esp], eax
call sym.__get_osfhandle
mov edx, 1
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov esi, eax
lea eax, [ebp - 0x34]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._PeekConsoleInputA_16
movzx edx, byte [ebx + 0x34]
xor ecx, ecx
and dl, 0xf7
and al, 1
sub esp, 0x10
shl al, 3
or dl, al
xor eax, eax
mov byte [ebx + 0x34], dl
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x19]
mov dword [esp + 0xc], edi
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sym._WriteFile_20
movzx edx, byte [ebx + 0x34]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
and dl, 0xcf
and al, 1
sub esp, 0x14
shl al, 4
or dl, al
xor eax, eax
mov byte [ebx + 0x34], dl
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x68630a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
test eax, eax
je 0x68630a90
cmp dword [eax + 0x44], 2
je 0x68630a85
mov eax, str.win32_channel__type__G_IO_WIN32_CONSOLE
mov ecx, str.g_io_win32_console_get_flags
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], 0x6869cf88
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
xor eax, eax
leave
ret
leave
jmp sym._g_io_win32_console_get_flags_internal
mov ecx, str.win32_channel___NULL
mov edx, str.g_io_win32_console_get_flags
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], 0x6869cf88
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
xor eax, eax
leave
ret
Function at 0x68630ac0
Capabilities:
Read file on windows
Read pipe
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
test dh, 0x10
je 0x68630b70
mov eax, dword [eax + 0x40]
xor edi, edi
xor esi, esi
mov dword [esp], eax
call sym.__get_osfhandle
xor ecx, ecx
mov dword [esp + 0x14], edi
lea edi, [ebp - 0x20]
mov dword [esp + 0x10], esi
lea esi, [ebp - 0x19]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._PeekNamedPipe_24
mov dl, 1
sub esp, 0x18
test eax, eax
je 0x68630c00
movzx eax, byte [ebx + 0x34]
shl dl, 3
and al, 0xf7
or al, dl
mov byte [ebx + 0x34], al
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sym.__get_osfhandle
xor edx, edx
mov dword [esp + 0xc], edi
xor edi, edi
mov dword [esp + 0x10], edx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
test eax, eax
movzx eax, byte [ebx + 0x34]
setne dl
shl dl, 4
and al, 0xcf
or al, dl
mov byte [ebx + 0x34], al
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [eax + 0x40]
xor esi, esi
lea edi, [ebp - 0x20]
mov dword [esp], eax
call sym.__get_osfhandle
xor ecx, ecx
mov dword [esp + 0x10], esi
lea esi, [ebp - 0x19]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
test eax, eax
movzx eax, byte [ebx + 0x34]
setne dl
shl dl, 3
and al, 0xf7
or al, dl
mov byte [ebx + 0x34], al
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sym.__get_osfhandle
xor edx, edx
mov dword [esp + 0xc], edi
xor edi, edi
mov dword [esp + 0x10], edx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
test eax, eax
movzx eax, byte [ebx + 0x34]
setne dl
shl dl, 4
and al, 0xef
or al, dl
or al, 0x20
mov byte [ebx + 0x34], al
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._GetLastError_0
cmp eax, 0x6d
sete dl
jmp 0x68630b14
Function at 0x68630c10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov dword [esp], 0xa4
call sym.libglib_2.0_0.dll_g_malloc
mov ebx, eax
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_io_channel_init
mov dword [esp], str.G_IO_WIN32_DEBUG
call sym._getenv
test eax, eax
setne al
movzx eax, al
mov dword [ebx + 0x48], eax
lea eax, [ebx + 0x50]
mov dword [esp], eax
call sym._InitializeCriticalSection_4
xor eax, eax
xor edx, edx
mov dword [ebx + 0x8c], eax
xor eax, eax
xor ecx, ecx
mov dword [ebx + 0x98], eax
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x80], edx
xor edx, edx
mov dword [ebx + 0x90], ecx
xor ecx, ecx
mov dword [ebx + 0x94], edx
xor edx, edx
sub esp, 4
test eax, eax
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov word [ebx + 0x7c], 0
mov dword [ebx + 0x9c], ecx
mov dword [ebx + 0xa0], edx
mov dword [ebx + 0x40], esi
jne 0x68630d02
movzx edx, word [edi]
test dh, 0x20
jne 0x68630ce3
mov eax, ebx
mov dword [ebx + 4], 0x68657780
mov dword [ebx + 0x44], 1
call sym._g_io_win32_fd_get_flags_internal
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
mov dword [ebx + 4], 0x68657760
mov dword [ebx + 0x44], 2
call sym._g_io_win32_console_get_flags_internal
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], str.g_io_channel_win32_new_fd:_channel_p_fd_u_n
call sym.libglib_2.0_0.dll_g_print
jmp 0x68630cbc

Function at 0x68630dc0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x68630e30
and esi, 2
je 0x68630e20
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x1c]
mov esi, 0x8004667e
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sym._ioctlsocket_12
mov edx, eax
sub esp, 0xc
inc edx
mov eax, 1
je 0x68630e51
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0
jmp 0x68630deb
mov dword [esp], str.g_io_win32_sock_set_flags:
call sym.libglib_2.0_0.dll_g_print
mov eax, esi
call sym._g_win32_print_gioflags
mov dword [esp], 0x6869cf8d
call sym.libglib_2.0_0.dll_g_print
jmp 0x68630ddf
call sym._WSAGetLastError_0
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_win32_error_message
mov ebx, eax
call sym.libglib_2.0_0.dll_g_io_channel_error_quark
mov ecx, 8
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov dword [esp], edi
mov dword [esp + 4], eax
call sym.libglib_2.0_0.dll_g_set_error_literal
mov dword [esp], ebx
call sym.libglib_2.0_0.dll_g_free
mov ebx, dword [ebp - 0xc]
xor eax, eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x68630ef0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x14]
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x68630f70
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
cmp eax, 0xffffffff
mov esi, eax
je 0x68631020
mov edx, dword [ebx + 0x48]
test edx, edx
jne 0x68630f90
cmp esi, 0xffffffff
je 0x68630fa5
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x68631005
xor ecx, ecx
mov eax, 1
mov dword [edi], esi
mov dword [ebx + 0x9c], ecx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x40]
mov dword [esp + 4], ebx
mov dword [esp], str.g_io_win32_sock_write:_channel_p_sock_d_count_u
mov dword [esp + 8], eax
call sym.libglib_2.0_0.dll_g_print
jmp 0x68630f0f
mov dword [esp + 4], esi
mov dword [esp], str._send_d
call sym.libglib_2.0_0.dll_g_print
cmp esi, 0xffffffff
jne 0x68630f45
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_win32_error_message
mov esi, eax
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x68631065
cmp dword [ebp - 0x1c], 0x2726
mov dword [edi], 0
je 0x68631030
cmp dword [ebp - 0x1c], 0x2733
je 0x68631040
mov ebx, 8
call sym.libglib_2.0_0.dll_g_io_channel_error_quark
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_set_error_literal
mov dword [esp], esi
call sym.libglib_2.0_0.dll_g_free
xor eax, eax
jmp 0x68630f5f
mov dword [esp], 0x6869cf8d
call sym.libglib_2.0_0.dll_g_print
jmp 0x68630f50
call sym._WSAGetLastError_0
mov dword [ebp - 0x1c], eax
jmp 0x68630f39
mov ebx, 1
jmp 0x68630fda
mov ecx, 1
xor edx, edx
mov dword [ebx + 0x9c], ecx
mov dword [ebx + 0x94], edx
mov dword [esp], esi
call sym.libglib_2.0_0.dll_g_free
mov eax, 3
jmp 0x68630f5f
mov dword [esp + 4], esi
mov dword [esp], str.__s_n
call sym.libglib_2.0_0.dll_g_print
jmp 0x68630fbd
Function at 0x68631080
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jne 0x686310f1
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
cmp eax, 0xffffffff
mov esi, eax
je 0x68631130
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x68631110
cmp esi, 0xffffffff
je 0x68631140
mov edx, dword [ebx + 0x48]
test edx, edx
jne 0x68631122
cmp esi, 1
sbb eax, eax
not eax
mov dword [edi], esi
add eax, 2
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x40]
mov dword [esp + 4], ebx
mov dword [esp], str.g_io_win32_sock_read:_channel_p_sock_d_count_u
mov dword [esp + 8], eax
call sym.libglib_2.0_0.dll_g_print
jmp 0x6863109f
mov dword [esp + 4], esi
mov dword [esp], str._recv_d
call sym.libglib_2.0_0.dll_g_print
jmp 0x686310cc
mov dword [esp], 0x6869cf8d
call sym.libglib_2.0_0.dll_g_print
jmp 0x686310d8
call sym._WSAGetLastError_0
mov dword [ebp - 0x1c], eax
jmp 0x686310c5
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_win32_error_message
mov ecx, dword [ebx + 0x48]
test ecx, ecx
mov esi, eax
jne 0x686311c0
cmp dword [ebp - 0x1c], 0x2726
mov dword [edi], 0
je 0x686311b2
cmp dword [ebp - 0x1c], 0x2733
mov ebx, 8
je 0x686311a0
call sym.libglib_2.0_0.dll_g_io_channel_error_quark
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_set_error_literal
mov dword [esp], esi
call sym.libglib_2.0_0.dll_g_free
xor eax, eax
jmp 0x686310e4
mov dword [esp], esi
call sym.libglib_2.0_0.dll_g_free
mov eax, 3
jmp 0x686310e4
mov ebx, 1
jmp 0x68631171
mov dword [esp + 4], eax
mov dword [esp], str.__s_n
call sym.libglib_2.0_0.dll_g_print
jmp 0x68631154
Function at 0x68632410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
jmp 0x6863246e
mov eax, 8
sub eax, edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
add eax, edi
mov dword [esp + 4], eax
call sym._read
mov edx, dword [0x686577e0]
test edx, edx
jne 0x686324a0
cmp eax, 0
jl 0x686324bb
je 0x68632510
add esi, eax
cmp esi, 7
mov edi, esi
ja 0x68632560
mov eax, dword [0x686577e0]
test eax, eax
je 0x68632430
mov eax, 8
mov ecx, str.gspawn_win32.c
sub eax, edi
mov dword [esp + 8], eax
mov dword [ebp - 0x24], eax
mov dword [esp + 4], ecx
mov dword [esp], str._s:read_helper_report:_read__u..._n
call sym.libglib_2.0_0.dll_g_print
mov eax, dword [ebp - 0x24]
jmp 0x68632437
mov dword [esp + 4], eax
mov dword [ebp - 0x24], eax
mov dword [esp], str....got__d_bytes_n
call sym.libglib_2.0_0.dll_g_print
mov eax, dword [ebp - 0x24]
cmp eax, 0
jge 0x6863245b
call sym.__errno
mov edi, 0x13
mov eax, dword [eax]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_strerror
mov dword [esp], str.Failed_to_read_from_child_pipe___s_
mov esi, eax
call sym.libglib_2.0_0.dll_glib_gettext
mov ebx, eax
call sym.libglib_2.0_0.dll_g_spawn_error_quark
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_set_error
add esp, 0x3c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Failed_to_read_from_child_pipe___s_
mov esi, 0x6869e26c
call sym.libglib_2.0_0.dll_glib_gettext
mov ebx, eax
call sym.libglib_2.0_0.dll_g_spawn_error_quark
mov dword [esp + 0xc], ebx
mov ebx, 0x13
mov dword [esp + 0x10], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_set_error
xor eax, eax
cmp edi, 7
seta al
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x68633c60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x20]
test edx, edx
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x24]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x2c]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp + 0x28]
mov dword [ebp - 0x28], ecx
je 0x68633db0
test ebx, ebx
je 0x68633cac
test al, 8
jne 0x68633d20
test edi, edi
nop
je 0x68633cba
test al, 0x10
jne 0x68633d50
test esi, esi
lea esi, [esi]
je 0x68633cca
test al, 0x20
jne 0x68633d80
mov ecx, eax
and ecx, 2
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x28]
mov dword [ebp + 0x20], ebx
mov ebx, dword [ebp - 0x24]
mov dword [ebp + 0x24], edi
mov edi, dword [ebp - 4]
mov dword [ebp + 0x1c], esi
mov esi, dword [ebp - 8]
mov dword [ebp + 0x2c], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp + 0x18], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp + 0x10], eax
xor eax, eax
mov dword [ebp + 8], edx
mov edx, dword [ebp - 0x2c]
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp + 0x28], 0
mov esp, ebp
pop ebp
jmp sym._do_spawn_with_pipes
mov edi, str.standard_output__NULL____flags__G_SPAWN_STDOUT_TO_DEV_NULL_
mov esi, str.g_spawn_async_with_pipes_utf8
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], 0x6869e2bd
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
mov ebx, dword [ebp - 0xc]
xor eax, eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, str.standard_error__NULL____flags__G_SPAWN_STDERR_TO_DEV_NULL_
mov ecx, str.g_spawn_async_with_pipes_utf8
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], 0x6869e2bd
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
mov ebx, dword [ebp - 0xc]
xor eax, eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, str.g_spawn_async_with_pipes_utf8
mov edx, str.standard_input__NULL____flags__G_SPAWN_CHILD_INHERITS_STDIN_
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], 0x6869e2bd
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
mov ebx, dword [ebp - 0xc]
xor eax, eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, str.argv___NULL
mov eax, str.g_spawn_async_with_pipes_utf8
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x6869e2bd
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
jmp 0x68633d3e
Function at 0x686343f0
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [esp], str.LC_ALL
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
call sym._getenv
test eax, eax
je 0x68634418
cmp byte [eax], 0
jne 0x686344f0
mov dword [esp], str.LC_MESSAGES
call sym._getenv
test eax, eax
je 0x68634431
cmp byte [eax], 0
jne 0x686344f0
mov dword [esp], str.LANG
call sym._getenv
test eax, eax
je 0x6863444a
cmp byte [eax], 0
jne 0x686344f0
lea esi, [esi]
call sym._GetThreadLocale_0
mov esi, 0xa
mov ecx, 0x59
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x22]
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov ebx, eax
mov dword [esp], eax
call sym._GetLocaleInfoA_16
sub esp, 0x10
test eax, eax
je 0x68634505
mov edx, 0xa
mov eax, 0x5a
lea edi, [ebp - 0x2c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._GetLocaleInfoA_16
sub esp, 0x10
test eax, eax
je 0x68634505
movzx ebx, bx
mov eax, ebx
and ebx, 0x3ff
shr eax, 0xa
cmp ebx, 0x2c
je 0x68634534
cmp ebx, 0x43
je 0x68634520
cmp ebx, 0x1a
je 0x68634550
xor eax, eax
xor ecx, ecx
mov edx, 0x6869e7cf
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], esi
call sym.libglib_2.0_0.dll_g_strconcat
jmp 0x686344f8
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_strdup
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], 0x6869e7cd
call sym.libglib_2.0_0.dll_g_strdup
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
dec eax
movzx edx, ax
xor eax, eax
cmp edx, 1
ja 0x686344ce
mov eax, dword [edx*4 + 0x6869e870]
jmp 0x686344ce
dec eax
movzx edx, ax
xor eax, eax
cmp edx, 1
ja 0x686344ce
mov eax, dword [edx*4 + 0x6869e854]
jmp 0x686344ce
sub eax, 2
movzx edx, ax
xor eax, eax
cmp edx, 4
ja 0x686344ce
mov eax, dword [edx*4 + 0x6869e85c]
jmp 0x686344ce

Function at 0x686372b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov dword [esp], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
call sym.__g_gnulib_vasnprintf
mov ebx, eax
mov eax, 0xffffffff
test ebx, ebx
je 0x6863730d
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sym._fwrite
mov dword [esp], ebx
call sym.libglib_2.0_0.dll_g_free
mov eax, dword [ebp - 0xc]
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x68637c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], edx
movzx ebx, byte [eax]
cmp bl, 0x53
je 0x68637c37
ja 0x68637c45
cmp bl, 4
jb 0x68637c90
cmp bl, 5
ja 0x68637c80
test esi, esi
je 0x68637c90
movzx ebx, bl
movzx ebx, byte [ebx + 0x686a15c0]
add eax, ebx
jmp 0x68637c1f
cmp bl, 0x59
jb 0x68637c90
cmp bl, 0x5b
ja 0x68637ca0
test esi, esi
je 0x68637c90
lea esi, [esi]
lea edi, [edi]
movzx ebx, byte [eax + 1]
movzx edi, byte [eax + 2]
shl ebx, 8
or ebx, edi
add eax, ebx
movzx ebx, byte [eax]
cmp bl, 0x54
je 0x68637c60
jmp 0x68637c37
cmp bl, 0x19
je 0x68637cb2
lea esi, [esi]
lea edi, [edi]
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
mov dl, bl
sub dl, 0x64
cmp dl, 2
jbe 0x68637c37
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
test ecx, ecx
jle 0x68637cc7
movzx ebx, byte [eax + 1]
mov edx, dword [ebp - 0x14]
mov edi, ebx
xor edi, dword [edx]
test edi, ecx
je 0x68637cc7
mov dword [edx], ebx
add eax, 2
jmp 0x68637c1f
Function at 0x68651500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [sym.imp.msvcrt.dll__iob]
mov dword [ebp - 4], esi
lea esi, [ebp + 0xc]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], 0x686a1e68
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort

Function at 0x68651550
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x68651576
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6865160a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x686515c5
cmp eax, 0x40
je 0x686515c5
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x68651569
cmp eax, 0x40
je 0x68651569
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x68651569
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
lea esi, [esi]
lea edi, [edi]