joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, 0xc
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword fs:[0x18]
sub esp, 0x2bc
mov dword [ebp - 0x29c], 0xc
lea esi, [esi]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
lea eax, [ebp - 0x29c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], edi
call sym._GetUdpTable_12
sub esp, 0xc
mov esi, eax
test eax, eax
jne 0x401af0
mov eax, dword [edi]
lea ebx, [ebp - 0x258]
test eax, eax
je 0x401abc
nop
mov eax, dword [edi + esi*8 + 4]
mov edx, ebx
call sym._NETSTAT_host_name.isra.0
movzx eax, word [edi + esi*8 + 8]
inc esi
mov dword [esp + 8], 0x4062e4
mov dword [esp + 4], 0x20
rol ax, 8
movzx eax, ax
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x298]
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x298]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x158]
mov dword [esp + 8], str._s:_s
mov dword [esp + 4], 0xa0
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x158]
mov dword [esp + 4], 0x4065cc
mov dword [esp + 8], eax
mov dword [esp], str.____6s___22s_:_n
call sym._NETSTAT_wprintf
cmp dword [edi], esi
ja 0x401a30
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
cmp esi, 0x7a
jne 0x401ae0
mov eax, dword [ebp - 0x29c]
jmp 0x4019d8
Function at 0x402730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40278b
cmp byte [esi + ebx - 1], 0xa
je 0x40275f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405100], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x403360
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000c455
pop dword [ebp - 0x24]
mov eax, 0xddf04e02
add eax, 0x32107653
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3934d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x48ec
mov edx, eax
mov edi, 0xb28aaa4f
sub edi, 0xa289244f
add edi, dword [ebp - 0x24]
mov esi, 0x74fd23d7
sub esi, 0xda2ed069
sub dword [ebp - 0x18], 0xfb051f36
mov ebx, dword [edi]
add dword [ebp - 0x18], eax
add ebx, esi
xor dword [ebp - 0x20], 0xaaec0620
mov dword [edx], ebx
sub dword [ebp - 0x20], ebx
add edx, 0x51b1e927
add edx, 0xae4e16dd
add edi, 4
loop 0x1000c4a9
add eax, 0x11683
mov ebx, eax
add eax, 5
mov ecx, 0x58b8acd9
add ecx, 0xb7475327
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x1000dcc4
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
mov edi, 0x100834d0
push edi
call sym.glib_lite.dll_Ordinal_240
xor esi, esi
inc esi
pop ecx
test eax, eax
je 0x1000dcff
push str.G_MAIN_POLL_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ecx, dword [0x100834b0]
test eax, eax
push esi
cmovne ecx, esi
push edi
mov dword [0x100834b0], ecx
call sym.glib_lite.dll_Ordinal_241
add esp, 0xc
push ebx
push 0x70
push esi
call sym.glib_lite.dll_Ordinal_200
mov edi, eax
push edi
call sym.glib_lite.dll_Ordinal_211
lea ecx, [edi + 8]
push ecx
call sym.glib_lite.dll_Ordinal_52
xor ebx, ebx
push ebx
push ebx
call sym.glib_lite.dll_Ordinal_128
mov dword [edi + 0x24], eax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], esi
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], ebx
mov dword [edi + 0x5c], 0x1001baf7
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
call fcn.100016bb
mov dword [edi + 0x28], eax
mov dword [edi + 0x68], ebx
call fcn.1001c0f2
lea esi, [edi + 0x50]
mov dword [edi + 0x4c], eax
push esi
push eax
call fcn.1001c0de
push esi
push ebx
push edi
call fcn.1000d835
mov esi, 0x100834c4
push esi
call sym.glib_lite.dll_Ordinal_212
push edi
push dword [0x100834cc]
call sym.glib_lite.dll_Ordinal_328
add esp, 0x38
mov dword [0x100834cc], eax
cmp dword [0x100834b0], 0
pop ebx
je 0x1000dd9c
push edi
push str.created_context_p_n
call fcn.1001478e
pop ecx
pop ecx
push esi
call sym.glib_lite.dll_Ordinal_213
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x1000f4ca
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x10083304]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
lea eax, [ebp - 0x80]
xor esi, esi
push eax
push dword [ebp + 0x19c]
mov dword [ebp - 0x80], esi
push esi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x1000f52c
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1000f523
push esi
push esi
push esi
lea eax, [ebp - 0x7c]
push 0xffffffffffffffff
push eax
call sym.glib_lite.dll_Ordinal_446
add esp, 0x14
mov esi, eax
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x190]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100319bd
add ebp, 0x194
leave
ret
Function at 0x10010d21
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1040
call fcn.10031b90
mov eax, dword [0x10083304]
xor eax, esp
mov dword [esp + 0x103c], eax
and dword [esp], 0
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x1048]
push edi
mov edi, dword [esp + 0x1058]
push eax
push dword [esp + 0x1054]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64]
pop ecx
pop ecx
test eax, eax
jns 0x10010d93
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [eax]
push esi
call sym.glib_lite.dll_Ordinal_364
pop ecx
push eax
push esi
call fcn.100030dd
pop ecx
push eax
call fcn.100031d3
push eax
push edi
call fcn.1001478e
add esp, 0x10
xor eax, eax
jmp 0x10010e72
test dword [esp + 0x12], 0x8000
jne 0x10010dab
push str.Not_a_regular_file
push 1
call fcn.10010763
jmp 0x10010d82
push ebx
mov bl, byte [esi + 0x14]
push esi
call fcn.100106e7
push esi
call fcn.10010bbf
mov eax, dword [esp + 0x1060]
pop ecx
pop ecx
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], eax
push ebp
push 0x1000
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1060]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [eax]
test ebp, ebp
je 0x10010e3e
jns 0x10010e20
cmp ebx, 4
je 0x10010e34
cmp ebx, 0xb
je 0x10010e34
push ebx
call sym.glib_lite.dll_Ordinal_364
pop ecx
push eax
push ebx
call fcn.100030dd
pop ecx
push eax
call fcn.100031d3
push eax
push edi
call fcn.1001478e
add esp, 0x10
jmp 0x10010e69
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x54]
push eax
push esi
call fcn.100110da
add esp, 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10010dcb
jmp 0x10010e46
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10010e49
push eax
jmp 0x10010e61
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1001478e
cmp dword [esp + 0x18], 0
pop ecx
pop ecx
je 0x10010e6d
push dword [esp + 0x10]
push edi
call fcn.1001478e
pop ecx
pop ecx
xor eax, eax
jmp 0x10010e70
xor eax, eax
inc eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x1044]
pop edi
pop esi
xor ecx, esp
call fcn.100319bd
add esp, 0x1040
ret
Function at 0x100142b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, dword [edx + 0x9c0]
cmp edi, 0x270
jb 0x10014365
push ebx
push ebp
xor edi, edi
mov ebp, closesocket
push esi
mov esi, edi
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebp
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x10038110]
xor ecx, dword [edx + esi*4 + 0x634]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0xe3
jl 0x100142d3
mov ebx, 0x26f
jmp 0x1001432c
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebp
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x10038110]
xor ecx, dword [edx + esi*4 - 0x38c]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, ebx
jl 0x10014307
mov ecx, dword [edx + 0x9bc]
xor ecx, dword [edx]
and ecx, ebp
xor ecx, dword [edx + 0x9bc]
mov eax, ecx
shr ecx, 1
and eax, 1
pop esi
pop ebp
pop ebx
mov eax, dword [eax*4 + 0x10038110]
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
mov dword [edx + 0x9c0], edi
mov ecx, dword [edx + edi*4]
lea eax, [edi + 1]
mov dword [edx + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop edi
ret

Function at 0x1001478e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001479d
pop dword [ebp - 0x44]
mov eax, 0xffc44bdc
sub eax, 0xefc3043f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x59b773c2
add dword [ebp - 0x54], 0xf49ad189
mov dword [ebp - 0x50], 0x5f957166
sub dword [ebp - 0x50], 0x2d622521
mov dword [ebp - 0x4c], 0x591759db
add dword [ebp - 0x4c], 0xf334ea53
mov dword [ebp - 0x48], 0xb23fdd62
add dword [ebp - 0x48], 0x4dc0229e
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x35428cf1
add dword [ebp - 0x54], 0x3f2fdc65
mov dword [ebp - 0x50], 0x95b7788a
sub dword [ebp - 0x50], 0x544b1715
mov dword [ebp - 0x4c], 0xfd569735
add dword [ebp - 0x4c], 0x6618d537
mov dword [ebp - 0x48], 0x971e222c
sub dword [ebp - 0x48], 0x971e222c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x8d64a1e8
sub eax, 0x7d615084
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3f3e3
push 0
call eax
mov ecx, 0xd8423ac0
sub ecx, 0xd841e219
xor edi, edi
add edi, eax
mov ebx, 0x41d51ec5
sub ebx, 0x31cc9ac5
add ebx, dword [ebp - 0x44]
mov edx, 0x7732e75b
add edx, 0xa481bc72
add dword [ebp - 0x14], 0xbc008b7
mov esi, dword [ebx]
sub esi, edx
add dword [ebp - 0x40], esi
mov dword [edi], esi
xor dword [ebp - 0x24], esi
add edi, 0x9e37f5fb
sub edi, 0x9e37f5f7
add ebx, 0x7a51a55
sub ebx, 0x7a51a51
loop 0x100148bc
add eax, 0x229b679a
sub eax, 0x229a122b
mov ebx, eax
add eax, 5
mov ecx, 0x2cfba52c
sub ecx, 0x1cfba52c
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10014c64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xa0
mov eax, dword [0x10083304]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0xa8]
push ebp
push esi
mov esi, dword [esp + 0xb8]
push edi
xor edi, edi
mov dword [esp + 0x18], ebx
push ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x10014cc9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push esi
jmp 0x10014df3
mov edx, 0x80
test esi, esi
je 0x10014ce0
test ebp, 0x400
mov eax, 0x200080
cmovne edx, eax
mov ecx, edx
mov eax, ebp
push edi
or ecx, 0x2000000
and al, 0x10
cmove ecx, edx
push ecx
push 3
push edi
push 7
push 0x88
push ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10014cb5
lea eax, [esp + 0x78]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetFileInformationByHandle]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x10014de2
push 0x18
lea eax, [esp + 0x64]
push eax
push 1
push ebx
call dword [sym.imp.kernel32.dll_GetFileInformationByHandleEx]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x10014de2
mov esi, dword [esp + 0x18]
test ebp, 0x400
je 0x10014d9b
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
xor edx, edx
test ecx, ecx
push 1
cmovne eax, edx
push eax
push edi
push edi
lea eax, [esp + 0x24]
push eax
xor eax, eax
test ecx, ecx
cmovne eax, ebx
test ecx, ecx
push eax
mov eax, esi
cmovne eax, edx
push eax
call fcn.1001478e
add esp, 0x1c
test eax, eax
jns 0x10014d97
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x10014dff
mov edi, dword [esp + 0x14]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x18]
push esi
call fcn.1001478e
push dword [esp + 0x20]
call sym.glib_lite.dll_Ordinal_109
push dword [esp + 0x38]
lea eax, [esp + 0x78]
push edi
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.1001478e
add esp, 0x28
xor eax, eax
jmp 0x10014e02
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [esp + 0x1c]
mov ecx, eax
call fcn.100152e4
add esp, 4
mov dword [ecx], eax
or eax, 0xffffffff
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100319bd
add esp, 0xa0
ret
Function at 0x100199e1
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ecx
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push 1
push esi
push 0x10038770
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10019a70
push ebp
lea eax, [esp + 8]
mov dword [esp + 8], esi
push eax
push esi
push esi
push esi
mov ebp, str.TimeZoneKeyName
push ebp
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10019a65
push edi
push dword [esp + 0xc]
call sym.glib_lite.dll_Ordinal_198
mov edi, eax
pop ecx
test edi, edi
je 0x10019a5d
lea eax, [esp + 0xc]
push eax
push edi
push esi
push esi
push ebp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10019a5d
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
call sym.glib_lite.dll_Ordinal_446
add esp, 0x14
mov esi, eax
jmp 0x10019a64
push edi
call sym.glib_lite.dll_Ordinal_109
pop ecx
pop edi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop esi
pop ecx
pop ecx
ret

Function at 0x1001b19d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10083304]
xor eax, ebp
mov dword [ebp - 4], eax
push str.G_DEBUG
mov dword [ebp - 0x1c], str.gc_friendly
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], str.fatal_warnings
mov dword [ebp - 0x10], 0x18
mov dword [ebp - 0xc], str.fatal_criticals
mov dword [ebp - 8], 8
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
pop ecx
test eax, eax
je 0x1001b1f6
push 3
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.1001b2b4
add esp, 0xc
mov ecx, eax
and eax, 1
and ecx, 0xfffffffc
mov dword [0x10083768], eax
or dword [0x10083210], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100319bd
leave
ret

Function at 0x1001f1fc
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [edi + 0x74]
push eax
xor eax, eax
push eax
push edi
push dword [esp + 0x20]
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test esi, esi
jne 0x1001f243
push dword [eax]
call sym.glib_lite.dll_Ordinal_364
push eax
push str.Error_creating_thread:__s.
push 0x10
push str.Glib
call sym.glib_lite.dll_Ordinal_186
add esp, 0x14
jmp 0x1001f277
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1001f277
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.1001478e
mov esi, eax
push esi
push str.Error_closing_thread_handle:__s.
push 0x10
push str.Glib
call sym.glib_lite.dll_Ordinal_186
push esi
call sym.glib_lite.dll_Ordinal_109
add esp, 0x18
push 0xffffffffffffffff
push dword [edi + 0x8c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
pop edi
pop esi
ret
Function at 0x40107e
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.004362a0
mov eax, dword [0x446408]
add eax, 1
mov dword [0x446408], eax
mov dword [ebp - 0x200c], 0x2000
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2010], eax
cmp dword [ebp - 0x2010], 0xffffffff
jne 0x4010ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2014], eax
cmp dword [ebp - 0x2014], 2
je 0x4010eb
cmp dword [ebp - 0x2014], 3
jne 0x4010f5
mov eax, 3
jmp 0x4011e1
mov eax, 2
jmp 0x4011e1
mov byte [ebp - 4], 1
mov dword [ebp - 0x2008], 0
mov edx, dword [ebp - 4]
and edx, 0xff
test edx, edx
je 0x4011c5
push 0
lea eax, [ebp - 0x2008]
push eax
push 0x2000
lea ecx, [ebp - 0x2004]
push ecx
mov edx, dword [ebp - 0x2010]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40115b
mov eax, dword [ebp - 0x2010]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
jmp 0x4011e1
mov dword [ebp - 0x2018], 0
jmp 0x401176
mov ecx, dword [ebp - 0x2018]
add ecx, 1
mov dword [ebp - 0x2018], ecx
mov edx, dword [ebp - 0x2018]
cmp edx, dword [ebp + 0xc]
jae 0x4011ae
mov eax, dword [ebp - 0x2008]
push eax
lea ecx, [ebp - 0x2004]
push ecx
mov edx, dword [ebp - 0x2018]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4]
mov edx, dword [ebp - 0x2018]
mov eax, dword [ebp + 8]
mov edx, dword [eax + edx*4]
mov eax, dword [edx]
call dword [eax + 4]
jmp 0x401167
xor ecx, ecx
cmp dword [ebp - 0x2008], 0x2000
sete cl
mov byte [ebp - 4], cl
jmp 0x40110d
mov edx, dword [ebp - 0x2010]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x446400]
add eax, dword [ebp + 0xc]
mov dword [0x446400], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x408fe0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
add edi, 0x50
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
leave
ret 4

Function at 0x4096a4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
cld
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x50]
mov ebx, eax
and ebx, 0x3f
mov edx, dword [edi + 0x54]
add eax, eax
adc edx, edx
add eax, eax
adc edx, edx
add eax, eax
adc edx, edx
cmp ebx, 0x38
jb 0x40973b
mov ecx, 0x40
sub ecx, ebx
add edi, 0x10
add edi, ebx
mov esi, 0x409798
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x10
call fcn.00409013
mov ebx, edi
mov dword [edi + 0x38], eax
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov dword [edi + 4], edx
mov edi, ebx
call fcn.00409013
mov ecx, 4
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
add edi, 0x50
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8
mov ecx, 0x38
sub ecx, ebx
mov esi, 0x409798
add edi, 0x10
add edi, ebx
rep movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
mov eax, edx
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x10
call fcn.00409013
mov ecx, 4
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
add edi, 0x50
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x40a180
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
add edi, 0x50
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
leave
ret 4