joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005088c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.10050690
mov ecx, dword [ebx]
call fcn.10050504
mov esi, eax
test esi, esi
je 0x10050920
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push ebp
call fcn.10050260
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebp, eax
mov dword [esp + 0x10], edi
lea eax, [esp + 0x10]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1005091a
mov ecx, dword [esi]
cmp dword [esi + 4], edi
jbe 0x100508e8
mov al, byte [esi + edi + 0x4c]
mov byte [edi + ecx], al
inc edi
cmp edi, dword [esi + 4]
jb 0x100508db
push dword [esi + 4]
mov edx, dword [esi]
mov ecx, ebp
call fcn.1004f3ce
pop ecx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push dword [esi + 4]
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esi]
xor edi, edi
xor edx, edx
mov dword [ebx], eax
mov ecx, esi
inc edi
call fcn.100504d1
call fcn.100503c3
pop ebp
call fcn.10050684
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x536970
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc8000]
push edi
jmp 0x53698a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x536991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x536980
mov eax, 1
add ebx, ebx
jne 0x5369a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5369b4
jne 0x5369d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5369d3
dec eax
add ebx, ebx
jne 0x5369c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x536998
add ebx, ebx
jne 0x5369cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x536a25
xor ecx, ecx
sub eax, 3
jb 0x5369eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x536a5a
sar eax, 1
mov ebp, eax
jmp 0x5369f6
add ebx, ebx
jne 0x5369f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5369c4
inc ecx
add ebx, ebx
jne 0x536a04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5369c4
add ebx, ebx
jne 0x536a11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x536a06
jne 0x536a22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x536a06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x536a44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x536a36
jmp 0x536986
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x536a44
add edi, ecx
jmp 0x536986
pop esi
mov edi, esi
mov ecx, 0x99dd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x536a62
cmp byte [edi], 0x24
jne 0x536a62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x536a67
lea edi, [esi + 0x132000]
mov eax, dword [edi]
or eax, eax
je 0x536adf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13d45c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13d5c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x536a94
mov ecx, edi
jns 0x536ac3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13d5c8]
or eax, eax
je 0x536ad9
mov dword [ebx], eax
add ebx, 4
jmp 0x536ab1
call dword [esi + 0x13d5d8]
mov ebp, dword [esi + 0x13d5cc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x536b13
sub esp, 0xffffff80
jmp 0x4b3786

Function at 0xd5c658
Capabilities:
Encode data using xor

Disassembly:
jmp 0xd5c662
pushal
call 0xd5c668
pop ebp
sub ebp, 0x10
sub ebp, 0x95c658
jmp 0xd5c67e
mov eax, 0x95c658
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b2
mov edx, 0xb8439b0b
xor byte [eax], dl
inc eax
dec ecx
jne 0xd5c695
jmp 0xd5c6a8
add dh, 0x80
xor byte [edi], 0xb
or ecx, dword [ebx]
mov cl, dl
or ecx, dword [ebx]
or ecx, dword [eax]
invalid
Function at 0x685cf350
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x685cf470
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_free
mov eax, dword [ebx]
mov dword [ebx + 4], 0
cmp eax, 1
je 0x685cf430
jae 0x685cf3b1
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
mov dword [ebx + 0x10], 0x98badcfe
mov dword [ebx + 0x14], 0x10325476
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x18], 0
add esp, 0x24
pop ebx
pop ebp
ret
cmp eax, 2
je 0x685cf3e3
xor ebx, ebx
mov ecx, str.g_checksum_reset
mov edx, 0x495
mov eax, str.gchecksum.c
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x686599a4
call sym.libglib_2.0_0.dll_g_assertion_message
mov dword [ebx + 8], 0x6a09e667
mov dword [ebx + 0xc], 0xbb67ae85
mov dword [ebx + 0x10], 0x3c6ef372
mov dword [ebx + 0x14], 0xa54ff53a
mov dword [ebx + 0x18], 0x510e527f
mov dword [ebx + 0x1c], 0x9b05688c
mov dword [ebx + 0x20], 0x1f83d9ab
mov dword [ebx + 0x24], 0x5be0cd19
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x28], 0
add esp, 0x24
pop ebx
pop ebp
ret
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
mov dword [ebx + 0x10], 0x98badcfe
mov dword [ebx + 0x14], 0x10325476
mov dword [ebx + 0x18], 0xc3d2e1f0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x1c], 0
add esp, 0x24
pop ebx
pop ebp
ret
mov ebx, str.checksum___NULL
mov ecx, str.g_checksum_reset
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], 0x686599a4
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x685db230
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov eax, 0xffffffff
mov ebp, esp
sub esp, 0x48
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0xc], ebx
xor ebx, ebx
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_utf8_to_utf16
test eax, eax
mov ebx, eax
je 0x685db300
mov dword [esp], eax
call sym._GetFileAttributesW_4
sub esp, 4
mov dword [ebp - 0x24], eax
mov dword [esp], ebx
call sym.libglib_2.0_0.dll_g_free
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
je 0x685db300
test edi, 0x10
mov esi, 1
jne 0x685db300
test edi, 1
je 0x685db2ab
test al, 0x50
je 0x685db300
test edi, 4
je 0x685db2bc
test al, 0x10
mov esi, 1
jne 0x685db300
and edi, 8
je 0x685db310
mov eax, dword [ebp + 8]
mov edi, 0x2e
xor esi, esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._strrchr
test eax, eax
mov ebx, eax
je 0x685db300
mov esi, str..exe
mov dword [esp + 4], esi
mov esi, 1
mov dword [esp], eax
call sym.__stricmp
test eax, eax
jne 0x685db321
mov esi, esi
lea edi, [edi]
mov eax, esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
xor esi, esi
mov ebx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov ecx, str..cmd
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sym.__stricmp
test eax, eax
je 0x685db300
mov edx, str..bat
mov dword [esp + 4], edx
mov dword [esp], ebx
call sym.__stricmp
test eax, eax
je 0x685db300
mov eax, str..com
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.__stricmp
test eax, eax
je 0x685db300
mov dword [esp], 0x6865c534
xor esi, esi
call sym.libglib_2.0_0.dll_g_getenv_utf8
test eax, eax
je 0x685db300
mov edi, 0xffffffff
mov esi, 0xffffffff
mov dword [esp + 4], edi
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_utf8_casefold
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [ebp - 0x20], eax
call sym.libglib_2.0_0.dll_g_utf8_casefold
mov dword [esp], eax
mov dword [ebp - 0x1c], eax
call sym._strlen
mov edi, dword [ebp - 0x20]
mov ebx, eax
jmp 0x685db3b8
cmp byte [eax], 0
je 0x685db40d
lea edi, [eax + 1]
mov ecx, 0x3b
mov dword [esp + 4], ecx
mov dword [esp], edi
call sym._strchr
test eax, eax
je 0x685db400
mov edx, eax
sub edx, edi
cmp edx, ebx
jne 0x685db3b0
mov esi, dword [ebp - 0x1c]
cmp ebx, ebx
mov ecx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x685db3b0
mov eax, dword [ebp - 0x20]
mov esi, 1
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_free
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_free
jmp 0x685db300
mov dword [esp], edi
call sym._strlen
lea eax, [edi + eax]
jmp 0x685db3cd
mov eax, dword [ebp - 0x20]
xor esi, esi
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_free
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_free
jmp 0x685db300
Function at 0x685dcac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, str.XXXXXX
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_strrstr
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x685dcc8a
lea eax, [ebp - 0x20]
mov edi, 0x38e38e39
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_get_current_time
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov eax, dword [0x686a4180]
mov edx, dword [ebp - 0x2c]
xor esi, ebx
add esi, eax
inc eax
inc edx
mov dword [0x686a4180], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edx
mov edx, dword [ebp - 0x2c]
add eax, 2
add edx, 3
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x2c]
add eax, 4
mov dword [ebp - 0x3c], eax
add edx, 5
lea eax, [esi + 0xbbf83]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], eax
jmp 0x685dcb60
call sym.__errno
cmp dword [eax], 0x11
jne 0x685dcc65
cmp esi, dword [ebp - 0x44]
je 0x685dcc72
add esi, 0x1e61
mov eax, esi
imul edi
mov eax, esi
sar eax, 0x1f
mov ecx, edx
mov edx, esi
sar ecx, 3
sub ecx, eax
lea eax, [ecx + ecx*8]
shl eax, 2
sub edx, eax
movzx eax, byte [edx + 0x6865c8e0]
mov edx, dword [ebp - 0x2c]
mov byte [edx], al
mov eax, ecx
imul edi
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
mov edx, dword [ebp - 0x30]
sar ebx, 3
sub ebx, eax
lea eax, [ebx + ebx*8]
shl eax, 2
sub ecx, eax
movzx eax, byte [ecx + 0x6865c8e0]
mov byte [edx], al
mov eax, ebx
imul edi
mov eax, ebx
sar eax, 0x1f
mov ecx, edx
mov edx, dword [ebp - 0x34]
sar ecx, 3
sub ecx, eax
lea eax, [ecx + ecx*8]
shl eax, 2
sub ebx, eax
movzx eax, byte [ebx + 0x6865c8e0]
mov byte [edx], al
mov eax, ecx
imul edi
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
mov edx, dword [ebp - 0x38]
sar ebx, 3
sub ebx, eax
lea eax, [ebx + ebx*8]
shl eax, 2
sub ecx, eax
movzx eax, byte [ecx + 0x6865c8e0]
mov byte [edx], al
mov eax, ebx
imul edi
mov eax, ebx
sar eax, 0x1f
mov ecx, edx
mov edx, dword [ebp - 0x3c]
sar ecx, 3
sub ecx, eax
lea eax, [ecx + ecx*8]
shl eax, 2
sub ebx, eax
movzx eax, byte [ebx + 0x6865c8e0]
mov byte [edx], al
mov eax, ecx
imul edi
mov eax, ecx
sar eax, 0x1f
sar edx, 3
sub edx, eax
lea eax, [edx + edx*8]
mov edx, dword [ebp - 0x40]
shl eax, 2
sub ecx, eax
movzx eax, byte [ecx + 0x6865c8e0]
mov ecx, 0x180
mov byte [edx], al
mov edx, 0x8502
mov eax, dword [ebp + 8]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._open
test eax, eax
js 0x685dcb43
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x4c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.__errno
mov dword [eax], 0x11
add esp, 0x4c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x685dcc5d
Function at 0x685e5e70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1058
call fcn.68651aa0
mov eax, dword [ebp - 0x10]
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x1c], 0
mov dword [esp], edx
mov edi, eax
lea eax, [ebp - 0x50]
mov dword [esp + 4], eax
call sym.__fstati64
test eax, eax
js 0x685e6020
movzx eax, word [ebp - 0x4a]
and eax, 0xf000
cmp eax, 0x8000
jne 0x685e5f80
mov eax, dword [ebp - 0x34]
or eax, dword [ebp - 0x38]
je 0x685e5fa2
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x685e6003
mov dword [edi + 0x1c], ebx
lea ebx, [ebp - 0x1050]
jmp 0x685e5efc
lea edx, [ebp - 0x1c]
mov ecx, eax
mov dword [esp], edx
mov eax, edi
mov edx, ebx
call sym._g_key_file_parse_data
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x685e5fe7
mov ecx, 0x1000
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._read
cmp eax, 0
je 0x685e5fe0
jge 0x685e5ee0
lea esi, [esi]
call sym.__errno
cmp dword [eax], 4
je 0x685e5ef1
call sym.__errno
cmp dword [eax], 0xb
je 0x685e5ef1
call sym.__errno
mov eax, dword [eax]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_strerror
mov esi, eax
call sym.__errno
mov eax, dword [eax]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_file_error_from_errno
mov ebx, eax
call sym.libglib_2.0_0.dll_g_file_error_quark
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym.libglib_2.0_0.dll_g_set_error_literal
xor eax, eax
add esp, 0x105c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Not_a_regular_file
call sym.libglib_2.0_0.dll_glib_gettext
mov ebx, eax
call sym.libglib_2.0_0.dll_g_key_file_error_quark
mov ecx, 1
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
jmp 0x685e5f63
mov dword [esp], str.File_is_empty
call sym.libglib_2.0_0.dll_glib_gettext
mov ebx, eax
call sym.libglib_2.0_0.dll_g_key_file_error_quark
mov edx, 1
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_set_error_literal
add esp, 0x105c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x685e6054
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_propagate_error
add esp, 0x105c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
call sym._g_key_file_clear
mov eax, edi
call sym._g_key_file_init
jmp 0x685e5ed3
call sym.__errno
mov eax, dword [eax]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_strerror
mov esi, eax
call sym.__errno
mov eax, dword [eax]
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_file_error_from_errno
mov ebx, eax
call sym.libglib_2.0_0.dll_g_file_error_quark
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
jmp 0x685e5fc2
lea edx, [ebp - 0x1c]
mov eax, edi
call sym._g_key_file_flush_parse_buffer
mov edx, dword [ebp - 0x1c]
mov eax, 1
test edx, edx
je 0x685e5f74
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sym.libglib_2.0_0.dll_g_propagate_error
xor eax, eax
jmp 0x685e5f74
Function at 0x685eaca0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov dword [esp], 0x60
call sym.libglib_2.0_0.dll_g_malloc0
mov ebx, eax
mov eax, dword [0x686a41a8]
test eax, eax
je 0x685eadc0
mov dword [esp], ebx
call sym.libglib_2.0_0.dll_g_static_mutex_init
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x14], 1
mov dword [ebx + 0x20], 1
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x50], sym.libglib_2.0_0.dll_g_poll
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
call sym.libglib_2.0_0.dll_g_ptr_array_new
mov edx, dword [sym.libglib_2.0_0.dll_g_threads_got_initialized]
mov dword [ebx + 0x5c], 0
test edx, edx
mov dword [ebx + 0x18], eax
je 0x685eada0
mov eax, ebx
call sym._g_main_context_init_pipe
mov eax, dword [sym.libglib_2.0_0.dll_g_threads_got_initialized]
test eax, eax
je 0x685ead4b
mov eax, dword [0x686a41a0]
mov esi, dword [0x686576c4]
test eax, eax
je 0x685eae05
mov dword [esp], eax
call esi
mov eax, dword [0x686a41a4]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_slist_append
mov esi, dword [0x686a4188]
test esi, esi
mov dword [0x686a41a4], eax
jne 0x685eadf0
mov ecx, dword [sym.libglib_2.0_0.dll_g_threads_got_initialized]
test ecx, ecx
je 0x685ead91
mov eax, dword [0x686a41a0]
mov esi, dword [0x686576cc]
test eax, eax
je 0x685eae20
mov dword [esp], eax
call esi
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, dword [0x686a419c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym.libglib_2.0_0.dll_g_slist_prepend
mov dword [0x686a419c], eax
jmp 0x685ead2a
mov dword [esp], str.G_MAIN_POLL_DEBUG
call sym._getenv
test eax, eax
je 0x685eaddb
mov esi, 1
mov dword [0x686a4188], esi
mov ecx, 1
mov dword [0x686a41a8], ecx
jmp 0x685eacc3
mov dword [esp + 4], ebx
mov dword [esp], str.created_context_p_n
call sym.libglib_2.0_0.dll_g_print
jmp 0x685ead6f
mov dword [esp], 0x686a41a0
call sym.libglib_2.0_0.dll_g_static_mutex_get_mutex_impl
jmp 0x685ead46
mov dword [esp], 0x686a41a0
call sym.libglib_2.0_0.dll_g_static_mutex_get_mutex_impl
jmp 0x685ead8c
Function at 0x685f3340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0xffffffff
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
div ebx
cmp eax, esi
jae 0x685f33a0
mov edx, dword [0x686a41c4]
test edx, edx
jne 0x685f336e
call sym._g_mem_init_nomessage
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.gmem.c:246
mov dword [esp + 8], str._s:_overflow_allocating__u_u_bytes
mov dword [esp + 4], 4
mov dword [esp], 0x68660958
call sym.libglib_2.0_0.dll_g_log
jmp 0x685f339a
imul ebx, esi
mov esi, dword [ebp - 4]
mov dword [ebp + 8], ebx
mov ebx, dword [ebp - 8]
mov esp, ebp
pop ebp
jmp sym.libglib_2.0_0.dll_g_malloc

Function at 0x685feb90
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test esi, esi
je 0x685fec54
call sym._get_random_version
cmp eax, 0x14
je 0x685fec20
cmp eax, 0x16
je 0x685febe2
xor esi, esi
mov ebx, str.g_rand_set_seed
mov ecx, 0x15c
mov edx, str.grand.c
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], 0x6866245e
call sym.libglib_2.0_0.dll_g_assertion_message
mov dword [esi], ebx
mov eax, 1
jmp 0x685febf1
inc eax
mov edx, ebx
shr edx, 0x1e
xor edx, ebx
imul ebx, edx, 0x6c078965
add ebx, eax
cmp eax, 0x26f
mov dword [esi + eax*4], ebx
jne 0x685febf0
mov eax, 0x270
mov dword [esi + 0x9c0], eax
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
test ebx, ebx
jne 0x685fec50
mov dword [esi], 0x6b842128
mov ebx, 0x6b842128
xor eax, eax
jmp 0x685fec36
mov ebx, dword [esi + eax]
imul ebx, ebx, 0x10dcd
mov dword [esi + eax + 4], ebx
add eax, 4
cmp eax, 0x9bc
jne 0x685fec33
jmp 0x685fec0a
mov dword [esi], ebx
jmp 0x685fec2f
mov esi, str.rand___NULL
mov ebx, str.g_rand_set_seed
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 0x6866245e
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
Function at 0x685fee60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov edx, dword [ebp + 8]
test edx, edx
je 0x685fef7b
mov ecx, dword [edx + 0x9c0]
cmp ecx, 0x26f
jbe 0x685fef75
mov ecx, dword [edx]
xor eax, eax
lea esi, [esi]
inc eax
mov ebx, ecx
mov ecx, dword [edx + eax*4]
and ebx, 0x80000000
mov esi, ecx
and esi, 0x7fffffff
or esi, ebx
mov ebx, esi
and esi, 1
shr ebx, 1
xor ebx, dword [edx + eax*4 + 0x630]
xor ebx, dword [esi*4 + 0x686624b4]
cmp eax, 0xe3
mov dword [edx + eax*4 - 4], ebx
jne 0x685fee90
lea esi, [esi]
lea edi, [edi]
inc eax
mov ebx, ecx
mov ecx, dword [edx + eax*4]
and ebx, 0x80000000
mov esi, ecx
and esi, 0x7fffffff
or esi, ebx
mov ebx, esi
and esi, 1
shr ebx, 1
xor ebx, dword [edx + eax*4 - 0x390]
xor ebx, dword [esi*4 + 0x686624b4]
cmp eax, 0x26f
mov dword [edx + eax*4 - 4], ebx
jne 0x685feed0
mov eax, dword [edx]
mov ecx, dword [edx + 0x9bc]
mov esi, dword [edx + 0x630]
mov ebx, eax
and ecx, 0x80000000
and ebx, 0x7fffffff
or ebx, ecx
mov ecx, ebx
and ebx, 1
shr ecx, 1
xor ecx, esi
mov esi, dword [ebx*4 + 0x686624b4]
xor ecx, esi
mov dword [edx + 0x9bc], ecx
mov ecx, 1
mov dword [edx + 0x9c0], ecx
mov edx, eax
add esp, 0x10
shr edx, 0xb
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
pop ebx
xor edx, eax
mov eax, edx
pop esi
shr eax, 0x12
xor eax, edx
pop ebp
ret
mov eax, dword [edx + ecx*4]
inc ecx
jmp 0x685fef41
mov ecx, str.rand___NULL
mov edx, str.g_rand_int
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], 0x6866245e
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
ret

Function at 0x68602700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov eax, dword [eax + 0x50]
cmp eax, dword [ebx + 0x54]
jb 0x68602775
mov edx, dword [ebx + 0x4c]
xor eax, eax
test edx, edx
js 0x68602757
mov esi, dword [ebx + 0x58]
jmp 0x6860272d
call sym.__errno
cmp dword [eax], 4
jne 0x68602760
mov edx, dword [ebx + 0x4c]
mov eax, 0xfa0
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edx
call sym._read
cmp eax, 0xffffffff
je 0x68602720
test eax, eax
jle 0x6860276a
lea eax, [esi + eax]
mov dword [ebx + 0x50], esi
mov dword [ebx + 0x54], eax
movzx eax, byte [esi]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
call sym.__errno
cmp dword [eax], 0xb
je 0x6860272a
mov dword [ebx + 0x4c], 0xffffffff
xor eax, eax
jmp 0x68602757
movzx eax, byte [eax]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret