joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4229de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor eax, eax
xor ecx, ecx
inc eax
push edi
push 0x20
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
pop ebp
cmp eax, ebp
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], ecx
cmova eax, ebp
mov dword [esi + 0x34], ecx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x70], ecx
mov dword [esi + 0x88], ecx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
mov dword [esi + 0x58], ecx
cmp eax, dword [esi + 0x20]
je 0x422a8a
lea edi, [esi + 0xc8]
mov ebx, ebp
cmp dword [edi + 8], ecx
je 0x422a67
mov ecx, edi
call fcn.00421bc6
xor ecx, ecx
add edi, 0x28
sub ebx, 1
jne 0x422a59
cmp dword [esi + 0x5c], ebx
je 0x422a85
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
pop ecx
pop ecx
xor ecx, ecx
mov dword [esi + 0x5c], ecx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], ecx
mov dword [esi + 0xa8], ecx
mov dword [esi + 0xac], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
mov ecx, ebx
call fcn.00421b56
mov edi, eax
test edi, edi
jne 0x422b16
lea ecx, [ebx + 0x20]
call fcn.00423fdc
mov edi, eax
test edi, edi
jne 0x422b16
lea ecx, [ebx + 0x1c]
call fcn.00423fdc
mov edi, eax
test edi, edi
jne 0x422b16
push ebx
call fcn.004227aa
mov edi, eax
test edi, edi
je 0x422b16
and dword [esi + 0x44], 0
lea ebx, [esi + 0xc8]
mov ecx, ebx
call fcn.00421bec
add ebx, 0x28
sub ebp, 1
jne 0x422b07
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x422b2a
mov dword [esi + 0x40], eax
xor edx, edx
cmp dword [esi + 0x38], edx
jne 0x422b3e
cmp dword [esi + 0x40], edx
jne 0x422b3e
cmp dword [esi + 0x3c], edx
jne 0x422b3e
mov dword [esi + 0x44], edx
pop edi
xor ecx, ecx
cmp dword [esi + 0x44], edx
pop esi
pop ebp
cmovne eax, ecx
pop ebx
ret

Function at 0x423c98
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 0x20], 0
and dword [ecx + 0x24], 0
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
ret
Function at 0x423f37
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, edx
mov esi, dword [edi + 0x20]
and esi, 0x3f
mov byte [esi + edi + 0x28], 0x80
inc esi
xor ebx, ebx
jmp 0x423f60
and esi, 0x3f
jne 0x423f5b
mov ecx, edi
call fcn.00423cd8
mov byte [edi + esi + 0x28], bl
inc esi
cmp esi, 0x38
jne 0x423f4f
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
shld eax, ecx, 3
shl ecx, 3
bswap ecx
bswap eax
mov dword [edi + 0x64], ecx
mov ecx, edi
mov dword [edi + 0x60], eax
call fcn.00423cd8
mov ecx, dword [edi + ebx*4 + 4]
mov eax, dword [edi + ebx*4]
add ebx, 2
bswap eax
mov dword [ebp], eax
lea ebp, [ebp + 8]
bswap ecx
mov dword [ebp - 4], ecx
cmp ebx, 8
jb 0x423f83
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00423c98
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..3ean
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6e7a1309
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..7LWLf
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6ab87af9
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x10004e8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esp + 0x28]
call sym.glib_lite.dll_Ordinal_482
mov esi, eax
add esp, 0x14
test esi, esi
je 0x10004ff4
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push esi
mov ebx, eax
call sym.glib_lite.dll_Ordinal_121
pop ecx
cmp ebx, 0xffffffff
je 0x10004ff4
mov ecx, dword [esp + 0x1c]
test cl, 0x10
jne 0x10004fe1
test cl, 1
je 0x10004ee2
test bl, 0x50
je 0x10004fe1
test cl, 4
je 0x10004ef0
test bl, 0x10
jne 0x10004fe1
test cl, 8
je 0x10004ff4
push 0x2e
push dword [esp + 0x1c]
call sub.vcruntime140.dll_strrchr
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10004ff4
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
push 0x10037d08
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x10004fe1
push 0x10037d10
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x10004fe1
push 0x10037d18
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x10004fe1
push 0x10037d20
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x10004fe1
push str.PATHEXT
call sym.glib_lite.dll_Ordinal_130
pop ecx
test eax, eax
je 0x10004ff4
push 0xffffffffffffffff
push eax
call fcn.1001d17b
push 0xffffffffffffffff
push esi
mov ebp, eax
call fcn.1001d17b
mov ebx, eax
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 0x14
mov dword [esp + 0x10], eax
mov edi, ebp
push 0x3b
push edi
call sub.vcruntime140.dll_strchr
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10004fae
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
lea esi, [edi + eax]
mov ecx, dword [esp + 0x10]
mov eax, esi
sub eax, edi
cmp ecx, eax
jne 0x10004fc9
push ecx
push edi
push ebx
call sub.vcruntime140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10004fd3
cmp byte [esi], 0
je 0x10004fe6
lea edi, [esi + 1]
jmp 0x10004f94
push ebp
call sym.glib_lite.dll_Ordinal_121
push ebx
call sym.glib_lite.dll_Ordinal_121
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x10004ff6
push ebp
call sym.glib_lite.dll_Ordinal_121
push ebx
call sym.glib_lite.dll_Ordinal_121
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10004ffc
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 2
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
push 2
push esi
call sym.glib_lite.dll_Ordinal_217
pop ecx
pop ecx
mov ebp, eax
push ebp
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
lea ecx, [esi - 1]
cmp eax, ecx
jne 0x1000503c
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebp
call sym.glib_lite.dll_Ordinal_480
add esp, 0x14
mov ebx, eax
push ebp
call sym.glib_lite.dll_Ordinal_121
pop ecx
test ebx, ebx
jne 0x10005054
push 0x100379ac
call sym.glib_lite.dll_Ordinal_386
pop ecx
mov ebx, eax
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x100059b3
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esi + 4]
call sym.glib_lite.dll_Ordinal_121
mov eax, dword [esi]
pop ecx
xor ecx, ecx
mov dword [esi + 4], ecx
sub eax, ecx
je 0x10005a08
sub eax, 1
je 0x100059fc
sub eax, 1
je 0x100059ee
sub eax, 1
lea eax, [esi + 8]
push eax
je 0x100059e7
call fcn.10009f41
pop ecx
pop esi
ret
call fcn.1000a170
jmp 0x100059e4
lea eax, [esi + 8]
push eax
call fcn.1000763f
add esp, 4
pop esi
ret
mov dword [esi + 0x18], 0xc3d2e1f0
mov dword [esi + 0x20], ecx
jmp 0x10005a0b
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 8], 0x67452301
pop esi
ret
Function at 0x1000763f
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x24], 0
and dword [eax + 0x20], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x10009f41
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov byte [eax + 0xc0], cl
mov dword [eax + 0xc8], ecx
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], ecx
ret

Function at 0x1000a170
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov byte [eax + 0xc0], cl
mov dword [eax + 0xc8], ecx
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], ecx
ret
Function at 0x1000acee
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
jne 0x1000ada5
push 0x100884a0
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov esi, dword [edi]
test esi, esi
jne 0x1000ad9a
mov ebx, dword [sym.imp.kernel32.dll_TlsAlloc]
call ebx
mov esi, eax
xor ebp, ebp
test esi, esi
jne 0x1000ad30
call ebx
push ebp
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsFree]
cmp esi, 0xffffffff
je 0x1000ad93
test esi, esi
je 0x1000ad93
cmp dword [edi + 4], ebp
je 0x1000ad7c
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x1000adac
mov dword [ebx], esi
mov ebp, 0x1008849c
mov eax, dword [edi + 4]
push ebp
mov dword [ebx + 4], eax
call fcn.10027c0f
push ebx
push eax
push ebp
mov dword [ebx + 8], eax
call sym.glib_lite.dll_Ordinal_28
add esp, 0x10
test eax, eax
jne 0x1000ad7a
push str.g_private_get_impl_1_
push eax
jmp 0x1000adb9
xor ebp, ebp
push esi
push ebp
push edi
call sym.glib_lite.dll_Ordinal_28
add esp, 0xc
test eax, eax
jne 0x1000ad9a
push str.g_private_get_impl_2_
push ebp
jmp 0x1000adb9
push 0x100382e8
jmp 0x1000ad90
push 0x100884a0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push 0x100382f4
push dword [eax]
call fcn.1000b07b
int3
Function at 0x1000e637
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10088374]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call edi
xor ebp, ebp
mov dword [eax], ebp
test esi, esi
jne 0x1000e674
call edi
mov dword [eax], 0xe
xor eax, eax
jmp 0x1000e77a
cmp word [esi], bp
jne 0x1000e683
call edi
mov dword [eax], 0x14
jmp 0x1000e66d
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000e699
call edi
mov dword [eax], 2
jmp 0x1000e66d
test al, 0x10
je 0x1000e679
push ebx
push 0x104
lea eax, [esp + 0x14]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wfullpath]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
push 0x10039880
call ebx
push 0x1003987c
mov esi, eax
call ebx
add esi, eax
lea eax, [esp + 0x24]
push eax
call ebx
add eax, esi
lea eax, [eax*2 + 0x452]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x1000e6f6
call edi
mov dword [eax], 0xc
xor eax, eax
jmp 0x1000e779
lea eax, [esp + 0x10]
push eax
lea edi, [esi + 0x44c]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
cmp word [edi], bp
mov ebp, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
pop ecx
pop ecx
je 0x1000e73d
push edi
call ebx
pop ecx
cmp word [esi + eax*2 + 0x44a], 0x2f
je 0x1000e73d
push edi
call ebx
pop ecx
cmp word [esi + eax*2 + 0x44a], 0x5c
je 0x1000e73d
push 0x1003987c
push edi
call ebp
pop ecx
pop ecx
push 0x10039880
push edi
call ebp
or dword [esi + 0x444], 0xffffffff
xor ecx, ecx
xor eax, eax
mov dword [esi + 0x448], ecx
push 0x20a
mov dword [esi + 0x234], eax
lea eax, [esi + 0x238]
push ecx
push eax
mov dword [esi + 0x230], ecx
call sub.vcruntime140.dll_memset
add esp, 0x14
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10034eb7
add esp, 0x20c
ret
Function at 0x1000f024
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x10087d80
push edi
call sym.glib_lite.dll_Ordinal_294
mov esi, eax
pop ecx
test esi, esi
jne 0x1000f061
push 0x1000f2f4
push sym.glib_lite.dll_Ordinal_121
push sym.glib_lite.dll_Ordinal_377
push sym.glib_lite.dll_Ordinal_380
call fcn.10027c0f
mov esi, eax
push esi
push edi
call sym.glib_lite.dll_Ordinal_295
add esp, 0x18
mov ebp, dword [esp + 0x1c]
push ebp
call fcn.1000f287
test eax, eax
mov ebx, 0x10039878
push ebp
push esi
cmovne ebx, eax
call fcn.10027c0f
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1000f09c
cmp dword [edi], 0
je 0x1000f09c
push ebx
push dword [edi]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x1000f143
push ebp
push esi
call sym.glib_lite.dll_Ordinal_145
push 8
call fcn.10001917
push 0
push 0x10037a10
push ebx
mov dword [esp + 0x28], eax
call sym.glib_lite.dll_Ordinal_408
add esp, 0x18
mov dword [esp + 0x14], eax
mov edi, eax
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f0e8
mov ebp, dword [esp + 0x10]
push ecx
push ebp
call fcn.1000ecb2
pop ecx
pop ecx
lea edi, [edi + 4]
mov ecx, dword [edi]
test ecx, ecx
jne 0x1000f0ce
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push eax
call sym.glib_lite.dll_Ordinal_392
mov dword [esp], 0x10039878
call sym.glib_lite.dll_Ordinal_386
mov edi, dword [esp + 0x14]
push eax
push edi
call sym.glib_lite.dll_Ordinal_297
push 0
push edi
call sym.glib_lite.dll_Ordinal_297
push 8
push 1
call sym.glib_lite.dll_Ordinal_216
push ebx
mov edi, eax
call sym.glib_lite.dll_Ordinal_386
push 0
push dword [esp + 0x34]
mov dword [edi], eax
call sym.glib_lite.dll_Ordinal_300
add esp, 0x28
mov dword [edi + 4], eax
push edi
push ebp
call sym.glib_lite.dll_Ordinal_386
pop ecx
push eax
push esi
call sym.glib_lite.dll_Ordinal_138
add esp, 0xc
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x10011a50
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esp + 0x28]
call sym.glib_lite.dll_Ordinal_482
mov ebp, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
add esp, 0x14
mov ebx, eax
lea eax, [esp + 0x10]
push 2
pop esi
push esi
push eax
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x10011ab4
push ebx
call sym.glib_lite.dll_Ordinal_121
pop ecx
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xcb
jne 0x10011a9d
xor eax, eax
jmp 0x10011b61
push 0x10037638
call sym.glib_lite.dll_Ordinal_308
push eax
call sym.glib_lite.dll_Ordinal_310
pop ecx
pop ecx
jmp 0x10011b61
cmp edi, 1
push esi
cmove edi, esi
push edi
call sym.glib_lite.dll_Ordinal_217
pop ecx
pop ecx
push edi
mov esi, eax
push esi
push ebx
call ebp
lea ecx, [edi - 1]
cmp eax, ecx
je 0x10011ae1
push ebx
call sym.glib_lite.dll_Ordinal_121
push esi
call sym.glib_lite.dll_Ordinal_121
pop ecx
pop ecx
jmp 0x10011a96
push 0x25
push esi
call sub.vcruntime140.dll_wcschr
pop ecx
pop ecx
test eax, eax
je 0x10011b2f
push 2
lea eax, [esp + 0x14]
mov edi, esi
push eax
push esi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test ebp, ebp
je 0x10011b2f
push 2
push ebp
call sym.glib_lite.dll_Ordinal_217
pop ecx
pop ecx
push ebp
mov esi, eax
push esi
push edi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
je 0x10011b28
push esi
call sym.glib_lite.dll_Ordinal_121
mov esi, edi
jmp 0x10011b2e
push edi
call sym.glib_lite.dll_Ordinal_121
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
call sym.glib_lite.dll_Ordinal_480
push ebx
mov edi, eax
call sym.glib_lite.dll_Ordinal_121
push esi
call sym.glib_lite.dll_Ordinal_121
push edi
call sym.glib_lite.dll_Ordinal_309
push edi
mov esi, eax
call sym.glib_lite.dll_Ordinal_121
push esi
call sym.glib_lite.dll_Ordinal_310
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10012375
Capabilities:
Hash data using djb2

Disassembly:
mov edx, dword [esp + 4]
mov ecx, 0x1505
jmp 0x10012389
imul ecx, ecx, 0x21
movsx eax, al
add ecx, eax
inc edx
mov al, byte [edx]
test al, al
jne 0x10012380
mov eax, ecx
ret
Function at 0x100132d4
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1040
call fcn.10035280
mov eax, dword [0x10088374]
xor eax, esp
mov dword [esp + 0x103c], eax
and dword [esp], 0
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x1048]
push edi
mov edi, dword [esp + 0x1058]
push eax
push dword [esp + 0x1054]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64]
pop ecx
pop ecx
test eax, eax
jns 0x10013346
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [eax]
push esi
call sym.glib_lite.dll_Ordinal_391
pop ecx
push eax
push esi
call fcn.10004b7f
pop ecx
push eax
call fcn.10004c7e
push eax
push edi
call fcn.10027c0f
add esp, 0x10
xor eax, eax
jmp 0x10013425
test dword [esp + 0x12], 0x8000
jne 0x1001335e
push str.Not_a_regular_file
push 1
call fcn.10012d29
jmp 0x10013335
push ebx
mov bl, byte [esi + 0x14]
push esi
call fcn.10012caa
push esi
call fcn.10013171
mov eax, dword [esp + 0x1060]
pop ecx
pop ecx
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], eax
push ebp
push 0x1000
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1060]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [eax]
test ebp, ebp
je 0x100133f1
jns 0x100133d3
cmp ebx, 4
je 0x100133e7
cmp ebx, 0xb
je 0x100133e7
push ebx
call sym.glib_lite.dll_Ordinal_391
pop ecx
push eax
push ebx
call fcn.10004b7f
pop ecx
push eax
call fcn.10004c7e
push eax
push edi
call fcn.10027c0f
add esp, 0x10
jmp 0x1001341c
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x54]
push eax
push esi
call fcn.100136be
add esp, 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001337e
jmp 0x100133f9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100133fc
push eax
jmp 0x10013414
lea eax, [esp + 0x10]
push eax
push esi
call fcn.10027c0f
cmp dword [esp + 0x18], 0
pop ecx
pop ecx
je 0x10013420
push dword [esp + 0x10]
push edi
call sym.glib_lite.dll_Ordinal_296
pop ecx
pop ecx
xor eax, eax
jmp 0x10013423
xor eax, eax
inc eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x1044]
pop edi
pop esi
xor ecx, esp
call fcn.10034eb7
add esp, 0x1040
ret
Function at 0x10016c2d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, dword [edx + 0x9c0]
cmp edi, 0x270
jb 0x10016cdd
push ebx
xor edi, edi
mov ebx, closesocket
push esi
mov esi, edi
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebx
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x1003a858]
xor ecx, dword [edx + esi*4 + 0x634]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0xe3
jl 0x10016c4f
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebx
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x1003a858]
xor ecx, dword [edx + esi*4 - 0x38c]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0x26f
jl 0x10016c7c
mov ecx, dword [edx + 0x9bc]
xor ecx, dword [edx]
and ecx, ebx
xor ecx, dword [edx + 0x9bc]
mov eax, ecx
shr ecx, 1
and eax, 1
pop esi
pop ebx
mov eax, dword [eax*4 + 0x1003a858]
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
mov dword [edx + 0x9c0], edi
mov ecx, dword [edx + edi*4]
lea eax, [edi + 1]
mov dword [edx + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop edi
ret

Function at 0x10016d78
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [esp + 0xc]
call fcn.10016ee8
mov edx, dword [esp + 8]
sub eax, 0x14
je 0x10016dc2
xor ecx, ecx
mov dword [edx], esi
inc ecx
mov dword [edx + 0x9c0], ecx
mov eax, dword [edx + ecx*4 - 4]
shr eax, 0x1e
xor eax, dword [edx + ecx*4 - 4]
imul eax, eax, 0x6c078965
add eax, ecx
mov dword [edx + ecx*4], eax
inc dword [edx + 0x9c0]
mov ecx, dword [edx + 0x9c0]
cmp ecx, 0x270
jb 0x10016d96
pop esi
ret
test esi, esi
mov eax, 0x6b842128
cmovne eax, esi
xor ecx, ecx
inc ecx
mov dword [edx], eax
mov dword [edx + 0x9c0], ecx
imul eax, dword [edx + ecx*4 - 4], 0x10dcd
mov dword [edx + ecx*4], eax
inc dword [edx + 0x9c0]
mov ecx, dword [edx + 0x9c0]
cmp ecx, 0x270
jb 0x10016dd7
pop esi
ret