joyce8/EMBER2024-capa huggingface dataset:
Function at 0x685dd290
Capabilities:
Set environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r8, str.variable___NULL
test rcx, rcx
mov rbx, rcx
je 0x685dd2bc
mov edx, 0x3d
call sub.msvcrt.dll_strchr
test rax, rax
lea r8, str.strchr__variable_____NULL
je 0x685dd2e0
lea rdx, str.g_unsetenv_utf8
lea rcx, [0x6866a17d]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.libglib_2.0_0.dll_g_return_if_fail_warning
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call sym.libglib_2.0_0.dll_g_utf8_validate
test eax, eax
je 0x685dd380
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov edx, 0xffffffff
call sym.libglib_2.0_0.dll_g_utf8_to_utf16
lea rdx, [0x6866a1e5]
xor r8d, r8d
mov rcx, rbx
mov rsi, rax
call sym.libglib_2.0_0.dll_g_strconcat
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rdi, rax
mov qword [rsp + 0x20], 0
mov rcx, rax
call sym.libglib_2.0_0.dll_g_utf8_to_utf16
mov rcx, rdi
mov rbx, rax
call sym.libglib_2.0_0.dll_g_free
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wputenv]
mov rcx, rbx
call sym.libglib_2.0_0.dll_g_free
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.libglib_2.0_0.dll_g_free
lea r8, str.g_utf8_validate__variable___1__NULL_
jmp 0x685dd2bc

Function at 0x685dd390
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov r13, rax
je 0x685dd4a0
cmp word [rax], 0
je 0x685dd492
mov rbx, rax
xor esi, esi
nop
mov rcx, rbx
add esi, 1
call sub.msvcrt.dll_wcslen
lea rbx, [rbx + rax*2 + 2]
cmp word [rbx], 0
jne 0x685dd3c0
add esi, 1
movsxd rcx, esi
mov edx, 8
call sym.libglib_2.0_0.dll_g_malloc0_n
mov r12, rax
cmp word [r13], 0
je 0x685dd46d
mov rsi, r13
xor r14d, r14d
xor ebp, ebp
jmp 0x685dd421
add r14d, 1
mov byte [rax], 0
movsxd rbp, r14d
lea rdi, [r12 + rbp*8]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
lea rsi, [rsi + rax*2 + 2]
cmp word [rsi], 0
je 0x685dd470
xor r9d, r9d
xor r8d, r8d
lea rdi, [r12 + rbp*8]
mov qword [rsp + 0x20], 0
mov edx, 0xffffffff
mov rcx, rsi
call sym.libglib_2.0_0.dll_g_utf16_to_utf8
test rax, rax
mov rbx, rax
mov qword [rdi], rax
je 0x685dd40e
mov edx, 0x3d
mov rcx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x685dd463
cmp rbx, rax
jb 0x685dd400
mov rcx, rbx
call sym.libglib_2.0_0.dll_g_free
jmp 0x685dd40e
mov rdi, r12
mov qword [rdi], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, 1
jmp 0x685dd3dc
mov ecx, 8
call sym.libglib_2.0_0.dll_g_malloc0
mov r12, rax
jmp 0x685dd3e9
Function at 0x685dd4c0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp word [rax], 0
mov rdi, rax
je 0x685dd584
mov rcx, rax
xor ebx, ebx
call sub.msvcrt.dll_wcslen
lea ebx, [rbx + rax + 1]
movsxd rax, ebx
lea rcx, [rdi + rax*2]
cmp word [rcx], 0
jne 0x685dd4e2
add ebx, 1
movsxd rcx, ebx
mov edx, 8
call sym.libglib_2.0_0.dll_g_malloc_n
cmp word [rdi], 0
mov r12, rax
je 0x685dd58e
mov rbx, rdi
xor edx, edx
xor esi, esi
nop dword [rax + rax]
lea rbp, [r12 + rdx*8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rbx
mov qword [rsp + 0x20], 0
call sym.libglib_2.0_0.dll_g_utf16_to_utf8
mov rcx, rbx
mov qword [rbp], rax
call sub.msvcrt.dll_wcslen
lea esi, [rsi + rax + 1]
movsxd rdx, esi
lea rbx, [rdi + rdx*2]
cmp word [rbx], 0
jne 0x685dd520
lea rbx, [rdx*8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, r12
mov qword [r12 + rbx], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, 1
jmp 0x685dd4fe
xor ebx, ebx
jmp 0x685dd565
Function at 0x685ddfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
test rcx, rcx
mov rbp, rcx
mov r12, rdx
mov dword [rsp + 0xa0], r8d
mov r14d, r9d
je 0x685de1b2
lea rdx, str.XXXXXX
call sym.libglib_2.0_0.dll_g_strrstr
test rax, rax
mov r15, rax
je 0x685de1e2
lea rdi, str.XXXXXX
mov ecx, 6
mov rsi, r15
repe cmpsb byte [rsi], byte [rdi]
jne 0x685de1e2
lea rcx, [rsp + 0x30]
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov ebx, 0x38e38e39
call sym.libglib_2.0_0.dll_g_get_current_time
mov r11d, dword [rsp + 0x30]
xor r11d, dword [rsp + 0x34]
mov eax, dword [0x686cd260]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
lea r13d, [r11 + rax]
add eax, 1
mov dword [0x686cd260], eax
lea eax, [r13 + 0xbdde4]
mov dword [rsp + 0x2c], eax
jmp 0x685de09d
call rdi
cmp dword [rax], 0x11
jne 0x685de1cc
add r13d, 0x1e61
cmp r13d, dword [rsp + 0x2c]
je 0x685de1d3
mov eax, r13d
imul ebx
mov eax, r13d
sar eax, 0x1f
mov r8d, edx
mov edx, r13d
sar r8d, 3
sub r8d, eax
lea eax, [r8 + r8*8]
shl eax, 2
sub edx, eax
movsxd rax, edx
movzx eax, byte [rsi + rax]
mov byte [r15], al
mov eax, r8d
imul ebx
mov eax, r8d
sar eax, 0x1f
mov ecx, edx
sar ecx, 3
sub ecx, eax
lea eax, [rcx + rcx*8]
shl eax, 2
sub r8d, eax
movsxd r8, r8d
movzx eax, byte [rsi + r8]
mov byte [r15 + 1], al
mov eax, ecx
imul ebx
mov eax, ecx
sar eax, 0x1f
mov r8d, edx
sar r8d, 3
sub r8d, eax
lea eax, [r8 + r8*8]
shl eax, 2
sub ecx, eax
movsxd rcx, ecx
movzx eax, byte [rsi + rcx]
mov byte [r15 + 2], al
mov eax, r8d
imul ebx
mov eax, r8d
sar eax, 0x1f
mov ecx, edx
sar ecx, 3
sub ecx, eax
lea eax, [rcx + rcx*8]
shl eax, 2
sub r8d, eax
movsxd r8, r8d
movzx eax, byte [rsi + r8]
mov r8d, r14d
mov byte [r15 + 3], al
mov eax, ecx
imul ebx
mov eax, ecx
sar eax, 0x1f
mov r10d, edx
sar r10d, 3
sub r10d, eax
lea eax, [r10 + r10*8]
shl eax, 2
sub ecx, eax
movsxd rcx, ecx
movzx eax, byte [rsi + rcx]
mov rcx, rbp
mov byte [r15 + 4], al
mov eax, r10d
imul ebx
mov eax, r10d
sar eax, 0x1f
sar edx, 3
sub edx, eax
lea eax, [rdx + rdx*8]
mov edx, dword [rsp + 0xa0]
shl eax, 2
sub r10d, eax
movsxd r10, r10d
movzx eax, byte [rsi + r10]
mov byte [r15 + 5], al
call r12
test eax, eax
js 0x685de080
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.tmpl___NULL
lea rdx, str.get_tmp_file
lea rcx, [0x6866a474]
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
mov eax, 0xffffffff
jmp 0x685de1a1
call rdi
mov dword [rax], 0x11
mov eax, 0xffffffff
jmp 0x685de1a1
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x685de1a1
Function at 0x685de210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
xor r9d, r9d
xor r8d, r8d
mov esi, edx
mov qword [rsp + 0x20], 0
mov edx, 0xffffffff
mov rdi, rcx
call sym.libglib_2.0_0.dll_g_utf8_to_utf16
test rax, rax
mov rbx, rax
je 0x685de2d4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
mov ebp, eax
call sym.libglib_2.0_0.dll_g_free
cmp ebp, 0xffffffff
je 0x685de2d4
test sil, 0x10
mov eax, 1
jne 0x685de2b9
test sil, 1
je 0x685de273
test bpl, 0x50
je 0x685de2b9
test sil, 4
je 0x685de283
and ebp, 0x10
mov eax, 1
jne 0x685de2b9
and esi, 8
je 0x685de2d4
mov edx, 0x2e
mov rcx, rdi
call sub.msvcrt.dll_strrchr
test rax, rax
mov rbx, rax
je 0x685de2d4
lea rdx, str..exe
mov rcx, rax
mov rsi, qword [sym.imp.msvcrt.dll__stricmp]
call rsi
test eax, eax
jne 0x685de2e1
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, r12
call sym.libglib_2.0_0.dll_g_free
mov rcx, rbp
call sym.libglib_2.0_0.dll_g_free
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str..cmd
mov rcx, rbx
call rsi
test eax, eax
je 0x685de2b4
lea rdx, str..bat
mov rcx, rbx
call rsi
test eax, eax
je 0x685de2b4
lea rdx, str..com
mov rcx, rbx
call rsi
test eax, eax
je 0x685de2b4
lea rcx, [0x6866a48d]
call sym.libglib_2.0_0.dll_g_getenv_utf8
test rax, rax
je 0x685de2d4
mov rdx, 0xffffffffffffffff
mov rcx, rax
call sym.libglib_2.0_0.dll_g_utf8_casefold
mov rdx, 0xffffffffffffffff
mov rcx, rbx
mov r12, rax
call sym.libglib_2.0_0.dll_g_utf8_casefold
mov rcx, rax
mov rbp, rax
mov rsi, r12
call sub.msvcrt.dll_strlen
movsxd rdi, eax
jmp 0x685de36d
cmp byte [rbx], 0
je 0x685de2c4
lea rsi, [rbx + 1]
mov edx, 0x3b
mov rcx, rsi
call sub.msvcrt.dll_strchr
test rax, rax
mov rbx, rax
je 0x685de3b4
mov rdx, rbx
sub rdx, rsi
cmp rdx, rdi
jne 0x685de360
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x685de360
mov rcx, r12
call sym.libglib_2.0_0.dll_g_free
mov rcx, rbp
call sym.libglib_2.0_0.dll_g_free
jmp 0x685de2b4
mov rcx, rsi
call sub.msvcrt.dll_strlen
lea rbx, [rsi + rax]
jmp 0x685de382
Function at 0x685deb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r9d, r8d
mov r8d, edx
lea rdx, [sym.libglib_2.0_0.dll_g_open]
or r8d, 0x500
jmp fcn.685ddfe0
Function at 0x685df010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8d, 0x180
mov edx, 0x8002
jmp sym.libglib_2.0_0.dll_g_mkstemp_full

Function at 0x685dfa30
Capabilities:
Get common file path

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov ecx, 2
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x40]
call rdi
mov edx, 2
mov ebx, eax
movsxd rcx, eax
call sym.libglib_2.0_0.dll_g_malloc_n
mov ecx, ebx
sub ebx, 1
mov rsi, rax
mov rdx, rax
call rdi
cmp eax, ebx
je 0x685dfa90
mov rcx, rsi
call sym.libglib_2.0_0.dll_g_free
lea rcx, [0x6866a4b3]
call sym.libglib_2.0_0.dll_g_strdup
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rsi
mov qword [rsp + 0x20], 0
call sym.libglib_2.0_0.dll_g_utf16_to_utf8
mov rcx, rsi
mov qword [rsp + 0x38], rax
call sym.libglib_2.0_0.dll_g_free
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x685dfa72
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret

Function at 0x685e1630
Capabilities:
Hash data using djb2

Disassembly:
movsx edx, byte [rcx]
mov eax, 0x1505
test dl, dl
je 0x685e1659
nop dword [rax]
mov r8d, eax
add rcx, 1
shl r8d, 5
add edx, r8d
add eax, edx
movsx edx, byte [rcx]
test dl, dl
jne 0x685e1640
repz ret
repz ret
Function at 0x685e16e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov ebx, ecx
mov r13, rdx
mov r14, r8
call sym.libglib_2.0_0.dll_g_checksum_new
test rax, rax
mov rsi, rax
je 0x685e184e
cmp ebx, 2
jbe 0x685e174a
lea rax, str.g_hmac_new
lea r9, str.ghmac.c
lea r8, [0x6866ae88]
lea rcx, [0x6866aeb5]
mov dword [rsp + 0x20], 0x72
mov edx, 8
mov qword [rsp + 0x28], rax
xor r12d, r12d
call sym.libglib_2.0_0.dll_g_log
jmp 0x685e1804
mov ecx, 0x18
call sym.libglib_2.0_0.dll_g_slice_alloc0
mov ecx, ebx
mov dword [rax + 4], ebx
mov qword [rax + 8], rsi
mov dword [rax], 1
mov r12, rax
call sym.libglib_2.0_0.dll_g_checksum_new
sub rsp, 0x50
mov qword [r12 + 0x10], rax
mov ecx, 8
lea rbx, [rsp + 0x30]
xor eax, eax
sub rsp, 0x50
cmp r14, 0x40
lea rsi, [rsp + 0x30]
mov rdi, rbx
rep stosq qword [rdi], rax
ja 0x685e1816
mov r8, r14
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_memcpy
xor r8d, r8d
nop word [rax + rax]
movzx r9d, byte [rbx + r8]
xor r9d, 0x36
mov byte [rsi + r8], r9b
add r8, 1
cmp r8, 0x40
jne 0x685e17b0
mov rcx, qword [r12 + 8]
mov rdx, rsi
call sym.libglib_2.0_0.dll_g_checksum_update
xor r8d, r8d
nop word [rax + rax]
movzx r9d, byte [rbx + r8]
xor r9d, 0x5c
mov byte [rsi + r8], r9b
add r8, 1
cmp r8, 0x40
jne 0x685e17e0
mov rcx, qword [r12 + 0x10]
mov rdx, rsi
call sym.libglib_2.0_0.dll_g_checksum_update
mov rax, r12
lea rsp, [rbp - 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
mov rcx, qword [r12 + 8]
mov r8, r14
mov rdx, r13
mov qword [rbp - 0x38], 0x40
call sym.libglib_2.0_0.dll_g_checksum_update
mov rcx, qword [r12 + 8]
lea r8, [rbp - 0x38]
mov rdx, rbx
call sym.libglib_2.0_0.dll_g_checksum_get_digest
mov rcx, qword [r12 + 8]
call sym.libglib_2.0_0.dll_g_checksum_reset
jmp 0x685e17a7
lea r8, str.checksum___NULL
lea rdx, str.g_hmac_new
lea rcx, [0x6866aeb5]
xor r12d, r12d
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
jmp 0x685e1804
Function at 0x685e8f40
Capabilities:
Read file on windows

Disassembly:
push r12
mov eax, 0x1070
push rbp
push rdi
push rsi
push rbx
call fcn.68657b00
sub rsp, rax
mov esi, edx
mov rbx, rcx
mov ebp, r8d
mov rdi, r9
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x30]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__fstat64]
test eax, eax
js 0x685e9090
movzx eax, word [rsp + 0x36]
and ax, 0xf000
cmp ax, 0x8000
je 0x685e8fc2
lea rcx, str.Not_a_regular_file
call sym.libglib_2.0_0.dll_glib_gettext
mov rbx, rax
call sym.libglib_2.0_0.dll_g_key_file_error_quark
mov r9, rbx
mov edx, eax
mov r8d, 1
mov rcx, rdi
call sym.libglib_2.0_0.dll_g_set_error_literal
xor eax, eax
add rsp, 0x1070
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movzx r12d, byte [rbx + 0x28]
mov rcx, rbx
call fcn.685e7c30
mov rcx, rbx
call fcn.685e7880
mov dword [rbx + 0x2c], ebp
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov byte [rbx + 0x28], r12b
lea rdx, [rsp + 0x70]
mov r8d, 0x1000
mov ecx, esi
call sub.msvcrt.dll__read
movsxd r8, eax
cmp r8, 0
je 0x685e90b0
jl 0x685e9040
lea r9, [rsp + 0x28]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.685e8dc0
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x685e8fe5
mov rcx, rdi
call sym.libglib_2.0_0.dll_g_propagate_error
xor eax, eax
add rsp, 0x1070
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call rbp
cmp dword [rax], 4
je 0x685e9018
call rbp
cmp dword [rax], 0xb
nop dword [rax]
je 0x685e9018
call rbp
mov ecx, dword [rax]
call sym.libglib_2.0_0.dll_g_strerror
mov rsi, rax
nop
call rbp
mov ecx, dword [rax]
call sym.libglib_2.0_0.dll_g_file_error_from_errno
mov ebx, eax
call sym.libglib_2.0_0.dll_g_file_error_quark
mov r9, rsi
mov edx, eax
mov r8d, ebx
mov rcx, rdi
call sym.libglib_2.0_0.dll_g_set_error_literal
xor eax, eax
add rsp, 0x1070
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
mov ecx, dword [rax]
call sym.libglib_2.0_0.dll_g_strerror
mov rsi, rax
call rbx
jmp 0x685e9062
mov rdx, qword [rsp + 0x28]
test rdx, rdx
jne 0x685e9022
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.685e87a0
mov rdx, qword [rsp + 0x28]
mov eax, 1
test rdx, rdx
jne 0x685e9022
jmp 0x685e8fb4
Function at 0x685ec6b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor ebp, ebp
test rcx, rcx
mov rbx, rcx
mov qword [rsp + 0x88], rdx
mov r14d, r8d
je 0x685ec7b1
lea rdx, [0x6866d080]
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x685ec7f1
mov r13, qword [rsp + 0x88]
lea edx, [r14 - 1]
movzx eax, byte [rbx]
mov dword [rsp + 0x2c], 0
shl rdx, 4
lea rdi, [r13 + rdx + 0x10]
nop
test al, al
je 0x685ec786
lea rdx, str.:____t
mov rcx, rbx
call sub.msvcrt.dll_strpbrk
test rax, rax
mov r12, rax
je 0x685ec7e0
mov r8, r12
lea rcx, [0x6866d0b2]
mov rdx, rbx
sub r8, rbx
mov esi, r8d
call fcn.685ec620
test eax, eax
jne 0x685ec7d4
test r14d, r14d
je 0x685ec77f
mov r15, qword [rsp + 0x88]
nop dword [rax]
mov rcx, qword [r15]
mov r8d, esi
mov rdx, rbx
call fcn.685ec620
test eax, eax
je 0x685ec776
or ebp, dword [r15 + 8]
add r15, 0x10
cmp r15, rdi
jne 0x685ec760
cmp byte [r12], 0
jne 0x685ec7c4
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x685ec7b1
test r14d, r14d
je 0x685ec875
xor eax, eax
nop dword [rax]
or eax, dword [r13 + 8]
add r13, 0x10
cmp r13, rdi
jne 0x685ec7a0
not ebp
and ebp, eax
mov eax, ebp
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [r12 + 1]
movzx eax, byte [r12 + 1]
jmp 0x685ec710
mov dword [rsp + 0x2c], 1
jmp 0x685ec77f
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea r12, [rbx + rax]
jmp 0x685ec72f
mov rsi, qword [sym.imp.msvcrt.dll___iob_func]
call rsi
lea rcx, str.Supported_debug_values:
lea r9, [rax + 0x60]
mov r8d, 0x17
mov edx, 1
call sub.msvcrt.dll_fwrite
test r14d, r14d
je 0x685ec851
mov r15, qword [rsp + 0x88]
lea eax, [r14 - 1]
shl rax, 4
lea rdi, [r15 + rax + 0x10]
nop
mov rbx, qword [r15]
add r15, 0x10
call rsi
lea rdx, [0x6866d0a8]
lea rcx, [rax + 0x60]
mov r8, rbx
call sub.msvcrt.dll_fprintf
cmp r15, rdi
jne 0x685ec830
call rsi
lea rcx, str._all_help_n
lea r9, [rax + 0x60]
mov r8d, 0xa
mov edx, 1
xor ebp, ebp
call sub.msvcrt.dll_fwrite
jmp 0x685ec7b1
xor ebp, ebp
jmp 0x685ec7b1
Function at 0x685ec880
Capabilities:
Query environment variable

Disassembly:
push rbx
add rsp, 0xffffffffffffff80
cmp edx, 1
je 0x685ec8a0
cmp edx, 3
jne 0x685ec894
call fcn.6862a350
mov eax, 1
sub rsp, 0xffffffffffffff80
pop rbx
ret
mov qword [0x686ceb70], rcx
call fcn.685ef230
call fcn.6862a080
lea rax, [0x6866d0b6]
lea rcx, str.G_MESSAGES_PREFIXED
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x48], 0x10
mov qword [rsp + 0x20], rax
lea rax, str.critical
mov dword [rsp + 0x58], 0x20
mov dword [rsp + 0x68], 0x40
mov dword [rsp + 0x78], pe_nt_image_headers64
mov qword [rsp + 0x30], rax
lea rax, str.warning
mov ebx, dword [0x68663894]
mov qword [rsp + 0x40], rax
lea rax, [0x6866d0cd]
mov qword [rsp + 0x50], rax
lea rax, str.info
mov qword [rsp + 0x60], rax
lea rax, str.debug
mov qword [rsp + 0x70], rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x685ec9e0
lea rdx, [rsp + 0x20]
mov r8d, 6
mov rcx, rax
call sym.libglib_2.0_0.dll_g_parse_debug_string
mov dword [0x68663894], eax
lea rax, str.gc_friendly
lea rcx, str.G_DEBUG
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x38], 0x18
mov qword [rsp + 0x20], rax
lea rax, str.fatal_warnings
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x30], rax
lea rax, str.fatal_criticals
mov qword [rsp + 0x40], rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x685ec9f0
lea rdx, [rsp + 0x20]
mov r8d, 3
mov rcx, rax
call sym.libglib_2.0_0.dll_g_parse_debug_string
mov edx, eax
and eax, 1
and edx, 0xfffffffc
or dword [0x68663890], edx
mov dword [sym.libglib_2.0_0.dll_g_mem_gc_friendly], eax
mov eax, 1
sub rsp, 0xffffffffffffff80
pop rbx
ret
mov eax, ebx
jmp 0x685ec957
xor eax, eax
xor edx, edx
jmp 0x685ec9c5
Function at 0x685ee110
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mfence
cmp qword [0x686cd2a8], 0
je 0x685ee220
mov ecx, 0xb8
call sym.libglib_2.0_0.dll_g_malloc0
mov rbx, rax
mov rcx, rax
call sym.libglib_2.0_0.dll_g_mutex_init
lea rcx, [rbx + 8]
lea rsi, [rbx + 0x88]
call sym.libglib_2.0_0.dll_g_cond_init
lea rax, [sym.libglib_2.0_0.dll_g_poll]
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x28], 0
mov dword [rbx + 0x30], 1
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x48], 0
mov qword [rbx + 0xa0], rax
mov qword [rbx + 0x70], 0
mov dword [rbx + 0x78], 0
call sym.libglib_2.0_0.dll_g_ptr_array_new
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x38], rax
call fcn.68628f90
mov rdx, rsi
mov rcx, rax
mov qword [rbx + 0x80], rax
call fcn.68628fe0
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.685ed660
lea rcx, [0x686cd298]
call sym.libglib_2.0_0.dll_g_mutex_lock
mov rcx, qword [0x686cd2a0]
mov rdx, rbx
call sym.libglib_2.0_0.dll_g_slist_append
mov r8d, dword [0x686cd290]
mov qword [0x686cd2a0], rax
test r8d, r8d
je 0x685ee203
lea rcx, str.created_context_p_n
mov rdx, rbx
call sym.libglib_2.0_0.dll_g_print
lea rcx, [0x686cd298]
call sym.libglib_2.0_0.dll_g_mutex_unlock
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, [0x686cd2a8]
call sym.libglib_2.0_0.dll_g_once_init_enter
test eax, eax
je 0x685ee127
lea rcx, str.G_MAIN_POLL_DEBUG
call sub.msvcrt.dll_getenv
test rax, rax
je 0x685ee24f
mov dword [0x686cd290], 1
lea rcx, [0x686cd2a8]
mov edx, 1
call sym.libglib_2.0_0.dll_g_once_init_leave
jmp 0x685ee127

Function at 0x685fecf0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push rbx
sub rsp, 0x38
test rcx, rcx
mov rsi, rcx
mov ebx, edx
je 0x685fedb4
call fcn.685feae0
cmp eax, 0x14
je 0x685fed80
cmp eax, 0x16
je 0x685fed40
lea r9, str.g_rand_set_seed
lea rdx, str.grand.c
lea rcx, [0x68670e6a]
mov qword [rsp + 0x20], 0
mov r8d, 0x157
call sym.libglib_2.0_0.dll_g_assertion_message
nop dword [rax]
mov dword [rsi], ebx
lea rcx, [rsi + 4]
mov eax, 1
jmp 0x685fed54
add rcx, 4
mov edx, ebx
shr edx, 0x1e
xor edx, ebx
imul ebx, edx, 0x6c078965
add ebx, eax
add eax, 1
cmp eax, 0x270
mov dword [rcx], ebx
jne 0x685fed50
mov dword [rsi + 0x9c0], 0x270
add rsp, 0x38
pop rbx
pop rsi
ret
test ebx, ebx
jne 0x685fedb0
mov dword [rsi], 0x6b842128
mov ebx, 0x6b842128
xor eax, eax
jmp 0x685fed96
mov ebx, dword [rsi + rax]
imul ebx, ebx, 0x10dcd
mov dword [rsi + rax + 4], ebx
add rax, 4
cmp rax, 0x9bc
jne 0x685fed93
jmp 0x685fed6f
mov dword [rsi], ebx
jmp 0x685fed8f
lea r8, str.rand___NULL
lea rdx, str.g_rand_set_seed
lea rcx, [0x68670e6a]
add rsp, 0x38
pop rbx
pop rsi
jmp sym.libglib_2.0_0.dll_g_return_if_fail_warning
Function at 0x685fefd0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x685ff102
mov edx, dword [rcx + 0x9c0]
cmp edx, 0x26f
ja 0x685ff025
mov eax, edx
add edx, 1
mov eax, dword [rcx + rax*4]
mov dword [rcx + 0x9c0], edx
mov edx, eax
shr edx, 0xb
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x28
ret
lea r10, [0x68670f04]
mov rdx, rcx
mov r9d, 0xe3
mov r8d, dword [rdx]
mov eax, dword [rdx + 4]
and r8d, 0x80000000
and eax, 0x7fffffff
or eax, r8d
mov r8d, eax
and eax, 1
shr r8d, 1
xor r8d, dword [rdx + 0x634]
xor r8d, dword [r10 + rax*4]
mov dword [rdx], r8d
add rdx, 4
sub r9d, 1
jne 0x685ff035
lea rdx, [rcx + 0x38c]
mov r9d, 0xe3
nop dword [rax + rax]
mov r8d, dword [rdx]
mov eax, dword [rdx + 4]
add r9d, 1
and r8d, 0x80000000
and eax, 0x7fffffff
or eax, r8d
mov r8d, eax
and eax, 1
shr r8d, 1
xor r8d, dword [rdx - 0x38c]
xor r8d, dword [r10 + rax*4]
mov dword [rdx], r8d
add rdx, 4
cmp r9d, 0x26f
jne 0x685ff080
mov eax, dword [rcx]
mov edx, dword [rcx + 0x9bc]
lea r9, [0x68670f04]
mov r8d, eax
and edx, 0x80000000
and r8d, 0x7fffffff
or r8d, edx
mov edx, r8d
and r8d, 1
shr edx, 1
xor edx, dword [rcx + 0x630]
xor edx, dword [r9 + r8*4]
mov dword [rcx + 0x9bc], edx
mov edx, 1
jmp 0x685feff3
lea r8, str.rand___NULL
lea rdx, str.g_rand_int
lea rcx, [0x68670e6a]
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
xor eax, eax
add rsp, 0x28
ret

Function at 0x68602980
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x68]
cmp rax, qword [rcx + 0x70]
mov rbx, rcx
jb 0x686029f0
mov ecx, dword [rcx + 0x60]
test ecx, ecx
js 0x68602a20
mov rsi, qword [rbx + 0x78]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
jmp 0x686029b3
mov ecx, dword [rbx + 0x60]
mov r8d, 0xfa0
mov rdx, rsi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
jne 0x68602a00
call rdi
cmp dword [rax], 4
nop dword [rax + rax]
je 0x686029b0
call rdi
cmp dword [rax], 0xb
je 0x686029b0
xor eax, eax
mov dword [rbx + 0x60], 0xffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
movzx eax, byte [rax]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test eax, eax
jle 0x686029d9
cdqe
mov qword [rbx + 0x68], rsi
add rax, rsi
mov qword [rbx + 0x70], rax
movzx eax, byte [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret