joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010f80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str.CHARSET
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10010fde
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10010fde
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [edx], eax
cmp dword [ebp - 4], 0
je 0x10010fd7
push 0x100d3ec4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR90.dll_strstr]
add esp, 8
test eax, eax
je 0x10010fd7
mov eax, 1
jmp 0x100110ad
xor eax, eax
jmp 0x100110ad
cmp dword [sym.glib_2.0.dll_g_threads_got_initialized], 0
je 0x10011018
cmp dword [0x100fe900], 0
je 0x10010ffb
mov edx, dword [0x100fe900]
mov dword [ebp - 8], edx
jmp 0x1001100b
push 0x100fe900
call sym.glib_2.0.dll_g_static_mutex_get_mutex_impl
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call dword [0x100d5de4]
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000bf00
add esp, 4
mov dword [ebp - 4], eax
cmp dword [sym.glib_2.0.dll_g_threads_got_initialized], 0
je 0x10011061
cmp dword [0x100fe900], 0
je 0x10011044
mov edx, dword [0x100fe900]
mov dword [ebp - 0xc], edx
jmp 0x10011054
push 0x100fe900
call sym.glib_2.0.dll_g_static_mutex_get_mutex_impl
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [0x100d5dec]
add esp, 4
cmp dword [ebp - 4], 0
je 0x100110a2
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
je 0x100110a2
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp - 4], 0
je 0x1001109e
push 0x100d3ecc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR90.dll_strstr]
add esp, 8
test eax, eax
je 0x1001109e
mov eax, 1
jmp 0x100110ad
xor eax, eax
jmp 0x100110ad
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x100d3ed4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10024cd0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call sym.glib_2.0.dll_g_utf8_to_utf16
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10024d04
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x10024d39
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR90.dll__wrmdir]
add esp, 4
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR90.dll__errno]
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
push eax
call sym.glib_2.0.dll_g_free
add esp, 4
call dword [sym.imp.MSVCR90.dll__errno]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10024d40
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call sym.glib_2.0.dll_g_utf8_to_utf16
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10024d74
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x10024dbf
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR90.dll__wremove]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10024d9a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR90.dll__wrmdir]
add esp, 4
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR90.dll__errno]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call sym.glib_2.0.dll_g_free
add esp, 4
call dword [sym.imp.MSVCR90.dll__errno]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10024eb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call sym.glib_2.0.dll_g_utf8_to_utf16
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10024ee4
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x10024f19
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR90.dll__wmkdir]
add esp, 4
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR90.dll__errno]
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
push eax
call sym.glib_2.0.dll_g_free
add esp, 4
call dword [sym.imp.MSVCR90.dll__errno]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10024f20
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call sym.glib_2.0.dll_g_utf8_to_utf16
add esp, 0x14
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 4], 0
jne 0x10024f5e
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x10025063
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call sym.glib_2.0.dll_g_utf8_to_utf16
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10024f9b
mov edx, dword [ebp - 4]
push edx
call sym.glib_2.0.dll_g_free
add esp, 4
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x10025063
push 1
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x10024fbb
mov dword [ebp - 8], 0
jmp 0x1002503d
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sub edx, 2
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0xb5
ja case.0x10024fe7.2
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x1002508c]
jmp dword [ecx*4 + 0x10025068]
mov dword [ebp - 0xc], 2
jmp 0x1002503d
mov dword [ebp - 0xc], 2
jmp 0x1002503d
mov dword [ebp - 0xc], 0xd
jmp 0x1002503d
mov dword [ebp - 0xc], 0x12
jmp 0x1002503d
mov dword [ebp - 0xc], 0xd
jmp 0x1002503d
mov dword [ebp - 0xc], 0xd
jmp 0x1002503d
mov dword [ebp - 0xc], 0x11
jmp 0x1002503d
mov dword [ebp - 0xc], 0x11
jmp 0x1002503d
mov dword [ebp - 0xc], 5
mov edx, dword [ebp - 4]
push edx
call sym.glib_2.0.dll_g_free
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call sym.glib_2.0.dll_g_free
add esp, 4
call dword [sym.imp.MSVCR90.dll__errno]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10025ee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 8
jae 0x10025fda
cmp dword [0x100da444], 0
je 0x10025f1b
mov eax, 8
sub eax, dword [ebp - 4]
push eax
push 0x100da528
push str._s:read_helper_report:_read__u..._n
call sym.glib_2.0.dll_g_print
add esp, 0xc
mov ecx, 8
sub ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [0x100da444], 0
je 0x10025f55
mov ecx, dword [ebp - 8]
push ecx
push str....got__d_bytes_n
call sym.glib_2.0.dll_g_print
add esp, 8
cmp dword [ebp - 8], 0
jge 0x10025f9b
call dword [sym.imp.MSVCR90.dll__errno]
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
call sym.glib_2.0.dll_g_strerror
add esp, 4
push eax
push 0x100da580
call sym.glib_2.0.dll_glib_gettext
add esp, 4
push eax
push 0x13
call sym.glib_2.0.dll_g_spawn_error_quark
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call sym.glib_2.0.dll_g_set_error
add esp, 0x14
xor eax, eax
jmp 0x10025fe9
cmp dword [ebp - 8], 0
jne 0x10025fcc
push 0x100da5a4
push str.Failed_to_read_from_child_pipe___s_
call sym.glib_2.0.dll_glib_gettext
add esp, 4
push eax
push 0x13
call sym.glib_2.0.dll_g_spawn_error_quark
push eax
mov edx, dword [ebp + 0x10]
push edx
call sym.glib_2.0.dll_g_set_error
add esp, 0x14
jmp 0x10025fda
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10025eed
cmp dword [ebp - 4], 8
jae 0x10025fe4
xor eax, eax
jmp 0x10025fe9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x100292e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x100fe800], 0
jne 0x100292f1
jmp 0x10029303
push str.sys_page_size__0
push 0x100db2d4
call fcn.10029b30
add esp, 8
xor eax, eax
jne 0x100292e6
mov ecx, 1
test ecx, ecx
je 0x10029312
jmp 0x10029324
push str.MIN_MAGAZINE_SIZE___4
push 0x100db304
call fcn.10029b30
add esp, 8
xor edx, edx
jne 0x10029307
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov dword [0x100fe800], ecx
cmp dword [0x100fe800], 0x200
jb 0x10029349
jmp 0x1002935b
push str.sys_page_size___2__LARGEALIGNMENT
push 0x100db340
call fcn.10029b30
add esp, 8
xor edx, edx
jne 0x1002933b
mov eax, dword [0x100fe800]
sub eax, 1
and eax, dword [0x100fe800]
jne 0x10029371
jmp 0x10029383
push str._sys_page_size___sys_page_size___1____0
push 0x100db384
call fcn.10029b30
add esp, 8
xor ecx, ecx
jne 0x1002935f
push 0x100fe810
call fcn.10028db0
add esp, 4
mov edx, dword [0x100fe800]
mov dword [0x100fe808], edx
mov eax, dword [0x100fe800]
mov dword [0x100fe80c], eax
mov dword [0x100fe828], 0
mov ecx, dword [0x100fe80c]
sub ecx, 0x18
shr ecx, 3
shr ecx, 3
shl ecx, 2
push ecx
call sym.glib_2.0.dll_g_malloc0
add esp, 4
mov dword [0x100fe82c], eax
mov edx, dword [0x100fe80c]
sub edx, 0x18
shr edx, 3
shr edx, 3
shl edx, 2
push edx
call sym.glib_2.0.dll_g_malloc0
add esp, 4
mov dword [0x100fe830], eax
mov dword [0x100fe834], 0
mov dword [0x100fe838], 7
mov dword [0x100fe83c], 0
mov dword [0x100fe840], 0
mov eax, dword [0x100fe80c]
sub eax, 0x18
shr eax, 3
shr eax, 3
shl eax, 2
push eax
call sym.glib_2.0.dll_g_malloc0
add esp, 4
mov dword [0x100fe844], eax
mov dword [0x100fe848], 0
call fcn.10028d50
mov ecx, dword [0x100fe80c]
sub ecx, 0x18
shr ecx, 3
mov dword [0x100fe824], ecx
cmp dword [0x100fe810], 0
jne 0x1002946e
cmp dword [0x100fe814], 0
je 0x10029478
mov dword [0x100fe824], 0
mov esp, ebp
pop ebp
ret
Function at 0x1002ca30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x50]
cmp edx, dword [ecx + 0x54]
jae 0x1002ca56
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
mov al, byte [ecx]
jmp 0x1002cad6
mov edx, dword [ebp + 8]
cmp dword [edx + 0x4c], 0
jl 0x1002cad4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58]
mov dword [ebp - 8], ecx
push 0xfa0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x4c]
push ecx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1002caa0
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 4
je 0x1002ca68
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0xb
je 0x1002ca68
cmp dword [ebp - 4], 1
jge 0x1002cab6
mov edx, dword [ebp + 8]
mov dword [edx + 0x4c], 0xffffffff
xor al, al
jmp 0x1002cad6
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x50], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], edx
mov ecx, dword [ebp - 8]
mov al, byte [ecx]
jmp 0x1002cad6
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1002e9b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x50]
cmp edx, dword [ecx + 0x54]
jae 0x1002e9e3
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x50], ecx
jmp 0x1002ea97
mov eax, dword [ebp + 8]
cmp dword [eax + 0x4c], 0
jl 0x1002ea93
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x58]
mov dword [ebp - 0xc], edx
push 0xfa0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x4c]
push edx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1002ea31
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 4
je 0x1002e9f9
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0xb
je 0x1002e9f9
cmp dword [ebp - 8], 1
jge 0x1002ea47
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c], 0xffffffff
mov byte [ebp - 1], 0
jmp 0x1002ea91
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x50], ecx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x54], eax
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
jne 0x1002ea91
mov edx, dword [ebp + 8]
push edx
call sym.glib_2.0.dll_g_scanner_sync_file_offset
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x50]
mov dword [eax + 0x54], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c], 0xffffffff
jmp 0x1002ea97
mov byte [ebp - 1], 0
movzx ecx, byte [ebp - 1]
cmp ecx, 0xa
jne 0x1002eab8
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x1002eacd
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002eacd
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x10037a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.glib_2.0.dll_g_option_context_get_help
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0x100e2b1c
call sym.glib_2.0.dll_g_print
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call sym.glib_2.0.dll_g_free
add esp, 4
push 0
call dword [sym.imp.MSVCR90.dll_exit]
mov esp, ebp
pop ebp
ret
Function at 0x10043310
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x60
call sym.glib_2.0.dll_g_malloc0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [0x100fe764], 0
jne 0x10043352
push str.G_MAIN_POLL_DEBUG
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x10043348
mov dword [0x100fe750], 1
mov dword [0x100fe764], 1
mov eax, dword [ebp - 4]
push eax
call sym.glib_2.0.dll_g_static_mutex_init
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x50], sym.glib_2.0.dll_g_poll
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], 0
call sym.glib_2.0.dll_g_ptr_array_new
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], 0
cmp dword [sym.glib_2.0.dll_g_threads_got_initialized], 0
je 0x100433e4
mov eax, dword [ebp - 4]
push eax
call fcn.10041ff0
add esp, 4
jmp 0x100433fc
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x100fe758]
push edx
call sym.glib_2.0.dll_g_slist_prepend
add esp, 8
mov dword [0x100fe758], eax
cmp dword [sym.glib_2.0.dll_g_threads_got_initialized], 0
je 0x10043435
cmp dword [0x100fe75c], 0
je 0x10043418
mov eax, dword [0x100fe75c]
mov dword [ebp - 8], eax
jmp 0x10043428
push 0x100fe75c
call sym.glib_2.0.dll_g_static_mutex_get_mutex_impl
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x100d5de4]
add esp, 4
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x100fe760]
push eax
call sym.glib_2.0.dll_g_slist_append
add esp, 8
mov dword [0x100fe760], eax
cmp dword [0x100fe750], 0
je 0x10043466
mov ecx, dword [ebp - 4]
push ecx
push str.created_context_p_n
call sym.glib_2.0.dll_g_print
add esp, 8
cmp dword [sym.glib_2.0.dll_g_threads_got_initialized], 0
je 0x100434a0
cmp dword [0x100fe75c], 0
je 0x10043483
mov edx, dword [0x100fe75c]
mov dword [ebp - 0xc], edx
jmp 0x10043493
push 0x100fe75c
call sym.glib_2.0.dll_g_static_mutex_get_mutex_impl
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [0x100d5dec]
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1004bb40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.MSVCR90.dll__get_osfhandle]
add esp, 4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 4]
push eax
push 1
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
and eax, 1
shl eax, 3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x34]
and edx, 0xfffffff7
or edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], edx
push 0
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp - 0x1d]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
and ecx, 1
shl ecx, 4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
and eax, 0xffffffef
or eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x34], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
and eax, 0xffffffdf
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x34], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1004bbe0
Capabilities:
Read file on windows
Read pipe
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 6]
and edx, 0x1000
je 0x1004bcb7
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp - 9]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.MSVCR90.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1004bc3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1004bc3c
mov dword [ebp - 0x10], 0
jmp 0x1004bc43
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0x10]
and ecx, 1
shl ecx, 3
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
and eax, 0xfffffff7
or eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x34], eax
push 0
lea edx, [ebp - 4]
push edx
push 0
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.MSVCR90.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], 0
setne al
and eax, 1
shl eax, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x34]
and edx, 0xffffffef
or edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x34]
and edx, 0xffffffdf
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], edx
jmp 0x1004bd52
push 0
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp - 9]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.MSVCR90.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
xor edx, edx
cmp dword [ebp - 0x18], 0
setne dl
and edx, 1
shl edx, 3
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x34]
and ecx, 0xfffffff7
or ecx, edx
mov edx, dword [ebp + 8]
mov dword [edx + 0x34], ecx
push 0
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp - 9]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.MSVCR90.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x1c], eax
xor ecx, ecx
cmp dword [ebp - 0x1c], 0
setne cl
and ecx, 1
shl ecx, 4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
and eax, 0xffffffef
or eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x34], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
or eax, 0x20
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x34], eax
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1004bd70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push str.G_IO_WIN32_DEBUG
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
neg eax
sbb eax, eax
neg eax
pop ebp
ret
Function at 0x1004e650
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
add eax, 0x74
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1004e6a5
call dword [sym.imp.MSVCR90.dll__errno]
mov eax, dword [eax]
push eax
call sym.glib_2.0.dll_g_strerror
add esp, 4
push eax
push str.Error_creating_thread:__s.
push 0x10
push 0x100ec2cc
call sym.glib_2.0.dll_g_log
add esp, 0x10
jmp 0x1004e6e9
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1004e6e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.glib_2.0.dll_g_win32_error_message
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
push str.Error_closing_thread_handle:__s.
push 0x10
push 0x100ec2f8
call sym.glib_2.0.dll_g_log
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call sym.glib_2.0.dll_g_free
add esp, 4
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x8c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret