{
  "ml": {
    "v": "7",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.01689916,
        "rte": "az",
        "prob": 0.01689916
      },
      {
        "cls": 0,
        "raw": 0.0000045597553,
        "rte": "az/source",
        "prob": 0.0000045597553
      },
      {
        "cls": 0,
        "raw": 0.21949604,
        "rte": "az/c",
        "prob": 0.21949604
      }
    ],
    "prob": 0.01689916,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.01689915917813778
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-10T10:20:21Z"
  },
  "path": "loaddll.c",
  "raw": {
    "v": "7",
    "tv": "46abf",
    "files": [
      {
        "id": 0,
        "mol": "H(Ds)",
        "sha": "b5001fe5845354dc8097be84214103e5a7ac4e4f0715f5edb3c39de8c29ed450",
        "fact": {
          "id": "c",
          "imp": [
            [
              "",
              "PTR_OFFSET"
            ],
            [
              "",
              "PTR_OFFSET"
            ],
            [
              "",
              "HIWORD"
            ],
            [
              "",
              "LOWORD"
            ],
            [
              "",
              "GetDataDirectory"
            ],
            [
              "",
              "ProcessRelocation"
            ],
            [
              "",
              "PTR_OFFSET"
            ],
            [
              "",
              "funcs.LoadLibraryA"
            ],
            [
              "",
              "PTR_OFFSET"
            ],
            [
              "",
              "PTR_OFFSET"
            ],
            [
              "",
              "PTR_OFFSET"
            ],
            [
              "",
              "DEREF"
            ],
            [
              "",
              "IMAGE_ORDINAL"
            ],
            [
              "",
              "DEREF"
            ],
            [
              "",
              "funcs.GetProcAddress"
            ],
            [
              "",
              "PTR_OFFSET"
            ],
            [
              "",
              "DEREF"
            ],
            [
              "",
              "funcs.GetProcAddress"
            ],
            [
              "",
              "GetDataDirectory"
            ],
            [
              "",
              "PTR_OFFSET"
            ],
            [
              "",
              "ProcessImport"
            ],
            [
              "",
              "PTR_OFFSET"
            ],
            [
              "",
              "movsb"
            ],
            [
              "",
              "PTR_OFFSET"
            ],
            [
              "",
              "movsb"
            ],
            [
              "",
              "LoadSections"
            ],
            [
              "",
              "ProcessRelocations"
            ],
            [
              "",
              "loaderdefs.h"
            ],
            [
              "",
              "tcg.h"
            ]
          ],
          "mbr": [
            "data.DosHeader",
            "data.DosHeader.e_lfanew",
            "data.NtHeaders",
            "data.NtHeaders.OptionalHeader",
            "data.OptionalHeader",
            "data.OptionalHeader.SizeOfImage",
            "dll.NtHeaders",
            "dll.NtHeaders.FileHeader",
            "dll.NtHeaders.FileHeader.NumberOfSections",
            "dll.NtHeaders.FileHeader.SizeOfOptionalHeader",
            "dll.OptionalHeader",
            "dll.OptionalHeader.AddressOfEntryPoint",
            "dll.OptionalHeader.DataDirectory",
            "dll.OptionalHeader.ImageBase",
            "dll.OptionalHeader.SizeOfHeaders",
            "firstThunk.u1",
            "firstThunk.u1.AddressOfData",
            "funcs.GetProcAddress",
            "funcs.LoadLibraryA",
            "importByName.Name",
            "importDesc.FirstThunk",
            "importDesc.Name",
            "importDesc.OriginalFirstThunk",
            "importTableHdr.VirtualAddress",
            "originalFirstThunk.u1",
            "originalFirstThunk.u1.Ordinal",
            "relocEntry.offset",
            "relocEntry.type",
            "relocation.SizeOfBlock",
            "relocation.VirtualAddress",
            "relocationData.Size",
            "relocationData.VirtualAddress",
            "sectionHdr.PointerToRawData",
            "sectionHdr.SizeOfRawData",
            "sectionHdr.VirtualAddress"
          ],
          "met": {
            "ast": {
              "op.eq": 4.0,
              "op.lt": 2.0,
              "op.add": 13.0,
              "op.div": 1.0,
              "op.mul": 4.0,
              "op.sub": 2.0,
              "op.band": 2.0,
              "op.land": 1.0,
              "max_depth": 20.0,
              "op.concat": 5.0,
              "bind_count": 19.0,
              "call_count": 27.0,
              "node_count": 1439.0,
              "member_count": 35.0,
              "op_density.eq": 0.0,
              "op_density.lt": 0.0,
              "op_density.add": 0.01,
              "op_density.div": 0.0,
              "op_density.mul": 0.0,
              "op_density.sub": 0.0,
              "op_density.band": 0.0,
              "op_density.land": 0.0,
              "identifier_count": 93.0,
              "member_depth_max": 4.0,
              "op_density.concat": 0.0,
              "string_literal_count": 2.0,
              "string_concat_chain_max_length": 2.0
            },
            "file": {
              "size": 8002.0,
              "entropy": 5.42,
              "size_bytes": 8002.0
            },
            "text": {
              "tab_count": 179.0,
              "digit_ratio": 0.01,
              "space_count": 1005.0,
              "total_lines": 196.0,
              "char_entropy": 5.42,
              "mixed_indent": 1.0,
              "unique_chars": 88.0,
              "string_density": 0.01,
              "avg_line_length": 39.83,
              "high_byte_ratio": 0.0,
              "max_line_length": 125.0,
              "non_ascii_ratio": 0.0,
              "empty_line_ratio": 0.18,
              "last_line_length": 1.0,
              "long_token_count": 1.0,
              "whitespace_ratio": 0.17,
              "most_common_ratio": 0.05,
              "identifier_density": 1.66,
              "line_length_stddev": 35.95,
              "normalized_string_count": 0.14,
              "repeated_char_sequences": 8.0,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 0.21,
              "max_inline_whitespace_run": 20.0,
              "most_common_char_codepoint": 101.0,
              "suspicious_identifier_ratio": 0.02,
              "normalized_unique_identifiers": 12.21
            },
            "binds": {
              "count": 19.0
            },
            "calls": {
              "count": 27.0
            },
            "binary": {
              "overall_entropy": 5.42
            },
            "source": {
              "function_count": 10.0
            },
            "imports": {
              "count": 2.0,
              "unique_modules": 2.0,
              "third_party_count": 2.0,
              "third_party_ratio": 1.0
            },
            "members": {
              "count": 35.0
            },
            "strings": {
              "total": 2.0,
              "avg_length": 8.5,
              "max_length": 12.0,
              "avg_entropy": 2.79,
              "total_bytes": 17.0,
              "entropy_stddev": 0.46
            },
            "comments": {
              "chars": 3020.0,
              "lines": 56.0,
              "total": 24.0,
              "to_code_ratio": 0.4,
              "url_in_comments": 2.0,
              "high_entropy_comments": 5.0
            },
            "functions": {
              "count": 10.0
            },
            "identifiers": {
              "count": 93.0,
              "total": 326.0,
              "avg_length": 11.91,
              "max_length": 31.0,
              "min_length": 1.0,
              "avg_entropy": 2.96,
              "reuse_ratio": 0.29,
              "unique_count": 93.0,
              "length_stddev": 6.01,
              "has_digit_ratio": 0.02,
              "sequential_names": 2.0,
              "single_char_count": 1.0,
              "single_char_ratio": 0.01,
              "high_entropy_count": 19.0,
              "high_entropy_ratio": 0.2,
              "all_lowercase_ratio": 0.14,
              "all_uppercase_ratio": 0.31,
              "numeric_suffix_count": 2.0,
              "underscore_prefix_count": 3.0
            }
          },
          "str": [
            [
              1586,
              "u8",
              "loaderdefs.h"
            ],
            [
              1587,
              "u8",
              "loaderdefs.h"
            ],
            [
              1610,
              "u8",
              "tcg.h"
            ],
            [
              1611,
              "u8",
              "tcg.h"
            ],
            [
              1649,
              "10",
              "12"
            ],
            [
              1664,
              "10",
              "4"
            ],
            [
              2265,
              "10",
              "0"
            ],
            [
              6718,
              "10",
              "0"
            ]
          ],
          "tgt": [
            "DEREF",
            "GetDataDirectory",
            "HIWORD",
            "IMAGE_ORDINAL",
            "LOWORD",
            "LoadSections",
            "PTR_OFFSET",
            "ProcessImport",
            "ProcessRelocation",
            "ProcessRelocations",
            "__movsb",
            "funcs.GetProcAddress",
            "funcs.LoadLibraryA"
          ],
          "val": {
            "file.stem": "loaddll",
            "file.basename": "loaddll.c",
            "source.language": "c",
            "source.imports[0]": "DEREF",
            "source.imports[1]": "GetDataDirectory",
            "source.imports[2]": "HIWORD",
            "source.imports[3]": "IMAGE_ORDINAL",
            "source.imports[4]": "LOWORD",
            "source.imports[5]": "LoadSections",
            "source.imports[6]": "PTR_OFFSET",
            "source.imports[7]": "ProcessImport",
            "source.imports[8]": "ProcessRelocation",
            "source.imports[9]": "ProcessRelocations",
            "source.strings[0]": "loaderdefs.h",
            "source.has_imports": true,
            "source.imports[10]": "funcs.GetProcAddress",
            "source.imports[11]": "funcs.LoadLibraryA",
            "source.imports[12]": "loaderdefs.h",
            "source.imports[13]": "movsb",
            "source.imports[14]": "tcg.h",
            "source.functions[0]": "* GetDataDirectory(DLLDATA * dll, UINT entry)",
            "source.functions[1]": "EntryPoint(DLLDATA * dll, void * base)",
            "source.functions[2]": "LoadDLL(DLLDATA * dll, char * src, char * dst)",
            "source.functions[3]": "LoadSections(DLLDATA * dll, char * src, char * dst)",
            "source.functions[4]": "ParseDLL(char * src, DLLDATA * data)",
            "source.functions[5]": "ProcessImport(IMPORTFUNCS * funcs, DLLDATA * dll, char * dst, IMAGE_IMPORT_DESCRIPTOR * importDesc)",
            "source.functions[6]": "ProcessImports(IMPORTFUNCS * funcs, DLLDATA * dll, char * dst)",
            "source.functions[7]": "ProcessRelocation(DLLDATA * dll, char * src, char * dst, IMAGE_BASE_RELOCATION * relocation, ULONG_PTR newBaseAddress)",
            "source.functions[8]": "ProcessRelocations(DLLDATA * dll, char * src, char * dst)",
            "source.functions[9]": "SizeOfDLL(DLLDATA * data)"
          }
        },
        "find": [
          {
            "ev": [
              "VirtualAddress"
            ],
            "id": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-virtualaddr",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "PE VirtualAddress reference"
          },
          {
            "ev": [
              "NumberOfSections"
            ],
            "id": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-sections",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "PE NumberOfSections reference"
          },
          {
            "ev": [
              "IMAGE_DIRECTORY_ENTRY_IMPORT"
            ],
            "id": "micro-behaviors/process/hook/interception::pe-import-directory-source",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "PE import directory access"
          },
          {
            "ev": [
              "LoadLibraryA"
            ],
            "id": "micro-behaviors/dylib/load/source::load-library-a-source",
            "atk": "T1574.002",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "LoadLibraryA call in source"
          },
          {
            "ev": [
              "source code"
            ],
            "id": "micro-behaviors/data/text/keywords/lexicon::target-source-test",
            "conf": 0.8799999952316284,
            "crit": 1,
            "desc": "Source or test deletion target"
          },
          {
            "ev": [
              "code"
            ],
            "id": "micro-behaviors/data/text/keywords/lexicon::target-codebase",
            "conf": 0.8799999952316284,
            "crit": 1,
            "desc": "Codebase deletion target"
          },
          {
            "ev": [
              "PointerToRawData"
            ],
            "id": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-pointerraw",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "PE PointerToRawData reference"
          },
          {
            "ev": [
              "reactos.org"
            ],
            "id": "metadata/lang/source::reactos-org-domain",
            "conf": 0.949999988079071,
            "crit": 2,
            "desc": "reactos.org domain reference"
          },
          {
            "ev": [
              "SizeOfRawData"
            ],
            "id": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-sizeofraw",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "PE SizeOfRawData reference"
          },
          {
            "ev": [
              "ReactOS"
            ],
            "id": "metadata/lang/source::reactos-string",
            "conf": 0.949999988079071,
            "crit": 2,
            "desc": "ReactOS branding string in source"
          },
          {
            "ev": [
              "FirstThunk"
            ],
            "id": "micro-behaviors/process/hook/interception::first-thunk-source",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "PE FirstThunk access"
          },
          {
            "ev": [
              "SizeOfImage"
            ],
            "id": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-sizeofimage",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "PE header SizeOfImage reference"
          },
          {
            "ev": [
              "GetProcAddress"
            ],
            "id": "micro-behaviors/dylib/lookup::get-proc-address-source",
            "atk": "T1574.002",
            "conf": 0.949999988079071,
            "crit": 2,
            "desc": "Windows GetProcAddress in source"
          },
          {
            "ev": [
              "IMAGE_SECTION_HEADER"
            ],
            "id": "micro-behaviors/fs/file/section::pe-viewer-header-labels",
            "conf": 1.0,
            "crit": 1,
            "desc": "PE viewer structure header labels"
          },
          {
            "ev": [
              "AddressOfEntryPoint"
            ],
            "id": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-entrypoint",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "PE entry point header field"
          },
          {
            "ev": [
              "SizeOfRawData",
              "VirtualAddress",
              "PointerToRawData",
              "NumberOfSections"
            ],
            "id": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "Source references PE section layout fields"
          },
          {
            "ev": [
              "AddressOfEntryPoint",
              "SizeOfImage"
            ],
            "id": "micro-behaviors/fs/file/section::asm-pe-header-manipulation",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "Source references multiple PE header fields"
          }
        ],
        "path": "/data/samples/bad/projects/execute-assembly-pico/lib/libtcg/src/loaddll.c",
        "risk": 2,
        "size": 8002,
        "type": "c"
      }
    ]
  }
}