joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002c3d0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0xc]
xor edi, edi
inc eax
mov r14, rdx
movsxd rbp, eax
mov rbx, rcx
movabs rax, 0x1fffffffffffffff
cmp rbp, rax
jbe 0x18002c436
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rbp
lea edx, [rdi + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18002c434
lea rbp, [rbp*8]
test rbp, rbp
je 0x18002c478
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x18002c47a
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbp
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18002c476
xor esi, esi
xor edx, edx
cmp dword [rbx], edx
jbe 0x18002c49e
mov rax, qword [rbx + 0x20]
cmp dword [rax + rdx*4], 2
jb 0x18002c498
mov rax, qword [rbx + 0x18]
mov rax, qword [rax + rdx*8]
mov qword [rsi + rdi*8], rax
inc edi
inc edx
cmp edx, dword [rbx]
jb 0x18002c480
movsxd rax, dword [rbx + 0xc]
mov ebp, edi
cmp rbp, rax
je 0x18002c518
xorps xmm0, xmm0
lea r9, [0x1800ef510]
xorps xmm1, xmm1
lea rdx, str.j__hash_table__nnodes
cvtsi2sd xmm0, rax
lea rcx, str.assertion_failed___s_:___I64i__s__I64i_
cvtsi2sd xmm1, rbp
cvttsd2si rax, xmm0
cvttsd2si r8, xmm1
mov qword [rsp + 0x20], rax
call sym.glib_2.0.dll_g_strdup_printf
lea r9, [0x1800ef530]
mov qword [rsp + 0x20], rax
mov r8d, 0x701
lea rdx, str.d:_buildob_bora_15653658cayman_glibglib_srcglibghash.c
lea rcx, [0x18009cbc8]
mov rbx, rax
call sym.glib_2.0.dll_g_assertion_message
test rbx, rbx
je 0x18002c518
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi + rdi*8], 0
mov rax, rsi
test r14, r14
je 0x18002c52b
mov dword [r14], edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x18002c670
Capabilities:
Hash data using djb2

Disassembly:
movzx edx, byte [rcx]
mov eax, 0x1505
test dl, dl
je 0x18002c693
nop dword [rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
movsx edx, dl
add eax, edx
movzx edx, byte [rcx]
test dl, dl
jne 0x18002c680
ret
Function at 0x18002f4a0
Capabilities:
Reference absolute stream path on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rcx], 1
mov ecx, 6
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x18002f4ea
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 6
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18002f4e8
mov eax, dword [0x1800eb510]
mov dword [rcx], eax
movzx eax, word [0x1800eb514]
mov word [rcx + 4], ax
xor eax, eax
mov qword [rbx + 0x28], rax
mov dword [rbx + 0x30], eax
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x38], 0x400
mov qword [rbx + 0x18], 0xffffffffffffffff
mov qword [rbx + 0x20], 0xffffffffffffffff
mov byte [rbx + 0x58], al
mov eax, dword [rbx + 0x60]
and eax, 0xfffffff9
or eax, 1
mov dword [rbx + 0x60], eax
add rsp, 0x30
pop rbx
ret
Function at 0x1800337b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x1070
call fcn.180099990
sub rsp, rax
mov rax, qword [0x18011c010]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov r14d, edx
mov qword [rsp + 0x20], 0
mov rbp, rcx
lea rdx, [rsp + 0x28]
mov ecx, r14d
mov rsi, r9
mov edi, r8d
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64]
test eax, eax
jns 0x180033846
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, dword [rax]
mov ecx, edi
call sym.glib_2.0.dll_g_strerror
mov rbx, rax
call sym.glib_2.0.dll_g_file_error_quark
mov ebp, eax
test rsi, rsi
je 0x1800338c4
cmp qword [rsi], 0
jne 0x1800338a9
mov ecx, edi
call sym.glib_2.0.dll_g_file_error_from_errno
mov edx, eax
mov ecx, ebp
mov r8, rbx
call sym.glib_2.0.dll_g_error_new_literal
mov qword [rsi], rax
xor eax, eax
jmp 0x180033991
mov eax, 0x8000
test word [rsp + 0x2e], ax
jne 0x1800338cb
call fcn.18002a6c0
call fcn.18002aa30
test eax, eax
jne 0x180033869
lea rbx, str.Not_a_regular_file
jmp 0x180033880
lea rdx, str.Not_a_regular_file
lea rcx, str.glib20
call qword [sym.imp.intl.dll_libintl_dgettext]
mov rbx, rax
call sym.glib_2.0.dll_g_key_file_error_quark
test rsi, rsi
je 0x1800338c4
cmp qword [rsi], 0
jne 0x1800338a9
mov edx, 1
mov ecx, eax
mov r8, rbx
call sym.glib_2.0.dll_g_error_new_literal
mov qword [rsi], rax
xor eax, eax
jmp 0x180033991
mov r9, rbx
lea r8, str.GError_set_over_the_top_of_a_previous_GError_or_uninitialized_memory._nThis_indicates_a_bug_in_someones_code._You_must_ensure_an_error_is_NULL_before_its_set._nThe_overwriting_error_message_was:__s
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor eax, eax
jmp 0x180033991
movzx ebx, byte [rbp + 0x28]
mov rcx, rbp
call fcn.1800332e0
mov rcx, rbp
call fcn.180033210
mov byte [rbp + 0x28], bl
mov dword [rbp + 0x2c], edi
nop word [rax + rax]
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
movsxd rdi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
test rdi, rdi
je 0x180033977
jns 0x18003394c
cmp ebx, 4
je 0x1800338f0
cmp ebx, 0xb
je 0x1800338f0
mov ecx, ebx
call sym.glib_2.0.dll_g_strerror
mov ecx, ebx
mov rdi, rax
call sym.glib_2.0.dll_g_file_error_from_errno
mov ebx, eax
call sym.glib_2.0.dll_g_file_error_quark
mov edx, eax
mov r9, rdi
mov r8d, ebx
mov rcx, rsi
call sym.glib_2.0.dll_g_set_error_literal
xor eax, eax
jmp 0x180033991
lea r9, [rsp + 0x20]
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.180034ce0
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x1800338f0
mov rcx, rsi
call sym.glib_2.0.dll_g_propagate_error
xor eax, eax
jmp 0x180033991
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.180034e50
mov rdx, qword [rsp + 0x20]
test rdx, rdx
jne 0x18003396b
lea eax, [rdx + 1]
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1800989b0
add rsp, 0x1070
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180035100
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r15, r8
mov rdi, rdx
test rcx, rcx
je 0x180035334
test rdx, rdx
je 0x1800352f8
mov qword [rsp + 0x58], rbx
mov rbx, qword [rcx + 8]
mov qword [rsp + 0x60], rsi
test rbx, rbx
je 0x18003528c
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.18002ac40
mov esi, eax
mov rax, qword [rbx + 0x20]
cmp dword [rax + rsi*4], 2
jb 0x1800352a6
mov rax, qword [rbx + 0x28]
mov rsi, qword [rax + rsi*8]
test rsi, rsi
je 0x1800352a6
mov rdx, qword [rsi + 0x10]
xor edi, edi
test rdx, rdx
je 0x18003519b
nop dword [rax]
mov rax, qword [rdx]
lea rcx, [rdi + 1]
mov rdx, qword [rdx + 8]
cmp qword [rax], 0
cmove rcx, rdi
mov rdi, rcx
test rdx, rdx
jne 0x180035180
lea rax, [rdi + 1]
movabs rcx, 0x1fffffffffffffff
cmp rax, rcx
jbe 0x1800351e2
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rax
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop dword [rax + rax]
jmp 0x1800351e0
lea rbx, [rax*8]
test rbx, rbx
je 0x180035224
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
jne 0x180035227
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180035222
xor r14d, r14d
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x180035260
lea rsi, [rdi - 1]
lea rsi, [r14 + rsi*8]
nop dword [rax + rax]
mov rax, qword [rbx]
mov rcx, qword [rax]
test rcx, rcx
je 0x180035257
call sym.glib_2.0.dll_g_strdup
mov qword [rsi], rax
sub rsi, 8
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180035240
mov qword [r14 + rdi*8], 0
test r15, r15
je 0x180035270
mov qword [r15], rdi
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lea r8, str.hash_table___NULL
lea rdx, [0x1800ef350]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_return_if_fail_warning
call fcn.18002a6c0
call fcn.18002aa30
test eax, eax
jne 0x1800352bd
lea rbx, str.Key_file_does_not_have_group__s
jmp 0x1800352d4
lea rdx, str.Key_file_does_not_have_group__s
lea rcx, str.glib20
call qword [sym.imp.intl.dll_libintl_dgettext]
mov rbx, rax
call sym.glib_2.0.dll_g_key_file_error_quark
mov edx, eax
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8d, 4
mov rcx, rbp
call sym.glib_2.0.dll_g_set_error
xor eax, eax
jmp 0x180035273
lea rax, str.group_name___NULL
lea r9, [0x1800f0d08]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
mov edx, 8
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
mov rbp, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lea rax, str.key_file___NULL
jmp 0x1800352ff
Function at 0x180039be0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov ebp, r8d
mov rsi, rdx
mov r14, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], 0
jne 0x180039c02
inc rbx
lea rdi, [rbx + rbx]
test rdi, rdi
je 0x180039c52
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r10, rax
test rax, rax
jne 0x180039c55
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rdi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop word [rax + rax]
jmp 0x180039c50
xor r10d, r10d
lea r11, [rsi - 1]
mov r8, r10
add r11, rbx
mov r9d, 1
cmp rsi, r11
jae 0x180039e18
mov byte [rsp + 0x58], 0x5c
mov byte [rsp + 0x5a], 0
nop dword [rax + rax]
movsx edx, byte [rsi]
mov ecx, edx
mov byte [rsp + 0x59], 0
sub ecx, 9
je 0x180039dd8
sub ecx, 1
je 0x180039da8
sub ecx, 3
je 0x180039d77
sub ecx, 0x13
je 0x180039d48
cmp ecx, 0x3c
je 0x180039d1c
test ebp, ebp
je 0x180039cf9
movzx eax, byte [r14 + 0x28]
cmp dl, al
jne 0x180039cf9
mov byte [rsp + 0x59], al
lea rcx, [rsp + 0x58]
lea rax, [rsp + 0x58]
mov rdx, r8
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180039ce0
mov eax, 2
lea r9d, [rax - 1]
jmp 0x180039d04
xor r9d, r9d
mov byte [r8], dl
mov eax, 1
add r8, rax
inc rsi
cmp rsi, r11
jb 0x180039c80
mov byte [r8], 0
jmp 0x180039e1c
lea rax, [rsp + 0x58]
mov byte [rsp + 0x59], 0x5c
mov rdx, r8
lea rcx, [rsp + 0x58]
sub rdx, rax
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180039d31
xor r9d, r9d
lea eax, [r9 + 2]
jmp 0x180039d04
test r9d, r9d
je 0x180039cfc
lea rax, [rsp + 0x58]
mov byte [rsp + 0x59], 0x73
mov rdx, r8
lea rcx, [rsp + 0x58]
sub rdx, rax
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180039d62
mov eax, 2
jmp 0x180039d04
lea rax, [rsp + 0x58]
mov byte [rsp + 0x59], 0x72
mov rdx, r8
lea rcx, [rsp + 0x58]
sub rdx, rax
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180039d90
mov eax, 2
jmp 0x180039d04
lea rax, [rsp + 0x58]
mov byte [rsp + 0x59], WSAGetLastError
mov rdx, r8
lea rcx, [rsp + 0x58]
sub rdx, rax
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180039dc0
mov eax, 2
jmp 0x180039d04
test r9d, r9d
je 0x180039cfc
lea rax, [rsp + 0x58]
mov byte [rsp + 0x59], 0x74
mov rdx, r8
lea rcx, [rsp + 0x58]
sub rdx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180039e00
mov eax, 2
jmp 0x180039d04
mov byte [r10], 0
mov rbx, qword [rsp + 0x50]
mov rax, r10
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x18003a2a0
Capabilities:
Reference absolute stream path on windows

Disassembly:
sub rsp, 0x38
test edx, edx
je 0x18003a2fd
mov ecx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x18003a2e3
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 5
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18003a2e1
mov eax, dword [str.true]
mov dword [rcx], eax
movzx eax, byte [0x1800f1644]
mov byte [rcx + 4], al
mov rax, rcx
add rsp, 0x38
ret
mov ecx, 6
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x18003a338
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 6
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18003a336
mov eax, dword [str.false]
mov dword [rcx], eax
movzx eax, word [0x1800f164c]
mov word [rcx + 4], ax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x18003aa70
Capabilities:
Query environment variable
Reference absolute stream path on windows

Disassembly:
mov r11, rsp
sub rsp, 0xa8
mov rax, qword [0x18011c010]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp dword [0x18011e9d8], 0
jne 0x18003ac4a
lea rax, str.error
mov qword [r11 - 8], rbx
mov ebx, dword [0x18011c138]
lea rcx, str.G_MESSAGES_PREFIXED
mov qword [r11 - 0x78], rax
lea rax, str.critical
mov dword [rsp + 0x38], 4
mov qword [r11 - 0x68], rax
lea rax, str.warning
mov dword [rsp + 0x48], 8
mov qword [r11 - 0x58], rax
lea rax, str.message
mov dword [rsp + 0x58], reloc.WS2_32.dll_recv
mov qword [r11 - 0x48], rax
lea rax, str.info
mov dword [rsp + 0x68], 0x20
mov qword [r11 - 0x38], rax
lea rax, str.debug
mov dword [rsp + 0x78], 0x40
mov qword [r11 - 0x28], rax
mov dword [0x18011e9d8], 1
mov dword [r11 - 0x20], 0x80
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x18003ab46
mov r8d, 6
lea rdx, [rsp + 0x30]
mov rcx, rax
call sym.glib_2.0.dll_g_parse_debug_string
mov ebx, eax
lea rax, str.gc_friendly
mov dword [0x18011c138], ebx
mov qword [rsp + 0x30], rax
lea rcx, str.G_DEBUG
lea rax, str.fatal_warnings
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x40], rax
lea rax, str.fatal_criticals
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0x18
mov dword [rsp + 0x58], 8
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, qword [rsp + 0xa0]
test rax, rax
je 0x18003abb5
mov r8d, 3
lea rdx, [rsp + 0x30]
mov rcx, rax
call sym.glib_2.0.dll_g_parse_debug_string
mov ecx, eax
and eax, 1
and ecx, 0xfffffffc
mov dword [sym.glib_2.0.dll_g_mem_gc_friendly], eax
or dword [0x18011c13c], ecx
cmp dword [0x18011eabc], 0
jne 0x18003ac62
xor r9d, r9d
lea rdx, [sym.glib_2.0.dll_g_str_equal]
xor r8d, r8d
lea rcx, [sym.glib_2.0.dll_g_str_hash]
call sym.glib_2.0.dll_g_hash_table_new_full
mov ecx, 0x4000
mov qword [0x18011eae0], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x18003ac32
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 0x4000
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop dword [rax]
jmp 0x18003ac30
mov qword [0x18011eac0], rax
mov qword [rax], 0
mov dword [0x18011eabc], 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800989b0
add rsp, 0xa8
ret
lea rax, str.quark_seq_id__0
mov r8d, 0x3c
lea r9, str.g_quark_init
mov qword [rsp + 0x20], rax
lea rdx, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgquark.c
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_assertion_message_expr
int3
Function at 0x18003bfb0
Capabilities:
Query environment variable
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rcx, [0x18011ea00]
call sym.glib_2.0.dll_g_once_init_enter
mov edi, 1
test eax, eax
je 0x18003c001
lea rcx, str.G_MAIN_POLL_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edx, dword [0x18011e748]
lea rcx, [0x18011ea00]
test rax, rax
cmovne edx, edi
mov dword [0x18011e748], edx
mov edx, edi
call sym.glib_2.0.dll_g_once_init_leave
mov edx, 0xb8
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
jne 0x18003c042
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:135
mov qword [rsp + 0x20], 0xb8
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop dword [rax]
jmp 0x18003c040
mov rax, qword [0x18011ef48]
mov rcx, rbx
call qword [case.0x180005f92.0]
mov rax, qword [0x18011ef88]
lea rcx, [rbx + 8]
call qword [case.0x180005f92.0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sym.glib_2.0.dll_g_hash_table_new_full
xor esi, esi
mov qword [rbx + 0x38], rax
lea rax, [sym.glib_2.0.dll_g_poll]
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x28], rsi
mov dword [rbx + 0x30], edi
lea ecx, [rsi + 0x20]
mov dword [rbx + 0x4c], edi
mov qword [rbx + 0x50], rsi
mov qword [rbx + 0xa0], rax
mov qword [rbx + 0x70], rsi
mov dword [rbx + 0x78], esi
call sym.glib_2.0.dll_g_slice_alloc
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov dword [rax + 0x10], edi
mov qword [rax + 0x18], rsi
mov qword [rbx + 0x40], rax
mov dword [rbx + 0xb0], esi
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
jne 0x18003c102
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.glib_2.0.dll_g_win32_error_message
mov r9, rax
lea r8, str.Cannot_create_event_for_GWakeup:__s
lea edx, [rsi + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop word [rax + rax]
jmp 0x18003c100
mov qword [rbx + 0x80], rax
lea r8, [rbx + 0x88]
mov qword [r8], rax
xor edx, edx
mov eax, 0x300
mov rcx, rbx
mov word [r8 + 8], ax
call fcn.180040210
mov rax, qword [0x18011ef58]
lea rcx, [0x18011e9f0]
call qword [case.0x180005f92.0]
mov rdi, qword [0x18011ea18]
mov ecx, reloc.WS2_32.dll_recv
call sym.glib_2.0.dll_g_slice_alloc
mov qword [rax], rbx
mov qword [rax + 8], rsi
test rdi, rdi
je 0x18003c176
mov rcx, qword [rdi + 8]
mov rdx, rdi
test rcx, rcx
je 0x18003c170
mov rdx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x18003c164
mov qword [rdx + 8], rax
jmp 0x18003c179
mov rdi, rax
cmp dword [0x18011e748], esi
mov qword [0x18011ea18], rdi
je 0x18003c197
mov rdx, rbx
lea rcx, str.created_context_p_n
call sym.glib_2.0.dll_g_print
mov rax, qword [0x18011ef68]
lea rcx, [0x18011e9f0]
call qword [case.0x180005f92.0]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18003c2e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call sym.glib_2.0.dll_g_main_context_acquire
test eax, eax
je 0x18003c37b
mov qword [rsp + 0x40], rdi
call sym.glib_2.0.dll_g_main_context_default
cmp rbx, rax
jne 0x18003c309
xor ebx, ebx
jmp 0x18003c316
test rbx, rbx
je 0x18003c316
mov rcx, rbx
call sym.glib_2.0.dll_g_main_context_ref
lea rcx, [0x18011df68]
call fcn.180094fc0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x18003c366
lea ecx, [rax + 0x18]
call sym.glib_2.0.dll_g_slice_alloc
mov rdi, rax
test rax, rax
je 0x18003c34f
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
lea rcx, [0x18011df68]
call fcn.180094fc0
mov ecx, eax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rdx, rbx
mov rcx, rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp sym.glib_2.0.dll_g_queue_push_head
lea rax, str.acquired_context
mov edx, 8
lea r9, [0x1800f18d0]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
add rsp, 0x30
pop rbx
ret

Function at 0x18003c3b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
call sym.glib_2.0.dll_g_main_context_default
xor edi, edi
lea rcx, [0x18011df68]
cmp rbx, rax
cmove rbx, rdi
call fcn.180094fc0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18003c424
mov rcx, qword [rax]
test rcx, rcx
je 0x18003c3ef
mov rdi, qword [rcx]
cmp rdi, rbx
jne 0x18003c41b
mov rcx, rax
call sym.glib_2.0.dll_g_queue_pop_head
mov rcx, rbx
call sym.glib_2.0.dll_g_main_context_release
test rbx, rbx
je 0x18003c44f
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp sym.glib_2.0.dll_g_main_context_unref
lea rax, str.g_queue_peek_head__stack___context
jmp 0x18003c42b
lea rax, str.stack___NULL
lea r9, [0x1800f1908]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
mov edx, 8
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18003c460
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
lea rcx, [0x18011df68]
call fcn.180094fc0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18003c48d
mov rax, qword [rax]
test rax, rax
je 0x18003c48d
mov rax, qword [rax]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x18003c4a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
lea rcx, [0x18011df68]
call fcn.180094fc0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18003c4cd
mov rax, qword [rax]
test rax, rax
je 0x18003c4c8
mov rax, qword [rax]
test rax, rax
jne 0x18003c4d7
call sym.glib_2.0.dll_g_main_context_default
test rax, rax
je 0x18003c4fa
lock or dword [rsp], 0
mov ecx, dword [rax + 0x30]
test ecx, ecx
jle 0x18003c4ec
lock inc dword [rax + 0x30]
add rsp, 0x38
ret
lea rax, str.g_atomic_int_get__context__ref_count____0
mov qword [rsp + 0x20], rax
jmp 0x18003c506
lea rcx, str.context___NULL
mov qword [rsp + 0x20], rcx
lea r9, [0x1800f1810]
mov edx, 8
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor eax, eax
add rsp, 0x38
ret

Function at 0x18003c530
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x30
mov rsi, rcx
test rcx, rcx
je 0x18003c5f7
cmp edx, 0x60
jb 0x18003c5ee
xor ebp, ebp
mov qword [rsp + 0x40], rdi
mov edi, edx
test edx, edx
je 0x18003c598
mov edx, edi
lea ecx, [rbp + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
jne 0x18003c59b
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:135
mov qword [rsp + 0x20], rdi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rbp + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18003c596
mov rbx, rbp
mov ecx, 0x20
call sym.glib_2.0.dll_g_slice_alloc
mov rdi, qword [rsp + 0x40]
test rax, rax
je 0x18003c5ba
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x18], rbp
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x10], rsi
mov dword [rbx + 0x18], 1
mov dword [rbx + 0x28], ebp
mov dword [rbx + 0x2c], 1
mov qword [rax + 0x10], 0xffffffffffffffff
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
lea rax, str.struct_size___sizeof__GSource_
jmp 0x18003c5fe
lea rax, str.source_funcs___NULL
lea r9, [0x1800f1970]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
mov edx, 8
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret