joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400afa30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x1400afab0
mov rdx, qword [rcx]
cmp rdx, 0x3fc
ja 0x1400afa90
mov rax, qword [0x14048f570]
mov r8, rdx
shr r8, 2
mov r8, qword [rax + r8*8]
test r8, r8
jne 0x1400afae8
lea r9, [0x1403893d1]
test rdx, rdx
jne 0x1400afa9e
lea r8, str.cannot_unreference_class_of_invalid__unclassed__type__s
mov edx, 0x10
lea rcx, [0x14038933a]
add rsp, 0x38
jmp fcn.1400d2190
mov r8, rdx
and r8, 0xfffffffffffffffc
test byte [r8 + 0x16], 2
jne 0x1400afaf3
mov rcx, rdx
call fcn.1400b8ae0
mov r9, rax
jmp 0x1400afa6c
lea rax, str.g_class___NULL
lea r9, str.g_type_class_unref
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x140389320]
lea rcx, [0x14038933a]
call fcn.1400d2190
nop
add rsp, 0x38
ret
test byte [r8 + 0x16], 2
je 0x1400afa60
mov eax, dword [r8]
test eax, eax
jne 0x1400afb08
mov rdx, qword [rcx]
jmp 0x1400afa60
mov eax, dword [r8]
cmp eax, 1
jbe 0x1400afb20
lea edx, [rax - 1]
lock cmpxchg dword [r8], edx
je 0x1400afadc
jmp 0x1400afb08
cmp qword [r8 + 8], 0
jne 0x1400afadc
mov ecx, dword [r8 + 0x28]
call fcn.1400d9720
lea r8, str.static_type__s_unreferenced_too_often
mov r9, rax
jmp 0x1400afa73
Function at 0x1400b0700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor edx, edx
mov rsi, rcx
mov ecx, 0x20
call fcn.14009f500
xor edx, edx
lea r8, [0x1400af6b0]
mov rcx, rax
mov rbx, rax
call fcn.14009f7b0
test rsi, rsi
je 0x1400b08d0
test rbx, rbx
je 0x1400b0908
mov rdx, qword [rsi + 0x10]
lea rax, [0x14035c2e0]
lea rcx, [0x14035c2a0]
mov rdi, qword [0x14048dbd0]
mov rbp, qword [0x14048d670]
cmp rdx, rax
setne al
cmp rdx, rcx
setne cl
and eax, ecx
cmp rdx, rdi
setne cl
and eax, ecx
cmp rdx, rbp
setne cl
test al, cl
je 0x1400b0788
cmp qword [rdx + 0x20], 0
je 0x1400b0938
mov rcx, rbx
call fcn.14009c5c0
mov rcx, rbx
call fcn.14009f840
lea r8, fcn.14009c5c0
mov rdx, rbx
mov rcx, rsi
call fcn.1400d42d0
cmp byte [rbx + 3], 0
lea rax, str.closure__is_invalid__FALSE
js 0x1400b0887
movzx eax, word [rbx + 2]
mov edx, eax
and dx, 0x7f8
cmp dx, 0x7f8
je 0x1400b0880
movzx edx, byte [rbx + 2]
shr ax, 3
mov rcx, qword [rbx + 0x18]
movzx eax, al
mov r8d, edx
shr dl, 1
and r8d, 1
and edx, 3
lea edx, [rdx + r8*2]
mov r8d, 0x10
lea edx, [rdx + rax + 1]
movsxd rdx, edx
call fcn.1400d5400
movzx edx, byte [rbx + 2]
mov qword [rbx + 0x18], rax
mov ecx, edx
shr dl, 1
and ecx, 1
and edx, 3
lea edx, [rdx + rcx*2]
movzx ecx, word [rbx + 2]
shr cx, 3
movzx ecx, cl
add edx, ecx
lea rcx, [0x1400af970]
movsxd rdx, edx
shl rdx, 4
mov qword [rax + rdx], rsi
mov rax, qword [rbx + 0x18]
mov qword [rax + rdx + 8], rcx
mov eax, dword [rbx]
mov edx, eax
mov ecx, eax
mov dword [rsp + 0x30], eax
shr edx, 0x13
shr ecx, 0x10
add edx, 1
and cx, 0xf807
movzx edx, dl
shl edx, 3
or edx, ecx
mov word [rsp + 0x32], dx
mov edx, dword [rsp + 0x30]
lock cmpxchg dword [rbx], edx
jne 0x1400b083f
cmp qword [rbx + 8], 0
je 0x1400b08b2
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, str.closure__n_inotifiers___CLOSURE_MAX_N_INOTIFIERS
mov qword [rsp + 0x20], rax
lea r9, str.g_closure_add_invalidate_notifier
lea r8, [0x140389320]
mov edx, 8
lea rcx, [0x14038933a]
call fcn.1400d2190
cmp qword [rbx + 8], 0
jne 0x1400b0875
mov rax, qword [rsi + 0x10]
mov rdx, qword [rax + 0x28]
test rdx, rdx
je 0x1400b0918
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.14009fa80
lea rax, [0x14038956f]
mov qword [rsp + 0x20], rax
lea r9, str.g_source_set_closure
lea r8, [0x140389320]
mov edx, 8
lea rcx, [0x14038933a]
call fcn.1400d2190
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [0x14038957e]
jmp 0x1400b08d7
cmp rax, rbp
je 0x1400b0929
mov rdx, qword [0x14048d490]
cmp rax, rdi
jne 0x1400b08bf
lea rdx, [0x1400af1f0]
jmp 0x1400b08bf
lea r8, str..._gobject_gsourceclosure.c:263:_closure_cannot_be_set_on_GSource_without_GSourceFuncs::closure_callback
mov edx, 8
lea rcx, [0x14038933a]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400d2190
Function at 0x1400b6750
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov edi, edx
test edx, edx
jne 0x1400b6820
xor r8d, r8d
xor edx, edx
call fcn.1400b4a80
mov rbx, rax
test rbx, rbx
je 0x1400b67e8
mov rcx, qword [0x1404cae00]
mov rdx, rbx
call fcn.1400c9800
mov eax, 1
mov dword [rbx], 0
mov word [rbx + 0x24], ax
test byte [rbx + 0x26], 2
jne 0x1400b67c8
mov eax, dword [rbx + 0x20]
mov ecx, dword [rbx + 0x1c]
test eax, eax
je 0x1400b6848
sub eax, 1
mov dword [rbx + 0x20], eax
jne 0x1400b6811
mov r8, rbx
mov rdx, rsi
add rsp, 0x70
pop rbx
pop rsi
pop rdi
jmp fcn.1400b5190
mov rcx, qword [rbx + 0x28]
mov rdx, rsi
call fcn.1402b2eb0
mov eax, dword [rbx + 0x20]
and byte [rbx + 0x26], 0xfd
mov ecx, dword [rbx + 0x1c]
test eax, eax
je 0x1400b6848
jmp 0x1400b67a8
mov dword [rsp + 0x28], edi
lea r9, str..._gobject_gsignal.c:2772
lea r8, str._s:_instance__p_has_no_handler_with_id__lu
mov edx, 0x10
mov qword [rsp + 0x20], rsi
lea rcx, [0x14038933a]
call fcn.1400d2190
nop
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
mov qword [rsp + 0x60], rcx
mov rcx, qword [0x1404cae00]
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x30]
call fcn.1400c84f0
mov rbx, rax
jmp 0x1400b6771
lea rax, [0x14038a7f8]
mov r9, qword [str.handler_unref_R]
lea r8, [0x140389320]
mov edx, 8
mov qword [rsp + 0x20], rax
lea rcx, [0x14038933a]
call fcn.1400d2190
jmp 0x1400b6811
Function at 0x1400b8780
Capabilities:
Enumerate process modules

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x260
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, rcx
xor edx, edx
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400b87d0
call rbx
cmp eax, 0x18
je 0x1400b8828
xor ebx, ebx
mov rax, rbx
add rsp, 0x260
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdi, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
mov rdx, rdi
call sub.KERNEL32.dll_Module32First
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1400b880f
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b87b5
mov rdx, rdi
mov rcx, rsi
call sub.KERNEL32.dll_Module32Next
test eax, eax
je 0x1400b87f3
mov rcx, qword [rsp + 0x48]
mov rdx, r12
call rbp
mov rbx, rax
test rax, rax
je 0x1400b8800
jmp 0x1400b87f5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400b8797
Function at 0x1400bccc0
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov dword [rsp + 0x3c], 0
mov rsi, rcx
mov rbx, rdx
test rcx, rcx
jne 0x1400bcd18
lea rax, str.data___NULL__len__0
test rdx, rdx
je 0x1400bcd18
mov qword [rsp + 0x20], rax
lea r9, str.g_base64_encode
lea r8, [0x14038b967]
mov edx, 8
lea rcx, [0x14038b962]
call fcn.1400d2190
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
movabs rax, 0xbffffffffffffff9
cmp rax, rbx
jb 0x1400bce10
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
shr rdx, 1
lea rdi, [rdx*4 + 5]
mov rcx, rdi
call sub.msvcrt.dll_malloc
test rax, rax
je 0x1400bcf9b
test rbx, rbx
je 0x1400bce60
cmp rbx, 2
ja 0x1400bce20
mov r10, rax
cmp rbx, 1
je 0x1400bcf80
xor ebx, ebx
movzx edx, byte [rsi]
mov ecx, 2
add rsi, 1
lea r8, [rsp + 0x3e]
mov byte [rsp + 0x3d], dl
movzx edx, byte [rsi]
mov byte [r8], dl
add cl, byte [rsp + 0x3c]
movzx edx, byte [rsp + 0x3d]
movzx r11d, byte [rsp + 0x3e]
mov byte [rsp + 0x3c], cl
cmp cl, 1
je 0x1400bce78
cmp cl, 2
jne 0x1400bce60
lea r8d, [r11*4]
lea rcx, [0x14038c740]
sar r11d, 4
and r8d, 0x3c
movzx r8d, byte [rcx + r8]
mov byte [r10 + 2], r8b
test r8b, r8b
jne 0x1400bce87
lea rax, str.outptr__2____0
lea r9, str.g_base64_encode_close
mov r8d, 0xe3
mov qword [rsp + 0x20], rax
lea rdx, str..._glib_gbase64.c
lea rcx, [0x14038b962]
call fcn.1400e7f70
nop dword [rax + rax]
lea rax, str.len_____G_MAXSIZE___1____4___1___3
jmp 0x1400bcce6
lea r9, [rsi + rbx - 2]
mov rbx, rax
cmp rsi, r9
jb 0x1400bcec0
sub r9, rsi
lea rcx, [r9 + 2]
cmp rcx, 2
ja 0x1400bcf50
sub rbx, rax
movsxd r10, ebx
add r10, rax
cmp rcx, 1
je 0x1400bcf91
cmp rcx, 2
je 0x1400bcd76
nop
xor edx, edx
add edx, ebx
movsxd rdx, edx
mov byte [rax + rdx], 0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov byte [r10 + 2], 0x3d
xor r11d, r11d
lea rcx, [0x14038c740]
mov r9d, edx
shl edx, 4
xor r8d, r8d
mov byte [r10 + 3], 0x3d
sar r9d, 2
and edx, 0x30
movsxd r9, r9d
or edx, r11d
mov r8b, byte [rcx + r9]
movsxd rdi, edx
mov edx, r8d
mov dh, byte [rcx + rdi]
mov word [r10], dx
mov edx, 4
jmp 0x1400bce62
lea rcx, [0x14038c740]
movzx r8d, byte [rsi]
movzx edx, byte [rsi + 1]
add rbx, 4
add rsi, 3
movzx edi, byte [rsi - 1]
mov r11d, r8d
mov r10d, r8d
mov r8d, edx
shl r11d, 4
sar r8d, 4
and r11d, 0x30
sar r10d, 2
or r11d, r8d
lea r8d, [rdx*4]
movzx edx, dil
and edi, 0x3f
sar edx, 6
and r8d, 0x3c
movsxd r11, r11d
movsxd r10, r10d
or r8d, edx
movzx edx, byte [rcx + rdi]
movsxd r8, r8d
movzx r8d, byte [rcx + r8]
shl edx, 8
or edx, r8d
movzx r8d, byte [rcx + r11]
shl edx, 8
or edx, r8d
movzx r8d, byte [rcx + r10]
shl edx, 8
or edx, r8d
mov dword [rbx - 4], edx
cmp rsi, r9
jb 0x1400bcec7
jmp 0x1400bce31
lea rax, str.len__0__len__1__len__2
lea r9, str.g_base64_encode_step
mov r8d, 0xa5
mov qword [rsp + 0x20], rax
lea rdx, str..._glib_gbase64.c
lea rcx, [0x14038b962]
call fcn.1400e7f70
nop dword [rax]
mov ecx, 1
xor ebx, ebx
lea r8, [rsp + 0x3d]
jmp 0x1400bcd8b
lea r8, [rsp + 0x3d]
jmp 0x1400bcd8b
mov qword [rsp + 0x20], rdi
lea r9, [0x14038b92d]
lea r8, [0x14038b940]
mov edx, 4
lea rcx, [0x14038b962]
call fcn.1400d2190
jmp 0x1400bcfbf
Function at 0x1400be1a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400be1e0
lea rcx, [rcx + 0x10]
call fcn.1400da490
test eax, eax
je 0x1400be1e0
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x1400be1c9
mov rcx, qword [rbx + 0x20]
call rax
mov rdx, rbx
mov ecx, 0x28
add rsp, 0x20
pop rbx
jmp fcn.1400e6130
add rsp, 0x20
pop rbx
ret

Function at 0x1400be1f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rdx
mov qword [rsp + 0x90], r8
mov rdi, rcx
mov qword [rsp + 0x98], r9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400f7740
mov r8, rbx
lea rdx, [rsp + 0x28]
xor ecx, ecx
lea r9, [rsp + 0x90]
mov rbp, rax
mov qword [rsp + 0x20], r9
call fcn.1402b7d40
mov rbx, rax
test rax, rax
je 0x1400be256
mov edx, dword [rsp + 0x28]
xor eax, eax
test edx, edx
cmovs rbx, rax
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.1400e4ea0
mov rcx, rax
mov rsi, rax
call fcn.1400e4a90
mov r14, qword [0x14048e3c0]
mov r13, rax
mov rax, qword [r14]
mov r12d, eax
test eax, eax
jne 0x1400be28e
mov rcx, r14
call fcn.1401001a0
mov r12d, eax
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, r13
mov ecx, r12d
mov r15, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test r15, r15
je 0x1400be2b9
mov rax, qword [r14 + 8]
test rax, rax
je 0x1400be2b9
mov rcx, r15
call rax
call qword [sym.imp.msvcrt.dll__errno]
mov r12, qword [0x14048ef10]
mov dword [rax], 0
mov eax, dword [r12]
test eax, eax
jne 0x1400be2e4
lea rcx, str.g_module_error_quark
call fcn.1400daa90
mov dword [r12], eax
test rdi, rdi
je 0x1400be30a
cmp qword [rdi], 0
je 0x1400be338
mov r9, rsi
lea r8, [0x14038c4e8]
mov edx, 0x10
lea rcx, [0x14038b962]
call fcn.1400d2190
mov rcx, rsi
call fcn.14034efb0
mov rcx, rbx
call fcn.14034efb0
mov rcx, rbp
call fcn.14034efb0
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8, rsi
xor edx, edx
mov ecx, eax
call fcn.1400cac00
mov qword [rdi], rax
jmp 0x1400be30a
Function at 0x1400be350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [0x14048e3c0]
mov qword [r8], 0
mov rax, qword [rbx]
mov rdi, rcx
mov r14, rdx
mov rsi, r8
mov r12d, eax
test eax, eax
jne 0x1400be38c
mov rcx, rbx
call fcn.1401001a0
mov r12d, eax
mov ecx, r12d
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rbp
xor edx, edx
mov r13, qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, r12d
mov r15, rax
call r13
test r15, r15
je 0x1400be3bd
mov rax, qword [rbx + 8]
test rax, rax
je 0x1400be3bd
mov rcx, r15
call rax
mov r12, qword [sym.imp.msvcrt.dll__errno]
call r12
mov dword [rax], 0
lea rax, [0x14038c5b6]
test rdi, rdi
je 0x1400be4e7
test r14, r14
je 0x1400be4e0
mov rcx, qword [0x14048d6f0]
call fcn.14010dd10
mov rcx, qword [rdi + 8]
cmp rcx, qword [0x14048cd70]
je 0x1400be510
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400be540
mov qword [rsi], rax
mov rax, qword [rbx]
mov ecx, eax
test eax, eax
jne 0x1400be42b
mov rcx, rbx
call fcn.1401001a0
mov ecx, eax
call rbp
mov rdi, rax
test rax, rax
je 0x1400be4b0
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r9, rax
lea r8, [0x14038c5da]
lea rcx, [0x14038c5de]
call fcn.1400e4ea0
mov rcx, rax
mov r14, rax
call fcn.1400e4a90
mov r15, rax
mov rax, qword [rbx]
mov ecx, eax
test eax, eax
je 0x1400be558
mov dword [rsp + 0x3c], ecx
call rbp
mov ecx, dword [rsp + 0x3c]
mov rdx, r15
mov rbp, rax
call r13
test rbp, rbp
je 0x1400be498
mov rax, qword [rbx + 8]
test rax, rax
je 0x1400be498
mov rcx, rbp
call rax
call r12
mov rcx, r14
mov dword [rax], 0
call fcn.14034efb0
mov qword [rsi], 0
mov rax, qword [0x14048d6f0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test rdi, rdi
sete al
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.symbol_name___NULL
mov qword [rsp + 0x20], rax
lea r9, str.g_module_symbol
lea r8, [0x14038b967]
mov edx, 8
lea rcx, [0x14038c5ae]
call fcn.1400d2190
xor eax, eax
jmp 0x1400be4c8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400be415
mov rcx, r14
call fcn.1400b8780
test rax, rax
jne 0x1400be415
nop
lea rdx, [0x14038c5d9]
xor ecx, ecx
call fcn.1400be1f0
xor eax, eax
jmp 0x1400be415
mov rcx, rbx
call fcn.1401001a0
mov ecx, eax
jmp 0x1400be472
Function at 0x1400c2dc0
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp qword [0x1404caea8], 0
je 0x1400c2de0
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, str.mlang.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x1400c2dd5
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
lea rdx, str.ConvertINetString
call rsi
mov rcx, rbx
lea rdx, str.ConvertINetMultiByteToUnicode
mov qword [0x1404caea8], rax
call rsi
mov rcx, rbx
lea rdx, str.ConvertINetUnicodeToMultiByte
mov qword [0x1404caea0], rax
call rsi
mov rcx, rbx
lea rdx, str.IsConvertINetStringAvailable
mov qword [0x1404cae98], rax
call rsi
mov rcx, rbx
lea rdx, str.LcidToRfc1766A
call rsi
lea rdx, str.Rfc1766ToLcidA
mov rcx, rbx
call rsi
jmp 0x1400c2dd0

Function at 0x1400c5550
Capabilities:
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
push rdi
push rbx
sub rsp, 0x28
xor edx, edx
mov ebx, ecx
cmp ecx, 4
ja 0x1400c55d0
mov ecx, 0x128
call fcn.1400e69e0
lea rdi, [rax + 8]
mov rcx, rax
mov qword [rax], 0
mov rdx, rax
mov qword [rax + 0x120], 0
and rdi, 0xfffffffffffffff8
xor eax, eax
sub rcx, rdi
add ecx, 0x128
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rdx], ebx
cmp ebx, 3
je 0x1400c5650
cmp ebx, 4
je 0x1400c5600
cmp ebx, 1
je 0x1400c55e0
cmp ebx, 2
jne 0x1400c563a
movdqa xmm0, xmmword [0x140390330]
movups xmmword [rdx + 0x10], xmm0
movdqa xmm0, xmmword [0x140390340]
movups xmmword [rdx + 0x20], xmm0
mov rax, rdx
add rsp, 0x28
pop rbx
pop rdi
ret
movdqa xmm0, xmmword [0x140390320]
mov rax, rdx
mov dword [rdx + 0x20], 0xc3d2e1f0
movups xmmword [rdx + 0x10], xmm0
add rsp, 0x28
pop rbx
pop rdi
ret
movdqa xmm0, xmmword [0x140390350]
mov rax, rdx
movups xmmword [rdx + 0x10], xmm0
movdqa xmm0, xmmword [0x140390360]
movups xmmword [rdx + 0x20], xmm0
movdqa xmm0, xmmword [0x140390370]
movups xmmword [rdx + 0x30], xmm0
movdqa xmm0, xmmword [0x140390380]
movups xmmword [rdx + 0x40], xmm0
add rsp, 0x28
pop rbx
pop rdi
ret
movdqa xmm0, xmmword [0x140390320]
mov rax, rdx
movups xmmword [rdx + 0x10], xmm0
add rsp, 0x28
pop rbx
pop rdi
ret
movdqa xmm0, xmmword [0x140390390]
mov rax, rdx
movups xmmword [rdx + 0x10], xmm0
movdqa xmm0, xmmword [0x1403903a0]
movups xmmword [rdx + 0x20], xmm0
movdqa xmm0, xmmword [0x1403903b0]
movups xmmword [rdx + 0x30], xmm0
movdqa xmm0, xmmword [0x1403903c0]
movups xmmword [rdx + 0x40], xmm0
add rsp, 0x28
pop rbx
pop rdi
ret
Function at 0x1400c6680
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400c66b0
mov rcx, qword [rcx + 8]
call fcn.14034efb0
mov rdx, rbx
mov ecx, 0x128
add rsp, 0x20
pop rbx
jmp fcn.1400e6130
add rsp, 0x20
pop rbx
ret

Function at 0x1400c66c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1400c6720
mov eax, dword [rcx + 0x18]
test eax, eax
jle 0x1400c66e8
lock sub dword [rcx + 0x18], 1
je 0x1400c6730
add rsp, 0x30
pop rbx
ret
lea rax, str.datetime__ref_count___0
mov qword [rsp + 0x20], rax
lea r9, str.g_date_time_unref
lea r8, [0x14038d1e0]
mov edx, 8
lea rcx, [0x14038d1fa]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
ret
lea rax, [0x14038d334]
jmp 0x1400c66ef
mov rcx, qword [rcx + 8]
call fcn.1400e9ea0
mov rdx, rbx
mov ecx, 0x20
add rsp, 0x30
pop rbx
jmp fcn.1400e6130
Function at 0x1400c71c0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
test rcx, rcx
je 0x1400c7328
call fcn.1400ed3e0
cmp byte [rax], 0
je 0x1400c7220
lea rax, str.g_utf8_validate__variable___1__NULL_
mov qword [rsp + 0x20], rax
lea r9, str.g_getenv
lea r8, [0x1403903e0]
mov edx, 8
lea rcx, [0x1403903fa]
call fcn.1400d2190
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
call fcn.1402b3210
lea r12, [rsp + 0x3c]
mov rbp, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r8d, 2
mov rsi, rax
mov rdx, r12
mov rcx, rax
call rbp
mov ebx, eax
test eax, eax
je 0x1400c7338
cmp eax, 1
je 0x1400c7390
mov ecx, eax
mov r13d, eax
sub ebx, 1
mov edx, 2
call fcn.1400d52e0
mov r8d, r13d
mov rcx, rsi
mov rdi, rax
mov rdx, rax
call rbp
cmp eax, ebx
jne 0x1400c73d0
mov edx, 0x25
mov rcx, rdi
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x1400c72bd
mov rdx, r12
mov r8d, 2
mov rcx, rdi
mov r12, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call r12
mov ebx, eax
test eax, eax
jne 0x1400c73a0
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rdi
xor ebx, ebx
call fcn.1402b36b0
mov rcx, rsi
mov rbp, rax
call fcn.14034efb0
mov rcx, rdi
call fcn.14034efb0
test rbp, rbp
je 0x1400c72f1
mov rcx, rbp
call fcn.1400dc3a0
mov ebx, eax
mov rcx, rbp
call fcn.14034efb0
mov rax, qword [0x14048ef60]
mov eax, dword [rax]
mov rdx, qword [0x14048ef80]
mov rdx, qword [rdx]
cmp ebx, eax
jae 0x1400c720d
mov rax, qword [rdx + rbx*8]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rax, str.variable___NULL
jmp 0x1400c71e9
mov rcx, rsi
call fcn.14034efb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x1400c720d
lea rcx, [0x140390505]
call fcn.1400daa90
mov rdx, qword [0x14048ef60]
mov edx, dword [rdx]
mov rcx, qword [0x14048ef80]
mov rcx, qword [rcx]
cmp eax, edx
jae 0x1400c720d
mov eax, eax
mov rax, qword [rcx + rax*8]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, 2
mov r13d, 2
jmp 0x1400c726b
mov ecx, eax
mov edx, 2
call fcn.1400d52e0
mov r8d, ebx
mov rcx, rdi
mov rbp, rax
mov rdx, rax
call r12
cmp eax, ebx
je 0x1400c73e8
mov rcx, rbp
call fcn.14034efb0
jmp 0x1400c72bd
mov rcx, rsi
call fcn.14034efb0
mov rcx, rdi
call fcn.14034efb0
jmp 0x1400c720d
mov rcx, rdi
mov rdi, rbp
call fcn.14034efb0
jmp 0x1400c72bd
Function at 0x1400c7420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov edi, edx
test rcx, rcx
je 0x1400c74d8
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
call fcn.1402b3210
mov rbx, rax
test rax, rax
je 0x1400c7503
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
mov ebp, eax
call fcn.14034efb0
cmp ebp, 0xffffffff
je 0x1400c7503
test dil, 0x10
jne 0x1400c74c0
test dil, 1
je 0x1400c7484
test bpl, 0x50
je 0x1400c74c0
test dil, 4
je 0x1400c748f
and ebp, 0x10
jne 0x1400c74c0
and edi, 8
je 0x1400c7503
mov edx, 0x2e
mov rcx, rsi
call sub.msvcrt.dll_strrchr
mov rbx, rax
test rax, rax
je 0x1400c7503
mov rsi, qword [sym.imp.msvcrt.dll__stricmp]
lea rdx, [0x140390517]
mov rcx, rax
call rsi
test eax, eax
jne 0x1400c7518
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rax, [0x140390506]
lea r9, str.g_file_test
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x1403903e0]
lea rcx, [0x1403903fa]
call fcn.1400d2190
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [0x14039051c]
mov rcx, rbx
call rsi
test eax, eax
je 0x1400c74c0
lea rdx, [0x140390521]
mov rcx, rbx
call rsi
test eax, eax
je 0x1400c74c0
lea rdx, [0x140390526]
mov rcx, rbx
call rsi
test eax, eax
je 0x1400c74c0
lea rcx, [0x14039052b]
call fcn.1400c71c0
test rax, rax
je 0x1400c7503
mov rcx, rax
call fcn.1402b1f50
mov rcx, rbx
mov r12, rax
call fcn.1402b1f50
mov rsi, r12
mov rcx, rax
mov r13, rax
call sub.msvcrt.dll_strlen
movsxd rdi, eax
mov rbp, rdi
jmp 0x1400c7599
cmp byte [rbx], 0
je 0x1400c75ee
lea rsi, [rbx + 1]
mov edx, 0x3b
mov rcx, rsi
call sub.msvcrt.dll_strchr
mov rbx, rax
test rax, rax
je 0x1400c75e0
mov rax, rbx
sub rax, rsi
cmp rax, rdi
jne 0x1400c7590
mov r8, rbp
mov rdx, rsi
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400c7590
mov rcx, r12
call fcn.14034efb0
mov rcx, r13
call fcn.14034efb0
jmp 0x1400c74c0
mov rcx, rsi
call sub.msvcrt.dll_strlen
lea rbx, [rsi + rax]
jmp 0x1400c75ae
mov rcx, r12
call fcn.14034efb0
mov rcx, r13
call fcn.14034efb0
xor eax, eax
jmp 0x1400c7505

Function at 0x1400c7cc0
Capabilities:
Get common file path

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, 2
lea rdx, [rsp + 0x3c]
call rdi
mov edx, 2
mov ecx, eax
mov rbx, rcx
call fcn.1400d52e0
mov ecx, ebx
sub ebx, 1
mov rsi, rax
mov rdx, rax
call rdi
cmp eax, ebx
je 0x1400c7d20
mov rcx, rsi
call fcn.14034efb0
lea rcx, [0x140390547]
call fcn.1400e4a90
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rsi
call fcn.1402b36b0
mov rcx, rsi
mov qword [rsp + 0x28], rax
call fcn.14034efb0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400c7d02
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret