joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f8c0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r13
push r15
sub rsp, 0x30
mov rax, qword [0x18011ef58]
lea rcx, [0x18011e7c8]
call qword [case.0x180005f92.0]
cmp qword [0x18011e7c0], 0
jne 0x18000faac
mov qword [rsp + 0x68], rsi
lea rdx, [sym.glib_2.0.dll_g_str_equal]
xor r9d, r9d
mov qword [rsp + 0x70], r14
xor r8d, r8d
lea rcx, [sym.glib_2.0.dll_g_str_hash]
call sym.glib_2.0.dll_g_hash_table_new_full
mov rsi, qword [0x18011efe0]
mov r14, rax
mov qword [0x18011e7c0], rax
test rsi, rsi
jne 0x18000f93a
lea rsi, str.CP936
mov qword [0x18011efe0], rsi
cmp byte [rsi], 0
je 0x18000faa2
xor r12d, r12d
movabs r13, 0x1fffffffffffffff
mov edi, r12d
mov rbx, r12
mov r15, rsi
mov rax, 0xffffffffffffffff
cmp byte [rsi + rax + 1], bl
lea rax, [rax + 1]
jne 0x18000f960
lea rbp, [rsi + rax]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rax + rbp + 1], bl
jne 0x18000f975
lea rsi, [rbp + 2]
add rsi, rax
test r14, r14
je 0x18000f9cd
lea r8, [rsp + 0x60]
mov rcx, r14
lea rdx, [rbp + 1]
call fcn.18002ac40
mov edx, eax
mov rax, qword [r14 + 0x20]
cmp dword [rax + rdx*4], 2
jb 0x18000f9e7
mov rcx, qword [r14 + 0x28]
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x18000f9ea
cmp qword [rcx], rbx
je 0x18000f9ea
nop dword [rax]
inc rbx
inc edi
cmp qword [rcx + rbx*8], r12
jne 0x18000f9c0
jmp 0x18000f9ea
lea r8, str.hash_table___NULL
lea rdx, [0x1800ef350]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_return_if_fail_warning
mov rcx, r12
lea eax, [rdi + 2]
movsxd rdx, eax
cmp rdx, r13
ja 0x18000fa72
lea rdi, [rdx*8]
test rdi, rdi
je 0x18000fa34
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
jne 0x18000fa42
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:170
mov qword [rsp + 0x20], rdi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18000fa32
test rcx, rcx
je 0x18000fa3f
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, r12
mov rcx, qword [0x18011e7c0]
lea rdx, [rbp + 1]
xor r9d, r9d
mov qword [rax + rbx*8], r15
mov r8, rax
mov qword [rax + rbx*8 + 8], r12
call fcn.18002ba90
cmp byte [rsi], r12b
je 0x18000faa2
mov r14, qword [0x18011e7c0]
jmp 0x18000f950
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:383
mov qword [rsp + 0x20], rdx
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x18000faa0
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov rax, qword [0x18011ef68]
lea rcx, [0x18011e7c8]
call qword [case.0x180005f92.0]
mov rax, qword [0x18011e7c0]
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x180010520
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea ebp, [rdx + rdx]
mov rbx, rcx
lea eax, [rbp + 1]
mov rdi, rdx
movsxd rsi, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rax
test rax, rax
jne 0x180010578
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rsi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180010576
xor r8d, r8d
test rdi, rdi
je 0x1800105bf
mov rdx, r9
lea r10, [0x18009d640]
nop word [rax + rax]
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov eax, ecx
lea rdx, [rdx + 2]
shr rax, 4
and ecx, 0xf
inc r8d
movzx eax, byte [rax + r10]
mov byte [rdx - 2], al
movzx eax, byte [rcx + r10]
mov byte [rdx - 1], al
movsxd rax, r8d
cmp rax, rdi
jb 0x180010590
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebp
mov rbp, qword [rsp + 0x48]
mov byte [rax + r9], 0
mov rax, r9
add rsp, 0x30
pop rdi
ret
Function at 0x180014950
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp], 0
mov rax, qword [rsp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1800149a4
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp], rax
mov rax, qword [rsp]
cmp dword [rax], 0x4550
jne 0x1800149a4
mov rax, qword [rsp]
jmp 0x1800149a6
xor eax, eax
add rsp, 0x18
ret
Function at 0x180016530
Capabilities:
Hash data using sha1
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x180016715
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x180016551
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rbx]
xor edx, edx
mov qword [rbx + 8], rdx
test ecx, ecx
je 0x1800166ef
sub ecx, 1
je 0x1800166c2
sub ecx, 1
je 0x180016680
sub ecx, 1
je 0x18001660f
cmp ecx, 1
jne 0x180016746
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rbx + 0x10], rax
movabs rax, 0x629a292a367cd507
mov qword [rbx + 0x18], rax
movabs rax, 0x9159015a3070dd17
mov qword [rbx + 0x20], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rbx + 0x28], rax
movabs rax, 0x67332667ffc00b31
mov qword [rbx + 0x30], rax
movabs rax, 0x8eb44a8768581511
mov qword [rbx + 0x38], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rbx + 0x40], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rbx + 0x48], rax
mov byte [rbx + 0xd0], dl
mov qword [rbx + 0xd8], rdx
mov qword [rbx + 0xe0], rdx
add rsp, 0x30
pop rbx
ret
movabs rax, 0x6a09e667f3bcc908
mov qword [rbx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rbx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbx + 0x28], rax
movabs rax, 0x510e527fade682d1
mov qword [rbx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
jmp 0x1800165f1
mov dword [rbx + 0x10], 0x6a09e667
mov dword [rbx + 0x14], 0xbb67ae85
mov dword [rbx + 0x18], 0x3c6ef372
mov dword [rbx + 0x1c], 0xa54ff53a
mov dword [rbx + 0x20], 0x510e527f
mov dword [rbx + 0x24], 0x9b05688c
mov dword [rbx + 0x28], 0x1f83d9ab
mov qword [rbx + 0x2c], 0x5be0cd19
mov dword [rbx + 0x34], edx
add rsp, 0x30
pop rbx
ret
mov dword [rbx + 0x10], 0x67452301
mov dword [rbx + 0x14], 0xefcdab89
mov dword [rbx + 0x18], 0x98badcfe
mov dword [rbx + 0x1c], 0x10325476
mov dword [rbx + 0x20], 0xc3d2e1f0
mov qword [rbx + 0x24], rdx
add rsp, 0x30
pop rbx
ret
mov dword [rbx + 0x10], 0x67452301
mov dword [rbx + 0x14], 0xefcdab89
mov dword [rbx + 0x18], 0x98badcfe
mov qword [rbx + 0x1c], 0x10325476
mov dword [rbx + 0x24], edx
add rsp, 0x30
pop rbx
ret
lea rax, str.checksum___NULL
mov edx, 8
lea r9, [0x1800eb5b8]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x20], rdx
lea r9, [0x1800eb5b8]
lea rdx, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgchecksum.c
mov r8d, 0x5ef
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_assertion_message_expr
int3
Function at 0x180017260
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x18011e7e0], 0
je 0x180017278
mov eax, 1
add rsp, 0x28
ret
lea rcx, str.mlang.dll
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18001729c
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.ConvertINetString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertINetMultiByteToUnicode
mov rcx, rbx
mov qword [0x18011e7e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertINetUnicodeToMultiByte
mov rcx, rbx
mov qword [0x18011e7d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsConvertINetStringAvailable
mov rcx, rbx
mov qword [0x18011e7d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LcidToRfc1766A
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Rfc1766ToLcidA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret
Function at 0x18001a110
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
lea eax, [rdx - 8]
mov edi, edx
mov rbx, rcx
test eax, 0xfffffff7
je 0x18001a161
lea rax, str.mask__UNSAFE_ALL__mask__UNSAFE_ALLOW_PLUS__mask__UNSAFE_PATH__mask__UNSAFE_HOST__mask__UNSAFE_SLASHES
mov edx, 8
lea r9, str.g_escape_uri_string
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
movzx eax, byte [rbx]
xor r9d, r9d
mov qword [rsp + 0x40], rbp
mov ecx, r9d
mov qword [rsp + 0x48], rsi
mov rdx, rbx
lea rbp, [0x180000000]
test al, al
je 0x18001a1a9
movzx r8d, al
lea eax, [r8 - 0x20]
cmp eax, 0x5f
ja 0x18001a19c
mov eax, r8d
test byte [r8 + rbp + 0x9d640], dil
jne 0x18001a19e
inc ecx
movzx eax, byte [rdx + 1]
inc rdx
test al, al
jne 0x18001a182
lea eax, [rcx + rcx]
movsxd rcx, eax
lea rsi, [rdx + 1]
sub rcx, rbx
add rsi, rcx
je 0x18001a1f2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rax
test rax, rax
jne 0x18001a1f2
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rsi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x18001a1f0
movzx ecx, byte [rbx]
mov rax, r9
mov rsi, qword [rsp + 0x48]
test cl, cl
je 0x18001a251
movzx edx, cl
lea ecx, [rdx - 0x20]
cmp ecx, 0x5f
ja 0x18001a21d
movsxd rcx, edx
test byte [rcx + rbp + 0x9d640], dil
je 0x18001a21d
mov byte [rax], dl
jmp 0x18001a243
mov byte [rax], 0x25
mov rcx, rdx
shr rcx, 4
movzx ecx, byte [rcx + rbp + 0x9d6c8]
mov byte [rax + 1], cl
add rax, 2
and edx, 0xf
movzx ecx, byte [rdx + rbp + 0x9d6c8]
mov byte [rax], cl
movzx ecx, byte [rbx + 1]
inc rbx
inc rax
test cl, cl
jne 0x18001a201
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov byte [rax], 0
mov rax, r9
add rsp, 0x30
pop rdi
ret
Function at 0x18001a270
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rdi
push r12
push r13
push r15
sub rsp, 0x48
mov r13d, r9d
mov ebx, edx
mov rdi, rcx
test rcx, rcx
je 0x18001a443
mov qword [rsp + 0x88], rsi
test edx, edx
jns 0x18001a2af
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x18001a2a6
lea eax, [rbx + 1]
movsxd rsi, eax
test eax, eax
je 0x18001a2f6
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x80], rax
mov r12, rax
test rax, rax
jne 0x18001a301
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rsi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18001a2f4
xor r12d, r12d
mov qword [rsp + 0x80], r12
movsxd rcx, ebx
mov r15, r12
mov qword [rsp + 0x30], rcx
lea rbp, [rcx + rdi]
cmp rdi, rbp
jae 0x18001a419
mov r12, qword [rsp + 0x90]
lea rsi, [rdi + 3]
lea rdx, [0x18009d910]
mov qword [rsp + 0x40], r14
movsx ebx, byte [rdi]
cmp ebx, 0x25
jne 0x18001a3f2
cmp rsi, rbp
ja 0x18001a407
movzx ecx, byte [rdi + 1]
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x18001a359
movsx ebx, cl
sub ebx, 0x37
jmp 0x18001a37e
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x18001a368
movsx ebx, cl
sub ebx, 0x57
jmp 0x18001a37e
movzx eax, cl
test byte [rdx + rax*2], 8
je 0x18001a379
movsx ebx, cl
sub ebx, 0x30
jmp 0x18001a37e
mov ebx, 0xffffffff
test ebx, ebx
js 0x18001a407
movzx ecx, byte [rdi + 2]
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x18001a399
movsx eax, cl
sub eax, 0x37
jmp 0x18001a3be
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x18001a3a8
movsx eax, cl
sub eax, 0x57
jmp 0x18001a3be
movzx eax, cl
test byte [rdx + rax*2], 8
je 0x18001a3b9
movsx eax, cl
sub eax, 0x30
jmp 0x18001a3be
mov eax, 0xffffffff
test eax, eax
js 0x18001a407
shl ebx, 4
or ebx, eax
jle 0x18001a407
test r13d, r13d
je 0x18001a3d3
cmp ebx, 0x7f
jle 0x18001a407
mov edx, ebx
mov rcx, r12
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
jne 0x18001a407
add rdi, 2
lea rdx, [0x18009d910]
add rsi, 2
mov byte [r15], bl
inc rdi
inc r15
inc rsi
cmp rdi, rbp
jb 0x18001a331
mov r12, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov rax, r15
sub rax, r12
cmp rax, rcx
jg 0x18001a464
mov byte [r15], 0
cmp rdi, rbp
je 0x18001a453
test r12, r12
je 0x18001a443
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
add rsp, 0x48
pop r15
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
mov rax, r12
add rsp, 0x48
pop r15
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
lea rax, str.out___result___len
mov r8d, 0x611
lea r9, str.g_unescape_uri_string
mov qword [rsp + 0x20], rax
lea rdx, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgconvert.c
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_assertion_message_expr
int3
Function at 0x18001aa80
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor esi, esi
xor ebp, ebp
mov rdi, rcx
test rcx, rcx
je 0x18001ab7a
mov qword [rsp + 0x50], r14
lea r14, [0x18009d910]
mov qword [rsp + 0x58], r15
mov r15d, 0x100
movzx ecx, byte [rdi]
cmp cl, 0x23
je 0x18001ab50
movzx eax, cl
test word [r14 + rax*2], r15w
je 0x18001aade
nop dword [rax]
movzx ecx, byte [rdi + 1]
inc rdi
test word [r14 + rcx*2], r15w
jne 0x18001aad0
mov rdx, rdi
test cl, cl
je 0x18001ab50
cmp cl, 0xa
je 0x18001aafd
cmp cl, 0xd
je 0x18001aafd
movzx eax, byte [rdx + 1]
inc rdx
movzx ecx, al
test al, al
jne 0x18001aae5
cmp rdx, rdi
jbe 0x18001ab50
dec rdx
cmp rdx, rdi
jbe 0x18001ab50
nop word [rax + rax]
movzx eax, byte [rdx]
test word [r14 + rax*2], r15w
je 0x18001ab24
dec rdx
cmp rdx, rdi
ja 0x18001ab10
jmp 0x18001ab50
cmp rdx, rdi
jbe 0x18001ab50
sub rdx, rdi
mov rcx, rdi
inc rdx
call sym.glib_2.0.dll_g_strndup
mov ecx, reloc.WS2_32.dll_recv
mov rbx, rax
call sym.glib_2.0.dll_g_slice_alloc
inc esi
mov qword [rax + 8], rbp
mov rbp, rax
mov qword [rax], rbx
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov rdi, rax
test rax, rax
je 0x18001ab70
add rdi, 1
jne 0x18001aab3
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
lea eax, [rsi + 1]
movsxd rdi, eax
movabs rax, 0x1fffffffffffffff
cmp rdi, rax
jbe 0x18001abc2
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rdi
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop dword [rax]
jmp 0x18001abc0
lea rdi, [rdi*8]
test rdi, rdi
je 0x18001ac04
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x18001ac06
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rdi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18001ac02
xor ebx, ebx
movsxd rax, esi
mov r9, rbp
mov qword [rbx + rax*8], 0
test rbp, rbp
je 0x18001ac43
lea eax, [rsi - 1]
movsxd rcx, eax
lea r10, [rbx + rcx*8]
nop dword [rax]
nop word [rax + rax]
mov r8, qword [r9]
mov qword [r10], r8
lea r10, [r10 - 8]
mov r9, qword [r9 + 8]
test r9, r9
jne 0x18001ac30
mov r8d, 8
mov rdx, rbp
lea ecx, [r8 + 8]
call sym.glib_2.0.dll_g_slice_free_chain_with_offset
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001c1e0
Capabilities:
Reference absolute stream path on windows

Disassembly:
sub rsp, 0x38
mov edx, 8
lea ecx, [rdx - 7]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
test rax, rax
jne 0x18001c222
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:135
mov qword [rsp + 0x20], 8
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop dword [rax]
jmp 0x18001c220
add rsp, 0x38
ret

Function at 0x18001c230
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rdi, edx
movzx esi, r8w
movzx ebp, cl
lea eax, [rdi - 1]
cmp eax, 0xb
ja 0x18001c30c
test cl, cl
je 0x18001c30c
test r8w, r8w
je 0x18001c30c
movzx ecx, r8w
mov qword [rsp + 0x40], rbx
call sym.glib_2.0.dll_g_date_is_leap_year
mov rbx, qword [rsp + 0x40]
lea rcx, [0x18009d725]
test eax, eax
lea rdx, [0x18009d718]
cmove rcx, rdx
cmp bpl, byte [rdi + rcx]
ja 0x18001c30c
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, rax
test rax, rax
jne 0x18001c2d2
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 8
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop dword [rax]
jmp 0x18001c2d0
and dword [rax + 4], 0xf0000002
and edi, 0xf
movzx eax, bpl
and eax, 0x3f
movzx ecx, si
shl ecx, 4
or ecx, edi
shl ecx, 6
or ecx, eax
mov rax, rdx
shl ecx, 2
or ecx, 2
or dword [rdx + 4], ecx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rax, str.g_date_valid_dmy__day__m__y_
mov edx, 8
lea r9, [0x1800ed0e0]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
mov rbp, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18001c350
Capabilities:
Reference absolute stream path on windows

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, ecx
test ecx, ecx
je 0x18001c3ae
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, rax
test rax, rax
jne 0x18001c397
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 8
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18001c395
mov eax, dword [rax + 4]
and eax, 0xfffffffd
mov dword [rdx], ebx
or eax, 1
mov dword [rdx + 4], eax
mov rax, rdx
add rsp, 0x30
pop rbx
ret
lea rax, str.g_date_valid_julian__julian_day_
mov edx, 8
lea r9, [0x1800ed170]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x18001c440
Capabilities:
Reference absolute stream path on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x18001c4b6
test byte [rcx + 4], 3
je 0x18001c469
call sym.glib_2.0.dll_g_date_get_julian
mov ecx, eax
call sym.glib_2.0.dll_g_date_new_julian
mov rcx, rax
add rsp, 0x30
pop rbx
ret
mov edx, 8
lea ecx, [rdx - 7]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rcx, rax
test rax, rax
jne 0x18001c4a7
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:135
mov qword [rsp + 0x20], 8
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18001c4a5
mov rax, qword [rbx]
mov qword [rcx], rax
mov rax, rcx
add rsp, 0x30
pop rbx
ret
lea rax, str.date___NULL
mov edx, 8
lea r9, [0x1800ed1a8]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x180021330
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x1800fa0a0]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rax
call sym.glib_2.0.dll_g_time_zone_new
mov rcx, rax
mov rdi, rax
call sym.glib_2.0.dll_g_date_time_new_now
mov rcx, rdi
mov rbx, rax
call sym.glib_2.0.dll_g_time_zone_unref
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800213c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1800fa0a0]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rax
call sym.glib_2.0.dll_g_time_zone_new
mov rdi, rax
movabs rax, 0x855043d1276
cmp rbx, rax
jle 0x1800213f8
xor ebx, ebx
jmp 0x180021417
movabs rax, 0xe77934880
mov rcx, rdi
add rax, rbx
imul rdx, rax, 0xf4240
call fcn.1800210a0
mov rbx, rax
mov rcx, rdi
call sym.glib_2.0.dll_g_time_zone_unref
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800214a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1800fa0a0]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rax
call sym.glib_2.0.dll_g_time_zone_new
movsxd rcx, dword [rbx + 4]
mov rdi, rax
movsxd rdx, dword [rbx]
movabs rax, 0xe77934880
add rdx, rax
imul rdx, rdx, 0xf4240
add rdx, rcx
mov rcx, rdi
call fcn.1800210a0
mov rcx, rdi
mov rbx, rax
call sym.glib_2.0.dll_g_time_zone_unref
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180022590
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, ecx
mov ebx, r9d
lea rcx, [0x1800fa0a0]
mov esi, r8d
mov ebp, edx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rax
call sym.glib_2.0.dll_g_time_zone_new
movsd xmm0, qword [rsp + 0x78]
mov r9d, esi
mov r10d, dword [rsp + 0x70]
mov r8d, ebp
movsd qword [rsp + 0x30], xmm0
mov edx, r14d
mov dword [rsp + 0x28], r10d
mov rcx, rax
mov dword [rsp + 0x20], ebx
mov rdi, rax
call sym.glib_2.0.dll_g_date_time_new
mov rcx, rdi
mov rbx, rax
call sym.glib_2.0.dll_g_time_zone_unref
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180023b40
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1800fa0a0]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rax
call sym.glib_2.0.dll_g_time_zone_new
mov rcx, rbx
mov rdi, rax
call fcn.180021010
mov rdx, rax
mov rcx, rdi
call fcn.1800210a0
mov rcx, rdi
mov rbx, rax
call sym.glib_2.0.dll_g_time_zone_unref
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret