joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180075ea0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x30
mov r14, r8
mov rbx, rcx
test rcx, rcx
je 0x1800760b2
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
xor edi, edi
test edx, edx
jns 0x180075ef6
movzx eax, byte [rcx]
test al, al
je 0x180075f29
lea rdx, [0x1800be4f0]
nop dword [rax]
movzx eax, al
inc edi
movsx rax, byte [rax + rdx]
add rcx, rax
movzx eax, byte [rcx]
test al, al
jne 0x180075ee0
jmp 0x180075f29
movsxd rax, edx
lea r8, [rax + rcx]
cmp rcx, r8
jae 0x180075f29
lea rdx, [0x1800be4f0]
nop dword [rax]
movzx eax, byte [rcx]
test al, al
je 0x180075f29
movzx eax, al
inc edi
movsx rax, byte [rax + rdx]
add rcx, rax
cmp rcx, r8
jb 0x180075f10
lea eax, [rdi + 1]
movsxd rcx, eax
movabs rax, 0x3fffffffffffffff
cmp rcx, rax
jbe 0x180075f72
mov qword [rsp + 0x28], 4
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
mov qword [rsp + 0x20], rcx
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
lea rcx, [0x18009cbc8]
mov edx, 4
call sym.glib_2.0.dll_g_log
nop dword [rax + rax]
jmp 0x180075f70
lea rsi, [rcx*4]
test rsi, rsi
je 0x180075fb4
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r11, rax
test rax, rax
jne 0x180075fb7
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rsi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180075fb2
xor r11d, r11d
xor ebp, ebp
movsxd rsi, edi
test edi, edi
jle 0x180076081
xor r10d, r10d
mov ebp, edi
nop dword [rax]
movzx r8d, byte [rbx]
inc rbx
mov eax, r8d
cmp r8b, 0xc0
jb 0x180076071
movzx edx, byte [rbx]
inc rbx
and edx, 0x3f
cmp r8b, 0xe0
jae 0x180075ffd
and eax, 0x1f
shl eax, 6
or eax, edx
jmp 0x180076071
movzx r9d, byte [rbx]
inc rbx
and r9d, 0x3f
shl edx, 6
cmp r8b, 0xf0
jae 0x18007601e
and eax, 0xf
shl eax, 0xc
or eax, edx
or eax, r9d
jmp 0x180076071
movzx ecx, byte [rbx]
and eax, 7
shl eax, 0x12
or edx, r9d
shl edx, 6
and ecx, 0x3f
or eax, edx
inc rbx
or eax, ecx
cmp r8b, 0xf8
jb 0x180076071
mov r8d, 0x100000
test r8d, eax
je 0x18007606b
nop dword [rax + rax]
movzx edx, byte [rbx]
mov ecx, eax
and edx, 0x3f
shl ecx, 6
mov eax, edx
shl r8d, 5
or eax, ecx
inc rbx
test eax, r8d
jne 0x180076050
lea ecx, [r8 - 1]
and eax, ecx
mov dword [r11 + r10*4], eax
inc r10
cmp r10, rsi
jl 0x180075fd0
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
movsxd rcx, ebp
mov dword [r11 + rcx*4], 0
test r14, r14
je 0x18007609e
mov dword [r14], ebp
mov rbp, qword [rsp + 0x40]
mov rax, r11
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
lea rax, str.str___NULL
mov edx, 8
lea r9, [0x1800fa550]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop r14
ret
Function at 0x180077330
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jns 0x18007735a
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rcx + rdi], 0
jne 0x180077351
lea rsi, [rdi + 1]
test rsi, rsi
je 0x180077398
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r10, rax
test rax, rax
jne 0x18007739b
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rsi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180077396
xor r10d, r10d
lea r11, [r10 + rdi]
mov r9, r11
cmp r11, r10
jbe 0x1800773e4
lea rdi, [0x1800be4f0]
nop
movzx eax, byte [rbx]
movsx rdx, byte [rax + rdi]
sub r9, rdx
test dl, dl
je 0x1800773df
mov r8, r9
sub r8, rbx
nop word [rax + rax]
movzx ecx, byte [rbx]
mov byte [r8 + rbx], cl
inc rbx
sub dl, 1
jne 0x1800773d0
cmp r9, r10
ja 0x1800773b0
mov rbx, qword [rsp + 0x40]
mov rax, r10
mov rsi, qword [rsp + 0x48]
mov byte [r11], 0
add rsp, 0x30
pop rdi
ret
Function at 0x180078460
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
lea eax, [rcx - 0xac00]
xor edi, edi
mov r14, rdx
mov esi, ecx
cmp eax, 0x2ba3
ja 0x180078507
lea r8d, [rcx - 0xac00]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1c
cmp r8d, eax
setne dil
add rdi, 2
mov qword [r14], rdi
lea rbx, [rdi*4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1800784e1
mov r8, r14
mov rdx, rax
mov ecx, esi
call fcn.180078300
jmp 0x180078647
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180078505
lea eax, [rcx - 0xa0]
mov qword [rsp + 0x40], r15
mov r8d, edi
mov r9d, 0x165a
cmp eax, 0x2f97d
ja 0x180078660
lea r15, [0x180000000]
mov edx, 0xb2d
cmp esi, 0xfb50
je 0x180078577
nop word [rax + rax]
cmp edx, r8d
je 0x180078660
movsxd rax, edx
mov ecx, dword [r15 + rax*8 + 0xd2940]
cmp esi, ecx
cmovbe r9d, edx
cmovbe edx, r8d
mov r8d, edx
lea eax, [rdx + r9]
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
cmp esi, dword [r15 + rdx*8 + 0xd2940]
jne 0x180078540
movsxd rax, edx
movzx ecx, word [r15 + rax*8 + 0xd2944]
mov eax, 0xffff
cmp cx, ax
je 0x180078660
movzx ebx, cx
lea rax, [0x1800ddc10]
add rbx, rax
je 0x180078660
movzx eax, byte [rbx]
mov rcx, rbx
mov edx, edi
test al, al
je 0x1800785c8
movzx eax, al
inc edx
movsx rax, byte [rax + r15 + 0xbe4f0]
add rcx, rax
movzx eax, byte [rcx]
test al, al
jne 0x1800785b0
movsxd rax, edx
mov qword [r14], rax
lea rsi, [rax*4]
test rsi, rsi
je 0x180078612
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x180078612
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rsi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x180078610
cmp byte [rbx], 0
je 0x180078642
mov rsi, rdi
nop word [rax + rax]
mov rcx, rbx
call sym.glib_2.0.dll_g_utf8_get_char
mov dword [rsi], eax
lea rsi, [rsi + 4]
movzx eax, byte [rbx]
movsx rax, byte [rax + r15 + 0xbe4f0]
add rbx, rax
cmp byte [rbx], 0
jne 0x180078620
mov r15, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
mov ecx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x18007867e
mov dword [rax], esi
mov qword [r14], 1
jmp 0x180078642
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 4
lea r8, str._s:_failed_to_allocate__I64u_bytes
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x1800786a6
Function at 0x180079320
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov r8, rdx
xor edx, edx
jmp sym.glib_2.0.dll_g_uri_unescape_segment
Function at 0x180079b20
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x18011c010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edx, ecx
lea r8, [rsp + 0x30]
xor ebx, ebx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x180079b8f
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x180079b84
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea edx, [rbx - 1]
lea rcx, [rsp + 0x40]
call sym.glib_2.0.dll_g_utf16_to_utf8
mov rbx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800989b0
add rsp, 0x260
pop rbx
ret

Function at 0x180079bb0
Capabilities:
Get common file path
Reference absolute stream path on windows

Disassembly:
sub rsp, 0x258
mov rax, qword [0x18011c010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x180079c9c
xor r9d, r9d
mov qword [rsp + 0x250], rbx
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
lea edx, [r9 - 1]
call sym.glib_2.0.dll_g_utf16_to_utf8
mov rbx, rax
test rax, rax
jne 0x180079c72
lea ecx, [rax + 4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x180079c47
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 4
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rbx + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180079c45
mov eax, dword [0x1800fa7e0]
mov dword [rcx], eax
mov rax, rcx
mov rbx, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800989b0
add rsp, 0x258
ret
mov rcx, rbx
call sym.glib_2.0.dll_g_path_skip_root
movzx ecx, byte [rax - 1]
lea rdx, [rax - 1]
cmp cl, 0x5c
je 0x180079c8c
cmp cl, 0x2f
jne 0x180079c94
cmp byte [rax - 2], 0x3a
cmovne rax, rdx
mov byte [rax], 0
mov rax, rbx
jmp 0x180079c52
mov ecx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x180079cd7
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 4
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180079cd5
mov eax, dword [0x1800fa7e0]
mov dword [rcx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800989b0
add rsp, 0x258
ret
Function at 0x180079d00
Capabilities:
Get session user name
Reference absolute stream path on windows

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x18011c010]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rbx, [0x18011ed20]
mov rcx, rbx
call sym.glib_2.0.dll_g_once_init_enter
test eax, eax
je 0x180079f1e
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x101
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x180079d81
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [rsp + 0x40]
lea edx, [r9 - 1]
call sym.glib_2.0.dll_g_utf16_to_utf8
mov rcx, rax
mov qword [0x18011edb0], rax
call sym.glib_2.0.dll_g_strdup
mov qword [0x18011edb8], rax
cmp qword [0x18011edb0], 0
jne 0x180079de3
mov ecx, 9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x180079dc6
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 9
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180079dc4
movsd xmm0, qword [str.somebody]
movsd qword [rax], xmm0
movzx eax, byte [0x1800fa7f0]
mov byte [rcx + 8], al
mov qword [0x18011edb0], rcx
cmp qword [0x18011edb8], 0
jne 0x180079e38
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x180079e25
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 8
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180079e23
movsd xmm0, qword [str.Unknown]
movsd qword [rax], xmm0
mov qword [0x18011edb8], rax
lock or dword [rsp], 0
mov rax, qword [0x18011ed20]
test rax, rax
jne 0x180079f04
cmp qword [0x18011ecb8], rax
je 0x180079efb
lea rax, [0x18011edb0]
mov qword [0x18011ed20], rax
lock or dword [rsp], 0
mov rax, qword [0x18011ef58]
lea rcx, [0x18011ecc0]
call qword [case.0x180005f92.0]
mov r8, qword [0x18011ecb8]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], r8
test r8, r8
je 0x180079eca
mov rdx, r8
nop word [rax + rax]
cmp qword [rdx], rbx
je 0x180079eb4
lea rcx, [rdx + 8]
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x180079ea0
jmp 0x180079eca
mov rax, qword [rdx + 8]
mov qword [rcx], rax
mov ecx, reloc.WS2_32.dll_recv
call sym.glib_2.0.dll_g_slice_free1
mov r8, qword [rsp + 0x38]
mov rax, qword [0x18011efa0]
lea rcx, [0x18011ecc8]
mov qword [0x18011ecb8], r8
call qword [case.0x180005f92.0]
mov rax, qword [0x18011ef68]
lea rcx, [0x18011ecc0]
call qword [case.0x180005f92.0]
jmp 0x180079f1e
lea r8, str.g_once_init_list___NULL
jmp 0x180079f0b
lea r8, str.g_atomic_pointer_get__value_location___NULL
lea rdx, [0x1800f9998]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_return_if_fail_warning
mov rax, qword [0x18011ed20]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800989b0
add rsp, 0x260
pop rbx
ret
Function at 0x18007a110
Capabilities:
Get hostname
Reference absolute stream path on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x18011c010]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [0x18011ed80]
call sym.glib_2.0.dll_g_once_init_enter
test eax, eax
je 0x18007a1f5
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
je 0x18007a17e
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
call sym.glib_2.0.dll_g_utf16_to_utf8
jmp 0x18007a183
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x18007a18c
test ebx, ebx
je 0x18007a1e1
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x18007a1c7
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 0xa
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18007a1c5
movsd xmm0, qword [str.localhost]
movsd qword [rax], xmm0
movzx eax, word [0x1800ece18]
mov word [rcx + 8], ax
mov rax, rcx
mov rdx, rax
lea rcx, [0x18011ed80]
call sym.glib_2.0.dll_g_once_init_leave
mov rbx, qword [rsp + 0x60]
mov rax, qword [0x18011ed80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800989b0
add rsp, 0x68
ret

Function at 0x18007a6a0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [0x18011ed18]
call sym.glib_2.0.dll_g_once_init_enter
test eax, eax
je 0x18007a6fc
lea rcx, str.XDG_RUNTIME_DIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rax
call sym.glib_2.0.dll_g_strdup
mov rbx, rax
test rax, rax
jne 0x18007a6ed
call sym.glib_2.0.dll_g_get_user_cache_dir
mov edx, 0x1c0
mov rcx, rax
mov rbx, rax
call sym.glib_2.0.dll_g_mkdir
test rbx, rbx
je 0x18007a709
mov rdx, rbx
lea rcx, [0x18011ed18]
call sym.glib_2.0.dll_g_once_init_leave
mov rax, qword [0x18011ed18]
add rsp, 0x30
pop rbx
ret
lea rax, str.dir___NULL
mov r8d, 0x572
lea r9, [0x1800fa910]
mov qword [rsp + 0x20], rax
lea rdx, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgutils.c
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_assertion_message_expr
int3
Function at 0x18007a910
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x18011ef58]
lea rcx, [0x18011ed48]
call qword [case.0x180005f92.0]
mov rsi, qword [0x18011ed60]
test rsi, rsi
je 0x18007aa0b
mov edx, 0x40
lea ecx, [rdx - 0x3f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
test rax, rax
jne 0x18007a982
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:135
mov qword [rsp + 0x20], 0x40
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop dword [rax]
jmp 0x18007a980
mov qword [0x18011ed60], rax
call fcn.18007a740
xor ebx, ebx
mov rax, qword [0x18011ed60]
mov rdi, qword [rbx + rsi]
mov r8, qword [rbx + rax]
test r8, r8
jne 0x18007a9aa
mov qword [rbx + rax], rdi
jmp 0x18007a9f3
test rdi, rdi
je 0x18007a9f3
mov rdx, r8
mov rax, rdi
sub rdx, rdi
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x18007a9cb
inc rax
test cl, cl
jne 0x18007a9b8
xor eax, eax
jmp 0x18007a9d0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x18007a9ea
mov rcx, r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x18011ed60]
mov qword [rbx + rax], rdi
jmp 0x18007a9f3
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rbx, 8
cmp rbx, 0x40
jl 0x18007a990
test rsi, rsi
je 0x18007aa0b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x18011ef68]
lea rcx, [0x18011ed48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [case.0x180005f92.0]
Function at 0x18007cb30
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
sub rsp, 0x40
movabs rax, 0x1fffffffffffffff
mov qword [rsp + 0x30], r15
mov rbp, rdx
mov r15, rcx
cmp rdx, rax
jbe 0x18007cb85
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
mov qword [rsp + 0x20], rdx
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18007cb83
lea rbx, [rdx*8]
test rbx, rbx
je 0x18007cbc7
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x18007cbc9
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18007cbc5
xor esi, esi
test rbp, rbp
je 0x18007cc89
mov qword [rsp + 0x60], rdi
sub r15, rsi
mov qword [rsp + 0x70], r12
mov rdi, rsi
mov qword [rsp + 0x78], r13
lea r12, str.value___NULL
mov qword [rsp + 0x38], r14
lea r13, [0x1800e9440]
mov r14, rbp
lea rbp, str.b_d__ghi____no_q_stuv_xy
mov rbx, qword [r15 + rdi]
test rbx, rbx
je 0x18007cc3d
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call fcn.18008c6b0
cmp byte [rbx + 9], 0
je 0x18007cc26
mov rax, qword [rbx + 0x10]
jmp 0x18007cc63
sub rbx, r13
sar rbx, 4
movsxd rax, ebx
lea rax, [rax*2]
add rax, rbp
jmp 0x18007cc63
lea r9, [0x1800fb9c0]
mov qword [rsp + 0x20], r12
lea r8, str._s:_assertion__s_failed
mov edx, 8
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor eax, eax
mov qword [rdi], rax
add rdi, 8
sub r14, 1
jne 0x18007cc04
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x60]
mov edx, ebp
mov rcx, rsi
call sym.glib_2.0.dll_g_variant_type_new_tuple
mov r15, qword [rsp + 0x30]
mov rbx, rax
test rsi, rsi
je 0x18007ccac
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret
Function at 0x18007ccc0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x30
mov rdi, rdx
mov r12, rcx
test rdx, rdx
je 0x18007cd13
test rcx, rcx
jne 0x18007cd13
lea rax, str.n_children__0__children___NULL
lea edx, [rcx + 8]
mov qword [rsp + 0x20], rax
lea rcx, [0x18009cbc8]
lea r9, [0x1800fb150]
lea r8, str._s:_assertion__s_failed
call sym.glib_2.0.dll_g_log
xor eax, eax
jmp 0x18007ce40
movabs rax, 0x1fffffffffffffff
mov qword [rsp + 0x50], rbp
cmp rdi, rax
jbe 0x18007cd55
mov eax, 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
mov qword [rsp + 0x28], rax
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
lea rcx, [0x18009cbc8]
mov qword [rsp + 0x20], rdi
lea edx, [rax - 4]
call sym.glib_2.0.dll_g_log
jmp 0x18007cd53
lea rbx, [rdx*8]
test rbx, rbx
je 0x18007cd97
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
jne 0x18007cd9a
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18007cd95
xor r15d, r15d
mov esi, 1
test rdi, rdi
je 0x18007cddb
mov qword [rsp + 0x58], r14
mov rbx, r12
mov r14, r15
mov rbp, rdi
sub r14, r12
mov rcx, qword [rbx]
call sym.glib_2.0.dll_g_variant_ref_sink
mov qword [r14 + rbx], rax
mov rax, qword [rbx]
lea rbx, [rbx + 8]
mov ecx, dword [rax + 0x20]
shr ecx, 2
and esi, ecx
sub rbp, 1
jne 0x18007cdb5
mov r14, qword [rsp + 0x58]
mov rdx, rdi
mov rcx, r12
call fcn.18007cb30
mov ecx, 0x28
mov rbp, rax
call sym.glib_2.0.dll_g_slice_alloc
mov rcx, rbp
mov rbx, rax
call sym.glib_2.0.dll_g_variant_type_info_get
mov qword [rbx], rax
test esi, esi
mov eax, 8
mov qword [rbx + 8], 0xffffffffffffffff
mov ecx, recv
mov dword [rbx + 0x24], 1
cmovne eax, ecx
mov qword [rbx + 0x10], r15
mov dword [rbx + 0x20], eax
mov qword [rbx + 0x18], rdi
test rbp, rbp
je 0x18007ce38
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r12
pop rdi
ret
Function at 0x18007dff0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov r14, rcx
call sym.glib_2.0.dll_g_variant_get_type
mov rcx, rax
lea rdx, [0x1800fb7a4]
call sym.glib_2.0.dll_g_variant_type_is_subtype_of
test eax, eax
jne 0x18007e058
lea rax, str.g_variant_is_of_type__value__G_VARIANT_TYPE_STRING_ARRAY_
mov edx, 8
lea r9, [0x1800fb7e8]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor eax, eax
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov qword [rsp + 0x50], rbx
mov rcx, r14
mov qword [rsp + 0x58], rbp
call sym.glib_2.0.dll_g_variant_get_data
mov rcx, r14
call sym.glib_2.0.dll_g_variant_n_children
mov rbp, rax
lea rbx, [rax + 1]
movabs rax, 0x1fffffffffffffff
cmp rbx, rax
jbe 0x18007e0b7
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rbx
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18007e0b5
lea rbx, [rbx*8]
test rbx, rbx
je 0x18007e0f9
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x18007e0fb
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18007e0f7
xor esi, esi
xor edi, edi
test rbp, rbp
je 0x18007e12e
mov rdx, rdi
mov rcx, r14
call sym.glib_2.0.dll_g_variant_get_child_value
xor edx, edx
mov rcx, rax
mov rbx, rax
call sym.glib_2.0.dll_g_variant_get_string
mov rcx, rbx
mov qword [rsi + rdi*8], rax
call sym.glib_2.0.dll_g_variant_unref
inc rdi
cmp rdi, rbp
jb 0x18007e102
mov rbx, qword [rsp + 0x50]
mov qword [rsi + rdi*8], 0
test r15, r15
je 0x18007e143
mov qword [r15], rbp
mov rbp, qword [rsp + 0x58]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x18007e830
Capabilities:
Reference absolute stream path on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call sym.glib_2.0.dll_g_variant_get_bytestring
mov rcx, rax
test rax, rax
jne 0x18007e84c
add rsp, 0x20
pop rbx
ret
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18007e853
test rbx, rbx
je 0x18007e864
mov qword [rbx], rax
lea edx, [rax + 1]
add rsp, 0x20
pop rbx
jmp sym.glib_2.0.dll_g_memdup