joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800636c0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1800637eb
xor edx, edx
mov qword [rsp + 0x40], rsi
cmp qword [rcx], rdx
je 0x1800636fc
mov rax, rcx
nop word [rax + rax]
inc edx
lea rax, [rax + 8]
cmp qword [rax], 0
jne 0x1800636f0
lea eax, [rdx + 1]
movsxd rsi, eax
movabs rax, 0x1fffffffffffffff
cmp rsi, rax
jbe 0x180063742
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rsi
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x180063740
lea rsi, [rsi*8]
test rsi, rsi
je 0x180063784
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x180063786
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rsi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180063782
xor edi, edi
mov rax, qword [rbx]
xor ebp, ebp
test rax, rax
je 0x1800637c8
xor esi, esi
mov qword [rsp + 0x48], r14
xor r14d, r14d
nop word [rax + rax]
mov rcx, rax
call sym.glib_2.0.dll_g_strdup
mov qword [r14 + rdi], rax
lea rsi, [rsi + 1]
lea r14, [rsi*8]
inc ebp
mov rax, qword [r14 + rbx]
test rax, rax
jne 0x1800637a0
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rax, rdi
movsxd rcx, ebp
mov qword [rdi + rcx*8], 0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180064fd0
Capabilities:
Reference absolute stream path on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rdi, rcx
add rax, rdx
cmp rax, qword [rcx + 0x10]
jb 0x18006506f
inc rax
mov qword [rsp + 0x40], rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x18006500a
mov rbx, 0xffffffffffffffff
jmp 0x18006501c
mov ebx, 1
cmp rbx, rax
jae 0x18006501c
add rbx, rbx
cmp rbx, rax
jb 0x180065014
mov rcx, qword [rdi]
mov qword [rdi + 0x10], rbx
test rbx, rbx
je 0x18006505a
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
jne 0x180065067
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:170
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180065058
test rcx, rcx
je 0x180065065
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov qword [rdi], rax
add rsp, 0x30
pop rdi
ret

Function at 0x180066450
Capabilities:
Reference absolute stream path on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0x28
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, rax
test rax, rax
jne 0x180066494
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 0x28
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180066492
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x1800664ac
mov rax, 0xffffffffffffffff
jmp 0x1800664be
mov eax, 1
cmp rax, rbx
jae 0x1800664be
add rax, rax
cmp rax, rbx
jb 0x1800664b6
xor ecx, ecx
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x18], rax
mov rax, rdx
mov qword [rdx], rcx
mov qword [rdx + 8], rcx
add rsp, 0x30
pop rbx
ret

Function at 0x180066590
Capabilities:
Reference absolute stream path on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
test rcx, rcx
je 0x180066611
mov qword [rsp + 0x48], rsi
mov rsi, qword [rcx + 8]
test rsi, rsi
je 0x1800665fa
mov qword [rsp + 0x40], rbx
mov rcx, rsi
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rcx + 8]
xor edx, edx
mov rcx, qword [rcx]
call sym.glib_2.0.dll_g_free
mov rcx, rbx
test rbx, rbx
jne 0x1800665c0
lea r8d, [rbx + 8]
mov rdx, rsi
lea ecx, [rbx + 0x10]
call sym.glib_2.0.dll_g_slice_free_chain_with_offset
mov rax, qword [rdi + 0x20]
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 0x40]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov rcx, qword [rdi]
mov rsi, qword [rsp + 0x48]
test rcx, rcx
je 0x18006663c
add rsp, 0x30
pop rdi
jmp sym.glib_2.0.dll_g_hash_table_remove_all
lea rax, str.chunk___NULL
mov edx, 8
lea r9, [0x1800f8648]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
add rsp, 0x30
pop rdi
ret
Function at 0x180067ea0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov rcx, qword [0x18011ec20]
jmp sym.glib_2.0.dll_g_rand_int

Function at 0x180067f30
Capabilities:
Reference absolute stream path on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x18011ec70]
test rbx, rbx
jne 0x180067f95
lea ecx, [rbx + 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x180067f82
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 0x18
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop dword [rax]
jmp 0x180067f80
or dword [rax + 0x10], 1
call sym.glib_2.0.dll_g_get_monotonic_time
mov qword [rbx], rax
mov qword [0x18011ec70], rbx
xorps xmm0, xmm0
movsd qword [0x18011ec50], xmm0
test rbx, rbx
je 0x180067fb7
or dword [rbx + 0x10], 1
call sym.glib_2.0.dll_g_get_monotonic_time
mov qword [rbx], rax
add rsp, 0x30
pop rbx
ret
lea rax, str.timer___NULL
mov edx, 8
lea r9, [0x1800f9d68]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
add rsp, 0x30
pop rbx
ret

Function at 0x1800682e0
Capabilities:
Reference absolute stream path on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18011ec00]
test rax, rax
jne 0x1800683d5
lea edx, [rax + 0x2f]
mov qword [rsp + 0x30], rbx
lea rcx, str.root
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
jne 0x18006833c
lea ecx, [rax + 0x18]
call sym.glib_2.0.dll_g_slice_alloc
mov rbx, rax
test rax, rax
je 0x18006832b
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
lea rcx, str.root
call sym.glib_2.0.dll_g_strdup
mov qword [rbx], rax
jmp 0x180068369
lea rax, str.strchr__suite_name______NULL
mov edx, 8
lea r9, [0x1800f91b8]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor ebx, ebx
mov rcx, qword [rbx]
mov qword [0x18011ec00], rbx
mov rbx, qword [rsp + 0x30]
test rcx, rcx
je 0x180068383
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, rax
test rax, rax
jne 0x1800683c2
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 1
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop dword [rax]
jmp 0x1800683c0
movzx eax, byte [0x1800eaba1]
mov byte [rdx], al
mov rax, qword [0x18011ec00]
mov qword [rax], rdx
add rsp, 0x38
ret
Function at 0x180069b90
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, rdx
mov rdi, r9
mov rdx, qword [rsp + 0x60]
mov esi, r8d
mov r14, rcx
test rdx, rdx
jne 0x180069c27
lea ecx, [rdx + 0x1b]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x180069bf9
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 0x1b
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180069bf7
movups xmm0, xmmword [str.code_should_not_be_reached]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1800f4370]
movsd qword [rax + 0x10], xmm1
movzx eax, word [0x1800f4378]
mov word [rbx + 0x18], ax
movzx eax, byte [0x1800f437a]
mov byte [rbx + 0x1a], al
jmp 0x180069c40
xor r9d, r9d
lea r8, [0x1800f4334]
lea rcx, str.assertion_failed:__
call sym.glib_2.0.dll_g_strconcat
mov rbx, rax
mov r9, rdi
mov qword [rsp + 0x20], rbx
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call sym.glib_2.0.dll_g_assertion_message
test rbx, rbx
je 0x180069c64
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp dword [0x18011ebd4], 0
je 0x180069c79
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
call sym.glib_2.0.dll_g_abort
int3
Function at 0x180069de0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor esi, esi
mov r13, rcx
mov rcx, qword [rsp + 0x88]
mov r14, r9
mov r15d, r8d
mov r12, rdx
mov ebp, esi
test rcx, rcx
je 0x180069e41
xor edx, edx
call sym.glib_2.0.dll_g_strescape
xor r9d, r9d
lea r8, [0x1800f9428]
mov rdx, rax
lea rcx, [0x1800f9428]
mov rsi, rax
call sym.glib_2.0.dll_g_strconcat
mov rdi, rax
jmp 0x180069e94
mov ecx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x180069e82
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 5
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop word [rax + rax]
jmp 0x180069e80
mov eax, dword [str.NULL]
mov dword [rdi], eax
movzx eax, byte [0x1800f722c]
mov byte [rdi + 4], al
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x180069ec9
xor edx, edx
call sym.glib_2.0.dll_g_strescape
xor r9d, r9d
lea r8, [0x1800f9428]
mov rdx, rax
lea rcx, [0x1800f9428]
mov rbp, rax
call sym.glib_2.0.dll_g_strconcat
mov rbx, rax
jmp 0x180069f16
mov ecx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x180069f04
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 5
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180069f02
mov eax, dword [str.NULL]
mov dword [rbx], eax
movzx eax, byte [0x1800f722c]
mov byte [rbx + 4], al
test rsi, rsi
je 0x180069f24
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbp, rbp
je 0x180069f32
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9, qword [rsp + 0x90]
lea rcx, str.assertion_failed___s_:___s__s__s_
mov rdx, qword [rsp + 0x80]
mov r8, rdi
mov qword [rsp + 0x20], rbx
call sym.glib_2.0.dll_g_strdup_printf
mov rsi, rax
test rdi, rdi
je 0x180069f67
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x180069f75
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9, r14
mov qword [rsp + 0x20], rsi
mov r8d, r15d
mov rdx, r12
mov rcx, r13
call sym.glib_2.0.dll_g_assertion_message
test rsi, rsi
je 0x180069f99
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18006b450
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, reloc.WS2_32.dll_recv
lea ecx, [rdx - 0xf]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
jne 0x18006b498
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:135
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18006b496
mov ecx, 0x18
call sym.glib_2.0.dll_g_slice_alloc
mov rbx, rax
mov edx, 0x400
xor eax, eax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov qword [rbx], rax
call fcn.180064fd0
mov rcx, qword [rbx]
mov rax, rdi
mov byte [rcx], 0
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18006bff0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov rsi, r8
mov r15, rdx
mov r14, rcx
test r8, r8
je 0x18006c139
mov rax, qword [0x18011ef58]
lea rcx, [0x18011ecd8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
call qword [case.0x180005f92.0]
mov ecx, 0x40
call sym.glib_2.0.dll_g_slice_alloc
xor edi, edi
mov rbx, rax
test rax, rax
je 0x18006c060
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x38], rdi
mov edx, dword [rsp + 0x70]
lea r8, [0x180095150]
mov qword [rax + 0x30], r15
mov r9, rbx
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx + 0x38], rax
test rax, rax
jne 0x18006c0de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.glib_2.0.dll_g_win32_error_message
mov rsi, rax
call sym.glib_2.0.dll_g_thread_error_quark
mov rcx, qword [rsp + 0x78]
lea r9, str.Error_creating_thread:__s
mov edx, eax
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call sym.glib_2.0.dll_g_set_error
test rsi, rsi
je 0x18006c0cf
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, rbx
mov ecx, 0x40
call sym.glib_2.0.dll_g_slice_free1
jmp 0x18006c109
mov rcx, r14
mov dword [rbx + 0x18], 2
mov rdi, rbx
mov dword [rbx + 0x1c], 1
mov dword [rbx + 0x10], 1
mov qword [rbx], rsi
mov qword [rbx + 8], rbp
call sym.glib_2.0.dll_g_strdup
mov qword [rbx + 0x20], rax
mov rax, qword [0x18011ef68]
lea rcx, [0x18011ecd8]
call qword [case.0x180005f92.0]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rsi
ret
lea rax, str.func___NULL
mov edx, 8
lea r9, str.g_thread_new_internal
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
mov rbp, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rsi
ret
Function at 0x18006c2c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
lea rcx, [0x18011e008]
call fcn.180094fc0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x18006c331
lea ecx, [rax + 0x30]
mov qword [rsp + 0x20], rbx
call sym.glib_2.0.dll_g_slice_alloc
mov rbx, rax
test rax, rax
je 0x18006c30b
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [0x18011e008]
mov dword [rbx + 0x18], 1
call fcn.180094fc0
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x18006c340
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ebx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x18006c395
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
test rdx, rdx
je 0x18006c395
nop
test dl, 1
lea eax, [rcx + 1]
cmove eax, ecx
shr rdx, 1
mov ecx, eax
jne 0x18006c380
test eax, eax
cmovne ebx, eax
test ebx, ebx
mov eax, 1
cmovne eax, ebx
add rsp, 0x50
pop rbx
ret

Function at 0x18006d910
Capabilities:
Reference absolute stream path on windows

Disassembly:
push rbx
sub rsp, 0x30
mov ecx, 0x18
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x18006d952
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 0x18
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x18006d950
or dword [rax + 0x10], 1
call sym.glib_2.0.dll_g_get_monotonic_time
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1800702c0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov edx, 0x120
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8, rax
test rax, rax
jne 0x180070312
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:135
mov qword [rsp + 0x20], 0x120
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x180070310
mov dword [rax], 0x77c
lea rcx, [rbx + 0x4c]
mov dword [rax + 0x90], 0xbb7
mov rdx, r8
mov eax, dword [rbx + 4]
neg eax
mov qword [rdi], r8
mov dword [r8 + 4], eax
mov eax, dword [rbx + 8]
neg eax
mov dword [r8 + 8], eax
sub rdx, rcx
movups xmm0, xmmword [rbx + 0xc]
movups xmmword [r8 + 0xc], xmm0
movups xmm1, xmmword [rbx + 0x1c]
movups xmmword [r8 + 0x1c], xmm1
movups xmm0, xmmword [rbx + 0x2c]
movups xmmword [r8 + 0x2c], xmm0
movups xmm1, xmmword [rbx + 0x3c]
movups xmmword [r8 + 0x3c], xmm1
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx + 0x4c], al
lea rcx, [rcx + 1]
test al, al
jne 0x180070370
lea rax, [rbx + 0x6d]
sub r8, rax
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [r8 + rax + 0x6d], cl
lea rax, [rax + 1]
test cl, cl
jne 0x180070390
mov rbx, qword [rsp + 0x40]
mov eax, 2
add rsp, 0x30
pop rdi
ret

Function at 0x180070a10
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, [0x1800fa0a0]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rax
add rsp, 0x28
jmp sym.glib_2.0.dll_g_time_zone_new

Function at 0x180074940
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
je 0x1800749e4
mov qword [rsp + 0x50], rsi
call fcn.180074230
mov r9d, eax
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
mov r14d, eax
call fcn.1800743f0
mov r15, rax
lea rsi, [rax + 1]
test rsi, rsi
je 0x1800749c2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1800749c4
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rsi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x1800749c0
xor ebx, ebx
mov r9d, r14d
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.1800743f0
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov byte [rbx + r15], 0
jmp 0x180074a11
lea rax, str.str___NULL
mov edx, 8
lea r9, [0x1800fa4f8]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180075010
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
je 0x1800750b4
mov qword [rsp + 0x50], rsi
call fcn.180074230
mov r9d, eax
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
mov r14d, eax
call fcn.180074a30
mov r15, rax
lea rsi, [rax + 1]
test rsi, rsi
je 0x180075092
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x180075094
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rsi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x180075090
xor ebx, ebx
mov r9d, r14d
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.180074a30
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov byte [rbx + r15], 0
jmp 0x1800750e1
lea rax, str.str___NULL
mov edx, 8
lea r9, [0x1800fa508]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1800755d0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
call sym.glib_2.0.dll_g_utf8_offset_to_pointer
sub edi, ebx
mov rcx, rax
mov edx, edi
mov rsi, rax
call sym.glib_2.0.dll_g_utf8_offset_to_pointer
mov rbp, rax
mov r14, rax
sub rbp, rsi
lea rdi, [rbp + 1]
test rdi, rdi
je 0x18007564a
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x18007564c
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rdi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180075648
xor ebx, ebx
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x48]
mov rcx, rbx
mov rdi, qword [rsp + 0x58]
sub rcx, rsi
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov byte [rcx + r14], 0
add rsp, 0x30
pop r14
ret