joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180026cc0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180026e57
mov edx, 0x3d
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
jne 0x180026e4e
test rsi, rsi
je 0x180026e45
xor r8d, r8d
lea rdx, [rax - 1]
mov rcx, rbx
call sym.glib_2.0.dll_g_utf8_validate
test eax, eax
je 0x180026e3c
xor r8d, r8d
mov rcx, rsi
lea rdx, [r8 - 1]
call sym.glib_2.0.dll_g_utf8_validate
test eax, eax
je 0x180026e33
test edi, edi
jne 0x180026d50
mov rcx, rbx
call sym.glib_2.0.dll_g_getenv
test rax, rax
je 0x180026d50
lea eax, [rdi + 1]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x48], r14
xor r8d, r8d
xor r14d, r14d
mov rcx, rbx
mov qword [rsp + 0x20], r14
lea edx, [r14 - 1]
call sym.glib_2.0.dll_g_utf8_to_utf16
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
lea edx, [r14 - 1]
mov rcx, rsi
mov rbp, rax
call sym.glib_2.0.dll_g_utf8_to_utf16
xor r9d, r9d
lea rdx, [0x1800ee9c4]
mov r8, rsi
mov rcx, rbx
mov rdi, rax
call sym.glib_2.0.dll_g_strconcat
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
lea edx, [r14 - 1]
mov rcx, rax
mov rsi, rax
call sym.glib_2.0.dll_g_utf8_to_utf16
mov rbx, rax
test rsi, rsi
je 0x180026dd1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv]
test rbx, rbx
je 0x180026de8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
setne r14b
test rbp, rbp
je 0x180026e08
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, qword [rsp + 0x40]
test rdi, rdi
je 0x180026e1b
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, r14d
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
lea rax, str.g_utf8_validate__value___1__NULL_
jmp 0x180026e5e
lea rax, str.g_utf8_validate__variable___1__NULL_
jmp 0x180026e5e
lea rax, str.value___NULL
jmp 0x180026e5e
lea rax, str.strchr__variable_____NULL
jmp 0x180026e5e
lea rax, str.variable___NULL
lea r9, [0x1800ee990]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
mov edx, 8
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180026ea0
Capabilities:
Set environment variable

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
test rcx, rcx
je 0x180027096
mov edx, 0x3d
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
jne 0x180027065
movzx r8d, byte [rdi]
mov rdx, rdi
test r8b, r8b
je 0x180026fa7
cmp r8b, 0x80
jb 0x180026f96
movzx ecx, byte [rdx]
movzx eax, cl
cmp r8b, 0xe0
jae 0x180026efb
cmp r8b, 0xc2
jb 0x180026fab
jmp 0x180026f83
cmp r8b, 0xf0
jae 0x180026f25
movzx ecx, byte [rdx + 1]
inc rdx
movzx r9d, r8b
and r9d, 0xf
je 0x180026f1d
cmp r9d, 0xd
jne 0x180026f7b
and cl, 0xe0
jmp 0x180026f7e
and cl, 0xe0
cmp cl, 0xa0
jmp 0x180026f81
movzx eax, r8b
cmp r8b, 0xf5
jae 0x180026fab
movzx r9d, byte [rdx + 1]
movzx eax, cl
movzx ecx, r8b
and ecx, 7
je 0x180026f5d
cmp ecx, 4
je 0x180026f51
and r9b, 0xc0
cmp r9b, 0x80
jne 0x180026fab
jmp 0x180026f6f
and r9b, 0xf0
cmp r9b, 0x80
jne 0x180026fab
jmp 0x180026f6f
movzx ecx, r9b
and cl, 0xc0
cmp cl, 0x80
jne 0x180026fab
test r9b, 0x30
je 0x180026fab
movzx ecx, byte [rdx + 2]
add rdx, 2
movzx eax, r8b
and cl, 0xc0
cmp cl, 0x80
jne 0x180026fab
movzx ecx, byte [rdx + 1]
inc rdx
and cl, 0xc0
movzx eax, r8b
cmp cl, 0x80
jne 0x180026fab
movzx r8d, byte [rdx + 1]
inc rdx
test r8b, r8b
jne 0x180026ed6
movzx eax, r8b
test al, al
jne 0x18002705c
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x48], rsi
mov rcx, rdi
mov qword [rsp + 0x20], 0
lea edx, [r9 - 1]
call sym.glib_2.0.dll_g_utf8_to_utf16
xor r8d, r8d
lea rdx, [0x1800ee9c4]
mov rcx, rdi
mov rbx, rax
call sym.glib_2.0.dll_g_strconcat
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rax
mov rsi, rax
lea edx, [r9 - 1]
call sym.glib_2.0.dll_g_utf8_to_utf16
mov rdi, rax
test rsi, rsi
je 0x18002701c
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv]
mov rsi, qword [rsp + 0x48]
test rdi, rdi
je 0x180027038
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test rbx, rbx
je 0x180027051
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rax, str.g_utf8_validate__variable___1__NULL_
jmp 0x18002706c
lea rax, str.strchr__variable_____NULL
lea r9, [0x1800ee9c8]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
mov edx, 8
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
add rsp, 0x30
pop rdi
ret
lea rax, str.variable___NULL
jmp 0x18002706c
Function at 0x1800270a0
Capabilities:
Query environment variable
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbp, rax
test rax, rax
je 0x1800270fc
mov rdx, rax
cmp word [rax], bx
je 0x1800270fc
nop
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rdx + rcx*2 + 2], r15w
lea rcx, [rcx + 1]
jne 0x1800270e0
lea rdx, [rdx + rcx*2]
inc ebx
add rdx, 2
cmp word [rdx], r15w
jne 0x1800270d0
lea eax, [rbx + 1]
movsxd rbx, eax
movabs rax, 0x1fffffffffffffff
cmp rbx, rax
jbe 0x180027142
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:357
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rbx
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x180027140
lea rbx, [rbx*8]
test rbx, rbx
je 0x180027189
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
jne 0x18002718c
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:135
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180027187
mov r14, r15
mov esi, r15d
mov rbx, rbp
cmp word [rbp], si
je 0x18002722f
mov qword [rsp + 0x50], rdi
mov rdi, r14
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 - 1]
call sym.glib_2.0.dll_g_utf16_to_utf8
mov qword [rdi], rax
test rax, rax
je 0x180027200
mov edx, 0x3d
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
je 0x1800271f2
cmp rax, qword [rdi]
jbe 0x1800271f2
inc esi
mov byte [rax], r15b
add rdi, 8
jmp 0x180027200
mov rcx, qword [rdi]
test rcx, rcx
je 0x180027200
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rcx*2 + 2], r15w
lea rcx, [rcx + 1]
jne 0x180027210
lea rbx, [rbx + rcx*2]
add rbx, 2
cmp word [rbx], r15w
jne 0x1800271b0
mov rdi, qword [rsp + 0x50]
movsxd rcx, esi
mov qword [r14 + rcx*8], r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x58]
mov rax, r14
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rsi
ret
Function at 0x180027260
Capabilities:
Query environment variable
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r12d, r12d
mov rdi, rax
mov r8d, r12d
mov r9d, r12d
cmp word [rax], r8w
je 0x1800272d1
mov rdx, rax
nop dword [rax]
nop word [rax + rax]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rdx + rcx*2], r12w
jne 0x1800272b0
inc r8d
inc r9d
add r8d, ecx
movsxd rax, r8d
cmp word [rdi + rax*2], r12w
lea rdx, [rdi + rax*2]
jne 0x1800272a0
lea eax, [r9 + 1]
movsxd rbx, eax
movabs rax, 0x1fffffffffffffff
cmp rbx, rax
jbe 0x180027316
mov qword [rsp + 0x28], 8
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rbx
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180027314
lea rbx, [rbx*8]
test rbx, rbx
je 0x180027358
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
jne 0x18002735b
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180027356
mov r15, r12
mov esi, r12d
mov ebp, r12d
cmp word [rdi], si
je 0x1800273b9
mov qword [rsp + 0x50], r14
mov rbx, rdi
mov r14, r15
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 - 1]
call sym.glib_2.0.dll_g_utf16_to_utf8
mov qword [r14], rax
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], r12w
jne 0x180027392
inc ecx
inc ebp
add esi, ecx
add r14, 8
movsxd rcx, esi
cmp word [rdi + rcx*2], r12w
lea rbx, [rdi + rcx*2]
jne 0x180027371
mov r14, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x58]
mov rax, r15
mov rsi, qword [rsp + 0x68]
movsxd rcx, ebp
mov rbp, qword [rsp + 0x60]
mov qword [r15 + rcx*8], r12
add rsp, 0x30
pop r15
pop r12
pop rdi
ret
Function at 0x180027e20
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
test rcx, rcx
je 0x180028033
xor r9d, r9d
mov qword [rsp + 0x40], rbp
xor r8d, r8d
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], 0
lea edx, [r9 - 1]
call sym.glib_2.0.dll_g_utf8_to_utf16
mov rbp, rax
test rax, rax
je 0x18002802f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbp
mov esi, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp esi, 0xffffffff
je 0x18002802f
mov qword [rsp + 0x50], r14
test bl, 0x10
jne 0x180027ff0
test bl, 1
je 0x180027ea0
test sil, 0x50
je 0x180027ff0
test bl, 4
je 0x180027eaf
test sil, 0x10
jne 0x180027ff0
test bl, 8
je 0x18002802b
mov edx, 0x2e
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, rax
test rax, rax
je 0x18002802b
lea rdx, str..exe
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x180027ff0
lea rdx, str..cmd
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x180027ff0
lea rdx, str..bat
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x180027ff0
lea rdx, str..com
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x180027ff0
lea rcx, str.PATHEXT
call sym.glib_2.0.dll_g_getenv
test rax, rax
je 0x18002802b
mov rdx, 0xffffffffffffffff
mov rcx, rax
call sym.glib_2.0.dll_g_utf8_casefold
mov rdx, 0xffffffffffffffff
mov rcx, rbx
mov r14, rax
call sym.glib_2.0.dll_g_utf8_casefold
mov rsi, rax
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x180027f72
mov rdi, r14
movsxd rbp, ecx
mov edx, 0x3b
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov rbx, rax
test rax, rax
jne 0x180027fac
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x180027fa0
add rbx, rdi
mov rax, rbx
sub rax, rdi
cmp rbp, rax
jne 0x180027fc9
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180027fd4
cmp byte [rbx], 0
je 0x18002800f
lea rdi, [rbx + 1]
jmp 0x180027f81
test r14, r14
je 0x180027fe2
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rsi, rsi
je 0x180027ff0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test r14, r14
je 0x18002801d
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rsi, rsi
je 0x18002802b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x180027ff5
xor eax, eax
jmp 0x180027ffa
lea rax, str.filename___NULL
mov edx, 8
lea r9, [0x1800eebd0]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x180029ae0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x30
mov rbp, rdx
mov rsi, rcx
test rcx, rcx
je 0x180029c77
test rdx, rdx
je 0x180029b3c
cmp qword [rdx], 0
je 0x180029b3c
lea rax, str.error__NULL__error__NULL
lea r9, [0x1800ef060]
mov qword [rsp + 0x20], rax
lea r8, str._s:_assertion__s_failed
mov edx, 8
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
xor eax, eax
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov edi, 0x100
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x180029c51
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.180060590
movsxd rcx, eax
test eax, eax
js 0x180029bdf
cmp rcx, rdi
jb 0x180029bfe
add rdi, rdi
je 0x180029bba
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rbx, rax
test rax, rax
jne 0x180029bca
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:170
mov qword [rsp + 0x20], rdi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180029bb8
test rbx, rbx
je 0x180029bc8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor ebx, ebx
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.180060590
movsxd rcx, eax
test eax, eax
jns 0x180029b74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, dword [rax]
call fcn.18002a6c0
call fcn.18002aa30
test eax, eax
jne 0x180029c1a
lea rax, str.Failed_to_read_the_symbolic_link__s:__s
jmp 0x180029c2e
mov byte [rcx + rbx], 0
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
lea rdx, str.Failed_to_read_the_symbolic_link__s:__s
lea rcx, str.glib20
call qword [sym.imp.intl.dll_libintl_dgettext]
mov r9d, edi
mov r8, rax
mov rdx, rsi
mov rcx, rbp
call fcn.180028280
test rbx, rbx
je 0x180029c4d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x180029c05
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rdi
lea r8, str._s:_failed_to_allocate__I64u_bytes
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180029c75
lea rax, str.filename___NULL
jmp 0x180029b0b
Function at 0x180029f60
Capabilities:
Reference absolute stream path on windows

Disassembly:
push r14
sub rsp, 0x30
mov r14, rcx
test rcx, rcx
je 0x18002a12e
movzx ecx, byte [rcx]
test cl, cl
jne 0x180029fc8
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x180029fb4
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 2
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x180029fb2
movzx eax, word [0x1800ef114]
mov word [rcx], ax
mov rax, rcx
add rsp, 0x30
pop r14
ret
mov qword [rsp + 0x50], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [r14 + rdi], 0
jne 0x180029fd4
sub rdi, 1
js 0x180029ff7
movzx eax, byte [rdi + r14]
cmp al, 0x5c
je 0x180029ff1
cmp al, 0x2f
jne 0x180029ff7
sub rdi, 1
jns 0x180029fe4
cmp rdi, 0xffffffffffffffff
jne 0x18002a03a
lea ecx, [rdi + 3]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x18002a092
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 2
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rdi + 5]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18002a038
lea rdx, [0x18009d910]
cmp rdi, 1
jne 0x18002a0ab
movzx eax, cl
test byte [rdx + rax*2], 2
je 0x18002a0ab
cmp byte [r14 + 1], 0x3a
jne 0x18002a0ab
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x18002a092
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 2
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rdi + 3]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x18002a090
movzx eax, word [0x1800eefe4]
mov rdi, qword [rsp + 0x50]
mov word [rcx], ax
mov rax, rcx
add rsp, 0x30
pop r14
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rsi, rdi
test rdi, rdi
js 0x18002a0d3
nop dword [rax]
movzx eax, byte [rsi + r14]
cmp al, 0x5c
je 0x18002a0d3
cmp al, 0x2f
je 0x18002a0d3
sub rsi, 1
jns 0x18002a0c0
cmp rsi, 0xffffffffffffffff
jne 0x18002a0f0
movzx eax, cl
test byte [rdx + rax*2], 2
je 0x18002a0f0
cmp byte [r14 + 1], 0x3a
mov eax, 1
cmove rsi, rax
sub rdi, rsi
lea rcx, [rdi + 1]
call sym.glib_2.0.dll_g_malloc
lea rdx, [r14 + 1]
mov r8, rdi
add rdx, rsi
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov byte [rbx + rdi], 0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
lea r8, str.file_name___NULL
lea rdx, [0x1800ef100]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_return_if_fail_warning
xor eax, eax
add rsp, 0x30
pop r14
ret
Function at 0x18002a450
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
lea rdx, [rsp + 0x40]
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rbp, eax
movabs rax, 0x7fffffffffffffff
mov rsi, rbp
cmp rbp, rax
jbe 0x18002a4b6
mov qword [rsp + 0x28], 2
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:333
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rbp
lea edx, [rdi + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18002a4b4
add rsi, rsi
je 0x18002a4f2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x18002a4f5
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], rsi
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x18002a4f0
mov rbx, rdi
mov rdx, rbx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
lea eax, [rbp - 1]
cmp ecx, eax
jne 0x18002a523
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 - 1]
call sym.glib_2.0.dll_g_utf16_to_utf8
mov rdi, rax
test rbx, rbx
je 0x18002a531
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rdi, rdi
jne 0x18002a57e
lea ecx, [rdi + 2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x18002a572
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 2
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rdi + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop word [rax + rax]
jmp 0x18002a570
movzx ecx, word [0x1800eefe4]
mov word [rax], cx
jmp 0x18002a581
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18002a5e0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [0x18011eff0]
test rcx, rcx
je 0x18002a668
call sym.glib_2.0.dll_g_win32_get_package_installation_directory_of_module
mov rdi, rax
test rax, rax
je 0x18002a668
mov qword [rsp + 0x40], rsi
lea rdx, [0x1800ef141]
nop
dec rdx
cmp byte [rdx], 0x2f
jne 0x18002a610
dec rdx
cmp byte [rdx], 0x2f
jne 0x18002a618
xor r8d, r8d
mov rcx, rdi
call sym.glib_2.0.dll_g_build_filename
mov rcx, rax
mov rsi, rax
call sym.glib_2.0.dll_g_win32_locale_filename_from_utf8
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rsi, rsi
je 0x18002a650
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x40]
test rbx, rbx
je 0x18002a668
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x18002a6a3
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:105
mov qword [rsp + 0x20], 1
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18002a6a1
movzx eax, byte [0x1800eaba1]
mov rbx, qword [rsp + 0x48]
mov byte [rcx], al
mov rax, rcx
add rsp, 0x30
pop rdi
ret
Function at 0x18002b290
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, rcx
mov rbp, r9
mov ecx, 0x58
mov rsi, r8
mov rdi, rdx
call sym.glib_2.0.dll_g_slice_alloc
xor r15d, r15d
lea r9, [sym.glib_2.0.dll_g_direct_hash]
test rbx, rbx
mov r14, rax
cmovne r9, rbx
mov dword [rax], 8
lea edx, [r15 + 0x40]
mov dword [rax + 4], 7
lea ecx, [rdx - 0x3f]
mov qword [rax + 8], 7
mov dword [rax + 0x10], r15d
mov qword [rax + 0x30], r9
mov qword [rax + 0x38], rdi
mov qword [rax + 0x40], 1
mov qword [rax + 0x48], rsi
mov qword [rax + 0x50], rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
test rax, rax
je 0x18002b3a9
mov qword [r14 + 0x18], rax
movabs rcx, 0x3fffffffffffffff
mov qword [r14 + 0x28], rax
movsxd rax, dword [r14]
cmp rax, rcx
jbe 0x18002b362
mov qword [rsp + 0x28], 4
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:357
lea r8, str._s:_overflow_allocating__I64u_I64u_bytes
mov qword [rsp + 0x20], rax
lea edx, [r15 + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
nop
jmp 0x18002b360
lea rbx, [rax*4]
test rbx, rbx
je 0x18002b3d3
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r15, rax
test rax, rax
jne 0x18002b3d3
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:135
mov qword [rsp + 0x20], rbx
lea r8, str._s:_failed_to_allocate__I64u_bytes
lea edx, [rax + 4]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18002b3a7
lea r9, str.d:_buildob_bora_15653658cayman_glibglib_srcglibgmem.c:135
mov qword [rsp + 0x20], 0x40
lea r8, str._s:_failed_to_allocate__I64u_bytes
mov edx, 4
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_log
jmp 0x18002b3d1
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov qword [r14 + 0x20], r15
add rsp, 0x30
pop r15
pop r14
pop rdi
ret