joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68603880
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rdx
mov rdx, qword [rcx + 0x68]
cmp rdx, qword [rcx + 0x70]
mov rbx, rcx
mov rbp, r8
jae 0x686038c3
movzx eax, byte [rdx]
add rdx, 1
mov qword [rcx + 0x68], rdx
cmp al, 0xa
je 0x68603944
test al, al
je 0x686038b8
add dword [rbp], 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, dword [rcx + 0x60]
test ecx, ecx
js 0x68603910
mov rsi, qword [rbx + 0x78]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
jmp 0x686038e3
mov ecx, dword [rbx + 0x60]
mov r8d, 0xfa0
mov rdx, rsi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
jne 0x68603920
call rdi
cmp dword [rax], 4
nop dword [rax + rax]
je 0x686038e0
call rdi
cmp dword [rax], 0xb
je 0x686038e0
mov dword [rbx + 0x60], 0xffffffff
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test eax, eax
jle 0x68603909
lea rdx, [rsi + 1]
cdqe
add rax, rsi
mov qword [rbx + 0x68], rdx
mov qword [rbx + 0x70], rax
movzx eax, byte [rsi]
test al, al
je 0x68603960
cmp al, 0xa
jne 0x686038b4
mov dword [rbp], 0
add dword [r12], 1
mov eax, 0xa
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
call sym.libglib_2.0_0.dll_g_scanner_sync_file_offset
mov rax, qword [rbx + 0x68]
mov qword [rbx + 0x70], rax
jmp 0x68603909

Function at 0x6860a180
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor r9d, r9d
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], 0
mov edx, 0xffffffff
call sym.libglib_2.0_0.dll_g_utf8_to_utf16
test rax, rax
mov rbx, rax
je 0x6860a297
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], 0
mov edx, 0xffffffff
call sym.libglib_2.0_0.dll_g_utf8_to_utf16
test rax, rax
mov rsi, rax
je 0x6860a28f
mov r8d, 1
mov rdx, rax
mov rcx, rbx
xor ebp, ebp
xor edi, edi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x6860a215
mov rcx, rbx
call sym.libglib_2.0_0.dll_g_free
mov rcx, rsi
call sym.libglib_2.0_0.dll_g_free
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebp
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x11
je 0x6860a280
jbe 0x6860a240
cmp eax, 0x50
je 0x6860a258
ja 0x6860a251
sub eax, 0x20
cmp eax, 1
nop
ja 0x6860a245
mov ebp, 0xd
mov edi, 0xffffffff
jmp 0x6860a1f2
cmp eax, 2
jae 0x6860a264
mov ebp, 5
mov edi, 0xffffffff
jmp 0x6860a1f2
cmp eax, 0xb7
jne 0x6860a245
mov ebp, 0x11
mov edi, 0xffffffff
jmp 0x6860a1f2
cmp eax, 3
mov bpl, 2
mov edi, 0xffffffff
jbe 0x6860a1f2
cmp eax, 5
jne 0x6860a245
jmp 0x6860a232
mov ebp, 0x12
mov edi, 0xffffffff
jmp 0x6860a1f2
mov rcx, rbx
call sym.libglib_2.0_0.dll_g_free
call qword [sym.imp.msvcrt.dll__errno]
mov edi, 0xffffffff
mov dword [rax], 0x16
jmp 0x6860a20a
Function at 0x6860a2b0
Capabilities:
Create directory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov qword [rsp + 0x20], 0
call sym.libglib_2.0_0.dll_g_utf8_to_utf16
test rax, rax
mov rbx, rax
je 0x6860a306
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wmkdir]
mov rsi, qword [sym.imp.msvcrt.dll__errno]
mov edi, eax
call rsi
mov ebp, dword [rax]
mov rcx, rbx
call sym.libglib_2.0_0.dll_g_free
call rsi
mov dword [rax], ebp
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.msvcrt.dll__errno]
mov edi, 0xffffffff
mov dword [rax], 0x16
jmp 0x6860a2fb

Function at 0x6860a510
Capabilities:
Delete directory
Delete file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov qword [rsp + 0x20], 0
call sym.libglib_2.0_0.dll_g_utf8_to_utf16
test rax, rax
mov rbx, rax
je 0x6860a57d
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wremove]
cmp eax, 0xffffffff
mov esi, eax
je 0x6860a570
mov rdi, qword [sym.imp.msvcrt.dll__errno]
call rdi
mov ebp, dword [rax]
mov rcx, rbx
call sym.libglib_2.0_0.dll_g_free
call rdi
mov dword [rax], ebp
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wrmdir]
mov esi, eax
jmp 0x6860a549
call qword [sym.imp.msvcrt.dll__errno]
mov esi, 0xffffffff
mov dword [rax], 0x16
jmp 0x6860a560

Function at 0x6860a590
Capabilities:
Delete directory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov qword [rsp + 0x20], 0
call sym.libglib_2.0_0.dll_g_utf8_to_utf16
test rax, rax
mov rbx, rax
je 0x6860a5e6
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wrmdir]
mov rsi, qword [sym.imp.msvcrt.dll__errno]
mov edi, eax
call rsi
mov ebp, dword [rax]
mov rcx, rbx
call sym.libglib_2.0_0.dll_g_free
call rsi
mov dword [rax], ebp
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.msvcrt.dll__errno]
mov edi, 0xffffffff
mov dword [rax], 0x16
jmp 0x6860a5db

Function at 0x6860eb40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov rcx, qword [0x686cd510]
jmp sym.libglib_2.0_0.dll_g_rand_int
Function at 0x68613670
Capabilities:
Query environment variable

Disassembly:
lea rcx, [0x68675679]
jmp sym.libglib_2.0_0.dll_g_time_zone_new

Function at 0x68613680
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, [0x6867567d]
call sub.msvcrt.dll_getenv
mov rcx, rax
add rsp, 0x28
jmp sym.libglib_2.0_0.dll_g_time_zone_new
Function at 0x68619e40
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
xor ebx, ebx
mov edx, ecx
mov qword [rsp + 0x38], 0
xor ecx, ecx
lea r8, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x68619e85
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x68619e91
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rbx
add rsp, 0x250
pop rbx
ret
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
call sym.libglib_2.0_0.dll_g_utf16_to_utf8
mov rbx, rax
jmp 0x68619e7a
Function at 0x6861a570
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x6861a5e0
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov edx, 0xffffffff
call sym.libglib_2.0_0.dll_g_utf16_to_utf8
test rax, rax
mov rbx, rax
je 0x6861a5e0
mov rcx, rax
call sym.libglib_2.0_0.dll_g_path_skip_root
movzx edx, byte [rax - 1]
cmp dl, 0x2f
jne 0x6861a600
xor edx, edx
cmp byte [rax - 2], 0x3a
setne dl
sub rax, rdx
mov byte [rax], 0
mov rax, rbx
add rsp, 0x240
pop rbx
ret
lea rcx, [0x686b3df0]
call sym.libglib_2.0_0.dll_g_strdup
mov rbx, rax
mov rax, rbx
add rsp, 0x240
pop rbx
ret
cmp dl, 0x5c
je 0x6861a5c3
jmp 0x6861a5cf
Function at 0x68629020
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x68629032
add rsp, 0x28
jmp fcn.68631ac0
lea r8, str.format___NULL
lea rdx, str.g_vprintf
lea rcx, [0x686b83ff]
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
mov eax, 0xffffffff
add rsp, 0x28
ret

Function at 0x68629090
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x686290a2
add rsp, 0x28
jmp fcn.68631a60
lea r8, str.format___NULL
lea rdx, str.g_vfprintf
lea rcx, [0x686b83ff]
call sym.libglib_2.0_0.dll_g_return_if_fail_warning
mov eax, 0xffffffff
add rsp, 0x28
ret

Function at 0x68629730
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ebx, dword [rcx]
mov rsi, rcx
test ebx, ebx
jne 0x686297d0
lea rcx, [0x686cd780]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [rsi]
test ebx, ebx
jne 0x686297bb
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov ebx, eax
je 0x686297da
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x6862979f
mov ecx, 0x18
call sub.msvcrt.dll_malloc
test rax, rax
mov rdx, rax
je 0x686297f6
mov dword [rax], ebx
mov qword [rax + 8], rdi
mov rax, qword [0x686cd6e0]
mov qword [rdx + 0x10], rax
lock cmpxchg qword [0x686cd6e0], rdx
cmp rax, qword [rdx + 0x10]
jne 0x686297e8
mov edx, ebx
xor eax, eax
lock cmpxchg qword [rsi], rdx
test rax, rax
je 0x686297bb
lea rdx, str.g_private_get_impl_2_
xor ecx, ecx
call fcn.68661050
lea rcx, [0x686cd780]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rdx, str.TlsAlloc
xor ecx, ecx
call fcn.68661050
lea rdx, str.g_private_get_impl_1_
xor ecx, ecx
call fcn.68661050
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
lea rdx, str.malloc
call fcn.68661050
nop
nop dword [rax + rax]
Function at 0x68629810
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x686cd7e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x68629832
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov ecx, 0x18
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x68629889
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx], rax
je 0x68629875
mov qword [rbx + 0x10], 0
mov rdx, rbx
mov ecx, dword [0x686cd7e8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x68629829
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateEvent
mov ecx, eax
call fcn.68661050
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.malloc
mov ecx, eax
call fcn.68661050
nop
nop
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, r8d
mov rbp, rdx
call fcn.686293f0
mov rdi, rax
call fcn.68629810
lea rcx, [0x686cd7c0]
mov rbx, rax
mov qword [rax + 8], 0
mov r13, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call r13
mov rax, qword [rdi + 8]
lea rcx, [0x686cd7c0]
mov r12, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rbx + 0x10], rax
mov qword [rax], rbx
lea rax, [rbx + 8]
mov qword [rdi + 8], rax
call r12
mov rcx, rbp
call qword [0x686cd728]
mov edx, esi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov esi, eax
jne 0x68629986
mov rcx, rbp
call qword [0x686cd718]
cmp esi, 0x102
je 0x68629940
xor eax, eax
test esi, esi
sete al
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, [0x686cd7c0]
call r13
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x6862996f
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x68629980
mov qword [rdx + 0x10], rax
mov rax, qword [rbx + 0x10]
mov qword [rax], rdx
mov qword [rbx + 0x10], 0
lea rcx, [0x686cd7c0]
call r12
jmp 0x6862992a
mov qword [rdi + 8], rax
jmp 0x68629964
cmp eax, 0x102
je 0x68629919
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.WaitForSingleObject
mov ecx, eax
call fcn.68661050
nop
nop word cs:[rax + rax]
push rbx
sub rsp, 0x30
call fcn.68629550
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rbx + 0x2c]
test r11d, r11d
je 0x68629a00
lea rax, str._lock__writer_locked
lea r9, str.g_thread_xp_AcquireSRWLockShared
lea rdx, str.gthread_win32.c
lea rcx, [0x686b8541]
mov r8d, 0x2de
mov qword [rsp + 0x20], rax
call sym.libglib_2.0_0.dll_g_assertion_message_expr
nop dword [rax + rax]
mov rcx, rbx
call fcn.686292d0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp rax

Function at 0x68629de0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.68629730
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x28
jmp rax

Function at 0x68629e00
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.68629730
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp rax
Function at 0x68629e30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, rdx
call fcn.68629730
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x68629e60
mov r8, qword [rsi + 8]
test r8, r8
je 0x68629e60
mov rcx, rax
call r8
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rdx, rdi
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp rax

Function at 0x68629f30
Capabilities:
Create thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rcx
mov ecx, 0x40
mov esi, edx
mov rbp, r8
call sym.libglib_2.0_0.dll_g_slice_alloc0
mov qword [rax + 0x30], rdi
mov rbx, rax
lea rax, [rsp + 0x3c]
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x68629f20]
mov edx, esi
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx + 0x38], rax
je 0x68629f8c
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.libglib_2.0_0.dll_g_win32_error_message
mov rsi, rax
call sym.libglib_2.0_0.dll_g_thread_error_quark
lea r9, str.Error_creating_thread:__s
mov edx, eax
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rsi
call sym.libglib_2.0_0.dll_g_set_error
mov rcx, rsi
call sym.libglib_2.0_0.dll_g_free
mov rdx, rbx
mov ecx, 0x40
xor ebx, ebx
call sym.libglib_2.0_0.dll_g_slice_free1
jmp 0x68629f80
Function at 0x6862a080
Capabilities:
Allocate thread local storage
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rbx, rax
je 0x6862a250
lea rdx, str.InitializeSRWLock
mov rcx, rax
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rsi
test rax, rax
mov rdi, rax
je 0x6862a250
lea rdx, str.AcquireSRWLockExclusive
mov rcx, rbx
call rsi
test rax, rax
mov rbp, rax
je 0x6862a250
lea rdx, str.TryAcquireSRWLockExclusive
mov rcx, rbx
call rsi
test rax, rax
mov r12, rax
je 0x6862a250
lea rdx, str.ReleaseSRWLockExclusive
mov rcx, rbx
call rsi
test rax, rax
mov r13, rax
je 0x6862a250
lea rdx, str.AcquireSRWLockShared
mov rcx, rbx
call rsi
test rax, rax
mov r14, rax
je 0x6862a250
lea rdx, str.TryAcquireSRWLockShared
mov rcx, rbx
call rsi
test rax, rax
mov r15, rax
je 0x6862a250
lea rdx, str.ReleaseSRWLockShared
mov rcx, rbx
call rsi
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6862a250
lea rdx, str.InitializeConditionVariable
mov rcx, rbx
call rsi
test rax, rax
mov qword [rsp + 0x30], rax
je 0x6862a250
lea rdx, str.SleepConditionVariableSRW
mov rcx, rbx
call rsi
test rax, rax
mov qword [rsp + 0x38], rax
je 0x6862a250
lea rdx, str.WakeAllConditionVariable
mov rcx, rbx
call rsi
test rax, rax
je 0x6862a250
lea rdx, str.WakeConditionVariable
mov rcx, rbx
mov qword [rsp + 0x20], rax
call rsi
test rax, rax
mov r8, qword [rsp + 0x20]
je 0x6862a250
mov rdx, qword [rsp + 0x28]
mov qword [0x686cd700], 0
mov qword [0x686cd708], rdi
mov qword [0x686cd710], 0
mov qword [0x686cd718], rbp
mov qword [0x686cd720], r12
mov qword [0x686cd740], rdx
mov rdx, qword [rsp + 0x30]
mov qword [0x686cd728], r13
mov qword [0x686cd730], r14
mov qword [0x686cd738], r15
mov qword [0x686cd750], 0
mov qword [0x686cd748], rdx
mov rdx, qword [rsp + 0x38]
mov qword [0x686cd760], r8
mov qword [0x686cd768], rax
mov rbx, qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [0x686cd758], rdx
jmp 0x6862a330
lea rcx, [0x686cd7c0]
mov rbx, qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
lea rdx, [0x686293a0]
mov dword [0x686cd7e8], eax
lea rax, [0x68629290]
mov qword [0x686cd700], rdx
mov qword [0x686cd708], rax
lea rdx, [0x68629350]
lea rax, [0x68629a20]
mov qword [0x686cd710], rdx
lea rdx, [0x686296a0]
mov qword [0x686cd718], rax
lea rax, [0x686292b0]
mov qword [0x686cd720], rdx
lea rdx, [0x686299b0]
mov qword [0x686cd728], rax
lea rax, [0x68629640]
mov qword [0x686cd730], rdx
lea rdx, [0x686295f0]
mov qword [0x686cd738], rax
lea rax, [0x686292a0]
mov qword [0x686cd740], rdx
lea rdx, [0x68629330]
mov qword [0x686cd748], rax
lea rax, [0x686298a0]
mov qword [0x686cd750], rdx
lea rdx, [0x686294d0]
mov qword [0x686cd758], rax
lea rax, [0x68629460]
mov qword [0x686cd760], rdx
mov qword [0x686cd768], rax
lea rcx, [0x686cd780]
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
Function at 0x6862a350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop dword [rax + rax]
mov rbx, qword [0x686cd6e0]
test rbx, rbx
je 0x6862a3b2
xor ebp, ebp
nop
mov ecx, dword [rbx]
call rdi
test rax, rax
mov rsi, rax
je 0x6862a3a5
cmp qword [rbx + 8], 0
je 0x6862a3a5
mov ebp, 1
xor edx, edx
mov ecx, dword [rbx]
call r12
mov rcx, rsi
call qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6862a380
test ebp, ebp
jne 0x6862a370
mov rax, qword [0x686cd700]
test rax, rax
je 0x6862a3cb
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x6862b240
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov rbx, rcx
mov ecx, dword [rcx + 0x78]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea r9, [rsp + 0x3c]
mov rsi, rax
lea rdx, [rsp + 0x40]
mov r8d, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
movzx edx, byte [rbx + 0x60]
and eax, 1
mov qword [rsp + 0x20], 0
shl eax, 3
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rcx, rsi
and edx, 0xfffffff7
or edx, eax
mov byte [rbx + 0x60], dl
lea rdx, [rsp + 0x3b]
call qword [sym.imp.KERNEL32.dll_WriteFile]
movzx edx, byte [rbx + 0x60]
and eax, 1
shl eax, 4
and edx, 0xffffffcf
or edx, eax
xor eax, eax
mov byte [rbx + 0x60], dl
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x6862c130
Capabilities:
Create thread

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rcx + 0xc4]
mov r8, rdx
mov r9, rcx
xor edx, edx
mov rbx, rcx
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov qword [rsp + 0x28], rax
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
je 0x6862c1c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x6862c1a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.libglib_2.0_0.dll_g_win32_error_message
lea rcx, [0x686b8874]
lea r8, str.Error_closing_thread_handle:__s.
mov rsi, rax
mov r9, rax
mov edx, 0x10
call sym.libglib_2.0_0.dll_g_log
mov rcx, rsi
call sym.libglib_2.0_0.dll_g_free
mov rcx, qword [rbx + 0xe8]
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
add rsp, 0x38
pop rbx
pop rsi
jmp rax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call sym.libglib_2.0_0.dll_g_strerror
lea r8, str.Error_creating_thread:__s.
lea rcx, [0x686b8874]
mov r9, rax
mov edx, 0x10
call sym.libglib_2.0_0.dll_g_log
jmp 0x6862c1a2
Function at 0x6862cc60
Capabilities:
Read file on windows
Read pipe
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [sym.imp.msvcrt.dll__get_osfhandle]
and dh, 0x10
mov rbx, rcx
mov ecx, dword [rcx + 0x78]
je 0x6862cd03
call rsi
xor r8d, r8d
lea rdx, [rsp + 0x3b]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
mov edx, 1
je 0x6862cd80
movzx eax, byte [rbx + 0x60]
shl edx, 3
mov ecx, dword [rbx + 0x78]
and eax, 0xfffffff7
or eax, edx
mov byte [rbx + 0x60], al
call rsi
xor r8d, r8d
lea rdx, [rsp + 0x3b]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
movzx eax, byte [rbx + 0x60]
setne dl
shl edx, 4
and eax, 0xffffffcf
or eax, edx
mov byte [rbx + 0x60], al
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
call rsi
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, [rsp + 0x3b]
mov qword [rsp + 0x20], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
movzx eax, byte [rbx + 0x60]
mov ecx, dword [rbx + 0x78]
setne dl
shl edx, 3
and eax, 0xfffffff7
or eax, edx
mov byte [rbx + 0x60], al
call rsi
xor r8d, r8d
lea rdx, [rsp + 0x3b]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
movzx eax, byte [rbx + 0x60]
setne dl
shl edx, 4
and eax, 0xffffffef
or eax, edx
or eax, 0x20
mov byte [rbx + 0x60], al
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
sete dl
jmp 0x6862ccb3

Function at 0x6862cfd0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.G_IO_WIN32_DEBUG
call sub.msvcrt.dll_getenv
test rax, rax
lea rcx, [rbx + 0x90]
setne al
movzx eax, al
mov dword [rbx + 0x80], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xc4], 0
mov qword [rbx + 0xc8], 0
mov word [rbx + 0xd0], 0
mov qword [rbx + 0xd8], 0
mov qword [rbx + 0xe8], 0
mov dword [rbx + 0xf0], 0
mov dword [rbx + 0xf4], 0
mov qword [rbx + 0xf8], 0
mov dword [rbx + 0x100], 0
mov dword [rbx + 0x104], 0
add rsp, 0x20
pop rbx
ret
Function at 0x6862e1c0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor r15d, r15d
xor ebx, ebx
mov r13d, 0x10
mov r12d, ecx
mov rbp, rdx
mov r14, r8
mov edi, 0x10
jmp 0x6862e226
lea rdx, [rbp + rsi]
mov r8d, edi
mov ecx, r12d
sub r8d, r15d
call sub.msvcrt.dll__read
mov edx, dword [0x68664280]
test edx, edx
jne 0x6862e250
cmp eax, 0
jl 0x6862e26b
je 0x6862e2c0
add ebx, eax
cmp ebx, 0xf
mov r15d, ebx
ja 0x6862e300
mov ecx, dword [0x68664280]
movsxd rsi, ebx
test ecx, ecx
je 0x6862e1f0
mov r8, r13
lea rdx, str.gspawn_win32.c
lea rcx, str._s:read_helper_report:_read__I64u..._n
sub r8, rsi
call sym.libglib_2.0_0.dll_g_print
jmp 0x6862e1f0
lea rcx, str....got__d_bytes_n
mov edx, eax
mov dword [rsp + 0x38], eax
call sym.libglib_2.0_0.dll_g_print
mov eax, dword [rsp + 0x38]
cmp eax, 0
jge 0x6862e212
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call sym.libglib_2.0_0.dll_g_strerror
lea rcx, str.Failed_to_read_from_child_pipe___s_
mov rsi, rax
call sym.libglib_2.0_0.dll_glib_gettext
mov rbx, rax
call sym.libglib_2.0_0.dll_g_spawn_error_quark
mov qword [rsp + 0x20], rsi
mov edx, eax
mov r9, rbx
mov r8d, 0x13
mov rcx, r14
call sym.libglib_2.0_0.dll_g_set_error
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.Failed_to_read_from_child_pipe___s_
call sym.libglib_2.0_0.dll_glib_gettext
mov rbx, rax
call sym.libglib_2.0_0.dll_g_spawn_error_quark
lea rdx, [0x686b9bc4]
mov r9, rbx
mov r8d, 0x13
mov rcx, r14
mov qword [rsp + 0x20], rdx
mov edx, eax
call sym.libglib_2.0_0.dll_g_set_error
xor eax, eax
jmp 0x6862e2a9
mov eax, 1
jmp 0x6862e2a9