joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x1404ca180]
lea rsi, [0x1404ca180]
mov rbx, rcx
mov ecx, eax
test eax, eax
jne 0x140045027
mov rcx, rsi
call fcn.1401001a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rax, str.l___NULL
test rdx, rdx
je 0x140045048
cmp qword [rdx], rbx
je 0x140045078
lea rax, str.l__data__cancellable
mov qword [rsp + 0x20], rax
lea r9, str.g_cancellable_pop_current
lea r8, [0x14036fdeb]
mov edx, 8
lea rcx, [0x14036fefe]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
ret
mov rbx, qword [rdx + 8]
mov qword [rdx + 8], 0
mov ecx, 0x10
call fcn.1400e6130
mov rax, qword [0x1404ca180]
mov ecx, eax
test eax, eax
jne 0x1400450a5
mov rcx, rsi
call fcn.1401001a0
mov ecx, eax
mov rdx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x140045260
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
test rcx, rcx
je 0x1400452d8
mov rax, qword [0x1404ca180]
lea rbp, [0x1404ca180]
mov ecx, eax
test eax, eax
jne 0x14004528e
mov rcx, rbp
call fcn.1401001a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0x10
mov rdi, rax
call fcn.1400e69e0
mov qword [rax], rsi
mov rbx, rax
mov qword [rax + 8], rdi
mov rax, qword [0x1404ca180]
mov ecx, eax
test eax, eax
jne 0x1400452c2
mov rcx, rbp
call fcn.1401001a0
mov ecx, eax
mov rdx, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rax, str.cancellable___NULL
lea r9, str.g_cancellable_push_current
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x14036fdeb]
lea rcx, [0x14036fefe]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400456a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x98]
mov rbx, rdx
call fcn.1400c84f0
mov rdi, rax
test rax, rax
je 0x140045700
mov rcx, rax
call fcn.1400e4080
cmp byte [rax + 0xf], 0
js 0x140045710
xor r9d, r9d
mov r8, rbx
mov rcx, rsi
mov edx, 1
call fcn.140045310
mov rcx, qword [rsi + 0x98]
mov rdx, rbx
call fcn.1400c9800
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400e8320
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.140045310
jmp 0x1400456cf
Function at 0x140054c40
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
xor r8d, r8d
mov rsi, rdx
mov edx, 0xffffffff
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
call fcn.1402b3210
xor r8d, r8d
mov r9d, 1
mov rcx, 0xffffffff80000000
mov rbx, rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140054d40
lea r12, [rsp + 0x44]
lea r13, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r13
mov rcx, qword [rsp + 0x48]
mov r9, r12
mov qword [rsp + 0x20], 0
mov rbp, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call rbp
test eax, eax
jne 0x140054d40
mov eax, dword [rsp + 0x44]
sub eax, 1
cmp eax, 1
ja 0x140054d40
mov eax, dword [rsp + 0x40]
mov edx, 2
add eax, 1
shr eax, 1
lea ecx, [rax + 1]
call fcn.1400d52e0
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r13
mov rdi, rax
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x48]
mov r9, r12
call rbp
mov eax, dword [rsp + 0x40]
xor edx, edx
shr eax, 1
cmp dword [rsp + 0x44], 2
mov word [rdi + rax*2], dx
je 0x140054d70
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rdi
call fcn.1402b36b0
mov rsi, rax
mov rcx, rdi
call fcn.14034efb0
jmp 0x140054d42
xor esi, esi
mov rcx, rbx
call fcn.14034efb0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140054d5a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [rsp + 0x3e]
mov r8d, 1
mov rcx, rdi
xor esi, esi
mov r13, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call r13
mov ebp, eax
test eax, eax
je 0x140054d36
mov ecx, eax
mov edx, 2
call fcn.1400d52e0
mov r8d, ebp
mov rcx, rdi
mov r12, rax
mov rdx, rax
call r13
cmp eax, ebp
je 0x140054dbc
mov rcx, r12
call fcn.14034efb0
jmp 0x140054d36
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r12
call fcn.1402b36b0
mov rsi, rax
jmp 0x140054daf
Function at 0x14005d7d0
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rcx
mov rdi, rdx
call fcn.14002b8d0
mov rsi, rax
test rdi, rdi
je 0x14005d8d8
mov rbp, qword [0x14048d1d0]
mov rcx, rbp
call fcn.140341618
mov rax, qword [rsi + 0x18]
mov rcx, qword [rax + 0x18]
call fcn.14034efb0
mov r12, qword [rsi + 0x18]
mov rcx, rdi
call fcn.1400e4a90
mov rcx, rbp
mov qword [r12 + 0x18], rax
call fcn.140341260
mov rax, qword [rsi + 0x18]
test byte [rax + 4], 1
jne 0x14005d8ed
mov rcx, rbx
call fcn.14002bd80
lea rcx, [0x140375c2d]
mov r12, rax
call fcn.1400f75a0
lea rcx, [0x14037596b]
mov rbp, rax
mov rax, qword [rsi + 0x18]
mov rdx, qword [rax + 0x28]
call fcn.1400f4a80
lea r9, [0x140375a68]
mov rdx, rax
mov rax, qword [rsi + 0x18]
mov r8, qword [rax + 0x20]
mov rcx, qword [rax + 8]
lea rax, [0x14005cd10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x58], rax
lea rax, [0x140375c35]
mov rdx, rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0xffffffff
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x20], rax
call fcn.140090020
nop
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rax + 0x18]
test byte [rax + 4], 1
jne 0x14005d8ed
cmp qword [rax + 0x10], 0
je 0x14005d834
mov rcx, rbx
xor r8d, r8d
xor edx, edx
call fcn.140032520
mov rcx, rbx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400a9ff0
Function at 0x14005d9c0
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov edi, edx
mov rdx, r8
mov r8, r9
mov r9, qword [rsp + 0xc0]
mov rsi, rcx
call fcn.140029f90
lea rdx, [fcn.14005d9c0]
mov rbx, rax
mov rcx, rax
call fcn.14002a300
mov rcx, rbx
call fcn.140030520
test rax, rax
je 0x14005db10
lea rdx, str._gio__D_Bus_proxy_init
mov rcx, rbx
call fcn.14002a380
mov edx, edi
mov rcx, rbx
call fcn.14002a160
mov rax, qword [rsi + 0x18]
xor edx, edx
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14005da54
call fcn.140081f10
test eax, eax
mov rax, qword [rsi + 0x18]
jne 0x14005da50
mov rcx, rbx
test byte [rax + 4], 0x14
je 0x14005da68
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.14005cdd0
mov rdx, qword [rax + 0x10]
mov rcx, rbx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.14005d7d0
call fcn.14002b8d0
mov rcx, rbx
mov rsi, rax
call fcn.14002bd80
lea rcx, [0x140375c80]
mov rbp, rax
call fcn.1400f75a0
xor r8d, r8d
lea rcx, str._su_
mov rdi, rax
mov rax, qword [rsi + 0x18]
mov rdx, qword [rax + 0x10]
call fcn.1400f4a80
mov rdx, qword [rsi + 0x18]
lea rsi, [0x140063770]
lea r9, [0x14037596f]
lea r8, [0x140375984]
mov rcx, qword [rdx + 8]
mov qword [rsp + 0x28], rax
lea rax, str.StartServiceByName
mov rdx, r9
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0xffffffff
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rax
call fcn.140090020
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.async_initable_init_second_async
mov rcx, rbx
call fcn.14002a380
jmp 0x14005da03

Function at 0x14005e9e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [rcx]
movzx edx, word [rbx + 0xa]
lea eax, [rdx + rdx]
mov rsi, rcx
and dx, 0x803f
and eax, 0xffffff80
add eax, 0xffffff80
sar ax, 7
mov ecx, eax
and cx, 0x1ff
shl ecx, 6
or edx, ecx
mov word [rbx + 0xa], dx
test ax, ax
jns 0x14005ea43
lea rax, str.item__ref_count___0
lea r9, str._unref_node
mov r8d, 0x1dd
mov qword [rsp + 0x20], rax
lea rdx, str..._gio_gregistrysettingsbackend.c
lea rcx, [0x14037593a]
call fcn.1400d7d20
test word [rbx + 0xa], 0x7fc0
je 0x14005ea58
add rsp, 0x38
pop rbx
pop rsi
ret
mov rcx, qword [rbx]
call fcn.14034efb0
mov eax, dword [rbx + 0x10]
cmp eax, 1
je 0x14005ea90
cmp eax, 0xb
je 0x14005ea90
mov rdx, rbx
mov ecx, 0x20
call fcn.1400e6130
mov rcx, rsi
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400d6490
mov rcx, qword [rbx + 0x18]
call fcn.14034efb0
jmp 0x14005ea6d
Function at 0x14005eaa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
test rcx, rcx
je 0x14005eae8
mov rbx, qword [rcx + 0x20]
test rbx, rbx
je 0x14005ead3
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx + 8]
xor edx, edx
call fcn.14005eaa0
test rbx, rbx
jne 0x14005eac0
mov rcx, rsi
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.14005e9e0
lea rax, [0x140375faf]
lea r9, str.g_node_children_foreach
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x140375920]
lea rcx, [0x140375a4a]
call fcn.1400d2190
mov rcx, rsi
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.14005e9e0

Function at 0x14005ec80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [rcx + 0x20]
mov rbp, qword [rcx]
mov rsi, rcx
mov rdi, rdx
test rbx, rbx
je 0x14005ecb4
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx + 8]
mov rdx, rdi
call fcn.14005ec80
test rbx, rbx
jne 0x14005eca0
mov eax, dword [rbp + 8]
shl eax, 0xa
sar eax, 0x12
test ax, ax
jle 0x14005ed0c
mov rax, qword [rdi + 0x30]
mov ecx, dword [rax + 8]
cmp ecx, 1
jbe 0x14005ed50
mov rax, qword [rax]
mov edx, 1
add rax, 8
jmp 0x14005ecef
add edx, 1
add rax, 8
cmp ecx, edx
je 0x14005edd0
cmp qword [rax], rsi
jne 0x14005ece0
cmp edx, ecx
jae 0x14005edd0
mov r8, rsi
mov rcx, rdi
call fcn.14005eb30
lock add dword [rdi + 0x10], 1
mov rbx, qword [rsi]
mov rcx, qword [rbx]
call fcn.14034efb0
mov eax, dword [rbx + 0x10]
cmp eax, 1
je 0x14005edb8
cmp eax, 0xb
je 0x14005edb8
mov rdx, rbx
mov ecx, 0x20
call fcn.1400e6130
mov rcx, rsi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400d6490
lea rax, str.self__cache_nodes__len___1
lea rbx, [0x14037593a]
mov r8d, 0x4f4
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea r9, str.registry_cache_destroy_tree
lea rdx, str..._gio_gregistrysettingsbackend.c
call fcn.1400d7d20
mov rax, qword [rdi + 0x30]
mov ecx, dword [rax + 8]
cmp ecx, 1
ja 0x14005ecd2
nop
sub ecx, 1
mov r9, qword [rbp]
mov edx, 0x10
lea r8, str.watch_thread:_a_watch_point_was_deleted__but_unable_to_find__s_in_the_list_of__i_watch_nodes_n
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.1400d2190
jmp 0x14005ed0c
mov rcx, qword [rbx + 0x18]
call fcn.14034efb0
jmp 0x14005ed2c
lea rbx, [0x14037593a]
jmp 0x14005ed90
Function at 0x14005ede0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, qword [rcx + 0x40]
mov rsi, rcx
test rbx, rbx
je 0x14005eea0
mov rcx, qword [rbx + 0x68]
mov dword [rbx + 0x38], 3
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14005ee78
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rdx, qword [rbx + 0x60]
mov ecx, 0x28
call fcn.1400e6130
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x68]
call rdi
mov rcx, qword [rbx + 0x70]
call rdi
mov rcx, qword [rbx + 8]
call rdi
mov rdx, rbx
mov ecx, 0x78
call fcn.1400e6130
mov qword [rsi + 0x40], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea r8, str.gregistrybackend:_unable_to_stop_watch_thread.
mov edx, 0x10
lea rcx, [0x14037593a]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.1400d2190
lea rax, str.watch___NULL
lea r9, str.watch_stop_unlocked
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x140375920]
lea rcx, [0x14037593a]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x140060b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov esi, edx
call fcn.1400d40c0
mov rcx, rax
test rax, rax
je 0x140060cd8
call fcn.1400d4050
mov rdi, rax
cmp qword [rbx + 0x40], rax
je 0x140060c78
mov edx, 0x20
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbp, rax
test rax, rax
je 0x140060ce5
lock add dword [rbx], 1
mov rcx, qword [rbx + 0x48]
mov qword [rax], rbx
test rcx, rcx
je 0x140060bc3
call fcn.1400a9ca0
mov rcx, rax
mov qword [rbp + 8], rcx
mov rcx, qword [rbx + 0x18]
call fcn.1400e4a90
mov dword [rbp + 0x18], esi
mov edx, 0x68
mov rcx, qword [0x14048d670]
mov qword [rbp + 0x10], rax
call fcn.1400d4150
mov edx, 0xc8
mov dword [rax + 0x60], 0
mov rsi, rax
mov rcx, rax
call fcn.1400d45b0
mov r8d, 1
lea rdx, [0x140375c9c]
mov rcx, rsi
call fcn.1400d4940
mov edx, 0xffffff9c
mov rcx, rsi
call fcn.1400d45b0
lea r9, [0x14005dd00]
mov r8, rbp
mov rcx, rsi
lea rdx, [0x140061110]
call fcn.1400d43b0
mov r8d, 1
lea rdx, str._gio__gdbusnamewatching.c__call_in_idle_cb
mov rcx, rsi
call fcn.1400d4940
mov rdx, qword [rbx + 0x40]
mov rcx, rsi
call fcn.1402c7d00
mov rcx, rsi
call fcn.1400d9040
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400d8970
mov eax, dword [rbx + 0x5c]
test eax, eax
jne 0x140060c63
mov r8, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x48]
cmp esi, 1
jne 0x140060cb0
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x140060c63
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x30]
call rax
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400d8970
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x140060c63
mov rdx, qword [rbx + 8]
mov r9, qword [rbx + 0x30]
call rax
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400d8970
call fcn.1400d5df0
mov rcx, rax
jmp 0x140060b7e
mov qword [rsp + 0x20], 0x20
lea r9, [0x140375a13]
lea r8, [0x140375a28]
mov edx, 4
lea rcx, [0x140375a4a]
call fcn.1400d2190
jmp 0x140060d0d
Function at 0x140062a70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [0x140375c2d]
mov rbx, rcx
mov rcx, rbp
mov r12, rdx
call fcn.1400f75a0
mov rdi, rax
test r12, r12
je 0x140062c48
mov rsi, qword [r12]
xor edx, edx
mov rcx, rsi
call fcn.1400f87f0
cmp byte [rsi + 9], 0
jne 0x140062c00
lea rax, [0x140377760]
sub rsi, rax
lea rax, str.b_d__ghi____no_q_stuv_xy
sar rsi, 4
movsxd rsi, esi
lea rcx, [rax + rsi*2]
mov rdx, rdi
call fcn.1400f71c0
test eax, eax
je 0x140062c14
mov r13, qword [0x14048d1d0]
lea rdi, [rsp + 0x40]
lea rsi, [0x1403767b4]
mov rcx, r13
call fcn.140341618
mov rdx, rbp
lea r8, [rsp + 0x38]
mov rcx, r12
call fcn.1400eea90
lea rbp, [rsp + 0x48]
jmp 0x140062b2a
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1400623f0
mov rcx, qword [rsp + 0x38]
mov r9, rbp
mov r8, rdi
mov rdx, rsi
call fcn.1402a1e00
test eax, eax
jne 0x140062b18
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x140062b5a
mov eax, 0xd55af426
cmp qword [rsi + 0x38], rax
je 0x140062cc8
lea rax, str.is_valid_heap_iter__iter_
lea r9, str.g_variant_iter_free
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x140375920]
lea rcx, [0x140375a4a]
call fcn.1400d2190
mov rax, qword [rbx + 0x18]
mov rax, qword [rax + 0x40]
test rax, rax
je 0x140062c80
mov esi, dword [rax + 0x10]
mov rcx, r13
call fcn.140341260
test esi, esi
je 0x140062bed
lea r8, [rsp + 0x50]
lea rdx, str.__asv_
mov rcx, r12
mov qword [rsp + 0x58], 0
call fcn.1400eea90
lea rax, [rsp + 0x58]
mov rcx, rbx
xor r8d, r8d
mov r9, qword [rsp + 0x50]
mov edx, dword [0x1404ca690]
mov qword [rsp + 0x20], rax
call fcn.1400b6730
mov rcx, qword [rsp + 0x50]
call fcn.1400f8d60
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, qword [rsi + 0x10]
mov rdx, rdi
call fcn.1400f71c0
test eax, eax
jne 0x140062ae1
mov rcx, r12
call fcn.1400ee7d0
lea r8, str.Value_for_GetAll_reply_with_type__s_does_not_match__asv_
mov edx, 0x10
lea rcx, [0x14037593a]
mov r9, rax
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400d2190
lea rax, [0x14037682e]
lea rcx, [0x140375a4a]
mov edx, 8
mov qword [rsp + 0x20], rax
lea r9, str.g_variant_get_type
lea r8, [0x140375920]
call fcn.1400d2190
xor ecx, ecx
jmp 0x140062ad1
lea rax, [0x140376899]
mov r9, qword [str.g_hash_table_size]
lea r8, [0x140375920]
mov edx, 8
mov qword [rsp + 0x20], rax
lea rcx, [0x140375a4a]
call fcn.1400d2190
mov rcx, r13
call fcn.140341260
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp qword [rsi + 0x48], 0x56716037
jne 0x140062b5a
mov rcx, qword [rsi + 0x40]
call fcn.1400f8d60
mov qword [rsi + 0x48], 0
mov rdx, rsi
mov ecx, 0x50
call fcn.1400e6130
jmp 0x140062b85
Function at 0x140065f50
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x140065faa
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140065faa
cmp eax, 0xffffffff
je 0x140065faa
cmp eax, 0x80
je 0x140065f98
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140067380
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push rsi
push rbx
sub rsp, 0x2f8
mov edx, 0x104
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
sub eax, 1
cmp eax, 0x102
ja 0x14006754d
cdqe
movzx eax, word [rsp + rax*2 + 0x20]
cmp ax, 0x5c
je 0x1400673c1
cmp ax, 0x2f
jne 0x140067568
mov rcx, rbx
lea rdx, [0x1403783f4]
call sub.msvcrt.dll_wcscat
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x14006754d
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WinHttpCloseHandle
mov rcx, rax
call rsi
lea rdx, str.WinHttpCrackUrl
mov rcx, rbx
mov qword [0x1404ca780], rax
call rsi
lea rdx, str.WinHttpConnect
mov rcx, rbx
mov qword [0x1404ca788], rax
call rsi
lea rdx, str.WinHttpCreateUrl
mov rcx, rbx
mov qword [0x1404ca790], rax
call rsi
lea rdx, str.WinHttpOpen
mov rcx, rbx
mov qword [0x1404ca798], rax
call rsi
lea rdx, str.WinHttpOpenRequest
mov rcx, rbx
mov qword [0x1404ca7a0], rax
call rsi
lea rdx, str.WinHttpQueryDataAvailable
mov rcx, rbx
mov qword [0x1404ca7a8], rax
call rsi
lea rdx, str.WinHttpQueryHeaders
mov rcx, rbx
mov qword [0x1404ca7b0], rax
call rsi
lea rdx, str.WinHttpReadData
mov rcx, rbx
mov qword [0x1404ca7b8], rax
call rsi
lea rdx, str.WinHttpReceiveResponse
mov rcx, rbx
mov qword [0x1404ca7c0], rax
call rsi
lea rdx, str.WinHttpSendRequest
mov rcx, rbx
mov qword [0x1404ca7c8], rax
call rsi
lea rdx, str.WinHttpWriteData
mov rcx, rbx
mov qword [0x1404ca7d0], rax
call rsi
cmp qword [0x1404ca780], 0
mov qword [0x1404ca7d8], rax
je 0x14006754d
cmp qword [0x1404ca788], 0
je 0x14006754d
cmp qword [0x1404ca790], 0
je 0x14006754d
cmp qword [0x1404ca798], 0
je 0x14006754d
cmp qword [0x1404ca7a0], 0
je 0x14006754d
cmp qword [0x1404ca7a8], 0
je 0x14006754d
cmp qword [0x1404ca7b0], 0
je 0x14006754d
cmp qword [0x1404ca7b8], 0
je 0x14006754d
cmp qword [0x1404ca7c0], 0
je 0x14006754d
cmp qword [0x1404ca7c8], 0
je 0x14006754d
cmp qword [0x1404ca7d0], 0
je 0x14006754d
test rax, rax
je 0x14006754d
mov dword [0x1404ca7e0], 1
mov dword [0x1404ca7e4], 1
add rsp, 0x2f8
pop rbx
pop rsi
ret
lea rdx, [0x1403783f0]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
jmp 0x1400673c1
Function at 0x140071e70
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
mov rax, qword [0x1404ca8a0]
test rax, rax
je 0x140071e90
add rsp, 0x1c0
pop rbx
ret
lea rbx, [0x1404ca8a0]
mov rcx, rbx
call fcn.1400e7370
test eax, eax
je 0x140071e84
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140071ed8
lea r8, str.Windows_Sockets_could_not_be_initialized
mov edx, 4
lea rcx, [0x14037a4a6]
call fcn.1400d2190
jmp 0x140071ecf
mov edx, 1
mov rcx, rbx
call fcn.1400e6720
jmp 0x140071e84

Function at 0x140073a50
Capabilities:
Convert ip address from string

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
je 0x140073b20
call fcn.140071e70
lea rdi, [rsp + 0x3c]
mov rdx, rbx
mov rsi, qword [sym.imp.WS2_32.dll_inet_pton]
mov r8, rdi
mov ecx, 2
call rsi
test eax, eax
jg 0x140073ae0
lea rdi, [rsp + 0x40]
mov rdx, rbx
mov ecx, 0x17
mov r8, rdi
call rsi
test eax, eax
jg 0x140073aa8
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call fcn.140071f90
mov qword [rsp + 0x20], rdi
lea r9, [0x14037a0db]
mov r8d, 0x17
mov qword [rsp + 0x28], 0
mov rcx, rax
lea rdx, [0x14037a0b9]
call fcn.1400ad9f0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call fcn.140071f90
mov qword [rsp + 0x20], rdi
lea r9, [0x14037a0db]
mov r8d, 2
mov qword [rsp + 0x28], 0
mov rcx, rax
lea rdx, [0x14037a0b9]
call fcn.1400ad9f0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
lea rax, [0x14037ad6c]
lea r9, str.g_inet_address_new_from_string
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x14037a411]
lea rcx, [0x14037a4a6]
call fcn.1400d2190
jmp 0x140073a9b
Function at 0x140077d90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [rcx + 0x18]
mov rsi, rcx
test byte [rax + 0x28], 8
je 0x140077e18
mov edx, dword [rax + 0x40]
xor ebx, ebx
test dl, 9
setne bl
and edx, 0x20
je 0x140077def
movsxd rcx, dword [rax + 0xc]
lea rdx, [rsp + 0x2c]
mov r9d, 2
mov r8d, 4
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
js 0x140077ea8
je 0x140077ee0
mov ebx, 1
mov rax, qword [rsi + 0x18]
test byte [rax + 0x28], 8
je 0x140077ea0
mov edx, dword [rax + 0x40]
or ebx, 0x10
and edx, 0x10
je 0x140077e09
mov edx, ebx
or ebx, 4
or edx, 0x18
test byte [rax + 0x44], 0x10
cmovne ebx, edx
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
ret
mov rdx, qword [rax + 0x30]
movsxd rcx, dword [rax + 0xc]
lea r8, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
test eax, eax
mov rax, qword [rsi + 0x18]
je 0x140077e70
mov edx, dword [rax + 0x40]
xor ebx, ebx
test dl, 9
setne bl
test dl, 0x20
jne 0x140077db3
test byte [rax + 0x28], 8
jne 0x140077def
test dl, 2
je 0x140077df5
mov edx, ebx
or ebx, 4
or edx, 8
test byte [rax + 0x44], 2
cmovne ebx, edx
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
ret
mov edx, dword [rsp + 0x30]
or dword [rax + 0x40], edx
test dl, 2
je 0x140077e84
mov ecx, dword [rsp + 0x38]
test ecx, ecx
jne 0x140077f00
and edx, 0x10
mov rax, qword [rsi + 0x18]
je 0x140077e33
mov edx, dword [rsp + 0x44]
test edx, edx
je 0x140077e33
or dword [rax + 0x44], 0x10
mov rax, qword [rsi + 0x18]
jmp 0x140077e33
mov edx, dword [rax + 0x40]
jmp 0x140077e4d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2749
je 0x140077ddc
lea edx, [rax - 0x2746]
and edx, 0xfffffffb
je 0x140077ee0
sub eax, 0x2744
cmp eax, 1
jbe 0x140077ee0
or ebx, 8
jmp 0x140077de1
mov rax, qword [rsi + 0x18]
or ebx, 0x10
test byte [rax + 0x28], 8
jne 0x140077def
mov edx, dword [rax + 0x40]
jmp 0x140077df5
mov rax, qword [rsi + 0x18]
or dword [rax + 0x44], 2
jmp 0x140077e84