joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dbe90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [rsp + 0x80]
mov rbx, rcx
mov dword [rsi + 0x414], r8d
mov edi, edx
mov rbp, r9
test r9, r9
je 0x1400dbefb
mov rax, qword [0x14048c2c0]
mov r9d, dword [rax]
test r9d, r9d
jne 0x1400dc038
mov eax, dword [rsi + 0x410]
cmp eax, 0x3f
jg 0x1400dc008
movsxd rdx, eax
mov qword [rsi + 0x408], rbp
add eax, 1
mov qword [rsi + rdx*8 + 0x200], rbp
mov rcx, qword [rbp]
mov dword [rsi + 0x410], eax
mov qword [rsi + rdx*8], rcx
shl rdi, 4
mov r12, qword [0x14048c2c0]
lea rbp, [0x14039e619]
add rdi, rbx
cmp rbx, rdi
jb 0x1400dbf34
jmp 0x1400dbf92
test rdx, rdx
jg 0x1400dbfa0
xor eax, eax
add rbx, 0x10
mov word [rbx - 6], ax
cmp rbx, rdi
jae 0x1400dbf92
mov eax, dword [rsi + 0x410]
cmp eax, 0x40
je 0x1400dbfe0
mov rcx, qword [rsi + 0x400]
cmp eax, 0x3f
jne 0x1400dbf58
test rcx, rcx
jne 0x1400dbfe0
mov rdx, qword [rbx]
cmp rdx, 0x130e396
jne 0x1400dbf20
test byte [rbx + 8], 1
je 0x1400dbfa0
mov r8d, dword [r12]
test r8d, r8d
je 0x1400dbf7c
test rcx, rcx
je 0x1400dc060
xor eax, eax
mov qword [rsi + 0x400], rbx
add rbx, 0x10
mov word [rbx - 6], ax
cmp rbx, rdi
jb 0x1400dbf34
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, dword [r12]
test ecx, ecx
jne 0x1400dbfd0
movsxd rdx, eax
add eax, 1
mov qword [rsi + rdx*8 + 0x200], rbx
mov rcx, qword [rbx]
mov dword [rsi + 0x410], eax
mov qword [rsi + rdx*8], rcx
jmp 0x1400dbf25
mov rcx, rbp
call fcn.1400d5d10
mov eax, dword [rsi + 0x410]
jmp 0x1400dbfa8
lea r8, str.Too_many_handles_to_wait_for_
mov edx, 0x10
lea rcx, [0x14039e15a]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400d2190
lea rax, str.data__nhandles___MAXIMUM_WAIT_OBJECTS
lea r9, str.fill_poll_thread_data
mov r8d, 0x139
mov qword [rsp + 0x20], rax
lea rdx, str..._glib_gpoll.c
lea rcx, [0x14039e15a]
call fcn.1400e7f70
nop dword [rax]
mov rdx, qword [rbp]
lea rcx, str._Stop_FD:__p
call fcn.1400d5d10
mov eax, dword [rsi + 0x410]
cmp eax, 0x3f
jg 0x1400dc008
jmp 0x1400dbed8
lea rcx, [0x14039e614]
call fcn.1400d5d10
jmp 0x1400dbf7c
Function at 0x1400df2b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.1402a1c60
test rbx, rbx
je 0x1400df2f0
mov rdx, qword [rbx]
mov r8d, 8
mov ecx, 0x18
call fcn.1400e74e0
mov rdx, rbx
mov ecx, 0x18
add rsp, 0x30
pop rbx
jmp fcn.1400e6130
lea rax, [0x14039e5a2]
lea r9, str.g_queue_free
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x14039e140]
lea rcx, [0x14039e15a]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
ret

Function at 0x1400df480
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x140361ee0]
lea rcx, [rsp + 0x30]
call rbx
lea rcx, [rsp + 0x34]
call rbx
lea rcx, [rsp + 0x38]
call rbx
lea rcx, [rsp + 0x3c]
call rbx
mov edx, 0x9c4
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x1400df607
call fcn.1400df3c0
cmp eax, 0x14
je 0x1400df5d7
cmp eax, 0x16
jne 0x1400df631
mov dword [rbx], 0x12bd6aa
mov edx, 1
mov ecx, 0x12bd6aa
nop word [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
lea ecx, [rax + rdx]
mov dword [rbx + rdx*4], ecx
add rdx, 1
cmp rdx, 0x270
jne 0x1400df4f0
mov r8d, dword [rbx]
mov r9d, 0x270
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x9c0], 0x270
xor r11d, r11d
nop dword [rax]
mov eax, r8d
mov r10d, edx
add edx, 1
shr eax, 0x1e
xor eax, r8d
mov r8d, ecx
imul eax, eax, 0x19660d
xor eax, dword [rbx + r10*4]
add eax, dword [rsp + r8*4 + 0x30]
lea r8d, [rax + rcx]
add ecx, 1
mov dword [rbx + r10*4], r8d
cmp edx, 0x270
jne 0x1400df573
mov r8d, dword [rbx + 0x9bc]
mov edx, 1
mov dword [rbx], r8d
cmp ecx, 4
cmove ecx, r11d
sub r9d, 1
jne 0x1400df530
mov ecx, 0x26f
nop dword [rax]
lea eax, [rdx - 1]
mov r8d, edx
mov r9d, dword [rbx + rax*4]
mov eax, r9d
shr eax, 0x1e
xor eax, r9d
imul eax, eax, 0x5d588b65
xor eax, dword [rbx + r8*4]
sub eax, edx
add edx, 1
mov dword [rbx + r8*4], eax
cmp edx, 0x270
jne 0x1400df5c3
mov eax, dword [rbx + 0x9bc]
mov edx, 1
mov dword [rbx], eax
sub ecx, 1
jne 0x1400df588
mov rax, rbx
mov dword [rbx], 0x80000000
add rsp, 0x40
pop rbx
ret
mov dword [rbx], 0x12bd6aa
lea rax, [rbx + 4]
mov edx, 0x12bd6aa
lea rcx, [rbx + 0x9c0]
nop dword [rax]
imul edx, edx, 0x10dcd
add rax, 4
mov dword [rax - 4], edx
cmp rax, rcx
jne 0x1400df5f0
jmp 0x1400df510
mov qword [rsp + 0x20], 0x9c4
lea r9, [0x14039e569]
lea r8, [0x14039e580]
mov edx, 4
lea rcx, [0x14039e15a]
call fcn.1400d2190
jmp 0x1400df62f
xor eax, eax
lea r9, str.g_rand_set_seed
mov r8d, 0x172
mov qword [rsp + 0x20], rax
lea rdx, str..._glib_grand.c
lea rcx, [0x14039e15a]
call fcn.1400e7f70
nop
nop dword [rax]
Function at 0x1400e36e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [fcn.14034e890]
mov qword [rsp + 0x68], rdx
mov rdi, rcx
mov ecx, 2
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
call rsi
mov r8d, 0x15
mov edx, 1
lea rcx, str._nMEMORY_ERROR:
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbp, qword [0x14048d130]
mov rcx, rbp
call fcn.140341618
mov rax, qword [0x14048d850]
mov rcx, rbp
mov rbx, qword [rax]
call fcn.140341260
call sub.msvcrt.dll__getpid
test rbx, rbx
mov ecx, 2
mov ebp, eax
lea rax, [0x1403a1d4f]
cmove rbx, rax
call rsi
mov r9d, ebp
lea rdx, str._s__ld_:_GSlice:
mov r8, rbx
mov rcx, rax
lea rbx, [rsp + 0x68]
call fcn.1400f76b0
mov qword [rsp + 0x20], rbx
mov ecx, 2
call rsi
mov r9, rbx
lea rdx, [rsp + 0x28]
mov r8, rdi
xor ecx, ecx
mov rbp, rax
call fcn.1402b7d40
mov rbx, rax
test rax, rax
je 0x1400e37bf
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov r9, rbp
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call fcn.14034efb0
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.msvcrt.dll_fputc
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1400e4440
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
mov rsi, rcx
mov rbp, rdx
mov edi, r8d
test rcx, rcx
je 0x1400e46d9
call sub.msvcrt.dll_strlen
mov rbx, rax
jmp 0x1400e448a
movzx ecx, byte [rsi + rbx - 1]
lea r9, [rbx - 1]
cmp cl, 0x5c
je 0x1400e4487
cmp cl, 0x2f
jne 0x1400e4650
mov rbx, r9
test rbx, rbx
jne 0x1400e4470
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rcx, rsi
call fcn.1402b3210
mov r12, rax
test rax, rax
je 0x1400e46d9
mov qword [rsp + 0x58], 0
mov rcx, rax
mov dword [rsp + 0x54], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e46bc
mov ecx, eax
and ecx, 0x10
and eax, 0x400
mov dword [rsp + 0x4c], eax
je 0x1400e4640
mov eax, 0x200080
test dil, 1
je 0x1400e4640
mov edx, eax
mov dword [rsp + 0x20], 3
mov r8d, 7
mov qword [rsp + 0x30], 0
or edx, 0x2000000
test ecx, ecx
mov rcx, r12
cmovne eax, edx
xor r9d, r9d
mov edx, 0x88
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400e46bc
lea r13, [rsp + 0x80]
mov rcx, rax
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov r14, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
call r14
mov edx, eax
test r15d, r15d
je 0x1400e4698
lea r15, [rsp + 0x60]
mov edx, 1
mov r9d, 0x18
mov rcx, rbx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
mov esi, eax
call r14
mov edx, eax
test esi, esi
je 0x1400e4698
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x1400e45c0
test edi, edi
je 0x1400e4630
mov rdx, rbx
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x20], 1
lea r8, [rsp + 0x54]
call fcn.1402ab970
test eax, eax
js 0x1400e4685
mov rcx, rbx
lea rbx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
mov r9, rbx
mov r8, r13
mov rcx, r12
mov rdx, rsi
call fcn.1402c69c0
mov rcx, rsi
call fcn.14034efb0
mov qword [rsp + 0x20], rbp
mov rcx, rbx
mov r8, r15
mov r9d, dword [rsp + 0x54]
mov rdx, r13
xor ebx, ebx
call fcn.1400e27a0
mov rcx, r12
call fcn.14034efb0
mov eax, ebx
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
xor edx, edx
lea r9, [rsp + 0x58]
jmp 0x1400e45a6
mov eax, pe_nt_image_headers64
jmp 0x1400e44f1
mov rcx, rsi
call fcn.1400c7610
test eax, eax
jne 0x1400e4668
mov rax, rbx
jmp 0x1400e448f
mov rcx, rsi
call fcn.1400c76a0
sub rax, rsi
cmp rax, rbx
jb 0x1400e465c
mov rcx, rsi
call sub.msvcrt.dll_strlen
jmp 0x1400e448f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0xffffffff
jmp 0x1400e4609
mov dword [rsp + 0x4c], edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rsp + 0x4c]
mov r8, rax
call fcn.1400e4260
mov dword [r8], eax
jmp 0x1400e468e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, ebx
mov r8, rax
call fcn.1400e4260
mov dword [r8], eax
jmp 0x1400e468e
call qword [sym.imp.msvcrt.dll__errno]
mov ebx, 0xffffffff
mov dword [rax], 0x16
jmp 0x1400e4611
Function at 0x1400e4860
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
mov rsi, rdx
mov edx, 0xffffffff
call fcn.1402b3210
mov rbx, rax
test rax, rax
je 0x1400e48fe
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
call fcn.1402b3210
mov rsi, rax
test rax, rax
je 0x1400e48f6
mov r8d, 1
mov rdx, rax
mov rcx, rbx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor ebp, ebp
test eax, eax
je 0x1400e48e0
mov rcx, rbx
call fcn.14034efb0
mov rcx, rsi
call fcn.14034efb0
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], edi
mov eax, ebp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, 0xffffffff
mov ecx, eax
call fcn.1400e4260
mov edi, eax
jmp 0x1400e48b8
mov rcx, rbx
call fcn.14034efb0
call qword [sym.imp.msvcrt.dll__errno]
or ebp, 0xffffffff
mov dword [rax], 0x16
jmp 0x1400e48d0
Function at 0x1400e64e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x1400e6538
mov rcx, qword [rcx + 0x10]
call fcn.1400e64e0
mov rcx, qword [rbx + 0x18]
mov rdx, rsi
call fcn.1400e64e0
test rsi, rsi
je 0x1400e651f
mov rax, qword [rsi + 8]
test rax, rax
je 0x1400e651f
cmp qword [rsi], rbx
je 0x1400e651f
mov rcx, qword [rbx + 0x20]
call rax
mov rdx, rbx
mov ecx, 0x28
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400e6130
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x1400e6540
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, 0x10
jmp fcn.1400e6130

Function at 0x1400e6820
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
lock sub dword [rcx + 0x18], 1
jne 0x1400e68a0
mov eax, dword [rcx + 0x1c]
test eax, eax
je 0x1400e68b0
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400e68c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400f7740
lea rdx, str.CloseHandle__wt__handle_
mov dword [rsp + 0x20], 0x1a4
lea r9, str..._glib_gthread_win32.c
mov qword [rsp + 0x30], rax
lea rax, str.g_system_thread_free
lea r8, str.file__s:_line__d___s_:_error__s_during__s
mov qword [rsp + 0x38], rdx
lea rcx, [0x1403a1bda]
mov edx, 4
mov qword [rsp + 0x28], rax
call fcn.1400d2190
jmp 0x1400e6895
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov ecx, 0x30
add rsp, 0x40
pop rbx
jmp fcn.1400e6130
mov rdx, rbx
mov ecx, 0x40
add rsp, 0x40
pop rbx
jmp fcn.1400e6130
Function at 0x1400e7450
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14048dbb0]
mov rax, qword [rsi]
mov ecx, eax
test eax, eax
jne 0x1400e7470
mov rcx, rsi
call fcn.1401001a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400e7490
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, 0x30
call fcn.1400e69e0
pxor xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov rbx, rax
mov dword [rax + 0x18], 1
movups xmmword [rax], xmm0
movups xmmword [rax + 0x20], xmm0
mov rax, qword [rsi]
mov ecx, eax
test eax, eax
jne 0x1400e74c6
mov rcx, rsi
call fcn.1401001a0
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400e7940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov r8d, 8
mov rdx, rcx
mov ecx, 0x10
jmp fcn.1400e74e0

Function at 0x1400e7960
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
test rcx, rcx
je 0x1400e798b
mov rbx, rcx
nop dword [rax]
mov rax, rbx
mov rbx, qword [rbx + 8]
xor edx, edx
mov rcx, qword [rax]
call rsi
test rbx, rbx
jne 0x1400e7978
mov r8d, 8
mov rdx, rdi
mov ecx, 0x10
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400e74e0

Function at 0x1400e8320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [0x1403a1e6a]
mov rbx, rcx
mov rdx, rcx
test rcx, rcx
je 0x1400e839f
nop dword [rax + rax]
mov rax, rdx
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x1400e8340
nop dword [rax]
mov rdx, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x1400e8350
mov rsi, qword [rdx + 0x20]
cmp rbx, qword [rsi]
je 0x1400e8398
mov eax, dword [rsi + 0x10]
test eax, eax
jne 0x1400e83d0
mov rcx, rbx
call fcn.1400e8280
nop dword [rax]
mov rcx, rbx
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1400e8378
mov rdx, rsi
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400e64e0
lea rax, [0x1403a243e]
mov qword [rsp + 0x20], rax
lea r9, str.g_sequence_remove
lea r8, [0x1403a1bc0]
mov edx, 8
lea rcx, [0x1403a1bda]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
ret
lea r8, [0x1403a2458]
mov edx, 0x10
lea rcx, [0x1403a1bda]
call fcn.1400d2190
jmp 0x1400e836c
Function at 0x1400e9ea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rsi, [rcx + 0x18]
mov eax, dword [rsi]
test eax, eax
jle 0x1400e9ef0
cmp eax, 1
jne 0x1400e9f20
cmp qword [rbx], 0
je 0x1400e9f54
lea rdi, [0x1404cb0d8]
mov rcx, rdi
call fcn.140341618
mov eax, dword [rsi]
cmp eax, 1
je 0x1400e9f38
mov rcx, rdi
call fcn.140341260
mov eax, dword [rsi]
test eax, eax
jg 0x1400e9eb4
nop word [rax + rax]
lea rax, str.ref_count___0
lea r9, str.g_time_zone_unref
mov r8d, 0xea
mov qword [rsp + 0x20], rax
lea rdx, str..._glib_gtimezone.c
lea rcx, [0x1403a1bda]
call fcn.1400e7f70
nop dword [rax]
lea edx, [rax - 1]
lock cmpxchg dword [rsi], edx
jne 0x1400e9eae
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [0x1404cb0d0]
test rcx, rcx
je 0x1400e9f4c
mov rdx, qword [rbx]
call fcn.1400c9800
mov rcx, rdi
call fcn.140341260
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x1400e9faa
mov eax, dword [rdi + 8]
test eax, eax
je 0x1400e9f8e
xor esi, esi
nop word cs:[rax + rax]
mov eax, esi
add esi, 1
shl rax, 4
add rax, qword [rdi]
mov rcx, qword [rax + 8]
call fcn.14034efb0
mov rdi, qword [rbx + 8]
cmp esi, dword [rdi + 8]
jb 0x1400e9f70
lea rcx, [rdi + 0x18]
call fcn.1400da490
mov rcx, rdi
cmp eax, 1
sbb edx, edx
and edx, 2
add edx, 1
call fcn.1400bde90
mov rsi, qword [rbx + 0x10]
test rsi, rsi
je 0x1400e9fcf
lea rcx, [rsi + 0x18]
call fcn.1400da490
mov rcx, rsi
cmp eax, 1
sbb edx, edx
and edx, 2
add edx, 1
call fcn.1400bde90
mov rcx, qword [rbx]
call fcn.14034efb0
mov rdx, rbx
mov ecx, 0x20
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.1400e6130
Function at 0x1400ed9a0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
xor edx, edx
xor ebx, ebx
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x28]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400ed9d8
mov rcx, qword [rsp + 0x28]
xor r8d, r8d
mov edx, 0xffffffff
call fcn.1402b36b0
mov rbx, rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ed9f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov edx, 0x104
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1400eda60
mov rcx, rbx
xor r8d, r8d
mov edx, 0xffffffff
call fcn.1402b36b0
mov rbx, rax
test rax, rax
je 0x1400eda60
mov rcx, rax
call fcn.1400c76a0
movzx edx, byte [rax - 1]
cmp dl, 0x5c
je 0x1400eda50
cmp dl, 0x2f
je 0x1400eda50
mov byte [rax], 0
mov rax, rbx
add rsp, 0x230
pop rbx
ret
cmp byte [rax - 2], 0x3a
je 0x1400eda3d
sub rax, 1
jmp 0x1400eda3d
lea rcx, [0x1403a2e83]
call fcn.1400e4a90
mov rbx, rax
mov rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x1400eda80
Capabilities:
Get session user name

Disassembly:
push rsi
push rbx
sub rsp, 0x248
mov rax, qword [0x1404cb2b8]
test rax, rax
je 0x1400edab0
mov rax, qword [0x1404cb2b8]
add rsp, 0x248
pop rbx
pop rsi
ret
lea rbx, [0x1404cb2b8]
mov rcx, rbx
call fcn.1400e7370
test eax, eax
je 0x1400eda95
lea rsi, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x101
lea rdx, [rsp + 0x2c]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1400edb10
cmp qword [0x1404cb2a0], 0
je 0x1400edb58
cmp qword [0x1404cb2a8], 0
je 0x1400edb40
lea rdx, [0x1404cb2a0]
mov rcx, rbx
call fcn.1400e6720
jmp 0x1400eda95
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rsi
call fcn.1402b36b0
mov rcx, rax
mov qword [0x1404cb2a0], rax
call fcn.1400e4a90
mov qword [0x1404cb2a8], rax
jmp 0x1400edae2
lea rcx, [0x1403a2e90]
call fcn.1400e4a90
mov qword [0x1404cb2a8], rax
jmp 0x1400edaf6
lea rcx, str.somebody
call fcn.1400e4a90
mov qword [0x1404cb2a0], rax
jmp 0x1400edaec
Function at 0x1400f3ce0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
call fcn.1400f34a0
test eax, eax
jne 0x1400f3d28
lea rax, str.valid_builder
mov qword [rsp + 0x20], rax
lea r9, str.g_variant_builder_close
lea r8, [0x1403a2dc0]
mov edx, 8
lea rcx, [0x1403a2dda]
call fcn.1400d2190
nop
add rsp, 0x38
pop rbx
pop rsi
ret
mov rsi, qword [rbx]
test rsi, rsi
je 0x1400f3da8
mov qword [rbx], 0
mov rcx, rbx
call fcn.1400f3920
mov rcx, rsi
mov rdx, rax
call fcn.1400f37c0
movdqu xmm0, xmmword [rsi]
mov rdx, rsi
mov ecx, pe_nt_image_headers64
movups xmmword [rbx], xmm0
movdqu xmm1, xmmword [rsi + 0x10]
movups xmmword [rbx + 0x10], xmm1
movdqu xmm2, xmmword [rsi + 0x20]
movups xmmword [rbx + 0x20], xmm2
movdqu xmm3, xmmword [rsi + 0x30]
movups xmmword [rbx + 0x30], xmm3
movdqu xmm4, xmmword [rsi + 0x40]
movups xmmword [rbx + 0x40], xmm4
movdqu xmm5, xmmword [rsi + 0x50]
movups xmmword [rbx + 0x50], xmm5
movdqu xmm0, xmmword [rsi + 0x60]
movups xmmword [rbx + 0x60], xmm0
movdqu xmm1, xmmword [rsi + 0x70]
movups xmmword [rbx + 0x70], xmm1
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400e6130
lea rax, str.GVSB_builder___parent___NULL
jmp 0x1400f3cf9

Function at 0x1400f76b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, rdx
mov qword [rsp + 0x60], r8
mov rsi, rcx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x68], r9
mov r8, rax
lea r9, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x20], r9
call fcn.1402b7d40
mov rbx, rax
test rax, rax
je 0x1400f7710
mov r8, qword [rsp + 0x28]
mov r9, rsi
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
mov rsi, rax
call fcn.14034efb0
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
mov eax, 0xffffffff
jmp 0x1400f7709

Function at 0x1400f78e0
Capabilities:
Accept command line arguments

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x3c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r12d, dword [rsp + 0x3c]
mov rdi, rax
lea eax, [r12 + 1]
cdqe
mov rdx, rax
shr rdx, 0x3d
setne bl
je 0x1400f7950
mov qword [rsp + 0x28], 8
lea r9, [0x1403ca47c]
lea r8, [0x1403ca2d0]
mov edx, 4
mov qword [rsp + 0x20], rax
lea rcx, [0x1403ca0fa]
call fcn.1400d2190
jmp 0x1400f7948
shl rax, 3
mov rbp, rax
je 0x1400f79c0
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rsi, rax
test rax, rax
je 0x1400f79cc
test r12d, r12d
jle 0x1400f79c7
nop
mov rcx, qword [rdi + rbx*8]
xor r8d, r8d
mov edx, 0xffffffff
call fcn.1402b36b0
mov qword [rsi + rbx*8], rax
mov rax, rbx
add rbx, 1
cmp dword [rsp + 0x3c], ebx
jg 0x1400f7970
add eax, 1
cdqe
lea rax, [rsi + rax*8]
mov rcx, rdi
mov qword [rax], 0
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor esi, esi
test r12d, r12d
jg 0x1400f7970
mov rax, rsi
jmp 0x1400f799b
mov qword [rsp + 0x20], rbp
lea r9, [0x1403ca0c0]
lea r8, [0x1403ca0d8]
mov edx, 4
lea rcx, [0x1403ca0fa]
call fcn.1400d2190
jmp 0x1400f79f0
Function at 0x1400f8be0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
xor edx, edx
mov rbx, rcx
call fcn.1400f87f0
cmp byte [rbx + 9], 0
jne 0x1400f8c00
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, [0x1404cb500]
call fcn.14010dd10
lea rcx, [rbx + 0x18]
call fcn.1400da490
test eax, eax
je 0x1400f8cc0
mov rcx, qword [0x1404cb4f0]
mov rdx, qword [rbx + 0x10]
call fcn.1400c9800
mov rcx, qword [0x1404cb4f0]
test rcx, rcx
je 0x1400f8cd8
mov edx, dword [rcx + 0x10]
test edx, edx
je 0x1400f8d0a
mov rcx, qword [0x1404cb500]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x10]
call fcn.14034efb0
movzx eax, byte [rbx + 9]
cmp al, 0x61
je 0x1400f8d20
cmp al, 0x72
jne 0x1400f8d33
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400f8ca4
xor esi, esi
nop dword [rax]
mov rax, rsi
add rsi, 1
shl rax, 5
add rax, qword [rbx + 0x20]
mov rcx, qword [rax]
call fcn.1400f8be0
mov rcx, qword [rbx + 0x28]
cmp rsi, rcx
jb 0x1400f8c80
shl rcx, 5
mov rdx, qword [rbx + 0x20]
call fcn.1400e6130
mov rdx, rbx
mov ecx, 0x30
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400e6130
mov rcx, qword [0x1404cb500]
add rsp, 0x38
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rax, [0x1403ca798]
mov r9, qword [str.g_hash_table_size]
lea rcx, [0x1403ca0fa]
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x1403ca25f]
call fcn.1400d2190
mov rcx, qword [0x1404cb4f0]
call fcn.1400c9e50
mov qword [0x1404cb4f0], 0
jmp 0x1400f8c48
mov rcx, qword [rbx + 0x20]
call fcn.1400f8be0
mov rdx, rbx
mov ecx, 0x28
jmp 0x1400f8cb5
xor eax, eax
lea r9, str.g_variant_type_info_unref
mov r8d, 0x373
mov qword [rsp + 0x20], rax
lea rdx, str..._glib_gvarianttypeinfo.c
lea rcx, [0x1403ca0fa]
call fcn.1400e7f70
nop
nop dword [rax + rax]

Function at 0x1400f8d60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1400f8de8
lea rcx, [rcx + 0x34]
call fcn.1400da490
test eax, eax
je 0x1400f8e14
mov eax, dword [rbx + 0x30]
test al, 1
je 0x1400f8da0
lea r8, str.attempting_to_free_a_locked_GVariant_instance.__This_should_never_happen.
mov edx, 8
lea rcx, [0x1403ca0fa]
call fcn.1400d2190
mov eax, dword [rbx + 0x30]
or eax, 1
mov rcx, qword [rbx]
mov dword [rbx + 0x30], eax
call fcn.1400f8be0
test byte [rbx + 0x30], 2
je 0x1400f8e20
mov rcx, qword [rbx + 0x10]
call fcn.1400be1a0
pxor xmm0, xmm0
mov rdx, rbx
mov ecx, 0x40
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
add rsp, 0x30
pop rbx
jmp fcn.1400e6130
lea rax, [0x1403ca279]
lea r9, str.g_variant_unref
mov edx, 8
mov qword [rsp + 0x20], rax
lea r8, [0x1403ca25f]
lea rcx, [0x1403ca0fa]
call fcn.1400d2190
nop
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
call fcn.1400eef60
jmp 0x1400f8dbd