joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140094ff0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
movzx ebx, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x14009517b
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x14009506b
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop dword [rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebx
cmp ebx, dword [rdi]
jne 0x140095050
mov byte [rdi + 4], 0
test esi, esi
je 0x14009519d
test sil, 1
je 0x1400950d0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualConst
mov edx, 9
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
and esi, 0xfffffffe
je 0x140095171
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x1400c9d94]
mov edx, 3
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test sil, 2
je 0x140095125
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualVolatile
mov edx, 0xc
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
and esi, 0xfffffffd
je 0x140095171
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x1400c9d94]
mov edx, 3
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test sil, 4
je 0x140095171
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualRestrict
mov edx, 0xc
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test esi, 0xfffffffb
je 0x140095171
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x1400c9d94]
mov edx, 3
jmp 0x1400951b4
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1400c9d38]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test esi, esi
jne 0x140095077
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualNone
mov edx, 8
mov r8d, 1
mov r9, rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
Function at 0x1400951d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400c9d1f]
lea r8, str.ConversionOperatorType
mov rcx, rax
call fcn.1400838a0
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009524a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140095230
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140095260
mov rcx, rdi
mov rdx, rsi
call fcn.1400933d0
jmp 0x140095285
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400952b0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400c9d1f]
lea r8, str.PostfixQualifiedType
mov rcx, rax
call fcn.1400838a0
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009532a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140095310
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140095340
mov rcx, rdi
mov rdx, rsi
call fcn.1400933d0
jmp 0x140095365
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140094d10
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140095490
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400954fa
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400954e0
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140095510
mov rcx, rdi
mov rdx, rsi
call fcn.1400933d0
jmp 0x140095535
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140095550
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400c9d1f]
lea r8, str.AbiTagAttr
mov rcx, rax
call fcn.1400838a0
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400955ca
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400955b0
mov byte [rsi + 4], 0
test rdi, rdi
je 0x1400955e0
mov rcx, rdi
mov rdx, rsi
call fcn.1400933d0
jmp 0x140095605
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140094d10
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140095720
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400c9d1f]
lea r8, str.ObjCProtoName
mov rcx, rax
call fcn.1400838a0
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009579a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140095780
mov byte [rsi + 4], 0
test rdi, rdi
je 0x1400957b0
mov rcx, rdi
mov rdx, rsi
call fcn.1400933d0
jmp 0x1400957d5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140094d10
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140095820
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400c9d1f]
lea r8, str.PointerType
mov rcx, rax
call fcn.1400838a0
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009589a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140095880
mov byte [rsi + 4], 0
test rdi, rdi
je 0x1400958b0
mov rcx, rdi
mov rdx, rsi
call fcn.1400933d0
jmp 0x1400958d5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140095900
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400c9d1f]
lea r8, str.ReferenceType
mov rcx, rax
call fcn.1400838a0
mov rdi, qword [r14 + 0x18]
mov ebp, dword [r14 + 0x20]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009597c
xor r14d, r14d
nop dword [rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc r14d
cmp r14d, dword [rsi]
jne 0x140095960
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140095992
mov rcx, rdi
mov rdx, rsi
call fcn.1400933d0
jmp 0x1400959b7
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call rbx
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140095a0a
xor edi, edi
nop word [rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc edi
cmp edi, dword [rsi]
jne 0x1400959f0
mov byte [rsi + 4], 0
test ebp, ebp
je 0x140095a20
cmp ebp, 1
jne 0x140095a48
lea rdi, str.ReferenceKind::RValue
jmp 0x140095a27
lea rdi, str.ReferenceKind::LValue
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov edx, 0x15
mov r8d, 1
mov rcx, rdi
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140095a70
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
lea rdx, [0x1400c9d1f]
lea r8, str.PointerToMemberType
mov rcx, rax
call fcn.1400838a0
mov rbx, qword [rdi + 0x18]
mov rdi, qword [rdi + 0x20]
mov ecx, 2
call r14
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140095aeb
xor ebp, ebp
nop dword [rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140095ad0
mov byte [rsi + 4], 0
test rbx, rbx
je 0x140095b01
mov rcx, rbx
mov rdx, rsi
call fcn.1400933d0
jmp 0x140095b26
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rdi
call fcn.140094b50
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140095b60
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
lea rdx, [0x1400c9d1f]
lea r8, str.ArrayType
mov rcx, rax
call fcn.1400838a0
mov rbx, qword [rdi + 0x18]
mov rdi, qword [rdi + 0x20]
mov ecx, 2
call r14
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140095bdb
xor ebp, ebp
nop dword [rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140095bc0
mov byte [rsi + 4], 0
test rbx, rbx
je 0x140095bf1
mov rcx, rbx
mov rdx, rsi
call fcn.1400933d0
jmp 0x140095c16
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rdi
call fcn.140095490
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140095c50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400c9d1f]
lea r8, str.FunctionType
mov rcx, rax
call fcn.1400838a0
mov r14, qword [rdi + 0x18]
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ebp, dword [rdi + 0x30]
movzx ebx, byte [rdi + 0x34]
mov rdi, qword [rdi + 0x38]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140095ced
xor r12d, r12d
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc r12d
cmp r12d, dword [rsi]
jne 0x140095cd0
mov byte [rsi + 4], 0
test r14, r14
je 0x140095d03
mov rcx, r14
mov rdx, rsi
call fcn.1400933d0
jmp 0x140095d28
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140095d90
mov rcx, rsi
mov edx, ebp
call fcn.140094ff0
mov rcx, rsi
mov edx, ebx
call fcn.140095fc0
mov rcx, rsi
mov rdx, rdi
call fcn.140094b50
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140095d90
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp byte [rcx + 4], 0
jne 0x140095db3
cmp qword [rdi + 8], 0
je 0x140095e18
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140095e10
xor ebp, ebp
nop dword [rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140095df0
mov byte [rsi + 4], 0
jmp 0x140095e3f
xor ebp, ebp
mov byte [rsi + 4], 0
jmp 0x140095e3f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x1400c9d38]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebp, dword [rsi]
mov r15, qword [rdi]
mov r14, qword [rdi + 8]
inc ebp
mov dword [rsi], ebp
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7b
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
test r14, r14
je 0x140095f90
lea r12, [r15 + r14*8]
mov al, 1
mov r13, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdi, str._null_
jmp 0x140095eb2
mov ecx, 2
call r13
mov edx, 6
mov r8d, 1
mov rcx, rdi
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
add r15, 8
xor eax, eax
cmp r15, r12
je 0x140095f6b
mov rbx, qword [r15]
test al, 1
je 0x140095ed0
test rbx, rbx
je 0x140095f48
mov rcx, rbx
mov rdx, rsi
call fcn.1400933d0
jmp 0x140095ea3
mov ecx, 2
call r13
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call r13
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140095f2b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r13
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140095f10
mov byte [rsi + 4], 0
test rbx, rbx
je 0x140095e81
mov rcx, rbx
mov rdx, rsi
call fcn.1400933d0
jmp 0x140095e9f
mov ecx, 2
call r13
mov edx, 6
mov r8d, 1
mov rcx, rdi
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x140095ea3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7d
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
dec dword [rsi]
test r14, r14
je 0x140095faa
mov byte [rsi + 4], 1
jmp 0x140095faa
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7d
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
dec dword [rsi]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140095fc0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov ebx, edx
mov rsi, rcx
movzx edi, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test dil, dil
je 0x140096069
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009603b
xor edi, edi
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop dword [rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc edi
cmp edi, dword [rsi]
jne 0x140096020
mov byte [rsi + 4], 0
cmp bl, 2
je 0x140096088
movzx eax, bl
cmp eax, 1
je 0x14009609c
test eax, eax
jne 0x1400960ca
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.FunctionRefQual::FrefQualNone
mov edx, 0x1d
jmp 0x1400960b3
lea rcx, [0x1400c9d38]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp bl, 2
jne 0x140096044
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.FunctionRefQual::FrefQualRValue
jmp 0x1400960ae
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.FunctionRefQual::FrefQualLValue
mov edx, 0x1f
mov r8d, 1
mov r9, rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400960e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400c9d1f]
lea r8, str.NoexceptSpec
mov rcx, rax
call fcn.1400838a0
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009615a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140096140
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140096170
mov rcx, rdi
mov rdx, rsi
call fcn.1400933d0
jmp 0x140096195
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret