joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d6690
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
add dword [rcx], 2
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, [0x14012d589]
lea r8, str.SpecialName
mov rcx, rax
call fcn.1400ccfc0
mov r15, qword [rbx + 0x10]
mov r12, qword [rbx + 0x18]
mov r14, qword [rbx + 0x20]
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d671b
xor ebx, ebx
nop word cs:[rax + rax]
nop dword [rax + rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rsi]
jne 0x1400d6700
mov byte [rsi + 4], 0
mov ecx, 2
call rdi
sub r12d, r15d
lea rdx, str.__.s_
mov rcx, rax
mov r8d, r12d
mov r9, r15
call fcn.1400ccfc0
mov ecx, 2
call rdi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d678b
xor ebx, ebx
nop dword [rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rsi]
jne 0x1400d6770
mov byte [rsi + 4], 0
test r14, r14
je 0x1400d67a1
mov rcx, r14
mov rdx, rsi
call fcn.1400d47a0
jmp 0x1400d67c6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400d7f50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, rdx
mov rsi, rcx
add dword [rcx], 2
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, [0x14012d589]
lea r8, str.EnclosingExpr
mov rcx, rax
call fcn.1400ccfc0
mov r15, qword [rbx + 0x10]
mov r12, qword [rbx + 0x18]
mov r14, qword [rbx + 0x20]
movups xmm0, xmmword [rbx + 0x28]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d7fdb
xor ebx, ebx
nop word [rax + rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rsi]
jne 0x1400d7fc0
mov byte [rsi + 4], 0
mov ecx, 2
call rdi
sub r12d, r15d
lea rdx, str.__.s_
mov rcx, rax
mov r8d, r12d
mov r9, r15
call fcn.1400ccfc0
mov ecx, 2
call rdi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d804b
xor ebx, ebx
nop dword [rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rsi]
jne 0x1400d8030
mov byte [rsi + 4], 0
test r14, r14
je 0x1400d8061
mov rcx, r14
mov rdx, rsi
call fcn.1400d47a0
jmp 0x1400d8086
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400d9690
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400d92f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov rdi, qword [rdx + 8]
add dword [rcx], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7b
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
test rdi, rdi
je 0x1400d941a
lea r12, [rbx + rdi*8]
mov al, 1
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r15, str._null_
jmp 0x1400d9377
mov ecx, 2
call rdi
mov edx, 6
mov r8d, 1
mov rcx, r15
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
add rbx, 8
xor eax, eax
cmp rbx, r12
je 0x1400d941a
mov r13, qword [rbx]
test al, 1
je 0x1400d9390
test r13, r13
je 0x1400d93f8
mov rcx, r13
mov rdx, rsi
call fcn.1400d47a0
jmp 0x1400d9368
mov ecx, 2
call rdi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d93db
xor ebp, ebp
nop
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400d93c0
mov byte [rsi + 4], 0
test r13, r13
je 0x1400d9347
mov rcx, r13
mov rdx, rsi
call fcn.1400d47a0
jmp 0x1400d9364
mov ecx, 2
call rdi
mov edx, 6
mov r8d, 1
mov rcx, r15
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x1400d9368
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7d
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xffffffff
cmp qword [r14 + 8], 0
je 0x1400d9440
mov byte [rsi + 4], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400d9460
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
add dword [rcx], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7b
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400d958a
mov rdi, qword [rdi]
lea r15, [rdi + rax*8]
mov al, 1
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r14, str._null_
jmp 0x1400d94e5
mov ecx, 2
call rbx
mov edx, 6
mov r8d, 1
mov rcx, r14
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
add rdi, 8
xor eax, eax
cmp rdi, r15
je 0x1400d958a
mov r12, qword [rdi]
test al, 1
je 0x1400d9500
test r12, r12
je 0x1400d9568
mov rcx, r12
mov rdx, rsi
call fcn.1400d47a0
jmp 0x1400d94d6
mov ecx, 2
call rbx
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d954b
xor ebp, ebp
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400d9530
mov byte [rsi + 4], 0
test r12, r12
je 0x1400d94b5
mov rcx, r12
mov rdx, rsi
call fcn.1400d47a0
jmp 0x1400d94d2
mov ecx, 2
call rbx
mov edx, 6
mov r8d, 1
mov rcx, r14
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x1400d94d6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7d
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xffffffff
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400d95c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d961b
xor ebp, ebp
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400d9600
mov byte [rsi + 4], 0
mov rsi, qword [rdi]
test r15, r15
je 0x1400d9634
mov rcx, r15
mov rdx, rsi
call fcn.1400d47a0
jmp 0x1400d9659
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, qword [rdi]
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
call fcn.1400d9690
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400d9690
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rdi, rcx
mov bl, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x1400d9711
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d970b
xor ebx, ebx
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400d96f0
mov byte [rdi + 4], 0
jmp 0x1400d972b
lea rcx, [0x14012d5a6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rdi, qword [r14]
mov esi, dword [r14 + 8]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
sub esi, edi
lea rdx, str.__.s_
mov rcx, rax
mov r8d, esi
mov r9, rdi
call fcn.1400ccfc0
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400d9760
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r14, r9
mov r15, r8
mov r12, rdx
mov rdi, rcx
mov rbx, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbx], 0
je 0x1400d97cb
xor ebp, ebp
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop dword [rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rbx]
jne 0x1400d97b0
mov byte [rbx + 4], 0
mov rbx, qword [rdi]
test r12, r12
je 0x1400d97e4
mov rcx, r12
mov rdx, rbx
call fcn.1400d47a0
jmp 0x1400d9809
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rbx + 4], 1
mov rcx, qword [rdi]
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
call fcn.1400d9690
mov rdi, qword [rdi]
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d987b
xor ebx, ebx
nop dword [rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400d9860
mov byte [rdi + 4], 0
test r14, r14
je 0x1400d9891
mov rcx, r14
mov rdx, rdi
call fcn.1400d47a0
jmp 0x1400d98b6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400d98d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, edx
mov rdi, rcx
mov bl, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x1400d9a5a
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d994b
xor ebx, ebx
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400d9930
mov byte [rdi + 4], 0
test ebp, ebp
je 0x1400d9a7c
test bpl, 1
je 0x1400d99b0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualConst
mov edx, 9
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
and ebp, 0xfffffffe
je 0x1400d9a51
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14012d602]
mov edx, 3
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test bpl, 2
je 0x1400d9a05
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualVolatile
mov edx, 0xc
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
and ebp, 0xfffffffd
je 0x1400d9a51
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14012d602]
mov edx, 3
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test bpl, 4
je 0x1400d9a51
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualRestrict
mov edx, 0xc
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test ebp, 0xfffffffb
je 0x1400d9a51
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14012d602]
mov edx, 3
jmp 0x1400d9a93
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x14012d5a6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test ebp, ebp
jne 0x1400d9957
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualNone
mov edx, 8
mov r8d, 1
mov r9, rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
Function at 0x1400d9ab0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, rdx
mov rdi, rcx
mov rbx, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbx], 0
je 0x1400d9b0b
xor ebp, ebp
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop dword [rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rbx]
jne 0x1400d9af0
mov byte [rbx + 4], 0
mov rdi, qword [rdi]
test r14, r14
je 0x1400d9b24
mov rcx, r14
mov rdx, rdi
call fcn.1400d47a0
jmp 0x1400d9b49
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400d9b60
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov r12, rdx
mov r15, rcx
mov rsi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d9bbb
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add edi, 1
cmp edi, dword [rsi]
jne 0x1400d9ba0
mov byte [rsi + 4], 0
mov rdi, qword [r12]
mov ebx, dword [r12 + 8]
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
sub ebx, edi
lea rdx, str.__.s_
mov rcx, rax
mov r8d, ebx
mov r9, rdi
call fcn.1400ccfc0
mov rdi, qword [r15]
mov ecx, 2
call rsi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d9c3b
xor ebx, ebx
nop
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400d9c20
mov byte [rdi + 4], 0
test r14, r14
je 0x1400d9c51
mov rcx, r14
mov rdx, rdi
call fcn.1400d47a0
jmp 0x1400d9c76
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400d9c90
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d9ceb
xor ebp, ebp
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400d9cd0
mov byte [rsi + 4], 0
mov rsi, qword [rdi]
test r15, r15
je 0x1400d9d04
mov rcx, r15
mov rdx, rsi
call fcn.1400d47a0
jmp 0x1400d9d29
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rdi, qword [rdi]
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d9d8b
xor ebx, ebx
nop word cs:[rax + rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400d9d70
mov byte [rdi + 4], 0
test r14, r14
je 0x1400d9da1
mov rcx, r14
mov rdx, rdi
call fcn.1400d47a0
jmp 0x1400d9dc6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400d9de0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, edx
mov rsi, rcx
mov bl, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x1400d9e89
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d9e5b
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add edi, 1
cmp edi, dword [rsi]
jne 0x1400d9e40
mov byte [rsi + 4], 0
cmp bpl, 2
je 0x1400d9ea9
cmp bpl, 1
je 0x1400d9ebd
test bpl, bpl
jne 0x1400d9eea
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.FunctionRefQual::FrefQualNone
mov edx, 0x1d
jmp 0x1400d9ed4
lea rcx, [0x14012d5a6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp bpl, 2
jne 0x1400d9e65
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.FunctionRefQual::FrefQualRValue
jmp 0x1400d9ecf
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.FunctionRefQual::FrefQualLValue
mov edx, 0x1f
mov r8d, 1
mov r9, rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400d9f00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d9f5b
xor ebp, ebp
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400d9f40
mov byte [rsi + 4], 0
mov rsi, qword [rdi]
test r15, r15
je 0x1400d9f74
mov rcx, r15
mov rdx, rsi
call fcn.1400d47a0
jmp 0x1400d9f99
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rdi, qword [rdi]
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d9ffb
xor ebx, ebx
nop word cs:[rax + rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400d9fe0
mov byte [rdi + 4], 0
test r14, r14
je 0x1400da011
mov rcx, r14
mov rdx, rdi
call fcn.1400d47a0
jmp 0x1400da036
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400da050
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, rdx
mov rdi, rcx
mov rbx, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbx], 0
je 0x1400da0ab
xor ebp, ebp
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop dword [rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rbx]
jne 0x1400da090
mov byte [rbx + 4], 0
mov rdi, qword [rdi]
test r14, r14
je 0x1400da0c4
mov rcx, r14
mov rdx, rdi
call fcn.1400d47a0
jmp 0x1400da0e9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret