joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d45f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov rdi, rcx
mov rbp, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbp], 0
je 0x1400d465c
xor ebx, ebx
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rbp]
jne 0x1400d4640
mov byte [rbp + 4], 0
mov rbp, qword [rdi]
test r12, r12
je 0x1400d4675
mov rcx, r12
mov rdx, rbp
call fcn.1400cf180
jmp 0x1400d469a
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rbp + 4], 1
mov rcx, qword [rdi]
mov edx, r15d
call fcn.1400d4770
mov rsi, qword [rdi]
mov bl, byte [rsi + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x1400d4721
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d471b
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop dword [rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add edi, 1
cmp edi, dword [rsi]
jne 0x1400d4700
mov byte [rsi + 4], 0
jmp 0x1400d473b
lea rcx, [0x14010e7b6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
movsxd r8, r14d
lea rdx, str._lld
mov rcx, rax
call fcn.1400cafc0
nop
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400d4770
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov edi, edx
mov rsi, rcx
mov bl, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x1400d47a5
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov rcx, rsi
call fcn.1400d32f0
jmp 0x1400d47bf
lea rcx, [0x14010e7b6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
lea rax, str.true
lea rsi, str.false
test dil, dil
cmovne rsi, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rsi
mov rdx, rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400f50e0
Function at 0x1400d4ce0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r9
mov r12, r8
mov rbx, rdx
mov r15, rcx
mov rdi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d4d4b
xor ebp, ebp
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rdi]
jne 0x1400d4d30
mov byte [rdi + 4], 0
mov rdi, qword [r15]
test rbx, rbx
je 0x1400d4d64
mov rcx, rbx
mov rdx, rdi
call fcn.1400cf180
jmp 0x1400d4d89
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
mov rdi, qword [r15]
mov r13, qword [r12]
mov rsi, qword [r12 + 8]
mov bl, byte [rdi + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x1400d4e01
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d4dfb
xor ebp, ebp
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rdi]
jne 0x1400d4de0
mov byte [rdi + 4], 0
jmp 0x1400d4e1b
lea rcx, [0x14010e7b6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
sub esi, r13d
lea rdx, str.__.s_
mov rcx, rax
mov r8d, esi
mov r9, r13
call fcn.1400cafc0
mov rsi, qword [r15]
mov ecx, 2
call rdi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d4e9b
xor ebx, ebx
nop word cs:[rax + rax]
nop dword [rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rsi]
jne 0x1400d4e80
mov byte [rsi + 4], 0
test r14, r14
je 0x1400d4eb1
mov rcx, r14
mov rdx, rsi
call fcn.1400cf180
jmp 0x1400d4ed6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400d5320
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, r9
mov r15, r8
mov rsi, rdx
mov r12, rcx
mov rdi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d538b
xor ebx, ebx
mov rbp, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop dword [rax]
mov ecx, 2
call rbp
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400d5370
mov byte [rdi + 4], 0
mov rbx, qword [rsi]
mov esi, dword [rsi + 8]
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
sub esi, ebx
lea rdx, str.__.s_
mov rcx, rax
mov r8d, esi
mov r9, rbx
call fcn.1400cafc0
mov rsi, qword [r12]
mov ecx, 2
call rdi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d540b
xor ebx, ebx
nop dword [rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rsi]
jne 0x1400d53f0
mov byte [rsi + 4], 0
test r15, r15
je 0x1400d5421
mov rcx, r15
mov rdx, rsi
call fcn.1400cf180
jmp 0x1400d5446
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rbx, qword [r12]
mov r15, qword [r14]
mov rsi, qword [r14 + 8]
mov bpl, byte [rbx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bpl, bpl
je 0x1400d54c1
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbx], 0
je 0x1400d54bb
xor ebp, ebp
nop word cs:[rax + rax]
nop
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rbx]
jne 0x1400d54a0
mov byte [rbx + 4], 0
jmp 0x1400d54db
lea rcx, [0x14010e7b6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
sub esi, r15d
lea rdx, str.__.s_
mov rcx, rax
mov r8d, esi
mov r9, r15
call fcn.1400cafc0
nop
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400d5510
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r9
mov r15, r8
mov r13, rdx
mov r12, rcx
mov rdi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d557b
xor ebx, ebx
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400d5560
mov byte [rdi + 4], 0
mov rdi, qword [r13]
mov esi, dword [r13 + 8]
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
sub esi, edi
lea rdx, str.__.s_
mov rcx, rax
mov r8d, esi
mov r9, rdi
call fcn.1400cafc0
mov rsi, qword [r12]
mov ecx, 2
call rbx
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d55fb
xor edi, edi
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add edi, 1
cmp edi, dword [rsi]
jne 0x1400d55e0
mov byte [rsi + 4], 0
test r15, r15
je 0x1400d5611
mov rcx, r15
mov rdx, rsi
call fcn.1400cf180
jmp 0x1400d5636
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rdi, qword [r12]
mov ecx, 2
call rbx
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d568b
xor esi, esi
nop dword [rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esi, 1
cmp esi, dword [rdi]
jne 0x1400d5670
mov byte [rdi + 4], 0
test r14, r14
je 0x1400d56a1
mov rcx, r14
mov rdx, rdi
call fcn.1400cf180
jmp 0x1400d56c6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400d56e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rdi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d573b
xor ebp, ebp
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rdi]
jne 0x1400d5720
mov byte [rdi + 4], 0
mov rdi, qword [rsi]
test r15, r15
je 0x1400d5754
mov rcx, r15
mov rdx, rdi
call fcn.1400cf180
jmp 0x1400d5779
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
mov rsi, qword [rsi]
mov r15, qword [r14]
mov rdi, qword [r14 + 8]
mov bl, byte [rsi + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test rdi, rdi
jne 0x1400d57ba
test bl, bl
jne 0x1400d57ba
lea rcx, [0x14010e7b6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x1400d580f
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d580b
xor ebp, ebp
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop dword [rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400d57f0
mov byte [rsi + 4], 0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400d3d00
test rdi, rdi
je 0x1400d582f
mov byte [rsi + 4], 1
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400d5d30
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov rsi, rcx
mov rbp, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbp], 0
je 0x1400d5d9c
xor ebx, ebx
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rbp]
jne 0x1400d5d80
mov byte [rbp + 4], 0
mov rbp, qword [rsi]
test r12, r12
je 0x1400d5db5
mov rcx, r12
mov rdx, rbp
call fcn.1400cf180
jmp 0x1400d5dda
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rbp + 4], 1
mov rcx, qword [rsi]
mov edx, r15d
call fcn.1400d4770
mov rcx, qword [rsi]
mov edx, r14d
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1400d4770
Function at 0x1400d5e10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, r9
mov r15, r8
mov rsi, rdx
mov r12, rcx
mov rbx, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbx], 0
je 0x1400d5e7b
xor ebp, ebp
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop dword [rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rbx]
jne 0x1400d5e60
mov byte [rbx + 4], 0
mov rbx, qword [r12]
test rsi, rsi
je 0x1400d5e95
mov rcx, rsi
mov rdx, rbx
call fcn.1400cf180
jmp 0x1400d5eba
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rbx + 4], 1
mov rsi, qword [r12]
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d5f1b
xor ebp, ebp
nop dword [rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400d5f00
mov byte [rsi + 4], 0
test r15, r15
je 0x1400d5f31
mov rcx, r15
mov rdx, rsi
call fcn.1400cf180
jmp 0x1400d5f56
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rdi, qword [r12]
mov r15, qword [r14]
mov rsi, qword [r14 + 8]
mov bpl, byte [rdi + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bpl, bpl
je 0x1400d5fd1
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d5fcb
xor ebp, ebp
nop word cs:[rax + rax]
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rdi]
jne 0x1400d5fb0
mov byte [rdi + 4], 0
jmp 0x1400d5feb
lea rcx, [0x14010e7b6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
sub esi, r15d
lea rdx, str.__.s_
mov rcx, rax
mov r8d, esi
mov r9, r15
call fcn.1400cafc0
nop
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400d62b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14d, r9d
mov r15, r8
mov rbx, rdx
mov r12, rcx
mov rbp, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbp], 0
je 0x1400d631c
xor edi, edi
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add edi, 1
cmp edi, dword [rbp]
jne 0x1400d6300
mov byte [rbp + 4], 0
mov rbp, qword [r12]
test rbx, rbx
je 0x1400d6336
mov rcx, rbx
mov rdx, rbp
call fcn.1400cf180
jmp 0x1400d635b
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rbp + 4], 1
mov rbx, qword [r12]
mov rbp, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbp
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbp
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbx], 0
je 0x1400d63bb
xor edi, edi
nop dword [rax]
mov ecx, 2
call rbp
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add edi, 1
cmp edi, dword [rbx]
jne 0x1400d63a0
mov byte [rbx + 4], 0
test r15, r15
je 0x1400d63d1
mov rcx, r15
mov rdx, rbx
call fcn.1400cf180
jmp 0x1400d63f6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rbx + 4], 1
mov rcx, qword [r12]
mov edx, r14d
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1400d4770
Function at 0x14060d210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14060d397
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14060d241
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14060d227
add dl, dl
jne 0x14060d24e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14060d2ae
xor eax, eax
add dl, dl
jne 0x14060d25d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14060d365
add dl, dl
jne 0x14060d26e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14060d27b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14060d288
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14060d295
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14060d2a2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14060d236
mov eax, 1
add dl, dl
jne 0x14060d2be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14060d2cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14060d2b3
sub eax, ebx
mov ebx, 1
jne 0x14060d304
mov ecx, 1
add dl, dl
jne 0x14060d2e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14060d2f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14060d2db
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14060d236
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14060d320
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14060d32d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14060d315
cmp eax, 0x7d00
jae 0x14060d353
cmp eax, 0x500
jb 0x14060d34e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14060d236
cmp eax, 0x7f
ja 0x14060d356
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14060d236
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14060d38a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14060d236
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400133e0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x5be0cd19
ret