joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140089140
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
lea rcx, [0x1400f3128]
call fcn.1400885f0
mov rax, qword [rsi]
cmp dword [rax], 0xbab1f0ed
jne 0x14008917f
mov rax, qword [rsi]
cmp dword [rax + 4], 0
jle 0x14008917f
mov rax, qword [rsi]
dec dword [rax + 4]
lea rcx, [0x1400f3128]
add rsp, 0x30
pop rsi
jmp fcn.140088630
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], 0x28
lea rdx, str.Assertion_failed:___s___file__s__line__d_n
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
lea r9, str..._mingw_w64_mingw_w64_libraries_winpthreads_src_rwlock.c
mov rcx, rax
call fcn.140088cb0
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x14008cf80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rcx, str.libcabi:
mov edx, 0xb
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 2
call rdi
mov r8, qword [rsp + 0x20]
mov rcx, rax
mov rdx, rsi
call fcn.140091570
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x140092d20
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x1400c7008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x140092d8c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140092d8c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x140092d8c
movzx edx, word [rax + 6]
test edx, edx
je 0x140092d8c
sub rcx, qword [0x1400c7008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140092d78
add rax, 0x28
dec edx
je 0x140092d8c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140092d70
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140092d70
jmp 0x140092d8e
xor eax, eax
ret

Function at 0x140092d90
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x1400c7008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140092dc5
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140092dc5
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140092dc5
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x140092e40
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400c7008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140092e6c
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140092e6c
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x140092e6e
xor eax, eax
ret
Function at 0x1400944c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm12
movaps xmmword [rsp + 0x70], xmm11
movaps xmmword [rsp + 0x60], xmm10
movaps xmmword [rsp + 0x50], xmm9
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rdx
mov rsi, rcx
cmp byte [0x14225a823], 1
jne 0x140094513
cmp byte [0x14225a822], 0
jne 0x140094532
jmp 0x140094564
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14225a823], 1
test rax, rax
setne byte [0x14225a822]
je 0x140094564
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:___unw_init_local_cursor_p__context_p__n
mov rcx, rax
mov r8, rsi
mov r9, rdi
call fcn.140088cb0
mov ecx, 2
call rbx
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
lea rax, [0x1400ce530]
mov qword [rsi], rax
lea rax, [0x142259e79]
mov qword [rsi + 8], rax
lea rax, [rsi + 0x580]
lea rcx, [rsi + 0xb0]
xorps xmm0, xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x50], xmm0
movaps xmmword [rsi + 0x60], xmm0
movaps xmmword [rsi + 0x70], xmm0
movaps xmmword [rsi + 0x80], xmm0
movaps xmmword [rsi + 0x90], xmm0
mov qword [rsi + 0xa0], 0
movaps xmmword [rsi + 0x580], xmm0
movaps xmmword [rsi + 0x590], xmm0
movaps xmmword [rsi + 0x5a0], xmm0
movaps xmmword [rsi + 0x5b0], xmm0
movaps xmmword [rsi + 0x5c0], xmm0
movaps xmmword [rsi + 0x5d0], xmm0
movaps xmmword [rsi + 0x5e0], xmm0
movaps xmmword [rsi + 0x5f0], xmm0
movaps xmmword [rsi + 0x600], xmm0
movaps xmmword [rsi + 0x610], xmm0
movaps xmmword [rsi + 0x620], xmm0
movaps xmmword [rsi + 0x630], xmm0
movaps xmmword [rsi + 0x640], xmm0
movups xmmword [rsi + 0x649], xmm0
mov qword [rsi + 0x80], rcx
mov qword [rsi + 0x98], rax
mov rbx, qword [rdi]
mov r14, qword [rdi + 8]
mov r15, qword [rdi + 0x80]
movups xmm6, xmmword [rdi + 0x10]
movdqu xmm0, xmmword [rdi + 0x30]
pshufd xmm7, xmm0, 0x4e
movdqu xmm0, xmmword [rdi + 0x20]
pshufd xmm8, xmm0, 0x4e
movups xmm9, xmmword [rdi + 0x40]
movups xmm10, xmmword [rdi + 0x50]
movups xmm11, xmmword [rdi + 0x60]
movups xmm12, xmmword [rdi + 0x70]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov dword [rsi + 0xe0], 0x10000b
mov qword [rsi + 0x128], rbx
movaps xmmword [rsi + 0x130], xmm6
mov qword [rsi + 0x140], r14
movdqu xmmword [rsi + 0x148], xmm7
movdqu xmmword [rsi + 0x158], xmm8
movups xmmword [rsi + 0x168], xmm9
movups xmmword [rsi + 0x178], xmm10
movups xmmword [rsi + 0x188], xmm11
movups xmmword [rsi + 0x198], xmm12
mov qword [rsi + 0x1a8], r15
mov rax, qword [rsi]
mov rcx, rsi
xor edx, edx
call qword [rax + 0x68]
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
movaps xmm10, xmmword [rsp + 0x60]
movaps xmm11, xmmword [rsp + 0x70]
movaps xmm12, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140094710
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x14225a823], 1
jne 0x14009472c
cmp byte [0x14225a822], 0
setne al
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x14225a822]
mov byte [0x14225a823], 1
add rsp, 0x28
ret

Function at 0x140094760
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
mov rbx, rcx
cmp byte [0x14225a823], 1
jne 0x140094785
cmp byte [0x14225a822], 0
jne 0x1400947a4
jmp 0x1400947dd
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14225a823], 1
test rax, rax
setne byte [0x14225a822]
je 0x1400947dd
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call fcn.140088cb0
mov ecx, 2
call r14
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [rbx]
mov rcx, rbx
mov edx, edi
call qword [rax + 0x10]
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x140094803
mov rax, qword [rbx]
mov rcx, rbx
mov edx, edi
call qword [rax + 0x18]
mov qword [rsi], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140094810
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rbx, r8
mov edi, edx
mov rsi, rcx
cmp byte [0x14225a823], 1
jne 0x140094836
cmp byte [0x14225a822], 0
jne 0x140094855
jmp 0x14009488e
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14225a823], 1
test rax, rax
setne byte [0x14225a822]
je 0x14009488e
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rbx
lea rdx, str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_llx__n
mov rcx, rax
mov r8, rsi
mov r9d, edi
call fcn.140088cb0
mov ecx, 2
call r14
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [rsi]
mov rcx, rsi
mov edx, edi
call qword [rax + 0x10]
mov ebp, 0xffffe672
test al, al
je 0x1400948ff
mov rax, qword [rsi]
mov rcx, rsi
mov edx, edi
mov r8, rbx
call qword [rax + 0x20]
xor ebp, ebp
cmp edi, 0xffffffff
jne 0x1400948ff
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call qword [rax + 0x48]
mov rax, qword [rsi]
xor ebp, ebp
mov rcx, rsi
xor edx, edx
call qword [rax + 0x68]
cmp qword [rsp + 0x48], 0
je 0x1400948ff
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xfffffffe
call qword [rax + 0x18]
add rax, qword [rsp + 0x48]
mov r9, qword [rsi]
mov rcx, rsi
mov edx, 0xfffffffe
mov r8, rax
call qword [r9 + 0x20]
mov eax, ebp
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140094a80
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x14225a823], 1
jne 0x140094a9d
cmp byte [0x14225a822], 0
jne 0x140094abc
jmp 0x140094aeb
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14225a823], 1
test rax, rax
setne byte [0x14225a822]
je 0x140094aeb
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.libunwind:___unw_step_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.140088cb0
mov ecx, 2
call rdi
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [rsi]
mov rax, qword [rax + 0x40]
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp rax

Function at 0x140094b80
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
cmp byte [0x14225a823], 1
jne 0x140094ba1
cmp byte [0x14225a822], 0
jne 0x140094bc0
jmp 0x140094bf2
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14225a823], 1
test rax, rax
setne byte [0x14225a822]
je 0x140094bf2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.140088cb0
mov ecx, 2
call rbx
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [rax + 0x48]
xor ecx, ecx
cmp qword [rsi + 8], 0
mov eax, 0xffffe66b
cmovne eax, ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140094c20
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x14225a823], 1
jne 0x140094c3d
cmp byte [0x14225a822], 0
jne 0x140094c5c
jmp 0x140094c8b
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14225a823], 1
test rax, rax
setne byte [0x14225a822]
je 0x140094c8b
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.libunwind:___unw_resume_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.140088cb0
mov ecx, 2
call rdi
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
mov eax, 0xffffe674
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140094ca0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [0x14225a823], 1
jne 0x140094ccb
cmp byte [0x14225a822], 0
jne 0x140094cea
jmp 0x140094d22
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14225a823], 1
test rax, rax
setne byte [0x14225a822]
je 0x140094d22
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
mov dword [rsp + 0x20], edi
lea rdx, str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
mov rcx, rax
mov r8, r14
mov r9, rbx
call fcn.140088cb0
mov ecx, 2
call r15
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [r14]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [rax + 0x60]
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140094ef0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x14225a821], 1
jne 0x140094f0c
cmp byte [0x14225a820], 0
setne al
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_UNWINDING
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x14225a820]
mov byte [0x14225a821], 1
add rsp, 0x28
ret

Function at 0x140095170
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.140094710
test al, al
je 0x1400951c3
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0llx__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call fcn.140088cb0
mov ecx, 2
call r14
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rcx, rbx
mov edx, edi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140094810

Function at 0x140095270
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.140094710
test al, al
je 0x1400952b8
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:__Unwind_SetIP_context_p__value0x_0llx__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.140088cb0
mov ecx, 2
call rbx
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rcx, rdi
mov edx, 0xffffffff
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140094810
Function at 0x140099e80
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov r14, qword [rdx + 8]
inc dword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7b
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
test r14, r14
je 0x140099f25
mov rcx, qword [rbx]
test rcx, rcx
je 0x140099ecf
mov rdx, rsi
call fcn.1400987e0
cmp r14, 1
jne 0x140099efa
jmp 0x140099f25
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp r14, 1
je 0x140099f25
shl r14, 3
mov r15d, 8
nop word cs:[rax + rax]
mov rdx, qword [rbx + r15]
mov rcx, rsi
call fcn.140099f60
add r15, 8
cmp r14, r15
jne 0x140099f10
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7d
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
dec dword [rsi]
cmp qword [rdi + 8], 0
je 0x140099f4a
mov byte [rsi + 4], 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140099f60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140099fca
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140099fb0
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140099fe0
mov rcx, rdi
mov rdx, rsi
call fcn.1400987e0
jmp 0x14009a005
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14009a020
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400cfd5f]
lea r8, str.DotSuffix
mov rcx, rax
call fcn.140088cb0
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009a09a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14009a080
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14009a0b0
mov rcx, rdi
mov rdx, rsi
call fcn.1400987e0
jmp 0x14009a0d5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14009a120
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14009a120
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
movzx ebx, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x14009a1a1
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x14009a19b
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebx
cmp ebx, dword [rdi]
jne 0x14009a180
mov byte [rdi + 4], 0
jmp 0x14009a1bb
lea rcx, [0x1400cfd78]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rdi, qword [rsi]
mov esi, dword [rsi + 8]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.__.s_
mov rcx, rax
mov r8d, esi
mov r9, rdi
call fcn.140088cb0
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14009a1f0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
lea rdx, [0x1400cfd5f]
lea r8, str.VendorExtQualType
mov rcx, rax
call fcn.140088cb0
mov rbx, qword [rdi + 0x18]
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rdi + 0x30]
mov ecx, 2
call r14
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009a27b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14009a260
mov byte [rsi + 4], 0
test rbx, rbx
je 0x14009a291
mov rcx, rbx
mov rdx, rsi
call fcn.1400987e0
jmp 0x14009a2b6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14009a120
mov rcx, rsi
mov rdx, rdi
call fcn.140099f60
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14009a310
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
lea rdx, [0x1400cfd5f]
lea r8, str.QualType
mov rcx, rax
call fcn.140088cb0
mov rbx, qword [rdi + 0x18]
mov edi, dword [rdi + 0x14]
mov ecx, 2
call r14
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009a38b
xor ebp, ebp
nop dword [rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14009a370
mov byte [rsi + 4], 0
test rbx, rbx
je 0x14009a3a1
mov rcx, rbx
mov rdx, rsi
call fcn.1400987e0
jmp 0x14009a3c6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov edx, edi
call fcn.14009a400
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14009a400
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
movzx ebx, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x14009a58b
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x14009a47b
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop dword [rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebx
cmp ebx, dword [rdi]
jne 0x14009a460
mov byte [rdi + 4], 0
test esi, esi
je 0x14009a5ad
test sil, 1
je 0x14009a4e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualConst
mov edx, 9
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
and esi, 0xfffffffe
je 0x14009a581
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x1400cfdd4]
mov edx, 3
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test sil, 2
je 0x14009a535
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualVolatile
mov edx, 0xc
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
and esi, 0xfffffffd
je 0x14009a581
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x1400cfdd4]
mov edx, 3
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test sil, 4
je 0x14009a581
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualRestrict
mov edx, 0xc
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test esi, 0xfffffffb
je 0x14009a581
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x1400cfdd4]
mov edx, 3
jmp 0x14009a5c4
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1400cfd78]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test esi, esi
jne 0x14009a487
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualNone
mov edx, 8
mov r8d, 1
mov r9, rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite