joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004720
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, r9
mov rbx, rcx
call qword [sym.imp.MSVCR120.dll___iob_func]
add rax, 0x30
cmp qword [rdi], rax
jne 0x140004814
mov rdx, qword [rbx]
test rdx, rdx
je 0x1400047e5
cmp word [rdx + 8], 0
je 0x1400047e5
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rcx, rax
call qword [sym.imp.MSVCR120.dll__fileno]
mov ecx, eax
call qword [sym.imp.MSVCR120.dll__isatty]
test eax, eax
je 0x1400047e5
call qword [sym.imp.MSVCR120.dll___iob_func]
lea rcx, [rax + 0x30]
call qword [sym.imp.MSVCR120.dll__fileno]
mov ecx, eax
call qword [sym.imp.MSVCR120.dll__isatty]
test eax, eax
je 0x1400047e5
lea rcx, str.PAGER
call qword [sym.imp.MSVCR120.dll_getenv]
mov rbx, rax
test rax, rax
jne 0x1400047af
lea rbx, str.more
jmp 0x1400047d1
lea rdx, str.__t_r_n
mov rcx, rax
call qword [sym.imp.MSVCR120.dll_strspn]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400047c3
cmp rax, rcx
je 0x1400047e5
lea rdx, [0x140012b60]
mov rcx, rbx
call fcn.14000e960
test rax, rax
jne 0x1400047ef
call qword [sym.imp.MSVCR120.dll___iob_func]
add rax, 0x30
mov qword [rdi], rax
call qword [sym.imp.MSVCR120.dll___iob_func]
add rax, 0x30
cmp qword [rdi], rax
mov rax, qword [rsp + 0x50]
setne cl
mov byte [rax], cl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x30]
mov byte [rax], 0
add rsp, 0x20
pop rdi
ret
Function at 0x1400054b0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
lea rdx, str.0123456789_.eE
mov rdi, rcx
call qword [sym.imp.MSVCR120.dll_strspn]
or rsi, 0xffffffffffffffff
mov rcx, rsi
nop
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400054d0
cmp rax, rcx
mov rcx, rdi
je 0x1400054ec
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140009ce0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x20], r15
call fcn.140005400
mov rcx, rsi
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140005510
inc eax
add eax, ecx
movsxd rcx, eax
call fcn.140009d60
movzx ecx, byte [rdi]
xor ebp, ebp
sub cl, 0x2b
mov r14, rax
mov ebx, ebp
mov rax, rdi
test cl, 0xfd
jne 0x14000553e
lea rax, [rdi + 1]
lea rdx, str.0123456789
mov rcx, rax
call qword [sym.imp.MSVCR120.dll_strspn]
mov r15d, dword [0x140019424]
movzx r8d, byte [rdi]
mov r10, rax
cdq
lea ecx, [r8 - 0x2b]
idiv r15d
test edx, edx
cmove edx, r15d
test cl, 0xfd
jne 0x14000557a
mov byte [r14], r8b
mov ebx, 1
inc rdi
mov r9, rbp
movsxd r11, r10d
test r10d, r10d
jle 0x1400055e7
mov r8, qword [0x140019430]
mov ebp, r11d
nop
test r9, r9
jle 0x1400055d1
dec edx
jne 0x1400055d1
movsxd rdx, ebx
mov rax, r8
sub rdx, r8
add rdx, r14
nop word [rax + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
mov byte [rdx + rax - 1], cl
test cl, cl
jne 0x1400055b0
mov rax, rsi
inc rax
cmp byte [r8 + rax], 0
jne 0x1400055c2
add ebx, eax
mov edx, r15d
movzx eax, byte [r9 + rdi]
movsxd rcx, ebx
inc r9
inc ebx
mov byte [rcx + r14], al
cmp r9, r11
jl 0x140005590
mov r15, qword [rsp + 0x20]
movsxd rax, ebp
cmp byte [rax + rdi], 0x2e
jne 0x14000562d
mov rdx, qword [0x140019428]
movsxd r8, ebx
sub r8, rdx
mov rcx, rdx
add r8, r14
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [r8 + rcx - 1], al
test al, al
jne 0x140005610
inc rsi
cmp byte [rdx + rsi], 0
jne 0x140005620
add ebx, esi
inc ebp
movsxd rcx, ebp
mov rbp, qword [rsp + 0x48]
movsxd rdx, ebx
mov rbx, qword [rsp + 0x40]
add rcx, rdi
sub rdx, rcx
add rdx, r14
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140005650
mov rax, r14
mov r14, qword [rsp + 0x50]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140009580
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, qword [r9]
mov r13d, dword [rsp + 0x70]
xor edi, edi
mov r15, r9
mov eax, r8d
mov r12, rdx
mov r14, rcx
cmp byte [rcx], dil
je 0x140009746
test r12, r12
je 0x140009746
mov edx, eax
mov rcx, r14
call sub.LIBPQ.dll_Ordinal_64
movsxd rsi, eax
cmp r12, rsi
jb 0x140009746
mov edx, dword [rsp + 0x60]
mov rcx, r14
call sub.LIBPQ.dll_Ordinal_112
mov edx, eax
cmp esi, 1
jne 0x1400096a0
movzx ecx, byte [r14]
cmp cl, 0xa
jne 0x140009623
mov byte [rbx], 0
mov dword [r15 + 8], edi
dec r13d
xor edi, edi
add r15, 0x10
inc rbx
test r13d, r13d
jle 0x14000973a
mov qword [r15], rbx
jmp 0x140009725
cmp cl, 0xd
jne 0x140009648
movzx eax, word [0x140012c60]
add edi, 2
add rbx, 2
mov word [rbx - 2], ax
movzx eax, byte [0x140012c62]
mov byte [rbx], al
jmp 0x140009725
cmp cl, 9
jne 0x140009671
nop dword [rax]
inc edi
mov byte [rbx], Ordinal_34
inc rbx
mov eax, edi
and eax, 0x80000007
jge 0x140009668
dec eax
or eax, 0xfffffff8
inc eax
test eax, eax
jne 0x140009650
jmp 0x140009725
test eax, eax
jns 0x140009694
movzx r8d, cl
lea rdx, str.x_02X
mov rcx, rbx
call fcn.14000c600
add edi, 4
add rbx, 4
jmp 0x140009725
add edi, eax
mov byte [rbx], cl
inc rbx
jmp 0x140009725
test eax, eax
jns 0x140009701
mov eax, dword [0x140019138]
test eax, eax
jns 0x1400096c0
lea rcx, [0x140012c58]
call sub.LIBPQ.dll_Ordinal_115
mov dword [0x140019138], eax
cmp dword [rsp + 0x60], eax
jne 0x1400096e9
mov rcx, r14
call fcn.140009920
lea rdx, str.u_04X
mov rcx, rbx
mov r8d, eax
call fcn.14000c600
add rbx, 6
add edi, 6
jmp 0x140009725
lea rdx, str.u____
mov rcx, rbx
call fcn.14000c600
add rbx, 6
add edi, 6
jmp 0x140009725
xor ecx, ecx
test esi, esi
jle 0x140009723
nop word [rax + rax]
movzx eax, byte [rcx + r14]
inc rcx
inc rbx
mov byte [rbx - 1], al
cmp rcx, rsi
jl 0x140009710
add edi, edx
add r14, rsi
sub r12, rsi
cmp byte [r14], 0
je 0x140009746
mov eax, dword [rsp + 0x60]
jmp 0x1400095c0
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
mov dword [r15 + 8], edi
mov byte [rbx], 0
test r13d, r13d
jg 0x14000975e
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov qword [r15 + 0x10], 0
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140009ce0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x140009d19
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.14000c790
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
call qword [sym.imp.MSVCR120.dll__strdup]
test rax, rax
jne 0x140009d52
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.14000c790
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x140009d70
Capabilities:
Terminate process

Disassembly:
mov edx, 4
jmp 0x140009ef0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
mov ebp, 1
cmove rbx, rbp
mov esi, edx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140009f5b
test sil, 2
jne 0x140009f57
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.14000c790
mov ecx, ebp
call qword [sym.imp.MSVCR120.dll_exit]
int3
xor eax, eax
jmp 0x140009fc1
test sil, 4
je 0x140009fbe
test al, 3
jne 0x140009fb1
test bl, 3
jne 0x140009fb1
cmp rbx, 0x400
ja 0x140009fb1
xor r9d, r9d
mov rcx, rax
add rax, rbx
mov r8, rax
mov edx, r9d
sub r8, rdi
add r8, 3
shr r8, 2
cmp rdi, rax
cmova r8, r9
test r8, r8
je 0x140009fbe
nop dword [rax]
inc rdx
mov dword [rcx], r9d
lea rcx, [rcx + 4]
cmp rdx, r8
jb 0x140009fa0
jmp 0x140009fbe
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140009ef0
Capabilities:
Terminate process

Disassembly:
mov edx, 4
jmp 0x140009ef0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
mov ebp, 1
cmove rbx, rbp
mov esi, edx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140009f5b
test sil, 2
jne 0x140009f57
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.14000c790
mov ecx, ebp
call qword [sym.imp.MSVCR120.dll_exit]
int3
xor eax, eax
jmp 0x140009fc1
test sil, 4
je 0x140009fbe
test al, 3
jne 0x140009fb1
test bl, 3
jne 0x140009fb1
cmp rbx, 0x400
ja 0x140009fb1
xor r9d, r9d
mov rcx, rax
add rax, rbx
mov r8, rax
mov edx, r9d
sub r8, rdi
add r8, 3
shr r8, 2
cmp rdi, rax
cmova r8, r9
test r8, r8
je 0x140009fbe
nop dword [rax]
inc rdx
mov dword [rcx], r9d
lea rcx, [rcx + 4]
cmp rdx, r8
jb 0x140009fa0
jmp 0x140009fbe
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140009fe0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc40
mov rax, qword [0x140019330]
xor rax, rsp
mov qword [rsp + 0xc30], rax
mov rbx, rdx
mov rdi, rcx
lea rdx, str.postgres_9.6
mov rcx, rbx
call sub.MSVCR120.dll_strcmp
test eax, eax
je 0x14000a026
lea rdx, [0x140011fe4]
xor ecx, ecx
call fcn.14000ebb0
lea rdx, [rsp + 0x830]
mov rcx, rdi
call fcn.14000a150
test eax, eax
js 0x14000a11c
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.14000c010
lea rdx, [rsp + 0x430]
mov rcx, rbx
call qword [sym.imp.libintl.dll_libintl_bindtextdomain]
mov rcx, rbx
call qword [sym.imp.libintl.dll_libintl_textdomain]
lea rcx, str.PGLOCALEDIR
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x14000a0ba
lea r9, [rsp + 0x430]
lea r8, str.PGLOCALEDIR_s
lea rcx, [rsp + 0x20]
mov edx, 0x40e
call fcn.14000c570
lea rcx, [rsp + 0x2c]
call fcn.14000b6f0
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll__strdup]
mov rcx, rax
call fcn.14000ea10
lea rcx, str.PGSYSCONFDIR
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x14000a11c
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.14000bef0
lea r9, [rsp + 0x430]
lea r8, str.PGSYSCONFDIR_s
lea rcx, [rsp + 0x20]
mov edx, 0x40e
call fcn.14000c570
lea rcx, [rsp + 0x2d]
call fcn.14000b6f0
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll__strdup]
mov rcx, rax
call fcn.14000ea10
mov rcx, qword [rsp + 0xc30]
xor rcx, rsp
call fcn.14000f6c0
mov rbx, qword [rsp + 0xc60]
add rsp, 0xc40
pop rdi
ret
Function at 0x14000b080
Capabilities:
Get session user name
Terminate process

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, [rsp + 0x38]
lea rcx, [0x140019440]
mov dword [rsp + 0x38], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x14000b0fa
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.user_name_lookup_failure:_error_code__lu
mov ebx, eax
call qword [sym.imp.libintl.dll_libintl_gettext]
mov edx, ebx
mov rcx, rax
call fcn.14000b2f0
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
lea rdx, str._s:__s_n
lea rcx, [rax + 0x60]
mov r9, rbx
mov r8, rdi
call fcn.14000c790
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
mov rbx, qword [rsp + 0x30]
lea rax, [0x140019440]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b2f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov edi, Ordinal_130
xor r14d, r14d
mov rcx, rdi
call fcn.140009e30
mov rbp, qword [rsp + 0x60]
lea rbx, [rsp + 0x68]
mov rsi, rax
call qword [sym.imp.MSVCR120.dll__errno]
mov r9, rbx
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
mov dword [rax], r14d
call fcn.14000c4f0
movsxd rcx, eax
test eax, eax
jns 0x14000b39b
call qword [sym.imp.MSVCR120.dll__errno]
cmp dword [rax], r14d
je 0x14000b362
call qword [sym.imp.MSVCR120.dll__errno]
cmp dword [rax], 0xc
jne 0x14000b3bd
cmp rdi, 0x3fffffff
jae 0x14000b404
mov ebx, 0x3fffffff
cmp rdi, 0x1fffffff
jae 0x14000b381
lea rbx, [rdi + rdi]
mov qword [rsp + 0x20], r14
cmp rbx, rdi
jb 0x14000b3f6
mov rcx, rsi
call fcn.140009ed0
mov rdi, rbx
jmp 0x14000b316
lea rax, [rdi - 1]
mov rbx, rcx
cmp rcx, rax
jb 0x14000b381
cmp rcx, rdi
jbe 0x14000b362
cmp rcx, 0x3ffffffd
ja 0x14000b362
lea eax, [rcx + 2]
movsxd rbx, eax
jmp 0x14000b381
call qword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR120.dll_strerror]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
lea rdx, str.vsnprintf_failed:__s_with_format_string___s__n
lea rcx, [rax + 0x60]
mov r9, rbp
mov r8, rbx
call fcn.14000c790
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
mov rax, rsi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.14000c790
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
Function at 0x14000c670
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x478
mov rax, qword [0x140019330]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
jne 0x14000c6b5
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 0x16
or eax, 0xffffffff
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000f6c0
add rsp, 0x478
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x460], rdi
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x30], rax
call fcn.14000c880
mov rdi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx ebx, byte [rsp + 0x44]
sub rdi, rcx
test bl, bl
jne 0x14000c753
test rdi, rdi
je 0x14000c753
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x468], rsi
mov esi, 1
mov edx, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_fwrite]
mov ecx, dword [rsp + 0x40]
movzx ebx, bl
add ecx, eax
cmp rax, rdi
cmovne ebx, esi
mov rsi, qword [rsp + 0x468]
jmp 0x14000c757
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x460]
or eax, 0xffffffff
test bl, bl
mov rbx, qword [rsp + 0x470]
cmovne ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000f6c0
add rsp, 0x478
ret

Function at 0x14000c810
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000c862
test rdi, rdi
je 0x14000c862
mov r9, qword [rbx + 0x18]
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
mov rax, qword [rbx + 8]
mov qword [rbx], rax
je 0x14000c865
mov byte [rbx + 0x24], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d180
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp dword [rsp + 0x50], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], r14
mov r14, rcx
mov edi, r8d
je 0x14000d1c5
movsxd rax, r9d
mov rbp, rcx
test r9d, r9d
je 0x14000d1c1
nop dword [rax]
dec rax
cmp byte [rbp], 0
je 0x14000d1c1
inc rbp
test rax, rax
jne 0x14000d1b0
sub ebp, ecx
jmp 0x14000d1d9
or rbp, 0xffffffffffffffff
nop dword [rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x14000d1d0
sub edi, ebp
mov eax, 0
cmovs edi, eax
test edx, edx
je 0x14000d1e9
neg edi
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x14000d258
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000d249
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x14000d249
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x14000d216
inc dword [rbx + 0x20]
jmp 0x14000d252
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000d242
test rsi, rsi
je 0x14000d242
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x14000d242
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_34
inc qword [rbx]
dec edi
test edi, edi
jg 0x14000d1f7
mov r8, rbx
mov edx, ebp
mov rcx, r14
call fcn.14000da30
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x14000d2e0
neg edi
movsxd rsi, edi
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000d2d2
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x14000d2d2
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x14000d29f
inc dword [rbx + 0x20]
jmp 0x14000d2db
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000d2cb
test rdi, rdi
je 0x14000d2cb
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000d2cb
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_34
inc qword [rbx]
dec rsi
jne 0x14000d280
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d370
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x80
mov rax, qword [0x140019330]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0xd0]
xor ebp, ebp
movsx eax, dl
add eax, 0xffffffa8
mov r10, rcx
lea r11, str.0123456789abcdef
mov dword [rsp + 0x24], ebp
mov esi, ebp
cmp eax, 0x20
ja case.0x14000d3d5.89
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0xd5c8]
mov ecx, dword [rdx + rax*4 + 0xd5b0]
add rcx, rdx
jmp rcx
mov ecx, 0xa
test r10, r10
jns 0x14000d3ee
mov dword [rsp + 0x24], reloc.LIBPQ.dll_Ordinal_45
neg r10
jmp 0x14000d417
test r8d, r8d
je 0x14000d417
mov dword [rsp + 0x24], Ordinal_48
jmp 0x14000d417
mov ecx, 8
jmp 0x14000d417
mov ecx, 0xa
jmp 0x14000d417
lea r11, str.0123456789ABCDEF
mov ecx, 0x10
mov qword [rsp + 0x90], rdi
mov edi, dword [rsp + 0xc0]
test r10, r10
jne 0x14000d438
cmp dword [rsp + 0xc8], esi
je 0x14000d438
test edi, edi
je 0x14000d45f
lea r8, [rsp + 0x30]
nop dword [rax]
xor edx, edx
mov rax, r10
inc esi
div rcx
lea r8, [r8 + 1]
mov r10, rax
movzx eax, byte [rdx + r11]
mov byte [r8 - 1], al
test r10, r10
jne 0x14000d440
mov eax, dword [rsp + 0xb0]
sub edi, esi
cmovs edi, ebp
sub eax, edi
sub eax, esi
cmovs eax, ebp
mov dword [rsp + 0x20], eax
test r9d, r9d
je 0x14000d481
neg eax
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0xb8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
mov r9, rbx
call fcn.14000dbb0
test edi, edi
jle 0x14000d4d0
nop
mov rax, qword [rbx + 0x10]
dec edi
test rax, rax
je 0x14000d4c3
cmp qword [rbx], rax
jb 0x14000d4c3
cmp qword [rbx + 0x18], rbp
jne 0x14000d4bb
inc dword [rbx + 0x20]
jmp 0x14000d4cc
mov rcx, rbx
call fcn.14000c810
mov rax, qword [rbx]
mov byte [rax], reloc.LIBPQ.dll_Ordinal_48
inc qword [rbx]
test edi, edi
jg 0x14000d4a0
movsxd rdi, esi
test esi, esi
jle 0x14000d517
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
movsx esi, byte [rsp + rdi + 0x2f]
dec rdi
test rax, rax
je 0x14000d509
cmp qword [rbx], rax
jb 0x14000d509
cmp qword [rbx + 0x18], rbp
jne 0x14000d501
inc dword [rbx + 0x20]
jmp 0x14000d512
mov rcx, rbx
call fcn.14000c810
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
test rdi, rdi
jg 0x14000d4e0
mov eax, dword [rsp + 0x20]
test eax, eax
jns 0x14000d584
neg eax
movsxd rsi, eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000d576
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x14000d576
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x14000d543
inc dword [rbx + 0x20]
jmp 0x14000d57f
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], bpl
jne 0x14000d56f
test rdi, rdi
je 0x14000d56f
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000d56f
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_34
inc qword [rbx]
dec rsi
jne 0x14000d524
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000f6c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x14000d5f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
xor eax, eax
lea edi, [r8 - 1]
mov qword [rsp + 0x30], rbp
test edi, edi
mov rbx, r9
mov ebp, ecx
cmovs edi, eax
test edx, edx
je 0x14000d615
neg edi
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x14000d681
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000d672
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x14000d672
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x14000d63f
inc dword [rbx + 0x20]
jmp 0x14000d67b
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000d66b
test rsi, rsi
je 0x14000d66b
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x14000d66b
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_34
inc qword [rbx]
dec edi
test edi, edi
jg 0x14000d620
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000d6a3
cmp qword [rbx], rax
jb 0x14000d6a3
cmp qword [rbx + 0x18], 0
jne 0x14000d69b
inc dword [rbx + 0x20]
jmp 0x14000d6ac
mov rcx, rbx
call fcn.14000c810
mov rax, qword [rbx]
mov byte [rax], bpl
inc qword [rbx]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x14000d720
neg edi
movsxd rsi, edi
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000d712
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x14000d712
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x14000d6df
inc dword [rbx + 0x20]
jmp 0x14000d71b
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000d70b
test rdi, rdi
je 0x14000d70b
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000d70b
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_34
inc qword [rbx]
dec rsi
jne 0x14000d6c0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000da30
Capabilities:
Write file on windows

Disassembly:
test edx, edx
jle 0x14000daf9
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov qword [rsp + 0x30], rsi
mov rbx, r8
mov ebp, edx
mov qword [rsp + 0x38], rdi
mov r14, rcx
nop word [rax + rax]
cmp qword [rbx + 0x10], 0
je 0x14000da6e
mov eax, dword [rbx + 0x10]
sub eax, dword [rbx]
jmp 0x14000da70
mov eax, ebp
test eax, eax
jg 0x14000dab5
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000dadc
mov rcx, qword [rbx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000daac
test rdi, rdi
je 0x14000daac
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000daac
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x14000dad6
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
cmovl esi, eax
mov rdx, r14
movsxd rdi, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_memmove]
add qword [rbx], rdi
add r14, rdi
sub ebp, esi
test ebp, ebp
jg 0x14000da60
jmp 0x14000dadf
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret