joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400185f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
xor eax, eax
cmp qword [rcx + 0x78], 0
je 0x140018738
mov rsi, rcx
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x1400187c4
mov edx, dword [rsi + 0x94]
test dl, 0x10
jne 0x140018653
test dl, 8
je 0x140018738
mov eax, dword [rsi + 0x8c]
mov dword [rsp + 0x34], eax
cmp byte [rsi + 0x9a], 0
je 0x1400186f4
mov rdx, qword [rsi + 0x20]
sub rdx, qword [rsi + 0x18]
jmp 0x14001871a
mov rax, qword [rsi + 0x30]
cmp rax, qword [rsi + 0x28]
je 0x14001867b
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x68]
mov ecx, eax
mov eax, 0xffffffff
cmp ecx, 0xffffffff
je 0x140018738
lea rdi, [rsi + 0x88]
lea r15, [rsp + 0x38]
nop word [rax + rax]
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
mov r9, qword [rsi + 0x60]
add r9, r8
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
call qword [rax + 0x28]
mov ebx, eax
mov r14, qword [rsp + 0x38]
mov rcx, qword [rsi + 0x40]
mov r9, qword [rsi + 0x78]
sub r14, rcx
mov edx, 1
mov r8, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, r14
jne 0x140018733
cmp ebx, 1
je 0x140018690
cmp ebx, 2
je 0x140018733
mov rcx, qword [rsi + 0x78]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov ecx, eax
mov eax, 0
test ecx, ecx
jne 0x140018733
jmp 0x140018738
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r9, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
sub rdx, r9
test eax, eax
jle 0x14001877c
mov rcx, qword [rsi + 0x20]
sub rcx, qword [rsi + 0x18]
mov eax, eax
imul rcx, rax
add rdx, rcx
xor edi, edi
mov rcx, qword [rsi + 0x78]
neg rdx
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
je 0x140018744
mov eax, 0xffffffff
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
test dil, dil
je 0x140018753
mov eax, dword [rsp + 0x34]
mov dword [rsi + 0x88], eax
mov rax, qword [rsi + 0x40]
mov qword [rsi + 0x50], rax
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x94], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
xor eax, eax
jmp 0x140018738
mov rax, qword [rsi + 0x18]
cmp rax, qword [rsi + 0x20]
je 0x14001871a
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
sub rax, qword [rsi + 0x10]
mov r10, qword [rcx]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x34]
mov rdi, rdx
mov rdx, rax
call qword [r10 + 0x40]
mov rdx, rdi
cdqe
add rdx, qword [rsi + 0x48]
add rax, qword [rsi + 0x40]
sub rdx, rax
mov dil, 1
jmp 0x14001871c
call fcn.140018090
int3
Function at 0x14006ca30
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140107180]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140107160]
test rbx, rbx
je 0x14006ca84
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14006ca7b
test rsi, rsi
je 0x14006ca7b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14006ca60
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x140107180]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x14006cd10
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x14006cd50
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov ecx, dword [rax + 0xc]
mov r8d, ecx
cmp r8, rdx
ja 0x14006cd47
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14006cd52
add rax, 0x28
cmp rax, r9
jne 0x14006cd34
xor eax, eax
repz ret

Function at 0x14006ce10
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp word [0x140000000], 0x5a4d
lea rbx, [0x140000000]
mov rsi, rcx
je 0x14006ce34
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rbx
call fcn.14006ccd0
test eax, eax
je 0x14006ce2b
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14006cd10
Function at 0x140078500
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rcx, str.libcabi:
mov edx, 0xb
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 2
call rdi
mov r8, qword [rsp + 0x20]
mov rcx, rax
mov rdx, rsi
call fcn.14006b3d0
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x140078c80
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.140079130
test al, al
je 0x140078cd3
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0llx__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call fcn.14000c090
mov ecx, 2
call r14
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rcx, rbx
mov edx, edi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140079230

Function at 0x140078d60
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.140079130
test al, al
je 0x140078da8
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:__Unwind_SetIP_context_p__value0x_0llx__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.14000c090
mov ecx, 2
call rbx
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rcx, rdi
mov edx, 0xffffffff
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140079230
Function at 0x140078ee0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm12
movaps xmmword [rsp + 0x70], xmm11
movaps xmmword [rsp + 0x60], xmm10
movaps xmmword [rsp + 0x50], xmm9
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rdx
mov rsi, rcx
cmp byte [0x140107531], 1
jne 0x140078f33
cmp byte [0x140107532], 0
jne 0x140078f52
jmp 0x140078f84
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x140107531], 1
test rax, rax
setne byte [0x140107532]
je 0x140078f84
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:___unw_init_local_cursor_p__context_p__n
mov rcx, rax
mov r8, rsi
mov r9, rdi
call fcn.14000c090
mov ecx, 2
call rbx
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
lea rax, [0x1400e9f70]
mov qword [rsi], rax
lea rax, [0x140107530]
mov qword [rsi + 8], rax
lea rax, [rsi + 0x580]
lea rcx, [rsi + 0xb0]
xorps xmm0, xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x50], xmm0
movaps xmmword [rsi + 0x60], xmm0
movaps xmmword [rsi + 0x70], xmm0
movaps xmmword [rsi + 0x80], xmm0
movaps xmmword [rsi + 0x90], xmm0
mov qword [rsi + 0xa0], 0
movaps xmmword [rsi + 0x580], xmm0
movaps xmmword [rsi + 0x590], xmm0
movaps xmmword [rsi + 0x5a0], xmm0
movaps xmmword [rsi + 0x5b0], xmm0
movaps xmmword [rsi + 0x5c0], xmm0
movaps xmmword [rsi + 0x5d0], xmm0
movaps xmmword [rsi + 0x5e0], xmm0
movaps xmmword [rsi + 0x5f0], xmm0
movaps xmmword [rsi + 0x600], xmm0
movaps xmmword [rsi + 0x610], xmm0
movaps xmmword [rsi + 0x620], xmm0
movaps xmmword [rsi + 0x630], xmm0
movaps xmmword [rsi + 0x640], xmm0
movups xmmword [rsi + 0x649], xmm0
mov qword [rsi + 0x80], rcx
mov qword [rsi + 0x98], rax
mov rbx, qword [rdi]
mov r14, qword [rdi + 8]
mov r15, qword [rdi + 0x80]
movups xmm6, xmmword [rdi + 0x10]
movdqu xmm0, xmmword [rdi + 0x30]
pshufd xmm7, xmm0, 0x4e
movdqu xmm0, xmmword [rdi + 0x20]
pshufd xmm8, xmm0, 0x4e
movups xmm9, xmmword [rdi + 0x40]
movups xmm10, xmmword [rdi + 0x50]
movups xmm11, xmmword [rdi + 0x60]
movups xmm12, xmmword [rdi + 0x70]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov dword [rsi + 0xe0], 0x10000b
mov qword [rsi + 0x128], rbx
movaps xmmword [rsi + 0x130], xmm6
mov qword [rsi + 0x140], r14
movdqu xmmword [rsi + 0x148], xmm7
movdqu xmmword [rsi + 0x158], xmm8
movups xmmword [rsi + 0x168], xmm9
movups xmmword [rsi + 0x178], xmm10
movups xmmword [rsi + 0x188], xmm11
movups xmmword [rsi + 0x198], xmm12
mov qword [rsi + 0x1a8], r15
mov rax, qword [rsi]
mov rcx, rsi
xor edx, edx
call qword [rax + 0x68]
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
movaps xmm10, xmmword [rsp + 0x60]
movaps xmm11, xmmword [rsp + 0x70]
movaps xmm12, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140079130
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x140107531], 1
jne 0x14007914c
cmp byte [0x140107532], 0
setne al
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140107532]
mov byte [0x140107531], 1
add rsp, 0x28
ret

Function at 0x140079180
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
mov rbx, rcx
cmp byte [0x140107531], 1
jne 0x1400791a5
cmp byte [0x140107532], 0
jne 0x1400791c4
jmp 0x1400791fd
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x140107531], 1
test rax, rax
setne byte [0x140107532]
je 0x1400791fd
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call fcn.14000c090
mov ecx, 2
call r14
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [rbx]
mov rcx, rbx
mov edx, edi
call qword [rax + 0x10]
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x140079223
mov rax, qword [rbx]
mov rcx, rbx
mov edx, edi
call qword [rax + 0x18]
mov qword [rsi], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140079230
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rbx, r8
mov edi, edx
mov rsi, rcx
cmp byte [0x140107531], 1
jne 0x140079255
cmp byte [0x140107532], 0
jne 0x140079274
jmp 0x1400792ad
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x140107531], 1
test rax, rax
setne byte [0x140107532]
je 0x1400792ad
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rbx
lea rdx, str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_llx__n
mov rcx, rax
mov r8, rsi
mov r9d, edi
call fcn.14000c090
mov ecx, 2
call r14
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [rsi]
mov rcx, rsi
mov edx, edi
call qword [rax + 0x10]
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x140079320
mov rax, qword [rsi]
mov rcx, rsi
mov edx, edi
mov r8, rbx
call qword [rax + 0x20]
xor eax, eax
cmp edi, 0xffffffff
jne 0x140079320
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [rax + 0x48]
mov rax, qword [rsi]
mov rcx, rsi
xor edx, edx
call qword [rax + 0x68]
cmp qword [rsp + 0x50], 0
je 0x14007931e
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xfffffffe
call qword [rax + 0x18]
add rax, qword [rsp + 0x50]
mov r9, qword [rsi]
mov rcx, rsi
mov edx, 0xfffffffe
mov r8, rax
call qword [r9 + 0x20]
xor eax, eax
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400794a0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x140107531], 1
jne 0x1400794bd
cmp byte [0x140107532], 0
jne 0x1400794dc
jmp 0x14007950b
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x140107531], 1
test rax, rax
setne byte [0x140107532]
je 0x14007950b
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.libunwind:___unw_step_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.14000c090
mov ecx, 2
call rdi
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [rsi]
mov rax, qword [rax + 0x40]
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp rax

Function at 0x1400795a0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
cmp byte [0x140107531], 1
jne 0x1400795c1
cmp byte [0x140107532], 0
jne 0x1400795e0
jmp 0x140079612
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x140107531], 1
test rax, rax
setne byte [0x140107532]
je 0x140079612
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.14000c090
mov ecx, 2
call rbx
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [rax + 0x48]
xor ecx, ecx
cmp qword [rsi + 8], 0
mov eax, 0xffffe66b
cmovne eax, ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140079640
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x140107531], 1
jne 0x14007965d
cmp byte [0x140107532], 0
jne 0x14007967c
jmp 0x1400796ab
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x140107531], 1
test rax, rax
setne byte [0x140107532]
je 0x1400796ab
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.libunwind:___unw_resume_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.14000c090
mov ecx, 2
call rdi
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
mov eax, 0xffffe674
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400796c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [0x140107531], 1
jne 0x1400796eb
cmp byte [0x140107532], 0
jne 0x14007970a
jmp 0x140079742
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x140107531], 1
test rax, rax
setne byte [0x140107532]
je 0x140079742
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
mov dword [rsp + 0x20], edi
lea rdx, str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
mov rcx, rax
mov r8, r14
mov r9, rbx
call fcn.14000c090
mov ecx, 2
call r15
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rax, qword [r14]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [rax + 0x60]
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140079910
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x140107533], 1
jne 0x14007992c
cmp byte [0x140107534], 0
setne al
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_UNWINDING
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140107534]
mov byte [0x140107533], 1
add rsp, 0x28
ret
Function at 0x14007d620
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov r14, qword [rdx + 8]
inc dword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7b
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
test r14, r14
je 0x14007d6c5
mov rcx, qword [rbx]
test rcx, rcx
je 0x14007d66f
mov rdx, rsi
call fcn.14007bda0
cmp r14, 1
jne 0x14007d69a
jmp 0x14007d6c5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp r14, 1
je 0x14007d6c5
shl r14, 3
mov r15d, 8
nop word cs:[rax + rax]
mov rdx, qword [rbx + r15]
mov rcx, rsi
call fcn.14007d700
add r15, 8
cmp r14, r15
jne 0x14007d6b0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7d
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
dec dword [rsi]
cmp qword [rdi + 8], 0
je 0x14007d6ea
mov byte [rsi + 4], 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14007d700
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14007d76a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14007d750
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14007d780
mov rcx, rdi
mov rdx, rsi
call fcn.14007bda0
jmp 0x14007d7a5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14007d7c0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400ecccc]
lea r8, str.DotSuffix
mov rcx, rax
call fcn.14000c090
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14007d83a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14007d820
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14007d850
mov rcx, rdi
mov rdx, rsi
call fcn.14007bda0
jmp 0x14007d875
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14007d8b0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14007d8b0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
movzx ebx, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x14007d931
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x14007d92b
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebx
cmp ebx, dword [rdi]
jne 0x14007d910
mov byte [rdi + 4], 0
jmp 0x14007d94b
lea rcx, [0x1400ecce5]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rdi, qword [rsi]
mov esi, dword [rsi + 8]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.__.s_
mov rcx, rax
mov r8d, esi
mov r9, rdi
call fcn.14000c090
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14007d980
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
lea rdx, [0x1400ecccc]
lea r8, str.VendorExtQualType
mov rcx, rax
call fcn.14000c090
mov rbx, qword [rdi + 0x18]
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rdi + 0x30]
mov ecx, 2
call r14
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14007da0b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14007d9f0
mov byte [rsi + 4], 0
test rbx, rbx
je 0x14007da21
mov rcx, rbx
mov rdx, rsi
call fcn.14007bda0
jmp 0x14007da46
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14007d8b0
mov rcx, rsi
mov rdx, rdi
call fcn.14007d700
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14007da90
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
lea rdx, [0x1400ecccc]
lea r8, str.QualType
mov rcx, rax
call fcn.14000c090
mov rbx, qword [rdi + 0x18]
mov edi, dword [rdi + 0x14]
mov ecx, 2
call r14
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14007db0b
xor ebp, ebp
nop dword [rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14007daf0
mov byte [rsi + 4], 0
test rbx, rbx
je 0x14007db21
mov rcx, rbx
mov rdx, rsi
call fcn.14007bda0
jmp 0x14007db46
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov edx, edi
call fcn.14007db80
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret