joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009fe00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r12, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r12
lea rdx, [0x1400d1d5f]
lea r8, str.ConditionalExpr
mov rcx, rax
call fcn.14008b170
mov r15, qword [rdi + 0x18]
mov r14, qword [rdi + 0x20]
mov rbx, qword [rdi + 0x28]
mov edi, dword [rdi + 0xc]
mov ecx, 2
call r12
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009fe8b
xor ebp, ebp
nop word [rax + rax]
mov ecx, 2
call r12
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14009fe70
mov byte [rsi + 4], 0
test r15, r15
je 0x14009fea1
mov rcx, r15
mov rdx, rsi
call fcn.14009aca0
jmp 0x14009fec6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
shl edi, 0x1a
sar edi, 0x1a
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, r14
call fcn.14009c420
mov rcx, rsi
mov rdx, rbx
call fcn.14009c420
mov rcx, rsi
mov edx, edi
call fcn.14009f8e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14009ff20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400d1d5f]
lea r8, str.MemberExpr
mov rcx, rax
call fcn.14008b170
mov r14, qword [rdi + 0x18]
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov rbx, qword [rdi + 0x30]
mov edi, dword [rdi + 0xc]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009ffab
xor ebp, ebp
nop word [rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14009ff90
mov byte [rsi + 4], 0
test r14, r14
je 0x14009ffc1
mov rcx, r14
mov rdx, rsi
call fcn.14009aca0
jmp 0x14009ffe6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
shl edi, 0x1a
sar edi, 0x1a
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14009c5e0
mov rcx, rsi
mov rdx, rbx
call fcn.14009c420
mov rcx, rsi
mov edx, edi
call fcn.14009f8e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400a0050
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rbx, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400d1d5f]
lea r8, str.SubobjectExpr
mov rcx, rax
call fcn.14008b170
mov r14, qword [rbx + 0x18]
mov rdi, qword [rbx + 0x20]
movups xmm0, xmmword [rbx + 0x28]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rbx + 0x38]
movaps xmmword [rsp + 0x20], xmm0
movzx ebx, byte [rbx + 0x48]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a00eb
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a00d0
mov byte [rsi + 4], 0
test r14, r14
je 0x1400a0101
mov rcx, r14
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a0126
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rdi
call fcn.14009c420
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14009c5e0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14009d660
mov rcx, rsi
mov edx, ebx
call fcn.14009e340
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400a0390
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400d1d5f]
lea r8, str.SizeofParamPackExpr
mov rcx, rax
call fcn.14008b170
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a040a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a03f0
mov byte [rsi + 4], 0
test rdi, rdi
je 0x1400a0420
mov rcx, rdi
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a0445
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400a0470
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
lea rdx, [0x1400d1d5f]
lea r8, str.CallExpr
mov rcx, rax
call fcn.14008b170
mov rbx, qword [rdi + 0x18]
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov edi, dword [rdi + 0xc]
mov ecx, 2
call r14
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a04fb
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a04e0
mov byte [rsi + 4], 0
test rbx, rbx
je 0x1400a0511
mov rcx, rbx
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a0536
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
shl edi, 0x1a
sar edi, 0x1a
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14009d660
mov rcx, rsi
mov edx, edi
call fcn.14009f8e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400a06c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400d1d5f]
lea r8, str.DeleteExpr
mov rcx, rax
call fcn.14008b170
mov r14, qword [rdi + 0x18]
movzx ebp, byte [rdi + 0x20]
movzx ebx, byte [rdi + 0x21]
mov edi, dword [rdi + 0xc]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a074d
xor r12d, r12d
nop dword [rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc r12d
cmp r12d, dword [rsi]
jne 0x1400a0730
mov byte [rsi + 4], 0
test r14, r14
je 0x1400a0763
mov rcx, r14
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a0788
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
shl edi, 0x1a
sar edi, 0x1a
mov byte [rsi + 4], 1
mov rcx, rsi
mov edx, ebp
call fcn.14009e340
mov rcx, rsi
mov edx, ebx
call fcn.14009e340
mov rcx, rsi
mov edx, edi
call fcn.14009f8e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400a08d0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
lea rdx, [0x1400d1d5f]
lea r8, str.ConversionExpr
mov rcx, rax
call fcn.14008b170
mov rbx, qword [rdi + 0x18]
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov edi, dword [rdi + 0xc]
mov ecx, 2
call r14
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a095b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a0940
mov byte [rsi + 4], 0
test rbx, rbx
je 0x1400a0971
mov rcx, rbx
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a0996
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
shl edi, 0x1a
sar edi, 0x1a
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14009d660
mov rcx, rsi
mov edx, edi
call fcn.14009f8e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400a09f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400d1d5f]
lea r8, str.PointerToMemberConversionExpr
mov rcx, rax
call fcn.14008b170
mov r14, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
movups xmm0, xmmword [rdi + 0x28]
movaps xmmword [rsp + 0x20], xmm0
mov edi, dword [rdi + 0xc]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a0a7b
xor ebp, ebp
nop word [rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a0a60
mov byte [rsi + 4], 0
test r14, r14
je 0x1400a0a91
mov rcx, r14
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a0ab6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
shl edi, 0x1a
sar edi, 0x1a
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rbx
call fcn.14009c420
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14009c5e0
mov rcx, rsi
mov edx, edi
call fcn.14009f8e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400a0b20
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400d1d5f]
lea r8, str.InitListExpr
mov rcx, rax
call fcn.14008b170
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a0b9a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a0b80
mov byte [rsi + 4], 0
test rdi, rdi
je 0x1400a0bb0
mov rcx, rdi
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a0bd5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14009d660
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400a0d30
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400d1d5f]
lea r8, str.ThrowExpr
mov rcx, rax
call fcn.14008b170
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a0daa
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a0d90
mov byte [rsi + 4], 0
test rdi, rdi
je 0x1400a0dc0
mov rcx, rdi
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a0de5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400a0e10
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400d1d5f]
lea r8, str.StringLiteral
mov rcx, rax
call fcn.14008b170
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a0e8a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a0e70
mov byte [rsi + 4], 0
test rdi, rdi
je 0x1400a0ea0
mov rcx, rdi
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a0ec5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400a0ef0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400d1d5f]
lea r8, str.LambdaExpr
mov rcx, rax
call fcn.14008b170
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a0f6a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a0f50
mov byte [rsi + 4], 0
test rdi, rdi
je 0x1400a0f80
mov rcx, rdi
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a0fa5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400a0fd0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400d1d5f]
lea r8, str.EnumLiteral
mov rcx, rax
call fcn.14008b170
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a104a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a1030
mov byte [rsi + 4], 0
test rdi, rdi
je 0x1400a1060
mov rcx, rdi
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a1085
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14009c5e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400a10d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400d1d5f]
lea r8, str.BracedExpr
mov rcx, rax
call fcn.14008b170
mov r14, qword [rbx + 0x18]
mov rdi, qword [rbx + 0x20]
movzx ebx, byte [rbx + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a115b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a1140
mov byte [rsi + 4], 0
test r14, r14
je 0x1400a1171
mov rcx, r14
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a1196
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rdi
call fcn.14009c420
mov rcx, rsi
mov edx, ebx
call fcn.14009e340
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400a11e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400d1d5f]
lea r8, str.BracedRangeExpr
mov rcx, rax
call fcn.14008b170
mov r14, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
mov rdi, qword [rdi + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400a126b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400a1250
mov byte [rsi + 4], 0
test r14, r14
je 0x1400a1281
mov rcx, r14
mov rdx, rsi
call fcn.14009aca0
jmp 0x1400a12a6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rbx
call fcn.14009c420
mov rcx, rsi
mov rdx, rdi
call fcn.14009c420
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400bb520
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov al, byte [0x1400f4fa0]
test al, al
je 0x1400bb61f
cmp qword [0x14225b8f0], 0
je 0x1400bb590
mov rax, qword [0x1400dc700]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
mov r8, qword [0x14225ba48]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.14002a5b0
mov rax, qword [0x1400dc6f0]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
mov r8, qword [0x14225b9f8]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.14002a5b0
call fcn.1400bb730
movzx eax, byte [rsi]
test al, 1
je 0x1400bb59d
mov rax, qword [rsi + 8]
jmp 0x1400bb59f
shr eax, 1
test rax, rax
je 0x1400bb617
lea rcx, [0x14225b870]
mov rdx, rsi
mov r8d, 0x10
call fcn.1400bb770
cmp qword [0x14225b8f0], 0
je 0x1400bb655
mov rax, qword [0x1400dc6f0]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
lea r8, [0x14225b9b8]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.14002a5b0
mov rax, qword [0x1400dc700]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
lea r8, [0x14225ba08]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14002a5b0
nop
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1400f4fa0]
call fcn.14003b100
test eax, eax
je 0x1400bb537
call fcn.1400bb690
lea rcx, [0x1400bb720]
call fcn.140037d90
lea rcx, [0x1400f4fa0]
call fcn.14003b1db
jmp 0x1400bb537
mov rdi, qword [0x1400dc6f8]
lea rdx, str.Unable_to_open_debug_log_file
mov rcx, rdi
call fcn.14001de90
mov rcx, rdi
mov rdx, rsi
call fcn.14001de60
mov rcx, rdi
call fcn.14001e220
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3