joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b7970
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
cmp byte [0x14012ced2], 1
jne 0x1400b7991
mov al, byte [0x14012ced1]
test al, al
jne 0x1400b79b5
jmp 0x1400b79d5
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x14012ced1]
mov byte [0x14012ced2], 1
test al, al
je 0x1400b79d5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.1400b6730
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [rax + 0x48]
xor ecx, ecx
cmp qword [rsi + 8], 0
mov eax, 0xffffe66b
cmovne eax, ecx
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400b7a00
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [0x14012ced2], 1
jne 0x1400b7a1d
mov al, byte [0x14012ced1]
test al, al
jne 0x1400b7a41
jmp 0x1400b7a5e
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x14012ced1]
mov byte [0x14012ced2], 1
test al, al
je 0x1400b7a5e
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:___unw_resume_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.1400b6730
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
mov eax, 0xffffe674
add rsp, 0x20
pop rsi
ret

Function at 0x1400b7a80
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp byte [0x14012ced2], 1
jne 0x1400b7aaa
mov al, byte [0x14012ced1]
test al, al
jne 0x1400b7ace
jmp 0x1400b7af2
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x14012ced1]
mov byte [0x14012ced2], 1
test al, al
je 0x1400b7af2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], edi
lea rdx, str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
mov rcx, rax
mov r8, rsi
mov r9, rbx
call fcn.1400b6730
mov rax, qword [rsi]
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [rax + 0x60]
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400b7c90
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x14012cec1], 1
jne 0x1400b7ca8
mov al, byte [0x14012cec0]
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_UNWINDING
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x14012cec0]
mov byte [0x14012cec1], 1
add rsp, 0x28
ret
Function at 0x1400bfe30
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
add dword [rcx], 2
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, [0x14010ab64]
lea r8, str.SpecialName
mov rcx, rax
call fcn.1400b6730
mov r15, qword [rbx + 0x10]
mov r12, qword [rbx + 0x18]
mov r14, qword [rbx + 0x20]
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400bfebb
xor ebx, ebx
nop word cs:[rax + rax]
nop dword [rax + rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rsi]
jne 0x1400bfea0
mov byte [rsi + 4], 0
mov ecx, 2
call rdi
sub r12d, r15d
lea rdx, str.__.s_
mov rcx, rax
mov r8d, r12d
mov r9, r15
call fcn.1400b6730
mov ecx, 2
call rdi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400bff2b
xor ebx, ebx
nop dword [rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rsi]
jne 0x1400bff10
mov byte [rsi + 4], 0
test r14, r14
je 0x1400bff41
mov rcx, r14
mov rdx, rsi
call fcn.1400bdf40
jmp 0x1400bff66
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400c16f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, rdx
mov rsi, rcx
add dword [rcx], 2
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, [0x14010ab64]
lea r8, str.EnclosingExpr
mov rcx, rax
call fcn.1400b6730
mov r15, qword [rbx + 0x10]
mov r12, qword [rbx + 0x18]
mov r14, qword [rbx + 0x20]
movups xmm0, xmmword [rbx + 0x28]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400c177b
xor ebx, ebx
nop word [rax + rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rsi]
jne 0x1400c1760
mov byte [rsi + 4], 0
mov ecx, 2
call rdi
sub r12d, r15d
lea rdx, str.__.s_
mov rcx, rax
mov r8d, r12d
mov r9, r15
call fcn.1400b6730
mov ecx, 2
call rdi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400c17eb
xor ebx, ebx
nop dword [rax]
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rsi]
jne 0x1400c17d0
mov byte [rsi + 4], 0
test r14, r14
je 0x1400c1801
mov rcx, r14
mov rdx, rsi
call fcn.1400bdf40
jmp 0x1400c1826
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400c2e30
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400c2a90
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov rdi, qword [rdx + 8]
add dword [rcx], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7b
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
test rdi, rdi
je 0x1400c2bba
lea r12, [rbx + rdi*8]
mov al, 1
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r15, str._null_
jmp 0x1400c2b17
mov ecx, 2
call rdi
mov edx, 6
mov r8d, 1
mov rcx, r15
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
add rbx, 8
xor eax, eax
cmp rbx, r12
je 0x1400c2bba
mov r13, qword [rbx]
test al, 1
je 0x1400c2b30
test r13, r13
je 0x1400c2b98
mov rcx, r13
mov rdx, rsi
call fcn.1400bdf40
jmp 0x1400c2b08
mov ecx, 2
call rdi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400c2b7b
xor ebp, ebp
nop
mov ecx, 2
call rdi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400c2b60
mov byte [rsi + 4], 0
test r13, r13
je 0x1400c2ae7
mov rcx, r13
mov rdx, rsi
call fcn.1400bdf40
jmp 0x1400c2b04
mov ecx, 2
call rdi
mov edx, 6
mov r8d, 1
mov rcx, r15
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x1400c2b08
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7d
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xffffffff
cmp qword [r14 + 8], 0
je 0x1400c2be0
mov byte [rsi + 4], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400c2c00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
add dword [rcx], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7b
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400c2d2a
mov rdi, qword [rdi]
lea r15, [rdi + rax*8]
mov al, 1
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r14, str._null_
jmp 0x1400c2c85
mov ecx, 2
call rbx
mov edx, 6
mov r8d, 1
mov rcx, r14
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
add rdi, 8
xor eax, eax
cmp rdi, r15
je 0x1400c2d2a
mov r12, qword [rdi]
test al, 1
je 0x1400c2ca0
test r12, r12
je 0x1400c2d08
mov rcx, r12
mov rdx, rsi
call fcn.1400bdf40
jmp 0x1400c2c76
mov ecx, 2
call rbx
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400c2ceb
xor ebp, ebp
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400c2cd0
mov byte [rsi + 4], 0
test r12, r12
je 0x1400c2c55
mov rcx, r12
mov rdx, rsi
call fcn.1400bdf40
jmp 0x1400c2c72
mov ecx, 2
call rbx
mov edx, 6
mov r8d, 1
mov rcx, r14
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x1400c2c76
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7d
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xffffffff
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400c2d60
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400c2dbb
xor ebp, ebp
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400c2da0
mov byte [rsi + 4], 0
mov rsi, qword [rdi]
test r15, r15
je 0x1400c2dd4
mov rcx, r15
mov rdx, rsi
call fcn.1400bdf40
jmp 0x1400c2df9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, qword [rdi]
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
call fcn.1400c2e30
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400c2e30
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rdi, rcx
mov bl, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x1400c2eb1
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400c2eab
xor ebx, ebx
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400c2e90
mov byte [rdi + 4], 0
jmp 0x1400c2ecb
lea rcx, [0x14010ab81]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rdi, qword [r14]
mov esi, dword [r14 + 8]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
sub esi, edi
lea rdx, str.__.s_
mov rcx, rax
mov r8d, esi
mov r9, rdi
call fcn.1400b6730
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400c2f00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r14, r9
mov r15, r8
mov r12, rdx
mov rdi, rcx
mov rbx, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbx], 0
je 0x1400c2f6b
xor ebp, ebp
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
nop dword [rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rbx]
jne 0x1400c2f50
mov byte [rbx + 4], 0
mov rbx, qword [rdi]
test r12, r12
je 0x1400c2f84
mov rcx, r12
mov rdx, rbx
call fcn.1400bdf40
jmp 0x1400c2fa9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rbx + 4], 1
mov rcx, qword [rdi]
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
call fcn.1400c2e30
mov rdi, qword [rdi]
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400c301b
xor ebx, ebx
nop dword [rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400c3000
mov byte [rdi + 4], 0
test r14, r14
je 0x1400c3031
mov rcx, r14
mov rdx, rdi
call fcn.1400bdf40
jmp 0x1400c3056
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400c3070
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, edx
mov rdi, rcx
mov bl, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x1400c31fa
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400c30eb
xor ebx, ebx
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400c30d0
mov byte [rdi + 4], 0
test ebp, ebp
je 0x1400c321c
test bpl, 1
je 0x1400c3150
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualConst
mov edx, 9
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
and ebp, 0xfffffffe
je 0x1400c31f1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14010abdd]
mov edx, 3
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test bpl, 2
je 0x1400c31a5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualVolatile
mov edx, 0xc
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
and ebp, 0xfffffffd
je 0x1400c31f1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14010abdd]
mov edx, 3
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test bpl, 4
je 0x1400c31f1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualRestrict
mov edx, 0xc
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test ebp, 0xfffffffb
je 0x1400c31f1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14010abdd]
mov edx, 3
jmp 0x1400c3233
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x14010ab81]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test ebp, ebp
jne 0x1400c30f7
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QualNone
mov edx, 8
mov r8d, 1
mov r9, rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
Function at 0x1400c3250
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, rdx
mov rdi, rcx
mov rbx, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbx], 0
je 0x1400c32ab
xor ebp, ebp
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop dword [rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rbx]
jne 0x1400c3290
mov byte [rbx + 4], 0
mov rdi, qword [rdi]
test r14, r14
je 0x1400c32c4
mov rcx, r14
mov rdx, rdi
call fcn.1400bdf40
jmp 0x1400c32e9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400c3300
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov r12, rdx
mov r15, rcx
mov rsi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400c335b
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add edi, 1
cmp edi, dword [rsi]
jne 0x1400c3340
mov byte [rsi + 4], 0
mov rdi, qword [r12]
mov ebx, dword [r12 + 8]
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
sub ebx, edi
lea rdx, str.__.s_
mov rcx, rax
mov r8d, ebx
mov r9, rdi
call fcn.1400b6730
mov rdi, qword [r15]
mov ecx, 2
call rsi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400c33db
xor ebx, ebx
nop
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400c33c0
mov byte [rdi + 4], 0
test r14, r14
je 0x1400c33f1
mov rcx, r14
mov rdx, rdi
call fcn.1400bdf40
jmp 0x1400c3416
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400c3430
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400c348b
xor ebp, ebp
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rsi]
jne 0x1400c3470
mov byte [rsi + 4], 0
mov rsi, qword [rdi]
test r15, r15
je 0x1400c34a4
mov rcx, r15
mov rdx, rsi
call fcn.1400bdf40
jmp 0x1400c34c9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rdi, qword [rdi]
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400c352b
xor ebx, ebx
nop word cs:[rax + rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rdi]
jne 0x1400c3510
mov byte [rdi + 4], 0
test r14, r14
je 0x1400c3541
mov rcx, r14
mov rdx, rdi
call fcn.1400bdf40
jmp 0x1400c3566
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400c3580
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, edx
mov rsi, rcx
mov bl, byte [rcx + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x1400c3629
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400c35fb
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add edi, 1
cmp edi, dword [rsi]
jne 0x1400c35e0
mov byte [rsi + 4], 0
cmp bpl, 2
je 0x1400c3649
cmp bpl, 1
je 0x1400c365d
test bpl, bpl
jne 0x1400c368a
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.FunctionRefQual::FrefQualNone
mov edx, 0x1d
jmp 0x1400c3674
lea rcx, [0x14010ab81]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp bpl, 2
jne 0x1400c3605
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.FunctionRefQual::FrefQualRValue
jmp 0x1400c366f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.FunctionRefQual::FrefQualLValue
mov edx, 0x1f
mov r8d, 1
mov r9, rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret