joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400258f0
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xc0
mov edi, 1
lea rcx, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov r9d, edi
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
xor ebx, ebx
test eax, eax
je 0x140025955
mov rcx, qword [rsp + 0xd0]
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1f]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0xd0]
test eax, eax
cmovne edi, ebx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
je 0x1400259c1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
call fcn.140023880
mov rcx, rbx
movups xmm0, xmmword [0x140041a00]
mov dword [rsp + 0x34], eax
mov eax, dword [0x1400473c8]
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + rcx + 0x30]
add rcx, 6
xor byte [rsp + rcx + 0x2b], al
movzx eax, byte [rsp + rcx + 0x2b]
xor byte [rsp + rcx + 0x2c], al
movzx eax, byte [rsp + rcx + 0x2c]
xor byte [rsp + rcx + 0x2d], al
movzx eax, byte [rsp + rcx + 0x2d]
xor byte [rsp + rcx + 0x2e], al
movzx eax, byte [rsp + rcx + 0x2e]
xor byte [rsp + rcx + 0x2f], al
movzx eax, byte [rsp + rcx + 0x2f]
xor byte [rsp + rcx + 0x30], al
cmp rcx, 0x1e
jl 0x140025981
lea rcx, [rsp + 0x60]
call fcn.140029978
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov r8d, 0x20
call fcn.14002a208
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.14002989c
lea rdx, [0x140000000]
nop word [rax + rax]
movzx ecx, byte [rsp + rbx + 0x50]
inc rbx
mov eax, ecx
and ecx, 0xf
shr rax, 4
movzx eax, byte [rax + rdx + 0x39908]
mov byte [rdx + rbx*2 + 0x47606], al
movzx eax, byte [rcx + rdx + 0x39908]
mov byte [rdx + rbx*2 + 0x47607], al
cmp rbx, 0x10
jl 0x140025a00
lea r8, [0x140047698]
lea rdx, [rsp + 0x30]
lea rcx, [0x140047420]
mov r9d, 0x20
call fcn.14002bc60
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rdi
ret
Function at 0x1400265b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, edx
mov rbp, rcx
test edx, edx
jle 0x14002660b
nop
mov rcx, qword [0x1400473e8]
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp eax, 0xffffffff
jne 0x140026605
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd8bb
test eax, 0xfffffffa
je 0x140026625
add ebx, esi
cmp ebx, edi
jl 0x1400265d0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x140026610
Function at 0x14002af70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14002b1a0
xor r10d, r10d
lea edx, [rax*4]
mov r11d, eax
movsxd r9, edx
test edx, edx
jle 0x14002afe9
lea r8, [rbx + 8]
lea rcx, [rbx + 8]
lea r8, [r8 + r9*4]
nop
mov eax, dword [r8 - 8]
mov edx, dword [rcx - 8]
add r10, 4
mov dword [rcx - 8], eax
mov eax, dword [r8 - 4]
mov dword [r8 - 8], edx
mov edx, dword [rcx - 4]
mov dword [rcx - 4], eax
mov eax, dword [r8]
mov dword [r8 - 4], edx
mov edx, dword [rcx]
mov dword [rcx], eax
mov eax, dword [r8 + 4]
mov dword [r8], edx
mov edx, dword [rcx + 4]
mov dword [rcx + 4], eax
sub r9, 4
mov dword [r8 + 4], edx
lea r8, [r8 - 0x10]
lea rcx, [rcx + 0x10]
cmp r10, r9
jl 0x14002afa0
cmp r11d, 1
jle 0x14002b18d
mov qword [rsp + 0x30], rdi
add rbx, 2
lea r10d, [r11 - 1]
lea rdi, [0x140000000]
nop word [rax + rax]
mov r8d, dword [rbx + 0xe]
lea rbx, [rbx + 0x10]
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x3b0c0]
movzx eax, byte [rbx - 1]
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
mov r9d, dword [rdi + rdx*4 + 0x3b4c0]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x3bcc0]
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
movzx eax, byte [rbx]
xor r9d, dword [rdi + rcx*4 + 0x3c0c0]
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
movzx eax, byte [rbx + 3]
movzx edx, byte [rdi + rax*4 + 0x3b0c0]
xor r9d, dword [rdi + rcx*4 + 0x3b8c0]
movzx eax, byte [rbx + 4]
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
mov r8d, dword [rdi + rdx*4 + 0x3bcc0]
mov dword [rbx - 2], r9d
xor r8d, dword [rdi + rcx*4 + 0x3b8c0]
mov r9d, dword [rbx + 2]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
movzx eax, r9b
mov r9d, dword [rbx + 6]
xor r8d, dword [rdi + rcx*4 + 0x3b4c0]
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
movzx eax, byte [rbx + 7]
xor r8d, dword [rdi + rcx*4 + 0x3c0c0]
movzx edx, byte [rdi + rax*4 + 0x3b0c0]
movzx eax, byte [rbx + 8]
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
mov dword [rbx + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0x3bcc0]
xor r8d, dword [rdi + rcx*4 + 0x3b8c0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
movzx eax, r9b
mov r9d, dword [rbx + 0xa]
xor r8d, dword [rdi + rcx*4 + 0x3b4c0]
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
movzx eax, byte [rbx + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x3c0c0]
movzx edx, byte [rdi + rax*4 + 0x3b0c0]
movzx eax, byte [rbx + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
mov dword [rbx + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0x3bcc0]
xor r8d, dword [rdi + rcx*4 + 0x3b8c0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x3b4c0]
movzx ecx, byte [rdi + rax*4 + 0x3b0c0]
xor r8d, dword [rdi + rcx*4 + 0x3c0c0]
mov dword [rbx + 0xa], r8d
dec r10
jne 0x14002b010
mov rdi, qword [rsp + 0x30]
mov eax, r11d
add rsp, 0x20
pop rbx
ret
Function at 0x14002b6b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rdi, rdx
mov rax, r9
mov r12, r9
cqo
mov rbx, r8
mov r13, rcx
and edx, 0xf
add rax, rdx
mov rbp, rax
and eax, 0xf
sub rax, rdx
sar rbp, 4
mov rsi, rax
test rax, rax
je 0x14002b6fb
test rbp, rbp
jne 0x14002b6f8
xor eax, eax
jmp 0x14002b8d9
dec rbp
mov qword [rsp + 0x80], r14
mov r14, qword [rsp + 0xa0]
movups xmm0, xmmword [r14]
movups xmm1, xmm0
movups xmmword [rsp + 0x20], xmm0
test rbp, rbp
je 0x14002b782
mov qword [rsp + 0x88], r15
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r13 + 4]
lea rcx, [r13 + 0xf8]
mov r9, rbx
mov r8, rdi
call fcn.14002a340
mov eax, dword [rsp + 0x20]
add rdi, 0x10
xor dword [rbx], eax
mov eax, dword [rsp + 0x24]
add rbx, 0x10
xor dword [rbx - 0xc], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx - 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx - 4], eax
movups xmm0, xmmword [rdi - 0x10]
movups xmm1, xmm0
movups xmmword [rsp + 0x20], xmm0
dec rbp
jne 0x14002b730
mov r15, qword [rsp + 0x88]
test rsi, rsi
je 0x14002b8ca
movups xmm0, xmmword [rdi]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, [r13 + 0xf8]
movups xmmword [r14], xmm0
mov edx, dword [r13 + 4]
movups xmmword [rsp + 0x40], xmm0
call fcn.14002a340
xor r9d, r9d
test rsi, rsi
je 0x14002b895
cmp rsi, 0x10
jb 0x14002b859
lea r10, [rsi + 0xf]
lea rdx, [rsi + 0xf]
lea r8, [rbx + 0x10]
add r10, rdi
add rdx, rbx
lea rcx, [rdi + 0x10]
cmp r8, r10
ja 0x14002b7e7
cmp rdx, rcx
jae 0x14002b859
lea rax, [rsp + rsi + 0x2f]
cmp r8, rax
ja 0x14002b7fb
lea r8, [rsp + 0x30]
cmp rdx, r8
jae 0x14002b859
lea rdx, [rsp + 0x30]
cmp rdx, r10
ja 0x14002b80a
cmp rax, rcx
jae 0x14002b859
mov rax, rsi
mov rdx, rsi
lea r8, [rsp + 0x30]
and eax, 0xf
sub r8, rdi
sub rdx, rax
mov rax, rbx
sub rax, rdi
nop dword [rax]
nop dword [rax + rax]
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [r8 + rcx - 0x10]
add r9, 0x10
lea rcx, [rcx + 0x10]
pxor xmm0, xmm1
movdqu xmmword [rax + rcx - 0x10], xmm0
movdqu xmmword [r8 + rcx - 0x20], xmm1
cmp r9, rdx
jb 0x14002b830
cmp r9, rsi
jae 0x14002b895
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x30]
mov r10, rbx
sub rdi, rax
sub r10, rcx
lea r8, [rsp + 0x30]
add r8, r9
inc r9
movzx eax, byte [r8 + rdi + 0x10]
movzx edx, al
xor dl, byte [r8]
mov byte [r8], al
mov byte [r8 + r10 + 0x10], dl
cmp r9, rsi
jb 0x14002b871
mov edx, dword [r13 + 4]
lea r8, [rsp + 0x30]
lea rcx, [r13 + 0xf8]
mov r9, rbx
call fcn.14002a340
mov eax, dword [rsp + 0x20]
xor dword [rbx], eax
mov eax, dword [rsp + 0x24]
xor dword [rbx + 4], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx + 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx + 0xc], eax
jmp 0x14002b8ce
movups xmmword [r14], xmm1
mov r14, qword [rsp + 0x80]
mov rax, r12
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x2fc548250
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc549330
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc548c52
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc56b108]
test eax, eax
je 0x2fc548cea
lea rax, [0x2fc56b0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc56b110]
mov qword [rbp - 8], rax
jmp 0x2fc548cce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc548cc2
cmp qword [rbp - 0x10], 0
je 0x2fc548cc2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc548c88
lea rax, [0x2fc56b0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc548ceb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc548df0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc548e18
mov eax, 0
jmp 0x2fc548e66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc548e41
mov eax, 0
jmp 0x2fc548e66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc548e61
mov eax, 0
jmp 0x2fc548e66
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc548e6c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc548eea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc548ee1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc548ee1
mov rax, qword [rbp - 8]
jmp 0x2fc548eff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc548eb4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cfca0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d0d80
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d06a2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d073a
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d071e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d0712
cmp qword [rbp - 0x10], 0
je 0x2fc4d0712
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d06d8
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d073b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d0840
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d0868
mov eax, 0
jmp 0x2fc4d08b6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d0891
mov eax, 0
jmp 0x2fc4d08b6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d08b1
mov eax, 0
jmp 0x2fc4d08b6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d08bc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d093a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d0931
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d0931
mov rax, qword [rbp - 8]
jmp 0x2fc4d094f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d0904
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d3a20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d4b00
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d4422
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d44ba
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d449e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d4492
cmp qword [rbp - 0x10], 0
je 0x2fc4d4492
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d4458
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d44bb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d45c0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d45e8
mov eax, 0
jmp 0x2fc4d4636
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4611
mov eax, 0
jmp 0x2fc4d4636
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d4631
mov eax, 0
jmp 0x2fc4d4636
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d463c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d46ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d46b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d46b1
mov rax, qword [rbp - 8]
jmp 0x2fc4d46cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d4684
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001f2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f76
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f78
xor al, al
add rsp, 0x28
ret
Function at 0x402000
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x20
call fcn.00401000
add rsp, 0x20
sub rsp, 0x20
mov rcx, str.kernel32.dll
mov rdx, 0x404114
call fcn.00402430
add rsp, 0x20
test rax, rax
jne 0x40204d
sub rsp, 0x20
mov rcx, str.psapi.dll
mov rdx, 0x404114
call fcn.00402430
add rsp, 0x20
test rax, rax
je 0x4020b7
sub rsp, 0x20
call fcn.00402231
add rsp, 0x20
test rax, rax
je 0x4020b7
sub rsp, 0x20
mov rcx, 0x404138
mov rdx, qword [0x00404008]
call fcn.004024c4
add rsp, 0x20
test rax, rax
jne 0x402095
sub rsp, 0x20
mov rcx, str.Failed__n
call fcn.00401169
add rsp, 0x20
jmp 0x4020b7
xor eax, eax
mov eax, dword [0x00404134]
add eax, 4
sub rsp, 0x20
mov rcx, 0x404134
mov rdx, rax
call fcn.004020d9
add rsp, 0x20
sub rsp, 0x20
call fcn.0040104a
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x402231
Capabilities:
Accept command line arguments

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
push rbx
push rsi
mov qword [rbp - 0x20], 0
xor rdi, rdi
sub rsp, 0x20
mov rcx, str.Cmdl:
call fcn.00401169
add rsp, 0x20
sub rsp, 0x20
call qword [sym.imp.kernel32.dll_GetCommandLineA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
mov rdx, 0
call fcn.0040108f
add rsp, 0x20
mov rsi, rax
mov rax, 0x20
sub rsp, 0x20
mov rcx, rsi
mov rdx, rax
call fcn.00401385
add rsp, 0x20
test rax, rax
je 0x4023c2
lea rsi, [rax + 1]
sub rsp, 0x20
mov rcx, 0x404010
mov rdx, rsi
call fcn.004012c0
add rsp, 0x20
sub rsp, 0x40
mov rcx, rsi
movabs rdx, 0x80000000
mov r8, 1
mov r9, 0
mov qword [rsp + 0x20], 3
mov qword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x30], 0
call qword [sym.imp.kernel32.dll_CreateFileA]
add rsp, 0x40
mov rbx, rax
inc rax
je 0x4023b0
sub rsp, 0x20
mov rcx, rbx
mov rdx, 0
call qword [sym.imp.kernel32.dll_GetFileSize]
add rsp, 0x20
test eax, eax
je 0x402398
lea edi, [eax + 4]
sub rsp, 0x20
mov rcx, 0x40
mov rdx, rdi
call qword [sym.imp.kernel32.dll_LocalAlloc]
add rsp, 0x20
mov qword [rbp - 0x18], rax
test rax, rax
je 0x402398
sub rsp, 0x30
mov rcx, rbx
mov rdx, qword [rbp - 0x18]
mov r8, rdi
lea r9, [rbp - 0x10]
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_ReadFile]
add rsp, 0x30
test rax, rax
je 0x402398
mov eax, dword [rbp - 0x10]
mov qword [section..bss], rax
mov rax, qword [rbp - 0x18]
mov qword [0x00404008], rax
mov qword [rbp - 0x20], 1
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
cmp qword [rbp - 0x20], 1
je 0x4023c2
sub rsp, 0x20
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.kernel32.dll_LocalFree]
add rsp, 0x20
mov rax, qword [rbp - 0x20]
pop rsi
pop rbx
leave
ret