joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f450
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
mov qword [0x1005dbe8], rcx
je 0x1001f4e0
dec edx
je 0x1001f4a1
dec edx
je 0x1001f489
dec edx
jne 0x1001f527
lea rcx, str._cmgtc__DLL_THREAD_DETACH._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea rcx, str._cmgtc__DLL_THREAD_ATTACH._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [0x1004b170]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.UIMNG
call fcn.10021950
lea rcx, str._cmgtc__DLL_PROCESS_ATTACH_____._n
mov qword [0x1005da98], rax
mov qword [0x10069720], rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [0x1004b208]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [0x1005dbf8]
test rcx, rcx
je 0x1001f51a
call fcn.1001f550
mov rbx, qword [0x1005dbf8]
test rbx, rbx
je 0x1001f51a
mov rcx, rbx
call fcn.1001f750
mov rcx, rbx
call fcn.100449c0
lea rcx, str._cmgtc__DLL_PROCESS_DETACH_____._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1001fe40
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x1005dcb0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x1005dda8]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1001fec1
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x1005dda8]
jmp 0x1001fedd
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x1005dda8], r11
mov qword [0x1005dd48], rax
mov rax, qword [0x1005d650]
mov qword [0x1005dc20], r11
mov qword [0x1005dd30], rdi
mov dword [0x1005dc10], 0xc0000409
mov dword [0x1005dc14], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x1005d648]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1004b328]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x1005d650]
jne 0x10044fb9
rol rcx, 0x10
test cx, 0xffff
jne 0x10044fb5
ret
ror rcx, 0x10
jmp 0x1001fe40
Function at 0x10020530
Capabilities:
Hash data using djb2

Disassembly:
sub rsp, 0x28
test rcx, rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], r12
mov r12, rdx
mov rsi, rcx
je 0x10020557
mov rcx, qword [rcx]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx ecx, byte [r12]
mov qword [rsp + 0x30], rbx
mov ebx, 0x1505
test ecx, ecx
mov eax, ebx
mov rdx, r12
je 0x1002057f
nop
imul eax, eax, 0x21
inc rdx
add eax, ecx
movzx ecx, byte [rdx]
test ecx, ecx
jne 0x10020570
xor r8d, r8d
lea rcx, [rsi + 8]
mov qword [rsp + 0x48], rdi
xor edx, edx
nop
mov edi, dword [rcx]
test edi, edi
je 0x100205ae
cmp eax, edi
je 0x1002064c
inc rdx
inc r8d
add rcx, 0x28
cmp rdx, 0x14
jl 0x10020590
cmp r8d, 0x14
jge 0x1002066b
movsxd rax, r8d
mov qword [rsp + 0x38], rbp
lea rdx, [0x1004b428]
lea rdi, [rax + rax*4]
xor eax, eax
mov r8, r12
lea rbp, [rsi + rdi*8 + 0xc]
mov rcx, rbp
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call qword [sym.imp.msvcrt.dll_sprintf]
lea r12, [rsi + rdi*8 + 8]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbp
mov dword [r12], 0
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x10020634
movzx eax, byte [rbp]
test eax, eax
je 0x10020630
nop
nop
imul ebx, ebx, 0x21
inc rbp
add ebx, eax
movzx eax, byte [rbp]
test eax, eax
jne 0x10020620
mov dword [r12], ebx
test rsi, rsi
mov rbp, qword [rsp + 0x38]
je 0x10020647
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, r12
jmp 0x1002067b
test rsi, rsi
movsxd rax, r8d
lea rcx, [rax + rax*4]
lea rdi, [rsi + rcx*8 + 8]
je 0x10020666
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, rdi
jmp 0x1002067b
test rsi, rsi
je 0x10020679
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x100206a0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x2d8
mov rax, qword [0x1005d650]
mov qword [rsp + 0x290], rax
test rcx, rcx
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov r12, qword [rsp + 0x300]
mov rbp, r9
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x100206f4
mov rcx, qword [rcx]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x2a8], r13
lea r13, [0x100609b0]
xor edx, edx
mov rcx, r13
mov r8d, 0x1388
call sub.msvcrt.dll_memset
mov r8, r12
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.msvcrt.dll_vsprintf]
lea rcx, [rbx + 0x34c]
xor edx, edx
mov r8d, 0x1400
call sub.msvcrt.dll_memset
xor r11d, r11d
lea rcx, [0x100609a0]
mov qword [0x100609a0], r11
mov qword [0x100609a8], r11
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [0x100609aa]
movzx r8d, word [0x100609a6]
movzx r9d, word [0x100609a2]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rsi
lea rax, [rdi + rdi*2]
movzx edi, word [0x100609a8]
lea rcx, [0x1004b3f8]
lea rcx, [rcx + rax*2]
movzx eax, word [0x100609ac]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r8d
lea rcx, [rbx + 0x34c]
lea r8, str.__02u__02u__02u:_02u:_02u___s___s__s_r_n
mov edx, 0x1388
call fcn.1001ff70
lea rcx, [rbx + 0x34c]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x181]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x180], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x70], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x70]
mov r8b, 1
mov edx, 0x104
call fcn.10038660
lea r9, [rsp + 0x70]
lea r8, str._s_vpn.log
lea rcx, [rsp + 0x180]
mov edx, 0x104
call fcn.1001ff70
xor r12d, r12d
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, qword [rsp + 0x2a8]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x100208e8
lea r9d, [r12 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x500000
jbe 0x100208ac
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
lea rdi, [rbx + 0x34c]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea r9, [rsp + 0x60]
lea rdx, [rbx + 0x34c]
not rcx
mov qword [rsp + 0x20], r12
lea r8, [rcx - 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
mov r12, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x2b8]
mov rsi, qword [rsp + 0x2c0]
mov rbp, qword [rsp + 0x2c8]
je 0x10020916
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rbx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x290]
call fcn.10044fa0
add rsp, 0x2d8
ret
Function at 0x10021950
Capabilities:
Hash data using djb2

Disassembly:
sub rsp, 0x28
mov rax, qword [0x10060980]
mov qword [rsp + 0x40], rbx
mov rbx, rcx
test rax, rax
jne 0x100219dc
mov qword [rsp + 0x48], rdi
lea rdi, [0x10060990]
test rdi, rdi
je 0x1002198b
mov rcx, qword [0x10060990]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x10060980]
test rax, rax
jne 0x100219c5
mov ecx, 0x1750
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x100219b0
mov rcx, rax
call fcn.100216e0
jmp 0x100219b2
xor eax, eax
lea rcx, [0x10020d20]
mov qword [0x10060980], rax
call fcn.10022180
test rdi, rdi
mov rdi, qword [rsp + 0x48]
je 0x100219dc
mov rcx, qword [0x10060990]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x10060980]
mov rdx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
jmp fcn.10020530

Function at 0x100227c0
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
sub rsp, 0xcc8
mov rax, qword [0x1005d650]
mov qword [rsp + 0xca0], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
movsxd rdi, edx
xor edx, edx
mov rbx, r8
mov rsi, rcx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x21]
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0xa0], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x4a1]
xor edx, edx
mov r8d, 0x7ff
mov byte [rsp + 0x4a0], 0
call sub.msvcrt.dll_memset
lea rdx, str.___s__
lea rcx, [rsp + 0x20]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_sprintf]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r9, [rsp + 0xa0]
lea rdx, [0x1004b748]
lea rcx, [rsp + 0x4a0]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_sprintf]
mov rbx, qword [rsp + 0xce8]
mov byte [rdi + rsi], 0
inc edi
xor ecx, ecx
movsxd r8, edi
add r8, rsi
movzx edx, byte [rsp + rcx + 0x4a0]
test dl, dl
je 0x100228c1
inc rcx
mov byte [r8], dl
inc edi
inc r8
cmp rcx, 0x800
jl 0x100228a1
movsxd rcx, edi
mov eax, edi
mov rdi, qword [rsp + 0xcb8]
mov byte [rcx + rsi + 1], 0
mov byte [rcx + rsi + 2], 0
mov rsi, qword [rsp + 0xcc0]
mov rcx, qword [rsp + 0xca0]
call fcn.10044fa0
add rsp, 0xcc8
ret
Function at 0x10023360
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x430
mov rax, qword [0x1005d650]
mov qword [rsp + 0x420], rax
mov rbx, rcx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x20]
test rcx, rcx
mov r8d, 0x400
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
xor edx, edx
mov r8, qword [r8]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
mov rcx, qword [rsp + 0x420]
call fcn.10044fa0
add rsp, 0x430
pop rbx
ret
Function at 0x100233f0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x430
mov rax, qword [0x1005d650]
mov qword [rsp + 0x420], rax
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
xor edx, edx
mov rbx, rcx
mov r8, qword [r8]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, str._ProgramFiles_x86___
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x20]
test rcx, rcx
mov r8d, 0x400
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
xor edx, edx
mov r8, qword [r8]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
mov rcx, qword [rsp + 0x420]
call fcn.10044fa0
add rsp, 0x430
pop rbx
ret
Function at 0x100239c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov r11, rsp
sub rsp, 0x178
mov rax, qword [0x1005d650]
mov qword [rsp + 0x150], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov rsi, rdx
xor edx, edx
mov ebx, ecx
lea ecx, [rdx + 0xa]
mov qword [r11 - 0x18], rdi
mov rbp, r8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x10023a66
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x10023a5d
nop
cmp dword [rsp + 0x40], ebx
jne 0x10023a4b
mov r9d, dword [rsp + 0x28]
mov rdx, rbp
mov rcx, rsi
mov r8d, r9d
call fcn.10023990
test al, al
jne 0x10023a4b
mov r8, rbp
mov rdx, rsi
mov ecx, r9d
call fcn.100239c0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x10023a20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
test rax, rax
mov rbp, qword [rsp + 0x170]
mov rbx, rax
je 0x10023aab
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x150]
call fcn.10044fa0
add rsp, 0x178
ret
Function at 0x100253d0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1005d650]
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x100254a2
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x50], al
call sub.msvcrt.dll_memset
mov r8, qword [rbx + 8]
test r8, r8
lea rdx, [0x1004bccc]
lea rcx, [rsp + 0x50]
cmove r8, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
je 0x1002548b
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x1002548b
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
mov byte [rsp + 0x20], al
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64__class_std::allocator_char__const____ptr64____ptr64]
lea rcx, [rsp + 0x28]
call fcn.100253d0
lea rcx, [rsp + 0x28]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rcx, qword [rbx + 8]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x160]
call fcn.10044fa0
add rsp, 0x170
pop rbx
ret

Function at 0x10025590
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x10], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov rbx, rcx
je 0x100255be
lea rcx, str.Wow64Redirection::disabler_____
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x100255e0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov rbx, rcx
je 0x1002560e
lea rcx, str.Wow64Redirection::restore_____
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [rbx + 0x18]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x100257a0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x4f8
mov rax, qword [0x1005d650]
mov qword [rsp + 0x4d0], rax
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov r8, qword [r8]
mov qword [r11 - 8], rsi
mov rbp, rdx
xor edx, edx
mov qword [r11 - 0x10], rdi
mov rbx, rcx
xor sil, sil
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x87
mov byte [rsp + 0x40], sil
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_OpenFile]
test eax, eax
movsxd rdi, eax
jne 0x10025848
xor ecx, ecx
call fcn.10021fa0
lea rdx, [0x1004bd20]
lea rcx, [rsp + 0x38]
mov rbx, rax
call fcn.100277d0
lea rdx, str._comm__read_file__s__OpenFile_failed:__s
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.100278d0
jmp 0x10025940
mov qword [rsp + 0x4e0], r12
lea rcx, [rsp + 0xd0]
xor r12d, r12d
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x30], r12d
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
mov r8d, 0x400
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100258fa
nop
nop
nop
nop
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64__unsigned_long_long_unsigned___int64_____ptr64]
cmp dword [rsp + 0x30], 0x400
jb 0x1002592c
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x400
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
mov r8d, 0x400
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100258a0
xor ecx, ecx
call fcn.10021fa0
lea rdx, [0x1004bd58]
lea rcx, [rsp + 0x38]
mov rbx, rax
call fcn.100277d0
lea rdx, str._comm__read_file__s__ReadFile_failed:__s
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.100278d0
jmp 0x1002592f
mov sil, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x4e0]
mov rdi, qword [rsp + 0x4e8]
mov rbp, qword [rsp + 0x518]
mov rbx, qword [rsp + 0x510]
mov al, sil
mov rsi, qword [rsp + 0x4f0]
mov rcx, qword [rsp + 0x4d0]
call fcn.10044fa0
add rsp, 0x4f8
ret
Function at 0x100259c0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x108
mov rax, qword [0x1005d650]
mov qword [rsp + 0xd0], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r12
mov r12, rdx
mov rbx, r8
lea rcx, [rsp + 0x41]
xor dil, dil
xor edx, edx
mov r8d, 0x87
mov byte [rsp + 0x40], dil
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
mov r8d, 0x1001
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_OpenFile]
test eax, eax
movsxd rsi, eax
jne 0x10025a5d
xor ecx, ecx
call fcn.10021fa0
lea rdx, [0x1004bd90]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.100277d0
lea rdx, str._comm__write_file__s__OpenFile_failed:__s
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.100278d0
jmp 0x10025abc
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10025ab0
xor ecx, ecx
call fcn.10021fa0
lea rdx, [0x1004bdc8]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.100277d0
lea rdx, str._comm__write_file__s__WriteFile_failed:__s
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.100278d0
jmp 0x10025ab3
mov dil, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0x100]
mov rbx, qword [rsp + 0x128]
mov al, dil
mov rdi, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xd0]
call fcn.10044fa0
add rsp, 0x108
ret