joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ebf0
Capabilities:
Terminate process
Terminate thread

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x100583c8]
test rcx, rcx
je 0x1001ec08
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp byte [0x10058328], 0
je 0x1001ec2a
mov rcx, qword [0x100583b0]
mov byte [0x10058328], 0
test rcx, rcx
je 0x1001ec2a
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x10058320]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
test rcx, rcx
mov qword [rsp + 0x48], rdi
lea rdi, [0x10046678]
je 0x1001ecff
lea edx, [rbx + 0x64]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1001ecff
mov rcx, qword [0x10058320]
lea rdx, [rsp + 0x38]
mov byte [0x10058328], bl
mov dword [rsp + 0x38], ebx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x38], 0x103
jne 0x1001ecff
mov rcx, qword [0x10058320]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x10058320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10058329], bl
mov dword [0x10058318], ebx
je 0x1001ecff
lea rcx, [0x10058310]
mov qword [0x10058310], rdi
mov byte [0x10058328], bl
call fcn.10008000
mov rcx, qword [0x100583b0]
mov qword [0x10058320], rbx
test rcx, rcx
mov dword [0x10058318], ebx
je 0x1001ecec
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x10058310]
mov qword [0x100583b0], rbx
call fcn.10041bb0
mov rcx, qword [0x10058498]
test rcx, rcx
je 0x1001ed13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp byte [0x100583f8], bl
je 0x1001ed33
mov rcx, qword [0x10058480]
mov byte [0x100583f8], bl
test rcx, rcx
je 0x1001ed33
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x100583f0]
test rcx, rcx
je 0x1001edf7
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1001edf7
mov rcx, qword [0x100583f0]
lea rdx, [rsp + 0x38]
mov byte [0x100583f8], bl
mov dword [rsp + 0x38], ebx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x38], 0x103
jne 0x1001edf7
mov rcx, qword [0x100583f0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x100583f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x100583f9], bl
mov dword [0x100583e8], ebx
je 0x1001edf7
lea rcx, [0x100583e0]
mov qword [0x100583e0], rdi
mov byte [0x100583f8], bl
call fcn.10008000
mov rcx, qword [0x10058480]
mov qword [0x100583f0], rbx
test rcx, rcx
mov dword [0x100583e8], ebx
je 0x1001ede4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100583e0]
mov qword [0x10058480], rbx
call fcn.10041bb0
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x1001f2e0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
mov qword [0x10058bf8], rcx
je 0x1001f370
dec edx
je 0x1001f331
dec edx
je 0x1001f319
dec edx
jne 0x1001f3b7
lea rcx, str._cmgtc__DLL_THREAD_DETACH._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea rcx, str._cmgtc__DLL_THREAD_ATTACH._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [0x10047f60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.UIMNG
call fcn.10024ec0
lea rcx, str._cmgtc__DLL_PROCESS_ATTACH_____._n
mov qword [0x10058a98], rax
mov qword [0x10061f40], rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [0x10047ff8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [0x10058c08]
test rcx, rcx
je 0x1001f3aa
call fcn.1001f3e0
mov rbx, qword [0x10058c08]
test rbx, rbx
je 0x1001f3aa
mov rcx, rbx
call fcn.1001f5e0
mov rcx, rbx
call fcn.10041bb0
lea rcx, str._cmgtc__DLL_PROCESS_DETACH_____._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1001fcd0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x10058cc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x10058db8]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1001fd51
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x10058db8]
jmp 0x1001fd6d
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x10058db8], r11
mov qword [0x10058d58], rax
mov rax, qword [0x10058650]
mov qword [0x10058c30], r11
mov qword [0x10058d40], rdi
mov dword [0x10058c20], 0xc0000409
mov dword [0x10058c24], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x10058648]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x10048118]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x10058650]
jne 0x10042189
rol rcx, 0x10
test cx, 0xffff
jne 0x10042185
ret
ror rcx, 0x10
jmp 0x1001fcd0
Function at 0x10020e00
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
sub rsp, 0xcc8
mov rax, qword [0x10058650]
mov qword [rsp + 0xca0], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
movsxd rdi, edx
xor edx, edx
mov rbx, r8
mov rsi, rcx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x21]
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0xa0], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x4a1]
xor edx, edx
mov r8d, 0x7ff
mov byte [rsp + 0x4a0], 0
call sub.msvcrt.dll_memset
lea rdx, str.___s__
lea rcx, [rsp + 0x20]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_sprintf]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r9, [rsp + 0xa0]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_sprintf]
mov rbx, qword [rsp + 0xce8]
mov byte [rdi + rsi], 0
inc edi
xor ecx, ecx
movsxd r8, edi
add r8, rsi
movzx edx, byte [rsp + rcx + 0x4a0]
test dl, dl
je 0x10020f01
inc rcx
mov byte [r8], dl
inc edi
inc r8
cmp rcx, 0x800
jl 0x10020ee1
movsxd rcx, edi
mov eax, edi
mov rdi, qword [rsp + 0xcb8]
mov byte [rcx + rsi + 1], 0
mov byte [rcx + rsi + 2], 0
mov rsi, qword [rsp + 0xcc0]
mov rcx, qword [rsp + 0xca0]
call fcn.10042170
add rsp, 0xcc8
ret

Function at 0x100219c0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x430
mov rax, qword [0x10058650]
mov qword [rsp + 0x420], rax
mov rbx, rcx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x20]
test rcx, rcx
mov r8d, 0x400
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
xor edx, edx
mov r8, qword [r8]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
mov rcx, qword [rsp + 0x420]
call fcn.10042170
add rsp, 0x430
pop rbx
ret
Function at 0x10021a50
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x430
mov rax, qword [0x10058650]
mov qword [rsp + 0x420], rax
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
xor edx, edx
mov rbx, rcx
mov r8, qword [r8]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, str._ProgramFiles_x86___
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x20]
test rcx, rcx
mov r8d, 0x400
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
xor edx, edx
mov r8, qword [r8]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
mov rcx, qword [rsp + 0x420]
call fcn.10042170
add rsp, 0x430
pop rbx
ret
Function at 0x10022060
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov r11, rsp
sub rsp, 0x178
mov rax, qword [0x10058650]
mov qword [rsp + 0x150], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov rsi, rdx
xor edx, edx
mov ebx, ecx
lea ecx, [rdx + 0xa]
mov qword [r11 - 0x18], rdi
mov rbp, r8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x10022106
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x100220fd
nop
cmp dword [rsp + 0x40], ebx
jne 0x100220eb
mov r9d, dword [rsp + 0x28]
mov rdx, rbp
mov rcx, rsi
mov r8d, r9d
call fcn.10022030
test al, al
jne 0x100220eb
mov r8, rbp
mov rdx, rsi
mov ecx, r9d
call fcn.10022060
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x100220c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
test rax, rax
mov rbp, qword [rsp + 0x170]
mov rbx, rax
je 0x1002214b
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x150]
call fcn.10042170
add rsp, 0x178
ret
Function at 0x10023890
Capabilities:
Hash data using djb2

Disassembly:
sub rsp, 0x28
test rcx, rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], r12
mov r12, rdx
mov rsi, rcx
je 0x100238b7
mov rcx, qword [rcx]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx ecx, byte [r12]
mov qword [rsp + 0x30], rbx
mov ebx, 0x1505
test ecx, ecx
mov eax, ebx
mov rdx, r12
je 0x100238df
nop
imul eax, eax, 0x21
inc rdx
add eax, ecx
movzx ecx, byte [rdx]
test ecx, ecx
jne 0x100238d0
xor r8d, r8d
lea rcx, [rsi + 8]
mov qword [rsp + 0x48], rdi
xor edx, edx
nop
mov edi, dword [rcx]
test edi, edi
je 0x1002390e
cmp eax, edi
je 0x100239ac
inc rdx
inc r8d
add rcx, 0x28
cmp rdx, 0x14
jl 0x100238f0
cmp r8d, 0x14
jge 0x100239cb
movsxd rax, r8d
mov qword [rsp + 0x38], rbp
lea rdx, [0x10048a18]
lea rdi, [rax + rax*4]
xor eax, eax
mov r8, r12
lea rbp, [rsi + rdi*8 + 0xc]
mov rcx, rbp
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call qword [sym.imp.msvcrt.dll_sprintf]
lea r12, [rsi + rdi*8 + 8]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbp
mov dword [r12], 0
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x10023994
movzx eax, byte [rbp]
test eax, eax
je 0x10023990
nop
nop
imul ebx, ebx, 0x21
inc rbp
add ebx, eax
movzx eax, byte [rbp]
test eax, eax
jne 0x10023980
mov dword [r12], ebx
test rsi, rsi
mov rbp, qword [rsp + 0x38]
je 0x100239a7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, r12
jmp 0x100239db
test rsi, rsi
movsxd rax, r8d
lea rcx, [rax + rax*4]
lea rdi, [rsi + rcx*8 + 8]
je 0x100239c6
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, rdi
jmp 0x100239db
test rsi, rsi
je 0x100239d9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x10024ec0
Capabilities:
Hash data using djb2

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1005ba60]
mov qword [rsp + 0x40], rbx
mov rbx, rcx
test rax, rax
jne 0x10024f4c
mov qword [rsp + 0x48], rdi
lea rdi, [0x1005ba70]
test rdi, rdi
je 0x10024efb
mov rcx, qword [0x1005ba70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x1005ba60]
test rax, rax
jne 0x10024f35
mov ecx, 0x1750
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x10024f20
mov rcx, rax
call fcn.10024c50
jmp 0x10024f22
xor eax, eax
lea rcx, [0x10024290]
mov qword [0x1005ba60], rax
call fcn.100207c0
test rdi, rdi
mov rdi, qword [rsp + 0x48]
je 0x10024f4c
mov rcx, qword [0x1005ba70]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x1005ba60]
mov rdx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
jmp fcn.10023890

Function at 0x100256f0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x10058650]
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x100257c2
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x50], al
call sub.msvcrt.dll_memset
mov r8, qword [rbx + 8]
test r8, r8
lea rdx, [0x10048bcc]
lea rcx, [rsp + 0x50]
cmove r8, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
je 0x100257ab
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x100257ab
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
mov byte [rsp + 0x20], al
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64__class_std::allocator_char__const____ptr64____ptr64]
lea rcx, [rsp + 0x28]
call fcn.100256f0
lea rcx, [rsp + 0x28]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rcx, qword [rbx + 8]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x160]
call fcn.10042170
add rsp, 0x170
pop rbx
ret
Function at 0x100258b0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x10], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov rbx, rcx
je 0x100258de
lea rcx, str.Wow64Redirection::disabler_____
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x10025900
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov rbx, rcx
je 0x1002592e
lea rcx, str.Wow64Redirection::restore_____
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [rbx + 0x18]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x10025ac0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x4f8
mov rax, qword [0x10058650]
mov qword [rsp + 0x4d0], rax
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov r8, qword [r8]
mov qword [r11 - 8], rsi
mov rbp, rdx
xor edx, edx
mov qword [r11 - 0x10], rdi
mov rbx, rcx
xor sil, sil
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x87
mov byte [rsp + 0x40], sil
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_OpenFile]
test eax, eax
movsxd rdi, eax
jne 0x10025b68
xor ecx, ecx
call fcn.100205e0
lea rdx, [0x10048c20]
lea rcx, [rsp + 0x38]
mov rbx, rax
call fcn.10027af0
lea rdx, str._comm__read_file__s__OpenFile_failed:__s
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.10027bf0
jmp 0x10025c60
mov qword [rsp + 0x4e0], r12
lea rcx, [rsp + 0xd0]
xor r12d, r12d
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x30], r12d
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
mov r8d, 0x400
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10025c1a
nop
nop
nop
nop
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64__unsigned_long_long_unsigned___int64_____ptr64]
cmp dword [rsp + 0x30], 0x400
jb 0x10025c4c
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x400
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
mov r8d, 0x400
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10025bc0
xor ecx, ecx
call fcn.100205e0
lea rdx, [0x10048c58]
lea rcx, [rsp + 0x38]
mov rbx, rax
call fcn.10027af0
lea rdx, str._comm__read_file__s__ReadFile_failed:__s
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.10027bf0
jmp 0x10025c4f
mov sil, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x4e0]
mov rdi, qword [rsp + 0x4e8]
mov rbp, qword [rsp + 0x518]
mov rbx, qword [rsp + 0x510]
mov al, sil
mov rsi, qword [rsp + 0x4f0]
mov rcx, qword [rsp + 0x4d0]
call fcn.10042170
add rsp, 0x4f8
ret
Function at 0x10025ce0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x108
mov rax, qword [0x10058650]
mov qword [rsp + 0xd0], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r12
mov r12, rdx
mov rbx, r8
lea rcx, [rsp + 0x41]
xor dil, dil
xor edx, edx
mov r8d, 0x87
mov byte [rsp + 0x40], dil
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
mov r8d, 0x1001
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_OpenFile]
test eax, eax
movsxd rsi, eax
jne 0x10025d7d
xor ecx, ecx
call fcn.100205e0
lea rdx, [0x10048c90]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10027af0
lea rdx, str._comm__write_file__s__OpenFile_failed:__s
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.10027bf0
jmp 0x10025ddc
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10025dd0
xor ecx, ecx
call fcn.100205e0
lea rdx, [0x10048cc8]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10027af0
lea rdx, str._comm__write_file__s__WriteFile_failed:__s
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.10027bf0
jmp 0x10025dd3
mov dil, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0x100]
mov rbx, qword [rsp + 0x128]
mov al, dil
mov rdi, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xd0]
call fcn.10042170
add rsp, 0x108
ret