joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e878
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r15, rdx
lea rax, [r11 - 0x50]
mov r12, r8
xor bpl, bpl
lea rdx, str.SOFTWAREej_technologiesexe4jlocatedjvms_
mov r9d, 0x20019
mov byte [r8], bpl
xor r8d, r8d
mov qword [r11 - 0x78], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000ea59
mov edi, 0x1770
mov rcx, rdi
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0x40], edi
call fcn.140013a90
mov rcx, rdi
mov r13, rax
call fcn.140013a90
mov rcx, rdi
mov rsi, rax
call fcn.140013a90
mov rcx, rdi
mov rbx, rax
call fcn.140013a90
xor r14d, r14d
mov rdi, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
and qword [rsp + 0x20], r14
xor edx, edx
jmp 0x14000ea10
mov byte [rbx], 0
mov rcx, rsi
mov byte [rdi], 0
call fcn.140013bc0
inc eax
movsxd r8, eax
test eax, eax
jle 0x14000e966
mov rdx, rsi
mov rcx, rbx
sub rdx, rbx
movzx eax, byte [rdx + rcx]
mov r9d, 0x5c
cmp al, 0x2f
cmove eax, r9d
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x14000e94b
cmp byte [rsp + 0xc8], 0
jne 0x14000e984
lea rdx, str.i4j_jres
mov rcx, rbx
call fcn.140016318
test rax, rax
je 0x14000e9d5
mov r9, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
mov rdx, rdi
mov rcx, rbx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
call fcn.14000d9ec
test al, al
je 0x14000e9d5
mov rdx, r12
mov rcx, rdi
call fcn.14000d75c
test al, al
je 0x14000e9d5
mov rdx, rdi
mov rcx, r12
call fcn.140014190
mov rdx, rbx
mov rcx, r15
call fcn.140014190
mov bpl, 1
lea rax, [rsp + 0x50]
inc r14d
mov dword [rsp + 0xb0], 0x1770
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb0]
mov dword [rsp + 0x40], 0x1770
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
and qword [rsp + 0x20], 0
mov edx, r14d
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x14000e92b
mov rcx, rbx
call fcn.140013f50
mov rcx, rdi
call fcn.140013f50
mov rcx, r13
call fcn.140013f50
mov rcx, rsi
call fcn.140013f50
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bpl
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f5a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rdx
test r8d, r8d
jle 0x14000f5d8
mov r9d, r8d
mov r8d, dword [rcx]
movsx eax, byte [r10]
inc r10
xor rax, r8
shr r8d, 8
movzx edx, al
lea rax, [0x14003b120]
mov eax, dword [rax + rdx*4]
xor eax, r8d
sub r9, 1
mov dword [rcx], eax
jne 0x14000f5af
repz ret

Function at 0x14000f9a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140013bc0
cmp eax, 3
jl 0x14000fa97
cmp byte [rbx + 1], 0x2d
jne 0x14000fa97
mov rcx, qword [0x14003b118]
lea rdi, [0x14003b118]
jmp 0x14000fa34
mov rsi, qword [rdi]
mov rcx, rsi
call fcn.140013bc0
mov rbp, rax
lea ecx, [rax + 1]
movsxd rcx, ecx
call fcn.140013a90
test ebp, ebp
jle 0x14000fa16
movsxd r8, ebp
mov rdx, rax
sub rsi, rax
mov cl, byte [rsi + rdx]
xor cl, 0xbb
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x14000fa05
movsxd r8, ebp
mov rdx, rax
mov rcx, rbx
mov byte [r8 + rax], 0
call fcn.140014f30
test eax, eax
je 0x14000fa97
add rdi, 8
mov rcx, qword [rdi]
call fcn.140013bc0
test rax, rax
jne 0x14000f9df
movsx ecx, byte [rbx]
sub ecx, 0x41
je 0x14000fa73
sub ecx, 4
je 0x14000fa67
sub ecx, 7
je 0x14000fa73
sub ecx, 7
je 0x14000fa73
cmp ecx, 1
jne 0x14000fa97
mov rcx, rbx
call fcn.14000f408
add eax, 0xfffffffc
jmp 0x14000fa7e
mov dl, 1
mov rcx, rbx
call fcn.14000f910
jmp 0x14000fa9c
mov rcx, rbx
call fcn.14000f408
add eax, 0xfffffffe
cmp eax, 1
ja 0x14000fa97
mov rcx, rbx
call fcn.14000f84c
neg al
sbb eax, eax
and eax, 2
add eax, 0xfffffffd
jmp 0x14000fa9c
mov eax, 0xfffffffd
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000fff8
Capabilities:
Set registry value

Disassembly:
mov eax, 0x17e8
call fcn.14002d110
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x17d0], rax
call fcn.1400058b4
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov rdx, rax
call fcn.1400066f8
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, str.SOFTWAREej_technologiesexe4jpids_
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400100aa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x17d0]
xor rcx, rsp
call fcn.1400142e0
add rsp, 0x17e8
ret

Function at 0x1400100c4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
mov eax, 0x17d0
call fcn.14002d110
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x17c0], rax
call fcn.1400058b4
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov rdx, rax
call fcn.1400066f8
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREej_technologiesexe4jpids_
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x140010174
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x140010169
cmp dword [rsp + 0x30], 4
cmove ebx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x17c0]
xor rcx, rsp
call fcn.1400142e0
add rsp, 0x17d0
pop rbx
ret
Function at 0x1400104dc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
call fcn.1400101e4
mov rcx, rbx
mov rsi, rax
call fcn.140014638
lea rbp, str.__i4j_empty_command_line
test rax, rax
mov edx, 0x40000000
mov rcx, rsi
cmovne rbp, rbx
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor ebx, ebx
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400105ab
mov ecx, ebx
inc ebx
cmp ecx, 0x32
jge 0x14001058f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140010547
cmp rdi, 0xffffffffffffffff
jne 0x1400105ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_mailslot_CreateFile__d
mov edx, eax
call fcn.14000ff78
jmp 0x14001060c
mov rcx, rbp
call fcn.140014638
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
add ebx, ebx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400105ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_mailslot_WriteFile__d
mov edx, eax
call fcn.14000ff78
jmp 0x140010603
mov edx, dword [rsp + 0x60]
cmp edx, ebx
je 0x140010603
lea rcx, str.error_mailslot_WriteFile_length__d__d
mov r8d, ebx
call fcn.14000ff78
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp fcn.140013f50
Function at 0x140010970
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
movss xmm0, dword [0x14003b938]
and dword [rax + 0x20], 0
and dword [rax - 0x38], 0
ucomiss xmm0, dword [0x1400330a0]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm7, xmm7
jp 0x140010a12
jne 0x140010a12
movss xmm6, dword [0x14003309c]
lea rcx, str.J2D_UISCALE
movss dword [0x14003b938], xmm6
call fcn.140017340
test rax, rax
je 0x140010a0a
xor edx, edx
mov rcx, rax
call fcn.1400181c8
cvtsd2ss xmm1, xmm0
movss dword [0x14003b938], xmm1
call fcn.140017fbc
cmp dword [rax], 0x22
je 0x1400109fd
movss xmm0, dword [0x14003b938]
comiss xmm7, xmm0
jb 0x140010a12
movaps xmm0, xmm6
movss dword [0x14003b938], xmm0
jmp 0x140010a12
movss xmm0, dword [0x14003b938]
comiss xmm0, xmm7
jbe 0x140010a24
movss dword [rbx], xmm0
movss dword [rdi], xmm0
jmp 0x140010b11
cmp qword [0x14004a710], 0
jne 0x140010a60
lea rcx, str.shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14004a710], rax
test rax, rax
je 0x140010a60
lea rdx, str.GetDpiForMonitor
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14004a708], rax
jmp 0x140010a67
mov rax, qword [0x14004a708]
test rax, rax
je 0x140010aa9
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, rsi
call rax
test eax, eax
jne 0x140010b11
mov eax, dword [rsp + 0x78]
pxor xmm0, xmm0
pxor xmm1, xmm1
cvtsi2ss xmm0, rax
mov eax, dword [rsp + 0x20]
cvtsi2ss xmm1, rax
movss dword [rdi], xmm0
movss dword [rbx], xmm1
jmp 0x140010b11
lea rcx, str.D2d1.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14004a700], rax
test rax, rax
je 0x140010b11
lea rdx, [0x140033040]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14004a6f8], rax
test rax, rax
je 0x140010b11
lea r9, [rsp + 0x28]
lea rdx, [0x140033030]
xor r8d, r8d
xor ecx, ecx
call rax
test eax, eax
jne 0x140010b11
mov rcx, qword [rsp + 0x28]
mov r8, rbx
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rdi
ret
Function at 0x140012290
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x14001231b
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x94
call fcn.1400171b0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 6
jne 0x1400122f3
cmp dword [rsp + 0x28], 0
je 0x14001231b
lea rdx, str.SetDefaultDllDirectories
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001231b
mov ecx, 0xc00
call rax
lea rcx, str.restrict_DLL_directories
call fcn.14000ff78
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400142e0
add rsp, 0xd0
pop rbx
ret

Function at 0x140012334
Capabilities:
Create directory

Disassembly:
push rbx
mov eax, 0x17a0
call fcn.14002d110
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x1790], rax
xor ebx, ebx
lea rcx, [rsp + 0x20]
call fcn.1400063d8
xor ecx, ecx
call fcn.140015ac4
lea r8, [rsp + 0x20]
lea rdx, str._s_dir_d
lea rcx, [0x14004a720]
mov r9, rax
call fcn.140014fe8
lea rdx, [0x14004a720]
lea rcx, str.Temp_dir3:__S
call fcn.14000ff78
lea rcx, [0x14004a720]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400123dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140033968]
mov edx, eax
call fcn.14000ff78
inc ebx
cmp ebx, 0xa
jl 0x140012357
lea rdx, [0x140033964]
mov ecx, 0x3f1
mov byte [0x14004a720], 0
call fcn.140004efc
mov rcx, qword [rsp + 0x1790]
xor rcx, rsp
call fcn.1400142e0
add rsp, 0x17a0
pop rbx
ret

Function at 0x1400123f8
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x48
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14001247e
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001247e
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
add rsp, 0x48
ret
Function at 0x1400125e0
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, 0xbb80
mov rcx, rbx
call fcn.140013a90
mov ecx, 0x2ee0
mov rdi, rax
call fcn.140013a90
mov r8d, 0x1770
mov rdx, rax
mov ecx, 0x2714
mov rsi, rax
call fcn.140004500
lea rcx, str.native_lib_dir_is__S
mov rdx, rsi
call fcn.14000ff78
mov rcx, rsi
call fcn.140008440
lea r8, [0x1400125b8]
mov rdx, rsi
mov rcx, rdi
call fcn.1400068a8
mov rcx, rdi
call fcn.140013bc0
test rax, rax
je 0x140012673
mov rcx, rdi
call fcn.140013bc0
cmp byte [rax + rdi - 1], 0x3b
je 0x140012673
lea rdx, [0x14003019c]
mov rcx, rdi
call fcn.1400140f0
mov rcx, rdi
call fcn.140013bc0
mov rcx, rdi
sub ebx, eax
call fcn.140013bc0
lea rcx, str.PATH
lea rdx, [rdi + rax]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rcx, str.PATH
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x1400126be
lea rcx, str.Setting_PATH__native_libs___S
mov rdx, rdi
call fcn.14000ff78
jmp 0x1400126d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Setting_PATH__native_libs___S_failed_with_error__d
mov rdx, rdi
mov r8d, eax
call fcn.14000ff78
mov rcx, rdi
call fcn.140013bc0
lea rcx, [rax + 6]
call fcn.140013a90
lea rdx, str.PATH_s
mov r8, rdi
mov rcx, rax
mov rbx, rax
call fcn.140014fe8
mov rcx, rbx
call fcn.1400178d0
mov rcx, rbx
call fcn.140013f50
mov rcx, rdi
call fcn.140013f50
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140013f50
Function at 0x140013608
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x4740
call fcn.14002d110
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x4730], rax
mov rsi, rcx
lea rcx, [rsp + 0xe0]
mov rdi, rdx
call fcn.140014190
lea rcx, str..pack
call fcn.140013bc0
lea rbx, [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
sub rbx, rax
call fcn.140013bc0
xor ebp, ebp
mov rcx, rdi
mov byte [rax + rbx], bpl
call fcn.1400057d4
cmp al, bpl
jne 0x14001368a
lea rcx, str.pack_path_doesnt_exists
call fcn.14000ff78
jmp 0x1400137db
lea rdx, str._s_binunpack200.exe
lea rcx, [rsp + 0x2fc0]
mov r8, rsi
call fcn.140014fe8
lea r9, [rsp + 0xe0]
lea rdx, str._r___s____s_
lea rcx, [rsp + 0x1850]
mov r8, rdi
call fcn.140014fe8
lea rdx, [rsp + 0x2fc0]
lea rcx, [0x140030008]
call fcn.14000ff78
lea rdx, [rsp + 0x1850]
lea rcx, [0x140030008]
call fcn.14000ff78
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call fcn.1400171b0
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8, rbx
xor edx, edx
call fcn.1400171b0
lea ecx, [rbx - 0x67]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x1850]
lea rcx, [rsp + 0x2fc0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x70], ebx
mov word [rsp + 0xb0], bp
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebp
jne 0x140013789
lea rcx, str.could_not_create_unpack_process
call fcn.14000ff78
lea rdx, [0x140034060]
mov ecx, 0x3f1
call fcn.140004efc
lea rcx, str.waiting_for_unpack200_to_finish
call fcn.14000ff78
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.unpack_done
call fcn.14000ff78
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, ebp
jne 0x1400137db
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400137db
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.could_not_delete_packed_file__error__d_
mov edx, eax
call fcn.14000ff78
mov rcx, qword [rsp + 0x4730]
xor rcx, rsp
call fcn.1400142e0
mov rbx, qword [rsp + 0x4770]
add rsp, 0x4740
pop rdi
pop rsi
pop rbp
ret
Function at 0x140013800
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov eax, 0x3060
call fcn.14002d110
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x3050], rax
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
mov r8, rcx
mov r9, rdx
lea rcx, [rsp + 0x170]
lea rdx, str._s_s.jar.pack
call fcn.140014fe8
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140013974
lea rcx, [rsp + 0x5c]
call fcn.140013bc0
lea rcx, [rsp + 0x5c]
lea rdx, str._s_s_.s
mov qword [rsp + 0x28], rcx
sub rax, 5
lea rcx, [rsp + 0x170]
mov r9, rbp
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.140014fe8
lea rdx, [rsp + 0x170]
lea rcx, str.checking__S
call fcn.14000ff78
lea rcx, [rsp + 0x170]
call fcn.1400057d4
test al, al
jne 0x140013955
cmp byte [rdi], al
jne 0x1400138f7
lea rcx, str.Unpacking_JRE
call fcn.14000ff78
lea rcx, str.Preparing_JRE_..._n
call fcn.1400183c8
call fcn.1400155d0
lea rcx, [rax + 0x30]
call fcn.140015408
mov byte [rdi], 1
lea rcx, [rsp + 0x5c]
call fcn.140013bc0
lea rcx, [rsp + 0x5c]
lea rdx, str._s_.s
mov qword [rsp + 0x20], rcx
lea r9, [rax - 5]
lea rcx, [rsp + 0x170]
mov r8, rbp
call fcn.140014fe8
lea r9, [rsp + 0x170]
lea rdx, str._s_s.pack
lea rcx, [rsp + 0x18e0]
mov r8, rsi
call fcn.140014fe8
lea rdx, [rsp + 0x18e0]
mov rcx, rsi
call fcn.140013608
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14001386a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x3050]
xor rcx, rsp
call fcn.1400142e0
mov rbx, qword [rsp + 0x3098]
add rsp, 0x3060
pop rdi
pop rsi
pop rbp
ret

Function at 0x140015f54
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140015f6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140015f6e
xor eax, eax
test eax, eax
je 0x140015f7e
mov ecx, eax
call fcn.140017ffc
or eax, 0xffffffff
jmp 0x140015f80
xor eax, eax
add rsp, 0x28
ret

Function at 0x140015f88
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140015f9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140015fa0
xor eax, eax
test eax, eax
je 0x140015fb0
mov ecx, eax
call fcn.140017ffc
or eax, 0xffffffff
jmp 0x140015fb2
xor eax, eax
add rsp, 0x28
ret

Function at 0x140015ffc
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140016014
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140016016
xor eax, eax
test eax, eax
je 0x140016026
mov ecx, eax
call fcn.140017ffc
or eax, 0xffffffff
jmp 0x140016028
xor eax, eax
add rsp, 0x28
ret
Function at 0x140016030
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140016046
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140016048
xor eax, eax
test eax, eax
je 0x140016058
mov ecx, eax
call fcn.140017ffc
or eax, 0xffffffff
jmp 0x14001605a
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400174b8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400174ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400174d0
xor eax, eax
test eax, eax
je 0x1400174e0
mov ecx, eax
call fcn.140017ffc
or eax, 0xffffffff
jmp 0x1400174e2
xor eax, eax
add rsp, 0x28
ret

Function at 0x14001881b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14003b9c0]
jne 0x1400142fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400142f6
repz ret
ror rcx, 0x10
jmp 0x140018774
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14004bfc0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14004c0b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400187f9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14004bfc0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001881b
mov rax, qword [rsp + 0x88]
mov qword [0x14004c0b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14004c058], rax
mov rax, qword [0x14004c0b8]
mov qword [0x14004bf30], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14004c040], rax
mov dword [0x14004bf20], 0xc0000409
mov dword [0x14004bf24], 1
mov rax, qword [0x14003b9c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14003b9c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14004bfb8], eax
mov ecx, 1
call fcn.1400188c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140034610]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14004bfb8], 0
jne 0x1400188a2
mov ecx, 1
call fcn.1400188c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14001c744
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001c5b8
Function at 0x14001c750
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14001d3d4
nop
cmp dword [0x14004c4f8], 1
je 0x14001c6f0
mov dword [0x14004c4f4], 1
mov byte [0x14004c4f0], r12b
test ebx, ebx
jne 0x14001c6dc
mov rcx, qword [0x14004cff0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001c6c9
mov rcx, qword [0x14004cfe8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14001c668
call fcn.1400188d0
cmp qword [rdi], rax
jne 0x14001c668
jmp 0x14001c64e
cmp rdi, rsi
jb 0x14001c6c9
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400188d0
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14004cff0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14004cfe8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14001c6a7
cmp r13, rax
je 0x14001c6c7
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14001c64e
lea rdx, [0x14002f520]
lea rcx, [0x14002f508]
call fcn.14001c498
lea rdx, [0x14002f530]
lea rcx, [0x14002f528]
call fcn.14001c498
nop
test r12d, r12d
je 0x14001c6ff
mov ecx, 8
call fcn.14001d2d4
test r12d, r12d
jne 0x14001c72a
mov dword [0x14004c4f8], 1
lea ecx, [r12 + 8]
call fcn.14001d2d4
mov ecx, r15d
call fcn.14001c42c
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14001c5b8