joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004d4d0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x1400ec028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.14004c370
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x1400f20b8]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x14004d52d
jnp 0x14004d592
ucomisd xmm0, xmm6
jne 0x14004d539
jnp 0x14004d6bc
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1400d3910]
subpd xmm1, xmmword [0x1400d3920]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1400d9870]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140066890
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1400f20c8]
mov ecx, dword [0x1400ef384]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004d6c3
mov eax, dword [0x1400f20d8]
mov ecx, dword [0x1400ef384]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004d6fd
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x1400f20d0]
movq xmm1, rbp
punpckldq xmm1, xmmword [0x1400d3910]
subpd xmm1, xmmword [0x1400d3920]
haddpd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1400d9868]
ucomisd xmm2, xmm1
ja 0x14004d52d
shl r15, 0x20
or r14, r15
sub r14, qword [0x1400f20c0]
movq xmm0, r14
punpckldq xmm0, xmmword [0x1400d3910]
subpd xmm0, xmmword [0x1400d3920]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x1400f20b8], xmm0
jmp 0x14004d52d
xor eax, eax
jmp 0x14004d56b
lea rcx, [0x1400f20c8]
call fcn.140065c70
cmp dword [0x1400f20c8], 0xffffffff
jne 0x14004d5dc
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1400f20c0], rdx
lea rcx, [0x1400f20c8]
call fcn.140065d08
jmp 0x14004d5dc
lea rcx, [0x1400f20d8]
call fcn.140065c70
cmp dword [0x1400f20d8], 0xffffffff
jne 0x14004d601
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x1400f20d0], rax
lea rcx, [0x1400f20d8]
call fcn.140065d08
jmp 0x14004d601
Function at 0x140050750
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x1400f5420]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x14005077d
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140050773

Function at 0x1400516e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400ef1e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140051714
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140051714
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14005170e

Function at 0x140051720
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1400ef1e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005175e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x140051757
call fcn.140031570
jmp 0x14005173e

Function at 0x140052420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x1400524b8
test rax, rax
jne 0x1400524a7
cmp dword [rsi + 0x50], 0
jne 0x1400524a7
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x140052495
lea rdi, [rsi + 0x20]
movabs r14, 0x100003600
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400457f0
cmp rax, 0xffffffffffffffff
jne 0x140052487
cmp dword [rsi + 0x58], 1
jne 0x1400524d4
jmp 0x1400524c1
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x140052463
mov byte [rsi + 0x54], 1
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400b2ba0
mov rax, qword [rsi + 0x40]
jmp 0x140052438
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x1400524d4
bt r14, rax
jb 0x140052487
mov rax, qword [rsi + 0x10]
mov bl, 1
nop word [rax + rax]
cmp rax, qword [rsi + 0x18]
je 0x14005249b
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400457f0
cmp rax, 0xffffffffffffffff
jne 0x14005249b
cmp dword [rsi + 0x58], 1
mov rax, qword [rsi + 0x10]
je 0x14005250e
add rax, 1
mov qword [rsi + 0x10], rax
jmp 0x1400524e0
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x140052504
bt r14, rcx
jae 0x140052504
jmp 0x14005249b
Function at 0x140058810
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x140058848
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov rbx, rsi
cmp rsi, r14
jae 0x140058852
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140058859
add rdi, rbx
sub rsi, rbx
jne 0x14005882a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, 0xffffffff
jmp 0x140058832
int3

Function at 0x1400588f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400f6ae0]
mov ecx, dword [0x1400ef384]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140058925
lea rcx, [0x1400f6ad8]
add rsp, 0x28
jmp fcn.1400516e0
lea rcx, [0x1400f6ae0]
call fcn.140065c70
cmp dword [0x1400f6ae0], 0xffffffff
jne 0x140058915
mov qword [0x1400f6ad8], 0
lea rcx, [0x1400f6ad8]
xor edx, edx
call fcn.140031780
lea rcx, [0x1400f6ae0]
call fcn.140065d08
jmp 0x140058915

Function at 0x14005a860
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x14005a8f7
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14005a8e1
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14005a8be
mov qword [rsi], rdi
call fcn.14004cfc0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x14005a8fb
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14004cfc0
mov rcx, qword [rsi]
call fcn.14004eee0
mov qword [rsi], 0
jmp 0x14005a8ac
mov byte [rsi + 8], 1
int3

Function at 0x14005f000
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1400f7020]
cmp rsi, 1
jbe 0x14005f023
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140051720
lea rcx, [0x1400f7020]
call fcn.140037cf0
test al, al
je 0x14005f069
mov qword [0x1400f7028], 0
lea rdi, [0x1400f7020]
lea rsi, [0x1400f7028]
mov rcx, rsi
xor edx, edx
call fcn.140031780
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140037d90
jmp 0x14005f013
mov rsi, qword [0x1400f7020]
jmp 0x14005f013

Function at 0x140063c20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
test r8, r8
je 0x140063c4c
xor ecx, ecx
lea r9, [0x1400df450]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
add rcx, 1
cmp r8, rcx
jne 0x140063c30
ret
Function at 0x1400653d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400f70d0]
mov ecx, dword [0x1400ef384]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140065436
lea rcx, [0x1400f70c8]
xor edx, edx
call fcn.140051720
mov eax, dword [0x1400f70e0]
mov ecx, dword [0x1400ef384]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140065472
lea rcx, [0x1400f70d8]
xor edx, edx
add rsp, 0x28
jmp fcn.140051720
lea rcx, [0x1400f70d0]
call fcn.140065c70
cmp dword [0x1400f70d0], 0xffffffff
jne 0x1400653f5
mov qword [0x1400f70c8], 0
lea rcx, [0x1400f70c8]
xor edx, edx
call fcn.140031780
lea rcx, [0x1400f70d0]
call fcn.140065d08
jmp 0x1400653f5
lea rcx, [0x1400f70e0]
call fcn.140065c70
cmp dword [0x1400f70e0], 0xffffffff
jne 0x140065424
mov qword [0x1400f70d8], 0
lea rcx, [0x1400f70d8]
xor edx, edx
call fcn.140031780
lea rcx, [0x1400f70e0]
call fcn.140065d08
jmp 0x140065424

Function at 0x1400655d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1400f70e8]
cmp rsi, 1
jbe 0x1400655f3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140051720
lea rcx, [0x1400f70e8]
call fcn.140037cf0
test al, al
je 0x140065639
mov qword [0x1400f70f0], 0
lea rdi, [0x1400f70e8]
lea rsi, [0x1400f70f0]
mov rcx, rsi
xor edx, edx
call fcn.140031780
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140037d90
jmp 0x1400655e3
mov rsi, qword [0x1400f70e8]
jmp 0x1400655e3

Function at 0x140065650
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1400f7100]
mov ecx, dword [0x1400ef384]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006568d
lea rcx, [0x1400f70f8]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140051720
lea rcx, [0x1400f7100]
call fcn.140065c70
cmp dword [0x1400f7100], 0xffffffff
jne 0x140065679
mov qword [0x1400f70f8], 0
lea rcx, [0x1400f70f8]
xor edx, edx
call fcn.140031780
lea rcx, [0x1400f7100]
call fcn.140065d08
jmp 0x140065679
Function at 0x1400a6d00
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140065b1c
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400a6d70]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.140071ef0
mov qword [rbx], rax
test rax, rax
je 0x1400a6d57
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1400a8880
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov edi, 2
cmp rdx, 1
jne 0x1400a88ba
mov rsi, qword [r14 + 8]
cmp rdi, rsi
ja 0x1400a89bb
jae 0x1400a89b1
mov rax, qword [r14 + 0x18]
test rax, rax
js 0x1400a88d5
cvtsi2ss xmm0, rax
jmp 0x1400a88ea
lea rax, [rdx - 1]
test rdx, rax
jne 0x1400a88c8
mov rdi, rdx
jmp 0x1400a8897
mov rcx, rdx
call fcn.140043c40
mov rdi, rax
jmp 0x1400a8897
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [r14 + 0x20]
call fcn.14008f190
cvttss2si rcx, xmm0
movss xmm1, dword [0x1400d5cc8]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rsi, 3
jb 0x1400a899d
mov rcx, rsi
shr rcx, 1
movabs rdx, 0x5555555555555555
and rdx, rcx
mov rbx, rsi
sub rbx, rdx
movabs rdx, 0x3333333333333333
mov rcx, rbx
shr rcx, 2
and rbx, rdx
and rcx, rdx
add rcx, rbx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x1400a899d
cmp rax, 2
jb 0x1400a89a5
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x1400a89a5
mov rcx, rax
call fcn.140043c40
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rsi
jb 0x1400a89bb
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, r14
mov rdx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140090d40

Function at 0x1400a8a30
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1400ec028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1400a8aaf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400a8ab4
test bl, bl
je 0x1400a8a8b
cmp byte [rdi + 8], 0
je 0x1400a8b10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
call fcn.1400296e0
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140066890
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
jmp 0x1400a8a5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x1400a8adc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400a8ae1
xor esi, esi
jmp 0x1400a8a98
mov rcx, qword [rdi]
jmp 0x1400a8ac9
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x1400a8b18
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400a8a8b
mov esi, dword [rsp + 0x24]
jmp 0x1400a8a8b
mov rcx, qword [rdi]
jmp 0x1400a8a80
mov rcx, qword [rdi]
jmp 0x1400a8af8
Function at 0x1400c4e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rcx
test r8d, r8d
jne 0x1400c4e7e
movabs rax, 0x100000001
mov qword [r14], rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15d, r8d
mov dword [r14], 0
test dl, 1
jne 0x1400c4e9f
xor ebx, ebx
movzx edx, dx
shr edx, 1
inc ebx
mov ebp, edx
test dl, 1
je 0x1400c4e8f
jmp 0x1400c4ea4
movzx ebp, dx
xor ebx, ebx
bsr ecx, ebp
xor ecx, 0x1f
mov eax, 0x20
sub eax, ecx
imul eax, r15d
cmp eax, 0xde3
jg 0x1400c4fa1
mov eax, 1
mov esi, eax
lea eax, [rsi + rsi]
cmp esi, r15d
jle 0x1400c4ec5
or cl, 0x20
mov r8, 0xffffffffffffffff
shl r8, cl
sar esi, 2
movzx r10d, dx
xor eax, eax
test esi, esi
jne 0x1400c4f60
xor esi, esi
mov rcx, r10
mov dword [r14], 0
test rcx, rcx
je 0x1400c4f19
xor edx, edx
mov edi, ecx
and edi, 0xfffffff
mov dword [r14 + rdx*4 + 4], edi
shr rcx, 0x1c
inc rdx
test rcx, rcx
jne 0x1400c4efc
mov word [r14], dx
test al, 1
je 0x1400c4f27
mov rcx, r14
mov edx, ebp
call fcn.1400c4b70
test esi, esi
je 0x1400c4f46
mov rcx, r14
call fcn.1400c4cc0
test esi, r15d
je 0x1400c4f42
mov rcx, r14
mov edx, ebp
call fcn.1400c4b70
sar esi, 1
jne 0x1400c4f2b
imul ebx, r15d
mov rcx, r14
mov edx, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400c4ac0
xor eax, eax
mov r9d, 1
mov rcx, r10
imul rcx, rcx
test esi, r15d
je 0x1400c4f8b
test rcx, r8
mov edx, 1
cmove rdx, r10
movzx eax, al
cmovne eax, r9d
imul rcx, rdx
sar esi, 1
je 0x1400c4eee
mov rdx, rcx
shr rdx, 0x20
je 0x1400c4f6b
jmp 0x1400c4eee
call fcn.1400bb110
int3
Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140028cb0]
lea rcx, str._JAVA_LAUNCHER_DEBUG
mov qword [0x140028cb8], rax
call fcn.14000a628
test rax, rax
je 0x140001068
lea rcx, str.Windows_original_main_args:_n
call fcn.14000a4c0
xor ebx, ebx
cmp dword [0x140028c9c], ebx
jle 0x140001068
xor edi, edi
mov r8, qword [0x140028ca0]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rdi + r8]
call fcn.14000a4c0
inc ebx
add rdi, 8
cmp ebx, dword [0x140028c9c]
jl 0x140001041
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call fcn.140004200
call fcn.1400041f0
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call fcn.1400042a4
mov rbx, rax
call fcn.1400041f8
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b4
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a1
mov rdx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rdx, rdx
jne 0x1400010cb
mov rdx, qword [rbx]
mov rcx, qword [0x140027018]
test rcx, rcx
jne 0x1400010da
mov rcx, qword [rbx]
mov r9, qword [0x140028a20]
mov r8d, 1
test r9, r9
setne al
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 1
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x50], al
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rcx
lea rax, [0x14001e440]
mov rdx, rbx
mov qword [rsp + 0x38], rax
lea rax, [0x14001e430]
mov ecx, edi
mov qword [rsp + 0x30], rax
mov rax, qword [0x140028a28]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call fcn.1400039dc
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14000177c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x150
mov rax, qword [0x1400270d0]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsxd rbp, ecx
lea rcx, str.CLASSPATH
mov r12, rdx
mov word [rsp + 0x20], 0x3b
call fcn.14000a628
mov edi, 0x28
test rax, rax
je 0x14000181a
mov rcx, rax
call fcn.140006484
mov rcx, rax
mov rsi, rax
call fcn.14000ab50
mov rcx, rsi
lea rbx, [rax + 0x28]
call fcn.14000ab50
cmp rbx, rax
jbe 0x14000181a
mov rcx, rsi
call fcn.14000ab50
lea rcx, [rdi + rax]
call fcn.1400042a4
lea rdx, str._Denv.class.path_s
mov r8, rsi
mov rcx, rax
mov rbx, rax
call fcn.14000b024
xor edx, edx
mov rcx, rbx
call fcn.14000121c
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140004470
test al, al
jne 0x140001840
lea rcx, str.Error:_Could_not_determine_application_home.
call fcn.140004614
xor al, al
jmp 0x140001908
lea rcx, [rsp + 0x30]
call fcn.14000ab50
lea rcx, [rdi + rax]
call fcn.1400042a4
lea r8, [rsp + 0x30]
lea rdx, str._Dapplication.home_s
mov rcx, rax
mov rbx, rax
call fcn.14000b024
xor edx, edx
mov rcx, rbx
call fcn.14000121c
xor esi, esi
test rbp, rbp
jle 0x14000189d
mov rcx, qword [r12 + rsi*8]
call fcn.14000ab50
lea rcx, [rsp + 0x30]
lea ebx, [rdi + rax]
call fcn.14000ab50
inc rsi
lea edi, [rbx + rax + 1]
cmp rsi, rbp
jl 0x14000187b
lea eax, [rdi + 1]
movsxd rcx, eax
call fcn.1400042a4
lea rdx, str._Djava.class.path
mov rcx, rax
mov rbx, rax
call fcn.14000b300
xor edi, edi
test rbp, rbp
jle 0x1400018ef
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000b260
mov rdx, qword [r12 + rdi*8]
mov rcx, rbx
call fcn.14000b260
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000b260
inc rdi
cmp rdi, rbp
jl 0x1400018c1
mov rcx, rbx
call fcn.14000ab50
xor edx, edx
mov rcx, rbx
mov byte [rax + rbx - 1], 0
call fcn.14000121c
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000b3d0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140001ea0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rcx, [0x14001e9f8]
movaps xmmword [rsp + 0x20], xmm6
call fcn.14000a628
lea rcx, [0x14001e9e0]
mov rbp, rax
call fcn.14000a628
mov rdi, rax
movss xmm6, dword [0x14001e9dc]
movss dword [rsp + 0x50], xmm6
test rax, rax
je 0x140001fd5
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, rbp
call fcn.14000664c
mov rbx, rax
test rbp, rbp
je 0x140001f5f
test rax, rax
je 0x140001f1b
lea r8, [rsp + 0x58]
mov rdx, rax
mov rcx, rbp
call fcn.1400072f4
mov rsi, rax
test rax, rax
jne 0x140001f39
lea r8, [rsp + 0x58]
mov rdx, rdi
mov rcx, rbp
movss dword [rsp + 0x50], xmm6
call fcn.1400072f4
mov rsi, rax
test rax, rax
je 0x140001f81
call fcn.140006594
movss xmm0, dword [rsp + 0x50]
call fcn.14000660c
mov edx, dword [rsp + 0x58]
mov rcx, rsi
call fcn.14000650c
mov rcx, rsi
call fcn.140004328
jmp 0x140001f81
call fcn.140006594
test rbx, rbx
je 0x140001f79
movss xmm0, dword [rsp + 0x50]
call fcn.14000660c
mov rcx, rbx
jmp 0x140001f7c
mov rcx, rdi
call fcn.140006554
test rbx, rbx
je 0x140001f8e
mov rcx, rbx
call fcn.140004328
mov rdx, rbp
mov rcx, rdi
call fcn.1400065c4
lea rcx, [0x14001e9c8]
call fcn.140004fd8
lea rcx, [0x14001e9e0]
call fcn.140004fd8
lea rcx, [0x14001e9f8]
call fcn.140004fd8
mov rcx, qword [0x140028a80]
call fcn.140004328
mov rcx, qword [0x140028a78]
call fcn.140004328
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004360
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str._JAVA_LAUNCHER_DEBUG
call fcn.14000a628
test rax, rax
je 0x14000438f
lea rdx, str._JAVA_LAUNCHER_DEBUG
lea rcx, str._____s_____n
mov byte [0x140028ad0], 1
call fcn.140004330
add rsp, 0x28
ret

Function at 0x1400044b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
lea rax, [r11 - 0x18]
mov ebx, r9d
mov rbp, r8
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
lea r9, [r11 - 0x14]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000452c
cmp dword [rsp + 0x34], 1
jne 0x14000452c
cmp dword [rsp + 0x30], ebx
jae 0x14000452c
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov rdx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000452c
mov al, 1
jmp 0x14000452e
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret