joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000aa80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r9d, dword [rcx + 0x10]
lea r12, [0x14004a910]
and qword [rsp + 0x50], 0
mov rsi, rdx
mov r8, rdx
mov qword [rsp + 0x48], r12
mov rdx, qword [rcx + 8]
mov rdi, rcx
or r9d, 0xf003f
mov dword [rsp + 0x58], 0x200
lea rcx, [rsp + 0x48]
call fcn.140009e5c
mov ebx, eax
mov r13d, 1
add eax, 0x7ff8fffe
cmp eax, r13d
cmovbe ebx, r13d
test ebx, ebx
jmp 0x14000ab0e
lea rdx, [rsp + 0x70]
call fcn.14000aa80
mov ebx, eax
test eax, eax
jne 0x14000ab81
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x70]
and qword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea rcx, [rsp + 0x48]
test eax, eax
je 0x14000ab00
call fcn.140009ca0
mov rcx, qword [rdi + 8]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea eax, [rbx + 0x7ff8fffe]
cmp eax, r13d
cmovbe ebx, r13d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], r12
call fcn.140009ca0
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140020b40
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000af70
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rsp + 0x250], rax
and qword [rsp + 0x38], 0
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
mov rdi, r8
and qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
mov rcx, qword [rcx + 8]
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
jne 0x14000afe6
lea rcx, [rsp + 0x50]
call fcn.140034f34
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140001948
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140020b40
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop rdi
ret
Function at 0x14000ba08
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, r9d
mov ecx, r9d
mov rsi, r8
mov rbp, rdx
call fcn.140034380
mov qword [rbx], rax
test rax, rax
je 0x14000baa0
mov edx, dword [rsi]
mov r9, rax
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov rcx, qword [rbx]
test eax, eax
je 0x14000ba93
and dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14000ba90
cmp dword [rsp + 0x58], 0
je 0x14000ba90
mov rax, qword [rsp + 0x40]
movzx ecx, word [rax]
movzx eax, word [rax + 2]
shl ecx, 0x10
or ecx, eax
mov eax, 1
mov dword [rbx + 8], ecx
jmp 0x14000baa2
mov rcx, qword [rbx]
call fcn.140020dec
and qword [rbx], 0
and dword [rbx + 8], 0
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000bc18
Capabilities:
Open clipboard
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov esi, r9d
mov edi, ecx
cmp ecx, 0x80000003
jne 0x14000bc70
xor eax, eax
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140020b40
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x802
call fcn.140021750
mov rbx, qword [0x140055b00]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14000602c
mov r9, qword [rsp + 0x40]
lea rax, str.baselogging.cc
mov dword [rsp + 0x38], esi
lea rdx, str.Exception__x_in__s__s__u_r_n_r_n_hs:_d_r_n
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
and dword [rsp + 0x28], 0
mov r8d, edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000bce8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14000bd0d
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.14000c95c
mov r9d, 0x250012
lea r8, str.Exception
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 3
je 0x14000bd3c
cmp eax, 1
jne 0x14000bd32
int3
mov eax, 1
jmp 0x14000bc4b
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14000c95c
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rsi, rcx
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [rbx + 1]
mov ecx, 0x2002
movsxd rdi, eax
add rdi, rdi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14000c9ac
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.140021910
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x14000c9d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
Function at 0x1400112f8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
xorps xmm0, xmm0
mov rdi, rcx
lea rcx, [rbp + 7]
mov r15, rdx
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
and qword [rdi + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xor edx, edx
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
jmp 0x140011439
cmp dword [rbp - 0x39], 0x1000
jne 0x14001142e
mov rsi, qword [rdi + 0x18]
movups xmm0, xmmword [rbp - 0x59]
mov rbx, rsi
mov rcx, rsi
movups xmm1, xmmword [rbp - 0x49]
movups xmm2, xmmword [rbp - 0x39]
movq rdx, xmm0
mov qword [rbp + 0x67], rdx
mov rax, qword [rsi + 8]
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm1
movups xmmword [rbp - 9], xmm2
jmp 0x14001139a
cmp qword [rax + 0x20], rdx
jae 0x140011394
mov rax, qword [rax + 0x10]
jmp 0x14001139a
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140011388
cmp rbx, rcx
je 0x1400113ab
cmp rdx, qword [rbx + 0x20]
jae 0x140011407
mov ecx, 0x58
int3
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm1
movups xmmword [rbx + 0x48], xmm2
test byte [rbp - 0x35], 0x70
je 0x14001142e
mov r8, qword [rbp - 0x41]
xor edx, edx
mov ecx, dword [rbp + 0xb]
mov rax, r8
div rcx
add qword [rdi + 0x10], rax
jmp 0x140011432
mov r8, qword [rbp - 0x41]
mov rdx, qword [rbp - 0x59]
add rdx, r8
mov r9d, 0x30
lea r8, [rbp - 0x59]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
je 0x14001134a
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020e99
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140020eb7
je 0x140020ec2
call 0x140020f11
mov bl, 0xc7
lahf
pop rsi
jne 0x140020ea2
call 0x140020eba
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140020ea2
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140020ef0
je 0x140020f2e
invalid
je 0x140020f3f
jne 0x140020ea2
lea rax, [0x140020dc8]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14001cb29]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140020fe0
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x140021039
je 0x14002103f
call 0x140021030
fild qword [rdi - 0x7c]
jmp 0x174f5d7b2
jne 0x140021002
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140020fc2
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140020eac
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140020eb7
je 0x140020ec2
call 0x140020f11
mov bl, 0xc7
lahf
pop rsi
jne 0x140020ea2
call 0x140020eba
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140020ea2
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140020ef0
je 0x140020f2e
invalid
je 0x140020f3f
jne 0x140020ea2
lea rax, [0x140020dc8]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14001cb29]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140020fe0
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x140021039
je 0x14002103f
call 0x140021030
fild qword [rdi - 0x7c]
jmp 0x174f5d7b2
jne 0x140021002
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140020fc2
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140020ed8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140020eb7
je 0x140020ec2
call 0x140020f11
mov bl, 0xc7
lahf
pop rsi
jne 0x140020ea2
call 0x140020eba
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140020ea2
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140020ef0
je 0x140020f2e
invalid
je 0x140020f3f
jne 0x140020ea2
lea rax, [0x140020dc8]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14001cb29]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140020fe0
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x140021039
je 0x14002103f
call 0x140021030
fild qword [rdi - 0x7c]
jmp 0x174f5d7b2
jne 0x140021002
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140020fc2
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140020f11
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140020eb7
je 0x140020ec2
call 0x140020f11
mov bl, 0xc7
lahf
pop rsi
jne 0x140020ea2
call 0x140020eba
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140020ea2
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140020ef0
je 0x140020f2e
invalid
je 0x140020f3f
jne 0x140020ea2
lea rax, [0x140020dc8]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14001cb29]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140020fe0
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x140021039
je 0x14002103f
call 0x140021030
fild qword [rdi - 0x7c]
jmp 0x174f5d7b2
jne 0x140021002
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140020fc2
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call fcn.14000a618
test rax, rax
je 0x14000105a
lea rcx, str.Windows_original_main_args:_n
call fcn.14000a4b0
xor ebx, ebx
cmp dword [0x140028c9c], ebx
jle 0x14000105a
xor edi, edi
mov r8, qword [0x140028ca0]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rdi + r8]
call fcn.14000a4b0
inc ebx
add rdi, 8
cmp ebx, dword [0x140028c9c]
jl 0x140001033
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call fcn.1400041f0
call fcn.1400041e0
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call fcn.140004294
mov rbx, rax
call fcn.1400041e8
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010a6
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x140001093
mov rdx, qword [0x140027020]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rdx, rdx
jne 0x1400010bd
mov rdx, qword [rbx]
mov rcx, qword [0x140027018]
test rcx, rcx
jne 0x1400010cc
mov rcx, qword [rbx]
mov r9, qword [0x140028a20]
mov r8d, 1
test r9, r9
setne al
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x50], al
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rcx
lea rax, [0x14001e438]
mov rdx, rbx
mov qword [rsp + 0x38], rax
lea rax, [0x14001e428]
mov ecx, edi
mov qword [rsp + 0x30], rax
mov rax, qword [0x140028a28]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call fcn.1400039cc
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14000176c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x150
mov rax, qword [0x1400270d0]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsxd rbp, ecx
lea rcx, str.CLASSPATH
mov r12, rdx
mov word [rsp + 0x20], 0x3b
call fcn.14000a618
mov edi, 0x28
test rax, rax
je 0x14000180a
mov rcx, rax
call fcn.140006474
mov rcx, rax
mov rsi, rax
call fcn.14000ab20
mov rcx, rsi
lea rbx, [rax + 0x28]
call fcn.14000ab20
cmp rbx, rax
jbe 0x14000180a
mov rcx, rsi
call fcn.14000ab20
lea rcx, [rdi + rax]
call fcn.140004294
lea rdx, str._Denv.class.path_s
mov r8, rsi
mov rcx, rax
mov rbx, rax
call fcn.14000aff4
xor edx, edx
mov rcx, rbx
call fcn.14000120c
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140004460
test al, al
jne 0x140001830
lea rcx, str.Error:_Could_not_determine_application_home.
call fcn.140004604
xor al, al
jmp 0x1400018f8
lea rcx, [rsp + 0x30]
call fcn.14000ab20
lea rcx, [rdi + rax]
call fcn.140004294
lea r8, [rsp + 0x30]
lea rdx, str._Dapplication.home_s
mov rcx, rax
mov rbx, rax
call fcn.14000aff4
xor edx, edx
mov rcx, rbx
call fcn.14000120c
xor esi, esi
test rbp, rbp
jle 0x14000188d
mov rcx, qword [r12 + rsi*8]
call fcn.14000ab20
lea rcx, [rsp + 0x30]
lea ebx, [rdi + rax]
call fcn.14000ab20
inc rsi
lea edi, [rbx + rax + 1]
cmp rsi, rbp
jl 0x14000186b
lea eax, [rdi + 1]
movsxd rcx, eax
call fcn.140004294
lea rdx, str._Djava.class.path
mov rcx, rax
mov rbx, rax
call fcn.14000b2d0
xor edi, edi
test rbp, rbp
jle 0x1400018df
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000b230
mov rdx, qword [r12 + rdi*8]
mov rcx, rbx
call fcn.14000b230
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000b230
inc rdi
cmp rdi, rbp
jl 0x1400018b1
mov rcx, rbx
call fcn.14000ab20
xor edx, edx
mov rcx, rbx
mov byte [rax + rbx - 1], 0
call fcn.14000120c
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000b3a0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140001e90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rcx, [0x14001e9e8]
movaps xmmword [rsp + 0x20], xmm6
call fcn.14000a618
lea rcx, [0x14001e9d0]
mov rbp, rax
call fcn.14000a618
mov rdi, rax
movss xmm6, dword [0x14001e9cc]
movss dword [rsp + 0x50], xmm6
test rax, rax
je 0x140001fc5
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, rbp
call fcn.14000663c
mov rbx, rax
test rbp, rbp
je 0x140001f4f
test rax, rax
je 0x140001f0b
lea r8, [rsp + 0x58]
mov rdx, rax
mov rcx, rbp
call fcn.1400072e4
mov rsi, rax
test rax, rax
jne 0x140001f29
lea r8, [rsp + 0x58]
mov rdx, rdi
mov rcx, rbp
movss dword [rsp + 0x50], xmm6
call fcn.1400072e4
mov rsi, rax
test rax, rax
je 0x140001f71
call fcn.140006584
movss xmm0, dword [rsp + 0x50]
call fcn.1400065fc
mov edx, dword [rsp + 0x58]
mov rcx, rsi
call fcn.1400064fc
mov rcx, rsi
call fcn.140004318
jmp 0x140001f71
call fcn.140006584
test rbx, rbx
je 0x140001f69
movss xmm0, dword [rsp + 0x50]
call fcn.1400065fc
mov rcx, rbx
jmp 0x140001f6c
mov rcx, rdi
call fcn.140006544
test rbx, rbx
je 0x140001f7e
mov rcx, rbx
call fcn.140004318
mov rdx, rbp
mov rcx, rdi
call fcn.1400065b4
lea rcx, [0x14001e9b8]
call fcn.140004fc8
lea rcx, [0x14001e9d0]
call fcn.140004fc8
lea rcx, [0x14001e9e8]
call fcn.140004fc8
mov rcx, qword [0x140028a80]
call fcn.140004318
mov rcx, qword [0x140028a78]
call fcn.140004318
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004350
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str._JAVA_LAUNCHER_DEBUG
call fcn.14000a618
test rax, rax
je 0x14000437f
lea rdx, str._JAVA_LAUNCHER_DEBUG
lea rcx, str._____s_____n
mov byte [0x140028ad0], 1
call fcn.140004320
add rsp, 0x28
ret

Function at 0x1400044a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
lea rax, [r11 - 0x18]
mov ebx, r9d
mov rbp, r8
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
lea r9, [r11 - 0x14]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000451c
cmp dword [rsp + 0x34], 1
jne 0x14000451c
cmp dword [rsp + 0x30], ebx
jae 0x14000451c
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov rdx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000451c
mov al, 1
jmp 0x14000451e
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret