joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400402e0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14011f190]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rbx, rcx
xor eax, eax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [r11 - 0x58]
call fcn.140040570
nop
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
sub rax, rdi
cmp rax, r14
jne 0x140040367
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.1400940b0
test eax, eax
je 0x1400404fa
mov rcx, rbx
call fcn.140040070
mov rbp, rax
test rax, rax
je 0x1400404fa
mov r9, rbx
mov r10, qword [rbx + 0x18]
cmp r10, 8
jb 0x14004038b
mov r9, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rdx, 0xffffffffffffffff
test r8, r8
je 0x1400403b1
mov rcx, r8
mov rax, r9
cmp word [rax], 0x5c
je 0x140040415
add rax, 2
sub rcx, 1
jne 0x1400403a1
mov rax, rdx
inc rax
movdqa xmm0, xmmword [0x140101630]
movdqu xmmword [rsp + 0x70], xmm0
xor r12d, r12d
mov word [rsp + 0x60], r12w
cmp r8, rax
jb 0x14004055b
sub r8, rax
cmp r8, rdx
cmovb rdx, r8
cmp r10, 8
jb 0x1400403ea
mov rbx, qword [rbx]
lea r9, [rbx + rax*2]
lea rcx, [rsp + 0x60]
cmp rdx, 7
ja 0x140040422
mov qword [rsp + 0x70], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.1400933b0
mov word [rsp + rbx + 0x60], r12w
jmp 0x140040427
test rax, rax
je 0x1400403b1
sub rax, r9
sar rax, 1
jmp 0x1400403b4
call fcn.14002d3d0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400404a4
cmp qword [rsi + 0x18], 8
jb 0x140040476
mov rsi, qword [rsi]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x100]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400404e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400404e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040561
call fcn.14006f490
movdqa xmm0, xmmword [0x140101630]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
test rdi, rdi
je 0x140040533
mov rdx, qword [rsp + 0x90]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14004052b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040555
mov rcx, rdi
call fcn.14006f490
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14006f430
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14009c704
nop
call fcn.14002cb50
nop
call fcn.14009c704
int3
Function at 0x1400432e0
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x14011f190]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x30], rsp
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x140043506
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x140043506
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140043506
mov ecx, dword [rsp + 0x80]
call fcn.14009f24c
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140043506
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x1400433dd
lea rdx, [0x140043506]
mov rcx, rsp
call fcn.1400d7460
xor edi, edi
mov dword [rsp + 0x38], edi
cmp edi, dword [rsp + 0x84]
jae 0x1400434fe
lea rcx, [rdi + rdi*2]
add rcx, rcx
movups xmm0, xmmword [r14 + rcx*8 + 0x10]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [r14 + rcx*8 + 0x20]
movups xmmword [rsp + 0x70], xmm1
mov r8d, 0x24
mov rdx, qword [r14 + rcx*8]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14004343f
lea rdx, [0x140043506]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
nop
lea r8, [rsp + 0x88]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140043470
lea rdx, [0x140043506]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
nop word [rax + rax]
cmp dword [rsp + 0x8c], 1
je 0x1400434ee
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x88]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400434c2
lea rdx, [0x140043506]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
cmp dword [rsp + 0x8c], 1
je 0x1400434ee
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x7530
jbe 0x1400434ec
lea rdx, [0x140043506]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
jmp 0x140043470
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc edi
jmp 0x1400433df
mov rcx, r14
call fcn.14009ef90
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14006f430
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140043530
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14011f190]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rsp
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140043771
cmp qword [rbx + 0x18], 8
jb 0x140043592
mov rbx, qword [rbx]
mov r8d, 0x2c
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140043768
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400435ea
lea rdx, [0x140043771]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
mov eax, dword [rsp + 0x54]
cmp eax, 1
jne 0x140043604
lea rdx, [0x140043771]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
mov r14d, 0x2710
nop word [rax + rax]
cmp eax, 3
jne 0x1400436b9
mov eax, 0xcccccccd
mul dword [rsp + 0x68]
shr edx, 3
cmp edx, 0x3e8
jae 0x140043634
mov edx, 0x3e8
jmp 0x14004363b
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140043678
lea rdx, [0x140043771]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
cmp dword [rsp + 0x54], 1
jne 0x140043690
lea rdx, [0x140043771]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7530
jbe 0x1400436b0
lea rdx, [0x140043771]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
mov eax, dword [rsp + 0x54]
jmp 0x140043610
mov rcx, rbx
call fcn.1400432e0
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400436f0
lea rdx, [0x140043771]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
nop dword [rax]
cmp dword [rsp + 0x54], 1
je 0x14004375f
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140043736
lea rdx, [0x140043771]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
cmp dword [rsp + 0x54], 1
je 0x14004375f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7530
jbe 0x14004375d
lea rdx, [0x140043771]
mov rcx, qword [rsp + 0x30]
call fcn.1400d7460
jmp 0x1400436f0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006f430
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14004e570
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x14011f190]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14004e613
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14004e613
mov dword [rsp + 0x20], 0x28
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14004e637
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14006f430
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x38]
call fcn.140022c80
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.14004e6b0
lea rdx, [0x14011c350]
lea rcx, [rsp + 0x60]
call fcn.1400932b8
int3

Function at 0x14004ecc0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x14011f190]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x14012a6c0]
mov rax, qword gs:[0x58]
mov edx, 0x120
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1401293b8], ecx
jg 0x14004edac
mov eax, ebx
cmp rbx, rax
jne 0x14004ed6e
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x14004ed6e
mov r8, rdi
mov edx, ebx
mov rcx, qword [0x1401293b0]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14004edef
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14006f430
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x28]
call fcn.140022c80
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.14004e6b0
lea rdx, [0x14011c350]
lea rcx, [rsp + 0x50]
call fcn.1400932b8
nop
lea rcx, [0x1401293b8]
call fcn.14006fed0
cmp dword [0x1401293b8], 0xffffffff
jne 0x14004ed19
lea rcx, [0x1401293b0]
call fcn.14004e570
lea rcx, [0x1400db440]
call fcn.14006f854
nop
lea rcx, [0x1401293b8]
call fcn.14006fe70
jmp 0x14004ed19
lea rdx, [0x1400ddf10]
lea rcx, [rsp + 0x28]
call fcn.140022c80
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.14004e6b0
lea rdx, [0x14011c350]
lea rcx, [rsp + 0x50]
call fcn.1400932b8
int3
Function at 0x140060490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r11, rdx
mov r9, rcx
mov r10d, ebx
cmp r8, 8
jb 0x1400604d7
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9]
add r9, 8
xor rax, qword [r11]
add r11, 8
or r10, rax
sub rcx, 1
jne 0x1400604c0
mov rdx, r10
shr rdx, 0x20
or edx, r10d
mov eax, edx
mov ecx, edx
shr eax, 8
or eax, edx
shr ecx, 0x10
and eax, 0xff00
or eax, ecx
movzx ecx, dl
shr eax, 8
or eax, ecx
test r8, r8
je 0x1400605e7
cmp r8, 8
jb 0x1400605b4
mov rdx, r8
mov rcx, r9
and rdx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rcx, r11
xorps xmm3, xmm3
mov r10, r11
nop word [rax + rax]
movd xmm2, dword [rcx + r10]
xorps xmm0, xmm0
movd xmm1, dword [r10]
lea r10, [r10 + 8]
punpcklbw xmm2, xmm0
add rbx, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r10 - 4]
punpcklbw xmm1, xmm0
por xmm2, xmm4
punpcklwd xmm1, xmm0
movdqa xmm4, xmm2
movd xmm2, dword [rcx + r10 - 4]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
pxor xmm2, xmm1
por xmm2, xmm3
movdqa xmm3, xmm2
cmp rbx, rdx
jb 0x140060530
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or eax, ecx
cmp rbx, r8
jae 0x1400605e7
sub r9, r11
lea r10, [rbx + r11]
sub r8, rbx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r10 + r9]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
xor edx, ecx
or eax, edx
sub r8, 1
jne 0x1400605d0
mov rbx, qword [rsp + 8]
test eax, eax
sete al
ret
Function at 0x140060600
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x140060744
cmp r9, 4
jb 0x14006064a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x140060630
xor r11d, r11d
test r9, r9
je 0x140060744
cmp r9, 0x40
jb 0x140060718
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14006067c
cmp rdx, r8
jae 0x140060718
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x140060691
cmp rdx, r10
jae 0x140060718
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
mov rbx, rcx
sub rdx, r8
mov rax, r8
sub rbx, r8
movdqu xmm0, xmmword [rax]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax]
movdqu xmm2, xmmword [rdx + rax + 0x10]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm2, xmmword [rdx + rax - 0x10]
movdqu xmmword [rbx + rax - 0x20], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x10], xmm2
cmp r11, rdi
jb 0x1400606b0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x140060744
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x140060730
add rsp, 8
ret
Function at 0x1400a1f5c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400a1cc0
Function at 0x1400bd200
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400bd213
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400c7104
lea rdx, [0x14011c988]
lea rcx, [rsp + 0x20]
call fcn.1400932b8
int3

Function at 0x1400c7a9c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14012c498]
xor edx, edx
jmp fcn.1400bd200

Function at 0x1400c8434
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14012c498]
jmp fcn.1400bd200

Function at 0x1400d3ff0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400d40ac]
mov r9, qword [r9 + 8]
jmp fcn.1400c5260

Function at 0x1400d4084
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400d40bc]
mov r9, qword [r9 + 8]
jmp fcn.1400c5260

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002240]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002230]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140002dc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002e0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002e0c
xor al, al
add rsp, 0x28
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140006d50]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x140006d60]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call fcn.140003680
jmp 0x14000123c
mov rax, qword [0x140006d60]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x140006d60]
mov dword [rax], 1
mov rax, qword [0x140006da0]
mov rdx, rax
mov rax, qword [0x140006d90]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000123c
mov dword [0x14000b024], 1
mov rax, qword [0x140006d60]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x140006d80]
mov rdx, rax
mov rax, qword [0x140006d70]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov rax, qword [0x140006d60]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140006d50]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x140006ca0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x140006ca0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.140002908
mov rax, qword [0x140006de0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140006d40]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140002100
mov eax, dword [0x14000b004]
lea rdx, [0x14000b008]
mov ecx, eax
call fcn.14000147c
call fcn.140001e97
mov rax, qword [0x140006cd0]
mov rax, qword [rax]
mov rdx, qword [0x14000b010]
mov qword [rax], rdx
mov rcx, qword [0x14000b010]
mov rdx, qword [0x14000b008]
mov eax, dword [0x14000b004]
mov r8, rcx
mov ecx, eax
call fcn.1400039a0
mov dword [0x14000b01c], eax
mov eax, dword [0x14000b020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14000b01c]
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x14000b024]
test eax, eax
jne 0x14000136c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x14000b01c]
add rsp, 0x70
pop rbp
ret