joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rsi, qword [0x14002e940]
xor edx, edx
xor ecx, ecx
call fcn.140001ce4
lea rcx, str._JAVA_LAUNCHER_DEBUG
call fcn.14000adb4
test rax, rax
je 0x14000106f
lea rcx, str.Windows_original_main_args:_n
call fcn.14000ac64
xor ebx, ebx
cmp dword [0x14002ebcc], ebx
jle 0x14000106f
xor edi, edi
mov r8, qword [0x14002ebd0]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rdi + r8]
call fcn.14000ac64
inc ebx
lea rdi, [rdi + 8]
cmp ebx, dword [0x14002ebcc]
jl 0x140001048
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call fcn.140001600
call fcn.1400017f8
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call fcn.1400014d4
mov rbx, rax
call fcn.140001800
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010bb
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a8
mov rcx, qword [0x14002d028]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010d2
mov rcx, qword [rbx]
mov rax, qword [0x14002d020]
test rax, rax
jne 0x1400010e1
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x14002049c]
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [0x1400204a0]
mov rdx, rbx
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov ecx, edi
call fcn.140002e40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140001534
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str._JAVA_LAUNCHER_DEBUG
call fcn.14000adb4
test rax, rax
je 0x140001563
lea rdx, str._JAVA_LAUNCHER_DEBUG
lea rcx, str._____s_____n
mov byte [0x14002e958], 1
call fcn.1400015c4
add rsp, 0x28
ret
Function at 0x140001600
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov r15d, 1
mov byte [rsp + 0x50], 0
mov ecx, r15d
call fcn.1400013d4
lea rdx, str.JDK_JAVA_OPTIONS
mov rcx, rax
mov rbx, rax
call fcn.140001ad4
test al, al
je 0x14000167a
lea rcx, str._JAVA_LAUNCHER_DEBUG
call fcn.14000adb4
test rax, rax
je 0x14000167a
lea rcx, str._JAVA_OPTIONS
call fcn.14000adb4
test rax, rax
je 0x14000167a
lea rdx, str._JAVA_OPTIONS
lea rcx, str.NOTE:_Picked_up__s:__s
mov r8, rax
call fcn.140003374
mov rbp, qword [rbx + 8]
add rbp, r15
mov rcx, rbp
shl rcx, 4
call fcn.1400014d4
mov rcx, rdi
mov rsi, rax
call fcn.140001598
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, rdi
mov r14, rax
call fcn.140001808
mov rcx, r14
mov r12, rax
call fcn.140001598
mov cl, byte [rsp + 0x50]
mov edi, r15d
mov r8, r15
mov byte [rsi + 8], cl
mov qword [rsi], rax
cmp r15, rbp
jae 0x1400016ec
lea rdx, [rsi + 0x10]
mov edi, ebp
mov rax, qword [rbx]
mov rcx, qword [rax + r8*8 - 8]
add r8, r15
mov byte [rdx + 8], 0
mov qword [rdx], rcx
lea rdx, [rdx + 0x10]
cmp r8, rbp
jb 0x1400016d1
mov rcx, qword [rbx]
call fcn.140001500
mov rcx, rbx
call fcn.140001500
mov byte [r14], 0
test r12, r12
je 0x1400017ca
movsxd r15, edi
lea r8, [rsp + 0x50]
mov rdx, r14
mov rcx, r12
call fcn.140001808
mov rcx, r14
mov r12, rax
call fcn.140001d28
mov rcx, rsi
mov rbx, rax
test rax, rax
je 0x14000178b
mov rbp, qword [rax + 8]
movsxd rdx, edi
add rdx, rbp
shl rdx, 4
call fcn.140001508
xor r8d, r8d
mov rsi, rax
test rbp, rbp
je 0x140001779
mov rdx, r15
add edi, ebp
shl rdx, 4
add rdx, rax
add r15, rbp
mov rax, qword [rbx]
mov rcx, qword [rax + r8*8]
inc r8
mov byte [rdx + 8], 0
mov qword [rdx], rcx
lea rdx, [rdx + 0x10]
cmp r8, rbp
jb 0x14000175f
mov rcx, qword [rbx]
call fcn.140001500
mov rcx, rbx
call fcn.140001500
jmp 0x1400017bd
inc edi
movsxd rdx, edi
shl rdx, 4
call fcn.140001508
mov rbx, r15
mov rcx, r14
mov rsi, rax
add rbx, rbx
call fcn.140001598
mov qword [rsi + rbx*8], rax
mov al, byte [rsp + 0x50]
inc r15
mov byte [rsi + rbx*8 + 8], al
mov byte [r14], 0
mov byte [r14], 0
test r12, r12
jne 0x14000170c
mov rcx, r14
call fcn.140001500
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov dword [0x14002e968], edi
mov qword [0x14002e960], rsi
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140001ad4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, rcx
mov rcx, rdx
mov rbp, rdx
call fcn.14000adb4
cmp dword [0x14002d070], 0
mov rbx, rax
jne 0x140001b15
xor al, al
jmp 0x140001c57
cmp byte [0x14002e96e], 0
jne 0x140001b0e
test rax, rax
je 0x140001b0e
lea rcx, str.NOTE:_Picked_up__s:__s
mov r8, rax
mov rdx, rbp
call fcn.140003374
mov rcx, rbx
call fcn.14000bfb0
mov r12d, 1
lea rcx, [r12 + rax]
call fcn.1400014d4
mov rdi, rax
mov cl, byte [rbx]
test cl, cl
je 0x140001c54
movsx ecx, cl
call fcn.14000cb78
test eax, eax
je 0x140001b6e
add rbx, r12
mov cl, byte [rbx]
test cl, cl
jne 0x140001b59
mov al, byte [rbx]
test al, al
je 0x140001c54
mov r14, rdi
movsx ecx, al
call fcn.14000cb78
test eax, eax
jne 0x140001bbf
mov al, byte [rbx]
cmp al, 0x22
je 0x140001ba5
cmp al, 0x27
je 0x140001ba5
mov byte [rdi], al
add rdi, r12
jmp 0x140001bb6
test cl, cl
je 0x140001c8c
mov byte [rdi], cl
add rdi, r12
add rbx, r12
mov cl, byte [rbx]
cmp cl, al
jne 0x140001b98
test cl, cl
je 0x140001c8c
add rbx, r12
mov al, byte [rbx]
test al, al
jne 0x140001b7b
mov byte [rdi], 0
mov rcx, r14
add rdi, r12
call fcn.140001d28
mov rsi, rax
test rax, rax
jne 0x140001bf2
mov rcx, r14
call fcn.140001f5c
mov rdx, r14
test eax, eax
jne 0x140001ca4
mov rcx, r15
call fcn.14000114c
jmp 0x140001c45
mov r13, qword [rax + 8]
xor r15d, r15d
test r13, r13
je 0x140001c30
mov rax, qword [rsi]
mov r12, qword [rax + r15*8]
mov rcx, r12
call fcn.140001f5c
mov rdx, r12
test eax, eax
jne 0x140001cbc
mov rcx, qword [rsp + 0x50]
call fcn.14000114c
mov r12d, 1
add r15, r12
cmp r15, r13
jb 0x140001bfe
mov rcx, qword [rsi]
call fcn.140001500
mov rcx, rsi
call fcn.140001500
mov r15, qword [rsp + 0x50]
cmp dword [0x14002d070], 0xffffffff
je 0x140001b4f
jmp 0x140001c74
mov al, r12b
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.Error:_Cannot_specify_main_class_in_environment_variable__s
mov rdx, rbp
call fcn.140003374
mov ecx, r12d
call fcn.14000b300
int3
lea rcx, str.Error:_Unmatched_quote_in_environment_variable__s
mov rdx, rbp
call fcn.140003374
mov ecx, r12d
call fcn.14000b300
int3
lea rcx, str.Error:_Option__s_is_not_allowed_in_environment_variable__s
mov r8, rbp
call fcn.140003374
mov ecx, r12d
call fcn.14000b300
int3
lea rcx, str.Error:_Option__s_in__s_is_not_allowed_in_environment_variable__s
mov r9, rbp
mov r8, r14
call fcn.140003374
mov ecx, 1
call fcn.14000b300
int3
Function at 0x140002308
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0xf68]
mov eax, 0x1060
call fcn.14000cd90
sub rsp, rax
mov rax, qword [0x14002d4f0]
xor rax, rsp
mov qword [rbp + 0xf50], rax
and dword [rsp + 0x20], 0
mov rsi, rcx
mov ecx, 4
call fcn.1400013d4
mov ecx, 8
mov rbx, rax
mov qword [rsp + 0x40], rax
call fcn.1400013d4
mov rcx, rsi
mov rdi, rax
call fcn.14000c5e0
test eax, eax
jne 0x1400023fc
lea rcx, [rsp + 0x50]
mov r9, rsi
mov edx, 1
mov r8d, 0x1000
call fcn.14000c934
mov rcx, rsi
mov rbx, rax
call fcn.14000c608
test eax, eax
jne 0x140002450
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
add rax, rbx
mov qword [rsp + 0x30], rax
jmp 0x1400023cb
mov rcx, rbx
call fcn.140001da4
mov rdx, rbx
mov rcx, rdi
call fcn.14000114c
lea rcx, [rsp + 0x20]
call fcn.1400020a0
mov rbx, rax
test rax, rax
jne 0x1400023b8
mov rcx, rsi
call fcn.14000c5e0
test eax, eax
je 0x140002374
cmp dword [rsp + 0x20], 5
je 0x14000242f
cmp dword [rsp + 0x20], 2
je 0x14000242f
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1400012d0
mov rax, rdi
mov rcx, qword [rbp + 0xf50]
xor rcx, rsp
call fcn.14000cdf0
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rbx, qword [rsp + 0x40]
cmp qword [rbx + 8], 0
je 0x1400023fc
mov rcx, rbx
call fcn.1400011f4
mov rcx, rdi
mov rdx, rax
call fcn.14000114c
jmp 0x1400023fc
mov rcx, rdi
call fcn.1400012d0
xor eax, eax
jmp 0x140002407
Function at 0x14000245c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x14002d4f0]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsxd r14, ecx
lea rcx, str.CLASSPATH
mov r15, rdx
mov word [rsp + 0x20], 0x3b
call fcn.14000adb4
mov ebp, 0x28
test rax, rax
je 0x140002500
mov rcx, rax
call fcn.140007ce0
mov rcx, rax
mov rdi, rax
call fcn.14000bfb0
mov rcx, rdi
lea rbx, [rax + 0x28]
call fcn.14000bfb0
cmp rbx, rax
jbe 0x140002500
mov rcx, rdi
call fcn.14000bfb0
lea rcx, [rax + rbp]
call fcn.1400014d4
lea rdx, str._Denv.class.path_s
mov r8, rdi
mov rcx, rax
mov rbx, rax
call fcn.14000d4ac
xor edx, edx
mov rcx, rbx
call fcn.140002628
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140007238
test al, al
jne 0x140002526
lea rcx, str.Error:_Could_not_determine_application_home.
call fcn.140007500
xor al, al
jmp 0x1400025f8
lea rcx, [rsp + 0x30]
call fcn.14000bfb0
lea rcx, [rax + rbp]
call fcn.1400014d4
lea r8, [rsp + 0x30]
lea rdx, str._Dapplication.home_s
mov rcx, rax
mov rbx, rax
call fcn.14000d4ac
xor edx, edx
mov rcx, rbx
call fcn.140002628
test r14d, r14d
jle 0x1400025f6
xor esi, esi
test r14d, r14d
jle 0x14000258d
mov rcx, qword [r15 + rsi*8]
call fcn.14000bfb0
lea rcx, [rsp + 0x30]
lea ebx, [rax + rbp]
call fcn.14000bfb0
inc rsi
lea ebp, [rax + 1]
add ebp, ebx
cmp rsi, r14
jl 0x14000256a
lea eax, [rbp + 1]
movsxd rcx, eax
call fcn.1400014d4
lea rdx, str._Djava.class.path
mov rcx, rax
mov rbx, rax
call fcn.14000d8c0
xor esi, esi
test r14d, r14d
jle 0x1400025df
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000d820
mov rdx, qword [r15 + rsi*8]
mov rcx, rbx
call fcn.14000d820
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000d820
inc rsi
cmp rsi, r14
jl 0x1400025b1
mov rcx, rbx
call fcn.14000bfb0
xor edx, edx
mov rcx, rbx
mov byte [rax + rbx - 1], 0
call fcn.140002628
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000cdf0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400054f4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rcx, str._JAVA_SPLASH_JAR
call fcn.14000adb4
lea rcx, str._JAVA_SPLASH_FILE
mov rsi, rax
call fcn.14000adb4
mov dword [rsp + 0x50], 0x3f800000
mov rdi, rax
test rax, rax
je 0x140005636
mov rcx, rax
call fcn.140007de8
movsxd rbx, eax
mov rcx, rbx
call fcn.1400014d4
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, rsi
mov r9, rax
mov qword [rsp + 0x20], rbx
mov rbp, rax
call fcn.140007d70
mov bl, al
test rsi, rsi
je 0x1400055c6
test al, al
je 0x140005580
lea r8, [rsp + 0x58]
mov rdx, rbp
mov rcx, rsi
call fcn.140005994
mov rbx, rax
test rax, rax
jne 0x1400055a0
lea r8, [rsp + 0x58]
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x50], 0x3f800000
call fcn.140005994
mov rbx, rax
test rax, rax
je 0x1400055e7
call fcn.140007e28
movss xmm0, dword [rsp + 0x50]
call fcn.140007f28
mov edx, dword [rsp + 0x58]
mov rcx, rbx
call fcn.140007e98
mov rcx, rbx
call fcn.140001500
jmp 0x1400055e7
call fcn.140007e28
test bl, bl
je 0x1400055df
movss xmm0, dword [rsp + 0x50]
call fcn.140007f28
mov rcx, rbp
jmp 0x1400055e2
mov rcx, rdi
call fcn.140007e58
mov rcx, rbp
call fcn.140001500
mov rdx, rsi
mov rcx, rdi
call fcn.140007ee0
lea rcx, str._JAVA_VERSION_SET
call fcn.1400079b8
lea rcx, str._JAVA_SPLASH_FILE
call fcn.1400079b8
lea rcx, str._JAVA_SPLASH_JAR
call fcn.1400079b8
mov rcx, qword [0x14002e9d0]
call fcn.140001500
mov rcx, qword [0x14002e9c8]
call fcn.140001500
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005e98
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov rbp, rdx
mov edi, 2
mov rdx, 0xffffffffffffffea
mov r8d, edi
mov r12, r9
mov esi, ecx
call fcn.14000dd7c
mov rbx, rax
test rax, rax
js 0x140006033
lea r8d, [rdi + 0x14]
mov rdx, rbp
mov ecx, esi
call fcn.140013b90
test eax, eax
js 0x140006033
xor ecx, ecx
cmp byte [rbp + 1], 0x4b
sete cl
xor eax, eax
cmp byte [rbp + 3], 6
sete al
and ecx, eax
xor eax, eax
cmp byte [rbp + 2], 5
sete al
and ecx, eax
xor eax, eax
cmp byte [rbp], 0x50
sete al
test eax, ecx
mov ecx, esi
je 0x140005f3b
mov r8, rbx
mov rdx, rbp
mov r9, r13
mov qword [rsp + 0x20], r12
call fcn.140006054
jmp 0x140006036
mov r8d, edi
xor edx, edx
call fcn.14000dd7c
mov r15, rax
test rax, rax
js 0x140006033
mov r14d, 0x10015
mov r8d, edi
mov ecx, esi
cmp rax, r14
mov ebx, r14d
cmovl rbx, rax
mov rdx, rbx
neg rdx
call fcn.14000dd7c
test rax, rax
js 0x140006033
mov ecx, r14d
call fcn.14000c130
mov rdi, rax
test rax, rax
je 0x140006033
mov r8d, ebx
mov rdx, rax
mov ecx, esi
call fcn.140013b90
test eax, eax
js 0x14000602b
movsxd r14, eax
add eax, 0xffffffea
movsxd rbx, eax
add r14, rdi
add rbx, rdi
cmp rbx, rdi
jb 0x14000602b
xor ecx, ecx
cmp byte [rbx + 1], 0x4b
sete cl
xor eax, eax
cmp byte [rbx + 3], 6
sete al
and ecx, eax
xor eax, eax
cmp byte [rbx + 2], 5
sete al
and ecx, eax
xor eax, eax
cmp byte [rbx], 0x50
sete al
test eax, ecx
je 0x140005fff
movzx eax, byte [rbx + 0x15]
shl eax, 8
movsxd rcx, eax
movzx eax, byte [rbx + 0x14]
or rcx, rax
lea rax, [rbx + 0x16]
add rax, rcx
cmp rax, r14
je 0x140006004
dec rbx
jmp 0x140005fb2
mov r8d, 0x16
mov rdx, rbx
mov rcx, rbp
call fcn.14000ba30
mov rcx, rdi
call fcn.14000c0f0
sub rbx, r14
mov ecx, esi
lea r8, [r15 + rbx]
jmp 0x140005f26
mov rcx, rdi
call fcn.14000c0f0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000633c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x80
cmp qword [rdx + 8], 0xffffffffffffffff
mov r14, r8
mov rdi, rdx
mov esi, ecx
je 0x140006493
cmp qword [rdx], 0xffffffffffffffff
je 0x140006493
mov rdx, qword [rdx + 0x10]
xor r8d, r8d
call fcn.14000dd7c
test rax, rax
js 0x140006493
mov rcx, qword [rdi + 8]
inc rcx
call fcn.14000c130
mov rbx, rax
test rax, rax
je 0x140006493
mov r15, qword [rdi + 8]
mov rdx, rax
mov ecx, esi
mov r8d, r15d
call fcn.140013b90
movsxd rcx, eax
cmp rcx, r15
jne 0x14000648b
cmp dword [rdi + 0x18], 0
jne 0x1400063dd
mov byte [r15 + rbx], 0
test r14, r14
je 0x1400063d5
mov eax, dword [rdi + 8]
mov dword [r14], eax
mov rax, rbx
jmp 0x140006495
cmp dword [rdi + 0x18], 8
jne 0x14000648b
mov eax, dword [rdi + 8]
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov r9d, 0x58
lea r8, str.1.2.11
lea rcx, [rsp + 0x20]
lea edx, [r9 - 0x67]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], eax
call fcn.1400095dc
test eax, eax
js 0x14000648b
mov rcx, qword [rdi]
inc rcx
call fcn.14000c130
mov rsi, rax
test rax, rax
je 0x14000648b
mov qword [rsp + 0x30], rax
mov eax, dword [rdi]
lea rcx, [rsp + 0x20]
mov edx, 1
mov dword [rsp + 0x38], eax
call fcn.140007f68
mov rcx, rbx
test eax, eax
jns 0x140006462
call fcn.14000c0f0
mov rcx, rsi
jmp 0x14000648e
mov rax, qword [rdi]
mov byte [rsi + rax], 0
call fcn.14000c0f0
lea rcx, [rsp + 0x20]
call fcn.140009594
test eax, eax
js 0x14000645d
test r14, r14
je 0x140006486
mov eax, dword [rdi]
mov dword [r14], eax
mov rax, rsi
jmp 0x140006495
mov rcx, rbx
call fcn.14000c0f0
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret

Function at 0x140006880
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, r9
mov ebp, r8d
mov rdi, rdx
mov esi, ecx
test rdx, rdx
js 0x1400068d2
xor r8d, r8d
call fcn.14000dd7c
cmp rax, rdi
jne 0x1400068d2
mov r8d, ebp
mov rdx, r14
mov ecx, esi
call fcn.140013b90
movsxd rcx, eax
cmp rcx, rbp
jne 0x1400068d2
mov ebx, 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x140006a68
Capabilities:
Create thread
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax + 0x20], 0
lea rax, [rax - 0x18]
mov rsi, r8
mov r9, r8
mov rbp, rcx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov rdi, rdx
mov dword [rsp + 0x20], 0x10000
call fcn.14000e0a8
mov rbx, rax
test rax, rax
jne 0x140006acf
lea rax, [rsp + 0x30]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], ebx
mov edx, edi
xor ecx, ecx
call fcn.14000e0a8
mov rbx, rax
cmp dword [0x14002d0e0], 0
je 0x140006b86
lea rcx, str.J2D_D3D
call fcn.14000adb4
test rax, rax
je 0x140006b06
lea rdx, str.false
mov rcx, rax
call fcn.14001f40c
neg eax
sbb ecx, ecx
and dword [0x14002d0e0], ecx
lea rcx, str.J2D_D3D_PRELOAD
call fcn.14000adb4
mov rdi, rax
test rax, rax
je 0x140006b3b
lea rdx, str.false
mov rcx, rax
call fcn.14001f40c
neg eax
sbb ecx, ecx
and ecx, dword [0x14002d0e0]
mov dword [0x14002d0e0], ecx
jmp 0x140006b41
mov ecx, dword [0x14002d0e0]
test ecx, ecx
jns 0x140006b78
and dword [0x14002d0e0], 0
test rdi, rdi
je 0x140006b86
lea rdx, str.true
mov rcx, rdi
call fcn.14001f40c
mov ecx, dword [0x14002d0e0]
mov edx, 1
test eax, eax
cmove ecx, edx
mov dword [0x14002d0e0], ecx
test ecx, ecx
je 0x140006b86
lea rcx, str.preloadD3D
call fcn.1400068f0
test rbx, rbx
je 0x140006bb0
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006bb9
mov rcx, rsi
call rbp
mov dword [rsp + 0x68], eax
cmp dword [0x14002ea08], 0
je 0x140006bd0
mov rax, qword [0x14002ea28]
test rax, rax
je 0x140006bd0
call rax
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140007ce0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, 0x2a
mov rbx, rcx
call fcn.14000d978
test rax, rax
jne 0x140007d06
mov rax, rbx
jmp 0x140007d5f
mov dl, 0x3b
mov rcx, rbx
call fcn.140001414
mov rcx, rax
mov rsi, rax
call fcn.140007a10
test eax, eax
je 0x140007d2e
mov dl, 0x3b
mov rcx, rsi
call fcn.140001320
mov rdi, rax
jmp 0x140007d31
mov rdi, rbx
mov rcx, rsi
call fcn.1400012d0
lea rcx, str._JAVA_LAUNCHER_DEBUG
call fcn.14000adb4
test rax, rax
je 0x140007d5c
lea rcx, str.Expanded_wildcards:_n____before:___s__n____after_:___s__n
mov r8, rdi
mov rdx, rbx
call fcn.14000ac64
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009928
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x14002d4f0]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rdi, qword [rbp + 0xc0]
lea rax, [rsp + 0x50]
mov esi, r9d
mov r14d, r8d
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rbx, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140009998
lea rdx, str.SoftwareJavaSoftJRE
lea rcx, str.FindPublicJREHome:_RegOpenKeyEx__s_s__failed._n
mov r8, rbx
call fcn.1400015c4
jmp 0x140009a3f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea r8, str.RuntimeLib
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x48], 0x104
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x1400099f0
lea rcx, str.FindPublicJREHome:_GetStringFromRegistry__s_sRuntimeLib__failed._n
lea rdx, str.SoftwareJavaSoftJRE
mov r8, rbx
call fcn.1400015c4
jmp 0x140009a34
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.140009b24
test al, al
jne 0x140009a65
lea rdx, [rsp + 0x60]
lea rcx, str.IsFileVersionEqual:_GetFileVersion__s__failed._n
call fcn.1400015c4
lea r9, [rsp + 0x60]
lea rdx, str.SoftwareJavaSoftJRE
lea rcx, str.FindPublicJREHome:_ignore__s_sRuntimeLib__s_:_file_version_doesnt_match._n
mov r8, rbx
call fcn.1400015c4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14000cdf0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp dword [rsp + 0x48], r14d
jne 0x140009a19
cmp dword [rsp + 0x40], esi
jne 0x140009a19
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r8, str.JavaHome
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x140009abe
lea rcx, str.FindPublicJREHome:_GetStringFromRegistry__s_sJavaHome__failed._n
jmp 0x1400099df
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsxd rdx, dword [rbp + 0xc8]
lea r9, [rsp + 0x60]
lea r8, [0x140021d40]
mov rcx, rdi
call fcn.1400075dc
test eax, eax
jns 0x140009b04
mov edx, dword [rbp + 0xc8]
lea r8, [rsp + 0x60]
lea rcx, str.FindPublicJREHome:_JLI_Snprintf__d___s__failed._n
call fcn.1400015c4
jmp 0x140009a3f
lea rdx, str.SoftwareJavaSoftJRE
lea rcx, str.FindPublicJREHome:__s_sJavaHome__s_._n
mov r9, rdi
mov r8, rbx
call fcn.1400015c4
mov al, 1
jmp 0x140009a41
Function at 0x140009b24
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, rdx
lea rdx, [rax + 0x20]
mov r14, r8
mov rbp, rcx
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test eax, eax
je 0x140009bd4
mov ecx, esi
call fcn.1400014d4
mov rdi, rax
test rax, rax
jne 0x140009b77
lea rcx, str.GetFileVersion:_JLI_MemAlloc__d__failed._n
mov edx, esi
call fcn.1400015c4
xor al, al
jmp 0x140009bd6
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x140009bbd
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x140021a04]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x140009bcc
mov rcx, qword [rsp + 0x28]
mov bl, 1
mov eax, dword [rcx + 8]
mov dword [r15], eax
mov eax, dword [rcx + 0xc]
mov dword [r14], eax
jmp 0x140009bcc
lea rcx, str.GetFileVersion:_GetFileVersionInfo__s__failed._n
mov rdx, rbp
call fcn.1400015c4
mov rcx, rdi
call fcn.140001500
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret