joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1de5c8920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5c89f8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov dword [rsp + 0x1f], 0xad0e04ff
mov dword [rsp + 0x22], 0xeb6420ad
movabs rdx, 0x300060406020205
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x100
xor eax, eax
jmp 0x1de5c8980
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x1de5c89b7
movzx edx, byte [rsp + rax + 0x26]
lea rsi, [rax + 1]
cmp rsi, 0xa
jae 0x1de5c89ea
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 7
jae 0x1de5c89de
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 7
jb 0x1de5c8962
jmp 0x1de5c89d2
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 7
call fcn.1de48b520
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 7
call fcn.1de49fa60
mov eax, edi
mov ecx, 7
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0xa
call fcn.1de49fa60
nop
call fcn.1de49d360
nop dword [rax]
jmp fcn.1de5c8920

Function at 0x1de5ca520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5ca5ed
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov dword [rsp + 0x1d], 0xe951e3dd
mov byte [rsp + 0x21], 0x73
mov dword [rsp + 0x22], 0x1020000
mov word [rsp + 0x26], 0x103
xor eax, eax
jmp 0x1de5ca575
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x6f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x6f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 6
jge 0x1de5ca5ac
movzx edx, byte [rsp + rax + 0x22]
lea rsi, [rax + 1]
cmp rsi, 6
jae 0x1de5ca5df
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 5
jae 0x1de5ca5d3
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 5
jb 0x1de5ca558
jmp 0x1de5ca5c7
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 5
call fcn.1de48b520
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 5
call fcn.1de49fa60
mov eax, edi
mov ecx, 5
call fcn.1de49fa60
mov rax, rsi
mov ecx, 6
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de5ca520
Function at 0x1de5ca9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5caaa9
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6f87a8827d8b6570
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x809a
movabs rdx, 0x5080405060509
mov qword [rsp + 0x22], rdx
movabs rdx, 0x204090203030005
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x1de5caa2d
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 2]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 2]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x1de5caa68
movzx edx, byte [rsp + rax + 0x22]
lea rsi, [rax + 1]
nop dword [rax]
cmp rsi, 0xe
jae 0x1de5caa9b
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x1de5caa8f
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x1de5caa10
jmp 0x1de5caa83
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.1de48b520
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.1de49fa60
mov eax, edi
mov ecx, 0xa
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0xe
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de5ca9c0

Function at 0x1de5def00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5deff8
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x2c87c76525cab4cd
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0xc3e964a3
movabs rdx, 0x60a0101030b0806
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa07060a0101030b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50506070a00020b
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x1de5def80
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x4b]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x4b]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x1de5defb7
movzx edx, byte [rsp + rax + 0x26]
lea rsi, [rax + 1]
cmp rsi, 0x12
jae 0x1de5defea
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x1de5defde
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xc
jb 0x1de5def62
jmp 0x1de5defd2
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.1de48b520
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
call fcn.1de49fa60
mov eax, edi
mov ecx, 0xc
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x12
call fcn.1de49fa60
nop
call fcn.1de49d360
nop dword [rax]
jmp fcn.1de5def00
Function at 0x1de5e0ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5e0c73
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movabs rdx, 0x4b5d4f6b4b61384b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x206060400050307
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x1de5e0bf7
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 - 0x14]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 - 0x14]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x1de5e0c2e
movzx edx, byte [rsp + rax + 0x18]
lea rsi, [rax + 1]
cmp rsi, 8
jae 0x1de5e0c65
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x1de5e0c55
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x1de5e0bda
jmp 0x1de5e0c49
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.1de48b520
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 8
call fcn.1de49fa60
mov eax, edi
mov ecx, 8
nop dword [rax]
call fcn.1de49fa60
mov rax, rsi
mov ecx, 8
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de5e0ba0

Function at 0x1de5e1740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5e185f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x91c1b53060c2a5b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd36f8cca2d64f72b
mov qword [rsp + 0x24], rdx
movabs rdx, 0xfa26ba4979247365
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x602120d0609170c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x302131316090f03
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xb12131603021313
mov qword [rsp + 0x40], rdx
movabs rdx, 0x508070215020215
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x1de5e17e2
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x71]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x71]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x1c
jge 0x1de5e1819
movzx edx, byte [rsp + rax + 0x34]
lea rsi, [rax + 1]
cmp rsi, 0x1c
jae 0x1de5e1851
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x1de5e1845
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x18
jb 0x1de5e17c5
jmp 0x1de5e1834
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.1de48b520
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
nop dword [rax + rax]
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x18
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x1c
call fcn.1de49fa60
nop
nop
call fcn.1de49d360
jmp fcn.1de5e1740
Function at 0x1de5e1880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5e199f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xf742ec50bb7030ee
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xdbb7373f5f742ec
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf2a7ea906ce57856
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x30b061001020c11
mov qword [rsp + 0x34], rdx
movabs rdx, 0x11050212060c0807
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x50e0f0011050212
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11305140d051210
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x1de5e1920
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x57]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x1de5e195c
movzx edx, byte [rsp + rax + 0x34]
lea rsi, [rax + 1]
cmp rsi, 0x1c
jae 0x1de5e1991
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x1de5e1985
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x57]
cmp rsi, 0x15
jb 0x1de5e1905
jmp 0x1de5e1977
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.1de48b520
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
nop
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x15
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x1c
call fcn.1de49fa60
nop
nop
call fcn.1de49d360
jmp fcn.1de5e1880
Function at 0x1de5e2e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x1de5e301f
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rdx, 0x5de6150206d2bb1
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3c1bf19d209b938e
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe063636ff7c23c1b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x749737207327b97a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x53116a02641eeac0
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x7660c8f863b47274
mov qword [rsp + 0x44], rdx
movabs rdx, 0x22b0a241f281b0a
mov qword [rsp + 0x4c], rdx
movabs rdx, 0xa0e2c062409171e
mov qword [rsp + 0x54], rdx
movabs rdx, 0xc0c0a1f0a0e2c06
mov qword [rsp + 0x58], rdx
movabs rdx, 0x100f2a06062c
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe0e16080a151d10
mov qword [rsp + 0x68], rdx
movabs rdx, 0xe110f1c06232d2c
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1c20080608222c16
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2d07060d092b2310
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x1de5e2fa0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x3c]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x3c]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x3c
jge 0x1de5e2fd7
movzx edx, byte [rsp + rax + 0x4c]
lea rsi, [rax + 1]
cmp rsi, 0x3c
jae 0x1de5e3011
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2e
jae 0x1de5e3005
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x2e
jb 0x1de5e2f7f
jmp 0x1de5e2ff8
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x2e
call fcn.1de48b520
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov eax, esi
mov ecx, 0x2e
nop
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x2e
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x3c
call fcn.1de49fa60
nop
nop
call fcn.1de49d360
jmp fcn.1de5e2e80
Function at 0x1de5e4460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r12, rsp
sub r12, 0x1c08
jb 0x1de5e45b4
cmp r12, qword [r14 + 0x10]
jbe 0x1de5e45b4
sub rsp, 0x1c88
mov qword [rsp + 0x1c80], rbp
lea rbp, [rsp + 0x1c80]
movabs rdx, 0x1b6a63d51ca6ea48
mov qword [rsp + 0x18], rdx
movabs rdx, 0xfc36653659ba8ad6
mov qword [rsp + 0x20], rdx
lea rdi, [rsp + 0x24]
lea rsi, [0x1de633c3f]
mov ecx, 0xe4
rep movsq qword [rdi], qword [rsi]
movabs rdx, 0x5be055f05e205e1
mov qword [rsp + 0x744], rdx
movabs rdx, 0x5060188012500b2
mov qword [rsp + 0x74c], rdx
lea rdi, [rsp + 0x750]
lea rsi, [0x1de66d844]
mov ecx, 0x2a6
rep movsq qword [rdi], qword [rsi]
xor eax, eax
jmp 0x1de5e4520
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6b]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa9e
jge 0x1de5e456d
movzx edx, word [rsp + rax*2 + 0x744]
lea rsi, [rax + 1]
cmp rsi, 0xa9e
jae 0x1de5e45a6
movzx esi, word [rsp + rax*2 + 0x746]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x72c
jae 0x1de5e459a
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6b]
cmp rsi, 0x72c
jb 0x1de5e4502
jmp 0x1de5e458e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x72c
call fcn.1de48b520
mov rbp, qword [rsp + 0x1c80]
add rsp, 0x1c88
ret
mov eax, esi
mov ecx, 0x72c
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x72c
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0xa9e
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de5e4460

Function at 0x1de5ecbf0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1de5eda40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1de5eda40
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1de5ecc60
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1de7a8724]
mov rbx, rcx
test esi, esi
jle 0x1de5ecd90
mov rax, qword [0x1de7a8728]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1de5eccab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1de5ecd35
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1de5ecc90
mov rcx, rbx
call fcn.1de5ed4c0
mov rdi, rax
test rax, rax
je 0x1de5ecdb2
mov rax, qword [0x1de7a8728]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1de5ed600
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1de7a8728]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1de5ecd97
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1de5ecd2e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1de5ecd40
add dword [0x1de7a8724], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1de7a8728]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1de5ecd2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1de5ecbf0
nop dword [rax]
xor esi, esi
jmp 0x1de5eccb8
mov rax, qword [0x1de7a8728]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1de5ecbf0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1de5ecbf0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1de5ed130
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1de7a8760]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1de7a8740]
test rbx, rbx
je 0x1de5ed18c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1de5ed183
test rsi, rsi
je 0x1de5ed183
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1de5ed168
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1de5ed4c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1de748af0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1de5ed4e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1de5ed4e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1de5ed4e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1de5ed53d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1de5ed534
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1de5ed4e0
add rax, 0x28
cmp rax, r9
jne 0x1de5ed520
xor eax, eax
ret

Function at 0x1de5ed540
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1de748af0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1de5ed55f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1de5ed568
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1de5ed55f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1de5ed600
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1de748af0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1de5ed61f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1de5ed628
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140051920
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005192d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005193d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140051925
lea eax, [rcx + 1]
jmp 0x14005194b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14005195e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140051944
sub eax, 3
jb 0x14005197e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400519cd
sar eax, 1
movsxd rbp, eax
jb 0x1400519b4
jmp 0x14005198c
add ebx, ebx
jne 0x14005198a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400519b4
inc ecx
add ebx, ebx
jne 0x14005199a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400519b4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400519ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14005199c
add ecx, 2
jmp 0x1400519b9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400518e2
jmp 0x14005192d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2d000
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140051a1d
cmp rsi, rcx
jae 0x140051a25
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140051a04
cmp al, 0x8f
ja 0x140051a04
cmp byte [rsi - 2], 0xf
je 0x140051a0a
sub al, 0xe8
cmp al, 1
ja 0x1400519ee
cmp rsi, rcx
jae 0x140051a25
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400519f4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140051a25
lodsb al, byte [rsi]
jmp 0x140051a04
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x4f000]
mov eax, dword [rdi]
or eax, eax
je 0x140051a82
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x51b44]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140051a32
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140051a7c
mov qword [rbx], rax
add rbx, 8
jmp 0x140051a52
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140051abc
cmp al, 0xef
ja 0x140051aae
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140051a8e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140051a9d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140051b10
sub rsp, 0xffffffffffffff80
jmp 0x140013ff0
Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x1400019ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a36
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a38
xor al, al
add rsp, 0x28
ret
Function at 0x140007e20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
movups xmm0, xmmword [r8 + 0x10]
mov r11, qword [r8 + 0x18]
mov rdi, rdx
xor edx, edx
mov r10, rcx
movaps xmmword [rsp + 0x20], xmm0
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x140007e73
mov rcx, qword [rsp + 0x20]
movabs rbx, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
inc rdx
xor r9, rax
imul r9, rbx
cmp rdx, r11
jb 0x140007e60
mov rdx, qword [r10 + 0x30]
and rdx, r9
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x140007ea7
cmp rax, r8
jne 0x140007e9d
mov rax, qword [r10 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140007eb2
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x140007eb2
cmp rax, r8
jne 0x140007eb2
mov rax, qword [r8]
mov qword [rdx], rax
mov rbx, qword [r8]
mov edx, gethostname
dec qword [r10 + 0x10]
mov rcx, qword [r8 + 8]
mov qword [rcx], rbx
mov rcx, qword [r8 + 8]
mov qword [rbx + 8], rcx
mov rcx, r8
call fcn.1401130b0
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret