joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rsi, r9
mov r10, rdx
mov qword [rsp + 0x20], rdx
mov r13, rcx
movsxd r8, dword [rdx + 0x3c]
movsxd rax, dword [rcx + 0x3c]
mov r9d, dword [r8 + rdx + 0x88]
mov r8d, dword [rax + rcx + 0x88]
test r9d, r9d
jne 0x180006018
test r8d, r8d
je 0x1800061f7
mov rbp, r9
lea r11, [r8 + rcx]
mov qword [rsp + 0x28], r11
add rbp, rdx
jne 0x180006032
test r11, r11
je 0x1800061f7
mov ebx, dword [rbp + 0x20]
add rbx, rdx
mov qword [rsp + 0x30], rbx
mov edi, dword [r11 + 0x20]
add rdi, r13
mov qword [rsp + 0x38], rdi
xor r15d, r15d
cmp dword [rbp + 0x18], r15d
jbe 0x1800061f7
nop word [rax + rax]
lea r8, [r15 + r15]
mov eax, dword [rbp + 0x24]
add rax, r8
movzx edx, word [rax + r10]
mov ecx, dword [rbp + 0x1c]
add rcx, r10
mov r12d, dword [rcx + rdx*4]
mov eax, dword [r11 + 0x24]
add rax, r8
movzx edx, word [rax + r13]
mov ecx, dword [r11 + 0x1c]
add rcx, r13
mov r14d, dword [rcx + rdx*4]
add r14, r13
add r12, r10
je 0x1800061ea
test r14, r14
je 0x1800061ea
mov edx, dword [rbx + r15*4]
add rdx, r10
mov edi, dword [rdi + r15*4]
add rdi, r13
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1800060c0
dec rcx
call fcn.1800043d0
mov ebx, eax
not ebx
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1800060e0
dec rcx
mov rdx, rdi
call fcn.1800043d0
not eax
cmp ebx, eax
jne 0x1800061d6
cmp ebx, 0xf33c2ac
je 0x1800061d6
cmp ebx, 0x2078f304
je 0x1800061d6
cmp ebx, 0x46926cf5
je 0x1800061d6
cmp ebx, 0x5100831b
je 0x1800061d6
cmp ebx, 0x515def78
je 0x1800061d6
cmp ebx, 0x6db71dcd
je 0x1800061d6
cmp ebx, 0xc8827a2a
je 0x1800061d6
cmp ebx, 0xa9554556
je 0x1800061d6
mov r8d, 4
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, 4
je 0x1800061d6
test rsi, rsi
je 0x1800061cb
mov rbx, qword [rsi]
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rsi + 8], rax
je 0x18000620f
mov qword [rsp + 0x40], rsi
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x48], rdi
lea ecx, [rdi + 0x18]
call fcn.18000e220
mov qword [rsp + 0x48], rax
mov qword [rax + 0x10], r12
inc qword [rsi + 8]
mov rcx, qword [rbx + 8]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 8], rax
mov qword [rcx], rax
mov r8, r14
mov rdx, r12
call fcn.180005eb0
mov r10, qword [rsp + 0x20]
mov r11, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
inc r15d
cmp r15d, dword [rbp + 0x18]
jb 0x180006060
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.list_too_long
call fcn.18000e0a8
int3
Function at 0x180006220
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
push r15
sub rsp, 0x80
mov rax, qword [0x18003f040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [r11 - 0x48], 8
mov qword [r11 - 0x58], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x48], eax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x30]
mov r15, qword [rcx + 0x60]
test r15, r15
je 0x1800063ff
mov qword [r11 - 0x20], r13
mov eax, 0x5a4d
mov r13, qword [r15 + 0x10]
cmp word [r13], ax
jne 0x1800063fa
movsxd rax, dword [r13 + 0x3c]
cmp dword [rax + r13], 0x4550
jne 0x1800063fa
mov qword [r11 - 0x28], r14
mov r14d, dword [rax + r13 + 0x90]
add r14, r13
cmp dword [r14], 0
je 0x1800063f5
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov ecx, dword [r14 + 0xc]
add rcx, r13
call fcn.18000ca40
mov r12, rax
test rax, rax
je 0x1800063d3
mov esi, dword [r14]
add rsi, qword [r15 + 0x10]
mov ebx, dword [r14 + 0x10]
add rbx, qword [r15 + 0x10]
mov rcx, qword [rsi]
test rcx, rcx
js 0x1800063c5
je 0x1800063c5
mov rdx, qword [r15 + 0x10]
add rdx, 2
mov qword [rsp + 0x30], rbx
mov rbp, qword [rbx]
add rdx, rcx
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x180006315
dec rcx
call fcn.1800043d0
not eax
mov rcx, r12
mov edx, eax
call fcn.18000cb50
mov rdi, rax
test rbp, rbp
je 0x1800063a8
test rax, rax
je 0x1800063a8
cmp rbp, rax
je 0x1800063a8
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], 8
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x30]
call fcn.18000dd88
test eax, eax
js 0x1800063a8
mov qword [rbx], rdi
lea rax, [rsp + 0x48]
mov r9d, dword [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], 8
call fcn.18000dd88
add rsi, 8
mov qword [rsp + 0x30], 0
add rbx, 8
mov rcx, qword [rsi]
test rcx, rcx
jns 0x1800062f5
add r14, 0x14
cmp dword [r14], 0
jne 0x1800062c2
mov rbx, qword [rsp + 0x90]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18000e0e0
add rsp, 0x80
pop r15
ret
Function at 0x18000c590
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18003f040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rcx + r8*2], 0
jne 0x18000c5b0
dec r8
cmp r8, 0xffffffffffffffff
jne 0x18000c5cb
mov eax, 0xffffffff
jmp 0x18000c5f1
lea rcx, [r8 - 1]
mov rdx, rbx
call fcn.180004350
movzx edx, word [rbx + r8*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
lea rdx, [0x18003a430]
xor eax, dword [rdx + rcx*4]
not eax
xor edx, edx
mov ecx, eax
call fcn.18000c810
test rax, rax
jne 0x18000c69c
mov rax, qword [0x1800e4890]
test rax, rax
jne 0x18000c64b
xor edx, edx
mov ecx, 0x84c05e40
call fcn.18000c810
mov edx, 0xfa2a9aa9
mov rcx, rax
call fcn.18000cb50
mov qword [0x1800e4890], rax
test rax, rax
jne 0x18000c64b
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18000e0e0
add rsp, 0x40
pop rbx
ret
mov rdx, rbx
lea rcx, [rsp + 0x28]
call rax
mov r10, qword [0x1800e4898]
test r10, r10
jne 0x18000c67f
mov edx, 0xa09b055e
mov ecx, 0x84c05e40
call fcn.18000ce60
mov qword [0x1800e4898], rax
mov r10, rax
test rax, rax
je 0x18000c636
xor eax, eax
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18000e0e0
add rsp, 0x40
pop rbx
ret
Function at 0x18000ce60
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
xor edx, edx
call fcn.18000c810
mov edx, ebx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.18000cb50

Function at 0x18000d210
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rbp, rcx
test rcx, rcx
je 0x18000d29f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000d29f
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
cmp dword [rsi], 0x4550
jne 0x18000d29f
xor edi, edi
cmp di, word [rsi + 6]
jae 0x18000d29f
nop word [rax + rax]
movzx ecx, word [rsi + 0x14]
lea rdx, [rdi + rdi*4]
add rcx, rsi
lea rbx, [rcx + rdx*8]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx + 0x18], 0
jne 0x18000d276
dec rcx
lea rdx, [rbx + 0x18]
call fcn.1800043d0
not eax
cmp eax, 0xa21c1ea3
je 0x18000d2bc
movzx eax, word [rsi + 6]
inc edi
cmp edi, eax
jb 0x18000d260
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [r14], rbp
mov eax, dword [rbx + 0x24]
add rax, rbp
mov qword [r14 + 8], rax
mov eax, dword [rbx + 0x28]
mov dword [r14 + 0x10], eax
mov eax, dword [rbx + 0x24]
sub eax, dword [rbx + 0x2c]
mov dword [r14 + 0x14], eax
mov eax, 1
jmp 0x18000d2a1
Function at 0x18000dc65
Capabilities:
Check os version
Execute syscall

Disassembly:
xor al, 0x5a
mov r10, qword gs:[0x60]
cmp word [r10 + 0x118], 0xa
je 0x18000dcb7
cmp word [r10 + 0x118], 6
je 0x18000dc88
jmp 0x18000dcde
cmp word [r10 + 0x11c], 3
je 0x18000dcb9
cmp word [r10 + 0x11c], 2
je 0x18000dcbb
cmp word [r10 + 0x11c], 1
jne 0x18000dcde
cmp word [r10 + 0x120], 0x1db1
je 0x18000dcbd
jmp 0x18000dcde
inc eax
inc eax
inc eax
cmp qword [0x1800e4718], 0
jne 0x18000dcd3
cmp eax, 0xc390050f
pop r10
mov r10, rcx
jne 0x18000dcc8
syscall
nop
ret
pop r10
mov r10, rcx
jmp qword [0x1800e4718]
ret
Function at 0x1800225bc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800225ec
xor eax, eax
jmp 0x1800226af
mov rbp, rbx
cmp word [rax], si
je 0x180022611
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800225f8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800225f4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18002250c
movsxd r14, eax
test eax, eax
jne 0x18002264f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800225e5
mov rcx, r14
call fcn.18001f580
mov rdi, rax
test rax, rax
jne 0x180022668
xor ecx, ecx
call fcn.18001f544
jmp 0x180022644
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18002250c
test eax, eax
jne 0x180022699
mov rcx, rdi
call fcn.18001f544
jmp 0x1800226a3
xor ecx, ecx
call fcn.18001f544
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800288f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180028918
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180028918
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000579c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov bl, cl
lea rcx, [0x140070012]
call fcn.140041b34
cmp byte [0x140068aa3], 0
je 0x1400057c8
test bl, bl
je 0x140005931
lea rax, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatTrunkInstaller_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000592a
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14000592a
and dword [rbp + 0x20], eax
lea ebx, [rax + 4]
and dword [rbp + 0x18], eax
cmp byte [0x140068aa3], al
mov dword [rbp + 0x28], ebx
jne 0x140005850
lea rax, [rbp + 0x28]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
lea rdx, str.bIsSingleClientApp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005850
cmp dword [rbp + 0x20], ebx
jne 0x140005850
cmp dword [rbp + 0x18], eax
setne byte [0x140068aa1]
cmp byte [0x140068aa1], 0
je 0x140005920
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.bIsSCAcroAppInstalled
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000589e
cmp dword [rbp + 0x20], ebx
jne 0x14000589e
cmp dword [rbp + 0x18], eax
setne byte [0x140068aa0]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.SCAPackageLevel
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400058e3
mov eax, dword [section..data]
cmp dword [rbp + 0x20], ebx
cmove eax, dword [rbp + 0x18]
mov dword [section..data], eax
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
xor r8d, r8d
lea rdx, str.IsAcrInstalledInRdrMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005920
cmp dword [rbp + 0x20], ebx
jne 0x140005920
cmp dword [rbp + 0x18], eax
setne byte [0x140068aa2]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x140068aa3], 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140012efc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
lea rcx, [0x1400700b8]
call fcn.140041b34
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rbx, rbx
je 0x140012f48
movzx eax, byte [r9 + rdi]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, rbx
jb 0x140012f2a
mov rbx, qword [rsp + 0x30]
mov rax, r8
add rsp, 0x20
pop rdi
ret
Function at 0x1400353f8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x38
lea rcx, [0x1400703dd]
call fcn.140041b34
xor ebx, ebx
call fcn.140011a5c
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesAdobeAcrobat_ReaderTrunkFeatureLockDown_
cmp eax, 1
mov r9d, 0x20019
lea rax, [rbp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
je 0x140035441
lea rdx, str.SOFTWAREPoliciesAdobeAdobe_AcrobatTrunkFeatureLockDown_
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003549d
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14003549d
lea rax, [rbp + 0x28]
mov dword [rbp + 0x18], ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.iMIPCloud
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140035493
cmp dword [rbp + 0x18], 4
cmove ebx, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
ret
Function at 0x180004150
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
mov rax, qword [0x180015060]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsxd rbp, ecx
mov r14, rdx
lea rcx, str.CLASSPATH
mov word [rsp + 0x20], 0x3b
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edi, 0x28
test rax, rax
je 0x1800041ef
mov rcx, rax
call fcn.18000ac74
mov rcx, rax
mov rsi, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rsi
lea rbx, [rdi + rax]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rbx, rax
jbe 0x1800041ef
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rcx, [rdi + rax]
call sym.jli.dll_JLI_MemAlloc
mov r8, rsi
lea rdx, str._Denv.class.path_s
mov rcx, rax
mov rbx, rax
call fcn.1800077d8
xor edx, edx
mov rcx, rbx
call fcn.180004310
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1800081cc
test al, al
jne 0x180004215
lea rcx, str.Error:_Could_not_determine_application_home.
call sym.jli.dll_JLI_ReportErrorMessage
xor al, al
jmp 0x1800042e5
lea rcx, [rsp + 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rcx, [rdi + rax]
call sym.jli.dll_JLI_MemAlloc
lea r8, [rsp + 0x30]
mov rcx, rax
lea rdx, str._Dapplication.home_s
mov rbx, rax
call fcn.1800077d8
xor edx, edx
mov rcx, rbx
call fcn.180004310
test ebp, ebp
jle 0x1800042e3
mov rsi, rbp
xor ebp, ebp
mov rcx, qword [r14 + rbp*8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rcx, [rsp + 0x30]
mov rbx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, ebx
inc edi
add edi, eax
inc rbp
cmp rbp, rsi
jl 0x180004256
lea eax, [rdi + 1]
movsxd rcx, eax
call sym.jli.dll_JLI_MemAlloc
lea rdx, str._Djava.class.path
mov rcx, rax
mov rbx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
test rsi, rsi
je 0x1800042cc
xor edi, edi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
mov rdx, qword [r14 + rdi*8]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
inc rdi
cmp rdi, rsi
jl 0x18000429e
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
xor edx, edx
mov rcx, rbx
mov byte [rax + rbx - 1], 0
call fcn.180004310
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18000b420
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18000724c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rcx, str._JAVA_SPLASH_JAR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea rcx, str._JAVA_SPLASH_FILE
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov dword [rsp + 0x50], 0x3f800000
mov rdi, rax
test rax, rax
je 0x180007398
call fcn.18000a86c
test eax, eax
je 0x18000735c
mov rcx, rdi
call fcn.18000a82c
movsxd rbx, eax
mov rcx, rbx
call sym.jli.dll_JLI_MemAlloc
mov r9, rax
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, rsi
mov rbp, rax
call fcn.18000a7b4
test rsi, rsi
je 0x18000732d
test al, al
je 0x1800072e5
lea r8, [rsp + 0x58]
mov rdx, rbp
mov rcx, rsi
call fcn.1800092fc
mov rbx, rax
test rax, rax
jne 0x180007305
lea r8, [rsp + 0x58]
mov dword [rsp + 0x50], 0x3f800000
mov rdx, rdi
mov rcx, rsi
call fcn.1800092fc
mov rbx, rax
test rax, rax
je 0x180007326
movss xmm0, dword [rsp + 0x50]
call fcn.18000a970
mov edx, dword [rsp + 0x58]
mov rcx, rbx
call fcn.18000a8e0
mov rcx, rbx
call sym.jli.dll_JLI_MemFree
jmp 0x180007349
call fcn.18000a784
jmp 0x180007349
test al, al
je 0x180007341
movss xmm0, dword [rsp + 0x50]
call fcn.18000a970
mov rcx, rbp
jmp 0x180007344
mov rcx, rdi
call fcn.18000a8a0
mov rcx, rbp
call sym.jli.dll_JLI_MemFree
mov rdx, rsi
mov rcx, rdi
call fcn.18000a928
lea rcx, str._JAVA_VERSION_SET
call fcn.180008c84
lea rcx, str._JAVA_SPLASH_FILE
call fcn.180008c84
lea rcx, str._JAVA_SPLASH_JAR
call fcn.180008c84
mov rcx, qword [0x1800150f8]
call sym.jli.dll_JLI_MemFree
mov rcx, qword [0x1800150f0]
call sym.jli.dll_JLI_MemFree
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800079f4
Capabilities:
Create thread
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x18], 0
lea rax, [rax + 0x20]
mov rsi, rdx
mov qword [rsp + 0x28], rax
mov r9, rdx
mov dword [rsp + 0x20], 0x10000
mov rdi, rcx
lea r8, [0x180008c44]
mov edx, ecx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rbx, rax
test rax, rax
jne 0x180007a60
lea rax, [rsp + 0x58]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x180008c44]
and dword [rsp + 0x20], ebx
mov edx, edi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rbx, rax
cmp dword [0x180015048], 0
je 0x180007b1c
lea rcx, str.J2D_D3D
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x180007a99
lea rdx, str.false
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
neg eax
sbb ecx, ecx
and dword [0x180015048], ecx
lea rcx, str.J2D_D3D_PRELOAD
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
je 0x180007ad0
lea rdx, str.false
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
neg eax
sbb ecx, ecx
and ecx, dword [0x180015048]
mov dword [0x180015048], ecx
jmp 0x180007ad6
mov ecx, dword [0x180015048]
test ecx, ecx
jns 0x180007b0e
and dword [0x180015048], 0
test rdi, rdi
je 0x180007b1c
lea rdx, str.true
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, dword [0x180015048]
mov edx, 1
test eax, eax
cmove ecx, edx
mov dword [0x180015048], ecx
test ecx, ecx
je 0x180007b1c
lea rcx, str.preloadD3D
call fcn.18000787c
test rbx, rbx
je 0x180007b46
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180007b52
mov rcx, rsi
call fcn.180005174
mov dword [rsp + 0x50], eax
cmp dword [0x180015148], 0
je 0x180007b69
mov rax, qword [0x180015170]
test rax, rax
je 0x180007b69
call rax
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180007ecc
Capabilities:
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x78
mov rax, qword [0x180015060]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, qword [rsp + 0xd0]
mov r14, rdx
mov rbx, qword [rsp + 0xe0]
mov rsi, rcx
mov edx, r9d
mov rcx, r8
mov rbp, r8
call fcn.180008298
test al, al
jne 0x180007f28
lea rcx, str.Error:_Could_not_find_Java_SE_Runtime_Environment.
call sym.jli.dll_JLI_ReportErrorMessage
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsxd rdx, dword [rsp + 0xe8]
lea rax, [0x18000f5e4]
mov qword [rsp + 0x28], rax
lea r8, str._s_slib_sjvm.cfg
mov r9, rbp
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.180007780
xor edx, edx
mov rcx, rbx
call fcn.180006a58
mov r12d, 1
cmp eax, r12d
jge 0x180007f7e
lea rcx, str.Error:_no_known_VMs.__check_for_corrupt_jvm.cfg_file_
call sym.jli.dll_JLI_ReportErrorMessage
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call fcn.18000448c
lea rdx, str.ERROR
mov rcx, rax
mov rbx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x180007fba
lea rcx, str.Error:_could_not_determine_JVM_type.
call sym.jli.dll_JLI_ReportErrorMessage
mov ecx, 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0x2f
mov byte [rdi], 0
mov rcx, rbx
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x180008000
lea edx, [rax + 0x5c]
mov rcx, rbx
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x180008000
movsxd rdx, dword [rsp + 0xd8]
lea r8, str._s_bin_sjvm.dll
mov r9, rbp
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call fcn.180007780
jmp 0x18000801a
movsxd rdx, dword [rsp + 0xd8]
lea r8, str._sjvm.dll
mov r9, rbx
mov rcx, rdi
call fcn.180007780
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800080d8
mov rbx, qword [r14]
xor edi, edi
cmp dword [rsi], edi
jle 0x1800080b5
mov ecx, dword [0x180015048]
test ecx, ecx
jns 0x180008067
mov rdx, qword [rbx]
lea rcx, str._Dsun.awt.warmup
call fcn.180008248
mov ecx, dword [0x180015048]
cmp eax, r12d
cmove ecx, r12d
mov dword [0x180015048], ecx
test ecx, ecx
je 0x1800080aa
mov rdx, qword [rbx]
lea rcx, str._Dsun.java2d.noddraw
call fcn.180008248
cmp eax, r12d
je 0x1800080cf
mov rdx, qword [rbx]
lea rcx, str._Dsun.java2d.d3d
call fcn.180008248
test eax, eax
je 0x1800080cf
mov rdx, qword [rbx]
lea rcx, str._Dsun.java2d.opengl
call fcn.180008248
cmp eax, r12d
je 0x1800080cf
mov ecx, dword [0x180015048]
add edi, r12d
add rbx, 8
cmp edi, dword [rsi]
jl 0x18000803f
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000b420
add rsp, 0x78
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
and dword [0x180015048], 0
jmp 0x1800080b5
mov r8, rdi
lea rcx, str.Error:_missing___s_JVM_at___s._nPlease_install_or_use_the_JRE_or_JDK_that_contains_these_missing_components.
mov rdx, rbx
call sym.jli.dll_JLI_ReportErrorMessage
mov ecx, 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3