joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ced0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14022c4a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x44], edx
mov qword [rsp + 0x38], rcx
mov eax, dword [0x14021c3b0]
add eax, 0x8eac9d9
mov dword [rsp + 0x4c], eax
mov eax, dword [0x14021c3b4]
add eax, 0x97348b42
mov dword [rsp + 0x48], eax
mov eax, dword [0x14021c3b8]
add eax, 0x5ff04a5
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [str.YtK]
add ecx, 0x838ba6a2
cmp eax, ecx
jne 0x14001cfb4
mov rcx, qword [rsp + 0x38]
mov edx, dword [0x14021c3c0]
add edx, 0xd17c6fb4
mov r8d, dword [0x14021c3c4]
add r8d, 0xfe36488c
mov eax, dword [0x14021c3c8]
add eax, 0xd31ff814
lea r9, [rsp + 0x4c]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x38]
mov edx, dword [0x14021c3cc]
add edx, 0x84a2e21e
mov r8d, dword [0x14021c3d0]
add r8d, 0xbb08aab1
mov eax, dword [0x14021c3d4]
add eax, 0x5c9e91f3
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, dword [rsp + 0x34]
mov dword [rsp + 0x34], eax
jmp 0x14001d10c
mov eax, dword [rsp + 0x44]
mov ecx, dword [str.h_v]
add ecx, 0x57357a2b
cmp eax, ecx
jne 0x14001d04f
mov rcx, qword [rsp + 0x38]
mov edx, dword [0x14021c3dc]
add edx, 0x3c71f497
mov r8d, dword [0x14021c3e0]
add r8d, 0x89c15859
mov eax, dword [0x14021c3e4]
add eax, 0xf08cd714
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x38]
mov edx, dword [0x14021c3e8]
add edx, 0xbd69ea16
mov r8d, dword [0x14021c3ec]
add r8d, 0xc2b486d2
mov eax, dword [0x14021c3f0]
add eax, 0x3c8c6c17
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, dword [rsp + 0x34]
mov dword [rsp + 0x34], eax
jmp 0x14001d10a
mov eax, dword [rsp + 0x44]
mov ecx, dword [str._Lpi]
add ecx, 0x968fb3a7
cmp eax, ecx
jne 0x14001d0e7
mov rcx, qword [rsp + 0x38]
mov edx, dword [0x14021c3f8]
add edx, 0x49067afe
mov r8d, dword [0x14021c3fc]
add r8d, 0xe894e59f
mov eax, dword [str.._P]
add eax, 0xafd8c0d6
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x38]
mov edx, dword [0x14021c404]
add edx, 0x76d9473
mov r8d, dword [0x14021c408]
add r8d, 0xb8e70df5
mov eax, dword [0x14021c40c]
add eax, 0xca4fca1a
lea r9, [rsp + 0x4c]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, dword [rsp + 0x34]
mov dword [rsp + 0x34], eax
jmp 0x14001d108
mov ecx, dword [0x14021c410]
add ecx, 0x9bec1efc
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x14021c414]
add eax, 0xdb3d6579
mov dword [rsp + 0x34], eax
jmp 0x14001d10a
jmp 0x14001d10c
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401e0600
mov eax, dword [rsp + 0x30]
add rsp, 0x58
ret
Function at 0x14001d130
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14022c4a0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], edx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x30]
mov edx, dword [0x14021c418]
add edx, 0x8f552f0d
mov r8d, dword [0x14021c41c]
add r8d, 0x2aa04bd6
mov eax, dword [0x14021c420]
add eax, 0xa5792e8f
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x2c], eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401e0600
mov eax, dword [rsp + 0x2c]
add rsp, 0x48
ret

Function at 0x14001d6d0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14022c4a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
mov eax, dword [0x14021c4e4]
add eax, 0xfa94a6fe
mov dword [rsp + 0x44], eax
mov eax, dword [0x14021c4e8]
add eax, 0xee9c5243
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xd0]
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x58], rcx
mov rax, qword [rsp + 0x50]
mov ecx, dword [0x14021c4ec]
add ecx, 0xb19f70bf
mov dword [rax + 0x28], ecx
mov rcx, qword [rsp + 0x50]
call fcn.14001d800
mov rcx, qword [rsp + 0x48]
call fcn.14001d820
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
add rdx, 0x30
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x58]
mov r8d, dword [0x14021c4f0]
add r8d, 0xeff4a771
mov r10d, dword [0x14021c4f4]
add r10d, 0x8b75aa55
lea r9, [rsp + 0x5c]
xor r11d, r11d
mov dword [rsp + 0x20], r10d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov ecx, dword [0x14021c4f8]
add ecx, 0xca0ee9ef
cmp eax, ecx
jne 0x14001d7d6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [0x14021c4fc]
add ecx, 0xda00d45e
cmp eax, ecx
je 0x14001d7d4
mov rcx, qword [rsp + 0x48]
call fcn.14001d840
jmp 0x14001d7d6
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401e0600
mov eax, dword [rsp + 0x40]
add rsp, 0x68
ret
Function at 0x14001d8b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14022c4a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
mov eax, dword [0x14021c508]
add eax, 0xf070f9fc
mov dword [rsp + 0x44], eax
mov eax, dword [0x14021c50c]
add eax, 0xf89d8a21
mov dword [rsp + 0x5c], eax
mov eax, dword [0x14021c510]
add eax, 0x3744c05d
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xd0]
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x58], rcx
mov rax, qword [rsp + 0x50]
mov ecx, dword [0x14021c514]
add ecx, 0x9788ae3d
mov dword [rax + 0x28], ecx
mov rcx, qword [rsp + 0x48]
call fcn.14001d820
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
add rdx, 0x30
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x58]
mov r8d, dword [0x14021c518]
add r8d, 0x6ceebb90
lea r9, [rsp + 0x58]
lea r10, [rsp + 0x5c]
xor r11d, r11d
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.WS2_32.dll_WSARecv]
mov ecx, dword [0x14021c51c]
add ecx, 0xa9fcc601
cmp eax, ecx
jne 0x14001d9b2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [0x14021c520]
add ecx, 0x48f00f87
cmp eax, ecx
je 0x14001d9b0
mov rcx, qword [rsp + 0x48]
call fcn.14001d840
jmp 0x14001d9b2
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401e0600
mov eax, dword [rsp + 0x40]
add rsp, 0x68
ret

Function at 0x14001d9d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14022c4a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rcx
mov eax, dword [0x14021c578]
add eax, 0x83c88507
mov dword [rsp + 0x3c], eax
mov eax, dword [0x14021c57c]
add eax, 0xf5312721
mov dword [rsp + 0x4c], eax
mov eax, dword [0x14021c580]
add eax, 0x1beaab2e
mov dword [rsp + 0x48], eax
mov rdx, qword [rsp + 0x40]
add rdx, 0x30
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x58]
mov r8d, dword [0x14021c584]
add r8d, 0x9b7afdd7
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x4c]
xor r10d, r10d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.WS2_32.dll_WSARecv]
mov ecx, dword [0x14021c588]
add ecx, 0xcb6c7e29
cmp eax, ecx
jne 0x14001da7b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14001daae
mov eax, dword [rsp + 0x48]
mov ecx, dword [0x14021c58c]
add ecx, 0x8ba9579b
cmp eax, ecx
jbe 0x14001da9d
mov ecx, dword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x30], ecx
jmp 0x14001daac
mov eax, dword [0x14021c590]
add eax, 0xf1231765
mov dword [rsp + 0x3c], eax
jmp 0x14001daae
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401e0600
mov eax, dword [rsp + 0x38]
add rsp, 0x58
ret
Function at 0x140024810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x68
mov al, byte [0x14022e546]
mov byte [rsp + 0x23], al
mov dword [rsp + 0x5c], r8d
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140024858
mov qword [rsp + 0x60], 0
jmp 0x14002498f
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14002487e
mov qword [rsp + 0x60], 0
jmp 0x14002498f
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x34]
add rax, rcx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [0x14021e458]
add ecx, 0x6adef626
and eax, ecx
mov dword [rsp + 0x24], eax
mov al, byte [rsp + 0x23]
mov ecx, dword [rsp + 0x24]
mov edx, dword [0x14021e45c]
add edx, 0xa9ae2cb2
cmp ecx, edx
mov byte [rsp + 0x22], al
jbe 0x1400248e6
mov rax, qword [rsp + 0x40]
cmp rax, qword [rsp + 0x38]
setb al
mov byte [rsp + 0x22], al
mov al, byte [rsp + 0x22]
test al, 1
jne 0x1400248f0
jmp 0x14002494b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
movzx ecx, word [rcx]
mov edx, ecx
movabs rcx, 0x4dd08b1c4a3a66c7
add rcx, qword [0x14021e460]
imul rdx, rcx
movabs rcx, 0xa133300950d974e1
add rcx, qword [0x14021e468]
add rcx, rdx
add rax, rcx
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x24]
mov ecx, dword [0x14021e470]
add ecx, 0x8851467c
add eax, ecx
mov dword [rsp + 0x24], eax
jmp 0x1400248b9
mov rax, qword [rsp + 0x40]
cmp rax, qword [rsp + 0x38]
jb 0x140024962
mov qword [rsp + 0x60], 0
jmp 0x14002498f
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
mov ecx, dword [0x14021e474]
add ecx, 0xdcea48d7
cmp eax, ecx
jne 0x140024985
mov qword [rsp + 0x60], 0
jmp 0x14002498f
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
add rsp, 0x68
ret

Function at 0x140025ac0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop
add rsp, 0x28
ret
Function at 0x140025b20
Capabilities:
Initialize winsock library

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rax, qword [0x14022c4a0]
xor rax, rbp
mov qword [rbp - 8], rax
mov byte [rbp - 0x11], r9b
mov byte [rbp - 0x12], r8b
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0
jne 0x140025b77
mov eax, 0x1a0
call fcn.1401e0e10
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x30]
movzx eax, byte [rbp - 0x11]
movabs rcx, 0xd117e7c5998574dc
add rcx, qword [0x14021fec8]
and rax, rcx
movzx eax, al
movzx ecx, byte [rbp - 0x12]
movabs r8, 0xd8dbebe12900124d
add r8, qword [0x14021fed0]
and rcx, r8
movzx ecx, cl
movzx r8d, cx
mov ecx, dword [0x14021fed8]
add ecx, 0x8f2553d4
shl r8d, cl
mov ecx, r8d
or eax, ecx
mov cx, ax
sub rsp, 0x20
call qword [sym.imp.WS2_32.dll_WSAStartup]
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp - 0x38]
mov dword [rax], ecx
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x40], rax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.1401e0600
mov rax, qword [rbp - 0x40]
mov rsp, rbp
pop rbp
ret
Function at 0x1401e6bfc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1401e6c33
call fcn.1401e6db8
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1401e71c4
xor eax, eax
jmp 0x1401e6cc1
mov rdx, r9
mov rcx, r8
call fcn.1401e6b98
mov rbx, rax
test rax, rax
je 0x1401e6cbe
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1401e6ac4]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401e6cab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401e6d2c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1401e6c92
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1401e6ca1
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1401f1918
jmp 0x1401e6cbe
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401e6cbb
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1401ef8f4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401ef6f0
Function at 0x1401f7a14
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1401f7a44
xor eax, eax
jmp 0x1401f7b07
mov rbp, rbx
cmp word [rax], si
je 0x1401f7a69
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1401f7a50
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1401f7a4c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401f7934
movsxd r14, eax
test eax, eax
jne 0x1401f7aa7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401f7a3d
mov rcx, r14
call fcn.1401f1954
mov rdi, rax
test rax, rax
jne 0x1401f7ac0
xor ecx, ecx
call fcn.1401f1918
jmp 0x1401f7a9c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401f7934
test eax, eax
jne 0x1401f7af1
mov rcx, rdi
call fcn.1401f1918
jmp 0x1401f7afb
xor ecx, ecx
call fcn.1401f1918
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1401f7b24
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1401f7bab
mov rsi, rbx
cmp word [rax], bp
je 0x1401f7b6a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1401f7b54
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1401f7b50
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1401f1954
mov rdi, rax
test rax, rax
je 0x1401f7b98
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1401e25b0
mov rbp, rdi
xor ecx, ecx
call fcn.1401f1918
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401fdfa0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1401fdfdd
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.1401e0de4
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1401fe0dc
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1401e0de4
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x1401fe050
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.1401cad40
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x1401fe11b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401fe11b
call fcn.1401e0620
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x1401fe102
mov rcx, r14
call fcn.1401e0620
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x140001000
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
call fcn.140012830
mov rcx, qword [rax]
mov qword [0x1400411f8], rcx
lea rcx, str._JAVA_LAUNCHER_DEBUG
call fcn.140012ac4
test rax, rax
je 0x14000106c
lea rcx, str.Windows_original_main_args:_n
call fcn.14000115c
xor ebx, ebx
call fcn.1400121f8
cmp dword [rax], ebx
jle 0x14000106c
xor edi, edi
call fcn.140012200
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.14000115c
inc ebx
lea rdi, [rdi + 8]
call fcn.1400121f8
cmp ebx, dword [rax]
jl 0x140001043
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call fcn.140001304
call fcn.1400013a8
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call fcn.1400011b8
mov rbx, rax
call fcn.1400013b0
xor r9d, r9d
test edi, edi
jle 0x1400010b8
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a5
mov rdx, qword [str.openjdk]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rdx, rdx
jne 0x1400010cf
mov rdx, qword [rbx]
mov rcx, qword [section..data]
test rcx, rcx
jne 0x1400010de
mov rcx, qword [rbx]
mov r9, qword [0x14003fce0]
mov r8d, 1
test r9, r9
setne al
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 1
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x50], al
lea rax, [0x14002e4bc]
mov qword [rsp + 0x48], rdx
mov rdx, rbx
mov qword [rsp + 0x40], rcx
mov ecx, edi
mov qword [rsp + 0x38], rax
lea rax, [0x14002e4c0]
mov qword [rsp + 0x30], rax
mov rax, qword [0x14003fce8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call fcn.140001da8
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400047cc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x14003f068]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov rbx, rdx
mov edi, ecx
call fcn.140004a84
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140004a5c
movzx ecx, byte [rbx + 0xf]
shl rcx, 8
cmp byte [0x14003fda0], 0
je 0x1400049fd
movzx eax, byte [rbx + 0xa]
movzx edx, byte [rbx + 0xb]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 9]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 8]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 0xe]
or rcx, rax
movzx eax, byte [rbx + 0xd]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 0xc]
shl rcx, 8
or rcx, rax
shl rcx, 0x20
or rdx, rcx
jl 0x140004a5c
xor r8d, r8d
mov ecx, edi
call fcn.140019fbc
test rax, rax
js 0x140004a5c
mov r8d, 0x400
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.14001d90c
test eax, eax
js 0x140004a5c
movzx eax, byte [rsp + 0x22]
movzx ecx, byte [rsp + 0x23]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x21]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x20]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6064b50
jne 0x140004a5c
movzx eax, byte [rsp + 0x56]
movzx edx, byte [rsp + 0x57]
movzx r8d, byte [rsp + 0x53]
shl edx, 8
or edx, eax
shl r8d, 8
movzx eax, byte [rsp + 0x55]
shl edx, 8
or edx, eax
movzx eax, byte [rsp + 0x54]
shl edx, 8
or rdx, rax
movzx eax, byte [rsp + 0x52]
or r8d, eax
shl rdx, 0x20
movzx eax, byte [rsp + 0x51]
shl r8d, 8
or r8d, eax
movzx eax, byte [rsp + 0x50]
shl r8d, 8
or r8, rax
or rdx, r8
jl 0x140004a5c
xor r8d, r8d
mov ecx, edi
call fcn.140019fbc
test rax, rax
js 0x140004a5c
movzx eax, byte [rsp + 0x4e]
mov r8, 0xffffffffffffffc8
movzx edx, byte [rsp + 0x4f]
movzx ecx, byte [rsp + 0x4b]
shl rdx, 8
or rdx, rax
shl rcx, 8
movzx eax, byte [rsp + 0x4d]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x4c]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x4a]
or rcx, rax
shl rdx, 0x20
movzx eax, byte [rsp + 0x49]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsp + 0x48]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsp + 0x56]
or rdx, rcx
movzx ecx, byte [rsp + 0x53]
sub r8, rdx
shl rcx, 8
movzx edx, byte [rsp + 0x57]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x55]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x54]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x52]
or rcx, rax
shl rdx, 0x20
movzx eax, byte [rsp + 0x51]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsp + 0x50]
shl rcx, 8
or rcx, rax
or rdx, rcx
sub r8, rdx
add rsi, r8
jmp 0x140004a57
movzx eax, byte [rbx + 0x12]
xor r8d, r8d
movzx edx, byte [rbx + 0x13]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 0x11]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 0x10]
shl rdx, 8
or rdx, rax
movzx eax, byte [rbx + 0xe]
or rcx, rax
movzx eax, byte [rbx + 0xd]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 0xc]
shl rcx, 8
or rcx, rax
add rcx, rdx
sub rsi, rcx
mov ecx, edi
add rdx, rsi
call fcn.140019fbc
test rax, rax
js 0x140004a5c
mov rax, rsi
jmp 0x140004a60
or rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.14000ac80
mov rbx, qword [rsp + 0x460]
add rsp, 0x430
pop rdi
pop rsi
pop rbp
ret