joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fcb0
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x58], 0x40
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
lea r8, [rsp + 0x40]
mov edx, 0xf003f
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0
jge 0x4fd6f
mov edx, dword [rsp + 0x88]
lea rcx, str.ZwOpenKey_failed__x__n
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x88]
jmp 0x4fe33
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0xc0000034
je 0x4fdb8
cmp dword [rsp + 0x78], 0
jne 0x4fdbf
mov eax, 0xc0000001
jmp 0x4fe33
mov edx, dword [rsp + 0x78]
mov r8d, 0x6d526567
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x70]
mov r8d, 2
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0
jge 0x4fe21
mov eax, 0xc0000001
jmp 0x4fe33
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x70]
mov qword [rcx], rax
xor eax, eax
add rsp, 0xa8
ret
Function at 0x4ff70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x80]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + rcx + 4]
cmp eax, 0x8664
je 0x4ffeb
mov rax, qword [rsp + 0x80]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + rcx + 4]
cmp eax, 0x200
je 0x4ffeb
mov rax, qword [rsp + 0x80]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x40]
lea rax, [rax + rcx + 0x78]
mov qword [rsp + 0x60], rax
jmp 0x50009
mov rax, qword [rsp + 0x80]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x40]
lea rax, [rax + rcx + 0x88]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x40]
add rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0
je 0x50052
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0
je 0x50052
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x1c], 0
je 0x50052
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x20], 0
jne 0x50059
xor eax, eax
jmp 0x5011e
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax + 0x1c]
mov rax, qword [rsp + 0x40]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax + 0x20]
mov rax, qword [rsp + 0x40]
add rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax + 0x24]
mov rax, qword [rsp + 0x40]
add rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], 0
jmp 0x500b9
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
jae 0x50119
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rdx, qword [rsp + 0x88]
call fcn.0005b2e0
test eax, eax
jne 0x500fb
mov rax, qword [rsp + 0x38]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x28]
lea rax, [rax + rcx*4]
mov qword [rsp + 0x58], rax
jmp 0x50119
mov rax, qword [rsp + 0x48]
add rax, 4
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x500ae
mov rax, qword [rsp + 0x58]
add rsp, 0x78
ret
Function at 0x57630
Capabilities:
Encode data using xor

Disassembly:
je 0x477a9
sub r11, rdi
lea eax, [r9 + 1]
movzx r9d, al
movzx r8d, byte [r9 + r10 + 8]
lea eax, [r8 + rbx]
movzx ebx, al
movzx ecx, byte [rbx + r10 + 8]
mov byte [r9 + r10 + 8], cl
mov byte [rbx + r10 + 8], r8b
add r8b, cl
movzx eax, r8b
mov cl, byte [rax + r10 + 8]
xor cl, byte [r11 + rdi]
or al, 0x3b
or al, 0x3b
mov byte [rdi], cl
inc rdi
sub rsi, 1
jne 0x47769
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [r10 + 4], ebx
mov rbx, qword [rsp + 8]
mov dword [r10], r9d
xor eax, eax
ret
or edx, r8d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x68]
movzx edx, word [rax + 8]
mov rax, qword [rsp + 0x68]
movzx ecx, word [rax + 0xa]
mov eax, edx
add eax, ecx
cdqe
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
and eax, 2
test eax, eax
jne 0x57696
xor r9d, r9d
mov r8d, 0x8ea
lea rdx, str.f:driverhivelibhivelibhttpparser.c
lea rcx, str.u__field_set___1____UF_HOST_
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov dword [rsp + 0x38], 0
jmp 0x5769e
mov dword [rsp + 0x38], 1
xor ecx, ecx
mov rax, qword [rsp + 0x68]
mov word [rax + 0xa], cx
cmp dword [rsp + 0x70], 0
je 0x576ba
mov dword [rsp + 0x3c], 2
jmp 0x576c2
mov dword [rsp + 0x3c], 4
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
movzx ecx, word [rax + 8]
mov rax, qword [rsp + 0x60]
add rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x576f0
mov rax, qword [rsp + 0x20]
add rax, 1
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x60]
add rax, rcx
cmp qword [rsp + 0x20], rax
jae 0x578a0
mov rax, qword [rsp + 0x20]
movzx edx, byte [rax]
mov ecx, dword [rsp + 0x30]
call fcn.000572a0
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 1
jne 0x5772e
mov eax, 1
jmp 0x578d6
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
sub eax, 3
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 9
ja case.default.0x57762
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x00010000]
mov eax, dword [rcx + rax*4 + 0x478dc]
add rax, rcx
jmp rax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
jmp 0x576e2
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 2
jl 0x578d4
cmp dword [rsp + 0x44], 5
jle 0x578cd
cmp dword [rsp + 0x44], 7
je 0x578cd
cmp dword [rsp + 0x44], 8
jle 0x578d4
cmp dword [rsp + 0x44], 0xb
jle 0x578cd
jmp 0x578d4
mov eax, 1
jmp 0x578d6
xor eax, eax
add rsp, 0x58
ret
Function at 0x5a270
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax + 8]
mov qword [rsp + 0x68], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov ecx, 3
call qword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x5a2f8
mov eax, 0xc000009a
jmp 0x5a48d
xor eax, eax
test eax, eax
je 0x5a31c
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.00057c80
jmp 0x5a338
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.00057c80
mov rcx, qword [rsp + 0x60]
call fcn.00057c20
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov byte [rax], 0xf
mov rax, qword [rsp + 0x98]
mov byte [rax + 1], 6
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x68]
mov qword [rcx + 0x28], rax
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xc0]
mov qword [rcx + 0x30], rax
mov rax, qword [rsp + 0x98]
add rax, 8
mov qword [rsp + 0x90], rax
mov ecx, dword [rsp + 0xc8]
mov rax, qword [rsp + 0x90]
mov qword [rax], rcx
mov rax, qword [rsp + 0x90]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x90]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x90]
mov qword [rax + 0x18], 0
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x103
jne 0x5a489
mov qword [rsp + 0xa0], 0xfffffffffd050f80
lea rcx, str.TDIDisconnect_STATUS_PENDING_n
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0xa0]
mov qword [rsp + 0x20], r11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x102
jne 0x5a481
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_IoCancelIrp]
lea rcx, str.STATUS_TIMEOUT__n
call sub.ntoskrnl.exe_DbgPrint
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov dword [rsp + 0x70], 0xc0000001
jmp 0x5a489
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x70]
add rsp, 0xb8
ret
Function at 0x5cb70
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xa8
mov r14d, 4
mov dword [r11 + 0x10], r14d
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x78], bx
xor eax, eax
mov qword [r11 - 0x5e], rax
mov dword [r11 - 0x56], eax
mov word [r11 - 0x52], ax
mov r12d, ebx
mov dword [rsp + 0x40], ebx
mov rdi, rbx
mov qword [r11 - 0x80], rbx
mov r13, r8
cmp r8, rbx
je 0x5cdb6
call fcn.0004de40
mov rsi, rax
mov qword [rsp + 0x60], rax
cmp rax, rbx
je 0x5cdb6
lea rdx, str.WINDOWSSYSTEM32CONFIGSYSTEM
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.0004df00
cmp eax, ebx
je 0x5cdae
mov rcx, qword [rsp + 0x48]
cmp dword [rcx], r14d
jne 0x5cd9c
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x5cd9c
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 8]
call fcn.0004dfa0
cmp rax, qword [rsp + 0xf8]
jne 0x5cd9c
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], bl
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x10000000
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov ecx, 0x400
call fcn.0004c4f0
mov rdi, rax
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x5cd67
cmp rax, rbx
je 0x5cd67
mov dword [rsp + 0x20], 9
mov r9d, 0x400
mov r8, rax
lea rdx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, ebx
jl 0x5cd4c
cmp dword [rdi], ebx
jbe 0x5cd4c
mov word [rsp + 0x68], bx
xor eax, eax
mov qword [rsp + 0x6a], rax
mov dword [rsp + 0x72], eax
mov word [rsp + 0x76], ax
lea rdx, [rdi + 4]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
mov r8b, 1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
cmp al, bl
je 0x5cd4c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov qword [r13], rax
mov rax, qword [rcx + 8]
mov qword [r13 + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [r13 + 0x10], rax
mov r12d, 1
mov dword [rsp + 0x40], r12d
jmp 0x5cdae
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, rdi
call fcn.0004c540
mov rdi, rbx
mov qword [rsp + 0x58], rbx
jmp 0x5cd9c
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.0004df70
jmp 0x5cc07
mov rcx, rsi
call fcn.0004c540
cmp rdi, rbx
je 0x5cdc3
mov rcx, rdi
call fcn.0004c540
mov eax, r12d
add rsp, 0xa8
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x81064
Capabilities:
Create device object

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00081008
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp fcn.00011320
Function at 0x1800010d0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x18001b020]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp edx, 1
jne 0x18000126f
mov qword [r11 + 8], rbx
lea r8, [0x180001050]
mov qword [r11 + 0x10], rbp
xor eax, eax
mov qword [r11 + 0x18], rsi
xor r9d, r9d
mov qword [r11 - 8], rdi
xor edx, edx
mov qword [r11 - 0x40], rax
xor ecx, ecx
movaps xmmword [rsp + 0x50], xmm6
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1800012a4
mov rbx, rax
call fcn.180001288
cmp rbx, 0x989680
jne 0x180001147
imul rax, rax, 0x64
jmp 0x180001165
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x18000117e
mov edi, 0xb2d05e00
add rdi, rax
jmp 0x180001188
movabs rdi, 0x7fffffffffffffff
movsd xmm6, qword [0x180017998]
movabs rsi, 0x311cdad160000
movabs rbp, 0x112e0be826d694b3
call fcn.1800012a4
mov rbx, rax
call fcn.180001288
cmp rbx, 0x989680
jne 0x1800011c0
imul rbx, rax, 0x64
jmp 0x1800011e1
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x180001253
call fcn.1800013d8
imul rdx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
lea rcx, [rdx + rsi]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r8b
test r8b, r8b
jne 0x180001212
lea rcx, [rax + rdx]
add rax, rdx
add rdx, rsi
test r8b, r8b
cmove rdx, rax
mov rax, rbp
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x30], rdx
sub ecx, eax
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x30]
call fcn.180001408
jmp 0x1800011a4
movaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180001680
add rsp, 0x68
ret
Function at 0x18000a56c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000a59c
xor eax, eax
jmp 0x18000a65f
mov rbp, rbx
cmp word [rax], si
je 0x18000a5c1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000a5a8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000a5a4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000a48c
movsxd r14, eax
test eax, eax
jne 0x18000a5ff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000a595
mov rcx, r14
call fcn.18000a864
mov rdi, rax
test rax, rax
jne 0x18000a618
xor ecx, ecx
call fcn.180007aa4
jmp 0x18000a5f4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000a48c
test eax, eax
jne 0x18000a649
mov rcx, rdi
call fcn.180007aa4
jmp 0x18000a653
xor ecx, ecx
call fcn.180007aa4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
jne 0x401028
lea rcx, str.malloc
call qword [sym.imp.msvcrt.dll_perror]
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
int3
add rsp, 0x28
ret

Function at 0x401420
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rdi
xor eax, eax
mov rdi, rdx
mov qword [rsp + 0x30], r12
mov r12, rcx
mov rcx, 0xffffffffffffffff
mov rbx, rdx
repne scasb al, byte [rdi]
not rcx
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rbp, rax
jne 0x401474
lea rcx, str.malloc
call qword [sym.imp.msvcrt.dll_perror]
lea ecx, [rbp + 1]
call qword [sym.imp.msvcrt.dll_exit]
int3
cmp byte [0x0040f342], 0
mov qword [rsp + 0x50], rsi
mov rdi, rax
je 0x40148f
call fcn.00404af0
mov rsi, rax
jmp 0x401494
mov rsi, qword [rsp + 0x20]
movzx eax, byte [rbx]
inc rbx
cmp al, 0x2e
jne 0x4014a5
mov ecx, 0x2f
jmp 0x4014a8
movsx ecx, al
mov byte [rdi], cl
inc rdi
test al, al
jne 0x401494
mov rax, qword [r12]
mov rdx, rbp
mov rcx, r12
call qword [rax + 0x30]
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.msvcrt.dll_free]
cmp byte [0x0040f342], 0
je 0x401500
call fcn.00404af0
sub rax, rsi
mov rcx, rax
call fcn.00404b40
lea rcx, str._ld_micro_seconds_to_load_main_class_n
mov rdx, rax
call qword [sym.imp.msvcrt.dll_printf]
lea rcx, str._____JAVA_LAUNCHER_DEBUG_____n
call qword [sym.imp.msvcrt.dll_printf]
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
ret

Function at 0x4018b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x1c0
mov rax, qword [0x0040f300]
mov qword [rsp + 0x1b0], rax
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call fcn.004046d0
lea rdx, [0x0040d4dc]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.msvcrt.dll_fopen]
test rax, rax
mov rbx, rax
jne 0x401930
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea r8, [rsp + 0xa0]
lea rdx, str.Cant_open__s_n
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
lea eax, [rbx + 1]
mov rcx, qword [rsp + 0x1b0]
call fcn.00409d20
add rsp, 0x1c0
pop rbx
ret
mov edx, 1
lea rcx, [rsp + 0x20]
mov r9, rax
lea r8d, [rdx + 0x7f]
call qword [sym.imp.msvcrt.dll_fread]
test rax, rax
je 0x40198a
nop
mov r9, qword [sym.imp.msvcrt.dll__iob]
lea rcx, [rsp + 0x20]
mov r8, rax
add r9, 0x30
mov edx, 1
call qword [sym.imp.msvcrt.dll_fwrite]
mov edx, 1
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x7f]
mov r9, rbx
call qword [sym.imp.msvcrt.dll_fread]
test rax, rax
jne 0x401950
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
call fcn.00409d20
add rsp, 0x1c0
pop rbx
ret
Function at 0x401e80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov eax, dword [0x0040f330]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rdi
movsxd rdi, dword [0x0040f320]
mov qword [rsp + 0x48], r12
cmp edi, eax
mov rbp, rdx
mov r12, rcx
jl 0x401f5a
cmp qword [0x0040f328], 0
jne 0x401efa
mov ecx, 0x40
mov dword [0x0040f330], 4
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rbx, rax
jne 0x401ef1
lea rcx, str.malloc
call qword [sym.imp.msvcrt.dll_perror]
lea ecx, [rbx + 1]
call qword [sym.imp.msvcrt.dll_exit]
int3
mov qword [0x0040f328], rax
jmp 0x401f61
add eax, eax
movsxd rcx, eax
mov dword [0x0040f330], eax
shl rcx, 4
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rbx, rax
jne 0x401f2e
lea rcx, str.malloc
call qword [sym.imp.msvcrt.dll_perror]
lea ecx, [rbx + 1]
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rdx, qword [0x0040f328]
mov r8, rdi
mov rcx, rax
shl r8, 4
call sub.msvcrt.dll_memcpy
mov rcx, qword [0x0040f328]
call qword [sym.imp.msvcrt.dll_free]
mov qword [0x0040f328], rbx
jmp 0x401f61
mov rbx, qword [0x0040f328]
mov rax, rdi
add rax, rax
inc edi
mov qword [rbx + rax*8], r12
mov r12, qword [rsp + 0x48]
mov qword [rbx + rax*8 + 8], rbp
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov dword [0x0040f320], edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x4031b0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
test rcx, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], r12
mov r12, r9
movsxd r10, r8d
mov rbx, rcx
jne 0x4031d8
test rdx, rdx
je 0x403401
mov rbx, rdx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
xor eax, eax
mov rdi, rbx
mov rcx, 0xffffffffffffffff
xor edx, edx
repne scasb al, byte [rdi]
test r10d, r10d
mov rsi, r10
not rcx
lea r8, [rcx - 1]
jle 0x40321e
mov rdi, qword [r9 + rdx*8]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
inc rdx
not rcx
add r8, rcx
cmp rdx, r10
jl 0x403201
xor eax, eax
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x28], r13
lea r13, str._Dsun.java.command
mov rcx, 0xffffffffffffffff
mov rdi, r13
repne scasb al, byte [rdi]
not rcx
add rcx, r8
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rbp, rax
jne 0x403268
lea rcx, str.malloc
call qword [sym.imp.msvcrt.dll_perror]
lea ecx, [rbp + 1]
call qword [sym.imp.msvcrt.dll_exit]
int3
mov byte [rax], 0
mov rdi, rax
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [r13 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x403280
xor eax, eax
mov rdi, rbp
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rbx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4032a1
xor r8d, r8d
test rsi, rsi
jle 0x403317
lea r9, [0x0040cc94]
nop
xor eax, eax
mov rdi, rbp
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [r9 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4032d0
mov rdx, qword [r12 + r8*8]
xor eax, eax
mov rdi, rbp
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x403300
inc r8
cmp r8, rsi
jl 0x4032c0
movsxd rbx, dword [0x0040f320]
mov eax, dword [0x0040f330]
cmp ebx, eax
jl 0x4033cb
mov rsi, qword [0x0040f328]
test rsi, rsi
jne 0x403373
lea ecx, [rsi + 0x40]
mov dword [0x0040f330], 4
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rdi, rax
jne 0x40336a
lea rcx, str.malloc
call qword [sym.imp.msvcrt.dll_perror]
lea ecx, [rsi + 1]
call qword [sym.imp.msvcrt.dll_exit]
int3
mov qword [0x0040f328], rax
jmp 0x4033d2
add eax, eax
movsxd rcx, eax
mov dword [0x0040f330], eax
shl rcx, 4
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rdi, rax
jne 0x4033a7
lea rcx, str.malloc
call qword [sym.imp.msvcrt.dll_perror]
lea ecx, [rdi + 1]
call qword [sym.imp.msvcrt.dll_exit]
int3
mov r8, rbx
mov rdx, rsi
mov rcx, rax
shl r8, 4
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov qword [0x0040f328], rdi
jmp 0x4033d2
mov rdi, qword [0x0040f328]
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
add rax, rax
inc ebx
mov qword [rdi + rax*8], rbp
mov rbp, qword [rsp + 0x48]
mov qword [rdi + rax*8 + 8], 0
mov rdi, qword [rsp + 0x58]
mov dword [0x0040f320], ebx
mov r12, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret