joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040cf70
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rax, rdx
mov rbx, rcx
xor esi, esi
mov qword [rsp + 0x20], 0xffffffffffffffff
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x10040d12b
mov rax, rbx
lea rcx, [rsp + 0x30]
lea edx, [rsi + 4]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x10040cfd0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
nop dword [rax + rax]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x10040d11a
lea r8, [rbx + 0x2c]
lea rax, [rsp + 0x5c]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x10040d086
add rax, 2
test ecx, ecx
jne 0x10040d072
test edx, edx
jle 0x10040d115
mov rcx, rbx
lea rax, [rsp + 0x30]
mov edx, 4
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
sub rax, 0xffffffffffffff80
sub rdx, 1
jne 0x10040d0a0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
jmp 0x10040d050
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
cmp eax, 0x12
cmove esi, ecx
cmp rdi, 0xffffffffffffffff
je 0x10040d13a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1004119e0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x10040dbd0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor eax, eax
mov rdi, rdx
mov rcx, rdi
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x44]
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x48], rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
jne 0x10040dc26
lea rdx, str.GetFileVersionInfoSize
call fcn.10040de10
jmp 0x10040dde5
mov rcx, rsi
mov qword [rsp + 0xd0], rbx
call fcn.10041200c
mov rbx, rax
test rax, rax
jne 0x10040dc5c
mov r9d, esi
lea r8, str.Could_not_allocate__d_bytes_of_memory_for_marshaled_slab
lea edx, [rax + 1]
lea rcx, [0x100422050]
call fcn.100401b20
jmp 0x10040dddd
mov r9, rbx
mov r8d, esi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov rcx, rbx
test eax, eax
jne 0x10040dc8a
call fcn.100411a08
lea rdx, str.GetFileVersionInfo
call fcn.10040de10
jmp 0x10040dddd
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [0x10041c0e0]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x10040dcae
lea r8, str.Fixed_version_resource_for__ls_is_either_invalid_or_does_not_exist
jmp 0x10040dcbc
cmp dword [rsp + 0x40], 0
jne 0x10040dcd5
lea r8, str.Fixed_version_resource_for__ls_is_unavailable
mov r9, rdi
lea rcx, [0x100422050]
mov edx, 1
call fcn.100401b20
jmp 0x10040ddd5
mov rax, qword [rsp + 0x48]
lea r8, str._u._u:_u._u
mov edx, dword [rax + 0xc]
mov r9d, dword [rax + 8]
movzx ecx, dx
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x50]
shr edx, 0x10
mov dword [rsp + 0x28], edx
mov edx, 0x17
movzx eax, r9w
shr r9d, 0x10
mov dword [rsp + 0x20], eax
call fcn.100401090
lea rcx, [0x100422050]
test eax, eax
js 0x10040dd3c
lea rax, [rsp + 0x50]
mov r9, rdi
lea r8, str.File_version_of_module__ls_:__ls
mov qword [rsp + 0x20], rax
mov edx, 2
call fcn.100401b20
jmp 0x10040dd50
mov r9d, eax
lea r8, str.File_version_dump_failed_HRESULT_code_0x_x
mov edx, 1
call fcn.100401b20
mov rax, qword [rsp + 0x48]
lea r8, str._u._u:_u._u
mov edx, 0x17
mov r10d, dword [rax + 0x14]
mov r9d, dword [rax + 0x10]
movzx ecx, r10w
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x80]
movzx eax, r9w
shr r10d, 0x10
mov dword [rsp + 0x28], r10d
shr r9d, 0x10
mov dword [rsp + 0x20], eax
call fcn.100401090
lea rcx, [0x100422050]
test eax, eax
js 0x10040ddc1
lea rax, [rsp + 0x80]
mov r9, rdi
lea r8, str.Product_version_of_module__ls_:__ls
mov qword [rsp + 0x20], rax
mov edx, 2
call fcn.100401b20
jmp 0x10040ddd5
mov r9d, eax
lea r8, str.Product_version_dump_failed_HRESULT_code_0x_x
mov edx, 1
call fcn.100401b20
mov rcx, rbx
call fcn.100411a08
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1004119e0
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
Function at 0x10040dee0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r12
push r14
push r15
sub rsp, 0x50
mov r8d, dword [rdx + 0xc]
lea r10, [rdx + 0xc]
xor r12d, r12d
shl r8, 4
add r8, 0xc
lea rbx, [0x100414a30]
mov r14, rdx
mov r15d, r12d
mov ebp, r12d
mov r9d, 0xffffffff
nop dword [rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
mov eax, r9d
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rbx + rdx*4]
xor r9d, eax
sub r8, 1
jne 0x10040df20
mov eax, dword [r14 + 8]
cmp r9d, eax
je 0x10040df7c
or dword [0x100422040], 0x20000400
lea r8, str.Mismatched_struct_checksum_for_head_slab___computed__X___read__X
mov edx, 1
mov dword [r14 + 0xc], r12d
lea rcx, [0x100422050]
mov qword [r14], r12
mov dword [rsp + 0x20], eax
call fcn.100401b20
jmp 0x10040e0ff
mov qword [rsp + 0x70], rsi
mov rsi, qword [r14]
mov qword [r14], r12
test rsi, rsi
je 0x10040e0fa
mov qword [rsp + 0x78], rdi
nop word [rax + rax]
mov rax, rbp
mov qword [rsp + 0x30], r12
inc rbp
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
cmp rax, 0x400
jae 0x10040e0d0
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rdx, rsi
lea rcx, [0x1004276d0]
call fcn.100403180
test eax, eax
je 0x10040e0c2
mov eax, dword [rsp + 0x3c]
mov edi, eax
cmp rax, 0x1000
ja 0x10040e090
shl rdi, 4
add rdi, 0x18
mov rcx, rdi
call fcn.10041200c
mov rbx, rax
mov r9, rdi
test rax, rax
je 0x10040e076
mov r8, rax
lea rcx, [0x1004276d0]
mov rdx, rsi
call fcn.100403180
test eax, eax
je 0x10040e06c
mov rcx, rbx
call fcn.10040e120
mov ecx, dword [rbx + 8]
cmp eax, ecx
jne 0x10040e043
mov qword [r14], rbx
mov r14, rbx
mov r15, qword [rbx]
mov qword [rbx], r12
jmp 0x10040e0c2
or dword [0x100422040], 0x20000400
lea r8, str.Mismatched_struct_checksum_for_intermediate_slab___computed__X___read__X
mov dword [rsp + 0x20], ecx
mov r9d, eax
lea rcx, [0x100422050]
mov edx, 1
call fcn.100401b20
mov rcx, rbx
call fcn.100411a08
jmp 0x10040e0c2
lea r8, str.Could_not_allocate__d_bytes_of_memory_for_marshaled_slab
mov edx, 1
lea rcx, [0x100422050]
call fcn.100401b20
jmp 0x10040e0c2
or dword [0x100422040], 0x20000800
lea r8, str.Slab_at__p_did_not_pass_sanity_check___read__d___max_expected__d
mov qword [rsp + 0x28], 0x1000
lea rcx, [0x100422050]
mov r9, rsi
mov dword [rsp + 0x20], eax
mov edx, 1
call fcn.100401b20
mov rsi, r15
test r15, r15
jne 0x10040dfa0
jmp 0x10040e0f5
or dword [0x100422040], 0x20000800
lea r8, str.Slab_list_did_not_pass_sanity_check___list_too_long___stopping_after__d_elements
mov r9, rbp
lea rcx, [0x100422050]
mov edx, 1
call fcn.100401b20
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x10040e120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9d, dword [rcx + 0xc]
lea r10, [rcx + 0xc]
shl r9, 4
lea r11, [0x100414a30]
add r9, 0xc
mov eax, 0xffffffff
nop dword [rax]
movzx edx, byte [r10]
lea r10, [r10 + 1]
mov ecx, eax
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov eax, dword [r11 + r8*4]
xor eax, ecx
sub r9, 1
jne 0x10040e140
ret
Function at 0x10040e170
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
test rcx, rcx
je 0x10040e1c6
mov rax, 0xffffffffffffffff
mov r10d, 0xffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x10040e185
add rax, rax
je 0x10040e1c2
lea r11, [0x100414a30]
nop dword [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov ecx, r10d
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov r10d, dword [r11 + r8*4]
xor r10d, ecx
sub rax, 1
jne 0x10040e1a0
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x10040f310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x38]
lea rcx, [fcn.10040f310]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x10040f33b
xor eax, eax
jmp 0x10040f42c
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov dword [0x10044c268], 0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.10040ee30
test eax, eax
jne 0x10040f37d
mov r8d, 1
lea rdx, str.sqlservr.ini
mov rcx, qword [rsp + 0x20]
call fcn.10040ee30
test eax, eax
je 0x10040f3b8
mov eax, 2
imul rax, rax, 0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x208
jae 0x10040f398
jmp 0x10040f39d
call fcn.100411b34
lea rax, [0x10044c690]
xor ecx, ecx
mov rdx, qword [rsp + 0x28]
mov word [rax + rdx], cx
mov eax, 1
jmp 0x10040f42c
call fcn.10040f270
test eax, eax
je 0x10040f42a
lea rax, [0x10044c690]
lea rcx, str.C:_varoptmssqlmssql.conf
mov rdi, rax
mov rsi, rcx
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x10044c690]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10040f420
mov eax, 2
imul rax, rax, 0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x208
jae 0x10040f409
jmp 0x10040f40e
call fcn.100411b34
lea rax, [0x10044c690]
xor ecx, ecx
mov rdx, qword [rsp + 0x30]
mov word [rax + rdx], cx
mov dword [0x10044c268], 1
xor eax, eax
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x10040f690
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov dword [rsp + 0x24], 0x80
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0xffffffffffffffff
inc qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmp word [rax + rcx*2], 0
jne 0x10040f6b9
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl rax, 1
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0x50]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x10040f802
mov r9d, 5
lea r8, str._dp_
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.10040ed90
movzx eax, al
test eax, eax
je 0x10040f779
mov eax, dword [0x10044c058]
cmp dword [rsp + 0x20], eax
jb 0x10040f76d
mov eax, dword [0x10044c058]
shl rax, 1
mov eax, eax
lea rcx, [0x10044c270]
mov rdi, qword [rsp + 0x30]
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov eax, dword [0x10044c058]
mov dword [rsp + 0x38], eax
jmp 0x10040f795
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x38], eax
jle 0x10040f7fb
mov eax, dword [rsp + 0x24]
shl eax, 1
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x20]
shl rax, 1
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0x58]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x30], rax
jmp 0x10040f7fd
jmp 0x10040f802
jmp 0x10040f712
mov rax, qword [rsp + 0x30]
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x10040f820
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x10040f8a1
mov eax, dword [rsp + 0x20]
shl rax, 1
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0x30]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x10040f8a1
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [rsp + 0x20]
dec eax
mov rcx, qword [rsp + 0x58]
mov dword [rcx], eax
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x10040f8c0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov eax, dword [0x10044c054]
cmp dword [0x10044c268], eax
jne 0x10040f8e2
call qword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [0x10044c268], 0
je 0x10040f8f9
lea rax, [0x10044c690]
mov qword [rsp + 0x40], rax
jmp 0x10040f905
lea rax, [0x10044c060]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x10040f92c
xor eax, eax
jmp 0x10040faa2
mov dword [rsp + 0x30], 0x80
mov eax, dword [rsp + 0x30]
shl rax, 1
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0x50]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x10040fa9d
mov dword [rsp + 0x34], 0xffffffff
cmp qword [rsp + 0x70], 0
je 0x10040f9d8
cmp qword [rsp + 0x78], 0
je 0x10040f9d8
lea rax, [0x10044c480]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x38]
lea r8, [0x100414ea4]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x30]
dec eax
cmp dword [rsp + 0x34], eax
je 0x10040f9d8
mov rcx, qword [rsp + 0x38]
call fcn.10040ed00
test eax, eax
je 0x10040f9d8
mov dword [rsp + 0x34], 0xffffffff
cmp dword [rsp + 0x34], 0xffffffff
jne 0x10040fa11
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x38]
lea r8, [0x100414ea4]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x34], eax
cmp qword [rsp + 0x70], 0
je 0x10040fa2d
cmp qword [rsp + 0x78], 0
je 0x10040fa2d
mov eax, dword [rsp + 0x30]
dec eax
cmp dword [rsp + 0x34], eax
je 0x10040fa4a
cmp qword [rsp + 0x70], 0
je 0x10040fa3d
cmp qword [rsp + 0x78], 0
jne 0x10040fa96
mov eax, dword [rsp + 0x30]
sub eax, 2
cmp dword [rsp + 0x34], eax
jne 0x10040fa96
mov eax, dword [rsp + 0x30]
shl eax, 1
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x30]
shl rax, 1
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0x58]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x38], rax
jmp 0x10040fa98
jmp 0x10040fa9d
jmp 0x10040f95e
mov rax, qword [rsp + 0x38]
add rsp, 0x68
ret
Function at 0x100411150
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x48
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
mov r8d, 5
lea rdx, [rsp + 0x28]
lea rcx, str.__MSSQL_XCOPY_SETUP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jbe 0x10041118f
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1004119e0
add rsp, 0x48
ret
Function at 0x140001008
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001069
lea rcx, str.Windows_original_main_args:_n
call fcn.14000114c
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001069
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.14000114c
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000103e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010b5
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a2
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010cc
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010db
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 0
mov r8d, 5
mov byte [rsp + 0x58], 0
mov rdx, rbx
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x1400023bc]
mov qword [rsp + 0x38], rax
lea rax, [0x1400023c0]
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x1400018f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001942
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001942
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001942
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001942
cmp dword [rcx + 0x84], 0xe
jbe 0x140001942
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001944
xor al, al
add rsp, 0x28
ret
Function at 0x140006010
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x4e70
call fcn.140032740
sub rsp, rax
mov rax, qword [0x140061148]
xor rax, rsp
mov qword [rsp + 0x4e60], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x3e80
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
mov r8d, 0x3e80
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x140006126
lea rax, [rsp + 0x3ec0]
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x30], rax
mov edi, 0xfa0
mov eax, dword [rsp + 0x20]
mov word [rsp + 0x2a], di
test rax, 0xfffffffffffffff8
jbe 0x14000611f
nop
mov r8, rdi
lea rcx, [rsp + 0x3ec0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + rbx*8 + 0x40]
lea rdx, [rsp + 0x3ec0]
mov r8d, 0x7cf
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x3ec0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400060e0
mov r8, qword [rsp + rbx*8 + 0x40]
lea rdx, [rsp + 0x28]
add ax, ax
lea rcx, [0x1400611d0]
xor r9d, r9d
mov word [rsp + 0x28], ax
call fcn.140006150
test eax, eax
je 0x140006126
mov eax, dword [rsp + 0x20]
inc rbx
shr rax, 3
cmp rbx, rax
jb 0x1400060a0
mov eax, 1
jmp 0x140006128
xor eax, eax
mov rcx, qword [rsp + 0x4e60]
xor rcx, rsp
call fcn.1400322d0
mov rbx, qword [rsp + 0x4e80]
add rsp, 0x4e70
pop rdi
ret
Function at 0x140006f30
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x14000710a
push rdi
sub rsp, 0x60
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, DispGetParam
lea r8, [rsp + 0x30]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
je 0x140007105
mov eax, 0x5a4d
mov qword [rsp + 0x50], r15
mov r15d, dword [rsp + 0x38]
cmp word [rdi], ax
jne 0x140007100
movsxd rcx, dword [rdi + 0x3c]
lea rax, [rcx + 0x108]
cmp rax, r15
jae 0x140007100
cmp dword [rcx + rdi], 0x4550
mov qword [rsp + 0x80], rbp
lea rbp, [rcx + rdi]
jne 0x1400070f8
movzx eax, word [rbp + 4]
mov ecx, 0x14c
mov qword [rsp + 0x88], rsi
xor esi, esi
mov qword [rsp + 0x58], r14
cmp cx, ax
jne 0x140006fdc
xor r14d, r14d
jmp 0x14000700e
mov ecx, 0x200
mov r8d, 0xaa64
cmp cx, ax
je 0x140007000
mov ecx, 0x8664
cmp cx, ax
je 0x140007000
cmp r8w, ax
jne 0x1400070eb
cmp r8w, ax
mov r14d, 1
sete sil
mov qword [rsp + 0x78], rbx
mov ebx, dword [rbp + 0x28]
add rbx, rdi
je 0x1400070e6
cmp rbx, rdi
jbe 0x1400070e6
lea rax, [r15 + rdi]
cmp rbx, rax
jae 0x1400070e6
mov rcx, rbx
call fcn.140007af0
test eax, eax
je 0x1400070e6
mov r9d, r14d
mov dword [rsp + 0x20], esi
mov r8d, r15d
mov rdx, rdi
mov rcx, rbp
call fcn.140007b60
mov edx, reloc.OLEAUT32.dll_SafeArrayLock
mov dword [rsp + 0x70], 0
lea r9, [rsp + 0x70]
mov rcx, rbx
lea r8d, [rdx + 0x2c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400070e6
test r14d, r14d
jne 0x140007096
mov eax, dword [0x1400611c0]
mov dword [rbx], eax
movzx eax, byte [0x1400611c4]
mov byte [rbx + 4], al
jmp 0x1400070ba
test esi, esi
je 0x1400070a6
mov rax, qword [0x1400611b8]
mov qword [rbx], rax
jmp 0x1400070ba
movzx eax, word [0x1400611b4]
mov word [rbx], ax
movzx eax, byte [0x1400611b6]
mov byte [rbx + 2], al
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x70]
mov edx, reloc.OLEAUT32.dll_SafeArrayLock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret