joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033bf8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor ebx, ebx
mov r13, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r14d, dword [rdi + 0x1c]
mov r15d, dword [rdi + 0x20]
add r14, rcx
mov r12d, dword [rdi + 0x24]
add r15, rcx
add r12, rcx
cmp dword [rdi + 0x18], ebx
jbe 0x140033c6b
movzx eax, word [r12 + rbx*2]
mov rdx, r13
mov ecx, dword [r15 + rbx*4]
add rcx, rsi
mov ebp, dword [r14 + rax*4]
add rbp, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140033c8a
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x140033c44
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbp
jmp 0x140033c6d
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dl, 0x59
retf 0x75ba
Function at 0x4011a0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
mov r11d, eax
mov eax, 1
cmp ecx, 5
ja 0x4011c8
jne 0x4011c6
shr r11w, 8
cmp r11b, al
jae 0x4011c8
xor eax, eax
add rsp, 0x28
ret

Function at 0x401558
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x400
mov rdi, rdx
call fcn.004151d0
mov edx, 0x400
mov rcx, rax
mov rbx, rax
call fcn.00418fe0
lea rcx, str._Extractor__Working_dir_is__s_n
mov rdx, rbx
call fcn.0040a054
mov rcx, rbx
call fcn.00415190
mov rdx, rdi
mov rcx, rsi
call fcn.00416230
xor ebx, ebx
jmp 0x401622
cmp ebx, 0xa
jge 0x40164e
call fcn.00415680
lea rcx, str._Rename__Could_not_rename__s_to__s___d__n
mov r8, rdi
mov r9d, dword [rax]
mov rdx, rsi
call fcn.0040a054
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str._Rename__Windows___this_FS_seems_to_not_supported_renaming._Trying_alternative_method..._n
call fcn.0040a054
mov r8d, 3
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401640
lea rdx, str.MoveFileEx
lea rcx, str.Extractor
call fcn.004096e0
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rdi
mov rcx, rsi
add ebx, 1
call fcn.00416230
test eax, eax
jne 0x4015a6
lea rcx, str._Rename__File__s_renamed_to__s_n
mov r8, rdi
mov rdx, rsi
call fcn.0040a054
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
lea rcx, str._Rename__MoveFileEx_worked._Assuming_success._n
call fcn.0040a054
xor eax, eax
test eax, eax
je 0x401626
call fcn.00415680
lea rcx, str._Rename___FAIL__Could_not_rename__s_to__s___d__n
mov r8, rdi
mov r9d, dword [rax]
mov rdx, rsi
call fcn.0040a054
lea rcx, str._Rename__Can_do_no_better_than_a_copy_on_this_filesystem_n
call fcn.0040a054
mov rcx, rdi
call fcn.00409fa8
lea rcx, str._Rename__Created_folder__s_n
mov rdx, rdi
call fcn.0040a054
mov rdx, rdi
mov rcx, rsi
call fcn.00401880
test eax, eax
je 0x4016ac
lea rcx, str._Rename__Copy_failed_too__Severe_filesystem_issues._n
call fcn.0040a054
jmp 0x401638
lea rcx, str._Rename__Copied__s_to__s_n
jmp 0x40162d

Function at 0x4017f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
lea rdx, [0x0043b2e0]
mov rbx, rcx
call fcn.00416fa0
test rax, rax
mov rdi, rax
jne 0x401823
lea rcx, str._Extractor___Unable_to_open_destination_file_for_copy__s_n
mov rdx, rbx
call fcn.0040a054
jmp 0x401875
lea rcx, [0x0053ef10]
mov r9, rsi
mov edx, 1
mov r8d, 0xc350
call fcn.00417680
test rax, rax
mov rbx, rax
je 0x40185c
lea rcx, [0x0053ef10]
mov r9, rdi
mov r8, rax
mov edx, 1
call fcn.00418d30
cmp rbx, 0xc350
je 0x401823
mov rcx, rsi
call fcn.00419a40
mov rcx, rdi
call fcn.00419a40
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x401880
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
mov eax, 0x2740
call fcn.00436460
sub rsp, rax
test rcx, rcx
mov rbx, rcx
je 0x4018ac
call section..text
mov rdi, rax
jmp 0x4018b9
call fcn.00415680
xor edi, edi
mov dword [rax], 0x16
test rdi, rdi
mov qword [rsp + 0x2770], rdi
jne 0x4018dd
lea rcx, str._CopyFolder__SourceDir_from__s_is_NULL_n
mov rdx, rbx
call fcn.0040a054
lea eax, [rdi + 1]
jmp 0x401ad2
mov rcx, rdi
call fcn.00401144
test rax, rax
mov rbp, rax
je 0x401ac6
mov rcx, qword [rax]
cmp byte [rcx], 0x2e
jne 0x401904
call fcn.004153e0
cmp rax, 2
jbe 0x4018dd
mov rdx, qword [rsp + 0x2760]
mov rbx, qword [rbp]
lea rcx, [rsp + 0x13b0]
mov byte [rsp + 0x13b0], 0
call fcn.004154a0
lea rcx, [rsp + 0x13b0]
mov rdx, rbx
call fcn.00409fec
mov rdx, qword [rsp + 0x2768]
mov rbx, qword [rbp]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], 0
call fcn.004154a0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.00409fec
lea rcx, [rsp + 0x13b0]
call section..text
test rax, rax
je 0x4019d6
mov rcx, rax
call fcn.004010f4
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder__Copying_DIR__s_n
call fcn.0040a054
lea rcx, [rsp + 0x20]
call fcn.00409fa8
test eax, eax
mov ebx, eax
jne 0x401a91
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x13b0]
call fcn.00401880
test eax, eax
mov ebx, eax
je 0x4018dd
lea rcx, str._CopyFolder___Failed_to_copy__s_to__s_n
lea rdx, [rsp + 0x13b0]
lea r8, [rsp + 0x20]
call fcn.0040a054
jmp 0x401ac8
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder__Copying_FILE__s_n
call fcn.0040a054
lea rdx, [0x0043b288]
lea rcx, [rsp + 0x13b0]
call fcn.00416fa0
test rax, rax
mov qword [rsp + 0x2778], rax
je 0x401aab
lea rdx, [0x0043b2e0]
lea rcx, [rsp + 0x20]
call fcn.00416fa0
test rax, rax
mov rbp, rax
je 0x401a9d
mov rdi, qword [rsp + 0x2778]
lea rcx, [0x0053ef10]
mov r9, rdi
mov edx, 1
mov r8d, 0xc350
call fcn.00417680
test rax, rax
mov rbx, rax
je 0x401a66
lea rcx, [0x0053ef10]
mov r9, rbp
mov r8, rax
mov edx, 1
call fcn.00418d30
cmp rbx, 0xc350
je 0x401a2d
mov rcx, qword [rsp + 0x2778]
mov rdi, qword [rsp + 0x2770]
call fcn.00419a40
mov rcx, rbp
call fcn.00419a40
jmp 0x4018dd
lea rcx, str._CopyFolder___Failed_to_copy__s_to__s__could_not_create_target_folder__n
jmp 0x4019bf
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder___Unable_to_open_destination_file_for_copy__s_n
jmp 0x401aba
lea rdx, [rsp + 0x13b0]
lea rcx, str._CopyFolder___Unable_to_open_source_file_for_copy__s_n
call fcn.0040a054
mov ebx, 1
jmp 0x401ac8
xor ebx, ebx
mov rcx, rdi
call fcn.004010f4
mov eax, ebx
add rsp, 0x2740
pop rdi
pop rbp
pop rbx
ret
Function at 0x4038f8
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov rax, rsp
sub rsp, 0x38
xor edi, edi
mov rbp, rdx
lea rdx, [rax + 0x48]
mov rbx, rcx
mov dword [rax + 0x48], edi
mov dword [rax + 0x50], edi
mov qword [rax - 0x18], rdi
call sub.VERSION.dll_GetFileVersionInfoSizeA
lea ecx, [rdi + 0x64]
mov r13d, eax
call fcn.004151d0
lea rcx, str._JavaCheck__Checking_file_version_of__s_n
mov rdx, rbx
mov byte [rax], 0x30
mov byte [rax + 1], dil
mov r12, rax
call fcn.0040a054
cmp r13d, edi
je 0x403a43
mov rcx, r13
call fcn.004151d0
lea rcx, str._JavaCheck__Got_version_size_n
mov rsi, rax
call fcn.0040a054
mov edx, dword [rsp + 0x80]
mov r9, rsi
mov r8d, r13d
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, edi
je 0x403a2d
lea rcx, str._JavaCheck__Got_version_info_n
call fcn.0040a054
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x20]
lea rdx, [0x0043c9d8]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueA
cmp eax, edi
je 0x403a24
lea rcx, str._JavaCheck__Queried_value_n
call fcn.0040a054
cmp dword [rsp + 0x88], edi
je 0x403a1b
lea rcx, str._JavaCheck__Size_OK_n
call fcn.0040a054
mov rbx, qword [rsp + 0x20]
cmp dword [rbx], 0xfeef04bd
jne 0x403a12
mov edx, dword [rbx + 0x10]
lea rcx, str._JavaCheck__file_version_MS_is__ld_n
call fcn.0040a054
mov edx, dword [rbx + 0x14]
lea rcx, str._JavaCheck__file_version_LS_is__ld_n
call fcn.0040a054
movzx r8d, word [rbx + 0x12]
lea rdx, [0x0043ca64]
mov rcx, r12
call fcn.00416260
jmp 0x403a39
lea rcx, str._JavaCheck__signature_is_wrong_n
jmp 0x403a34
lea rcx, str._JavaCheck__size_is_null_n
jmp 0x403a34
lea rcx, str._JavaCheck__ver_query_value_function_call_failed_n
jmp 0x403a34
lea rcx, str._JavaCheck__get_file_version_info_call_failed_n
call fcn.0040a054
mov rcx, rsi
call fcn.00415190
jmp 0x403a4f
lea rcx, str._JavaCheck__verSize_is_zero_n
call fcn.0040a054
cmp rbp, rdi
je 0x403a82
lea rcx, str._Extractor__Checking_JRE_version_requirements:__s_vs_required__s_n
mov r8, rbp
mov rdx, r12
call fcn.0040a054
mov rcx, r12
call fcn.00416c50
mov rcx, rbp
mov ebx, eax
call fcn.00416c50
cmp ebx, eax
setge dil
mov eax, edi
jmp 0x403a96
xor edx, edx
lea rcx, str._Extractor__Versions_for_JREs_could_not_be_detected___d__d__n
lea r8d, [rdx + 1]
call fcn.0040a054
xor eax, eax
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x405ff4
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
cmp qword [0x00448230], 0
je 0x40605d
mov ecx, dword [0x00448238]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov rcx, qword [0x00448230]
mov edx, 0x2328
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x406043
mov rcx, qword [0x00448230]
mov edx, 0x8ae
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x00448230]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x00448240]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x00448230], 0
add rsp, 0x28
ret
Function at 0x407064
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
call fcn.004011a0
xor r9d, r9d
test al, al
je 0x4070d4
cmp qword [0x004481b0], r9
jne 0x4070cc
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [0x004481b0]
lea r8, [0x0040871c]
mov qword [0x004481c0], rax
lea rax, [0x004481b8]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.00419c80
mov rcx, qword [0x004481c0]
mov qword [0x004481b0], rax
jmp 0x40712b
mov ecx, dword [0x004481b8]
jmp 0x407151
cmp qword [0x00448230], 0
jne 0x40714b
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [0x00448230]
lea r8, [0x00406070]
mov qword [0x00448240], rax
lea rax, [0x00448238]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.00419c80
mov rcx, qword [0x00448240]
mov qword [0x00448230], rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x407161
lea rcx, str.Error_starting_SplashThread_n
call fcn.0040a054
jmp 0x407161
mov ecx, dword [0x00448238]
mov r8d, 2
lea edx, [r8 + 4]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
add rsp, 0x38
ret
Function at 0x4075c4
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rdi, rcx
mov ecx, 0x40
mov rbx, rdx
call fcn.004151d0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor esi, esi
mov rcx, rdi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rbx
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], esi
mov dword [rbp + 0x30], esi
mov dword [rbp + 0x14], esi
call fcn.00407f0c
lea edx, [rsi + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rbp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rbp]
mov ebx, 0xffffffff
mov edx, ebx
mov qword [rbp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r11, [rsp + 0x30]
lea r8, [0x00407534]
mov qword [rsp + 0x28], r11
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00407258]
mov r9, rbp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x34]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00407324]
mov r9, rbp
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00407414]
mov r9, rbp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x3c]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x004074a4]
mov r9, rbp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp]
mov dword [rbp + 0x30], 5
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbp + 0x38]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rbp + 0x10]
lea rcx, str._HttpDownloader__Download_Tasks_Complete___success_d__n
call fcn.0040a054
mov rcx, qword [rsp + rsi*8 + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 1
cmp rsi, 5
jl 0x407736
mov eax, dword [rbp + 0x10]
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40777c
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x2748
call fcn.00436460
sub rsp, rax
mov rbp, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SetDllDirectoryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x13b0]
mov rdx, rbp
mov rbx, rax
mov byte [rsp + 0x13b0], 0
call fcn.004154a0
lea rdx, [0x0043ade4]
lea rcx, [rsp + 0x13b0]
call fcn.00409fec
lea rdx, [rsp + 0x13b0]
lea rcx, str._JNILaunch__Bin_folder_is__s_n
call fcn.0040a054
mov edi, 0x7d0
mov rcx, rdi
call fcn.004151d0
mov ecx, edi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [rsp + 0x13b0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test rbx, rbx
je 0x407829
lea rcx, [rsp + 0x13b0]
call rbx
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov byte [rsp + 0x20], 0
call fcn.004154a0
lea rdx, [0x0043ade4]
lea rcx, [rsp + 0x20]
call fcn.00409fec
lea rdx, str.server
lea rcx, [rsp + 0x20]
call fcn.00409fec
lea rdx, str.jvm.dll
lea rcx, [rsp + 0x20]
call fcn.00409fec
lea rcx, [rsp + 0x20]
call fcn.00409b64
lea rdx, [rsp + 0x20]
lea rcx, str._JNILaunch__Trying_to_load_library__s__exists_d__n
mov r8d, eax
call fcn.0040a054
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x407933
lea rcx, str._JNILaunch__Unable_to_load_library._Will_attempt_fallback._n
call fcn.0040a054
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov byte [rsp + 0x20], dil
call fcn.004154a0
lea rdx, [0x0043ade4]
lea rcx, [rsp + 0x20]
call fcn.00409fec
lea rdx, str.client
lea rcx, [rsp + 0x20]
call fcn.00409fec
lea rdx, str.jvm.dll
lea rcx, [rsp + 0x20]
call fcn.00409fec
lea rcx, [rsp + 0x20]
call fcn.00409b64
lea rdx, [rsp + 0x20]
lea rcx, str._JNILaunch__Trying_to_load_library__s__exists_d__n
mov r8d, eax
call fcn.0040a054
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x407933
lea rcx, str._JNILaunch__Unable_to_load_second_library._n
call fcn.0040a054
jmp 0x407944
lea rdx, [rsp + 0x20]
lea rcx, str._JNILauncher__Loaded_Windows_DLL____s_n
call fcn.0040a054
test rbx, rbx
je 0x40794d
xor ecx, ecx
call rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, rdi
add rsp, 0x2748
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x407d7c
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rbp, r8
mov rdi, rdx
call fcn.00409464
xor edx, edx
lea rcx, [rsp + 0x48]
mov qword [rbp], 0
lea r8d, [rdx + 0x20]
mov rbx, rax
mov qword [rbp + 8], 0
call fcn.004171b0
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x18]
call fcn.004171b0
lea rcx, str._Proxy__Opening_HTTP_Session_n
call fcn.0040a054
xor r9d, r9d
lea rcx, str.JWrapper_Proxy_Detector_1.0
lea edx, [r9 + 1]
xor r8d, r8d
mov dword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
test rax, rax
mov rsi, rax
je 0x407efa
test rdi, rdi
mov dword [rsp + 0x48], 1
je 0x407e23
lea rcx, str._Proxy__Using_auto_config_URL:__S_n
mov rdx, rdi
mov dword [rsp + 0x48], 3
call fcn.0040a054
mov qword [rsp + 0x50], rdi
lea rcx, str._Proxy__Attempting_to_detect_proxy_for_URL__S_n
mov rdx, rbx
mov dword [rsp + 0x4c], 3
mov dword [rsp + 0x64], 1
call fcn.0040a054
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x407ebd
lea rcx, str._Proxy__Configuration_found_n
call fcn.0040a054
cmp dword [rsp + 0x30], 1
jne 0x407e7d
lea rcx, str._Proxy__Direct_connection_used_n
call fcn.0040a054
jmp 0x407ed1
mov rdx, qword [rsp + 0x38]
lea rcx, str._Proxy___S_n
call fcn.0040a054
mov rdx, qword [rsp + 0x40]
lea rcx, str._Proxy___S_n
call fcn.0040a054
mov rcx, qword [rsp + 0x38]
call fcn.004094c4
mov rcx, qword [rsp + 0x40]
mov qword [rbp], rax
call fcn.004094c4
mov qword [rbp + 8], rax
jmp 0x407ed1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._Proxy__Configuration_NOT_found___d__n
mov edx, eax
call fcn.0040a054
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x407ee1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x407ef1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbx
call fcn.00415190
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4081f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
mov eax, 0xc430
call fcn.00436460
sub rsp, rax
mov rbx, rcx
lea rcx, str._Spawner__Constructing_command_line..._n
call fcn.0040a054
call fcn.0041a8a0
lea rcx, [rax + 0x30]
call fcn.00416bd0
xor esi, esi
mov byte [rsp + 0xe0], 0
cmp qword [rbx], rsi
je 0x40827a
mov rdi, rbx
lea rdx, [0x0043addc]
lea rcx, [rsp + 0xe0]
call fcn.004154a0
mov rdx, qword [rdi]
lea rcx, [rsp + 0xe0]
call fcn.004154a0
lea rdx, [0x00440088]
lea rcx, [rsp + 0xe0]
call fcn.004154a0
add rsi, 1
lea rdi, [rbx + rsi*8]
cmp qword [rdi], 0
jne 0x408234
lea rdx, [rsp + 0xe0]
lea rcx, str._Spawner__Creating_command_line__s_n
call fcn.0040a054
call fcn.0041a8a0
lea rcx, [rax + 0x30]
call fcn.00416bd0
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.004171b0
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call fcn.004171b0
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408337
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed___d_._n
mov edx, eax
call fcn.0040a054
call fcn.0041a8a0
lea rcx, [rax + 0x30]
call fcn.00416bd0
mov rax, 0xffffffffffffffff
jmp 0x40838c
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xc458]
lea rcx, str._Spawner__runSpawnerAndWait_returned__d_n
call fcn.0040a054
mov rax, qword [rsp + 0xc458]
add rsp, 0xc430
pop rdi
pop rsi
pop rbx
ret