joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400045dc
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor edx, edx
movsxd rcx, eax
mov r8, rdx
cmp rcx, rdx
jle 0x140004615
movsx eax, byte [r8 + rbx]
add r8, 1
add eax, edx
imul eax, eax, 0x401
mov edx, eax
shr eax, 6
xor edx, eax
cmp r8, rcx
jl 0x1400045f8
lea ecx, [rdx + rdx*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
add rsp, 0x20
pop rbx
ret

Function at 0x14000516c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r12
mov eax, 0x1040
call fcn.14001f4c0
sub rsp, rax
mov r9d, r8d
mov rdi, rdx
mov r8, rdx
mov rdx, rcx
mov rbx, rcx
lea rcx, str.GetRegistryValue_input___s___output___s___len___d_
call fcn.1400065e4
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.14000b880
lea rcx, [rsp + 0x40]
mov edx, 0x5c
call fcn.14000b7a0
test rax, rax
jne 0x1400051e1
lea rcx, str.Invalid_registry_key__no_backslash_found___s_
mov rdx, rbx
call fcn.1400069bc
mov eax, 0xd
jmp 0x1400052f8
lea rdx, [rsp + 0x40]
lea rcx, str.GetRegistryValue_rootKey___s_
mov byte [rax], 0
lea rsi, [rax + 1]
call fcn.1400065e4
lea rcx, [rsp + 0x40]
call fcn.1400050b8
lea rcx, str.GetRegistryValue_full_key___s_
mov rdx, rsi
mov r12, rax
call fcn.1400065e4
mov edx, 0x3a
mov rcx, rsi
call fcn.14000b7a0
test rax, rax
mov rbp, rax
jne 0x140005233
lea rcx, str.Invalid_registry_key__no_key_name_found___s_
jmp 0x1400051cf
lea rcx, str.GetRegistryValue_stripped_key___s_
mov rdx, rsi
mov byte [rax], 0
call fcn.1400065e4
lea rdx, [rbp + 1]
lea rcx, str.GetRegistryValue_valueName___s_
call fcn.1400065e4
lea r11, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000528f
lea rcx, str.Unable_to_open_registry_key___s__error___d_
mov r8d, eax
mov rdx, rbx
call fcn.1400069bc
jmp 0x1400051d7
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x1070]
lea r9, [rsp + 0x1078]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1400052cb
lea rcx, str.Unable_to_get_registry_value___s_
jmp 0x1400051cf
cmp dword [rsp + 0x1078], 4
je 0x1400052e4
cmp dword [rsp + 0x1078], 1
je 0x1400052f6
jmp 0x1400051d7
mov r8d, dword [rdi]
lea rdx, [0x140020ce4]
mov rcx, rdi
call fcn.14000bbe0
xor eax, eax
lea r11, [rsp + 0x1040]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140005454
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov eax, 0x1020
call fcn.14001f4c0
sub rsp, rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 4], edi
jle 0x1400054d5
xor esi, esi
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
mov r8d, 0x1000
mov r12, qword [rsi + rax]
mov rax, qword [rbx + 8]
mov rbp, qword [rsi + rax]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x1400054b9
lea rcx, str.Could_not_expand_variable:__s
mov rdx, rbp
call fcn.1400069bc
lea r8, [rsp + 0x20]
mov rdx, r12
mov rcx, rbx
call fcn.140004b38
add edi, 1
add rsi, 8
cmp edi, dword [rbx + 4]
jl 0x140005482
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x14000550c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x1160
call fcn.14001f4c0
sub rsp, rax
lea rdx, str.:ini.registry.location
mov rbp, rcx
call fcn.140004cb4
test rax, rax
mov rbx, rax
je 0x140005700
lea rcx, str.Loading_INI_keys_from_registry:__s
mov rdx, rax
call fcn.1400065e4
mov rcx, rbx
call fcn.14000ba10
xor edi, edi
xor ecx, ecx
test eax, eax
movsxd rdx, eax
jle 0x14000556f
cmp byte [rcx + rbx], 0x5c
je 0x14000556f
add rcx, 1
add edi, 1
cmp rcx, rdx
jl 0x14000555d
cmp edi, eax
jne 0x140005587
lea rcx, str.Unable_to_parse_registry_location___s____keys_not_included
mov rdx, rbx
call fcn.1400069bc
jmp 0x140005700
mov rcx, rbx
call fcn.140007c6c
movsxd rcx, edi
mov byte [rcx + rax], 0
mov rcx, rax
mov rsi, rax
call fcn.1400050b8
mov rcx, rsi
mov r12, rax
call fcn.14000bac0
test r12, r12
jne 0x1400055bd
mov rdx, rsi
lea rcx, str.Unrecognized_registry_root_key:__s
jmp 0x14000557d
lea eax, [rdi + 1]
mov r9d, 0x20019
xor r8d, r8d
movsxd rdx, eax
lea rax, [rsp + 0x40]
mov rcx, r12
add rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400055ef
lea rcx, str.Unable_to_open_registry_location___s_
jmp 0x14000557a
lea rax, [rsp + 0x1198]
xor edi, edi
mov esi, 0x104
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x160]
mov r12d, 0x1000
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x11a0]
mov byte [rsp + 0x50], 0x3a
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rdi
xor edx, edx
jmp 0x1400056d1
lea rcx, [rsp + 0x51]
mov dl, 0x3a
call fcn.1400077ec
lea rbx, [rsp + 0x51]
lea rcx, [rsp + 0x50]
test al, al
cmove rbx, rcx
cmp dword [rsp + 0x11a0], 4
jne 0x140005678
mov r8d, dword [rsp + 0x160]
lea rdx, [0x140020ce4]
lea rcx, [rsp + 0x160]
call fcn.14000bbe0
jmp 0x14000568c
cmp dword [rsp + 0x11a0], 1
jne 0x14000569f
cmp dword [rsp + 0x1198], 1
jbe 0x14000569f
lea r8, [rsp + 0x160]
mov rdx, rbx
mov rcx, rbp
call fcn.140004b38
lea rax, [rsp + 0x1198]
add edi, 1
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x160]
mov edx, edi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x11a0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x11a8]
lea r8, [rsp + 0x51]
mov dword [rsp + 0x11a8], esi
mov dword [rsp + 0x1198], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x140005634
add rsp, 0x1160
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140006644
Capabilities:
Move file

Disassembly:
sub rsp, 0x178
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x5a]
movzx edx, word [rsp + 0x58]
movzx r8d, word [rsp + 0x56]
mov rax, qword [0x14002b3c0]
movzx r11d, word [rsp + 0x5c]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov r8, qword [0x14002b3b8]
lea rdx, str._s__4d_02d_02d__02d_02d_02d_s
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], r10d
call fcn.14000bbe0
mov rcx, qword [0x14002b390]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14002b3b0]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov r11b, byte [0x14002b3a2]
mov rcx, qword [0x14002b3b0]
neg r11b
mov edx, 0xc0000000
sbb eax, eax
and qword [rsp + 0x30], 0
xor r9d, r9d
and eax, 0xfffffffe
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
add eax, 4
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov qword [0x14002b390], rax
je 0x14000673c
mov cl, byte [0x14002b3a2]
neg cl
mov rcx, rax
sbb r9d, r9d
xor r8d, r8d
xor edx, edx
not r9d
and r9d, 2
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rdx, [rsp + 0x60]
lea rcx, str.Rolled_log_name:__s
call fcn.1400065e4
add rsp, 0x178
ret
Function at 0x140006758
Capabilities:
Get file size
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2030
call fcn.14001f4c0
sub rsp, rax
cmp dword [0x140029510], ecx
mov rax, r8
mov rbx, rdx
jg 0x1400069a8
xor edi, edi
cmp rax, rdi
je 0x1400069a8
lea rcx, [rsp + 0x30]
mov r8, r9
mov rdx, rax
call fcn.14000d660
cmp byte [0x140029514], dil
je 0x1400067d6
lea r8, [0x1400206a8]
cmp rbx, rdi
lea r9, [rsp + 0x30]
lea rdx, str._s__s_n
lea rcx, [rsp + 0x1030]
cmovne r8, rbx
call fcn.14000bbe0
lea rcx, [rsp + 0x1030]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp rbx, rdi
je 0x14000682a
mov rcx, rbx
call fcn.14000ba10
mov rcx, qword [0x14002b390]
lea r9, [rsp + 0x2040]
mov r8, rax
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14002b390]
lea r9, [rsp + 0x2040]
lea rdx, [0x140020ce0]
mov r8d, 1
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x30]
call fcn.14000ba10
mov rcx, qword [0x14002b390]
lea r9, [rsp + 0x2040]
lea rdx, [rsp + 0x30]
mov r8, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14002b390]
lea r9, [rsp + 0x2040]
lea rdx, [0x140021750]
mov r8d, 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14002b390]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp byte [0x14002b3a0], dil
je 0x140006958
cmp byte [0x14002b3a1], dil
je 0x140006958
cmp rbx, rdi
je 0x1400068f8
mov rcx, rbx
call fcn.14000ba10
mov rcx, qword [0x14002b398]
lea r9, [rsp + 0x2040]
mov r8, rax
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14002b398]
lea r9, [rsp + 0x2040]
lea rdx, [0x140020ce0]
mov r8d, 1
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x30]
call fcn.14000ba10
mov rcx, qword [0x14002b398]
lea r9, [rsp + 0x2040]
lea rdx, [rsp + 0x30]
mov r8, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14002b398]
lea r9, [rsp + 0x2040]
lea rdx, [0x140021750]
mov r8d, 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14002b398]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
movsd xmm0, qword [0x14002b3a8]
comisd xmm0, xmmword [0x140021748]
jbe 0x1400069a8
mov al, byte [0x14002b3a3]
cmp al, dil
jne 0x1400069a8
mov rcx, qword [0x14002b390]
xor edx, edx
mov byte [0x14002b3a3], 1
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
cvtsi2sd xmm0, rcx
comisd xmm0, xmmword [0x14002b3a8]
jbe 0x1400069a1
call fcn.140006644
mov byte [0x14002b3a3], dil
mov rbx, qword [rsp + 0x2048]
add rsp, 0x2030
pop rdi
ret
Function at 0x140008420
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.Unregistering_Service...
call fcn.1400065e4
lea rdx, str.:service.id
mov rcx, rbx
call fcn.140004cb4
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
jne 0x140008463
lea rcx, str.Service_ID_not_specified
call fcn.1400069fc
lea eax, [rbx + 1]
jmp 0x1400084c4
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp rax, rbx
jne 0x14000848e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_access_service_manager:__d
mov edx, eax
mov ebx, eax
call fcn.1400069fc
jmp 0x1400084c2
mov r8d, 0xf003f
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp rax, rbx
jne 0x1400084b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_open_service:__d
jmp 0x140008483
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
cmp eax, ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400085b8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x850
mov r13d, ecx
xor ecx, ecx
mov rbp, rdx
call fcn.1400095ec
mov rcx, qword [0x14002b418]
and dword [rsp + 0x870], 0
lea r9, [rsp + 0x870]
lea r8, [rsp + 0x30]
lea rdx, str.:arg
mov rdi, rax
mov dword [rsp + 0x20], 0xa
call fcn.14000501c
mov r11, qword [rdi]
lea rdx, str.java_lang_String
mov rcx, rdi
call qword [r11 + 0x30]
mov ecx, dword [rsp + 0x870]
mov r10, qword [rdi]
lea edx, [rcx + r13 - 1]
xor r9d, r9d
mov r8, rax
mov rcx, rdi
call qword [r10 + 0x560]
xor esi, esi
cmp dword [rsp + 0x870], esi
mov r12, rax
jbe 0x14000868c
lea rbx, [rsp + 0x30]
mov r8, qword [rdi]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [r8 + 0x538]
mov r10, qword [rdi]
mov r8d, esi
mov rdx, r12
mov rcx, rdi
mov r9, rax
call qword [r10 + 0x570]
add esi, 1
add rbx, 8
cmp esi, dword [rsp + 0x870]
jb 0x140008656
lea esi, [r13 - 1]
xor ebx, ebx
test esi, esi
je 0x1400086d3
add rbp, 8
mov rax, qword [rdi]
mov rdx, qword [rbp]
mov rcx, rdi
call qword [rax + 0x538]
mov ecx, dword [rsp + 0x870]
mov r10, qword [rdi]
lea r8d, [rbx + rcx]
mov r9, rax
mov rdx, r12
mov rcx, rdi
call qword [r10 + 0x570]
add ebx, 1
add rbp, 8
cmp ebx, esi
jb 0x14000869a
mov rax, qword [rdi]
mov rdx, r12
mov rcx, rdi
call qword [rax + 0xa8]
mov edx, dword [rsp + 0x870]
lea r8d, [r13 - 1]
lea rcx, str.Service_startup_initiated_with__d_INI_args_and__d_Ctrl_Manager_args
mov rbx, rax
call fcn.1400065e4
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [0x14002b3e0]
lea rdx, [0x14002b3f0]
mov qword [0x14002b3e8], rax
mov dword [0x14002b3f4], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x140008500]
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x14002b3e8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r11, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r11 + 0xb0]
call fcn.14000962c
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
xor eax, eax
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140008a64
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x370
lea rdx, str.:single.instance
mov r12, rcx
call fcn.140004cb4
xor edi, edi
cmp rax, rdi
mov rbx, rax
je 0x140008bd5
lea rdx, str.window
mov rcx, rax
mov sil, 1
mov bpl, dil
call fcn.14000b950
cmp eax, edi
jne 0x140008b91
mov sil, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x260]
mov r8d, 0x104
xor ecx, ecx
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov r13, rax
call sub.KERNEL32.dll_Process32First
cmp eax, edi
je 0x140008bd5
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, [rsp + 0x150]
mov r9d, 0x104
mov rcx, rax
xor edx, edx
mov rbx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14d, dword [rsp + 0x28]
je 0x140008c19
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x260]
call fcn.14000b950
cmp eax, edi
jne 0x140008c19
cmp bpl, dil
je 0x140008bf9
mov rcx, r12
call fcn.1400043c4
cmp al, dil
je 0x140008bf9
lea rcx, str.Single_Instance_Shutdown
call fcn.1400069bc
mov eax, 1
jmp 0x140008bd7
lea rdx, [0x140022208]
mov rcx, rbx
call fcn.14000b950
cmp eax, edi
jne 0x140008baf
mov sil, dil
mov bpl, 1
jmp 0x140008ac1
lea rdx, str.process
mov rcx, rbx
call fcn.14000b950
cmp eax, edi
je 0x140008ac1
lea rcx, str.Invalid_single_instance_mode:__s
mov rdx, rbx
call fcn.1400069bc
xor eax, eax
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
cmp sil, dil
jne 0x140008b7e
mov edx, dword [rsp + 0x28]
lea rcx, [0x1400089f4]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp eax, edi
sete dil
mov eax, edi
jmp 0x140008bd7
lea rdx, [rsp + 0x20]
mov rcx, r13
call sub.KERNEL32.dll_Process32Next
jmp 0x140008b02
Function at 0x1400090ec
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rsi
sub rsp, 0xd0
and dword [r11 - 0x48], 0
and qword [r11 - 0x38], 0
lea rax, [0x14000909c]
mov qword [r11 - 0x40], rcx
mov edx, 0x7f02
xor ecx, ecx
mov qword [r11 - 0x50], rax
mov dword [r11 - 0x58], 0x50
mov dword [r11 - 0x54], 0x3000
mov dword [r11 - 0x44], 0x1e
call qword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, 1
mov qword [rsp + 0xa8], rax
call qword [sym.imp.GDI32.dll_GetStockObject]
and qword [rsp + 0xb8], 0
and qword [rsp + 0xc8], 0
lea rsi, str.WinRun4J.SplashWClass
lea rcx, [rsp + 0x80]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc0], rsi
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x140009199
lea rcx, str.Could_not_register_splash_window_class
call fcn.1400069fc
jmp 0x14000925a
mov rcx, qword [0x14002b558]
lea r8, [rsp + 0x60]
mov edx, 0x20
call qword [sym.imp.GDI32.dll_GetObjectA]
mov r11d, dword [rsp + 0x64]
mov eax, dword [rsp + 0x68]
mov ecx, 0x10
mov dword [0x14002b54c], r11d
mov dword [0x14002b560], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x11
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov ecx, dword [0x14002b560]
mov r8d, dword [0x14002b54c]
and qword [rsp + 0x40], 0
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], r8d
sub eax, ecx
sub ebx, r8d
shr eax, 1
lea r8, str.WinRun4J.SplashWindow
shr ebx, 1
mov dword [rsp + 0x28], eax
mov r9d, 0x80000000
mov rdx, rsi
mov ecx, 0x80
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, 5
mov rcx, rax
mov qword [0x14002b550], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14002b550]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rsi
ret
Function at 0x14000926c
Capabilities:
Get common file path
Get file size
Read file on windows
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x150
mov rdi, rdx
lea rdx, str.:working.directory
mov rbx, rcx
call fcn.140004cb4
test rax, rax
mov rsi, rax
jne 0x1400092c3
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, str.WinRun4J:ini.dir
mov rcx, rbx
call fcn.140004cb4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor ebx, ebx
xor r9d, r9d
mov edx, 0x80000000
and qword [rsp + 0x30], rbx
and dword [rsp + 0x28], ebx
lea r8d, [rbx + 1]
mov rcx, rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x14000935d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov edx, eax
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
and dword [rsp + 0x180], ebx
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x180]
mov rdx, rax
mov r8d, ebp
mov rcx, rdi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000934b
cmp dword [rsp + 0x180], ebp
jne 0x14000934b
mov edx, ebp
mov rcx, r12
call fcn.140008e50
mov rbx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
jne 0x14000936d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea r11, [rsp + 0x150]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140009430
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r13, rdx
mov r14, rcx
lea rdx, str.:splash.image
mov rcx, r13
call fcn.140004cb4
mov ebx, 1
test rax, rax
mov r12, rax
jne 0x14000953b
mov r8d, 0x2b1
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov rdi, rax
je 0x14000951a
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [r12 + 2]
mov rdx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.14000bca0
mov edx, ebp
mov rcx, rsi
call fcn.140008e50
mov rcx, rsi
mov qword [0x14002b558], rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp qword [0x14002b558], r12
jne 0x140009528
lea rcx, str.Could_not_load_embedded_splash_image
call fcn.1400069bc
cmp qword [0x14002b558], 0
je 0x1400095cb
lea rcx, str.Displaying_embedded_splash_image
call fcn.1400065e4
mov ebx, 1
jmp 0x14000954a
lea rcx, str.Displaying_splash:__s
mov rdx, rax
call fcn.1400065e4
lea rdx, str.:splash.autohide
mov rcx, r13
call fcn.140004cb4
test rax, rax
je 0x14000957f
lea rdx, str.false
mov rcx, rax
call fcn.14000b950
movzx ecx, byte [0x14002b565]
test eax, eax
cmove ecx, ebx
mov byte [0x14002b565], cl
test r12, r12
je 0x1400095ac
mov rdx, r12
mov rcx, r13
call fcn.14000926c
test rax, rax
mov qword [0x14002b558], rax
jne 0x1400095ac
lea rcx, str.Could_not_load_splash_screen:__s
mov rdx, r12
call fcn.1400069bc
jmp 0x1400095cb
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x140009388]
mov r9, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x140009d1c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x150
mov esi, dword [rdx]
and dword [rdx], 0
mov rbx, rdx
lea rax, [rax + 0x18]
mov rbp, rcx
mov edi, 0x20019
lea rdx, str.SoftwareJavaSoftJava_Runtime_Environment
xor r8d, r8d
mov r9d, edi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140009de9
jmp 0x140009de5
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov edx, dword [rbx]
mov rcx, qword [rsp + 0x180]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x178], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140009de9
mov ecx, dword [rbx]
lea rdx, [rsp + 0x40]
imul rcx, rcx, 0x234
add rcx, rbp
call fcn.140009674
mov r11d, dword [rbx]
lea rdx, str.SoftwareJavaSoftJava_Runtime_Environment
imul r11, r11, 0x234
lea rcx, [r11 + rbp + 0x130]
call fcn.14000b880
add dword [rbx], 1
cmp dword [rbx], esi
jb 0x140009d6a
lea rax, [rsp + 0x180]
lea rdx, str.SoftwareIBMJava2_Runtime_Environment
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140009ea7
mov edi, dword [rbx]
cmp edi, esi
jae 0x140009ea7
and qword [rsp + 0x38], 0
mov edx, dword [rbx]
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x180]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x40]
sub edx, edi
mov dword [rsp + 0x178], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140009ea7
mov ecx, dword [rbx]
lea rdx, [rsp + 0x40]
imul rcx, rcx, 0x234
add rcx, rbp
call fcn.140009674
mov r11d, dword [rbx]
lea rdx, str.SoftwareIBMJava2_Runtime_Environment
imul r11, r11, 0x234
lea rcx, [r11 + rbp + 0x130]
call fcn.14000b880
add dword [rbx], 1
cmp dword [rbx], esi
jb 0x140009e22
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret