joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005dc8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r11, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
mov r10, rcx
xor edx, edx
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r11]
xor r10, rax
imul r10, r8
inc rdx
cmp rdx, 8
jb 0x140005e07
xor edx, edx
movzx eax, byte [r11 + rdx + 8]
xor rcx, rax
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x140005e1e
xor rcx, r10
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
add r8, r8
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r8*8]
je 0x140005ea6
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
jmp 0x140005ea0
mov rdi, qword [rdi + 8]
mov rax, qword [r11]
cmp rax, qword [rdi + 0x10]
jne 0x140005ea0
mov rax, qword [r11 + 8]
cmp rax, qword [rdi + 0x18]
jne 0x140005ea0
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rcx, rbx
call fcn.14000b314
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140005f3a
cmp rdi, qword [rcx + r8*8]
jne 0x140005e59
mov rax, qword [rbx]
cmp rdi, rax
je 0x140005edb
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x140005ef8
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140005f27
cmp rax, rdi
jne 0x140005f03
mov qword [rdx + r8*8], rbx
jmp 0x140005f27
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140005f27
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.140006218
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400063d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov rbx, r9
mov r11, r8
mov r9, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
mov r10, rcx
xor edx, edx
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r11]
xor r10, rax
imul r10, r8
inc rdx
cmp rdx, 8
jb 0x140006417
xor edx, edx
movzx eax, byte [r11 + rdx + 8]
xor rcx, rax
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x14000642e
xor rcx, r10
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rcx, qword [rsi + 0x18]
cmp rdi, qword [rcx + r8*8]
je 0x1400064c1
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r8*8]
je 0x1400064c1
mov rdi, qword [rdi + 8]
mov rax, qword [r11]
cmp rax, qword [rdi + 0x10]
jne 0x1400064b6
mov rax, qword [r11 + 8]
cmp rax, qword [rdi + 0x18]
jne 0x1400064b6
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call fcn.14000b314
mov rax, qword [rsp + 0x68]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x1400065ef
cmp rdi, qword [rcx + r8*8]
jne 0x14000646d
mov r9, qword [rsp + 0x68]
mov qword [rsp + 0x20], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400064fb
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140006518
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140006547
cmp rax, rdi
jne 0x140006523
mov qword [rdx + r8*8], rbx
jmp 0x140006547
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140006547
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14000fdd4]
test rax, rax
jns 0x140006568
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140006579
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400065e4
cmp rdx, 0x200
jae 0x140006591
shl rdx, 3
jmp 0x1400065a3
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400065a3
add rdx, rdx
mov rcx, rsi
call fcn.14000581c
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400065df
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400063d4
cmp rdi, qword [rsp + 0x70]
jne 0x1400065bd
mov r9, qword [rsp + 0x68]
mov qword [r9], rbx
mov byte [r9 + 8], 1
mov rax, r9
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400091c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov r11, r8
mov r10, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + r8]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r9
cmp r9, 4
jb 0x1400091ff
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x140009293
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x140009293
mov ecx, dword [r11]
mov rdi, qword [rdi + 8]
cmp ecx, dword [rdi + 0x10]
je 0x140009258
cmp rdi, qword [rax + r8*8]
jne 0x140009247
jmp 0x140009293
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.140001fec
mov rcx, rbx
call fcn.14000b314
mov rax, qword [rsp + 0x78]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x1400093c1
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400092cd
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400092ea
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140009319
cmp rax, rdi
jne 0x1400092f5
mov qword [rdx + r8*8], rbx
jmp 0x140009319
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140009319
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14000fdd4]
test rax, rax
jns 0x14000933a
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14000934b
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400093b6
cmp rdx, 0x200
jae 0x140009363
shl rdx, 3
jmp 0x140009375
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140009375
add rdx, rdx
mov rcx, rsi
call fcn.14000581c
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400093b1
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1400091c8
cmp rdi, qword [rsp + 0x20]
jne 0x14000938f
mov r10, qword [rsp + 0x78]
mov qword [r10], rbx
mov byte [r10 + 8], 1
mov rax, r10
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140009444
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x140009469
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400094c1
cmp qword [rcx + rdx*8], rdi
jne 0x1400094b6
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400094ba
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400094ce
cmp qword [rcx + rdx*8], rdi
jne 0x1400094ce
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.140001fec
mov rcx, rdi
call fcn.14000b314
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140009934
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov rbp, rdx
mov rsi, rcx
mov rax, qword [0x1400160d0]
lea rcx, [0x1400160d0]
mov rax, qword [rax + 0x18]
call qword [case.0x14000c50e.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov r8, rsi
lea rdx, str._sDiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x60]
call fcn.140009b20
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
xor r14d, r14d
cmp eax, 0xffffffff
jne 0x140009abf
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], r14d
je 0x140009a02
cmp dword [rdx + 0x10], r14d
jge 0x1400099cc
cmp dword [rbx - 0xc], r14d
jl 0x140009b09
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x140009a02
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400099e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000c50e.0]
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x14000c50e.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov r8, rsi
lea rdx, str._s_amd64DiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x60]
call fcn.140009b20
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009abf
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], r14d
je 0x140009a8a
cmp dword [rdx + 0x10], r14d
jge 0x140009a54
cmp dword [rbx - 0xc], r14d
jl 0x140009b14
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x140009a8a
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009a71
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000c50e.0]
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x14000c50e.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea r9, str.Team_ToolsDiagnosticsHubCollector
mov r8, rsi
lea rdx, str._s_s_amd64DiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x60]
call fcn.140009b20
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009abf
mov edi, 0x80070057
jmp 0x140009ad3
mov rdx, rbp
mov rcx, rbx
call fcn.14000966c
mov edi, eax
test eax, eax
js 0x140009ad3
mov edi, r14d
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140009af4
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14000c50e.0]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.1400022cc
int3
mov ecx, 0x80070057
call fcn.1400022cc
int3
Function at 0x14000b9fc
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b77c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba52
mov ecx, 1
call fcn.14000b77c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
movsd dword [rdi], dword [rsi]
jle 0x140023312
jmp qword [rsp + rbx*4 - 0x6406a95c]
movsb byte [rdi], byte [rsi]
pushfq
movsb byte [rdi], byte [rsi]
push rsi
stc
wait
sub ebp, dword [rdi + 0x4843735b]
lea ebx, [rax + 0x7b16aa51]
sbb eax, 0x2c6aff66
sub eax, 0x365008ad
invalid
Function at 0x17578b4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x17578be
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x17578e7
pop rbp
sub rbp, 0x33
sub rbp, 0x13578b4
sub rsp, 0x20
jmp 0x1757906
mov rax, 0x13578b4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xb66c947
xor byte [rax], dl
inc rax
dec rcx
jne 0x1757925
jmp 0x175793c
bswap esi
scasb al, byte [rdi]
int3
Function at 0x140011276
Capabilities:
Terminate process

Disassembly:
jmp 0x140015f70
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011311
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400172c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400172e0
xor al, al
jmp 0x140017361
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400172f3
xor al, al
jmp 0x140017361
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001731d
xor al, al
jmp 0x140017361
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017331
xor al, al
jmp 0x140017361
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017343
xor al, al
jmp 0x140017361
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001735f
xor al, al
jmp 0x140017361
mov al, 1
add rsp, 0x38
ret
Function at 0x1400151a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001145b
movzx eax, al
test eax, eax
jne 0x1400151c0
mov ecx, 7
call fcn.1400113c0
nop
mov byte [rsp + 0x20], 0
call fcn.1400113d4
mov byte [rsp + 0x21], al
cmp dword [0x140022018], 1
jne 0x1400151e4
mov ecx, 7
call fcn.1400113c0
nop
jmp 0x14001523c
cmp dword [0x140022018], 0
jne 0x140015237
mov dword [0x140022018], 1
lea rdx, [0x14001d770]
lea rcx, [0x14001d440]
call fcn.140011212
test eax, eax
je 0x140015218
mov eax, 0xff
jmp 0x140015341
lea rdx, [0x14001d330]
lea rcx, [section..rdata]
call fcn.1400113ca
mov dword [0x140022018], 2
jmp 0x14001523c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400113ac
call fcn.140011339
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140015299
mov rcx, qword [rsp + 0x30]
call fcn.1400111b3
movzx eax, al
test eax, eax
je 0x140015299
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140029020]
nop
call fcn.140011370
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400152cd
mov rcx, qword [rsp + 0x38]
call fcn.1400111b3
movzx eax, al
test eax, eax
je 0x1400152cd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011410
nop
call fcn.1400153f0
mov dword [rsp + 0x28], eax
call fcn.140011311
movzx eax, al
test eax, eax
jne 0x1400152ec
mov ecx, dword [rsp + 0x28]
call fcn.140011069
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400152fb
call fcn.14001141a
nop
xor edx, edx
mov cl, 1
call fcn.14001119f
mov eax, dword [rsp + 0x28]
jmp 0x140015341
add rsp, 0x68
ret
Function at 0x140e8d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140e8d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e8d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e8d06f
add dl, dl
jne 0x140e8d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e8d0f6
xor eax, eax
add dl, dl
jne 0x140e8d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e8d1ad
add dl, dl
jne 0x140e8d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e8d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e8d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e8d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e8d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e8d07e
mov eax, 1
add dl, dl
jne 0x140e8d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e8d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e8d0fb
sub eax, ebx
mov ebx, 1
jne 0x140e8d14c
mov ecx, 1
add dl, dl
jne 0x140e8d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e8d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e8d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e8d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e8d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e8d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e8d15d
cmp eax, 0x7d00
jae 0x140e8d19b
cmp eax, 0x500
jb 0x140e8d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e8d07e
cmp eax, 0x7f
ja 0x140e8d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e8d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e8d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e8d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
mov dword [rsp + 0x68], 1
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002238]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002228]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x180574db9
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + rcx - 0x2980dd35], r9
jmp 0x180577f6b
lea r9, [rcx + rcx*8 - 0x5c6bd95f]
lea rcx, [0x1805addf0]
mov r9d, 0x42ae5308
shl r9, 0x9d
movzx r9d, byte [r8]
push 0x1037443b
xor r9d, eax
and r9d, 0xff
mov r9d, dword [rcx + r9*4]
shr eax, 8
xor eax, r9d
push 0x22a5f705
inc r8
xor eax, 0x91bfa41f
dec rbp
push 0x3c1671ac
lea rsp, [rsp + 0x18]
jne 0x180577f7a
call fcn.1805a97ab

Function at 0x180596398
Capabilities:
Encode data using xor

Disassembly:
lea rax, [0x180596a10]
lea rsp, [rsp + 8]
mov esi, 0x7f3dfa84
movzx esi, byte [rsi + r10 - 0x7f3dfa84]
xor esi, r9d
push 0x2281c8b3
and esi, 0xff
sal dword [rsp + 4], 0x9d
mov esi, dword [rax + rsi*4]
shr r9d, 8
xor r9d, esi
not byte [rsp + 1]
push 0xffffffff8d9ad626
push 0xffffffffb60e6e82
inc r10
push 0xffffffffc435d604
xor r9d, 0xe9205399
dec rdi
lea rsp, [rsp + 0x20]
jne 0x1805963a4
mov esi, 0x76155a3c
pop rsi