joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001bb0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180001bd2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x180001be1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180001c04
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180001c06
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180001c42
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180001cde
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180001c7d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180001cbe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180001cde
cmp rbx, rax
ja 0x180001c90
test rbx, rbx
je 0x180001cde
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180002140
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180009040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18000216d
xor eax, eax
jmp 0x1800022d9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1800021a7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1800021a7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1800022d9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800022cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800021ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180002215
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800022d1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180002284
sub eax, 1
je 0x180002284
cmp eax, 2
jne 0x1800022cc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800022d1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1800022b2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800022cc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800022d1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180002f40
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180002500
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180009040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800025d3
cmp byte [rcx + 0x71], 0
je 0x1800025d3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800025cf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180002594
sub eax, 1
je 0x180002598
cmp eax, 2
jne 0x1800025cf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180002f40
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1800025c6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800025cf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18000257c
xor al, al
jmp 0x18000257c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180002f40
add rsp, 0x60
pop rbx
ret
Function at 0x401250
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
mov r11d, eax
mov eax, 1
cmp ecx, 5
ja 0x401278
jne 0x401276
shr r11w, 8
cmp r11b, al
jae 0x401278
xor eax, eax
add rsp, 0x28
ret

Function at 0x401380
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x400
mov rdi, rdx
call fcn.00416500
mov edx, 0x400
mov rcx, rax
mov rbx, rax
call fcn.00419fd0
lea rcx, str._Extractor__Working_dir_is__s_n
mov rdx, rbx
call fcn.0040b310
mov rcx, rbx
call fcn.004164c0
mov rcx, rdi
call fcn.0040adcc
test eax, eax
je 0x4013df
lea rcx, str._Rename__The_target_already_exists._Deleting._n
call fcn.0040b310
mov rcx, rdi
call fcn.0040aca0
mov rdx, rdi
mov rcx, rsi
call fcn.004173a0
xor ebx, ebx
jmp 0x40146a
cmp ebx, 0xa
jge 0x401496
call fcn.004169b0
lea rcx, str._Rename__Could_not_rename__s_to__s___d__n
mov r8, rdi
mov r9d, dword [rax]
mov rdx, rsi
call fcn.0040b310
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str._Rename__Windows___this_FS_seems_to_not_supported_renaming._Trying_alternative_method..._n
call fcn.0040b310
mov r8d, 3
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401488
lea rdx, str.MoveFileEx
lea rcx, str.Extractor
call fcn.0040a948
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rdi
mov rcx, rsi
add ebx, 1
call fcn.004173a0
test eax, eax
jne 0x4013ee
lea rcx, str._Rename__File__s_renamed_to__s_n
mov r8, rdi
mov rdx, rsi
call fcn.0040b310
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
lea rcx, str._Rename__MoveFileEx_worked._Assuming_success._n
call fcn.0040b310
xor eax, eax
test eax, eax
je 0x40146e
call fcn.004169b0
lea rcx, str._Rename___FAIL__Could_not_rename__s_to__s___d__n
mov r8, rdi
mov r9d, dword [rax]
mov rdx, rsi
call fcn.0040b310
lea rcx, str._Rename__Can_do_no_better_than_a_copy_on_this_filesystem_n
call fcn.0040b310
mov rcx, rdi
call fcn.0040b220
lea rcx, str._Rename__Created_folder__s_n
mov rdx, rdi
call fcn.0040b310
mov rdx, rdi
mov rcx, rsi
call fcn.00401590
test eax, eax
je 0x4014f4
lea rcx, str._Rename__Copy_failed_too__Severe_filesystem_issues._n
call fcn.0040b310
jmp 0x401480
lea rcx, str._Rename__Copied__s_to__s_n
jmp 0x401475

Function at 0x401500
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
lea rdx, [0x0044b6c0]
mov rbx, rcx
call fcn.00417f90
test rax, rax
mov rdi, rax
jne 0x401533
lea rcx, str._Extractor___Unable_to_open_destination_file_for_copy__s_n
mov rdx, rbx
call fcn.0040b310
jmp 0x401585
lea rcx, [0x0045bcd0]
mov r9, rsi
mov edx, 1
mov r8d, 0xc350
call fcn.00418670
test rax, rax
mov rbx, rax
je 0x40156c
lea rcx, [0x0045bcd0]
mov r9, rdi
mov r8, rax
mov edx, 1
call fcn.00419d20
cmp rbx, 0xc350
je 0x401533
mov rcx, rsi
call fcn.0041a870
mov rcx, rdi
call fcn.0041a870
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x401590
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
mov eax, 0x2740
call fcn.004387d0
sub rsp, rax
test rcx, rcx
mov rbx, rcx
je 0x4015bc
call fcn.004010b0
mov rdi, rax
jmp 0x4015c9
call fcn.004169b0
xor edi, edi
mov dword [rax], 0x16
test rdi, rdi
mov qword [rsp + 0x2770], rdi
jne 0x4015ed
lea rcx, str._CopyFolder__SourceDir_from__s_is_NULL_n
mov rdx, rbx
call fcn.0040b310
lea eax, [rdi + 1]
jmp 0x4017e2
mov rcx, rdi
call fcn.004011f4
test rax, rax
mov rbp, rax
je 0x4017d6
mov rcx, qword [rax]
cmp byte [rcx], 0x2e
jne 0x401614
call fcn.00416710
cmp rax, 2
jbe 0x4015ed
mov rdx, qword [rsp + 0x2760]
mov rbx, qword [rbp]
lea rcx, [rsp + 0x13b0]
mov byte [rsp + 0x13b0], 0
call fcn.004167d0
lea rcx, [rsp + 0x13b0]
mov rdx, rbx
call fcn.0040b264
mov rdx, qword [rsp + 0x2768]
mov rbx, qword [rbp]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], 0
call fcn.004167d0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.0040b264
lea rcx, [rsp + 0x13b0]
call fcn.004010b0
test rax, rax
je 0x4016e6
mov rcx, rax
call fcn.004011a4
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder__Copying_DIR__s_n
call fcn.0040b310
lea rcx, [rsp + 0x20]
call fcn.0040b220
test eax, eax
mov ebx, eax
jne 0x4017a1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x13b0]
call fcn.00401590
test eax, eax
mov ebx, eax
je 0x4015ed
lea rcx, str._CopyFolder___Failed_to_copy__s_to__s_n
lea rdx, [rsp + 0x13b0]
lea r8, [rsp + 0x20]
call fcn.0040b310
jmp 0x4017d8
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder__Copying_FILE__s_n
call fcn.0040b310
lea rdx, [0x0044b668]
lea rcx, [rsp + 0x13b0]
call fcn.00417f90
test rax, rax
mov qword [rsp + 0x2778], rax
je 0x4017bb
lea rdx, [0x0044b6c0]
lea rcx, [rsp + 0x20]
call fcn.00417f90
test rax, rax
mov rbp, rax
je 0x4017ad
mov rdi, qword [rsp + 0x2778]
lea rcx, [0x0045bcd0]
mov r9, rdi
mov edx, 1
mov r8d, 0xc350
call fcn.00418670
test rax, rax
mov rbx, rax
je 0x401776
lea rcx, [0x0045bcd0]
mov r9, rbp
mov r8, rax
mov edx, 1
call fcn.00419d20
cmp rbx, 0xc350
je 0x40173d
mov rcx, qword [rsp + 0x2778]
mov rdi, qword [rsp + 0x2770]
call fcn.0041a870
mov rcx, rbp
call fcn.0041a870
jmp 0x4015ed
lea rcx, str._CopyFolder___Failed_to_copy__s_to__s__could_not_create_target_folder__n
jmp 0x4016cf
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder___Unable_to_open_destination_file_for_copy__s_n
jmp 0x4017ca
lea rdx, [rsp + 0x13b0]
lea rcx, str._CopyFolder___Unable_to_open_source_file_for_copy__s_n
call fcn.0040b310
mov ebx, 1
jmp 0x4017d8
xor ebx, ebx
mov rcx, rdi
call fcn.004011a4
mov eax, ebx
add rsp, 0x2740
pop rdi
pop rbp
pop rbx
ret
Function at 0x402cf0
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov rax, rsp
sub rsp, 0x38
xor edi, edi
mov rbp, rdx
lea rdx, [rax + 0x48]
mov rbx, rcx
mov dword [rax + 0x48], edi
mov dword [rax + 0x50], edi
mov qword [rax - 0x18], rdi
call sub.VERSION.dll_GetFileVersionInfoSizeA
lea ecx, [rdi + 0x64]
mov r13d, eax
call fcn.00416500
lea rcx, str._JavaCheck__Checking_file_version_of__s_n
mov rdx, rbx
mov byte [rax], 0x30
mov byte [rax + 1], dil
mov r12, rax
call fcn.0040b310
cmp r13d, edi
je 0x402e3b
mov rcx, r13
call fcn.00416500
lea rcx, str._JavaCheck__Got_version_size_n
mov rsi, rax
call fcn.0040b310
mov edx, dword [rsp + 0x80]
mov r9, rsi
mov r8d, r13d
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, edi
je 0x402e25
lea rcx, str._JavaCheck__Got_version_info_n
call fcn.0040b310
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x20]
lea rdx, [0x0044c658]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueA
cmp eax, edi
je 0x402e1c
lea rcx, str._JavaCheck__Queried_value_n
call fcn.0040b310
cmp dword [rsp + 0x88], edi
je 0x402e13
lea rcx, str._JavaCheck__Size_OK_n
call fcn.0040b310
mov rbx, qword [rsp + 0x20]
cmp dword [rbx], 0xfeef04bd
jne 0x402e0a
mov edx, dword [rbx + 0x10]
lea rcx, str._JavaCheck__file_version_MS_is__ld_n
call fcn.0040b310
mov edx, dword [rbx + 0x14]
lea rcx, str._JavaCheck__file_version_LS_is__ld_n
call fcn.0040b310
movzx r8d, word [rbx + 0x12]
lea rdx, [0x0044c6e4]
mov rcx, r12
call fcn.004173d0
jmp 0x402e31
lea rcx, str._JavaCheck__signature_is_wrong_n
jmp 0x402e2c
lea rcx, str._JavaCheck__size_is_null_n
jmp 0x402e2c
lea rcx, str._JavaCheck__ver_query_value_function_call_failed_n
jmp 0x402e2c
lea rcx, str._JavaCheck__get_file_version_info_call_failed_n
call fcn.0040b310
mov rcx, rsi
call fcn.004164c0
jmp 0x402e47
lea rcx, str._JavaCheck__verSize_is_zero_n
call fcn.0040b310
cmp rbp, rdi
je 0x402e7a
lea rcx, str._Extractor__Checking_JRE_version_requirements:__s_vs_required__s_n
mov r8, rbp
mov rdx, r12
call fcn.0040b310
mov rcx, r12
call fcn.00417df0
mov rcx, rbp
mov ebx, eax
call fcn.00417df0
cmp ebx, eax
setge dil
mov eax, edi
jmp 0x402e8e
xor edx, edx
lea rcx, str._Extractor__Versions_for_JREs_could_not_be_detected___d__d__n
lea r8d, [rdx + 1]
call fcn.0040b310
xor eax, eax
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4057ec
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
cmp qword [0x00459230], 0
je 0x405855
mov ecx, dword [0x00459238]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov rcx, qword [0x00459230]
mov edx, 0x2328
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40583b
mov rcx, qword [0x00459230]
mov edx, 0x8ae
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x00459230]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x00459240]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x00459230], 0
add rsp, 0x28
ret
Function at 0x406838
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
call fcn.00401250
xor r9d, r9d
test al, al
je 0x4068a8
cmp qword [0x004591b0], r9
jne 0x4068a0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [0x004591b0]
lea r8, [0x004087c0]
mov qword [0x004591c0], rax
lea rax, [0x004591b8]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.0041ac60
mov rcx, qword [0x004591c0]
mov qword [0x004591b0], rax
jmp 0x4068ff
mov ecx, dword [0x004591b8]
jmp 0x406925
cmp qword [0x00459230], 0
jne 0x40691f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [0x00459230]
lea r8, [0x00405868]
mov qword [0x00459240], rax
lea rax, [0x00459238]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.0041ac60
mov rcx, qword [0x00459240]
mov qword [0x00459230], rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x406935
lea rcx, str.Error_starting_SplashThread_n
call fcn.0040b310
jmp 0x406935
mov ecx, dword [0x00459238]
mov r8d, 2
lea edx, [r8 + 4]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
add rsp, 0x38
ret
Function at 0x406d98
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rbx, rcx
mov ecx, 0x40
mov rsi, rdx
call fcn.00416500
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, rbx
mov dword [rdi + 0x10], 0
mov dword [rdi + 0x30], 0
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rsi
mov qword [rdi + 8], rax
mov dword [rdi + 0x14], 0
call fcn.004077dc
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rdi]
mov ebx, 0xffffffff
mov edx, ebx
mov qword [rdi + 0x38], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r11, [rsp + 0x30]
lea r8, [0x00406d08]
mov qword [rsp + 0x28], r11
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00406a2c]
mov r9, rdi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x34]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00406af8]
mov r9, rdi
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00406be8]
mov r9, rdi
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x3c]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00406c78]
mov r9, rdi
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rdi]
mov dword [rdi + 0x30], 5
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rdi + 0x38]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rdi + 0x10]
lea rcx, str._HttpDownloader__Download_Tasks_Complete___success_d__n
call fcn.0040b310
lea rcx, str._HttpDownloader__Saving_any_detected_proxy_settings_n
call fcn.0040b310
mov rcx, qword [rdi + 0x28]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.00405cf4
xor ebx, ebx
mov rcx, qword [rsp + rbx*8 + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 1
cmp rbx, 5
jl 0x406f43
cmp dword [rdi + 0x10], 0
je 0x406f62
xor eax, eax
jmp 0x406f7b
lea rcx, str._HttpDownloader__Downloads_failed._Closing_buffer._n
call fcn.0040b310
mov rcx, rsi
call fcn.0040792c
mov eax, 0xffffffff
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x406fa8
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
mov eax, 0x2758
call fcn.004387d0
sub rsp, rax
mov rsi, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SetDllDirectoryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x13c0]
mov rdx, rsi
mov rbx, rax
mov byte [rsp + 0x13c0], 0
call fcn.004167d0
lea r14, [0x0044b24c]
lea rcx, [rsp + 0x13c0]
mov rdx, r14
call fcn.0040b264
lea rdx, [rsp + 0x13c0]
lea rcx, str._JNILaunch__Bin_folder_is__s_n
call fcn.0040b310
mov edi, 0x7d0
mov rcx, rdi
call fcn.00416500
mov ecx, edi
mov rdx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [rsp + 0x13c0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test rbx, rbx
je 0x40705c
lea rcx, [rsp + 0x13c0]
call rbx
lea r13, str.jvm.dll
lea r9, str.server
lea rcx, [rsp + 0x30]
mov r8, r14
mov rdx, rsi
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x20], r13
call fcn.0040b2cc
lea rcx, [rsp + 0x30]
call fcn.0040adcc
lea rdx, [rsp + 0x30]
lea rcx, str._JNILaunch__Trying_to_load__s__exists_d__n
mov r8d, eax
call fcn.0040b310
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x4071e6
lea r9, str.client
lea rcx, [rsp + 0x30]
mov r8, r14
mov rdx, rsi
mov byte [rsp + 0x30], al
mov qword [rsp + 0x20], r13
call fcn.0040b2cc
lea rcx, [rsp + 0x30]
call fcn.0040adcc
lea rdx, [rsp + 0x30]
lea rcx, str._JNILaunch__Failed._Now_trying_to_load_library__s__exists_d__n
mov r8d, eax
call fcn.0040b310
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x4071e6
mov byte [rsp + 0x30], al
lea rax, str.client
lea r8, [0x0044b230]
lea rcx, [rsp + 0x30]
mov r9, r14
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.0040b2cc
lea rcx, [rsp + 0x30]
mov rdx, r13
call fcn.0040b264
lea rcx, [rsp + 0x30]
call fcn.0040adcc
lea rdx, [rsp + 0x30]
lea rcx, str._JNILaunch__Failed._Now_trying_to_load_library__s__exists_d__n
mov r8d, eax
call fcn.0040b310
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x4071e6
mov byte [rsp + 0x30], al
lea rax, str.server
lea r8, [0x0044b230]
lea rcx, [rsp + 0x30]
mov r9, r14
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.0040b2cc
lea rcx, [rsp + 0x30]
mov rdx, r13
call fcn.0040b264
lea rcx, [rsp + 0x30]
call fcn.0040adcc
lea rdx, [rsp + 0x30]
lea rcx, str._JNILaunch__Failed._Now_trying_to_load_library__s__exists_d__n
mov r8d, eax
call fcn.0040b310
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x4071e6
lea rcx, str._JNILauncher__Failed_to_load_DLL._Will_fall_back_to_spawning._n
call fcn.0040b310
jmp 0x4071f7
lea rdx, [rsp + 0x30]
lea rcx, str._JNILauncher__Loaded_Windows_DLL____s_n
call fcn.0040b310
test rbx, rbx
je 0x407200
xor ecx, ecx
call rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, rdi
add rsp, 0x2758
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40764c
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rbp, r8
mov rdi, rdx
call fcn.004099fc
xor edx, edx
lea rcx, [rsp + 0x48]
mov qword [rbp], 0
lea r8d, [rdx + 0x20]
mov rbx, rax
mov qword [rbp + 8], 0
call fcn.004181a0
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x18]
call fcn.004181a0
lea rcx, str._Proxy__Opening_HTTP_Session_n
call fcn.0040b310
xor r9d, r9d
lea rcx, str.JWrapper_Proxy_Detector_1.0
lea edx, [r9 + 1]
xor r8d, r8d
mov dword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
test rax, rax
mov rsi, rax
je 0x4077ca
test rdi, rdi
mov dword [rsp + 0x48], 1
je 0x4076f3
lea rcx, str._Proxy__Using_auto_config_URL:__S_n
mov rdx, rdi
mov dword [rsp + 0x48], 3
call fcn.0040b310
mov qword [rsp + 0x50], rdi
lea rcx, str._Proxy__Attempting_to_detect_proxy_for_URL__S_n
mov rdx, rbx
mov dword [rsp + 0x4c], 3
mov dword [rsp + 0x64], 1
call fcn.0040b310
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x40778d
lea rcx, str._Proxy__Configuration_found_n
call fcn.0040b310
cmp dword [rsp + 0x30], 1
jne 0x40774d
lea rcx, str._Proxy__Direct_connection_used_n
call fcn.0040b310
jmp 0x4077a1
mov rdx, qword [rsp + 0x38]
lea rcx, str._Proxy___S_n
call fcn.0040b310
mov rdx, qword [rsp + 0x40]
lea rcx, str._Proxy___S_n
call fcn.0040b310
mov rcx, qword [rsp + 0x38]
call fcn.00409a5c
mov rcx, qword [rsp + 0x40]
mov qword [rbp], rax
call fcn.00409a5c
mov qword [rbp + 8], rax
jmp 0x4077a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._Proxy__Configuration_NOT_found___d__n
mov edx, eax
call fcn.0040b310
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x4077b1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x4077c1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbx
call fcn.004164c0
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret