joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001200
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r13, rcx
lea r8, [0x140010dd8]
lea rdx, [0x1400153f0]
lea rcx, [rbp + 0x38]
xor r12d, r12d
mov qword [rbp + 0x38], r12
call fcn.140001ea0
mov ecx, r12d
test eax, eax
lea rdx, [0x140010de0]
sete cl
call fcn.1400010cc
mov rcx, qword [rbp + 0x38]
lea r8d, [r12 + 2]
xor edx, edx
call fcn.14000325c
mov rcx, qword [rbp + 0x38]
call fcn.140002ec4
mov rcx, qword [rbp + 0x38]
movsxd r14, eax
lea edi, [r14 - 0x104]
test edi, edi
cmovs edi, r12d
xor r8d, r8d
mov edx, edi
call fcn.14000325c
mov r9, qword [rbp + 0x38]
lea r15d, [r12 + 1]
mov esi, 0x104
mov edx, r15d
mov rcx, r13
mov r8d, esi
call fcn.140002bc4
mov rcx, r13
mov rdx, rax
call fcn.140001198
mov rbx, rax
test rax, rax
je 0x1400012d9
lea rcx, [rbp - 0x20]
lea r8d, [r12 + 0x14]
mov rdx, rax
call fcn.140009de0
movsxd rdi, edi
sub rdi, r13
add rdi, rbx
jmp 0x140001360
mov ebx, 0x4100000
mov ecx, ebx
call fcn.1400025ac
mov rcx, qword [rbp + 0x38]
lea edi, [r14 - 0x4100000]
test edi, edi
mov rsi, rax
cmovs edi, r12d
xor r8d, r8d
mov edx, edi
call fcn.14000325c
mov r9, qword [rbp + 0x38]
mov r8d, ebx
mov rdx, r15
mov rcx, rsi
call fcn.140002bc4
mov rcx, rsi
mov rdx, rax
call fcn.140001198
mov ecx, r12d
lea rdx, [0x140010e00]
test rax, rax
mov rbx, rax
setne cl
call fcn.1400010cc
lea rcx, [rbp - 0x20]
mov rdx, rbx
mov r8d, 0x14
call fcn.140009de0
movsxd rdi, edi
mov rcx, rsi
sub rdi, rsi
add rdi, rbx
call fcn.1400022d4
mov esi, 0x104
mov eax, dword [rbp - 0x10]
mov rcx, qword [rbp + 0x38]
xor r8d, r8d
add eax, dword [rbp - 0x14]
sub rdi, rax
mov edx, edi
call fcn.14000325c
mov r9, qword [rbp + 0x38]
mov r8, rsi
mov rdx, r15
mov rcx, r13
call fcn.140002bc4
mov ecx, r12d
lea rdx, [0x140010e28]
test rax, rax
setne cl
call fcn.1400010cc
movzx eax, word [r13]
cmp ax, word [0x140010e44]
jne 0x1400013b1
mov r12, r13
jmp 0x140001417
mov rcx, qword [rbp + 0x38]
lea edx, [rdi - 0x104]
test edx, edx
cmovs edx, r12d
xor r8d, r8d
call fcn.14000325c
mov r9, qword [rbp + 0x38]
mov r8, rsi
mov rdx, r15
mov rcx, r13
call fcn.140002bc4
mov ecx, r12d
lea rdx, [0x140010e28]
test rax, rax
mov rbx, rax
setne cl
call fcn.1400010cc
lea r11, [rbx + r13 - 1]
cmp r11, r13
jb 0x140001417
movzx eax, word [0x140010e44]
cmp word [r11], ax
je 0x140001414
sub r11, r15
cmp r11, r13
jae 0x140001404
jmp 0x140001417
mov r12, r11
mov rcx, qword [rbp + 0x38]
call fcn.140003580
lea r11, [rsp + 0x40]
mov rax, r12
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140003260
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp r8, qword [rsp + 0x70]
jne 0x1400032e0
test r8, r8
je 0x1400032d7
movzx r10d, byte [rcx + 0x100]
movzx eax, byte [rcx + 0x101]
xor r11d, r11d
nop word cs:[rax + rax]
inc r10b
movzx esi, r10b
movzx ebx, byte [rcx + rsi]
add al, bl
movzx edi, al
movzx ebp, byte [rcx + rdi]
mov byte [rcx + rsi], bpl
mov byte [rcx + rdi], bl
add bl, byte [rcx + rsi]
movzx esi, byte [rdx + r11]
movzx edi, bl
xor sil, byte [rcx + rdi]
mov byte [r9 + r11], sil
lea rsi, [r11 + 1]
mov r11, rsi
cmp r8, rsi
jne 0x140003290
mov byte [rcx + 0x100], r10b
mov byte [rcx + 0x101], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_input.len____output.len__assertion_failed:_key.len_____1__key.len_____256C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rust_crypto_0.2.36_src_rc4.rs
lea r8, [0x14001e640]
mov edx, 0x2d
call fcn.14001c5b0
ud2
Function at 0x140005940
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x1400059d0
jmp 0x1400059bf
jae 0x140005a90
cmp r8, 0x201
jae 0x1400059d0
lea r12, [rbp - 0x58]
mov esi, 0x200
mov r15, r8
jmp 0x140005a28
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x1400059ff
lea rcx, [rbp + 0x3c8]
mov rdx, r13
call fcn.14001bb40
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3d8], r13
mov rbx, rdi
mov r12, qword [rbp + 0x3e8]
mov rsi, r13
mov r15, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140005a51
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140005af8
mov r8d, r14d
cmp r15, r8
jne 0x1400059b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140005b1b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400059bf
jmp 0x1400059d0
cmp rsi, r8
jb 0x140005b35
lea rcx, [rbp + 0x3a8]
mov rdx, r12
call fcn.140007080
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140005ae1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140002e20
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140005ac9
jmp 0x140005ae1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_eb26296b556cef10fb713a38f3d16b9886080f26library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001c5b0
jmp 0x140005b4a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001ca00
ud2
Function at 0x140005ba0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14000d530
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x410], rax
test rax, rax
je 0x140005d16
mov qword [rbp + 0x408], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x418], rax
xor edi, edi
xor ebx, ebx
xor esi, esi
cmp r8, 0x201
jae 0x140005c50
jmp 0x140005c3f
jae 0x140005d28
cmp r8, 0x201
jae 0x140005c50
lea r13, [rbp - 0x60]
mov r15d, 0x200
mov r12, r8
jmp 0x140005ca7
sub r8, rsi
sub rbx, rsi
cmp rbx, r8
jae 0x140005c7f
lea rcx, [rbp + 0x3e8]
mov rdx, rsi
call fcn.14001bb40
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x418], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov esi, 0xffffffff
cmovb rsi, rdi
mov qword [rbp + 0x3f8], rsi
mov rbx, rdi
mov r13, qword [rbp + 0x418]
mov r15, rsi
mov r12, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x410]
mov rdx, r13
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x140005cd7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140005dfb
mov r8d, r14d
cmp r12, r8
jne 0x140005c30
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140005e25
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140005c3f
jmp 0x140005c50
lea rcx, [rbp - 0x58]
call fcn.140003930
mov byte [rsi + 0x18], 2
jmp 0x140005dba
cmp r15, r8
jb 0x140005e3f
lea rcx, [rbp + 0x3a0]
mov rdx, r13
call fcn.140007080
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x140005d79
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x418]
mov rdx, rdi
call fcn.140002e20
cmp byte [rbp + 0x3d8], 2
jne 0x140005dd1
mov rsi, qword [rbp + 0x408]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.140003930
mov rdx, qword [rbp + 0x400]
test rdx, rdx
je 0x140005dba
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x410]
call fcn.140002e20
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x408]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x400]
test rdx, rdx
jne 0x140005da5
jmp 0x140005dba
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x140005d61
jmp 0x140005d79
lea rcx, str.internal_error:_entered_unreachable_code_rustc_eb26296b556cef10fb713a38f3d16b9886080f26library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001c5b0
jmp 0x140005e54
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14001ca00
ud2
Function at 0x140007a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140007ab0
test ecx, ecx
jne 0x140007b00
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x140007abc
test ecx, ecx
jne 0x140007b00
mov rcx, rdi
call fcn.140007960
movzx eax, al
test bpl, bpl
jne 0x140007b07
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140007af3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140007c78]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140007af3.2
xor eax, eax
test bpl, bpl
je 0x140007acc
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140007c59
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x140007b3a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140007bb9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140007b80
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x140007b9b
inc rax
dec rdi
cmp rax, 1
jne 0x140007b60
jmp 0x140007bb9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x140007b9b
cmp ebx, 0x5c
je 0x140007b9b
inc rax
dec rdi
cmp rax, 1
jne 0x140007b80
jmp 0x140007bb9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140007c67
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140007be3
mov al, 9
cmp rdx, 2
je 0x140007be7
cmp rdx, 1
jne 0x140007bf7
cmp byte [r8], 0x2e
jne 0x140007bf7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140007bf7
mov al, 0xa
jmp 0x140007bf7
cmp byte [r8], 0x2e
jne 0x140007bf7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140007af3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140007af3.2
mov ecx, 2
jmp case.0x140007af3.2
lea r8, str.library_std_srcpath.rs
call fcn.14001c980
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14001c980
ud2
Function at 0x14000be60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001fbc0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000bea4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000bf0a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000bf41
test eax, eax
js 0x14000bf1b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000bf34
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140006f50
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140003bc0
mov ecx, 7
int 0x29
ud2

Function at 0x140019950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400199ca
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1400199c0
cmp r10, r11
jb 0x140019a63
cmp r10, rdx
ja 0x140019a77
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1400199c2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400199a0
jmp 0x140019a37
ja 0x1400199ca
mov r11, r10
cmp rax, r8
jne 0x140019972
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140019a3b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140019a10
mov r8, r10
sub ecx, r9d
jns 0x140019a2e
jmp 0x140019a3d
cmp r10, rdx
je 0x140019a49
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140019a3d
xor al, 1
cmp r8, rdx
jne 0x1400199f0
jmp 0x140019a3d
xor eax, eax
jmp 0x140019a3d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001c5b0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001ca80
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001ca00
ud2
Function at 0x14001b4e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001b52e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b52e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001b52e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001b52e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001b52e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001b530
xor al, al
add rsp, 0x28
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14013c650
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14013c65d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14013c66d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14013c655
lea eax, [rcx + 1]
jmp 0x14013c67b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14013c68e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14013c674
sub eax, 3
jb 0x14013c6ae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14013c6fd
sar eax, 1
movsxd rbp, eax
jb 0x14013c6e4
jmp 0x14013c6bc
add ebx, ebx
jne 0x14013c6ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14013c6e4
inc ecx
add ebx, ebx
jne 0x14013c6ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14013c6e4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14013c6dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14013c6cc
add ecx, 2
jmp 0x14013c6e9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14013c612
jmp 0x14013c65d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xc1000
mov dl, 0x1c
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14013c749
cmp rsi, rcx
jae 0x14013c751
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14013c730
cmp al, 0x8f
ja 0x14013c730
cmp byte [rsi - 2], 0xf
je 0x14013c736
sub al, 0xe8
cmp al, 1
ja 0x14013c71a
cmp rsi, rcx
jae 0x14013c751
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14013c720
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14013c751
lodsb al, byte [rsi]
jmp 0x14013c730
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x139000]
mov eax, dword [rdi]
or eax, eax
je 0x14013c7ae
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x13c000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14013c75e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14013c7a8
mov qword [rbx], rax
add rbx, 8
jmp 0x14013c77e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14013c7e8
cmp al, 0xef
ja 0x14013c7da
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14013c7ba
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14013c7c9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14013c83c
sub rsp, 0xffffffffffffff80
jmp 0x14009aa44
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00405670]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x00405680]
mov dword [rax], 1
mov rax, qword [0x00405690]
mov dword [rax], 1
mov rax, qword [0x00405660]
mov dword [rax], 1
mov rax, qword [0x00405550]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x00405650]
mov dword [0x0040800c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x00405610]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00405500]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x401724
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rdx, [0x00405060]
mov rcx, qword [rbp + 0x10]
call sym.fopen
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x401765
lea rcx, str.Erreur_lors_de_lopration
call sym.puts
mov eax, 0
jmp 0x401845
mov rax, qword [rbp - 0x10]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.ftell
mov rdx, qword [rbp + 0x18]
mov dword [rdx], eax
mov rax, qword [rbp - 0x10]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0x18]
mov eax, dword [rax]
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x4017df
lea rcx, str.Erreur_lors_de_lopration
call sym.puts
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.fclose
mov eax, 0
jmp 0x401845
mov rax, qword [rbp + 0x18]
mov eax, dword [rax]
movsxd rdx, eax
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x18]
mov eax, dword [rax]
cdqe
cmp qword [rbp - 0x18], rax
je 0x401835
lea rcx, str.Erreur_lors_de_lopration
call sym.puts
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov qword [rbp - 8], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.fclose
mov rax, qword [rbp - 8]
add rsp, 0x40
pop rbp
ret
Function at 0x4019bd
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0xffffffffffffffff
jne 0x401a0a
lea rcx, str.Erreur_lors_de_la_cration_du_snapshot
call sym.puts
mov ecx, 1
call sym.exit
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
test eax, eax
jne 0x401a42
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x401aa4
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x401a75
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x401aa4
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x401a42
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret