joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003bcd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x1400fa8e0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r12d, dword [rdx]
lea r11, [0x140000000]
mov r15d, dword [rcx]
lea rax, [0x1400731c8]
xor ebx, ebx
mov qword [rbp - 0x39], rax
add r12, r11
mov qword [rbp - 0x41], rbx
add r15, r11
mov qword [rbp - 1], r12
mov r10d, 0x3fffffff
mov qword [rbp - 9], r15
mov ecx, ebx
mov dword [rbp - 0x49], ebx
mov r13, qword [r12]
mov r8d, ebx
mov edx, dword [r15]
mov r9, r13
shr r9, 0x3f
mov qword [rbp + 7], r13
mov qword [rbp - 0x31], r9
test r10d, edx
jbe 0x140003d5b
xor r14d, r14d
mov eax, r8d
mov qword [rbp - 0x25], rbx
mov dil, bl
mov dword [rbp - 0x29], ebx
mov dword [rbp - 0x1d], ebx
mov r13, qword [r15 + rax*8 + 8]
mov r12, r13
mov dword [rbp - 0x45], r14d
shr r13, 3
and r13d, 0xfffffff
shr r12, 0x1f
mov r10d, r13d
and r12d, 0xfffffff
add r10, r11
mov qword [rbp - 0x11], r10
test r9d, r9d
je 0x140003bfc
mov r8d, r12d
lea rcx, [rbp - 0x29]
mov edx, r13d
call fcn.1400025bc
mov r10d, dword [rbp - 0x15]
cmp r10d, dword [rbp - 0x29]
jae 0x140003be6
mov rax, qword [rbp - 0x25]
mov edx, dword [rax + r10*4]
mov eax, edx
and eax, 0x8148ffff
sub rsp, 0xa0
mov rcx, 0
mov rdx, 0xaa94
mov r8, 0x1000
lea r9, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
adc byte [rax], al
add byte [rbp + rcx*4 + 0x49], cl
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140003c1e
mov rbx, rax
call 0x140003c01
pop rsi
mov rcx, rax
add rsi, 0x2a8f2
mov rcx, 0xaa94
mov dl, byte [rsi]
mov byte [rbx], dl
inc rsi
inc rbx
loop 0x140003c13
hlt
mov rbx, rax
call rbx
mov ecx, 1
ret
movabs r8, 0x8000000000000000
mov rax, r13
or rcx, r8
or rax, r8
cmp rcx, rax
je 0x140003d7d
call fcn.140002644
jmp 0x140003e0f
test r9d, r9d
je 0x140003e0f
mov qword [rbp - 0x41], rbx
mov esi, ebx
test r10d, edx
jbe 0x140003df5
mov eax, esi
mov rdi, qword [r15 + rax*8 + 8]
mov rax, rdi
shr rdi, 3
and edi, 0xfffffff
shr rax, 0x1f
add rdi, r11
and eax, 0xfffffff
je 0x140003de5
mov r14d, eax
mov rax, qword [rbp - 0x39]
lea rdx, [rbp - 0x41]
mov r8b, byte [rdi]
lea rcx, [rbp - 0x39]
mov rax, qword [rax + 8]
call qword [0x140075220]
inc rdi
sub r14, 1
jne 0x140003db6
mov r10d, 0x3fffffff
lea r11, [0x140000000]
mov ecx, dword [r15]
inc esi
and ecx, r10d
cmp esi, ecx
jb 0x140003d91
mov rbx, qword [rbp - 0x41]
movabs rcx, 0x7fffffffffffffff
mov rax, r13
and rbx, rcx
mov qword [rbp - 0x41], rbx
lock cmpxchg qword [r12], rbx
mov eax, 1
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call 0x140070f60
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400053c4
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rcx, [rsp + 0x58]
call fcn.140004c74
lea rcx, [rsp + 0x58]
call fcn.140005dbc
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 0x10], 0
jne 0x14000543c
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140004270
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006c74
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000542d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x58]
call fcn.140007320
mov rbx, qword [rsp + 0x58]
and dword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
jne 0x140005460
call fcn.140006d5c
mov edi, eax
jmp 0x14000547a
mov edx, dword [rsp + 0x50]
mov r8, rsi
mov rcx, rdi
call fcn.1400054a8
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005494
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140006e68
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140004918
xor esi, esi
mov rcx, rax
test rax, rax
je 0x140006f31
mov rax, qword [rax]
call qword [rax + 0x18]
xor r8d, r8d
lea rcx, str.SystemDrive
add rax, 0x18
xor edx, edx
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
je 0x140006f19
test eax, eax
js 0x140006f3c
mov rax, qword [rbx]
lea edx, [rsi + 1]
sub edx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or edx, eax
jge 0x140006ed6
mov edx, edi
mov rcx, rbx
call fcn.140004e7c
mov rdx, qword [rbx]
lea rcx, str.SystemDrive
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140006ef5
mov eax, esi
jmp 0x140006f02
movsxd rdx, dword [rcx - 0xc]
call fcn.14000d2f8
test eax, eax
js 0x140006f47
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x140006f47
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], si
jmp 0x140006f1e
call fcn.140006d5c
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004f58
int3
mov ecx, 0x80070057
call fcn.140004f58
int3
mov ecx, 0x80070057
call fcn.140004f58
int3
Function at 0x140007ca4
Capabilities:
Open clipboard
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x140029028]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov esi, r9d
mov edi, ecx
cmp ecx, 0x80000003
jne 0x140007cfc
xor eax, eax
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140008f10
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x802
call fcn.14000a550
mov rbx, qword [0x14002bae8]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.140004370
mov r9, qword [rsp + 0x40]
lea rax, str.baselogging.cc
mov dword [rsp + 0x38], esi
lea rdx, str.Exception__x_in__s__s__u_r_n_r_n_hs:_d_r_n
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
and dword [rsp + 0x28], 0
mov r8d, edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007d74
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140007d99
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140007dd4
mov r9d, 0x250012
lea r8, str.Exception
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 3
je 0x140007dc8
cmp eax, 1
jne 0x140007dbe
int3
mov eax, 1
jmp 0x140007cd7
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140007dd4
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rsi, rcx
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [rbx + 1]
mov ecx, 0x2002
movsxd rdi, eax
add rdi, rdi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140007e24
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.14000a100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x140007e49
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
Function at 0x140007ed0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x140029028]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor ebx, ebx
lea r8, [rcx + 0x10]
mov r9, rcx
mov ecx, ebx
movzx edx, byte [r8]
movzx eax, byte [r8 + 1]
lea r8, [r8 + 4]
shl eax, 0x10
shl edx, 0x18
or edx, eax
movzx eax, byte [r8 - 2]
shl eax, 8
or edx, eax
movzx eax, byte [r8 - 1]
or edx, eax
mov dword [rsp + rcx*4 + 0x20], edx
inc rcx
cmp rcx, 0x10
jl 0x140007f0c
lea r10, [rsp + 0x58]
mov r11d, 0x30
mov ecx, dword [r10 - 0x34]
mov r8d, ecx
mov edx, dword [r10]
mov eax, ecx
rol r8d, 0xe
lea r10, [r10 + 4]
shr ecx, 3
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
rol eax, 0xd
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r10 - 0x3c]
add r8d, dword [r10 - 0x18]
mov dword [r10 + 4], r8d
sub r11, 1
jne 0x140007f4a
mov esi, dword [r9 + 0x5c]
mov ebp, dword [r9 + 0x6c]
mov r12d, ebp
mov r13d, dword [r9 + 0x50]
mov r11d, dword [r9 + 0x54]
mov edi, dword [r9 + 0x58]
mov r10d, dword [r9 + 0x60]
mov r14d, dword [r9 + 0x68]
mov dword [rsp + 8], esi
mov r15d, dword [rsp + 8]
mov esi, dword [r9 + 0x64]
mov eax, r13d
mov r8d, r13d
rol eax, 0xa
mov ecx, r11d
xor ecx, r13d
ror r8d, 0xd
xor r8d, eax
and ecx, edi
mov eax, r13d
mov edx, r10d
ror eax, 2
xor r8d, eax
ror edx, 0xb
mov eax, r11d
and eax, r13d
xor ecx, eax
mov eax, r10d
rol eax, 7
add r8d, ecx
xor edx, eax
mov ecx, r10d
mov eax, r10d
not ecx
ror eax, 6
and ecx, r14d
xor edx, eax
mov eax, esi
and eax, r10d
xor ecx, eax
lea rax, [0x140024340]
add edx, ecx
add edx, dword [rbx + rax]
add edx, dword [rsp + rbx + 0x20]
add rbx, 4
add edx, r12d
mov r12d, r14d
mov r14d, esi
mov esi, r10d
lea r10d, [rdx + r15]
mov r15d, edi
mov edi, r11d
mov r11d, r13d
lea r13d, [rdx + r8]
cmp rbx, 0x100
jl 0x140007fbc
add dword [r9 + 0x50], r13d
lea eax, [r12 + rbp]
add dword [r9 + 0x54], r11d
add dword [r9 + 0x58], edi
add dword [r9 + 0x5c], r15d
add dword [r9 + 0x60], r10d
add dword [r9 + 0x64], esi
add dword [r9 + 0x68], r14d
mov dword [r9 + 0x6c], eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140008f10
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140008308
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x140029028]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r10d, dword [rcx + 8]
mov rbx, rdx
mov r11d, r8d
and r10d, 0x3f
add qword [rcx + 8], r11
mov r9, rcx
test r8d, r8d
je 0x14000849e
mov al, byte [rbx]
dec r11d
mov byte [r10 + r9 + 0x10], al
inc rbx
inc r10d
cmp r10d, 0x40
jne 0x140008495
lea rdx, [r9 + 0x10]
xor r8d, r8d
movzx ecx, byte [rdx]
movzx eax, byte [rdx + 1]
lea rdx, [rdx + 4]
shl eax, 0x10
shl ecx, 0x18
or ecx, eax
movzx eax, byte [rdx - 2]
shl eax, 8
or ecx, eax
movzx eax, byte [rdx - 1]
or ecx, eax
mov dword [rsp + r8*4], ecx
inc r8
cmp r8, 0x10
jl 0x140008378
cmp r8, 0x50
jge 0x1400083d4
mov edx, 0x50
lea rcx, [rsp + r8*4 - 0x38]
sub rdx, r8
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
rol eax, 1
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x1400083ba
mov r15d, dword [r9 + 0x50]
xor r10d, r10d
mov r12d, dword [r9 + 0x54]
mov r14d, r15d
mov r13d, dword [r9 + 0x58]
mov esi, r12d
mov edi, dword [r9 + 0x5c]
mov r8d, r13d
mov ebp, dword [r9 + 0x60]
mov edx, r14d
rol edx, 5
add edx, dword [rsp + r10*4]
add edx, ebp
cmp r10, 0x14
jge 0x140008417
mov ecx, edi
xor ecx, r8d
and ecx, esi
xor ecx, edi
add ecx, 0x5a827999
jmp 0x140008455
cmp r10, 0x28
jge 0x14000842c
mov ecx, edi
xor ecx, r8d
xor ecx, esi
add ecx, 0x6ed9eba1
jmp 0x140008455
cmp r10, 0x3c
jge 0x140008448
mov ecx, r8d
mov eax, r8d
or ecx, esi
and eax, esi
and ecx, edi
or ecx, eax
add ecx, 0x8f1bbcdc
jmp 0x140008455
mov ecx, edi
xor ecx, r8d
xor ecx, esi
add ecx, 0xca62c1d6
add ecx, edx
mov ebp, edi
mov edi, r8d
inc r10
mov r8d, esi
mov esi, r14d
ror r8d, 2
mov r14d, ecx
cmp r10, 0x50
jl 0x1400083f4
add dword [r9 + 0x5c], edi
lea eax, [r15 + rcx]
add dword [r9 + 0x60], ebp
mov dword [r9 + 0x50], eax
xor r10d, r10d
lea eax, [r12 + rsi]
mov dword [r9 + 0x54], eax
lea eax, [r8 + r13]
mov dword [r9 + 0x58], eax
test r11d, r11d
jne 0x140008357
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140008f10
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140008784
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetDefaultDllDirectories
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400087b7
mov ecx, 0x800
call rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.14000520c
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400053c4
mov ebx, eax
test eax, eax
js 0x140008876
lea rdx, str.user
lea rcx, [rsp + 0x20]
call fcn.140004c74
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140005870
mov rdx, qword [rsp + 0x20]
test al, al
sete dil
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008826
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, str.unregister
lea rcx, [rsp + 0x28]
call fcn.140004c74
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140005870
mov rdx, qword [rsp + 0x28]
test al, al
sete bl
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000886a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dl, bl
mov cl, dil
call fcn.1400086c0
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.14000534c
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14000e6f4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14000e4c8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e4c8
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000e4c8
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000e4c8
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000e4c8
cmp dword [rcx + 0x84], 0xe
jbe 0x14000e4c8
cmp dword [rcx + 0xf8], esi
je 0x14000e4c8
mov ecx, r14d
call fcn.14000e610
mov ecx, 2
call fcn.14000efc8
nop
cmp byte [0x14002ac38], 0
jne 0x14000e592
mov r15d, 1
mov eax, r15d
xchg dword [0x14002ac2c], eax
test ebx, ebx
jne 0x14000e53b
mov rdi, qword [0x140029028]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14002ac30]
cmp rcx, rax
je 0x14000e532
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140007464]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14002ac48]
jmp 0x14000e547
cmp ebx, r15d
jne 0x14000e54d
lea rcx, [0x14002ac60]
call fcn.14000ec5c
nop
test ebx, ebx
jne 0x14000e564
lea rdx, [0x1400184a8]
lea rcx, [0x140018488]
call fcn.14000e388
lea rdx, [0x1400184b8]
lea rcx, [0x1400184b0]
call fcn.14000e388
movzx eax, byte [0x14002ac38]
test esi, esi
cmove eax, r15d
mov byte [0x14002ac38], al
jmp 0x14000e592
mov ecx, 2
call fcn.14000f01c
test esi, esi
jne 0x14000e5a9
mov ecx, r14d
call fcn.14000e5c4
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000e458
Function at 0x401250
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
mov r11d, eax
mov eax, 1
cmp ecx, 5
ja 0x401278
jne 0x401276
shr r11w, 8
cmp r11b, al
jae 0x401278
xor eax, eax
add rsp, 0x28
ret

Function at 0x401380
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x400
mov rdi, rdx
call fcn.00416460
mov edx, 0x400
mov rcx, rax
mov rbx, rax
call fcn.00419f30
lea rcx, str._Extractor__Working_dir_is__s_n
mov rdx, rbx
call fcn.0040b26c
mov rcx, rbx
call fcn.00416420
mov rcx, rdi
call fcn.0040ad28
test eax, eax
je 0x4013df
lea rcx, str._Rename__The_target_already_exists._Deleting._n
call fcn.0040b26c
mov rcx, rdi
call fcn.0040abfc
mov rdx, rdi
mov rcx, rsi
call fcn.00417300
xor ebx, ebx
jmp 0x40146a
cmp ebx, 0xa
jge 0x401496
call fcn.00416910
lea rcx, str._Rename__Could_not_rename__s_to__s___d__n
mov r8, rdi
mov r9d, dword [rax]
mov rdx, rsi
call fcn.0040b26c
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str._Rename__Windows___this_FS_seems_to_not_supported_renaming._Trying_alternative_method..._n
call fcn.0040b26c
mov r8d, 3
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401488
lea rdx, str.MoveFileEx
lea rcx, str.Extractor
call fcn.0040a8a4
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rdi
mov rcx, rsi
add ebx, 1
call fcn.00417300
test eax, eax
jne 0x4013ee
lea rcx, str._Rename__File__s_renamed_to__s_n
mov r8, rdi
mov rdx, rsi
call fcn.0040b26c
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
lea rcx, str._Rename__MoveFileEx_worked._Assuming_success._n
call fcn.0040b26c
xor eax, eax
test eax, eax
je 0x40146e
call fcn.00416910
lea rcx, str._Rename___FAIL__Could_not_rename__s_to__s___d__n
mov r8, rdi
mov r9d, dword [rax]
mov rdx, rsi
call fcn.0040b26c
lea rcx, str._Rename__Can_do_no_better_than_a_copy_on_this_filesystem_n
call fcn.0040b26c
mov rcx, rdi
call fcn.0040b17c
lea rcx, str._Rename__Created_folder__s_n
mov rdx, rdi
call fcn.0040b26c
mov rdx, rdi
mov rcx, rsi
call fcn.00401590
test eax, eax
je 0x4014f4
lea rcx, str._Rename__Copy_failed_too__Severe_filesystem_issues._n
call fcn.0040b26c
jmp 0x401480
lea rcx, str._Rename__Copied__s_to__s_n
jmp 0x401475

Function at 0x401500
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
lea rdx, [0x0044b6c0]
mov rbx, rcx
call fcn.00417ef0
test rax, rax
mov rdi, rax
jne 0x401533
lea rcx, str._Extractor___Unable_to_open_destination_file_for_copy__s_n
mov rdx, rbx
call fcn.0040b26c
jmp 0x401585
lea rcx, [0x0045bcd0]
mov r9, rsi
mov edx, 1
mov r8d, 0xc350
call fcn.004185d0
test rax, rax
mov rbx, rax
je 0x40156c
lea rcx, [0x0045bcd0]
mov r9, rdi
mov r8, rax
mov edx, 1
call fcn.00419c80
cmp rbx, 0xc350
je 0x401533
mov rcx, rsi
call fcn.0041a7d0
mov rcx, rdi
call fcn.0041a7d0
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x401590
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
mov eax, 0x2740
call fcn.00438730
sub rsp, rax
test rcx, rcx
mov rbx, rcx
je 0x4015bc
call fcn.004010b0
mov rdi, rax
jmp 0x4015c9
call fcn.00416910
xor edi, edi
mov dword [rax], 0x16
test rdi, rdi
mov qword [rsp + 0x2770], rdi
jne 0x4015ed
lea rcx, str._CopyFolder__SourceDir_from__s_is_NULL_n
mov rdx, rbx
call fcn.0040b26c
lea eax, [rdi + 1]
jmp 0x4017e2
mov rcx, rdi
call fcn.004011f4
test rax, rax
mov rbp, rax
je 0x4017d6
mov rcx, qword [rax]
cmp byte [rcx], 0x2e
jne 0x401614
call fcn.00416670
cmp rax, 2
jbe 0x4015ed
mov rdx, qword [rsp + 0x2760]
mov rbx, qword [rbp]
lea rcx, [rsp + 0x13b0]
mov byte [rsp + 0x13b0], 0
call fcn.00416730
lea rcx, [rsp + 0x13b0]
mov rdx, rbx
call fcn.0040b1c0
mov rdx, qword [rsp + 0x2768]
mov rbx, qword [rbp]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], 0
call fcn.00416730
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.0040b1c0
lea rcx, [rsp + 0x13b0]
call fcn.004010b0
test rax, rax
je 0x4016e6
mov rcx, rax
call fcn.004011a4
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder__Copying_DIR__s_n
call fcn.0040b26c
lea rcx, [rsp + 0x20]
call fcn.0040b17c
test eax, eax
mov ebx, eax
jne 0x4017a1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x13b0]
call fcn.00401590
test eax, eax
mov ebx, eax
je 0x4015ed
lea rcx, str._CopyFolder___Failed_to_copy__s_to__s_n
lea rdx, [rsp + 0x13b0]
lea r8, [rsp + 0x20]
call fcn.0040b26c
jmp 0x4017d8
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder__Copying_FILE__s_n
call fcn.0040b26c
lea rdx, [0x0044b668]
lea rcx, [rsp + 0x13b0]
call fcn.00417ef0
test rax, rax
mov qword [rsp + 0x2778], rax
je 0x4017bb
lea rdx, [0x0044b6c0]
lea rcx, [rsp + 0x20]
call fcn.00417ef0
test rax, rax
mov rbp, rax
je 0x4017ad
mov rdi, qword [rsp + 0x2778]
lea rcx, [0x0045bcd0]
mov r9, rdi
mov edx, 1
mov r8d, 0xc350
call fcn.004185d0
test rax, rax
mov rbx, rax
je 0x401776
lea rcx, [0x0045bcd0]
mov r9, rbp
mov r8, rax
mov edx, 1
call fcn.00419c80
cmp rbx, 0xc350
je 0x40173d
mov rcx, qword [rsp + 0x2778]
mov rdi, qword [rsp + 0x2770]
call fcn.0041a7d0
mov rcx, rbp
call fcn.0041a7d0
jmp 0x4015ed
lea rcx, str._CopyFolder___Failed_to_copy__s_to__s__could_not_create_target_folder__n
jmp 0x4016cf
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder___Unable_to_open_destination_file_for_copy__s_n
jmp 0x4017ca
lea rdx, [rsp + 0x13b0]
lea rcx, str._CopyFolder___Unable_to_open_source_file_for_copy__s_n
call fcn.0040b26c
mov ebx, 1
jmp 0x4017d8
xor ebx, ebx
mov rcx, rdi
call fcn.004011a4
mov eax, ebx
add rsp, 0x2740
pop rdi
pop rbp
pop rbx
ret
Function at 0x402cf0
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov rax, rsp
sub rsp, 0x38
xor edi, edi
mov rbp, rdx
lea rdx, [rax + 0x48]
mov rbx, rcx
mov dword [rax + 0x48], edi
mov dword [rax + 0x50], edi
mov qword [rax - 0x18], rdi
call sub.VERSION.dll_GetFileVersionInfoSizeA
lea ecx, [rdi + 0x64]
mov r13d, eax
call fcn.00416460
lea rcx, str._JavaCheck__Checking_file_version_of__s_n
mov rdx, rbx
mov byte [rax], 0x30
mov byte [rax + 1], dil
mov r12, rax
call fcn.0040b26c
cmp r13d, edi
je 0x402e3b
mov rcx, r13
call fcn.00416460
lea rcx, str._JavaCheck__Got_version_size_n
mov rsi, rax
call fcn.0040b26c
mov edx, dword [rsp + 0x80]
mov r9, rsi
mov r8d, r13d
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, edi
je 0x402e25
lea rcx, str._JavaCheck__Got_version_info_n
call fcn.0040b26c
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x20]
lea rdx, [0x0044c658]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueA
cmp eax, edi
je 0x402e1c
lea rcx, str._JavaCheck__Queried_value_n
call fcn.0040b26c
cmp dword [rsp + 0x88], edi
je 0x402e13
lea rcx, str._JavaCheck__Size_OK_n
call fcn.0040b26c
mov rbx, qword [rsp + 0x20]
cmp dword [rbx], 0xfeef04bd
jne 0x402e0a
mov edx, dword [rbx + 0x10]
lea rcx, str._JavaCheck__file_version_MS_is__ld_n
call fcn.0040b26c
mov edx, dword [rbx + 0x14]
lea rcx, str._JavaCheck__file_version_LS_is__ld_n
call fcn.0040b26c
movzx r8d, word [rbx + 0x12]
lea rdx, [0x0044c6e4]
mov rcx, r12
call fcn.00417330
jmp 0x402e31
lea rcx, str._JavaCheck__signature_is_wrong_n
jmp 0x402e2c
lea rcx, str._JavaCheck__size_is_null_n
jmp 0x402e2c
lea rcx, str._JavaCheck__ver_query_value_function_call_failed_n
jmp 0x402e2c
lea rcx, str._JavaCheck__get_file_version_info_call_failed_n
call fcn.0040b26c
mov rcx, rsi
call fcn.00416420
jmp 0x402e47
lea rcx, str._JavaCheck__verSize_is_zero_n
call fcn.0040b26c
cmp rbp, rdi
je 0x402e7a
lea rcx, str._Extractor__Checking_JRE_version_requirements:__s_vs_required__s_n
mov r8, rbp
mov rdx, r12
call fcn.0040b26c
mov rcx, r12
call fcn.00417d50
mov rcx, rbp
mov ebx, eax
call fcn.00417d50
cmp ebx, eax
setge dil
mov eax, edi
jmp 0x402e8e
xor edx, edx
lea rcx, str._Extractor__Versions_for_JREs_could_not_be_detected___d__d__n
lea r8d, [rdx + 1]
call fcn.0040b26c
xor eax, eax
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret