joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140269b20
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140269b38
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140269b40
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140269b50
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x140269b9d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140269b94
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140269b9f
add rax, 0x28
cmp rax, r9
jne 0x140269b80
xor eax, eax
ret

Function at 0x140269ba0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140269c30
mov rdx, qword [0x14037ac50]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x140269c1e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140269c1e
cmp word [rax + 0x18], 0x20b
jne 0x140269c1e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140269c30
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140269c09
add rbx, 0x28
cmp rbx, rdi
je 0x140269c30
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140269c00
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140269c40
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14037ac50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140269c60
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140269c68
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140269c60
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140269cbd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140269cb4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140269c60
add rax, 0x28
cmp rax, r9
jne 0x140269ca0
xor eax, eax
ret

Function at 0x140269cc0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14037ac50]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140269cdf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140269ce8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140269cdf
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140269d00
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14037ac50]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140269d20
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140269d28
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140269d20
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140269d70
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140269d67
test rcx, rcx
je 0x140269d20
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140269d58
xor eax, eax
ret

Function at 0x140269d80
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14037ac50]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140269d9f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140269da8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140269dc0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14037ac50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140269de0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140269de8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140269de0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140269de0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140269e34
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140269e40
add rdx, 0x28
cmp r9, rdx
jne 0x140269e20
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140269e50
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14037ac50]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140269e72
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140269e80
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140269e72
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140269e72
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140269e72
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140269ed5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140269ee8
add rdx, 0x28
cmp rdx, r10
jne 0x140269ec0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140269ef7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140269f07
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140269ede
test ecx, ecx
jg 0x140269ef0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140a8da7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push qword [rsp + 3]
jmp 0x140a8dafe
ja 0x140a8daad
jbe 0x140a8daad

Function at 0x140a8da82
Capabilities:
Execute anti-debugging instructions

Disassembly:
push bx
jno 0x140a8dab2
pop word [rsp + 0x12]
jmp 0x140a8dae8
push word [rsp + 0xe]
lea rsp, [rsp + 2]
mov qword [rsp + 0x28], r15
jmp 0x140a8db18
lea rsp, [rsp + 0x28]
jmp 0x140a8db02
Function at 0x140b948ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsi, [r8 + r11]
xchg word [rsp + 6], r10w
push sp
bswap esi
rdtsc
cpuid
jmp 0x140b948c6
rdtsc
mov r11, r8
mov ecx, dword [rsp + 4]
not rsi
bswap r12d
push qword [rsp + 3]
jmp 0x140b9486a
push word [rsp + 8]
mov cl, byte [rsp + 6]
call 0x140b948ab
xor ah, byte [rsi + 0x45]
mov esp, eax
push word [rsp + 0xe]
mov ecx, r11d
mov rbp, 0x4a2c7d6a
jmp 0x140b948f5
lea rbx, [rsp - 0x6934]
xchg cx, r15w
pop rdi
xchg qword [rsp], r12
push rcx
xchg dword [rsp + 7], r11d
jmp 0x140b9489c
mov bpl, r9b
push word [rsp + 0xd]
push r12
push si
jmp 0x140b94934
bswap r15
pop qword [rsp + 7]
xchg byte [rsp + 0xd], r15b
xchg r13w, bx
xchg r15d, ecx
mov r13d, r11d
jmp 0x140b948df
mov r10, rax
mov qword [rsp], rsi
jmp 0x140b94886
push word [rsp + 5]
rdtsc
mov rbx, rsp
mov r15w, word [rsp + 0x19]
jmp 0x140b94964
pop qword [rsp + 0xb]
xchg rbx, r15
mov cl, 0x33
lea r15, [r15 + riz + 0x4f74]
cpuid
pop r8w
jmp 0x140b9491e
lea rsp, [rsp + 3]
mov bpl, byte [rsp]
bswap r10d
lea r12, [rdx + r11]
jmp 0x140b94af4
mov r15b, 0x5c
lea rsp, [rsp + 0x12]
mov r10d, 0xa9549c75
lea rsi, [rcx + r15]
jmp 0x140b9494e
mov r10b, dil
mov r12b, 0xe1
mov r8, r11
mov r12d, 0xd97e160e
jmp 0x140b949e8
xchg cx, ax
mov rdi, rbp
mov rcx, qword [rsp + 0x10]
xchg r15, rsi
bswap r10d
mov dx, word [rsp]
jmp 0x140b9499c
mov di, r13w
mov rbp, 0xfffffffff13ead6b
rdtsc
not rdx
bswap edx
bswap rax
jmp 0x140b94a2f
mov r10, qword [rsp]
mov r15d, 0x6510423b
mov r10, qword [rsp + 0x18]
setge al
bswap rax
mov dl, 0xc2
jmp 0x140b949c8
mov esi, 0x592c09d7
lea r12, [rdi + r8]
setnp r8b
jmp 0x140b94a6b
mov esi, 0x56b12a38
mov rdx, qword [rsp + 0x28]
xchg r15, r12
mov r13, rsp
jmp 0x140b94a01
mov rax, qword [rsp + 0x20]
lea r15, [rbx + riz - 0x368a938b]
mov ebx, 0xda357d9a
lea rdx, [0xffffffffb1793feb]
mov r15, 0x14592c53
mov r15b, 0xc6
jmp 0x140b94a17
mov r8b, dl
mov r15d, r9d
mov r15w, word [rsp]
sete r13b
jmp 0x140b94abf
mov rbp, qword [rsp + 0x30]
mov r12w, word [rsp]
lea r13, [r8 + rbp]
lea r8, [rbx + rbx]
mov r15b, 0x1d
jmp 0x140b94a55
mov r11, qword [rsp + 8]
mov al, r8b
mov rax, rbx
cpuid
mov bl, byte [rsp]
mov r12b, bpl
jmp 0x140b949b2
lea r12, [rcx + riz - 0x8f68]
xchg esi, r13d
xchg si, di
mov r15, qword [rsp + 0x40]
mov r8w, word [rsp]
jmp 0x140b94ad6
mov r12b, 0xaa
mov rbx, qword [rsp + 0x38]
mov r8b, 0xeb
xchg r15, r12
xchg r12w, si
bswap r13d
jmp 0x140b94a9f
mov rdi, qword [rsp]
not r12d
xchg sil, r12b
not edi
lea r8, [r10 + r11]
mov rdi, qword [rsp + 0x48]
jmp 0x140b94b1c
cpuid
xchg ebx, edx
xchg r15, r8
mov sil, bl
bswap rdi
mov ax, sp
jmp 0x140b94a87
bswap r8d
call 0x140b94b06
mov r8d, 0x106de985
mov r12, qword [rsp + 0x58]
mov sil, r8b
mov rsi, qword [rsp]
jmp 0x140b94e7e
mov sil, byte [rsp]
bswap r13d
mov r13, qword [rsp + 0x68]
mov sil, bl
mov sil, byte [rsp]
mov sil, dl
mov r13b, 0xb6
mov r13w, word [rsp]
mov r13b, 0x39
lea rsi, [0x4ceabf40]
mov r13, qword [rsp]
mov si, word [rsp]
jmp 0x140b94b89
mov r13, qword [rsp]
mov rsi, qword [rsp]
bswap r8d
xchg r13, r8
mov r8b, byte [rsp]
mov r8, qword [rsp + 0x60]
jmp 0x140b94be7
Function at 0x140001000
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
nop dword [rax + rax]
mov ecx, 6
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, 0xffff
jge 0x1400010df
mov eax, dword [0x140003668]
cmp eax, 3
jge 0x1400010d9
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
mov qword [rsp + 0x20], rbx
inc eax
xor r9d, r9d
xor r8d, r8d
mov dword [0x140003668], eax
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1e
sub ecx, eax
add ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000001
jge 0x1400010bc
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1400010ca
lea ecx, [rax + 0x13]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x140003668]
cmp eax, 3
jl 0x140001040
mov dword [0x140003668], ebx
mov ecx, 5
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, 0xffff
jge 0x140001010
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 8]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_mouse_event]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x19
sub ecx, eax
add ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000001
jge 0x140001166
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x140001010
lea ecx, [rax + 0x1d]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001010

Function at 0x140001a58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001aa2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001aa2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001aa2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001aa2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001aa2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001aa4
xor al, al
add rsp, 0x28
ret
Function at 0x140f11058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140f111df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f11089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f1106f
add dl, dl
jne 0x140f11096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f110f6
xor eax, eax
add dl, dl
jne 0x140f110a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f111ad
add dl, dl
jne 0x140f110b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f110c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f110d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f110dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f110ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f1107e
mov eax, 1
add dl, dl
jne 0x140f11106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f11113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f110fb
sub eax, ebx
mov ebx, 1
jne 0x140f1114c
mov ecx, 1
add dl, dl
jne 0x140f1112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f1113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f11123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f1107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f11168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f11175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f1115d
cmp eax, 0x7d00
jae 0x140f1119b
cmp eax, 0x500
jb 0x140f11196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f1107e
cmp eax, 0x7f
ja 0x140f1119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f1107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f111d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f1107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001330
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140001690]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateThread]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffe
jae 0x14000136b
xor ecx, ecx
jmp 0x140001378
call fcn.1400019d0
mov dword [rsi + 0x10], edx
mov ecx, 1
mov qword [rsi + 8], rax
mov qword [rsi], rcx
add rsp, 0x30
pop rsi
ret

Function at 0x140004bf0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140004c90
jmp 0x140004c7f
jae 0x140004d4f
cmp r8, 0x201
jae 0x140004c90
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140004ce7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x140004cbf
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14001b120
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140004d10
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140004dbb
mov r8d, r13d
cmp r12, r8
jne 0x140004c70
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140004def
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140004c7f
jmp 0x140004c90
cmp r14, r8
jb 0x140004e09
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140007200
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140004da4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140001700
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x140004d8f
jmp 0x140004da4
lea rcx, str.internal_error:_entered_unreachable_code_rustc_051478957371ee0084a7c0913941d2a8c4757bb9library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14001bde0
jmp 0x140004e1e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14001c190
ud2
Function at 0x14000bc30
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14001f240]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14000bc68
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14000bcbf
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x14000bccc
xor edx, edx
xor eax, eax
jmp 0x14000bcf6
cmp eax, 0x103
je 0x14000bd00
test eax, eax
js 0x14000bcdf
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14000bcf6
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140006f30
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1400033c0
mov ecx, 7
int 0x29
ud2

Function at 0x14000bd50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14001f240]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14000bd88
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000bde6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14000be13
test eax, eax
js 0x14000bdf2
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14000be09
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140006f30
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1400033c0
mov ecx, 7
int 0x29
ud2
Function at 0x140018fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14001906a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140019060
cmp r11, r10
ja 0x1400190e6
cmp r10, rdx
ja 0x1400190f8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x140019062
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140019040
jmp 0x1400190c7
ja 0x14001906a
mov r11, r10
cmp rax, r8
jne 0x140019007
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x1400190cb
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400190a0
mov r8, r10
sub ecx, r9d
jns 0x1400190be
jmp 0x1400190cd
cmp r10, rdx
je 0x1400190da
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400190cd
xor al, 1
cmp r8, rdx
jne 0x140019080
jmp 0x1400190cd
xor eax, eax
jmp 0x1400190cd
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14001bca0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001c200
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001c190
int3

Function at 0x14001a964
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a9ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a9ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a9ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a9ae
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a9ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001a9b0
xor al, al
add rsp, 0x28
ret
Function at 0x140004708
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004752
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004752
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004752
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004752
cmp dword [rcx + 0x84], 0xe
jbe 0x140004752
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004754
xor al, al
add rsp, 0x28
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret