Function at 0x404110
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x210
mov rax, qword [0x00409048]
mov qword [rsp + 0x200], rax
mov rbx, rcx
lea rdx, [rsp + 0xf0]
mov r8d, 0x105
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r15d, r15d
cmp eax, r15d
je 0x40460c
cmp eax, 0x104
jg 0x40460c
cmp byte [0x00409082], r15b
je 0x404190
lea rdx, [rsp + 0xf0]
lea rcx, str.ExecJRE:_old:__s_n
call qword [sym.imp.msvcrt.dll_printf]
lea rcx, str.ExecJRE:_new:__s_n
mov rdx, rbx
call qword [sym.imp.msvcrt.dll_printf]
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rdx, [rsp + 0xf0]
mov rcx, rbx
mov r8, rax
call qword [sym.imp.msvcrt.dll__strnicmp]
cmp eax, r15d
je 0x40462e
lea rcx, [rsp + 0xf0]
mov rdx, rbx
call sub.msvcrt.dll_strcpy
lea rdx, str._bin_
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rdx, str.java
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rdx, str..exe
lea rcx, [rsp + 0xf0]
call sub.msvcrt.dll_strcat
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_StringDup
lea rcx, [rsp + 0x50]
mov r14, rax
mov qword [rsp + 0x50], rax
call fcn.0040407c
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
call sub.msvcrt.dll_strlen
lea rcx, [rsp + 0xf0]
mov rbx, rax
call sub.msvcrt.dll_strlen
lea rcx, [rbx + rax + 4]
call sub.jli.dll_JLI_MemAlloc
lea rcx, [rsp + 0xf0]
mov edx, 0x20
mov rbx, rax
call qword [sym.imp.msvcrt.dll_strchr]
cmp rax, r15
jne 0x404283
lea rcx, [rsp + 0xf0]
mov edx, 9
call qword [sym.imp.msvcrt.dll_strchr]
cmp rax, r15
jne 0x404283
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call sub.msvcrt.dll_strcpy
jmp 0x4042b1
lea rdx, [0x00407ddc]
mov rcx, rbx
call sub.msvcrt.dll_strcpy
lea rdx, [rsp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rdx, [0x00407ddc]
mov rcx, rax
call sub.msvcrt.dll_strcat
cmp byte [rsi], r15b
mov r12, rax
je 0x40447f
lea rcx, [rsp + 0x50]
call fcn.0040407c
mov r13, rax
cmp byte [rax], r15b
je 0x40442e
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_strlen
lea rcx, [rax + 1]
call sub.jli.dll_JLI_MemAlloc
cmp byte [rbx], r15b
mov rbp, rax
mov rsi, rax
je 0x40434a
mov al, byte [rbx]
cmp al, 0x22
je 0x404342
cmp al, 0x5c
jne 0x40433d
lea rdx, [0x00407d20]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strspn]
lea r11, [rbx + rax]
cmp byte [r11], 0x22
jne 0x404336
mov byte [rsi], 0x5c
add rbx, 2
inc rsi
cmp byte [rbx], 0x5c
jne 0x404345
cmp rbx, r11
jb 0x404316
jmp 0x404345
mov al, byte [rbx]
mov byte [rsi], al
inc rsi
inc rbx
cmp rbx, r11
jb 0x40432c
jmp 0x404345
mov byte [rsi], al
inc rsi
inc rbx
cmp byte [rbx], r15b
jne 0x4042f2
mov byte [rsi], r15b
cmp byte [rbp], 0x2d
jne 0x40443e
lea rdx, str._classpath
mov rcx, rbp
call sub.msvcrt.dll_strcmp
cmp eax, r15d
je 0x4043da
lea rdx, [0x004065ac]
mov rcx, rbp
call sub.msvcrt.dll_strcmp
cmp eax, r15d
je 0x4043da
lea rdx, str._version:
mov r8d, 9
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_strncmp]
cmp eax, r15d
je 0x404426
lea rdx, str._jre_restrict_search
mov rcx, rbp
call sub.msvcrt.dll_strcmp
cmp eax, r15d
je 0x404426
lea rdx, str._no_jre_restrict_search
mov rcx, rbp
call sub.msvcrt.dll_strcmp
cmp eax, r15d
je 0x404426
lea rdx, [0x0040697c]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rdx, r13
jmp 0x40441b
lea rdx, [0x0040697c]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rcx, [rsp + 0x50]
mov r12, rax
call fcn.0040407c
cmp byte [rax], r15b
mov rbx, rax
je 0x404426
lea rdx, [0x0040697c]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_strcat
mov r12, rax
mov rcx, rbp
call sub.jli.dll_JLI_MemFree
mov rax, qword [rsp + 0x50]
cmp byte [rax], r15b
jne 0x4042bd
jmp 0x40447f
lea rdx, [0x0040697c]
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rdx, [0x0040697c]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rcx, rbp
mov r12, rax
call sub.jli.dll_JLI_MemFree
mov rcx, r14
call sub.jli.dll_JLI_MemFree
cmp byte [0x00409082], r15b
je 0x4044dc
mov rcx, r12
call sub.jli.dll_JLI_StringDup
lea rcx, [rsp + 0x50]
mov rbx, rax
mov qword [rsp + 0x50], rax
call fcn.0040407c
lea rdx, [rsp + 0xf0]
lea rcx, str.ReExec_Command:__s___s__n
mov r8, rax
call qword [sym.imp.msvcrt.dll_printf]
mov rdx, qword [rsp + 0x50]
lea rcx, str.ReExec_Args:__s_n
call qword [sym.imp.msvcrt.dll_printf]
mov rcx, rbx
call sub.jli.dll_JLI_MemFree
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x30
call qword [sym.imp.msvcrt.dll_fflush]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fflush]
mov ebx, 0x68
lea rcx, [rsp + 0x80]
mov r8, rbx
xor edx, edx
call sub.msvcrt.dll_memset
lea r8d, [rbx - 0x50]
lea rcx, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x80], ebx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x60]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0xf0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, r15d
jne 0x404597
lea rdx, [rsp + 0xf0]
lea rcx, str.CreateProcess__s__...__failed:__s
mov r8b, 1
call fcn.00403d64
lea ecx, [rbx - 0x67]
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rcx, qword [rsp + 0x60]
mov ebx, 0xffffffff
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x4045c4
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, r15d
jne 0x4045eb
jmp 0x4045e3
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea r8, str.WaitForSingleObject___failed.
lea rdx, [0x00407d1c]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov dword [rsp + 0x58], 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.msvcrt.dll_exit]
int3
lea rdx, str.java
lea rcx, str.Unable_to_resolve_path_to_current__s_executable:__s
mov r8b, 1
call fcn.00403d64
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rcx, qword [rsp + 0x200]
call fcn.004052a0
add rsp, 0x210
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret