Function at 0x405030
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
sub rsp, 0x248
mov rax, qword [0x0040f310]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x260], rbx
mov rbx, rcx
lea rdx, [rsp + 0xf0]
xor ecx, ecx
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4058c1
cmp eax, 0x104
jg 0x4058c1
cmp byte [0x0040f352], 0
je 0x4050a8
lea rdx, [rsp + 0xf0]
lea rcx, str.ExecJRE:_old:__s_n
call qword [sym.imp.msvcrt.dll_printf]
lea rcx, str.ExecJRE:_new:__s_n
mov rdx, rbx
call qword [sym.imp.msvcrt.dll_printf]
mov qword [rsp + 0x238], rdi
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
lea rdx, [rsp + 0xf0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
je 0x405904
lea rcx, [rsp + 0xf0]
sub rcx, rbx
nop
nop
movzx eax, byte [rbx]
inc rbx
test al, al
mov byte [rcx + rbx - 1], al
jne 0x4050f0
xor eax, eax
lea r8, [rsp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdi, r8
lea rdx, str._bin_
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405120
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea r8, str.java
nop
nop
nop
movzx eax, byte [r8 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405150
xor eax, eax
lea rdi, [rsp + 0xf0]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, str..exe
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405180
mov qword [rsp + 0x230], r12
mov qword [rsp + 0x228], r13
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call qword [sym.imp.msvcrt.dll__strdup]
lea rcx, [rsp + 0x58]
mov r13, rax
mov qword [rsp + 0x58], rax
call fcn.00404e70
mov rbx, qword [rsp + 0x58]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
lea rdi, [rsp + 0xf0]
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea rcx, [rdx + rcx + 3]
call fcn.00401000
lea rcx, [rsp + 0xf0]
mov edx, 0x20
mov r12, rax
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
jne 0x405250
lea edx, [rax + 9]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
jne 0x405250
lea rax, [rsp + 0xf0]
mov rdx, r12
lea rcx, [rsp + 0xf0]
sub rdx, rax
nop
movzx eax, byte [rcx]
inc rcx
test al, al
mov byte [rdx + rcx - 1], al
jne 0x405240
jmp 0x4052bf
movzx eax, word [0x0040dc98]
mov rcx, 0xffffffffffffffff
mov rdi, r12
mov word [r12], ax
xor eax, eax
lea rdx, [rsp + 0xf0]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405280
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
lea rdx, [0x0040dc94]
dec rdi
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 1], al
jne 0x4052b0
movzx eax, byte [rbx]
mov qword [rsp + 0x220], r14
xor r14d, r14d
test al, al
je 0x4056f0
mov qword [rsp + 0x218], r15
mov qword [rsp + 0x268], rbp
mov qword [rsp + 0x240], rsi
lea r15, [0x0040dcf8]
test al, al
mov r8d, r14d
mov r9d, r14d
je 0x405312
nop
cmp al, 0x20
je 0x405308
cmp al, 9
jne 0x405312
mov al, byte [rbx + 1]
inc rbx
test al, al
jne 0x405300
cmp byte [rbx], 0
mov rsi, rbx
je 0x405385
nop
nop
test r9d, r9d
jne 0x405330
movzx eax, byte [rbx]
cmp al, 0x20
je 0x40537a
cmp al, 9
je 0x40537a
movzx edi, byte [rbx]
cmp dil, 0x5c
jne 0x405351
cmp byte [rbx + 1], 0x22
jne 0x405351
mov eax, r8d
cdq
and eax, 1
xor eax, edx
sub eax, edx
jne 0x405351
inc rbx
jmp 0x405363
cmp dil, 0x22
jne 0x405363
test r9d, r9d
mov eax, r14d
sete al
mov r9d, eax
movzx eax, byte [rbx]
inc rbx
cmp al, 0x5c
jne 0x405372
inc r8d
jmp 0x405375
mov r8d, r14d
cmp byte [rbx], 0
jne 0x405320
cmp byte [rbx], 0
je 0x405385
mov byte [rbx], 0
inc rbx
cmp byte [rsi], 0
je 0x405629
mov rcx, rsi
call fcn.00404f40
mov rbp, rax
cmp byte [rax], 0x2d
jne 0x405638
lea rdi, str._classpath
mov rcx, rax
sub rdi, rax
nop
movzx eax, byte [rcx]
movzx edx, byte [rcx + rdi]
sub eax, edx
jne 0x4053c2
inc rcx
test edx, edx
jne 0x4053b0
test eax, eax
je 0x4054c4
lea rdi, [0x0040dcac]
mov rax, rbp
sub rdi, rbp
nop
nop
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x4053f2
inc rax
test ecx, ecx
jne 0x4053e0
test edx, edx
je 0x4054c4
lea rdx, str._version:
mov r8d, 9
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
je 0x405620
lea rdi, str._jre_restrict_search
mov rax, rbp
sub rdi, rbp
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x405437
inc rax
test ecx, ecx
jne 0x405425
test edx, edx
je 0x405620
lea rdi, str._no_jre_restrict_search
mov rax, rbp
sub rdi, rbp
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x405462
inc rax
test ecx, ecx
jne 0x405450
test edx, edx
je 0x405620
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [r15 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405480
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
dec rdi
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rsi + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 1], al
jne 0x4054b0
jmp 0x405620
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
lea r15, [0x0040dcb0]
nop
nop
movzx eax, byte [r15 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4054e0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
lea r15, [0x0040dcf8]
dec rdi
xor ecx, ecx
nop
nop
movzx eax, byte [rsi + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 1], al
jne 0x405510
movzx eax, byte [rbx]
mov r8d, r14d
mov r9d, r14d
test al, al
je 0x405542
nop
cmp al, 0x20
je 0x405538
cmp al, 9
jne 0x405542
mov al, byte [rbx + 1]
inc rbx
test al, al
jne 0x405530
cmp byte [rbx], 0
mov r10, rbx
je 0x4055b5
nop
nop
test r9d, r9d
jne 0x405560
movzx eax, byte [rbx]
cmp al, 0x20
je 0x4055aa
cmp al, 9
je 0x4055aa
movzx edi, byte [rbx]
cmp dil, 0x5c
jne 0x405581
cmp byte [rbx + 1], 0x22
jne 0x405581
mov eax, r8d
cdq
and eax, 1
xor eax, edx
sub eax, edx
jne 0x405581
inc rbx
jmp 0x405593
cmp dil, 0x22
jne 0x405593
test r9d, r9d
mov eax, r14d
sete al
mov r9d, eax
movzx eax, byte [rbx]
inc rbx
cmp al, 0x5c
jne 0x4055a2
inc r8d
jmp 0x4055a5
mov r8d, r14d
cmp byte [rbx], 0
jne 0x405550
cmp byte [rbx], 0
je 0x4055b5
mov byte [rbx], 0
inc rbx
cmp byte [r10], 0
je 0x405620
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
lea r14, [0x0040dcb4]
nop
nop
nop
nop
movzx eax, byte [r14 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4055e0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
dec rdi
xor r14d, r14d
nop
nop
nop
movzx eax, byte [r10 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 1], al
jne 0x405610
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov al, byte [rbx]
test al, al
jne 0x4052f4
jmp 0x4056d8
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x0040dcfc]
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405650
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rsi + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405670
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor edx, edx
lea r8, [0x0040dd00]
nop
nop
nop
movzx eax, byte [r8 + rdx]
inc rdx
test al, al
mov byte [rdi + rdx - 2], al
jne 0x4056a0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rbx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4056c0
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov rbp, qword [rsp + 0x268]
mov rsi, qword [rsp + 0x240]
mov r15, qword [rsp + 0x218]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_free]
cmp byte [0x0040f352], 0
mov r13, qword [rsp + 0x228]
je 0x405758
mov rcx, r12
call qword [sym.imp.msvcrt.dll__strdup]
lea rcx, [rsp + 0x58]
mov rdi, rax
mov qword [rsp + 0x58], rax
call fcn.00404e70
lea rdx, [rsp + 0xf0]
lea rcx, str.ReExec_Command:__s___s__n
mov r8, rax
call qword [sym.imp.msvcrt.dll_printf]
mov rdx, qword [rsp + 0x58]
lea rcx, str.ReExec_Args:__s_n
call qword [sym.imp.msvcrt.dll_printf]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x30
call qword [sym.imp.msvcrt.dll_fflush]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fflush]
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov rdx, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x80], 0x68
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov r14, qword [rsp + 0x220]
mov r12, qword [rsp + 0x230]
test eax, eax
jne 0x405846
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea r8, [rsp + 0xf0]
lea rdx, str.CreateProcess__s__...__failed
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, [0x0040dbd0]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x405879
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4058a0
mov dword [rsp + 0x50], 1
jmp 0x4058a0
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea r8, str.WaitForSingleObject___failed.
lea rdx, [0x0040dbcc]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov dword [rsp + 0x50], 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea r8, str.java
lea rdx, str.Unable_to_resolve_path_to_current__s_executable.
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, [0x0040dbd0]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rdi, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x200]
call fcn.00409d10
add rsp, 0x248
ret