Function at 0x405040
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
sub rsp, 0x248
mov rax, qword [0x0040f300]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x260], rbx
mov rbx, rcx
lea rdx, [rsp + 0xf0]
xor ecx, ecx
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4058d1
cmp eax, 0x104
jg 0x4058d1
cmp byte [0x0040f342], 0
je 0x4050b8
lea rdx, [rsp + 0xf0]
lea rcx, str.ExecJRE:_old:__s_n
call qword [sym.imp.msvcrt.dll_printf]
lea rcx, str.ExecJRE:_new:__s_n
mov rdx, rbx
call qword [sym.imp.msvcrt.dll_printf]
mov qword [rsp + 0x238], rdi
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
lea rdx, [rsp + 0xf0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
je 0x405914
lea rcx, [rsp + 0xf0]
sub rcx, rbx
nop
nop
movzx eax, byte [rbx]
inc rbx
test al, al
mov byte [rcx + rbx - 1], al
jne 0x405100
xor eax, eax
lea r8, [rsp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdi, r8
lea rdx, str._bin_
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405130
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea r8, str.java
nop
nop
nop
movzx eax, byte [r8 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405160
xor eax, eax
lea rdi, [rsp + 0xf0]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, str..exe
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405190
mov qword [rsp + 0x230], r12
mov qword [rsp + 0x228], r13
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call qword [sym.imp.msvcrt.dll__strdup]
lea rcx, [rsp + 0x58]
mov r13, rax
mov qword [rsp + 0x58], rax
call fcn.00404e80
mov rbx, qword [rsp + 0x58]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
lea rdi, [rsp + 0xf0]
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea rcx, [rdx + rcx + 3]
call fcn.00401000
lea rcx, [rsp + 0xf0]
mov edx, 0x20
mov r12, rax
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
jne 0x405260
lea edx, [rax + 9]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
jne 0x405260
lea rax, [rsp + 0xf0]
mov rdx, r12
lea rcx, [rsp + 0xf0]
sub rdx, rax
nop
movzx eax, byte [rcx]
inc rcx
test al, al
mov byte [rdx + rcx - 1], al
jne 0x405250
jmp 0x4052cf
movzx eax, word [0x0040dc88]
mov rcx, 0xffffffffffffffff
mov rdi, r12
mov word [r12], ax
xor eax, eax
lea rdx, [rsp + 0xf0]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405290
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
lea rdx, [0x0040dc84]
dec rdi
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 1], al
jne 0x4052c0
movzx eax, byte [rbx]
mov qword [rsp + 0x220], r14
xor r14d, r14d
test al, al
je 0x405700
mov qword [rsp + 0x218], r15
mov qword [rsp + 0x268], rbp
mov qword [rsp + 0x240], rsi
lea r15, [0x0040dce8]
test al, al
mov r8d, r14d
mov r9d, r14d
je 0x405322
nop
cmp al, 0x20
je 0x405318
cmp al, 9
jne 0x405322
mov al, byte [rbx + 1]
inc rbx
test al, al
jne 0x405310
cmp byte [rbx], 0
mov rsi, rbx
je 0x405395
nop
nop
test r9d, r9d
jne 0x405340
movzx eax, byte [rbx]
cmp al, 0x20
je 0x40538a
cmp al, 9
je 0x40538a
movzx edi, byte [rbx]
cmp dil, 0x5c
jne 0x405361
cmp byte [rbx + 1], 0x22
jne 0x405361
mov eax, r8d
cdq
and eax, 1
xor eax, edx
sub eax, edx
jne 0x405361
inc rbx
jmp 0x405373
cmp dil, 0x22
jne 0x405373
test r9d, r9d
mov eax, r14d
sete al
mov r9d, eax
movzx eax, byte [rbx]
inc rbx
cmp al, 0x5c
jne 0x405382
inc r8d
jmp 0x405385
mov r8d, r14d
cmp byte [rbx], 0
jne 0x405330
cmp byte [rbx], 0
je 0x405395
mov byte [rbx], 0
inc rbx
cmp byte [rsi], 0
je 0x405639
mov rcx, rsi
call fcn.00404f50
mov rbp, rax
cmp byte [rax], 0x2d
jne 0x405648
lea rdi, str._classpath
mov rcx, rax
sub rdi, rax
nop
movzx eax, byte [rcx]
movzx edx, byte [rcx + rdi]
sub eax, edx
jne 0x4053d2
inc rcx
test edx, edx
jne 0x4053c0
test eax, eax
je 0x4054d4
lea rdi, [0x0040dc9c]
mov rax, rbp
sub rdi, rbp
nop
nop
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x405402
inc rax
test ecx, ecx
jne 0x4053f0
test edx, edx
je 0x4054d4
lea rdx, str._version:
mov r8d, 9
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
je 0x405630
lea rdi, str._jre_restrict_search
mov rax, rbp
sub rdi, rbp
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x405447
inc rax
test ecx, ecx
jne 0x405435
test edx, edx
je 0x405630
lea rdi, str._no_jre_restrict_search
mov rax, rbp
sub rdi, rbp
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x405472
inc rax
test ecx, ecx
jne 0x405460
test edx, edx
je 0x405630
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [r15 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405490
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
dec rdi
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rsi + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 1], al
jne 0x4054c0
jmp 0x405630
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
lea r15, [0x0040dca0]
nop
nop
movzx eax, byte [r15 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4054f0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
lea r15, [0x0040dce8]
dec rdi
xor ecx, ecx
nop
nop
movzx eax, byte [rsi + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 1], al
jne 0x405520
movzx eax, byte [rbx]
mov r8d, r14d
mov r9d, r14d
test al, al
je 0x405552
nop
cmp al, 0x20
je 0x405548
cmp al, 9
jne 0x405552
mov al, byte [rbx + 1]
inc rbx
test al, al
jne 0x405540
cmp byte [rbx], 0
mov r10, rbx
je 0x4055c5
nop
nop
test r9d, r9d
jne 0x405570
movzx eax, byte [rbx]
cmp al, 0x20
je 0x4055ba
cmp al, 9
je 0x4055ba
movzx edi, byte [rbx]
cmp dil, 0x5c
jne 0x405591
cmp byte [rbx + 1], 0x22
jne 0x405591
mov eax, r8d
cdq
and eax, 1
xor eax, edx
sub eax, edx
jne 0x405591
inc rbx
jmp 0x4055a3
cmp dil, 0x22
jne 0x4055a3
test r9d, r9d
mov eax, r14d
sete al
mov r9d, eax
movzx eax, byte [rbx]
inc rbx
cmp al, 0x5c
jne 0x4055b2
inc r8d
jmp 0x4055b5
mov r8d, r14d
cmp byte [rbx], 0
jne 0x405560
cmp byte [rbx], 0
je 0x4055c5
mov byte [rbx], 0
inc rbx
cmp byte [r10], 0
je 0x405630
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
lea r14, [0x0040dca4]
nop
nop
nop
nop
movzx eax, byte [r14 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4055f0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
dec rdi
xor r14d, r14d
nop
nop
nop
movzx eax, byte [r10 + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 1], al
jne 0x405620
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov al, byte [rbx]
test al, al
jne 0x405304
jmp 0x4056e8
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x0040dcec]
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405660
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rsi + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405680
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor edx, edx
lea r8, [0x0040dcf0]
nop
nop
nop
movzx eax, byte [r8 + rdx]
inc rdx
test al, al
mov byte [rdi + rdx - 2], al
jne 0x4056b0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rbx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4056d0
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov rbp, qword [rsp + 0x268]
mov rsi, qword [rsp + 0x240]
mov r15, qword [rsp + 0x218]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_free]
cmp byte [0x0040f342], 0
mov r13, qword [rsp + 0x228]
je 0x405768
mov rcx, r12
call qword [sym.imp.msvcrt.dll__strdup]
lea rcx, [rsp + 0x58]
mov rdi, rax
mov qword [rsp + 0x58], rax
call fcn.00404e80
lea rdx, [rsp + 0xf0]
lea rcx, str.ReExec_Command:__s___s__n
mov r8, rax
call qword [sym.imp.msvcrt.dll_printf]
mov rdx, qword [rsp + 0x58]
lea rcx, str.ReExec_Args:__s_n
call qword [sym.imp.msvcrt.dll_printf]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x30
call qword [sym.imp.msvcrt.dll_fflush]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fflush]
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov rdx, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x80], 0x68
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov r14, qword [rsp + 0x220]
mov r12, qword [rsp + 0x230]
test eax, eax
jne 0x405856
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea r8, [rsp + 0xf0]
lea rdx, str.CreateProcess__s__...__failed
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, [0x0040dbc0]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x405889
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4058b0
mov dword [rsp + 0x50], 1
jmp 0x4058b0
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea r8, str.WaitForSingleObject___failed.
lea rdx, [0x0040dbbc]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov dword [rsp + 0x50], 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea r8, str.java
lea rdx, str.Unable_to_resolve_path_to_current__s_executable.
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, [0x0040dbc0]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rdi, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x200]
call fcn.00409d20
add rsp, 0x248
ret