joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050f50
Capabilities:
Print debug messages

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
lea eax, [rdx - 1]
mov edi, edx
xor edx, edx
mov ebp, r8d
mov r12d, r9d
div dword [rcx + 0x28]
mov esi, eax
cmp dword [rcx], edi
jae 0x140050f9d
mov r9d, edi
mov r8d, 0x80d44900
lea rdx, str.ext2fs_inode_alloc_stats2
lea rcx, str._s:___08X___Illegal_inode_number:__lu_
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140036717
mov rcx, qword [rbx + 0x48]
mov edx, edi
test r8d, r8d
jle 0x140050faf
call fcn.140058c80
jmp 0x140050fb4
call fcn.140058d0a
mov edx, esi
mov rcx, rbx
call fcn.1400526a2
mov edx, esi
mov rcx, rbx
sub eax, ebp
mov r8d, eax
call fcn.1400526db
test r12d, r12d
je 0x140050feb
mov edx, esi
mov rcx, rbx
call fcn.14005270f
mov edx, esi
mov rcx, rbx
lea r8d, [rbp + rax]
call fcn.140052748
mov r8d, 1
mov edx, esi
mov rcx, rbx
call fcn.14005285c
mov rax, qword [rbx + 0x20]
test dword [rax + 0x64], 0x410
je 0x14005104b
mov edx, esi
mov rcx, rbx
mov r12d, dword [rax + 0x28]
call fcn.14005277c
mov ecx, eax
mov rax, qword [rbx + 0x20]
mov r8d, dword [rax + 0x28]
mov edx, r8d
imul edx, esi
lea eax, [r12 + rdx + 1]
sub eax, ecx
cmp edi, eax
jb 0x140051041
add r8d, edx
mov rcx, rbx
mov edx, esi
sub r8d, edi
call fcn.1400527b5
mov edx, esi
mov rcx, rbx
call fcn.140054cb9
mov rax, qword [rbx + 0x20]
sub dword [rax + 0x10], ebp
or dword [rbx + 0x10], 0x16
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140051069
Capabilities:
Print debug messages

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
call fcn.140052190
mov rcx, qword [rbx + 0x20]
mov ebp, eax
call fcn.14005223a
cmp rsi, rax
jb 0x1400510b3
mov r9d, esi
mov r8d, 0x80d44900
lea rdx, str.ext2fs_block_alloc_stats
lea rcx, str._s:___08X___Illegal_block_number:__lu_
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140036717
mov rcx, qword [rbx + 0x50]
mov rdx, rsi
test edi, edi
jle 0x1400510c5
call fcn.140058c80
jmp 0x1400510ca
call fcn.140058d0a
mov edx, ebp
mov rcx, rbx
call fcn.140052635
mov edx, ebp
mov rcx, rbx
sub eax, edi
mov r8d, eax
call fcn.14005266e
mov r8d, 2
mov edx, ebp
mov rcx, rbx
call fcn.14005285c
mov edx, ebp
mov rcx, rbx
call fcn.140054cb9
mov edx, edi
mov ecx, dword [rbx + 0xb8]
neg edx
movsxd rdx, edx
shl rdx, cl
mov rcx, qword [rbx + 0x20]
call fcn.14005235b
mov rax, qword [rbx + 0x100]
or dword [rbx + 0x10], 0x26
test rax, rax
je 0x14005113a
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140057d00
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0x20]
add edx, dword [rcx + 0x30]
test rax, rax
mov r9d, r8d
lea r8d, [rdx - 0x7f2bb700]
lea rdx, [0x1400a5dc0]
je 0x140057d38
mov qword [rsp + 0x20], rax
lea rcx, [0x1400a5dc7]
call fcn.140036717
nop
add rsp, 0x38
ret
lea rcx, [0x1400a5de0]
add rsp, 0x38
jmp fcn.140036717

Function at 0x14005871c
Capabilities:
Print debug messages

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
mov edi, r8d
cmp edx, dword [rcx + 0x10]
jb 0x140058743
mov edx, dword [rcx + 0x14]
cmp edx, esi
jb 0x140058743
lea eax, [rsi + r8 - 1]
xor ebp, ebp
cmp edx, eax
jae 0x14005875b
mov r8, qword [rbx + 0x20]
mov edx, esi
mov ecx, 0x7f2bb72d
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140062c70
cmp ebp, edi
jge 0x140058773
mov rdx, qword [rbx + 0x28]
mov ecx, esi
sub ecx, dword [rbx + 0x10]
add ecx, ebp
inc ebp
call fcn.14005a5f0
jmp 0x14005875b
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14005877c
Capabilities:
Print debug messages

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
mov edi, r8d
cmp edx, dword [rcx + 0x10]
jb 0x1400587a3
mov edx, dword [rcx + 0x14]
cmp edx, esi
jb 0x1400587a3
lea eax, [rsi + r8 - 1]
xor ebp, ebp
cmp edx, eax
jae 0x1400587bb
mov r8, qword [rbx + 0x20]
mov edx, esi
mov ecx, 0x7f2bb72e
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140062c70
cmp ebp, edi
jge 0x1400587d3
mov rdx, qword [rbx + 0x28]
mov ecx, esi
sub ecx, dword [rbx + 0x10]
add ecx, ebp
inc ebp
call fcn.14005a607
jmp 0x1400587bb
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400587e0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0x40]
add edx, dword [rcx + 0x50]
test rax, rax
mov r9, r8
lea r8d, [rdx - 0x7f2bb700]
lea rdx, str.ext2fs
je 0x140058818
mov qword [rsp + 0x20], rax
lea rcx, str._s:___08X____llu_for__s_
call fcn.140036717
nop
add rsp, 0x38
ret
lea rcx, str._s:___08X____llu_
add rsp, 0x38
jmp fcn.140036717
Function at 0x1400590d3
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edi, r8d
mov rbx, rcx
mov rsi, rdx
add rdi, rdx
test rcx, rcx
je 0x1400591a1
mov eax, dword [rcx]
sub eax, 0x7f2bb708
cmp eax, 2
ja 0x14005912d
mov eax, 0xffffffff
cmp rax, rdx
jb 0x14005910e
lea rdx, [rdi - 1]
cmp rax, rdx
jae 0x140059126
or r8d, 0xffffffff
mov edx, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140057d00
mov edx, esi
call fcn.14005871c
mov eax, dword [rbx]
sub eax, 0x7f2bb76d
cmp eax, 2
ja 0x1400591a1
mov ecx, dword [rbx + 0x38]
shr rsi, cl
mov rdx, rsi
mov r10d, esi
cmp rsi, qword [rbx + 0x20]
jb 0x140059174
mov r9, qword [rbx + 0x28]
cmp r9, rsi
jb 0x140059174
mov eax, 1
shl rax, cl
lea r8, [rdi + rax - 1]
shr r8, cl
sub r8d, esi
mov eax, r8d
lea rax, [rsi + rax - 1]
cmp r9, rax
jae 0x14005918c
mov r8, qword [rbx + 0x40]
mov edx, r10d
mov ecx, 0x7f2bb72d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140062c70
mov rax, qword [rbx + 0x10]
mov rcx, rbx
mov rax, qword [rax + 0x40]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400591a9
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edi, r8d
mov rbx, rcx
mov rsi, rdx
add rdi, rdx
test rcx, rcx
je 0x140059277
mov eax, dword [rcx]
sub eax, 0x7f2bb708
cmp eax, 2
ja 0x140059203
mov eax, 0xffffffff
cmp rax, rdx
jb 0x1400591e4
lea rdx, [rdi - 1]
cmp rax, rdx
jae 0x1400591fc
or r8d, 0xffffffff
mov edx, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140057d00
mov edx, esi
call fcn.14005877c
mov eax, dword [rbx]
sub eax, 0x7f2bb76d
cmp eax, 2
ja 0x140059277
mov ecx, dword [rbx + 0x38]
shr rsi, cl
mov rdx, rsi
mov r10d, esi
cmp rsi, qword [rbx + 0x20]
jb 0x14005924a
mov r9, qword [rbx + 0x28]
cmp r9, rsi
jb 0x14005924a
mov eax, 1
shl rax, cl
lea r8, [rdi + rax - 1]
shr r8, cl
sub r8d, esi
mov eax, r8d
lea rax, [rsi + rax - 1]
cmp r9, rax
jae 0x140059262
mov r8, qword [rbx + 0x40]
mov edx, r10d
mov ecx, 0x7f2bb72e
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140062c70
mov rax, qword [rbx + 0x10]
mov rcx, rbx
mov rax, qword [rax + 0x48]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x14005927f
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
test rcx, rcx
mov r9, rdx
lea rdx, str.ext2fs
je 0x1400592b8
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x1400592b8
mov qword [rsp + 0x20], rax
mov r8d, 0xa
lea rcx, str._s:___08X___called__s_with_64_bit_bitmap_for__s_
call fcn.140036717
nop
add rsp, 0x38
ret
mov r8d, 0xa
lea rcx, str._s:___08X___called__s_with_64_bit_bitmap_
add rsp, 0x38
jmp fcn.140036717
Function at 0x14005fb9f
Capabilities:
Get file size

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
xor eax, eax
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x5c]
mov ebx, edx
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5b]
mov rsi, r8
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rdx
mov edx, 1
call fcn.14005f5cd
test al, al
jne 0x14005fbff
mov eax, dword [rsp + 0x5c]
jmp 0x14005fd57
cmp qword [rsp + 0x68], 0
jne 0x14005fd3b
cmp qword [0x1401133d0], 0
mov rbp, qword [rsp + 0x70]
jne 0x14005fc3d
lea rcx, str.NtDll
call fcn.14005ed10
lea rdx, str.NtDeviceIoControlFile
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1401133d0], rax
mov r10, qword [0x1401133d0]
test r10, r10
je 0x14005fd3b
xor r12d, r12d
mov ecx, 0x24
lea r13, [rsp + 0x78]
xor r9d, r9d
lea rdx, [rsp + 0xb0]
mov eax, r12d
xor r8d, r8d
mov rdi, rdx
rep stosd dword [rdi], eax
mov qword [rsp + 0x40], rdx
mov rcx, rbp
mov qword [rsp + 0x30], rdx
xor edx, edx
mov dword [rsp + 0x48], 0x90
mov dword [rsp + 0x38], 0x90
mov dword [rsp + 0x28], 0x70048
mov qword [rsp + 0x20], r13
call r10
test eax, eax
js 0x14005fcb0
mov rax, qword [rsp + 0xc0]
jmp 0x14005fd36
cmp eax, 0xc0000010
jne 0x14005fd12
mov ecx, 0xa
mov eax, r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x88]
mov rdi, rdx
rep stosd dword [rdi], eax
mov qword [rsp + 0x40], rdx
mov rcx, rbp
mov qword [rsp + 0x30], rdx
xor edx, edx
mov dword [rsp + 0x48], 0x28
mov dword [rsp + 0x38], 0x28
mov dword [rsp + 0x28], 0x700a0
mov qword [rsp + 0x20], r13
call qword [0x1401133d0]
test eax, eax
js 0x14005fd3b
mov rax, qword [rsp + 0xa0]
jmp 0x14005fd36
cmp eax, 0xc000000d
jne 0x14005fd3b
lea rdx, [rsp + 0x88]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x14005fd3b
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x70]
call fcn.14005f70e
mov rax, qword [rsp + 0x68]
movsxd rcx, ebx
xor edx, edx
div rcx
mov qword [rsi], rax
xor eax, eax
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14006205d
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov r14d, pe_nt_image_headers64
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x28], rax
mov rsi, rcx
mov rbx, r8
xor ecx, ecx
xor r8d, r8d
mov dword [rsp + 0x68], ecx
mov ebp, edx
lea r12, [rsp + 0x20]
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 0x20], r8
lea r13, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x38], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x40], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x48], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x50], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x58], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x60], rax
mov edi, dword [rsp + 0x68]
mov rcx, rdi
test ebp, ebp
je 0x14006218a
test ecx, ecx
jne 0x14006213f
cmp ebp, 0x7f
jbe 0x14006213f
mov rdx, rsi
mov rcx, r12
sub rsi, 0xffffffffffffff80
add ebp, 0xffffff80
call fcn.140061b60
add qword [rsp + 0x20], 0x400
jmp 0x14006210e
mov r15d, r14d
lea rax, [r13 + rdi]
sub r15d, ecx
mov rdi, rax
cmp r15d, ebp
cmova r15d, ebp
mov ecx, r15d
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x68]
add eax, r15d
mov dword [rsp + 0x68], eax
cmp eax, 0x80
jne 0x140062185
mov rdx, r13
mov rcx, r12
call fcn.140061b60
xor edx, edx
add qword [rsp + 0x20], 0x400
mov dword [rsp + 0x68], edx
sub ebp, r15d
jmp 0x14006210e
mov rax, qword [rsp + 0x20]
lea edx, [rdi + 1]
mov byte [rsp + rdi + 0x6c], pe_nt_image_headers64
mov dword [rsp + 0x68], edx
lea rsi, [rax + rdi*8]
mov qword [rsp + 0x20], rsi
cmp edx, 0x70
jbe 0x1400621f9
mov eax, edx
mov r8d, edx
xor r9d, r9d
add rax, r12
inc rax
cmp r8d, 0x7f
ja 0x1400621c9
mov byte [rax + 0x4b], 0
inc r8d
mov r9b, 1
jmp 0x1400621b4
test r9b, r9b
je 0x1400621e6
mov eax, 0x7f
sub eax, ecx
xor ecx, ecx
cmp edx, 0x80
cmova eax, ecx
add eax, edx
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0x6c]
mov rcx, r12
call fcn.140061b60
xor eax, eax
mov dword [rsp + 0x68], eax
mov edx, dword [rsp + 0x68]
xor r8d, r8d
mov rax, rdx
add rdx, r12
mov ecx, eax
inc rdx
cmp ecx, 0x77
ja 0x14006221b
mov byte [rdx + 0x4b], 0
inc ecx
mov r8b, 1
jmp 0x140062208
test r8b, r8b
je 0x140062235
mov edx, 0x78
xor ecx, ecx
sub edx, eax
cmp eax, 0x78
cmova edx, ecx
add eax, edx
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0x6c]
mov rcx, r12
bswap rsi
mov qword [rsp + 0xe4], rsi
call fcn.140061b60
xor eax, eax
lea r8, [rsp + 0x28]
mov rdx, qword [r8 + rax]
mov rcx, rdx
mov byte [rbx + rax + 6], dh
shr rcx, 0x38
mov byte [rbx + rax + 7], dl
mov byte [rbx + rax], cl
mov rcx, rdx
shr rcx, 0x30
mov byte [rbx + rax + 1], cl
mov rcx, rdx
shr rcx, 0x28
mov byte [rbx + rax + 2], cl
mov rcx, rdx
shr rcx, 0x20
mov byte [rbx + rax + 3], cl
mov rcx, rdx
shr rcx, 0x18
mov byte [rbx + rax + 4], cl
mov rcx, rdx
shr rcx, 0x10
mov byte [rbx + rax + 5], cl
add rax, 8
cmp rax, 0x40
jne 0x140062254
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140062c70
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov rax, r8
mov r9d, edx
lea r8d, [rcx - 0x7f2bb700]
test rax, rax
lea rdx, [0x1400a6880]
je 0x140062ca4
mov qword [rsp + 0x20], rax
lea rcx, str._s:___08X____lu_for__s_
call fcn.140036717
nop
add rsp, 0x38
ret
lea rcx, str._s:___08X____lu_
add rsp, 0x38
jmp fcn.140036717

Function at 0x140064a45
Capabilities:
Encode data using xor

Disassembly:
lea r9, [0x1400a6ac0]
jmp fcn.140064970

Function at 0x14006aa06
Capabilities:
Read file on windows

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, 0xffffffff
mov r12, r9
mov rbx, rdx
mov rsi, r8
mov rdi, r9
imul r12, rdx
cmp rax, r12
jae 0x14006aa37
lea rcx, str.read_sectors:_nSectors_x_SectorSize_is_too_big_n
call fcn.140036717
jmp 0x14006aa76
mov eax, r9d
mov qword [rsp + 0x70], rcx
xor r9d, r9d
imul eax, edx
imul rdx, r8
xor r8d, r8d
mov dword [rsp + 0x3c], eax
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
mov rcx, qword [rsp + 0x70]
test eax, eax
jne 0x14006aa7c
call fcn.140036bd7
mov rdx, rsi
lea rcx, str.read_sectors:_Could_not_access_sector_0x_08I64x____s_n
mov r8, rax
call fcn.140036717
or rax, 0xffffffffffffffff
jmp 0x14006aaf9
xor eax, eax
mov r8d, dword [rsp + 0x3c]
lea r9, [rsp + 0x3c]
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x14006aaa8
mov eax, dword [rsp + 0x3c]
cmp r12, rax
je 0x14006aaf5
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, [0x1400ae2e2]
test eax, eax
je 0x14006aac1
call fcn.140036bd7
mov rdx, rax
lea rcx, str.read_sectors:_Read_error__s_n
call fcn.140036717
mov edx, dword [rsp + 0x3c]
mov r8, r12
lea rcx, str.__Read:__d__Expected:__I64u_n
call fcn.140036717
mov r9, rbx
mov r8, rdi
mov rdx, rsi
lea rcx, str.__StartSector:_0x_08I64x__nSectors:_0x_I64x__SectorSize:_0x_I64x_n
call fcn.140036717
mov eax, dword [rsp + 0x3c]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x14006c378
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
xor eax, eax
mov r9, rcx
mov r12d, edx
mov rbx, r8
test rcx, rcx
je 0x14006c477
cmp byte [rcx], 0
lea rbp, [rsp + 0x20]
lea rsi, [rsp + 0x2c]
jne 0x14006c3cf
cmp byte [rcx + 1], 0
jne 0x14006c3cf
cmp byte [rcx + 2], 0
jne 0x14006c3cf
cmp byte [rcx + 3], 0
jne 0x14006c3cf
cmp byte [rcx + 4], 0
jne 0x14006c3cf
cmp byte [rcx + 5], 0
jne 0x14006c3cf
xor edx, edx
mov qword [rsp + 0x20], rdx
jmp 0x14006c452
xor eax, eax
mov ecx, 9
mov rdi, rbx
rep stosd dword [rdi], eax
lea rcx, [0x1400ae868]
movzx eax, byte [r9]
mov dword [rbx + 0x14], eax
movzx eax, byte [r9 + 1]
dec eax
mov dword [rbx + 0x10], eax
movzx eax, byte [r9 + 2]
mov dword [rbx + 0xc], eax
movzx eax, byte [r9 + 3]
mov dword [rbx + 8], eax
movzx eax, byte [r9 + 4]
mov dword [rbx + 4], eax
movsx eax, byte [r9 + 6]
movzx edx, byte [r9 + 5]
mov dword [rbx + 0x20], 0xffffffff
imul eax, eax, 0xfffffc7c
add eax, edx
mov dword [rbx], eax
xor eax, eax
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll_getenv
call sub.msvcrt.dll__tzset
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__mktime64]
mov rdi, rax
call sub.msvcrt.dll__tzset
mov qword [rsp + 0x20], rdi
test r12b, r12b
je 0x14006c460
mov rdx, rbp
mov rcx, rsi
call qword [0x14007eaf0]
jmp 0x14006c46b
mov rdx, rsi
mov rcx, rbp
call fcn.14006c36e
mov ecx, 9
mov rdi, rbx
mov al, 1
rep movsd dword [rdi], dword [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400739e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400761c0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400761c0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140073a50
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140114324]
mov rbx, rcx
test esi, esi
jle 0x140073b80
mov rax, qword [0x140114328]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140073a9b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140073b25
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140073a80
mov rcx, rbx
call fcn.1400744c0
mov rdi, rax
test rax, rax
je 0x140073ba2
mov rax, qword [0x140114328]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140074600
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140114328]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.DLL_VirtualQuery]
test rax, rax
je 0x140073b87
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140073b1e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140073b30
add dword [0x140114324], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140114328]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x140073b1e
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400739e0
nop dword [rax]
xor esi, esi
jmp 0x140073aa8
mov rax, qword [0x140114328]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400739e0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400739e0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140074130
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140114380]
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rbx, qword [0x140114360]
test rbx, rbx
je 0x14007418c
mov rbp, qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.DLL_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140074183
test eax, eax
jne 0x140074183
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140074168
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
Function at 0x1400744c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400b1300]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400744e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400744e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400744e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14007453d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140074534
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400744e0
add rax, 0x28
cmp rax, r9
jne 0x140074520
xor eax, eax
ret

Function at 0x140074540
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400b1300]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14007455f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140074568
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14007455f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140074600
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400b1300]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14007461f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140074628
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1801e9f40
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test r8, r8
jne 0x1801e9f56
mov al, 1
add rsp, 0x30
pop rdi
ret
test rcx, rcx
jne 0x1801e9f63
xor al, al
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1801e9f5b
test rdx, rdx
je 0x1801e9f5b
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x50]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1801e9f9a
cmp dword [rsp + 0x50], edi
jne 0x1801e9f9a
mov ebx, eax
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret