joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400018e0
Capabilities:
Log keystrokes via application hook

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r9d, r9d
lea rdx, [0x140001290]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov qword [0x1400078d8], rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x14000195d
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140001930
mov rcx, qword [0x1400078d8]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140002f70
add rsp, 0x68
ret

Function at 0x140001d10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140001d40
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140001d68
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001d6a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001dc3
test ecx, ecx
jle 0x140001da3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001dc3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001dc3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140001df0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001e12
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140001e21
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001e44
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001e46
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140001e80
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140001f27
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x140001ebb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140001f01
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140001f40
cmp rbx, rax
ja 0x140001ed0
mov r8, rdi
test rdi, rdi
je 0x140001f27
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x140001f2a
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140002340
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000236d
xor eax, eax
jmp 0x1400024c2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140002398
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140002398
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400024c2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400024b5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400023db
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002406
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024ba
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002475
sub eax, 1
je 0x140002475
cmp eax, 2
jne 0x1400024b5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024ba
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400024a3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400024b5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400024ba
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002f70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400028b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002983
cmp byte [rcx + 0x71], 0
je 0x140002983
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000297f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002944
sub eax, 1
je 0x140002948
cmp eax, 2
jne 0x14000297f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002f70
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002976
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000297f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000292c
xor al, al
jmp 0x14000292c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002f70
add rsp, 0x60
pop rbx
ret
Function at 0x140001d88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001dd2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001dd2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001dd2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001dd2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001dd2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001dd4
xor al, al
add rsp, 0x28
ret

Function at 0x14000650c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140006308
Function at 0x1400095cc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400095fc
xor eax, eax
jmp 0x1400096bf
mov rbp, rbx
cmp word [rax], si
je 0x140009621
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140009608
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140009604
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400094ec
movsxd r14, eax
test eax, eax
jne 0x14000965f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400095f5
mov rcx, r14
call fcn.14000a4a8
mov rdi, rax
test rax, rax
jne 0x140009678
xor ecx, ecx
call fcn.140007b4c
jmp 0x140009654
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400094ec
test eax, eax
jne 0x1400096a9
mov rcx, rdi
call fcn.140007b4c
jmp 0x1400096b3
xor ecx, ecx
call fcn.140007b4c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000cbb0
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400085bc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000cc3a
cmp byte [rbp - 0x21], r15b
je 0x14000cc35
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000cc70
call fcn.14000acb8
test eax, eax
jne 0x14000cc5c
cmp byte [rbp - 0x21], r15b
je 0x14000cc54
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000cc70
cmp byte [rbp - 0x21], r15b
je 0x14000cc6d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140007b9c
test eax, eax
jne 0x14000cd10
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400085bc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000ccaf
cmp byte [rbp - 0x21], r15b
je 0x14000cce4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000cce4
call fcn.14000acb8
test eax, eax
jne 0x14000ccd0
cmp byte [rbp - 0x21], r15b
je 0x14000ccc9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000cce4
cmp byte [rbp - 0x21], r15b
je 0x14000cce1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140007b9c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000cd10
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000cd13
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000cd21
mov rcx, rdi
call fcn.140007b4c
cmp byte [rbp + 0x3f], r15b
je 0x14000cd30
mov rcx, qword [rbp + 0x27]
call fcn.140007b4c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000fb60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000fb88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000fb88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001008
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001069
lea rcx, str.Windows_original_main_args:_n
call fcn.140001148
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001069
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.140001148
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000103e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010b5
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a2
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010cc
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010db
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 0
mov r8d, 2
mov byte [rsp + 0x58], 0
mov rdx, rbx
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x1400022cc]
mov qword [rsp + 0x38], rax
lea rax, [0x1400022d0]
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140005b70
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub rsp, 0x68
lea rdx, [rsp + 0x30]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140005cc3
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140005cb8
lea rax, str.discord.exe
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
lea r8, [0x1400260a0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov dword [rsp + 0x50], eax
cmp dword [0x14003c040], 1
jne 0x140005c48
lea r8, [rsp + 0x48]
lea rdx, [0x1400260b0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005c48
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140005cad
lea r8, [rsp + 0x48]
lea rdx, [0x140026110]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005cad
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14003c162]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
add rsp, 0x68
ret

Function at 0x140005ce0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub rsp, 0x38
cmp dword [0x14003c040], 1
jne 0x140005d27
lea r8, [rsp + 0x20]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005d27
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140005d6a
lea r8, [rsp + 0x20]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005d6a
lea rdx, [0x14003c162]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140008740
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub rsp, 0x118
lea rdx, [rsp + 0x50]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x140008932
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x140008927
mov rdx, qword [rsp + 0x60]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140008927
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x140008927
mov r8d, 0x7fff
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000891c
mov dx, 0x5c
mov rcx, qword [rsp + 0x68]
call fcn.140002100
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x14000891c
xor eax, eax
mov rcx, qword [rsp + 0x70]
mov word [rcx + 2], ax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000891c
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x14000891c
lea rax, str.445E617B_0185_47D9_971F_D367CFB6F2B9
mov qword [rsp + 0x28], rax
lea rax, str.discord.exe
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x58]
lea r8, str.__s_s___s
mov edx, 0x7fff
mov rcx, qword [rsp + 0x78]
call fcn.140019c8c
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140019ba0
mov dword [rsp + 0xa0], WSAGetLastError
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x140008911
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x140008934
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x118
ret

Function at 0x140008940
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea rax, [0x14003f3e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140008a00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14003f3d0], rax
cmp qword [0x14003f3d0], 0
je 0x140008984
mov eax, 1
jmp 0x140008986
xor eax, eax
add rsp, 0x38
ret