joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801f7104
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov rdi, rdx
mov rbx, rcx
call qword [rax + 0x218]
test al, al
jne 0x1801f7150
mov eax, dword [rdi]
sub eax, 9
cmp eax, 0xc
ja 0x1801f7150
mov rcx, qword [rbx + 0x740]
mov rdx, rdi
test rcx, rcx
jne 0x1801f7306
mov rcx, rbx
call fcn.1801f0f04
jmp 0x1801f7316
cmp dword [rdi], 0x13
jne 0x1801f717f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x208]
test al, al
je 0x1801f7316
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, rbx
call fcn.1801f9494
jmp 0x1801f7316
cmp dword [rdi], 3
mov ebp, InitCommonControls
jne 0x1801f719f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x208]
test al, al
je 0x1801f719f
cmp word [rdi + 0x1c], bp
je 0x1801f7169
cmp dword [rdi], ebp
jne 0x1801f71f6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x208]
test al, al
je 0x1801f7316
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
lea rbx, [rbx + 0x728]
mov rdi, qword [rbx]
and ax, cx
mov rcx, rbx
je 0x1801f71ec
call qword [rdi + 0x20]
test al, al
mov rcx, rbx
sete dl
call qword [rdi + 0x30]
jmp 0x1801f7316
mov dl, 1
call qword [rdi + 0x28]
jmp 0x1801f7316
mov rcx, qword [rbx + 0x740]
test rcx, rcx
je 0x1801f7216
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rax + 0x470], 0
je 0x1801f7216
cmp dword [rdi], 0xf
je 0x1801f71a3
cmp dword [rdi], 0xe
jne 0x1801f7255
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x208]
test al, al
je 0x1801f7316
mov byte [rsp + 0x28], 0
lea r8, str.itemclick
and qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rbx + 0x58]
mov rdx, rbx
call fcn.1801e0d00
jmp 0x1801f7316
cmp dword [rdi], 9
je 0x1801f7316
cmp dword [rdi], 0xb
jne 0x1801f7283
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x208]
test al, al
je 0x1801f7316
or dword [rbx + 0x738], 8
jmp 0x1801f7172
cmp dword [rdi], 0xa
jne 0x1801f72a4
mov eax, dword [rbx + 0x738]
test al, 8
je 0x1801f7316
and eax, 0xfffffff7
mov dword [rbx + 0x738], eax
jmp 0x1801f7172
cmp dword [rdi], 0x1b
jne 0x1801f72c4
mov rax, qword [rdi + 0x28]
lea r8, str.timer
mov r9, qword [rdi + 0x20]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
jmp 0x1801f7244
cmp dword [rdi], 0x14
jne 0x1801f72f7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x1c0]
test al, al
je 0x1801f72f7
mov rax, qword [rdi + 0x28]
lea r8, [0x180252d30]
mov r9, qword [rdi + 0x20]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
jmp 0x1801f7244
mov rcx, qword [rbx + 0x740]
mov rdx, rdi
test rcx, rcx
je 0x1801f730e
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x1801f7316
mov rcx, rbx
call fcn.1801e47f0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1801f7678
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov rdi, rdx
mov rbx, rcx
call qword [rax + 0x218]
test al, al
jne 0x1801f76bd
mov eax, dword [rdi]
sub eax, 9
cmp eax, 0xc
ja 0x1801f76bd
mov rcx, qword [rbx + 0x5b8]
mov rdx, rdi
test rcx, rcx
je 0x1801f77b5
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x1801f77bd
mov rcx, qword [rbx + 0x5b8]
test rcx, rcx
je 0x1801f7730
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rax + 0x470], 0
je 0x1801f7730
cmp dword [rdi], 0xf
jne 0x1801f7730
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x208]
test al, al
je 0x1801f77bd
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
lea rbx, [rbx + 0x5a0]
mov rdi, qword [rbx]
and ax, cx
mov rcx, rbx
je 0x1801f7726
call qword [rdi + 0x20]
test al, al
mov rcx, rbx
sete dl
call qword [rdi + 0x30]
jmp 0x1801f77bd
mov dl, 1
call qword [rdi + 0x28]
jmp 0x1801f77bd
cmp dword [rdi], 0xd
je 0x1801f76dd
cmp dword [rdi], 0xe
jne 0x1801f776d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x208]
test al, al
je 0x1801f77bd
mov rcx, qword [rbx + 0x58]
lea r8, str.itemclick
mov byte [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
mov rdx, rbx
call fcn.1801e0d00
jmp 0x1801f77bd
cmp dword [rdi], 9
je 0x1801f77bd
cmp dword [rdi], 0xb
jne 0x1801f7798
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x208]
test al, al
je 0x1801f77bd
or dword [rbx + 0x5b0], 8
mov rcx, rbx
call fcn.1801f9494
jmp 0x1801f77bd
cmp dword [rdi], 0xa
jne 0x1801f77b2
mov eax, dword [rbx + 0x5b0]
test al, 8
je 0x1801f77bd
and eax, 0xfffffff7
mov dword [rbx + 0x5b0], eax
jmp 0x1801f778e
mov rdx, rdi
mov rcx, rbx
call fcn.1801f7328
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1801f7cb8
Capabilities:
Log keystrokes via polling

Disassembly:
sub rcx, 0x728
jmp method.DuiLib::CListUI.1.virtual_632

Function at 0x180201410
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
cmp qword [rcx + 0x708], r14
je 0x1802014be
cmp edx, 0x100
jne 0x180201498
cmp di, 0xd
jne 0x180201498
cmp byte [rcx + 0x712], r14b
je 0x18020146f
lea ecx, [r14 + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x180201498
cmp byte [rbx + 0x713], r14b
jne 0x180201498
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x180201494
mov byte [rsp + 0x28], r14b
lea r8, str.return
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rdx, rbx
call fcn.1801e0d00
xor eax, eax
jmp 0x1802014c3
mov rax, qword [rbx + 0x708]
mov r9, rbp
mov r8, rdi
mov edx, esi
mov rcx, qword [rax + 0x18]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r10, qword [rcx]
call qword [r10 + 0x18]
jmp 0x1802014c3
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x180203e98
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor ebp, ebp
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180203edc
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180203edc
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [rdi]
test ax, ax
je 0x180203f8f
mov rcx, rdi
mov rdx, rdi
cmp ax, 0x2f
je 0x180203efa
cmp ax, 0x5c
jne 0x180203efd
mov rcx, rdx
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x180203eee
cmp rcx, rdi
je 0x180203f4c
sub rcx, rdi
mov rdx, rdi
sar rcx, 1
lea rsi, [rcx + rcx]
mov r8, rsi
lea rcx, [rsp + 0x230]
call sub.VCRUNTIME140.dll_memcpy
cmp rsi, 0x208
jae 0x180203fb2
lea rdx, [rsp + 0x230]
mov word [rsp + rsi + 0x230], bp
mov rcx, rbx
call fcn.180203e98
mov word [rsp + 0x20], bp
test rbx, rbx
je 0x180203f64
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180203f8f
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18022a7d0
mov rbx, qword [rsp + 0x480]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret
call fcn.18022ae28
int3
Function at 0x1802045d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx], 0
mov esi, r9d
mov r14d, r8d
mov rbp, rdx
mov rbx, rcx
jne 0x1802046a0
cmp dword [rcx + 8], 0xffffffff
jne 0x1802046a0
lea rdi, [rcx + 0x250]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
movzx ecx, word [rbx + rax*2 + 0x24e]
cmp cx, 0x5c
je 0x180204644
cmp cx, 0x2f
je 0x180204644
lea rdx, [0x18026cd74]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
mov r9d, 1
cmp esi, r9d
jne 0x180204669
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180204669
mov eax, 0x2000000
jmp 0x1802046a5
lea r9, [rsp + 0x40]
mov r8d, esi
mov edx, r14d
mov rcx, rbp
call fcn.180206f50
test rax, rax
jne 0x180204687
mov eax, dword [rsp + 0x40]
jmp 0x1802046a5
mov rcx, rax
call fcn.180207770
mov qword [rbx], rax
neg rax
sbb eax, eax
not eax
and eax, 0x200
jmp 0x1802046a5
mov eax, 0x1000000
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180204c04
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx]
mov r10, rcx
movsx rax, dl
mov r8d, r9d
xor r8, rax
shr r9d, 8
movzx eax, r8b
lea r8, [0x18025c360]
mov edx, dword [r8 + rax*4]
xor edx, r9d
mov dword [rcx], edx
movzx eax, dl
add eax, dword [rcx + 4]
mov edx, dword [r10 + 8]
imul ecx, eax, 0x8088405
inc ecx
mov dword [r10 + 4], ecx
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [r10 + 8], eax
ret

Function at 0x180207088
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
imul r8d, edx
mov rdi, r9
cmp byte [r9], 0
mov rsi, rdx
mov r10, rcx
je 0x1802070cf
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
mov rdx, rcx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1802070c9
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x1802070fb
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
sub ecx, edx
lea eax, [rdx + r8]
cmp eax, dword [r9 + 0x28]
cmovbe ecx, r8d
add rdx, qword [r9 + 0x20]
mov ebx, ecx
mov r8d, ecx
mov rcx, r10
call sub.VCRUNTIME140.dll_memcpy
add dword [rdi + 0x2c], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180207250
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x180207269
xor eax, eax
jmp 0x1802072da
lea rdi, [0x18025c360]
not r9d
cmp r8d, 8
jb 0x1802072af
mov r11d, r8d
shr r11, 3
mov ebx, 8
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub rbx, 1
jne 0x180207285
add r8d, 0xfffffff8
sub r11, 1
jne 0x180207280
test r8d, r8d
je 0x1802072d4
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r8d, 0xffffffff
jne 0x1802072b4
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x180215a3c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, rdx
mov r12, r9
shr rax, 0x10
mov r14, r8
mov rbx, rdx
mov rdi, rcx
test ax, ax
je 0x180215a8d
cmp word [rdx], 0x3c
je 0x180215a8d
call fcn.18005ff00
mov rcx, rax
mov rdx, rbx
call fcn.1801eb2b4
test rax, rax
cmovne rbx, rax
mov rax, rbx
shr rax, 0x10
test ax, ax
je 0x180215adb
cmp word [rbx], 0x3c
mov rdx, rbx
mov rcx, rdi
jne 0x180215aac
call fcn.1802139ac
jmp 0x180215ab4
xor r8d, r8d
call fcn.180213a1c
test al, al
jne 0x180215b6c
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rbp, qword [rdi + 0x158]
test rbp, rbp
jne 0x180215aef
call fcn.1801dc194
mov rbp, rax
mov r8, r14
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x180215abc
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
jne 0x180215b25
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x180215abc
mov rdx, rsi
mov qword [rdi + 0x148], r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.180213d68
test al, al
je 0x180215abc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rdi + 0x150], r14
mov r9, qword [rsp + 0x78]
mov rdx, r12
mov r8, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18021499c
jmp 0x180215abe
Function at 0x18021ea28
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub rsp, 0x2e8
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x18021eac9
xor edx, edx
lea rcx, [rsp + 0x1d0]
mov r8d, 0xff
call sub.VCRUNTIME140.dll_memset
mov edx, 0xff
lea rcx, [rsp + 0x1d0]
call sub.WS2_32.dll_gethostname
lea rcx, [rsp + 0x1d0]
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x18021eac9
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x20]
mov r8d, 4
mov rdx, qword [rdx]
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, byte [rsp + 0x21]
movzx eax, byte [rsp + 0x20]
shl eax, 8
add eax, ecx
movzx ecx, byte [rsp + 0x22]
shl eax, 8
add eax, ecx
movzx ecx, byte [rsp + 0x23]
shl eax, 8
add eax, ecx
jmp 0x18021eacb
xor eax, eax
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x2e8
ret

Function at 0x180225b50
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rdx]
mov rdi, rdx
sub eax, 0xd
mov rbx, rcx
test eax, 0xfffffff7
jne 0x180225b71
call fcn.180226ad0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp method.DuiLib::CListUI.1.virtual_632

Function at 0x180225b88
Capabilities:
Log keystrokes via polling

Disassembly:
sub rcx, 0x728
jmp method.DuiLib::CListExUI.virtual_632

Function at 0x180228b78
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ecx, ecx
mov qword [rsp + 0x20], rdx
mov edi, r8d
mov rsi, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov ecx, edi
mov r8, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov ebx, eax
cmp edi, 0x21
jb 0x180228bd4
cmp edi, 0x28
jbe 0x180228bd0
lea eax, [rdi - 0x2d]
cmp eax, 1
ja 0x180228bd4
bts ebx, 8
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
shl ebx, 0x10
lea rdx, [rsp + 0x30]
mov ecx, ebx
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
or r8d, 0xffffffff
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1801e2f08
mov rax, rsi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18022a7d0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18022d7d0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, r9
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
test rdx, rdx
jne 0x18022d80b
xor al, al
jmp 0x18022d950
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x48], xmm1
xor r14d, r14d
mov word [rsp + 0x38], r14w
lea r9, [rsp + 0x38]
call fcn.18022d570
test al, al
je 0x18022d854
cmp byte [rsp + 0xb0], r14b
je 0x18022d864
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1800f25a0
test al, al
jne 0x18022d8a9
cmp byte [rsi], 0
je 0x18022d8ad
mov byte [rsi + 1], 1
mov bl, 1
jmp 0x18022d8f4
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18022d871
mov rcx, qword [rbx]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rbx + 0x10]
jne 0x18022d854
test rdx, rdx
je 0x18022d8a9
sub r8, rcx
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x18022d854
add rcx, 2
sub rdx, 1
jne 0x18022d895
mov bl, 1
jmp 0x18022d8f4
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x18022d8bb
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x18022d8c5
mov rdi, qword [rdi]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18022d8f2
mov bl, 1
jmp 0x18022d8f4
xor bl, bl
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x18022d939
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18022d934
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18022d934
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18022acec
movdqa xmm0, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], r14w
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x1800014f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test edx, edx
je 0x18000152f
cmp edx, 1
jne 0x18000153a
xor eax, eax
lea r8, [0x180001070]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140ad5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140ad51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ad5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ad506f
add dl, dl
jne 0x140ad5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ad50f6
xor eax, eax
add dl, dl
jne 0x140ad50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ad51ad
add dl, dl
jne 0x140ad50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ad50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ad50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ad50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ad50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ad507e
mov eax, 1
add dl, dl
jne 0x140ad5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ad5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ad50fb
sub eax, ebx
mov ebx, 1
jne 0x140ad514c
mov ecx, 1
add dl, dl
jne 0x140ad512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ad513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ad5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ad507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ad5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ad5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ad515d
cmp eax, 0x7d00
jae 0x140ad519b
cmp eax, 0x500
jb 0x140ad5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ad507e
cmp eax, 0x7f
ja 0x140ad519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ad507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ad51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ad507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20