joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f044
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400231e0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400231e0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002f194
cmp rax, 0xffffffffffffffff
je 0x14002f194
xor edi, edi
test rbp, rbp
jle 0x14002f13f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001d250
mov rbx, rax
test rax, rax
jne 0x14002f0cc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002f135
mov edx, 0x8000
mov ecx, r14d
call fcn.140019d40
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001dda8
cmp eax, 0xffffffff
je 0x14002f115
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14002f0dc
mov edx, r15d
mov ecx, r14d
call fcn.140019d40
jmp 0x14002f135
cmp byte [rsi + 0x38], dil
je 0x14002f12c
cmp dword [rsi + 0x34], 5
jne 0x14002f12c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002f135
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001e0b0
jmp 0x14002f1a8
jns 0x14002f1a8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400231e0
cmp rax, 0xffffffffffffffff
jne 0x14002f160
cmp byte [rsi + 0x30], dil
je 0x14002f1a8
mov edi, dword [rsi + 0x2c]
jmp 0x14002f1a8
mov ecx, r14d
call fcn.14002713c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14002f1a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14002f1a8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14002f1a1
mov eax, dword [rsi + 0x2c]
jmp 0x14002f1a6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400231e0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002f9b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002f9d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002f9d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x4011a0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
mov r11d, eax
mov eax, 1
cmp ecx, 5
ja 0x4011c8
jne 0x4011c6
shr r11w, 8
cmp r11b, al
jae 0x4011c8
xor eax, eax
add rsp, 0x28
ret

Function at 0x401558
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x400
mov rdi, rdx
call fcn.004153f0
mov edx, 0x400
mov rcx, rax
mov rbx, rax
call fcn.00419230
lea rcx, str._Extractor__Working_dir_is__s_n
mov rdx, rbx
call fcn.0040a274
mov rcx, rbx
call fcn.004153b0
mov rcx, rdi
call fcn.00409d40
test eax, eax
je 0x4015b7
lea rcx, str._Rename__The_target_already_exists._Deleting._n
call fcn.0040a274
mov rcx, rdi
call fcn.00409c14
mov rdx, rdi
mov rcx, rsi
call fcn.00416450
xor ebx, ebx
jmp 0x401642
cmp ebx, 0xa
jge 0x40166e
call fcn.004158a0
lea rcx, str._Rename__Could_not_rename__s_to__s___d__n
mov r8, rdi
mov r9d, dword [rax]
mov rdx, rsi
call fcn.0040a274
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str._Rename__Windows___this_FS_seems_to_not_supported_renaming._Trying_alternative_method..._n
call fcn.0040a274
mov r8d, 3
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401660
lea rdx, str.MoveFileEx
lea rcx, str.Extractor
call fcn.004098bc
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rdi
mov rcx, rsi
add ebx, 1
call fcn.00416450
test eax, eax
jne 0x4015c6
lea rcx, str._Rename__File__s_renamed_to__s_n
mov r8, rdi
mov rdx, rsi
call fcn.0040a274
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
lea rcx, str._Rename__MoveFileEx_worked._Assuming_success._n
call fcn.0040a274
xor eax, eax
test eax, eax
je 0x401646
call fcn.004158a0
lea rcx, str._Rename___FAIL__Could_not_rename__s_to__s___d__n
mov r8, rdi
mov r9d, dword [rax]
mov rdx, rsi
call fcn.0040a274
lea rcx, str._Rename__Can_do_no_better_than_a_copy_on_this_filesystem_n
call fcn.0040a274
mov rcx, rdi
call fcn.0040a184
lea rcx, str._Rename__Created_folder__s_n
mov rdx, rdi
call fcn.0040a274
mov rdx, rdi
mov rcx, rsi
call fcn.004018a0
test eax, eax
je 0x4016cc
lea rcx, str._Rename__Copy_failed_too__Severe_filesystem_issues._n
call fcn.0040a274
jmp 0x401658
lea rcx, str._Rename__Copied__s_to__s_n
jmp 0x40164d

Function at 0x401810
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
lea rdx, [0x0043c320]
mov rbx, rcx
call fcn.004171f0
test rax, rax
mov rdi, rax
jne 0x401843
lea rcx, str._Extractor___Unable_to_open_destination_file_for_copy__s_n
mov rdx, rbx
call fcn.0040a274
jmp 0x401895
lea rcx, [0x0053ff10]
mov r9, rsi
mov edx, 1
mov r8d, 0xc350
call fcn.004178d0
test rax, rax
mov rbx, rax
je 0x40187c
lea rcx, [0x0053ff10]
mov r9, rdi
mov r8, rax
mov edx, 1
call fcn.00418f80
cmp rbx, 0xc350
je 0x401843
mov rcx, rsi
call fcn.00419c90
mov rcx, rdi
call fcn.00419c90
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x4018a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
mov eax, 0x2740
call fcn.004376b0
sub rsp, rax
test rcx, rcx
mov rbx, rcx
je 0x4018cc
call section..text
mov rdi, rax
jmp 0x4018d9
call fcn.004158a0
xor edi, edi
mov dword [rax], 0x16
test rdi, rdi
mov qword [rsp + 0x2770], rdi
jne 0x4018fd
lea rcx, str._CopyFolder__SourceDir_from__s_is_NULL_n
mov rdx, rbx
call fcn.0040a274
lea eax, [rdi + 1]
jmp 0x401af2
mov rcx, rdi
call fcn.00401144
test rax, rax
mov rbp, rax
je 0x401ae6
mov rcx, qword [rax]
cmp byte [rcx], 0x2e
jne 0x401924
call fcn.00415600
cmp rax, 2
jbe 0x4018fd
mov rdx, qword [rsp + 0x2760]
mov rbx, qword [rbp]
lea rcx, [rsp + 0x13b0]
mov byte [rsp + 0x13b0], 0
call fcn.004156c0
lea rcx, [rsp + 0x13b0]
mov rdx, rbx
call fcn.0040a1c8
mov rdx, qword [rsp + 0x2768]
mov rbx, qword [rbp]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], 0
call fcn.004156c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.0040a1c8
lea rcx, [rsp + 0x13b0]
call section..text
test rax, rax
je 0x4019f6
mov rcx, rax
call fcn.004010f4
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder__Copying_DIR__s_n
call fcn.0040a274
lea rcx, [rsp + 0x20]
call fcn.0040a184
test eax, eax
mov ebx, eax
jne 0x401ab1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x13b0]
call fcn.004018a0
test eax, eax
mov ebx, eax
je 0x4018fd
lea rcx, str._CopyFolder___Failed_to_copy__s_to__s_n
lea rdx, [rsp + 0x13b0]
lea r8, [rsp + 0x20]
call fcn.0040a274
jmp 0x401ae8
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder__Copying_FILE__s_n
call fcn.0040a274
lea rdx, [0x0043c2c8]
lea rcx, [rsp + 0x13b0]
call fcn.004171f0
test rax, rax
mov qword [rsp + 0x2778], rax
je 0x401acb
lea rdx, [0x0043c320]
lea rcx, [rsp + 0x20]
call fcn.004171f0
test rax, rax
mov rbp, rax
je 0x401abd
mov rdi, qword [rsp + 0x2778]
lea rcx, [0x0053ff10]
mov r9, rdi
mov edx, 1
mov r8d, 0xc350
call fcn.004178d0
test rax, rax
mov rbx, rax
je 0x401a86
lea rcx, [0x0053ff10]
mov r9, rbp
mov r8, rax
mov edx, 1
call fcn.00418f80
cmp rbx, 0xc350
je 0x401a4d
mov rcx, qword [rsp + 0x2778]
mov rdi, qword [rsp + 0x2770]
call fcn.00419c90
mov rcx, rbp
call fcn.00419c90
jmp 0x4018fd
lea rcx, str._CopyFolder___Failed_to_copy__s_to__s__could_not_create_target_folder__n
jmp 0x4019df
lea rdx, [rsp + 0x20]
lea rcx, str._CopyFolder___Unable_to_open_destination_file_for_copy__s_n
jmp 0x401ada
lea rdx, [rsp + 0x13b0]
lea rcx, str._CopyFolder___Unable_to_open_source_file_for_copy__s_n
call fcn.0040a274
mov ebx, 1
jmp 0x401ae8
xor ebx, ebx
mov rcx, rdi
call fcn.004010f4
mov eax, ebx
add rsp, 0x2740
pop rdi
pop rbp
pop rbx
ret
Function at 0x4039a0
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov rax, rsp
sub rsp, 0x38
xor edi, edi
mov rbp, rdx
lea rdx, [rax + 0x48]
mov rbx, rcx
mov dword [rax + 0x48], edi
mov dword [rax + 0x50], edi
mov qword [rax - 0x18], rdi
call sub.VERSION.dll_GetFileVersionInfoSizeA
lea ecx, [rdi + 0x64]
mov r13d, eax
call fcn.004153f0
lea rcx, str._JavaCheck__Checking_file_version_of__s_n
mov rdx, rbx
mov byte [rax], 0x30
mov byte [rax + 1], dil
mov r12, rax
call fcn.0040a274
cmp r13d, edi
je 0x403aeb
mov rcx, r13
call fcn.004153f0
lea rcx, str._JavaCheck__Got_version_size_n
mov rsi, rax
call fcn.0040a274
mov edx, dword [rsp + 0x80]
mov r9, rsi
mov r8d, r13d
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, edi
je 0x403ad5
lea rcx, str._JavaCheck__Got_version_info_n
call fcn.0040a274
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x20]
lea rdx, [0x0043da28]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueA
cmp eax, edi
je 0x403acc
lea rcx, str._JavaCheck__Queried_value_n
call fcn.0040a274
cmp dword [rsp + 0x88], edi
je 0x403ac3
lea rcx, str._JavaCheck__Size_OK_n
call fcn.0040a274
mov rbx, qword [rsp + 0x20]
cmp dword [rbx], 0xfeef04bd
jne 0x403aba
mov edx, dword [rbx + 0x10]
lea rcx, str._JavaCheck__file_version_MS_is__ld_n
call fcn.0040a274
mov edx, dword [rbx + 0x14]
lea rcx, str._JavaCheck__file_version_LS_is__ld_n
call fcn.0040a274
movzx r8d, word [rbx + 0x12]
lea rdx, [0x0043dab4]
mov rcx, r12
call fcn.00416480
jmp 0x403ae1
lea rcx, str._JavaCheck__signature_is_wrong_n
jmp 0x403adc
lea rcx, str._JavaCheck__size_is_null_n
jmp 0x403adc
lea rcx, str._JavaCheck__ver_query_value_function_call_failed_n
jmp 0x403adc
lea rcx, str._JavaCheck__get_file_version_info_call_failed_n
call fcn.0040a274
mov rcx, rsi
call fcn.004153b0
jmp 0x403af7
lea rcx, str._JavaCheck__verSize_is_zero_n
call fcn.0040a274
cmp rbp, rdi
je 0x403b2a
lea rcx, str._Extractor__Checking_JRE_version_requirements:__s_vs_required__s_n
mov r8, rbp
mov rdx, r12
call fcn.0040a274
mov rcx, r12
call fcn.00416ea0
mov rcx, rbp
mov ebx, eax
call fcn.00416ea0
cmp ebx, eax
setge dil
mov eax, edi
jmp 0x403b3e
xor edx, edx
lea rcx, str._Extractor__Versions_for_JREs_could_not_be_detected___d__d__n
lea r8d, [rdx + 1]
call fcn.0040a274
xor eax, eax
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4061d0
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
cmp qword [0x00449230], 0
je 0x406239
mov ecx, dword [0x00449238]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov rcx, qword [0x00449230]
mov edx, 0x2328
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40621f
mov rcx, qword [0x00449230]
mov edx, 0x8ae
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x00449230]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x00449240]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x00449230], 0
add rsp, 0x28
ret
Function at 0x407240
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
call fcn.004011a0
xor r9d, r9d
test al, al
je 0x4072b0
cmp qword [0x004491b0], r9
jne 0x4072a8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [0x004491b0]
lea r8, [0x004088f8]
mov qword [0x004491c0], rax
lea rax, [0x004491b8]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.00419ed0
mov rcx, qword [0x004491c0]
mov qword [0x004491b0], rax
jmp 0x407307
mov ecx, dword [0x004491b8]
jmp 0x40732d
cmp qword [0x00449230], 0
jne 0x407327
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [0x00449230]
lea r8, [0x0040624c]
mov qword [0x00449240], rax
lea rax, [0x00449238]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.00419ed0
mov rcx, qword [0x00449240]
mov qword [0x00449230], rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40733d
lea rcx, str.Error_starting_SplashThread_n
call fcn.0040a274
jmp 0x40733d
mov ecx, dword [0x00449238]
mov r8d, 2
lea edx, [r8 + 4]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
add rsp, 0x38
ret
Function at 0x4077a0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rdi, rcx
mov ecx, 0x40
mov rbx, rdx
call fcn.004153f0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor esi, esi
mov rcx, rdi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rbx
mov qword [rbp + 8], rax
mov dword [rbp + 0x10], esi
mov dword [rbp + 0x30], esi
mov dword [rbp + 0x14], esi
call fcn.004080e8
lea edx, [rsi + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rbp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rbp]
mov ebx, 0xffffffff
mov edx, ebx
mov qword [rbp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r11, [rsp + 0x30]
lea r8, [0x00407710]
mov qword [rsp + 0x28], r11
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00407434]
mov r9, rbp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x34]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00407500]
mov r9, rbp
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x004075f0]
mov r9, rbp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x3c]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00407680]
mov r9, rbp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp]
mov dword [rbp + 0x30], 5
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbp + 0x38]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rbp + 0x10]
lea rcx, str._HttpDownloader__Download_Tasks_Complete___success_d__n
call fcn.0040a274
mov rcx, qword [rsp + rsi*8 + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 1
cmp rsi, 5
jl 0x407912
mov eax, dword [rbp + 0x10]
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x407958
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x2748
call fcn.004376b0
sub rsp, rax
mov rbp, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SetDllDirectoryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x13b0]
mov rdx, rbp
mov rbx, rax
mov byte [rsp + 0x13b0], 0
call fcn.004156c0
lea rdx, [0x0043bde8]
lea rcx, [rsp + 0x13b0]
call fcn.0040a1c8
lea rdx, [rsp + 0x13b0]
lea rcx, str._JNILaunch__Bin_folder_is__s_n
call fcn.0040a274
mov edi, 0x7d0
mov rcx, rdi
call fcn.004153f0
mov ecx, edi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [rsp + 0x13b0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test rbx, rbx
je 0x407a05
lea rcx, [rsp + 0x13b0]
call rbx
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov byte [rsp + 0x20], 0
call fcn.004156c0
lea rdx, [0x0043bde8]
lea rcx, [rsp + 0x20]
call fcn.0040a1c8
lea rdx, str.server
lea rcx, [rsp + 0x20]
call fcn.0040a1c8
lea rdx, str.jvm.dll
lea rcx, [rsp + 0x20]
call fcn.0040a1c8
lea rcx, [rsp + 0x20]
call fcn.00409d40
lea rdx, [rsp + 0x20]
lea rcx, str._JNILaunch__Trying_to_load_library__s__exists_d__n
mov r8d, eax
call fcn.0040a274
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x407b0f
lea rcx, str._JNILaunch__Unable_to_load_library._Will_attempt_fallback._n
call fcn.0040a274
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov byte [rsp + 0x20], dil
call fcn.004156c0
lea rdx, [0x0043bde8]
lea rcx, [rsp + 0x20]
call fcn.0040a1c8
lea rdx, str.client
lea rcx, [rsp + 0x20]
call fcn.0040a1c8
lea rdx, str.jvm.dll
lea rcx, [rsp + 0x20]
call fcn.0040a1c8
lea rcx, [rsp + 0x20]
call fcn.00409d40
lea rdx, [rsp + 0x20]
lea rcx, str._JNILaunch__Trying_to_load_library__s__exists_d__n
mov r8d, eax
call fcn.0040a274
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x407b0f
lea rcx, str._JNILaunch__Unable_to_load_second_library._n
call fcn.0040a274
jmp 0x407b20
lea rdx, [rsp + 0x20]
lea rcx, str._JNILauncher__Loaded_Windows_DLL____s_n
call fcn.0040a274
test rbx, rbx
je 0x407b29
xor ecx, ecx
call rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, rdi
add rsp, 0x2748
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x407f58
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rbp, r8
mov rdi, rdx
call fcn.00409640
xor edx, edx
lea rcx, [rsp + 0x48]
mov qword [rbp], 0
lea r8d, [rdx + 0x20]
mov rbx, rax
mov qword [rbp + 8], 0
call fcn.00417400
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x18]
call fcn.00417400
lea rcx, str._Proxy__Opening_HTTP_Session_n
call fcn.0040a274
xor r9d, r9d
lea rcx, str.JWrapper_Proxy_Detector_1.0
lea edx, [r9 + 1]
xor r8d, r8d
mov dword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
test rax, rax
mov rsi, rax
je 0x4080d6
test rdi, rdi
mov dword [rsp + 0x48], 1
je 0x407fff
lea rcx, str._Proxy__Using_auto_config_URL:__S_n
mov rdx, rdi
mov dword [rsp + 0x48], 3
call fcn.0040a274
mov qword [rsp + 0x50], rdi
lea rcx, str._Proxy__Attempting_to_detect_proxy_for_URL__S_n
mov rdx, rbx
mov dword [rsp + 0x4c], 3
mov dword [rsp + 0x64], 1
call fcn.0040a274
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x408099
lea rcx, str._Proxy__Configuration_found_n
call fcn.0040a274
cmp dword [rsp + 0x30], 1
jne 0x408059
lea rcx, str._Proxy__Direct_connection_used_n
call fcn.0040a274
jmp 0x4080ad
mov rdx, qword [rsp + 0x38]
lea rcx, str._Proxy___S_n
call fcn.0040a274
mov rdx, qword [rsp + 0x40]
lea rcx, str._Proxy___S_n
call fcn.0040a274
mov rcx, qword [rsp + 0x38]
call fcn.004096a0
mov rcx, qword [rsp + 0x40]
mov qword [rbp], rax
call fcn.004096a0
mov qword [rbp + 8], rax
jmp 0x4080ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._Proxy__Configuration_NOT_found___d__n
mov edx, eax
call fcn.0040a274
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x4080bd
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x4080cd
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbx
call fcn.004153b0
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4083cc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
mov eax, 0xc430
call fcn.004376b0
sub rsp, rax
mov rbx, rcx
lea rcx, str._Spawner__Constructing_command_line..._n
call fcn.0040a274
call fcn.0041aaf0
lea rcx, [rax + 0x30]
call fcn.00416e20
xor esi, esi
mov byte [rsp + 0xe0], 0
cmp qword [rbx], rsi
je 0x408456
mov rdi, rbx
lea rdx, [0x0043bddc]
lea rcx, [rsp + 0xe0]
call fcn.004156c0
mov rdx, qword [rdi]
lea rcx, [rsp + 0xe0]
call fcn.004156c0
lea rdx, [0x00441138]
lea rcx, [rsp + 0xe0]
call fcn.004156c0
add rsi, 1
lea rdi, [rbx + rsi*8]
cmp qword [rdi], 0
jne 0x408410
lea rdx, [rsp + 0xe0]
lea rcx, str._Spawner__Creating_command_line__s_n
call fcn.0040a274
call fcn.0041aaf0
lea rcx, [rax + 0x30]
call fcn.00416e20
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.00417400
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call fcn.00417400
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408513
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed___d_._n
mov edx, eax
call fcn.0040a274
call fcn.0041aaf0
lea rcx, [rax + 0x30]
call fcn.00416e20
mov rax, 0xffffffffffffffff
jmp 0x408568
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xc458]
lea rcx, str._Spawner__runSpawnerAndWait_returned__d_n
call fcn.0040a274
mov rax, qword [rsp + 0xc458]
add rsp, 0xc430
pop rdi
pop rsi
pop rbx
ret
Function at 0x408574
Capabilities:
Create process on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0xc430
call fcn.004376b0
sub rsp, rax
mov rbx, rcx
lea rcx, str._Spawner__Constructing_command..._n
mov byte [rsp + 0xe0], 0
call fcn.0040a274
call fcn.0041aaf0
lea rcx, [rax + 0x30]
call fcn.00416e20
xor esi, esi
cmp qword [rbx], rsi
je 0x4085fa
mov rdi, rbx
lea rdx, [0x0043bddc]
lea rcx, [rsp + 0xe0]
call fcn.004156c0
mov rdx, qword [rdi]
lea rcx, [rsp + 0xe0]
call fcn.004156c0
lea rdx, [0x00441138]
lea rcx, [rsp + 0xe0]
call fcn.004156c0
add rsi, 1
lea rdi, [rbx + rsi*8]
cmp qword [rdi], 0
jne 0x4085b4
lea rdx, [rsp + 0xe0]
lea rcx, str._Spawner__Executing_command__s_n
call fcn.0040a274
call fcn.0041aaf0
lea rcx, [rax + 0x30]
call fcn.00416e20
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.00417400
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call fcn.00417400
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4086b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed___d_._n
mov edx, eax
call fcn.0040a274
call fcn.0041aaf0
lea rcx, [rax + 0x30]
call fcn.00416e20
mov eax, 0xffffffff
jmp 0x4086e7
lea rcx, str._Spawner__Create_process_seems_to_have_worked_n
call fcn.0040a274
call fcn.0041aaf0
lea rcx, [rax + 0x30]
call fcn.00416e20
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0xc430
pop rdi
pop rsi
pop rbx
ret

Function at 0x408804
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
cmp qword [0x004491b0], 0
je 0x40886d
mov ecx, dword [0x004491b8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov rcx, qword [0x004491b0]
mov edx, 0x2328
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408853
mov rcx, qword [0x004491b0]
mov edx, 0x8ae
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x004491b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x004491c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x004491b0], 0
add rsp, 0x28
ret