joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c0e8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14000c0c5
call fcn.14000adb8
mov dword [rax], 0x16
call fcn.14000ac98
or eax, 0xffffffff
jmp 0x14000c0e2
sub dword [rcx + 0x10], 1
jns 0x14000c0d4
add rsp, 0x28
jmp 0x14000eeac
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14000c0a4
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14000ed4c
call fcn.14000adb8
mov dword [rax], 0x16
call fcn.14000ac98
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14000ed34
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14000ed34
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14000ed7e
lock or dword [rax + 0x14], 0x10
jmp 0x14000ed34
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14000ed9b
mov rcx, qword [rbp + 0x10]
call fcn.14000eeb4
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000bee8
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400102ac
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14000edf2
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14000ed34
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14000ee5e
mov rcx, qword [rbp + 0x10]
call fcn.14000bee8
cmp eax, 0xffffffff
je 0x14000ee45
mov rcx, qword [rbp + 0x10]
call fcn.14000bee8
cmp eax, 0xfffffffe
je 0x14000ee45
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000bee8
movsxd rdi, eax
lea rsi, [0x14016ecc0]
mov rcx, rbx
sar rdi, 6
call fcn.14000bee8
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14000ee4c
lea rax, [0x14016e160]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14000ee5e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14000ee94
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14000ee90
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14000ee90
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14000ed37
jmp 0x14000ed04
Function at 0x140011c48
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, 0x2537
lea r14d, [r8 - 0x2537]
mov ebp, r8d
lea edi, [rdx + 0x169]
mov r8d, dword [rsp + 0x90]
xor ebp, eax
mov esi, r8d
mov r15d, edx
xor r15d, eax
xor esi, 0x30e
mov eax, dword [r9 + 0x100]
mov r13d, ecx
lea r12d, [r8 - 0x21c]
mov rbx, r9
lea ecx, [rdx - 0xbd]
cmp dword [r9 + 0x20], eax
jne 0x140011cbe
add dword [0x1400d7144], 0x188ca
jmp 0x140011cc9
mov eax, dword [r9 + 0xc]
add dword [r9 + 0x114], eax
mov eax, dword [0x1400d7034]
cmp dword [r9 + 0x140], eax
ja 0x140011ce8
mov eax, dword [r9 + 0x15c]
xor eax, 0xffe2be19
mov dword [r9 + 0x48], eax
lea eax, [rbp + 0x23ff]
cmp r14d, eax
je 0x140011d3b
mov r10d, r12d
lea eax, [rsi + 0x214]
xor r10d, 0x11
lea r8d, [rbp + 0x247a]
mov dword [rsp + 0x30], r10d
lea edx, [r13 + 0x14b]
mov r9d, r12d
mov dword [rsp + 0x28], eax
xor r9d, 0x334
add ecx, 0xffffff92
mov dword [rsp + 0x20], r9d
mov r9, rbx
call fcn.140002dd0
mov r8d, dword [rsp + 0x90]
mov ecx, eax
cmp ebp, ecx
je 0x140011e82
cmp r13d, r8d
je 0x140011dbd
lea eax, [rdi - 0x2c3]
xor esi, 0x21e
xor r15d, 0x264a
mov dword [rsp + 0x28], esi
mov edx, r15d
mov dword [rsp + 0x20], eax
lea r9d, [r12 + 0x283]
lea ecx, [rdi - 0x283]
lea r8, [0x1400d7010]
call fcn.1400013dc
mov eax, dword [rbx + 0x124]
cmp dword [rbx + 0xcc], eax
jae 0x140011daa
mov rax, qword [section..data]
mov ecx, dword [rax + 0x4c]
xor ecx, dword [rbx + 0x134]
xor ecx, 0x618
sub dword [0x1400d707c], ecx
mov rax, qword [0x1400d7108]
mov qword [rbx + 0xf0], rax
jmp 0x140011e82
mov eax, dword [rbx + 0x178]
and eax, esi
and eax, r14d
cmp r14d, eax
jbe 0x140011e82
mov eax, dword [rbx + 0x110]
xor eax, dword [rbx + 0xc0]
cmp dword [rbx + 0x4c], eax
je 0x140011e82
mov esi, edi
imul esi, edi
cmp r14d, esi
je 0x140011e82
mov ebp, edi
imul ebp, r13d
mov ecx, dword [rbx + 0x20]
or rcx, 0x274b
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov r10, qword [section..data]
mov r9d, dword [rbx + 0x178]
mov ecx, dword [rbx + 0xc4]
add r9d, r12d
mov edx, dword [rbx + 0xc8]
and ecx, r12d
mov eax, dword [r10 + 0xe8]
mov r8d, dword [rbx + 0x38]
xor eax, 0x2537
imul ecx, dword [rbx + 0xbc]
or r15d, eax
mov eax, dword [r10 + 0x20]
add edx, r15d
imul eax, r12d
or r8d, 0x2530
and eax, r12d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r9d
lea r9, [0x1400d7010]
mov dword [rsp + 0x20], ebp
call fcn.140002dd0
add r14d, 3
mov r12d, eax
cmp r14d, esi
jne 0x140011dfa
lea r11, [rsp + 0x40]
xor edi, 0x397
mov rbx, qword [r11 + 0x30]
mov eax, edi
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001238c
Capabilities:
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
lea esi, [r8 - 0x247a]
mov edi, r8d
mov ecx, esi
lea eax, [r9 + 0x8a]
xor ecx, 0x2639
xor edi, 0x243
mov rbx, rdx
cmp eax, ecx
jg 0x14001245e
lea eax, [r9 + 0x1a]
xor eax, 0x130
cmp esi, eax
je 0x140012427
cmp dword [rdx + 0xd8], 0x1590e
jae 0x1400123fe
mov eax, dword [rdx + 0xa4]
sub eax, dword [rdx + 0x20]
sub eax, 0x17612
add dword [rdx + 0x110], eax
jmp 0x140012414
mov rax, qword [section..data]
mov ecx, dword [rax + 0x14c]
add ecx, 0x6774d
mov dword [rdx + 0x54], ecx
mov eax, dword [rdx + 0x70]
xor eax, dword [0x1400d7120]
add eax, 0x44dadf2b
xor dword [rdx + 0x54], eax
jmp 0x14001245e
cmp dword [rdx + 0x60], edi
jbe 0x14001245e
mov ecx, dword [rdx + 0xac]
mov ebp, dword [rdx + 0x178]
add ecx, esi
cmp ebp, ecx
jbe 0x14001245e
mov r14d, edi
or r14d, esi
mov ecx, r14d
sub ecx, dword [rbx + 0x34]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [rbx + 0xac]
inc ebp
add ecx, esi
cmp ebp, ecx
ja 0x140012444
mov rbx, qword [rsp + 0x30]
lea eax, [rdi + 0x89]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140014e44
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x30
mov esi, dword [rsp + 0x68]
lea edi, [rdx - 0x21c]
mov r8d, dword [rsp + 0x60]
lea eax, [rdi - 0x1e]
mov rbx, rcx
mov r10d, edx
xor r10d, 0x30e
mov ebp, edx
lea r14d, [rsi + 0x8b]
xor esi, 0x26c0
lea ecx, [r8 + 0x170]
xor r8d, 0x2530
cmp r8d, eax
je 0x140014ffe
mov eax, r10d
xor eax, 0x1aa
cmp edi, eax
jg 0x14001509d
xor ecx, 0x390
lea r9d, [rdx + 0x87]
mov edx, ecx
xor r10d, 0x3f7
xor edi, 0x1de
mov dword [r11 - 0x18], r10d
mov rcx, rbx
mov r8d, edi
call fcn.1400011e0
lea rax, [0x140043af0]
xor r9d, r9d
mov qword [rbx + 0xe0], rax
mov rcx, qword [section..data]
mov rax, qword [rcx + 0xe0]
mov r8d, dword [r9 + rax]
add r9, 4
mov eax, dword [rcx + 0xc0]
add dword [rbx + 0xac], eax
mov rax, qword [section..data]
mov ecx, dword [rbx + 0x90]
imul r8d, dword [rax + 0x58]
mov eax, dword [rbx + 0x24]
add eax, 0xfff1793b
add ecx, eax
or dword [rbx + 8], ecx
mov rax, qword [section..data]
mov edx, r8d
shr edx, 0x10
mov ecx, dword [rax + 0x80]
add ecx, dword [rbx + 0x140]
mov eax, dword [rbx + 0xc4]
xor ecx, 0xc7366
imul eax, ecx
movsxd rcx, dword [rbx + 0x6c]
mov dword [rbx + 0xc4], eax
mov eax, dword [0x1400d705c]
add eax, 0xffffffef
xor dword [rbx + 0xc0], eax
mov eax, dword [rbx + 8]
xor eax, 0xf
add dword [rbx + 0x178], eax
mov rax, qword [rbx + 0xf0]
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [rbx + 0x6c]
mov rax, qword [0x1400d7100]
movsxd rcx, dword [rbx + 0x6c]
shr edx, 8
mov byte [rcx + rax], dl
inc dword [rbx + 0x6c]
movsxd rcx, dword [rbx + 0x6c]
mov rax, qword [rbx + 0xf0]
mov byte [rcx + rax], r8b
inc dword [rbx + 0x6c]
mov rax, qword [section..data]
mov ecx, dword [rax + 0x90]
dec ecx
add dword [rbx + 0xb0], ecx
mov rax, qword [section..data]
mov ecx, dword [rax + 8]
xor ecx, dword [rbx + 0x80]
sub ecx, 0xf
or dword [rbx + 0x110], ecx
cmp r9, 0x87d50
jl 0x140014eee
mov eax, dword [rbx + 0xb4]
mov dword [0x1400d7068], eax
jmp 0x14001509d
xor ecx, 0x26c2
and ecx, dword [0x1400d7030]
cmp r10d, ecx
jbe 0x14001509d
mov r9d, 0x21fb
mov qword [rsp + 0x20], 0x310c
mov r8b, 0x70
mov edx, 0x1d2e
mov ecx, 0x33ab
call fcn.140004580
movsxd rcx, eax
mov rax, qword [section..data]
mov qword [0x14016ea88], rcx
mov ecx, dword [rbx + 0x110]
mov r10d, dword [rbx + 0x10c]
xor ecx, 0x249d
mov edx, dword [rax + 0x110]
imul r10d, dword [rbx + 0xc4]
or edx, 0x254a
mov r8d, dword [rbx + 0xec]
sub edx, ebp
imul ecx, dword [0x1400d7188]
add r8d, esi
mov qword [rsp + 0x28], rdx
mov edx, 0x25b3
movsxd rax, r14d
movsxd r9, edi
or r9, rax
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
lea eax, [r14 - 0x89]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
test al, 0x17
sar byte [rdx + 0x73977e36], cl
sub bl, byte [rsi - 0x4b]
jge 0x140020a27
invalid
outsd dx, dword [rsi]
mov ecx, eax
mov cl, dl
invalid
Function at 0x140017f2c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, 0x45753c06
jmp 0x140006d6a
dec rcx
jmp 0x140009473
jmp 0x140009c7c
jne 0x140006d6a
jmp 0x140009108
jmp 0x140009d36
jmp 0x140009d88
jmp 0x140009dd1
jmp 0x140009e2e
jmp 0x140009e98
jmp 0x140009ef8
jmp 0x140009f1d
jmp 0x140009f76
jmp 0x140009fbc
jmp 0x14000a02d
jmp 0x14000a05a
jmp 0x14000a0bf
jmp 0x14000a128
jmp 0x14000a17d
jmp 0x14000a1bc
jmp 0x14000a1dc
jmp 0x14000a234
jmp 0x14000a2a8
jmp 0x14000a2f3
xor rcx, rcx
nop
nop
nop
mov rdx, 0x8e88
nop
nop
nop
nop
nop
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
nop
call 0x14000a320
pop rsi
add rsi, 0xe58
nop
nop
nop
nop
nop
mov rdi, rax
mov rcx, 0x8e88
rep movsb byte [rdi], byte [rsi]
nop
nop
jmp rax
sub rsp, 0x28
call fcn.140018510
add rsp, 0x28
xor rcx, rcx
jmp 0x14000547c
invalid

Function at 0x1400187b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140018802
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140018802
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140018802
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140018802
cmp dword [rcx + 0x84], 0xe
jbe 0x140018802
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140018804
xor al, al
add rsp, 0x28
ret
Function at 0x14057b99a
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x7619ae57
pushf
not eax
add eax, 0x983fc5a1
xor eax, 0xca23e9a6
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x9f4ac36a
xor eax, 0x98b4e5f1
rol eax, 0x6c
popf
pushf
not eax
add eax, 0x8357ea91
xor eax, 0x9befaf05
rol eax, 0xed
popf
cmp eax, 2
jne 0x14057b9ea
popf
pop rax
jmp 0x14057bb45
cmp eax, 0
jne 0x14057b9f9
popf
pop rax
jmp 0x14057ba17
cmp eax, 3
jne 0x14057ba08
popf
pop rax
jmp 0x14057bb91
cmp eax, 1
jne 0x14057ba17
popf
pop rax
jmp 0x14057bb3c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x19ec35751]
pushf
sub r9, 0x5e6d64a1
popf
mov edi, ecx
lea rdx, [0x1bd3719a6]
pushf
sub rdx, 0x7ce126f6
popf
mov ecx, 0x9502308b
pushf
not ecx
add ecx, 0xc56657cb
xor ecx, 0x9fe482a5
rol ecx, 0x5f
popf
pushf
not ecx
add ecx, 0xc1d24fc3
xor ecx, 0x8ac6bc7d
rol ecx, 0x19
popf
pushf
not ecx
add ecx, 0xf5dd0b59
xor ecx, 0xe41b3cd7
rol ecx, 0x13
popf
lea r8, [0x1837e2925]
pushf
sub r8, 0x4328367d
popf
call fcn.14054a584
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x14057bb08
push rax
pushf
mov eax, 0xb935b0ae
pushf
not eax
add eax, 0x88bb2ca9
xor eax, 0xe6415762
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xcd8894e2
xor eax, 0xb1653a00
rol eax, 0x39
popf
pushf
not eax
add eax, 0xa6e14ad9
xor eax, 0xadcaf8dd
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xcdc886bc
xor eax, 0xb2d794f5
rol eax, 0x68
popf
jmp 0x14057b9db
push rax
pushf
mov eax, 0xf83bdf2f
pushf
not eax
add eax, 0xf94011f7
xor eax, 0xe04a78e8
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xca0e9d88
xor eax, 0xa045578a
rol eax, 0xa1
popf
jmp 0x14057b9db
call qword [0x14055e2e8]
jmp 0x14057bb91
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0x45cf967f
pushf
not eax
add eax, 0xcf10f4ba
xor eax, 0xb9a3d2cb
rol eax, 0x57
popf
pushf
not eax
add eax, 0xaffdfe27
xor eax, 0xc8fee2d8
rol eax, 0x14
popf
pushf
not eax
add eax, 0xaedc3779
xor eax, 0xcb2c3dc2
rol eax, 0xb
popf
jmp 0x14057b9db
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140591a75
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x6c1430df
pushf
not eax
add eax, 0xf1562372
xor eax, 0xee2b8d30
rol eax, 0x81
popf
pushf
not eax
add eax, 0xe65ecd0f
xor eax, 0xfc96dc2f
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xa849ebce
xor eax, 0xdbcda436
rol eax, 0xa9
popf

Function at 0x140adca26
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x342f78ea
pushf
not eax
add eax, 0xaf1fcffa
xor eax, 0xe7b3691b
rol eax, 0x41
popf
pushf
not eax
add eax, 0xd3f036c6
xor eax, 0x9969ba9c
rol eax, 0x33
popf
cmp eax, 2
jne 0x140adca63
popf
pop rax
jmp 0x140adcbcf
cmp eax, 0
jne 0x140adca72
popf
pop rax
jmp 0x140adca81
cmp eax, 1
jne 0x140adca81
popf
pop rax
jmp 0x140adcbc3
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1857c9c6b]
pushf
sub r9, 0x4526a9d3
popf
mov ecx, 0x5ba2b843
pushf
not ecx
add ecx, 0xc8572700
xor ecx, 0xbf7657b5
rol ecx, 0x6f
popf
pushf
not ecx
add ecx, 0x9b0a1a1b
xor ecx, 0x92e2b2c2
rol ecx, 0xa3
popf
pushf
not ecx
add ecx, 0x8f9bb522
xor ecx, 0xd03248d6
rol ecx, 0x2a
popf
pushf
not ecx
add ecx, 0x8df437e9
xor ecx, 0xd69de377
rol ecx, 0xfa
popf
lea r8, [0x193cef65f]
pushf
sub r8, 0x537903cf
popf
lea rdx, [0x19f521044]
pushf
sub rdx, 0x5efc1dac
popf
call fcn.14054a584
mov ecx, ebx
test rax, rax
je 0x140adcb7d
push rax
pushf
mov eax, 0xb41f5477
pushf
not eax
add eax, 0xf623492f
xor eax, 0xd79117a5
rol eax, 0xfc
popf
pushf
not eax
add eax, 0xfe885561
xor eax, 0x8ad99e11
rol eax, 0x37
popf
pushf
not eax
add eax, 0x94706342
xor eax, 0xb79ad9b4
rol eax, 0x23
popf
pushf
not eax
add eax, 0xec742806
xor eax, 0x959e357b
rol eax, 2
popf
jmp 0x140adca54
push rax
pushf
mov eax, 0xae6c1b04
pushf
not eax
add eax, 0xea26c812
xor eax, 0xbb2d8023
rol eax, 0xff
popf
pushf
not eax
add eax, 0xf31a73d5
xor eax, 0xf97e5ff0
rol eax, 0x16
popf
pushf
not eax
add eax, 0xaf4377cf
xor eax, 0xdbf08bae
rol eax, 0x64
popf
jmp 0x140adca54
add rsp, 0x20
pop rbx
jmp qword [0x14055e2e8]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x140ae0828
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0x986edb8f
pushf
not eax
add eax, 0xae13c906
xor eax, 0xc6be2e6b
rol eax, 0xef
popf
pushf
not eax
add eax, 0xbf28ead5
xor eax, 0xabf559b9
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xacd85b27
xor eax, 0xce265d3a
rol eax, 0x85
popf
cmp eax, 2
jne 0x140ae0878
popf
pop rax
jmp 0x140ae097b
cmp eax, 0
jne 0x140ae0887
popf
pop rax
jmp 0x140ae0896
cmp eax, 1
jne 0x140ae0896
popf
pop rax
jmp 0x140ae096c
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1ba6cc5c0]
pushf
sub r9, 0x7a16d350
popf
xor ecx, ecx
lea r8, [0x1b2810205]
pushf
sub r8, 0x722b0f9d
popf
lea rdx, [0x1914b7a61]
pushf
sub rdx, 0x50f587f1
popf
call fcn.14054a584
test rax, rax
je 0x140ae0913
push rax
pushf
mov eax, 0x54a436f4
pushf
not eax
add eax, 0x9a324c2c
xor eax, 0x8c4be6ae
rol eax, 1
popf
pushf
not eax
add eax, 0x82f2223e
xor eax, 0xef66330a
rol eax, 0xb5
popf
jmp 0x140ae0869
push rax
pushf
mov eax, 0xcc75c692
pushf
not eax
add eax, 0xe4c98475
xor eax, 0xfcfe898e
rol eax, 0x69
popf
pushf
not eax
add eax, 0xb5b49b91
xor eax, 0xe34add84
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xf478a31b
xor eax, 0xe6b21a36
rol eax, 0x92
popf
pushf
not eax
add eax, 0xd585dc0f
xor eax, 0xfcd50326
rol eax, 0x3c
popf
jmp 0x140ae0869
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x14055e2e8]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x140af195a
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x545a0576
pushf
not eax
add eax, 0xdd44c9cc
xor eax, 0xedbfaa7c
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xa25fd845
xor eax, 0xedc866df
rol eax, 0x99
popf
pushf
not eax
add eax, 0xf6e36ce4
xor eax, 0x88f7cf1b
rol eax, 0x69
popf
cmp eax, 2
jne 0x140af19aa
popf
pop rax
jmp 0x140af1a8b
cmp eax, 0
jne 0x140af19b9
popf
pop rax
jmp 0x140af19c8
cmp eax, 1
jne 0x140af19c8
popf
pop rax
jmp 0x140af1a79
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140b1a443
test al, al
je 0x140af1a1f
push rax
pushf
mov eax, 0xe86fec8d
pushf
not eax
add eax, 0xcde5474f
xor eax, 0xc2eb0141
rol eax, 0x8e
popf
pushf
not eax
add eax, 0xe32be165
xor eax, 0x98fd6bf8
rol eax, 0xba
popf
pushf
not eax
add eax, 0xdffab407
xor eax, 0xcaa7d914
rol eax, 0x67
popf
jmp 0x140af199b
push rax
pushf
mov eax, 0xd2810435
pushf
not eax
add eax, 0xd2120c71
xor eax, 0x86a4782a
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x88106453
xor eax, 0xaf9371ed
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xdbf535e6
xor eax, 0xb595e2f4
rol eax, 0x2a
popf
pushf
not eax
add eax, 0x967dd1c8
xor eax, 0x904bcef1
rol eax, 0x77
popf
jmp 0x140af199b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x140af1a85
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.140aed6ac
mov ecx, ebx
jmp 0x140af1a95
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400bb5e8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400bb622
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400bb627
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400bb670
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400d7840]
cmp byte [rcx + rax], 0
je 0x1400bb670
dec r8
sub rdx, 1
jne 0x1400bb656
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret