joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003cf60
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov edi, edx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1400423d0
xor eax, eax
mov dword [rsp + 0x70], 0x68
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov word [rsp + 0xb0], cx
mov qword [rsp + 0x48], rax
mov rdx, rbx
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
je 0x14003d038
test edi, edi
je 0x14003d00f
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x14003d020
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
cmp rcx, 0xffffffffffffffff
je 0x14003d031
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, 1
jmp 0x14003d03a
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400406e0
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret

Function at 0x14003de50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
lea r9, [rsp + 0x20]
xor ebx, ebx
lea rcx, [0x14005bc10]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x14003deac
mov r9, qword [rsp + 0x20]
lea r8, str._sWindowsApps
mov edx, 0x104
mov rcx, rdi
call fcn.14000a160
mov ebx, 1
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003debc
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400406e0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14003dee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r14
sub rsp, 0x480
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x470], rax
movzx eax, byte [0x14007cdf0]
lea r14, [0x14007cdf0]
cmp al, byte [0x140064a40]
jne 0x14003e045
xor edx, edx
mov qword [rsp + 0x4a0], rdi
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call fcn.1400423d0
xor edi, edi
xor ecx, ecx
lea edx, [rdi + 1]
lea r8d, [rdi + 0x10]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_FindResourceW]
test rax, rax
je 0x14003e03d
mov rdx, rax
mov qword [rsp + 0x490], rbx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14003e035
mov rcx, rax
mov qword [rsp + 0x498], rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x14003dfe9
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.1400423d0
lea r8, str.StringFileInfo040904b0PRODUCTVERSION
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140044288
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x40]
mov rcx, rsi
lea rdx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x14003dfe9
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x260]
mov edx, 0x104
call fcn.140044288
mov edi, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeResource]
mov rsi, qword [rsp + 0x498]
test edi, edi
je 0x14003e035
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x260]
mov qword [rsp + 0x30], 0
mov r9d, 0xffffffff
mov dword [rsp + 0x28], 0x104
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
mov rbx, qword [rsp + 0x490]
mov rdi, qword [rsp + 0x4a0]
mov rax, r14
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0x480
pop r14
ret
Function at 0x14003f5e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x440
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov edi, edx
mov rbx, rcx
mov rcx, qword [0x140079b70]
lea rsi, [0x140079b70]
cmp rcx, rsi
je 0x14003f639
test byte [rcx + 0x1c], 4
je 0x14003f639
mov rcx, qword [rcx + 0x10]
mov edx, 0xd
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call fcn.14003f100
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call fcn.1400423d0
mov r9, rbx
mov dword [rsp + 0x20], edi
lea r8, str._s__0x_x
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.140006720
mov rcx, qword [0x140079b70]
test byte [rcx + 0x44], 1
je 0x14003f69b
cmp rcx, rsi
je 0x14003f742
mov rcx, qword [rcx + 0x38]
lea rax, [rsp + 0x30]
mov edx, 0x1a
mov qword [rsp + 0x20], rax
call fcn.14003f070
jmp 0x14003f742
cmp qword [0x14007cf20], 0
je 0x14003f6c6
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14007cf20]
sub rax, rcx
cmp rax, 0x2710
jae 0x14003f742
test rcx, rcx
jne 0x14003f6d3
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [0x14007cf20], rax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x14003f6e0
inc eax
mov ecx, eax
mov edi, eax
call fcn.14004d694
mov rbx, rax
test rax, rax
je 0x14003f742
lea r8, [rsp + 0x30]
mov edx, edi
mov rcx, rax
call fcn.140046f74
xor eax, eax
lea r8, [0x14003ff70]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14003f73a
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x14003f742
mov rcx, rbx
call fcn.14004d69c
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400406e0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14003f770
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x440
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov edi, edx
mov rbx, rcx
mov rcx, qword [0x140079b70]
lea rsi, [0x140079b70]
cmp rcx, rsi
je 0x14003f7c9
test byte [rcx + 0x1c], 4
je 0x14003f7c9
mov rcx, qword [rcx + 0x10]
mov edx, 0x10
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call fcn.14003f100
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call fcn.1400423d0
mov r9, rbx
mov dword [rsp + 0x20], edi
lea r8, str._s___d
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.140006720
mov rcx, qword [0x140079b70]
test byte [rcx + 0x44], 1
je 0x14003f82b
cmp rcx, rsi
je 0x14003f8d2
mov rcx, qword [rcx + 0x38]
lea rax, [rsp + 0x30]
mov edx, 0x1a
mov qword [rsp + 0x20], rax
call fcn.14003f070
jmp 0x14003f8d2
cmp qword [0x14007cf20], 0
je 0x14003f856
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14007cf20]
sub rax, rcx
cmp rax, 0x2710
jae 0x14003f8d2
test rcx, rcx
jne 0x14003f863
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [0x14007cf20], rax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x14003f870
inc eax
mov ecx, eax
mov edi, eax
call fcn.14004d694
mov rbx, rax
test rax, rax
je 0x14003f8d2
lea r8, [rsp + 0x30]
mov edx, edi
mov rcx, rax
call fcn.140046f74
xor eax, eax
lea r8, [0x14003ff70]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14003f8ca
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x14003f8d2
mov rcx, rbx
call fcn.14004d69c
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400406e0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14003f9e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x440]
mov r8d, 0x400
call fcn.1400423d0
xor esi, esi
test rbx, rbx
jne 0x14003fa2a
mov eax, esi
jmp 0x14003fa37
mov edx, 0x104
mov rcx, rbx
call fcn.14004d7f4
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x440]
mov qword [rsp + 0x30], rsi
mov r9d, eax
mov dword [rsp + 0x28], 0x400
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
mov rcx, qword [0x140079b70]
lea rbx, [0x140079b70]
cmp rcx, rbx
je 0x14003fa9f
test byte [rcx + 0x1c], 4
je 0x14003fa9f
mov rcx, qword [rcx + 0x10]
lea rax, [rsp + 0x440]
mov qword [rsp + 0x28], rax
mov edx, 0x12
mov qword [rsp + 0x20], rdi
call fcn.14003f310
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x400
call fcn.1400423d0
lea rax, [rsp + 0x440]
mov r9, rdi
lea r8, str._s___s
mov qword [rsp + 0x20], rax
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.140006720
mov rcx, qword [0x140079b70]
test byte [rcx + 0x44], 1
je 0x14003fb0a
cmp rcx, rbx
je 0x14003fbb0
mov rcx, qword [rcx + 0x38]
lea rax, [rsp + 0x40]
mov edx, 0x1a
mov qword [rsp + 0x20], rax
call fcn.14003f070
jmp 0x14003fbb0
cmp qword [0x14007cf20], rsi
je 0x14003fb34
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14007cf20]
sub rax, rcx
cmp rax, 0x2710
jae 0x14003fbb0
test rcx, rcx
jne 0x14003fb41
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [0x14007cf20], rax
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x14003fb50
inc eax
mov ecx, eax
mov edi, eax
call fcn.14004d694
mov rbx, rax
test rax, rax
je 0x14003fbb0
lea r8, [rsp + 0x40]
mov edx, edi
mov rcx, rax
call fcn.140046f74
mov r9, rbx
mov qword [rsp + 0x28], rsi
lea r8, [0x14003ff70]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14003fba8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x14003fbb0
mov rcx, rbx
call fcn.14004d69c
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400406e0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14003fbe0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x440
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [0x140079b70]
lea rsi, [0x140079b70]
cmp rcx, rsi
je 0x14003fc3b
test byte [rcx + 0x1c], 4
je 0x14003fc3b
mov rcx, qword [rcx + 0x10]
mov edx, 0x14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
call fcn.14003f310
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call fcn.1400423d0
mov r9, rbx
mov qword [rsp + 0x20], rdi
lea r8, str._s___s
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.140006720
mov rcx, qword [0x140079b70]
test byte [rcx + 0x44], 1
je 0x14003fc9e
cmp rcx, rsi
je 0x14003fd44
mov rcx, qword [rcx + 0x38]
lea rax, [rsp + 0x30]
mov edx, 0x1a
mov qword [rsp + 0x20], rax
call fcn.14003f070
jmp 0x14003fd44
cmp qword [0x14007cf20], 0
je 0x14003fcc9
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14007cf20]
sub rax, rcx
cmp rax, 0x2710
jae 0x14003fd44
test rcx, rcx
jne 0x14003fcd6
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [0x14007cf20], rax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14003fce2
inc eax
mov ecx, eax
mov edi, eax
call fcn.14004d694
mov rbx, rax
test rax, rax
je 0x14003fd44
lea r8, [rsp + 0x30]
mov edx, edi
mov rcx, rax
call fcn.140046f74
xor eax, eax
lea r8, [0x14003ff70]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14003fd3c
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x14003fd44
mov rcx, rbx
call fcn.14004d69c
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400406e0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14003fe60
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [0x140079b70]
test byte [rcx + 0x44], 1
je 0x14003fe9f
lea rax, [0x140079b70]
cmp rcx, rax
je 0x14003ff68
mov rcx, qword [rcx + 0x38]
mov edx, 0x1a
mov qword [rsp + 0x20], rbx
call fcn.14003f070
add rsp, 0x30
pop rbx
ret
cmp qword [0x14007cf20], 0
je 0x14003feca
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14007cf20]
sub rax, rcx
cmp rax, 0x2710
jae 0x14003ff68
test rcx, rcx
jne 0x14003fed7
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [0x14007cf20], rax
mov qword [rsp + 0x40], rsi
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x48], rdi
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x14003fef0
inc eax
mov ecx, eax
mov esi, eax
call fcn.14004d694
mov rdi, rax
test rax, rax
je 0x14003ff5e
mov r8, rbx
mov edx, esi
mov rcx, rax
call fcn.140046f74
xor eax, eax
lea r8, [0x14003ff70]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14003ff56
mov rcx, rax
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, rdi
call fcn.14004d69c
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
Function at 0x141f9d34a
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x7131632a
lea rax, [0x141fb1668]
mov edi, 0x9a39782c
movzx edi, byte [r10]
push 0xffffffff9a19dd1f
xor edi, esi
and edi, 0xff
mov edi, dword [rax + rdi*4]
shr esi, 8
shr byte [rsp + 6], 0xe5
xor esi, edi
inc r10
xor esi, 0x39049314
dec rdx
push 0xffffffffac0ba09e
lea rsp, [rsp + 0x10]
jne 0x141f854c3
mov edi, 0x48b9a79f
jmp 0x141fbe815
test rdx, rdx
jmp 0x141f9d369
lea rsp, [rsp + 0x10]
je 0x141fbe816
push rdi
jmp 0x141f854b7
pop rdi
not esi
call fcn.141fbb83b

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x180002ab0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180002b0d
lea rbx, [0x1800c1ac0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180002af4
cmp r10, 2
jb 0x180002af4
cmp byte [r9], r8b
jne 0x180002af4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180002ad0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180002b4f
lea rbx, [0x1800c1ac0]
cmp r8b, 0x23
jne 0x180002b33
cmp byte [r9], r8b
jne 0x180002b33
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180002b20
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180002da0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
test rcx, rcx
jne 0x180002dcf
mov r8d, 0x599
lea rdx, str.E:_source_codes_fscimguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rsi, rsi
je 0x180002ddb
mov qword [rsi], 0
lea rdx, [0x1800c1768]
mov rcx, rbx
call fcn.180002b60
mov rbx, rax
test rax, rax
jne 0x180002dfd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x180002ee8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180002ee8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180002ee8
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180002ee8
cmp rdi, 0xffffffffffffffff
je 0x180002ee8
mov rax, qword [0x180202970]
test rax, rax
je 0x180002e79
inc dword [rax + 0x3bc]
mov rdx, qword [0x180202960]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbp, rax
test rax, rax
je 0x180002ee8
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180002ed5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180202970]
test rax, rax
je 0x180002ec4
dec dword [rax + 0x3bc]
mov rdx, qword [0x180202960]
mov rcx, rbp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x180002ef1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x180002ee3
mov qword [rsi], rdi
mov rax, rbp
jmp 0x180002ef3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x180004e30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xc0]
mov rbx, rcx
mov edi, edx
test eax, eax
jg 0x180004e6d
mov r8d, 0x51b
lea rdx, str.E:_source_codes_fscimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx + 0xc0]
movsxd rcx, eax
lea r8, [0x1800c1ac0]
mov rax, qword [rbx + 0xc8]
mov edx, dword [rax + rcx*4 - 4]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x180202970]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1a78], edx
jne 0x180004ee2
mov dword [rax + 0x1a7c], edx
cmp dword [rax + 0x1ab4], edx
jne 0x180004ef1
mov byte [rax + 0x1ab8], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x180004f00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xc0]
mov rdi, rdx
mov rbx, rcx
test eax, eax
jg 0x180004f3a
mov r8d, 0x51b
lea rdx, str.E:_source_codes_fscimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx + 0xc0]
movss xmm0, dword [rdi]
subss xmm0, dword [rbx + 0x10]
movss xmm1, dword [rdi + 4]
subss xmm1, dword [rbx + 0x14]
movsxd rcx, eax
mov rax, qword [rbx + 0xc8]
cvttss2si r8d, xmm0
movss xmm0, dword [rdi + 8]
subss xmm0, dword [rbx + 0x10]
cvttss2si r9d, xmm1
movss xmm1, dword [rdi + 0xc]
lea rdi, [0x1800c1ac0]
subss xmm1, dword [rbx + 0x14]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, r8b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
cvttss2si r10d, xmm0
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r9b
cvttss2si r11d, xmm1
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r10b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
xor ebx, dword [rdi + rdx*4]
shr eax, 0x10
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r11b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r11d
shr eax, 8
movzx edx, al
mov eax, r11d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x180202970]
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r11d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
not ebx
cmp dword [rax + 0x1a78], ebx
jne 0x1800050d7
mov dword [rax + 0x1a7c], ebx
cmp dword [rax + 0x1ab4], ebx
jne 0x1800050e6
mov byte [rax + 0x1ab8], 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret