joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001fb80
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
push r12
push rsi
push rbx
sub rsp, 0x28
mov qword [rbp + 0x10], rcx
call dbg._fpreset
lea rcx, [0x140025668]
call dbg.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
lea r12, [rax + 0x38]
mov rcx, r12
call dbg.pthread_mutex_lock
cmp dword [0x14002f060], 1
je 0x14001fbbf
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov rdx, qword [rbp + 0x10]
mov ecx, dword [0x140025678]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rbx, qword [rbp + 0x10]
mov rcx, r12
mov dword [rbx + 0x70], eax
call dbg.pthread_mutex_unlock
mov rax, qword [rbp + 0x10]
mov rdx, rbp
lea rcx, [rax + 0xd0]
call sym._setjmp
test eax, eax
je 0x14001fc90
lea rcx, [0x140025668]
call dbg.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
lea r12, [rax + 0x38]
mov rcx, r12
call dbg.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x30]
mov rbx, qword [rax + 8]
test rcx, rcx
je 0x14001fc32
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x10]
cmp qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
je 0x14001fcee
mov rcx, r12
call dbg.pthread_mutex_unlock
mov rcx, r12
call dbg.pthread_mutex_destroy
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov dword [rax + 0xbc], 1
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
lea rsi, [0x140025668]
mov rcx, rsi
call dbg.pthread_mutex_unlock
test eax, eax
jne 0x14001fce6
xor ecx, ecx
call r12
jmp 0x14001fc7d
lea rcx, [0x140025668]
call dbg.pthread_mutex_unlock
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x14001fd24
mov rsi, qword [rbp + 0x10]
mov rcx, qword [rsi + 8]
call rax
mov r12, rax
nop
nop
lea rcx, [0x140025668]
call dbg.pthread_mutex_lock
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x1d8]
mov qword [rax + 8], r12
test rcx, rcx
je 0x14001fc0b
call sym._pthread_cleanup_dest.part.0
jmp 0x14001fc0b
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__endthreadex]
mov rax, qword [rbp + 0x10]
mov rcx, r12
mov dword [rax], 0xdeadbeef
call dbg.pthread_mutex_unlock
mov rcx, r12
call dbg.pthread_mutex_destroy
mov rcx, qword [rbp + 0x10]
call sym.push_pthread_mem
mov ecx, dword [0x140025678]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x14001fc6f
mov r12d, pe_nt_image_headers64
jmp 0x14001fcb6
Function at 0x14001fd30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x14002f060], 1
je 0x14001fd47
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x140025678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x14001fd70
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call sym.pop_pthread_mem
cmp qword [sym.__dyn_tls_pthread], 0
mov rbx, rax
je 0x14001fd5b
test rax, rax
je 0x14001fd5b
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x14001fe7a
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rdi
mov dword [rsp + 0x30], 2
mov r8, rsi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je sym.__pthread_self_lite.cold
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x140025678]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je sym.__pthread_self_lite.cold
mov r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call sym.replace_spin_keys.part.0
nop
Function at 0x14001fe80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
test edx, edx
jne 0x14001feb0
test r8, r8
je 0x14001ff70
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
cmp edx, 1
je 0x14001ffa0
cmp edx, 3
jne 0x14001fe97
mov ecx, dword [0x140025678]
cmp ecx, 0xffffffff
je 0x14001fe97
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x14001fe97
test byte [rax + 0x40], 0x30
je 0x14001ffd0
mov rcx, qword [rax + 0x1d8]
test rcx, rcx
je 0x14001fef2
call sym._pthread_cleanup_dest.part.0
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x14001ff25
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r13
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x14001ff13
call r13
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
lea rcx, [r12 + 0x38]
call dbg.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x140020064
cmp qword [r12 + 0x1d0], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
je 0x1400200d0
mov ecx, dword [0x140025678]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x14001fe97
mov rcx, qword [0x14002f020]
test rcx, rcx
je 0x14001fe97
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov qword [0x14002f020], 0
jmp 0x14001fe97
lea rdx, [dbg.SetThreadName_VEH]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [0x14002f020], rax
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
mov rcx, qword [rax + 0x30]
mov eax, dword [rax + 0xbc]
test eax, eax
jne 0x140020070
test rcx, rcx
je 0x14001ffed
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r12 + 0x1d8]
mov qword [r12 + 0x30], 0
mov dword [r12 + 0xbc], 1
test rcx, rcx
je 0x140020014
call sym._pthread_cleanup_dest.part.0
lea r14, [r12 + 0x38]
lea r13, [r12 + 0x68]
test byte [r12 + 0x44], 4
je 0x1400200b0
mov rcx, qword [r12 + 0x28]
mov dword [r12], 0xdeadbeef
test rcx, rcx
je 0x140020042
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x28], 0
mov rcx, r14
call dbg.pthread_mutex_destroy
mov rcx, r13
call dbg.pthread_spin_destroy
cmp eax, 1
jne 0x14001ff42
call sym.replace_spin_keys.part.0
nop dword [rax]
test rcx, rcx
je 0x14002007b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x30], 0
lea rcx, [r12 + 0x38]
call dbg.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x140020064
mov qword [r12 + 0x68], 0xffffffffffffffff
jmp 0x14001fe97
mov rcx, r14
call dbg.pthread_mutex_destroy
mov rcx, r13
call dbg.pthread_spin_destroy
cmp eax, 1
jne 0x14002009d
jmp 0x140020064
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x14001ff5a
Function at 0x140020d80
Capabilities:
Hijack thread execution

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x140020e6e
lea r12, [0x140025668]
mov rcx, r12
call dbg.pthread_mutex_lock
mov rcx, rsi
call dbg.__pthread_get_pointer
mov rcx, r12
mov rbx, rax
call dbg.pthread_mutex_unlock
test rbx, rbx
je 0x140020e6e
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140020e6e
lea r12, [rsp + 0x20]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140020e6e
lea r13, [rbx + 0x38]
mov rcx, r13
call dbg.pthread_mutex_lock
call sym.__pthread_self_lite
test rax, rax
je 0x140020e0b
cmp rsi, qword [rax + 0x1d8]
je 0x140020e88
mov edx, dword [rbx + 0x44]
movzx eax, byte [rbx + 0x40]
and edx, 3
cmp edx, 3
je 0x140020ee0
test al, 3
jne 0x140020e60
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x14002f068], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140020e42
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, r13
call dbg.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x140020e4a
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
movzx eax, byte [rbx + 0x40]
test al, 3
jne 0x140020e60
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x14002f068], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140020eb0
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x140020e42
and eax, 0xfffffffe
mov rcx, r13
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call dbg.pthread_mutex_unlock
call dbg._pthread_invoke_cancel
nop dword [rax]
test al, 0xc
jne 0x140020e60
test al, 0xf
jne 0x140020e6e
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140020e42
mov rcx, qword [rbx + 0x28]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [dbg._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, r12
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x14002f068], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140020f66
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call dbg.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140020e42
Function at 0x140020f80
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
lea r13, [0x140025668]
mov r12, rcx
mov rcx, r13
mov ebx, edx
call dbg.pthread_mutex_lock
mov rcx, r12
call dbg.__pthread_get_pointer
test rax, rax
je 0x140021000
cmp qword [rax + 0x1d8], r12
jne 0x140021000
test byte [rax + 0x40], 0xc
jne 0x140021000
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140021000
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140021000
mov rcx, r13
call dbg.pthread_mutex_unlock
test ebx, ebx
je 0x140021020
lea edx, [rbx - 2]
cmp edx, 0x15
ja 0x140021028
mov rcx, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp dbg.pthread_cancel
mov rcx, r13
call dbg.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
xor eax, eax
jmp 0x14002100d
mov eax, 0x16
jmp 0x14002100d
Function at 0x1400212d0
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.pop_pthread_mem
mov r12, rax
test rax, rax
je 0x140021539
test rdi, rdi
je 0x14002130a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x140021377
add ebx, 1
cmp ebx, 1
je 0x140021480
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x140021345
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x14002157a
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x140021522
xor edx, edx
test rsi, rsi
je 0x1400213ef
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x140021550
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [dbg.pthread_create_wrapper]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400214e0
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x1400214b0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x140021490
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x140021345
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002145f
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140021435
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x140021435
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x1400214f0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call dbg.pthread_mutex_destroy
mov rcx, r14
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x14002157a
mov qword [r12 + 0x68], 0xffffffffffffffff
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x14002152e
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x140021570
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.__pthread_self_lite
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x1400213ef
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x140021539
call sym.replace_spin_keys.part.0
nop
Function at 0xbe6520
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xbe652d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xbe653d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xbe6525
lea eax, [rcx + 1]
jmp 0xbe654b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xbe655e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xbe6544
sub eax, 3
jb 0xbe657e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xbe65cd
sar eax, 1
movsxd rbp, eax
jb 0xbe65b4
jmp 0xbe658c
add ebx, ebx
jne 0xbe658a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xbe65b4
inc ecx
add ebx, ebx
jne 0xbe659a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xbe65b4
call r11
adc ecx, ecx
add ebx, ebx
jne 0xbe65ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xbe659c
add ecx, 2
jmp 0xbe65b9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00be64e2
jmp 0xbe652d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x3ff000
mov dl, 0x6c
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xbe661d
cmp rsi, rcx
jae 0xbe6625
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xbe6604
cmp al, 0x8f
ja 0xbe6604
cmp byte [rsi - 2], 0xf
je 0xbe660a
sub al, 0xe8
cmp al, 1
ja 0xbe65ee
cmp rsi, rcx
jae 0xbe6625
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xbe65f4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xbe6625
lodsb al, byte [rsi]
jmp 0xbe6604
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x7dd000]
mov eax, dword [rdi]
or eax, eax
je 0xbe6682
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7e6000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xbe6632
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xbe667c
mov qword [rbx], rax
add rbx, 8
jmp 0xbe6652
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xbe66c6
cmp al, 0xef
ja 0xbe66ae
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xbe668e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xbe669d
mov eax, dword [rdi]
add rdi, 4
jmp 0xbe669d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.00be6745], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.00be6745
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xbe6735
sub rsp, 0xffffffffffffff80
jmp 0x4014b0
Function at 0x140001008
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001069
lea rcx, str.Windows_original_main_args:_n
call fcn.14000114c
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001069
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.14000114c
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000103e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010b5
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a2
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010cc
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010db
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 0
mov r8d, 5
mov byte [rsp + 0x58], 0
mov rdx, rbx
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x14000237c]
mov qword [rsp + 0x38], rax
lea rax, [0x140002380]
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x1409ba9e8
Capabilities:
Encode data using xor

Disassembly:
call fcn.140986350
xor r8w, bx
push r11
sub r8w, 0xdfab
neg r8w
inc r8w
rol byte [rsp + 5], 1
add r11w, 0xecbd
xor r8w, 0x8cb6
not r8w
neg r8w
not r11w
call fcn.1409aa383
call fcn.1409b249e
mov dx, word [r10 + rdx - 0x7700d6b5]
mov qword [rsp], rbp
and word [rsp + 6], bp
sal rbp, 0xc1
adc r10, 2
ror bpl, 0xe3
sar dword [rsp + 4], 0xb8
push rbp
sbb rdi, 1
push rbp
movzx ebp, byte [rdi]
xor dword [rsp + 0x12], 0x6e8bbc3d
xor bpl, sil
inc bpl
not bpl
sar byte [rsp + 0x15], 0x86
add bpl, 0xbd
rol bpl, 1
not bpl
ror dword [rsp + 9], 0x15
xor sil, bpl
dec qword [rsp + 8]
lea rbp, [rsp + rbp + 0x18]
jne 0x1409ba9b0
push 0xb862f08
lea rsp, [rsp + 0x10]
jmp fcn.1409b01da
add r10, 4
jmp 0x14097f853
mov word [rbp + riz], dx
lea rsp, [rsp + 0x18]
jg fcn.1409b01da
inc bl
mov edi, 0xd52ffb33
ror di, 0xe3
shr edi, 0x7d
xor bpl, bl
shr edi, 0x1c
adc rbx, rsp
not di
not dil
sub edi, edi
or dil, byte [rbx + rdi*2]
call fcn.1409831d8
mov rax, qword [r10]
mov ebp, 0x5f39f69c
ror ebp, 0x3a
mov ebp, dword ss:[rax]
jb 0x1409a5e2f
push 0x54b6699e
adc rbx, 0xc
shr dword [rsp + 1], 0xf
xor eax, eax
sar qword [rsp], 0xa6
test r8, r8
lea rsp, [rsp + 8]
je 0x1409bb21b
push rbx
lea rbx, [0x1409ac720]
push 0xffffffffd0abf586
mov r10d, dword [rsp + 1]
movzx r10d, byte [rcx]
push 0xffffffffd2388f82
xor r10d, eax
and r10d, 0xff
push 0xffffffffb8172cbd
mov r10d, dword [rbx + r10*4]
shr eax, 8
xor eax, r10d
inc rcx
xor eax, 0xdaa9b1bc
not byte [rsp + 0xa]
dec r8
lea rsp, [rsp + 0x18]
jne 0x1409baa2a
push 0xffffffff8921cd8a
call fcn.140982ee5
add r10, 4
add ebp, ecx
push 0xffffffff82bc370b
mov dword [r10], ebp
jmp 0x1409a2419
not eax
mov dword [rbx], eax
call fcn.1409ab912
mov edx, 0xe5959e0c
mov rdx, qword [r10]
mov r9d, 0xec9c0321
mov r9, qword [r10 + 8]
push 0xfffffffff3b1e83e
call fcn.14098aa0e
Function at 0x865030
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
je 0x865040
jne 0x865040
sub rsp, 0x28
mov rax, qword [rdx]
cmp dword [rax + 0x8c], 0
je 0x8650eb
mov rsi, qword [rdx + 8]
mov edi, dword [rax + 0x88]
cmp dword [rdi + rsi + 0x18], 0
je 0x865088
jne 0x865088
je 0x497a51b6
add r12, rsi
add rbx, rsi
je 0x8650eb
cmp dword [rsi + rdi + 0x14], 0
je 0x8650eb
mov r15, r8
mov r13, rcx
mov ebx, dword [rsi + rdi + 0x20]
mov r12d, dword [rsi + rdi + 0x24]
je 0x865069
jne 0x865069
je 0x7549afeb
and eax, 0x44e92375
mov esi, dword [rcx + rax]
Function at 0x872790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x8727c0
mov eax, dword [rax + 0x20]
mov dword [rdi + 0x38], eax
mov rcx, rbx
mov rdx, rsi
call r15
mov rcx, rdi
jmp 0x872870
xor r14d, r14d
xor edx, edx
jmp 0x8728ff
mov rax, qword [rcx]
jmp 0x87280b
push r15
je 0x8728f6
jne 0x8728f6
add byte [rax], al
add byte [rax], al
nop word cs:[rax + rax]
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
jmp 0x8728de
mov rcx, rbp
jmp 0x8728b1
mov r15, qword [sym.imp.itmkl_beo_UteNpt2HgazewrUmZvtjloS]
je 0x8727d2
jne 0x8727d2
jmp 0xffffffffff88b34d
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x872796
call qword [rax + 8]
je 0x872914
jne 0x872914
jmp 0x87d508
jmp 0x8728cc
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 8]
test eax, eax
je 0x87287d
jne 0x87287d
por mm3, qword [rdx - 0x17]
je 0x8727ed
jne 0x8727ed
je 0xffffffff8496d62d
jmp 0x872821
sub rsp, 0x28
mov rdi, rcx
je 0x87290b
jmp 0x872932
push rdi
push rbp
push rbx
jmp 0x872845
je 0x872920
mov rax, qword [rcx]
jmp 0x8727ad
call fcn.00873060
jmp 0x87295e
jmp 0x13fac90
je 0x87293b
je 0x87294f
jne 0x87294f
je 0xffffffff8e0b3819
je 0x872925
add byte [rax], al
add byte [rax - 0x75], cl
outsd dx, dword [rsi]
adc byte [rdi], cl
test ch, cl
add byte [rax], al
add byte [rdi], cl
test edi, eax
add byte [rax], al
add byte [rax - 0x7b], cl
leave
mov rbp, qword [rdi + 0x10]
je 0x87296f
jne 0x87296f
test rcx, rcx
jmp 0x87285e
call qword [rax + 0x18]
lea edx, [rax + 1]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
jmp 0x8727bb
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [rax + 0x30]
test rax, rax
je 0x87293b
mov rcx, qword [rdi + 0x10]
je 0x872801
jne 0x872801
push r14
push rsi
jmp 0x872857
je 0x872842
jne 0x872842
mov rcx, qword [rcx + 0x10]
je 0x8728a8
jne 0x8728a8
jmp 0x172e99d
test eax, eax
jmp 0x872918
jne 0x8727e0
jmp 0x87293b
xor r14d, r14d
jmp 0x87293b
je 0x872935
jne 0x872935
jmp 0x87287c
jne 0x87290b
jmp 0x88e77a
mov r14d, 1
mov eax, r14d
jmp 0x872942
je 0x87281b
jne 0x87281b
jmp 0x38e6b69b
lea rbx, [rdi + 0x38]
lea rsi, [rdi + 0x3c]
jmp 0x8727f5
cmp eax, 1
je 0x872892
jne 0x872892
je 0xccb4bb
mov rax, qword [rbp]
jmp 0x872838
invalid
add al, ah
dec dword [rbp + 0x29]
imul r9, rbx, 0xa2c13