joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x522e2c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9f53cbe9d1ea70d9
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xdbe064da
movabs rdx, 0x405070802020400
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3050b0a0b040a06
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x522dc5
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x10
jge 0x522dfc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x522e1f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
cmp rsi, 0xc
jb 0x522dab
jmp 0x522e13
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004451c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00457340
mov eax, edi
mov ecx, 0xc
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00522d60

Function at 0x522e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x522f07
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf7336cfa023cc42f
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x6cfbd82e
movabs rdx, 0x70400090a010104
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x703020200070401
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x522ea8
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x42]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x42]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x522ed7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x522efa
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x522e8b
jmp 0x522eee
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004451c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00457340
mov eax, edi
mov ecx, 0xc
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00522e40
Function at 0x5239c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x523aa6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x740187910d2200f7
mov qword [rsp + 0x30], rdx
movabs rdx, 0x73016e796bedc615
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40e0f08060c0209
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x90a0203060e040e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x10a01030a050800
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x523a40
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x58]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x523a72
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x523a97
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x58]
cmp rsi, 0x10
jb 0x523a22
jmp 0x523a8b
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457340
mov eax, edi
mov ecx, 0x10
nop
call fcn.00457340
nop
call fcn.00455060
jmp fcn.005239c0

Function at 0x5245e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5246a7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x761eb83d6e651a30
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x32da63ad
movabs rdx, 0x80401000b0a0a06
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa0801050405
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x524648
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x5c]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x5c]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x524677
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x52469a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x52462b
jmp 0x52468e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004451c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00457340
mov eax, edi
mov ecx, 0xc
call fcn.00457340
nop
call fcn.00455060
jmp fcn.005245e0
Function at 0x5272e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5273dd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xb575c5b1b8f71a47
mov qword [rsp + 0x36], rdx
movabs rdx, 0x2665b575c5b1b8f7
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3ab3f9e24e35d269
mov qword [rsp + 0x40], rdx
movabs rdx, 0x506060602060f02
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20b030c01030507
mov qword [rsp + 0x24], rdx
movabs rdx, 0x90f020b030c0103
mov qword [rsp + 0x26], rdx
movabs rdx, 0x100e030411100b0f
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x527380
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 - 0x47]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 - 0x47]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x5273ad
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x5273d0
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x12
jb 0x52735f
jmp 0x5273c4
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457340
mov eax, edi
mov ecx, 0x12
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.005272e0

Function at 0x527a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x527b58
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xc2426c6fbdace76e
mov qword [rsp + 0x47], rdx
movabs rdx, 0x65c2426c6fbdace7
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd172df2bcb22b2bc
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf6fc865a0e31306
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb1a1d1c7d550da52
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1119061a10070118
mov qword [rsp + 0x19], rdx
movabs rdx, 0x120b1a11070e1413
mov qword [rsp + 0x21], rdx
movabs rdx, 0x120e0c1d0d0b120b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x131e120901201813
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x191e0b030a1c1a
mov qword [rsp + 0x37], rdx
movabs rdx, 0x219181c161f191c
mov qword [rsp + 0x3f], rdx
xor eax, eax
jmp 0x527af5
movzx r9d, byte [rsp + rsi + 0x47]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x47], dl
mov byte [rsp + rsi + 0x47], r8b
add rax, 2
cmp rax, 0x2e
jge 0x527b28
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x527b4b
movzx r8d, byte [rsp + rdi + 0x47]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
nop
cmp rsi, 0x21
jb 0x527adb
jmp 0x527b3f
xor eax, eax
lea rbx, [rsp + 0x47]
mov ecx, 0x21
call fcn.004451c0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00457340
mov eax, edi
mov ecx, 0x21
call fcn.00457340
nop
call fcn.00455060
nop dword [rax]
jmp fcn.00527a20
Function at 0x527f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52802c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8973a7c2cd6c6f59
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa5748e948db88973
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6090202080a04
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xd07050a0d0b030d
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x527fcf
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x1a]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x1a]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0x10
jge 0x527ffc
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x52801f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x527fb2
jmp 0x528013
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.004451c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457340
mov eax, edi
mov ecx, 0xe
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00527f60

Function at 0x529c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x529d27
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa7feaf68277483ea
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x6cb318a7
movabs rdx, 0x806070003000601
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x7090509050806
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x529cc8
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 0x6e]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 0x6e]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x529cf7
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x529d1a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x529cab
jmp 0x529d0e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.004451c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457340
mov eax, edi
mov ecx, 0xb
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00529c60
Function at 0x529d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x529e3d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1e72124536043d58
mov qword [rsp + 0x33], rdx
movabs rdx, 0x1834193f601e7212
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7355266f09300c42
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb100f050d020e03
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9090c12040b0a07
mov qword [rsp + 0x21], rdx
movabs rdx, 0x10c09090c12040b
mov qword [rsp + 0x23], rdx
movabs rdx, 0x13080d0312000410
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x529de0
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 + 0x43]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 + 0x43]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x529e0d
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x529e30
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x529dbf
jmp 0x529e24
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457340
mov eax, edi
mov ecx, 0x15
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.00529d40

Function at 0x529e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x529f4c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x65637dfe5074e7f4
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe445894165637dfe
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe2fcf0485a720168
mov qword [rsp + 0x40], rdx
movabs rdx, 0x130c11080f090d05
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb0d1312040f110a
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd0111100d100900
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x529eea
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x66]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x18
jge 0x529f1c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x529f3f
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x66]
cmp rsi, 0x14
jb 0x529ed0
jmp 0x529f33
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457340
mov eax, edi
mov ecx, 0x14
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00529e60
Function at 0x52aae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52abdd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa8997f7250cacf83
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xbed9736509a8997f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8f9b9992affc89d7
mov qword [rsp + 0x48], rdx
movabs rdx, 0x140f050e08070d13
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1402021009001206
mov qword [rsp + 0x25], rdx
movabs rdx, 0x80c110110021402
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1308061108070b06
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x52ab80
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x52abad
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x52abd0
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x52ab5f
jmp 0x52abc4
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.004451c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457340
mov eax, edi
mov ecx, 0x15
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.0052aae0

Function at 0x52f380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52f43d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6b323b7029010627
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xfa65
movabs rdx, 0x903000502030601
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x306
xor eax, eax
jmp 0x52f3e0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x43]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x43]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x52f40d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x52f430
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x52f3c2
jmp 0x52f424
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.004451c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00457340
mov eax, edi
mov ecx, 0xa
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.0052f380
Function at 0x532e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x532ff5
push rbp
mov rbp, rsp
sub rsp, 0xb8
movabs rdx, 0x79261d6d1426aee9
mov qword [rsp + 0x71], rdx
movabs rdx, 0x2751460310af979
mov qword [rsp + 0x78], rdx
movabs rdx, 0x7b704ad30e6ed6a7
mov qword [rsp + 0x80], rdx
movabs rdx, 0xf5dacdf5868961eb
mov qword [rsp + 0x88], rdx
movabs rdx, 0x6e60f72011076e78
mov qword [rsp + 0x90], rdx
movabs rdx, 0x5e153b95d965a1a9
mov qword [rsp + 0x98], rdx
movabs rdx, 0xc5c46f5e2072270d
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x257861adb420740b
mov qword [rsp + 0xa8], rdx
movabs rdx, 0xad35378907459631
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x1240170043401c10
mov qword [rsp + 0x1b], rdx
lea rdi, [rsp + 0x21]
lea rsi, [0x005a95ee]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045795a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x532f94
movzx r9d, byte [rsp + rsi + 0x71]
sub r9d, edx
lea edx, [r9 - 0x5c]
mov byte [rsp + rdi + 0x71], dl
lea edx, [r8 - 0x5c]
mov byte [rsp + rsi + 0x71], dl
add rax, 2
cmp rax, 0x56
jge 0x532fc2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x532fe8
movzx r8d, byte [rsp + rdi + 0x71]
sub r8d, edx
cmp rsi, 0x47
jb 0x532f77
nop
jmp 0x532fdc
xor eax, eax
lea rbx, [rsp + 0x71]
mov ecx, 0x47
call fcn.004451c0
add rsp, 0xb8
pop rbp
ret
mov eax, esi
mov ecx, 0x47
call fcn.00457340
mov eax, edi
mov ecx, 0x47
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00532e80

Function at 0x544260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x544318
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x456e4d37e248d347
mov qword [rsp + 0x28], rdx
movabs rdx, 0x701040304050501
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x1050205
xor eax, eax
jmp 0x5442b6
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7b]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x5442e8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x54430b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7b]
cmp rsi, 8
jb 0x54429c
jmp 0x5442ff
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.004451c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00457340
mov eax, edi
mov ecx, 8
call fcn.00457340
nop
call fcn.00455060
nop dword [rax]
jmp fcn.00544260
Function at 0x5446c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5447aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x99db9bd7d4326930
mov qword [rsp + 0x37], rdx
movabs rdx, 0x4799db9bd7d43269
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc2ab1616ae230c2c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5070a090108090d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x30a09040b040d0e
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1008010c030d0f06
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x54474d
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x5c]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x5c]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x54477a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54479d
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x544730
jmp 0x544791
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457340
mov eax, edi
mov ecx, 0x11
call fcn.00457340
nop
call fcn.00455060
jmp fcn.005446c0

Function at 0x5447c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5448ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x37b51ec7f5328f30
mov qword [rsp + 0x37], rdx
movabs rdx, 0xe637b51ec7f5328f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xbfed6585ec24c43b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90c040f1009030b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb030a080a100508
mov qword [rsp + 0x27], rdx
movabs rdx, 0xd060c0609050401
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x54484a
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x70]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x18
jge 0x54487c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54489f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x70]
cmp rsi, 0x11
jb 0x544830
jmp 0x544893
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457340
mov eax, edi
mov ecx, 0x11
call fcn.00457340
nop
call fcn.00455060
jmp fcn.005447c0
Function at 0x544e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x544eec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3761773489327f94
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x983761773489327f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4b5665b9635a0dea
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80d090506000a08
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd06030b0506080d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x901010d060f0810
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x544e8a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x39]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x16
jge 0x544ebc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x544edf
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x39]
cmp rsi, 0x11
jb 0x544e70
jmp 0x544ed3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457340
mov eax, edi
mov ecx, 0x11
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00544e00

Function at 0x140001008
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001069
lea rcx, str.Windows_original_main_args:_n
call fcn.140001148
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001069
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.140001148
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000103e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010b5
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a2
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010cc
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010db
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 0
mov r8d, 2
mov byte [rsp + 0x58], 0
mov rdx, rbx
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x1400022cc]
mov qword [rsp + 0x38], rax
lea rax, [0x1400022d0]
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400017e3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x14000140a
rol rcx, 0x10
test cx, 0xffff
jne 0x140001406
repz ret
ror rcx, 0x10
jmp 0x14000173c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400030f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400031e8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400017c1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400030f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400017e3
mov rax, qword [rsp + 0x88]
mov qword [0x1400031e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140003188], rax
mov rax, qword [0x1400031e8]
mov qword [0x140003060], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140003170], rax
mov dword [0x140003050], 0xc0000409
mov dword [0x140003054], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140003008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400030e8], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400023f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400030e8], 0
jne 0x14000186a
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret