joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5333a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x53353a
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, qword [rsp + 0x70]
cmp rdx, 9
jb 0x53352f
mov rbx, qword [str.urn:uuid:]
cmp qword [0x007c4348], 9
je 0x5334f7
xor eax, eax
test al, al
je 0x533466
mov rcx, qword [rsp + 0x68]
nop word [rax + rax]
cmp rcx, 9
jb 0x533525
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
lea rax, [rdx - 9]
mov rdx, rax
neg rax
sar rax, 0x3f
and rax, 9
mov rbx, qword [rsp + 0x60]
add rax, rbx
mov qword [rsp + 8], rax
lea rax, [rcx - 9]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rdx
call fcn.00533560
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
call fcn.0040b6a0
mov rax, qword [rsp + 0x18]
lea rcx, [0x00611940]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00666067]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
lea rax, [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 1
mov qword [rsp + 0x20], 1
call fcn.004d6e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], 9
call fcn.00402a40
movzx eax, byte [rsp + 0x18]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
jmp 0x5333ee
mov eax, 9
call fcn.0046ce80
mov ecx, 9
call fcn.0046ce40
nop
call fcn.0046abe0
nop
jmp fcn.005333a0
Function at 0x533560
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x533722
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword [rsp + 0x88]
cmp rax, 0x20
je 0x5336bd
nop word [rax + rax]
cmp rax, 0x24
jne 0x5335f7
mov rcx, qword [rsp + 0x78]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x18], rax
call fcn.00532ea0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp], rax
call fcn.0040b580
mov rax, qword [rsp + 8]
lea rcx, [0x00613700]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x10], rax
call fcn.0040b6a0
mov rax, qword [rsp + 0x18]
lea rcx, [0x00611940]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
lea rax, [0x00666a8d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
lea rax, [rsp + 0x48]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 2
call fcn.004d6e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x78]
test byte [rcx], al
mov qword [rsp], rcx
mov qword [rsp + 8], 0x10
mov qword [rsp + 0x10], 0x10
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
call fcn.00519ca0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
call fcn.0046abe0
jmp fcn.00533560
Function at 0x535b40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x68]
cmp rax, qword [rcx + 0x10]
jbe 0x535e06
sub rsp, 0xe8
mov qword [rsp + 0xe0], rbp
lea rbp, [rsp + 0xe0]
lea rax, [rsp + 0x78]
mov qword [rsp], rax
lea rax, [0x00664a00]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x24
call fcn.00452220
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x70], rcx
call fcn.004c3300
mov rax, qword [rsp]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 8]
bt rax, 0x3f
jae 0x535bdf
shl rax, 1
shr rax, 0x1f
movabs rbx, 0xdd7b17f80
lea rcx, [rax + rbx]
mov qword [rsp + 0x48], rcx
nop
lea rax, [0x006367a0]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp + 0xa0], rax
mov qword [rsp], rax
mov rcx, qword [rsp + 0x48]
imul rcx, rcx, 0x3b9aca00
mov rdx, qword [rsp + 0x68]
and rdx, 0x3fffffff
movsxd rdx, edx
add rcx, rdx
movabs rdx, 0xa1b203eb3d1a0000
add rcx, rdx
mov qword [rsp + 8], rcx
call fcn.0051a580
nop
lea rax, [0x00626a20]
mov qword [rsp], rax
lea rax, [0x006a5c00]
mov qword [rsp + 8], rax
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x10], rcx
call fcn.0040ba60
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
lea rdx, [0x006a5c00]
mov qword [rsp + 0xb0], rdx
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rcx
xor eax, eax
xor ecx, ecx
xor edx, edx
lea rbx, [rsp + 0x47]
jmp 0x535cdc
mov byte [r8 + rdx], al
mov r9, qword [rsp + 0x60]
lea rax, [r9 + 1]
mov rcx, rbx
mov rdx, rdi
mov rbx, r8
mov rsi, qword [rsp + 0xf0]
cmp rsi, rax
jle 0x535dbd
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xb0]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 8], rcx
call fcn.0051a300
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
jbe 0x535e00
mov rdx, qword [rsp + 0x50]
lea rbx, [rdx + 1]
mov rsi, qword [rsp + 0xa8]
movzx eax, byte [rsi + rax]
mov rdi, qword [rsp + 0x58]
cmp rdi, rbx
jb 0x535d5e
mov r8, qword [rsp + 0x98]
jmp 0x535cc6
mov byte [rsp + 0x47], al
lea rax, [0x00614000]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rbx
call fcn.0044ddc0
mov r8, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
lea rbx, [rax + 1]
movzx eax, byte [rsp + 0x47]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0xa8]
jmp 0x535cc6
mov qword [rsp], 0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
call fcn.00452060
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rcx
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
call fcn.0046cdc0
nop
call fcn.0046abe0
jmp fcn.00535b40
Function at 0x536120
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x536260
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rsp + 0x48]
mov qword [rsp], rdx
call rcx
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 8], rax
jne 0x53623e
lea rax, [0x006211c0]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x10], rcx
call fcn.0040ba60
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
cmp byte [rsp + 0x28], 0
nop
je 0x5361e8
mov rax, qword [rax + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
call rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.00535f80
mov rax, qword [rsp + 0x28]
lea rcx, [0x006a5840]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a11e0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
nop dword [rax + rax]
call fcn.0046abe0
jmp fcn.00536120
Function at 0x5365c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x536700
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rsp + 0x48]
mov qword [rsp], rdx
call rcx
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 8], rax
jne 0x5366de
lea rax, [0x00621140]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x10], rcx
call fcn.0040ba60
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
cmp byte [rsp + 0x28], 0
nop
je 0x536688
mov rax, qword [rax + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
call rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.00535f80
mov rax, qword [rsp + 0x28]
lea rcx, [0x006a5818]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1220]
mov qword [rsp + 8], rax
call fcn.00438920
nop
nop dword [rax + rax]
call fcn.0046abe0
jmp fcn.005365c0
Function at 0x536c40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x536ec6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x00621240]
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 8], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x10], rcx
call fcn.0040ba60
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
cmp byte [rsp + 0x28], 0
je 0x536ce9
mov rax, qword [rax + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x18], rcx
call rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rcx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rdx
call rcx
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 8], rax
jne 0x536ea5
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rdx
nop
call rcx
cmp qword [rsp + 8], 0x200
jg 0x536e85
mov eax, 0x200
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 0
call fcn.0040daa0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp], rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x10], rcx
call fcn.0046d6c0
lea rax, [0x00614000]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x10], rax
nop dword [rax]
call fcn.0044dcc0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
lea rcx, [0x0063cce0]
mov qword [rsp], rcx
call fcn.0040e560
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
cmp dword [0x00811460], 0
jne 0x536e6d
mov rcx, qword [rsp + 0x60]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
cmp dword [0x00811460], 0
jne 0x536e5d
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x30], 0
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x38], rcx
cmp dword [0x00811460], 0
jne 0x536e4d
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x28], rcx
mov qword [rax + 0x40], 0
lea rcx, [0x006a4680]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x38]
call fcn.0046ca20
jmp 0x536e24
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x40]
call fcn.0046ca20
jmp 0x536e01
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x60]
call fcn.0046ca20
nop dword [rax + rax]
jmp 0x536de2
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
nop
jmp 0x536d36
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a11f0]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00536c40
Function at 0x538f00
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x538f6b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x538f24
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x538f41
cmp rdx, 0
je 0x538f8d
test rdx, 0xf
je 0x538f1d
test rdx, 7
jne 0x538f41
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x538f1d
ret
Function at 0x53b960
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x53b99f
jb 0x53b9b4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x53ba20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x53ba5f
jb 0x53ba74
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x53bae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x53bbb0
jb 0x53bc0f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0053b900
aeskeygenassist xmm1, xmm0, 1
call fcn.0053b920
aeskeygenassist xmm1, xmm2, 2
call fcn.0053b900
aeskeygenassist xmm1, xmm0, 2
call fcn.0053b920
aeskeygenassist xmm1, xmm2, 4
call fcn.0053b900
aeskeygenassist xmm1, xmm0, 4
call fcn.0053b920
aeskeygenassist xmm1, xmm2, 8
call fcn.0053b900
aeskeygenassist xmm1, xmm0, 8
call fcn.0053b920
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0053b900
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0053b920
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0053b900
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0053b920
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0053b900
jmp 0x53bc7d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0053b860
aeskeygenassist xmm1, xmm2, 2
call fcn.0053b8c0
aeskeygenassist xmm1, xmm2, 4
call fcn.0053b860
aeskeygenassist xmm1, xmm2, 8
call fcn.0053b8c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0053b860
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0053b8c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0053b860
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0053b8c0
jmp 0x53bc7d
aeskeygenassist xmm1, xmm0, 1
call fcn.0053b820
aeskeygenassist xmm1, xmm0, 2
call fcn.0053b820
aeskeygenassist xmm1, xmm0, 4
call fcn.0053b820
aeskeygenassist xmm1, xmm0, 8
call fcn.0053b820
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0053b820
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0053b820
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0053b820
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0053b820
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0053b820
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0053b820
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x53bc8a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x53bdc0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x006a10e0]
movdqu xmm14, xmmword [0x006a1310]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x53beab
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x53beab
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x53bf10
ret
Function at 0x53ed60
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x10]
cmp rax, qword [rcx + 0x10]
jbe 0x53effa
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov rcx, qword [rsp + 0xb0]
nop
test rcx, rcx
je 0x53eff4
mov rax, qword [rsp + 0xa0]
cqo
idiv rcx
mov byte [rsp + 0x47], 0
sub rcx, rdx
mov byte [rsp + 0x47], cl
test rcx, rcx
je 0x53efa5
jl 0x53efd8
mov rax, rcx
cqo
idiv rax
nop dword [rax]
cmp rax, 1
jne 0x53efbc
mov qword [rsp + 0x50], rcx
lea rax, [0x00614000]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rcx
call fcn.0044dcc0
mov rcx, qword [rsp + 0x50]
cmp rcx, 1
mov eax, 1
mov rdx, rcx
cmovg rcx, rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x80], rax
lea rbx, [rsp + 0x47]
cmp rbx, rax
je 0x53ee43
jmp 0x53ef73
shl rsi, 1
mov rdx, rbx
mov rcx, rsi
cmp rdx, rcx
jle 0x53ee9d
jb 0x53efb1
mov rbx, rdx
sub rdx, rcx
cmp rcx, rdx
cmovl rdx, rcx
mov rsi, rcx
sub rcx, rbx
sar rcx, 0x3f
and rcx, rsi
lea rdi, [rcx + rax]
test rcx, rcx
je 0x53ee3a
mov qword [rsp + 0x68], rsi
mov qword [rsp], rdi
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
call fcn.0046d6c0
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
jmp 0x53ee3a
mov rcx, qword [rsp + 0xa0]
lea rbx, [rcx + rdx]
mov qword [rsp + 0x68], rbx
mov rsi, qword [rsp + 0xa8]
cmp rsi, rbx
jb 0x53ef1c
mov rdi, qword [rsp + 0x98]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x78], rdi
add rcx, rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
nop
call fcn.0046d6c0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xc8], rax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x70], rax
lea rax, [0x00614000]
mov qword [rsp], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rbx
call fcn.0044ddc0
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x48]
jmp 0x53eec3
mov qword [rsp + 0x58], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
call fcn.0046d6c0
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
nop dword [rax]
jmp 0x53ee43
xor edx, edx
lea rax, [rsp + 0x47]
jmp 0x53ee9d
mov rax, rcx
mov rcx, rdx
call fcn.0046ce80
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a14b0]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a14a0]
mov qword [rsp + 8], rax
call fcn.00438920
call fcn.00436e20
nop
call fcn.0046abe0
nop
jmp fcn.0053ed60