joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9c90
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b9e27
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx eax, byte [0x008b3fe2]
cmp al, 1
jbe 0x4b9ccd
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
jne 0x4b9cd6
call fcn.00429680
ud2
mov byte [0x008b3fe2], 1
call fcn.00496290
call fcn.0045cd90
call fcn.0048c6b0
call fcn.004a91b0
call fcn.0045bcb0
call fcn.0048d9a0
mov byte [rsp + 0x27], 0
lea rax, [0x0066fcc0]
mov qword [rsp], rax
lea rax, [rsp + 0x27]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0049d600
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896eb0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x4b9e0d
mov qword [0x00896eb8], rcx
lea rax, [0x006d9fec]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896ec0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x4b9df6
mov qword [0x00896ec8], rcx
lea rax, [0x006d7de3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896ea0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x4b9ddf
mov qword [0x00896ea8], rcx
mov byte [0x008b3fe2], 2
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00896ea8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x4b9dce
lea rax, [0x00896ec8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x4b9d93
lea rax, [0x00896eb8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x4b9d58
call fcn.00452210
jmp fcn.004b9c90
Function at 0x4c8790
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4c884f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b3fdf]
cmp al, 1
jbe 0x4c87cd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4c87d6
call fcn.00429680
ud2
mov byte [0x008b3fdf], 1
call fcn.0045cd90
call fcn.0048d9a0
call fcn.004a91b0
lea rax, [0x006db0bf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896e80], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x4c8838
mov qword [0x00896e88], rcx
mov byte [0x008b3fdf], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00896e88]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x4c8827
call fcn.00452210
jmp fcn.004c8790

Function at 0x4c8950
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4c8a1a
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x60], 0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jl 0x4c89d1
mov rdx, qword [rax + 0x18]
mov rbx, qword [rax + 8]
sub rbx, rdx
cmp rcx, rbx
jg 0x4c89d1
test rcx, rcx
jne 0x4c89ac
mov qword [rax + 0x18], 0
mov rdx, qword [rax + 0x18]
add rcx, rdx
mov rdx, qword [rax + 0x10]
cmp rcx, rdx
ja 0x4c89ca
mov qword [rax + 8], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00429450
ud2
lea rax, [0x006da135]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x25
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.004c8950
Function at 0x4c9c10
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4c9e4f
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
test rax, rax
jl 0x4c9e06
jle 0x4c9df6
mov rcx, qword [rsp + 0x88]
mov rdx, rax
imul rax, rcx
mov rbx, rdx
cmp rbx, 0xffffffffffffffff
je 0x4c9dec
cqo
idiv rbx
cmp rcx, rax
jne 0x4c9da3
lea rax, [0x0066fcc0]
mov qword [rsp], rax
imul rbx, rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbx
call fcn.0043e630
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x48], rcx
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x30], rdx
mov rbx, qword [rsp + 0x88]
cmp rdx, rbx
jle 0x4c9d9b
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov rsi, qword [rsp + 0x80]
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbx
call fcn.00455480
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x30]
cmp rax, rcx
jge 0x4c9d5e
ja 0x4c9d94
mov rdx, rcx
sub rcx, rax
mov rbx, qword [rsp + 0x38]
mov rsi, rbx
sub rbx, rax
dec rbx
sar rbx, 0x3f
xor rbx, 0xffffffffffffffff
and rbx, rax
mov rdi, qword [rsp + 0x48]
add rbx, rdi
cmp rax, rsi
ja 0x4c9d94
cmp rcx, rax
jle 0x4c9d8a
mov rcx, rax
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rax
call fcn.00455480
mov rax, qword [rsp + 0x40]
shl rax, 1
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x30]
cmp rax, rcx
jl 0x4c9cfa
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rcx
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, rcx
mov rcx, qword [rsp + 0x40]
jmp 0x4c9d34
call fcn.00429450
ud2
mov rbx, rdx
jmp 0x4c9cc6
lea rax, [0x006d9923]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x23
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
neg rax
xor edx, edx
jmp 0x4c9c70
mov rcx, qword [rsp + 0x88]
mov rbx, rax
jmp 0x4c9c79
lea rax, [0x006d7382]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x1c
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.004c9c10
Function at 0x4d7f40
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4d80b0
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x60]
lea rdx, [rax + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rdx, [rax + rdx + 7]
sar rdx, 3
mov rbx, qword [rsp + 0x50]
cmp rdx, rbx
jg 0x4d8079
ja 0x4d8072
mov rcx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
mov rdi, rax
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
test rax, rax
jle 0x4d8009
lea r11, [rax - 1]
cmp r11, rdi
jae 0x4d806b
movzx eax, byte [rsi + rax - 1]
mov r12, rcx
mov rcx, r8
shl rax, cl
cmp rcx, 0x40
sbb r13, r13
and rax, r13
or rax, r10
lea r10, [rcx + 8]
cmp rcx, 0x38
jne 0x4d8060
cmp r9, rdx
jae 0x4d8059
mov qword [r12 + r9*8], rax
lea rax, [r9 + 1]
xor ecx, ecx
xor r8d, r8d
mov r9, rax
mov r10, r8
mov rax, r11
mov r8, rcx
mov rcx, r12
test rax, rax
jg 0x4d7fb1
cmp r9, rdx
jge 0x4d8014
jae 0x4d8052
mov qword [rcx + r9*8], r10
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rbx
call fcn.004d1000
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.004293e0
ud2
call fcn.004293e0
ud2
mov rcx, r10
mov r8, rax
mov rax, r9
jmp 0x4d7ff5
call fcn.004293e0
ud2
call fcn.00429450
ud2
lea rcx, [0x0066f540]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
lea rcx, [rdx + 4]
mov qword [rsp + 0x10], rcx
call fcn.0043e630
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x60]
jmp 0x4d7f9b
call fcn.00452210
jmp fcn.004d7f40

Function at 0x4db4f0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4db5bc
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jae 0x4db573
mov rcx, qword [0x008976f8]
mov rdx, qword [0x008976f0]
cmp rax, rcx
jae 0x4db56c
lea rcx, [rdx + rax*8]
mov ebx, dword [0x008b4340]
test ebx, ebx
jne 0x4db557
mov rcx, qword [rsp + 0x48]
mov qword [rdx + rax*8], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp], rcx
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x4db54d
call fcn.004293e0
ud2
lea rax, [0x006dbf02]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x2d
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.004db4f0
Function at 0x4e20a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e21b3
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x50]
cmp rax, 0x40
jne 0x4e216a
lea rcx, [0x006aed00]
mov qword [rsp], rcx
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x20], rax
mov dword [rax + 0x140], 0x3d
test byte [rax], al
mov qword [rsp], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
call fcn.00455480
mov rax, qword [rsp + 0x20]
xor ecx, ecx
cmp rcx, 0x100
jge 0x4e213a
mov byte [rax + rcx + 0x40], 0xff
inc rcx
cmp rcx, 0x100
jl 0x4e2129
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
xor ebx, ebx
cmp rbx, rcx
jge 0x4e215b
movzx esi, byte [rdx + rbx]
mov byte [rax + rsi + 0x40], bl
inc rbx
cmp rbx, rcx
jl 0x4e214b
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006da591]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x26
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.004e20a0

Function at 0x4e2e70
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x18]
cmp rax, qword [rcx + 0x10]
jbe 0x4e3018
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rax + 0x140]
cmp ecx, 0xffffffff
jne 0x4e2ff1
mov rcx, qword [rsp + 0xb0]
lea rdx, [rcx + rcx*2]
shl rdx, 1
mov rbx, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rbx
sar rdx, 3
lea rbx, [0x0066fcc0]
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdx
call fcn.0043e630
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x60], rcx
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x88], rdx
lea rbx, [rsp + 0x68]
mov qword [rsp], rbx
mov rbx, qword [rsp + 0xa8]
mov qword [rsp + 8], rbx
mov rbx, qword [rsp + 0xb0]
mov qword [rsp + 0x10], rbx
call fcn.00442830
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0xa0]
mov qword [rsp], rbx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 8], rbx
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
call fcn.004e26e0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
cmp rdx, rbx
ja 0x4e2fea
mov rsi, qword [rsp + 0x88]
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xd8], rax
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
call fcn.00429450
ud2
mov rcx, qword [rsp + 0xb0]
mov rbx, rcx
sar rcx, 0x3f
shr rcx, 0x3e
lea rsi, [rbx + rcx]
sar rsi, 2
lea rdx, [rsi + rsi*2]
mov rcx, rbx
jmp 0x4e2ede
call fcn.00452210
jmp fcn.004e2e70
Function at 0x4e3090
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0xe8]
cmp rax, qword [rcx + 0x10]
jbe 0x4e3295
sub rsp, 0x168
mov qword [rsp + 0x160], rbp
lea rbp, [rsp + 0x160]
movzx eax, byte [0x008b3fde]
cmp al, 1
jbe 0x4e30e4
mov rbp, qword [rsp + 0x160]
add rsp, 0x168
ret
jne 0x4e30ed
call fcn.00429680
ud2
mov byte [0x008b3fde], 1
call fcn.0045cd90
call fcn.00496290
lea rax, [0x006de8bd]
mov qword [rsp], rax
mov qword [rsp + 8], 0x40
call fcn.004e20a0
mov rax, qword [rsp + 0x10]
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4e327b
mov qword [0x008962c0], rax
lea rax, [0x006de8fd]
mov qword [rsp], rax
mov qword [rsp + 8], 0x40
call fcn.004e20a0
mov rax, qword [rsp + 0x10]
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4e3261
mov qword [0x008962c8], rax
mov rax, qword [0x008962c0]
mov rcx, qword [rax]
mov qword [rsp], rcx
lea rdi, [rsp + 8]
mov qword [rsp + 0x158], rdi
lea rsi, [rax + 8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004550c8
mov rbp, qword [rbp]
mov dword [rsp + 0x148], 0xffffffff
call fcn.004e21c0
mov rax, qword [rsp + 0x150]
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4e3247
mov qword [0x008962b0], rax
mov rax, qword [0x008962c8]
mov rcx, qword [rax]
mov qword [rsp], rcx
lea rsi, [rax + 8]
mov rdi, qword [rsp + 0x158]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004550c8
mov rbp, qword [rbp]
mov dword [rsp + 0x148], 0xffffffff
call fcn.004e21c0
mov rax, qword [rsp + 0x150]
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4e3230
mov qword [0x008962b8], rax
mov byte [0x008b3fde], 2
mov rbp, qword [rsp + 0x160]
add rsp, 0x168
ret
lea rcx, [0x008962b8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x4e3219
lea rcx, [0x008962b0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x4e31c3
lea rcx, [0x008962c8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x4e3164
lea rcx, [0x008962c0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x4e3131
call fcn.00452210
jmp fcn.004e3090
Function at 0x4e89e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e8b2e
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
lea rcx, [rax - 1]
cmp rcx, 0xff
ja 0x4e8ae8
lea rcx, [0x0069dc60]
mov qword [rsp], rcx
call fcn.0040f840
mov rax, qword [rsp + 8]
xor ecx, ecx
cmp rcx, 0x100
jge 0x4e8a4d
mov dword [rax + rcx*4], ecx
inc rcx
cmp rcx, 0x100
jl 0x4e8a3e
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
xor ebx, ebx
xor esi, esi
cmp rbx, 0x100
jge 0x4e8ab2
mov edi, dword [rax + rbx*4]
test rdx, rdx
je 0x4e8ae1
mov r8, rax
mov rax, rbx
mov r9, rdx
cmp r9, 0xffffffffffffffff
je 0x4e8ada
cqo
idiv r9
cmp rdx, r9
jae 0x4e8ad3
movzx r10d, byte [rcx + rdx]
add r10d, edi
add esi, r10d
movzx r10d, sil
mov r11d, dword [r8 + r10*4]
mov dword [r8 + rbx*4], r11d
mov dword [r8 + r10*4], edi
inc rbx
mov rax, r8
mov rdx, r9
cmp rbx, 0x100
jl 0x4e8a64
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004293e0
ud2
neg rax
xor edx, edx
jmp 0x4e8a80
call fcn.004294c0
ud2
mov qword [rsp + 0x20], rax
lea rax, [0x007e5580]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040cd80
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00452210
jmp fcn.004e89e0
Function at 0x4ef8a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4ef987
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b4017]
cmp al, 1
jbe 0x4ef8dd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4ef8e6
call fcn.00429680
ud2
mov byte [0x008b4017], 1
call fcn.004cb700
call fcn.004eacf0
call fcn.0045cd90
call fcn.0048c6b0
call fcn.004e78c0
call fcn.00451ac0
call fcn.00496290
call fcn.004c82e0
call fcn.0045bcb0
call fcn.0046a3f0
lea rax, [0x006d998c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00897570], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x4ef970
mov qword [0x00897578], rcx
call fcn.004ee790
mov byte [0x008b4017], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00897578]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x4ef95a
call fcn.00452210
jmp fcn.004ef8a0
Function at 0x4f93e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x4f94f6
mov rcx, qword [rsp + 0x18]
movzx edx, byte [rcx]
cmp dl, 0x30
jb 0x4f94f6
cmp dl, 0x39
ja 0x4f94f6
cmp rax, 2
jl 0x4f9431
cmp dl, 0x30
jne 0x4f9431
movzx edx, byte [rcx + 1]
cmp dl, 0x30
jb 0x4f9431
cmp dl, 0x39
jbe 0x4f94cd
mov rdx, rax
mov rbx, rcx
test rax, rax
je 0x4f9466
movzx esi, byte [rcx]
cmp sil, 0x30
jb 0x4f9466
cmp sil, 0x39
ja 0x4f9466
lea rsi, [rax - 2]
sar rsi, 0x3f
xor rsi, 0xffffffffffffffff
and rsi, 1
add rcx, rsi
dec rax
test rax, rax
jne 0x4f943c
mov rsi, rdx
sub rdx, rax
cmp rdx, rsi
ja 0x4f94c6
xor esi, esi
xor edi, edi
cmp rsi, rdx
jge 0x4f949d
cmp rdi, 0x5f5e100
jge 0x4f94bd
lea r8, [rsi + 1]
movzx r9d, byte [rbx + rsi]
lea r10, [rdi + rdi*4]
lea rdi, [r9 + r10*2 - 0x30]
mov rsi, r8
cmp rsi, rdx
jl 0x4f947a
mov rdx, rdi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], 1
mov rbp, qword [rsp]
add rsp, 8
ret
mov rdx, 0xffffffffffffffff
jmp 0x4f94a0
call fcn.00429450
ud2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x40], 0
mov rbp, qword [rsp]
add rsp, 8
ret
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x40], 0
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x4fd2c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4fd3f7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
xor eax, eax
xor ecx, ecx
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x78]
cmp rax, rdi
jge 0x4fd352
lea r8, [rax + 1]
cmp r8, rdi
jae 0x4fd3f0
mov r8, qword [rsp + 0x70]
mov r9d, dword [r8 + rax*4 + 4]
mov dword [rsp + 0x3c], r9d
cmp rax, rdi
jae 0x4fd3f0
mov r10d, dword [r8 + rax*4]
dec r10d
cmp ecx, r10d
jle 0x4fd3ac
add rax, 2
lea ecx, [r9 + 1]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x78]
cmp rax, rdi
jl 0x4fd30a
cmp ecx, 0x10ffff
jle 0x4fd37c
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rsi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], 0x10ffff
call fcn.004fccb0
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
jmp 0x4fd35a
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], r10d
call fcn.004fccb0
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x3c]
jmp 0x4fd33b
call fcn.004293e0
ud2
call fcn.00452210
jmp fcn.004fd2c0
Function at 0x4fd410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4fd67d
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x58], rdx
xor ebx, ebx
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rcx
cmp rbx, rdx
jge 0x4fd51e
movzx r9d, word [rcx + 4]
mov dword [rsp + 0x4c], r9d
movzx r10d, word [rcx + 2]
mov dword [rsp + 0x48], r10d
movzx r11d, word [rcx]
cmp r9d, 1
je 0x4fd635
mov dword [rsp + 0x44], r11d
cmp r11d, r10d
jg 0x4fd504
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r11d
call fcn.004fccb0
mov r9d, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x44]
lea r11d, [rax + r9]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r10d, dword [rsp + 0x48]
mov dword [rsp + 0x44], r11d
cmp r11d, r10d
jle 0x4fd4a5
add rcx, 6
inc rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rcx
cmp rbx, rdx
jl 0x4fd479
mov rcx, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x58], rax
xor edx, edx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x60], rcx
cmp rdx, rax
jge 0x4fd5d6
mov ebx, dword [rcx + 8]
mov dword [rsp + 0x38], ebx
mov r9d, dword [rcx + 4]
mov dword [rsp + 0x3c], r9d
mov r10d, dword [rcx]
cmp ebx, 1
je 0x4fd5f8
mov dword [rsp + 0x40], r10d
cmp r10d, r9d
jg 0x4fd5bc
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r10d
call fcn.004fccb0
mov eax, dword [rsp + 0x40]
mov ebx, dword [rsp + 0x38]
lea r10d, [rbx + rax]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x3c]
mov dword [rsp + 0x40], r10d
cmp r10d, r9d
jle 0x4fd566
add rcx, 0xc
inc rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x60], rcx
cmp rdx, rax
jl 0x4fd540
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], r8
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r9d
call fcn.004fccb0
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
jmp 0x4fd5bc
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r10d
call fcn.004fccb0
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
jmp 0x4fd504
call fcn.00452210
jmp fcn.004fd410
Function at 0x517c60
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x517d1f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b3fe0]
cmp al, 1
jbe 0x517c9d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x517ca6
call fcn.00429680
ud2
mov byte [0x008b3fe0], 1
call fcn.004cb700
call fcn.004b9c90
call fcn.0045cd90
lea rax, [0x006d9969]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896e90], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x517d08
mov qword [0x00896e98], rcx
mov byte [0x008b3fe0], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00896e98]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x517cf7
call fcn.00452210
jmp fcn.00517c60