joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57a580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57a779
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
cmp cx, 0x1d
jne 0x57a6aa
lea rax, [0x005fe2e0]
mov ebx, 0x20
mov rcx, rbx
nop
call fcn.00448e60
mov qword [rsp + 0x60], rax
mov rbx, qword [rsp + 0x80]
mov rcx, rax
mov edi, 0x20
mov rsi, rdi
mov rax, qword [rsp + 0x78]
call fcn.00487160
test rbx, rbx
jne 0x57a696
mov rdi, qword [0x007e0980]
mov rsi, qword [0x007e0988]
mov r8, qword [0x007e0990]
mov rax, qword [rsp + 0x60]
mov ebx, 0x20
mov rcx, rbx
call fcn.0055e340
test rdi, rdi
je 0x57a630
xor eax, eax
xor ebx, ebx
mov rcx, rdi
mov rdi, rsi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x006190a0]
call fcn.0040d1e0
mov qword [rax + 8], 0x20
mov qword [rax + 0x10], 0x20
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x18], rcx
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x006870b8]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
mov rdi, rcx
mov rcx, rbx
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov word [rsp + 0x88], cx
mov eax, ecx
call fcn.0057a7c0
nop dword [rax]
test cl, cl
je 0x57a754
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbx
lea rax, [0x00628b60]
call fcn.0040d1e0
mov qword [rsp + 0x48], rax
movzx ecx, word [rsp + 0x88]
mov word [rax + 0x28], cx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rax, qword [rsp + 0x58]
call fcn.0050a1c0
mov rdx, qword [rsp + 0x48]
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rcx
mov qword [rdx], rax
mov qword [rdx + 0x18], rdi
mov qword [rdx + 0x20], rsi
test r8, r8
je 0x57a73c
xor eax, eax
xor ebx, ebx
mov rcx, r8
mov rdi, r9
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x00687088]
mov rbx, rdx
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x00652c5e]
mov ebx, 0x26
call fcn.00468600
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x18], cx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, word [rsp + 0x18]
nop dword [rax]
jmp fcn.0057a580
Function at 0x57bf80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57c0d7
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movzx edx, word [rsp + 0xe0]
cmp dx, 0x303
jae 0x57bfab
cmp al, 0xe4
jne 0x57bfe7
cmp qword [rsp + 0xc8], 0
je 0x57c0c3
cmp al, 0xe4
je 0x57bfc5
cmp dx, 0x303
jmp 0x57bfec
mov rax, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
cmp dx, 0x303
jae 0x57c062
cmp al, 0xe3
jne 0x57c019
mov rdx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rdx + 0x30]
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rax, qword [rsp + 0x88]
mov qword [rsp], rax
lea rdi, [rsp + 8]
lea rsi, [rsp + 0x90]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00461c4c
mov rbp, qword [rbp]
call fcn.0057bc80
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rax, rbx
call fcn.004d32e0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov rcx, qword [rax + 0x38]
mov rdx, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rax, rbx
mov rbx, rdx
mov r9, rcx
mov rcx, rsi
call r9
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + 0x30]
mov rax, qword [rsp + 0x70]
xor ebx, ebx
xor edi, edi
mov rdx, rcx
mov rcx, rdi
call rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x005fe120]
lea rbx, [0x006848e0]
call fcn.00436780
nop
mov byte [rsp + 0x70], al
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
call fcn.0045f280
movzx eax, byte [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
nop
jmp fcn.0057bf80
Function at 0x57e8c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57ea1e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov ebx, 0xa
call fcn.0057e6e0
mov rdx, qword [0x007df7a8]
cmp qword [0x007df7a0], rdi
jne 0x57e9a0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x28], rsi
mov rax, rdi
mov rbx, rsi
mov rcx, rdx
nop dword [rax]
call fcn.00403f40
test al, al
je 0x57e986
mov rdx, qword [rsp + 0x18]
test rdx, rdx
je 0x57e965
mov rax, qword [rsp + 0x30]
movzx r9d, byte [rdx + rax - 1]
nop
cmp r9b, 0xd
jne 0x57e96a
mov r9, qword [rsp + 0x50]
mov r10, qword [r9 + 0x28]
test r10, r10
je 0x57ea0a
dec r10
mov qword [r9 + 0x28], r10
lea rbx, [rdx - 1]
jmp 0x57e96d
mov rax, qword [rsp + 0x30]
mov rbx, rdx
mov rcx, qword [rsp + 0x20]
mov edi, 1
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
nop
test rbx, rbx
je 0x57e9df
movzx edx, byte [rbx + rax - 1]
cmp dl, 0xa
jne 0x57e9ce
cmp rbx, 1
jle 0x57e9c6
movzx edx, byte [rbx + rax - 2]
cmp dl, 0xd
jne 0x57e9c6
mov edx, 2
jmp 0x57e9cb
mov edx, 1
sub rbx, rdx
xor edi, edi
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test rdi, rdi
mov edx, 0
cmovne rcx, rdx
cmovne rbx, rdx
mov edx, 0
cmovne rax, rdx
mov r8, rsi
mov rsi, rdi
xor edi, edi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x005fe120]
lea rbx, [0x006845f0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0057e8c0
Function at 0x581ac0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x581bdc
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
nop dword [rax]
call fcn.00582440
test rbx, rbx
je 0x581bc1
test rdi, rdi
je 0x581bb3
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdi
mov rax, rcx
mov rbx, rdi
lea rcx, [0x00644399]
mov edi, 1
call fcn.004ce380
test al, al
je 0x581b98
mov rcx, qword [rsp + 0x20]
lea rbx, [rcx - 1]
mov rcx, rbx
neg rbx
sar rbx, 0x3f
and ebx, 1
mov rdx, qword [rsp + 0x28]
lea rax, [rdx + rbx]
mov rbx, rcx
nop
call fcn.00582440
test rbx, rbx
je 0x581b7d
test rdi, rdi
je 0x581b6f
lea rax, [0x006549d1]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00468600
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00650321]
mov ebx, 0x20
call fcn.00468600
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00652ba0]
mov ebx, 0x26
call fcn.00468600
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00649999]
mov ebx, 0x13
call fcn.00468600
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00581ac0
Function at 0x582900
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x582b4c
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
xor ecx, ecx
xor edx, edx
jmp 0x582931
mov rcx, rsi
cmp rbx, rcx
jle 0x582a4c
movzx esi, byte [rax + rcx]
nop
cmp sil, 0x25
je 0x58294c
lea rsi, [rcx + 1]
jmp 0x58292e
lea rsi, [rcx + 2]
cmp rbx, rsi
jg 0x58295c
mov esi, 1
jmp 0x5829cd
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x38], rdx
movzx edx, byte [rax + rcx + 1]
mov eax, edx
call fcn.00582b80
test al, al
jne 0x582997
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x88]
mov esi, 1
jmp 0x5829cd
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x80]
movzx eax, byte [rdx + rcx + 2]
call fcn.00582b80
xor eax, 1
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x88]
mov esi, eax
mov rax, qword [rsp + 0x80]
test sil, sil
jne 0x5829de
inc rdx
lea rsi, [rcx + 3]
jmp 0x58292e
movups xmmword [rsp + 0x60], xmm15
sub rbx, rcx
cmp rbx, 3
mov edx, 3
mov rsi, rbx
cmovg rbx, rdx
neg rsi
sar rsi, 0x3f
and rcx, rsi
add rax, rcx
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
lea rax, [0x00651941]
mov ebx, 0x23
lea rcx, [rsp + 0x60]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
test rdx, rdx
je 0x582a89
shl rdx, 1
mov rcx, rbx
sub rcx, rdx
mov qword [rsp + 0x30], rcx
lea rax, [0x005fe2e0]
mov rbx, rcx
call fcn.00448e60
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
xor ebx, ebx
xor esi, esi
jmp 0x582aa0
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rbx, rdi
nop word [rax + rax]
cmp rcx, rbx
jle 0x582b2f
movzx edi, byte [rdx + rbx]
cmp dil, 0x25
je 0x582ac2
mov byte [rax + rsi], dil
inc rsi
lea rdi, [rbx + 1]
nop
jmp 0x582a97
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rsi
movzx eax, byte [rdx + rbx + 1]
call fcn.00582bc0
mov byte [rsp + 0x2f], al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
movzx ebx, byte [rdx + rcx + 2]
mov eax, ebx
call fcn.00582bc0
movzx ecx, byte [rsp + 0x2f]
shl ecx, 4
or ecx, eax
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
mov byte [rbx + rdx], cl
lea rsi, [rdx + 1]
mov rcx, qword [rsp + 0x48]
lea rdi, [rcx + 3]
mov rax, rbx
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
jmp 0x582a97
mov rbx, rax
mov rcx, qword [rsp + 0x30]
xor eax, eax
call fcn.0044cd60
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00582900
Function at 0x584840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5849c9
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
nop dword [rax]
cmp rbx, 2
jl 0x584913
movzx ecx, byte [rax]
cmp byte [rax + 1], 0x3a
jne 0x584894
lea edx, [rcx - 0x61]
cmp dl, 0x19
jbe 0x584885
lea edx, [rcx - 0x41]
nop
cmp dl, 0x19
ja 0x584894
mov eax, 2
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
nop
cmp rbx, 5
jge 0x5848aa
xor ecx, ecx
jmp 0x5848c0
mov eax, ecx
call fcn.00584820
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x20]
nop dword [rax]
test cl, cl
jne 0x5848c8
xor ecx, ecx
jmp 0x584902
movzx ecx, byte [rax + 1]
mov eax, ecx
call fcn.00584820
test al, al
jne 0x5848e5
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
jmp 0x584902
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + 2]
call fcn.00584820
xor eax, 1
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x20]
test cl, cl
je 0x58491f
cmp byte [rax + 2], 0x2e
je 0x58491f
mov ecx, 3
jmp 0x58493e
xor eax, eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rdx, qword [rsp + 8]
lea rcx, [rdx + 1]
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
lea rdx, [rbx - 1]
cmp rcx, rdx
jge 0x58491f
mov qword [rsp + 8], rcx
movzx edx, byte [rcx + rax]
mov eax, edx
call fcn.00584820
test al, al
je 0x58492b
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
movzx eax, byte [rdx + rcx + 1]
call fcn.00584820
test al, al
jne 0x58491f
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
movzx ebx, byte [rdx + rcx + 1]
cmp bl, 0x2e
je 0x58491f
inc rdx
jmp 0x58499a
mov rbx, qword [rsp + 8]
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
nop
cmp rbx, rdx
jle 0x5849bc
mov qword [rsp + 8], rdx
movzx eax, byte [rdx + rcx]
call fcn.00584820
test al, al
je 0x58498c
mov rdx, qword [rsp + 8]
mov rax, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00584840

Function at 0x586340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x586381
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov ebx, 0xa
call fcn.0046ea40
mov ecx, 0x23
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00651892]
call fcn.0044c9c0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.00586340
Function at 0x588d20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x588df5
movdqa xmm0, xmmword [0x00684c20]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x588d61
movdqa xmm0, xmmword [0x00684c30]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x588e77
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x588e4b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00684328]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00685000]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x58d5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x58d7ce
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov rcx, qword [rax + 0x2c8]
mov qword [rsp + 0x58], rcx
mov rdi, qword [rax + 0x2d0]
mov qword [rsp + 0x40], rdi
mov rsi, qword [rax + 0x2d8]
mov qword [rsp + 0x48], rsi
mov edx, 1
jmp 0x58d640
inc rdx
nop dword [rax]
cmp rdx, rdi
jl 0x58d649
xor ebx, ebx
jmp 0x58d678
mov qword [rsp + 0x30], rdx
movzx eax, byte [rcx + rdx]
call fcn.00469740
xor eax, 1
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov ebx, eax
mov rax, qword [rsp + 0x98]
test bl, bl
jne 0x58d639
jmp 0x58d6a4
movzx r9d, byte [rsp + 0x39]
mov r10, qword [rsp + 0x30]
lea rdx, [r9 + r10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
cmp rdx, rdi
jge 0x58d7ab
mov qword [rsp + 0x30], rdx
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
mov r9, qword [rax + 0x1a0]
mov r10, qword [r9]
mov r11, qword [rsp + 0x60]
xor ebx, ebx
mov r8, rdx
mov rdx, r9
mov rax, r11
call r10
mov byte [rsp + 0x50], al
mov byte [rsp + 0x51], bl
mov byte [rsp + 0x52], cl
mov byte [rsp + 0x53], dil
mov byte [rsp + 0x54], sil
mov byte [rsp + 0x55], r8b
mov word [rsp + 0x56], r9w
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x38], r9
movzx eax, byte [rsp + 0x38]
movzx ebx, byte [rsp + 0x39]
movzx ecx, byte [rsp + 0x3a]
movzx edi, byte [rsp + 0x3b]
movzx esi, byte [rsp + 0x3c]
movzx r8d, byte [rsp + 0x3d]
movzx r9d, word [rsp + 0x3e]
call fcn.0058c280
test al, al
je 0x58d67e
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
sub rdx, rbx
mov rsi, qword [rsp + 0x98]
mov qword [rsi + 0x2d0], rdx
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
sub rcx, rbx
mov qword [rsi + 0x2d8], rcx
neg rcx
sar rcx, 0x3f
and rcx, rbx
mov rax, qword [rsp + 0x58]
lea rdi, [rax + rcx]
mov qword [rsi + 0x2c8], rdi
mov rcx, rdx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rdx, qword [rax + 0x1a8]
mov qword [rax + 0x2b0], rdx
mov rcx, qword [rdx]
call rcx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.0058d5e0

Function at 0x593da0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x593df3
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp eax, 0x1a
jb 0x593dd2
lea ecx, [rax - 0x1a]
nop dword [rax]
cmp ecx, 0xa
jae 0x593ddf
add eax, 0x16
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
add eax, 0x61
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x006852f0]
call fcn.00436780
nop
mov dword [rsp + 8], eax
call fcn.0045f280
mov eax, dword [rsp + 8]
jmp fcn.00593da0
Function at 0x595ee0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x595f38
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movups xmmword [rsp + 0x28], xmm15
call fcn.0040a7c0
lea rcx, [0x005fd960]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x00653022]
mov ebx, 0x27
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004af1a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.00595ee0

Function at 0x5970a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5971e1
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
cmp byte [rax + 0x98], 0
nop
jne 0x5970cc
cmp dword [rax + 0x30], 0
ja 0x59719b
mov qword [rsp + 0x58], rax
mov rbx, qword [rax + 0x58]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rax + 0x68]
mov eax, 5
call fcn.00597200
test rsi, rsi
jne 0x59718b
mov rdx, qword [rsp + 0x58]
mov esi, dword [rdx + 0x38]
cmp rax, rsi
jbe 0x597143
lea rax, [0x006517e3]
mov ebx, 0x23
call fcn.00468600
movups xmmword [rsp + 0x38], xmm15
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
lea rax, [0x00618100]
lea rbx, [rsp + 0x38]
call fcn.0040a5c0
mov rbx, rax
lea rax, [0x006861c0]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rbx
mov rbx, rax
mov rax, rdx
call fcn.00596240
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x60], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rdx + 0x68], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rdx + 0x58], rcx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
mov rbx, r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00658869]
mov ebx, 0x47
call fcn.00468600
movups xmmword [rsp + 0x38], xmm15
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
lea rax, [0x00618100]
lea rbx, [rsp + 0x38]
call fcn.0040a5c0
mov rbx, rax
lea rax, [0x006861c0]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.005970a0
Function at 0x59a200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59a2e1
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, qword [rbx]
mov rsi, qword [rbx + 8]
nop
cmp rsi, 5
jne 0x59a240
cmp dword [rdx], 0x70747468
jne 0x59a240
cmp byte [rdx + 4], 0x73
jne 0x59a240
mov rdx, qword [rax + 0x38]
jmp 0x59a283
cmp rsi, 4
jne 0x59a281
cmp dword [rdx], 0x70747468
jne 0x59a281
mov rdx, qword [rax + 0x40]
test rdx, rdx
je 0x59a283
cmp byte [rax + 0x30], 0
je 0x59a283
lea rax, [0x00658fcd]
mov ebx, 0x52
call fcn.00468600
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
nop
ret
xor edx, edx
test rdx, rdx
je 0x59a2d1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x18], rdx
mov rax, rbx
call fcn.0059ad20
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x30]
call fcn.0059a4c0
test al, al
je 0x59a2c1
mov rax, qword [rsp + 0x18]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0059a200
Function at 0x59fa60
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x59fc96
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], rax
xor edx, edx
jmp 0x59fae3
mov r8, qword [rsp + 0x50]
lea rdx, [r8 + 1]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xb8]
cmp rsi, rdx
jle 0x59fbb3
mov qword [rsp + 0x50], rdx
mov rbx, qword [rcx]
movzx eax, byte [rdi + rdx]
mov rdx, rcx
call rbx
nop dword [rax]
test al, al
jne 0x59fab2
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xb8]
movzx ecx, byte [rdx + rcx]
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
lea rsi, [0x005fe2e0]
mov qword [rsp + 0x70], rsi
lea rdi, [0x007b5d40]
lea rcx, [rdi + rcx*8]
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, [0x00657229]
mov ebx, 0x37
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
call fcn.004d1140
lea rax, [0x005fe2e0]
xor ebx, ebx
mov rcx, qword [rsp + 0xc0]
nop dword [rax + rax]
call fcn.00448e60
xor ecx, ecx
xor edx, edx
mov rbx, qword [rsp + 0xc0]
jmp 0x59fbd8
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov r8, qword [rsp + 0x48]
lea rcx, [r8 + 1]
mov rdx, rsi
mov rbx, rdi
mov rsi, qword [rsp + 0xc0]
cmp rsi, rcx
jle 0x59fc79
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsp + 0xb8]
movzx eax, byte [rbx + rcx]
mov byte [rsp + 0x47], al
mov rdx, qword [rsp + 0xb0]
mov rsi, qword [rdx]
call rsi
test al, al
je 0x59fc65
mov rcx, qword [rsp + 0x58]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x60]
cmp rdi, rsi
jb 0x59fc38
mov rax, qword [rsp + 0x68]
jmp 0x59fc55
lea rax, [0x005fe2e0]
mov rbx, qword [rsp + 0x68]
call fcn.00448f20
lea rsi, [rbx + 1]
mov rdi, rcx
mov rcx, qword [rsp + 0x58]
movzx r8d, byte [rsp + 0x47]
mov byte [rax + rcx], r8b
nop
jmp 0x59fbc9
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
jmp 0x59fbc9
mov rbx, rax
mov rcx, rdx
xor eax, eax
call fcn.0044cd60
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0059fa60