joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f18f1
sub esp, 0x24
xor eax, eax
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
mov ebp, dword [esp + 0x30]
cmp eax, ebp
jge 0x4f18ed
mov esi, dword [ecx]
shl edx, 1
mov word [esp + 0x12], dx
test eax, eax
jne 0x4f17bc
add ecx, 4
inc eax
jmp 0x4f1795
test esi, esi
jne 0x4f17c2
jmp 0x4f17b6
mov edi, ebx
sub ebx, esi
mov dword [esp + 0x3c], ebx
cmp ebx, edi
ja 0x4f18e6
mov esi, dword [esp + 0x28]
test byte [esi], al
lea ebp, [esi + 0x5c]
mov dword [esp], ebp
mov ebp, dword [esp + 0x40]
sub ebp, ebx
shl ebx, 3
lea ecx, [ebp - 1]
sar ecx, 0x1f
xor ecx, 0xffffffff
and ebx, ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x38]
lea esi, [ebx + ecx]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x3c]
sub edi, esi
mov dword [esp + 0x18], edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
call dbg.compress/flate.(*byLiteral).sort
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x38]
lea eax, [ecx + eax]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x28]
movzx esi, word [esp + 0x12]
xor edi, edi
mov word [esp + 0x10], si
cmp edi, ebx
jge 0x4f18b7
lea ebx, [edx - 0x10]
neg ebx
mov ecx, ebx
shl esi, cl
cmp cl, 0x20
sbb ebx, ebx
and ebx, esi
mov esi, ebx
and ebx, 0xff
mov ecx, edi
lea edi, [0x72ad40]
movzx ebx, byte [edi + ebx]
shr si, 8
movzx esi, si
movzx esi, byte [edi + esi]
mov edi, dword [ebp]
shl ebx, 8
or ebx, esi
movzx esi, word [eax]
mov ebp, dword [ebp + 4]
cmp esi, ebp
jae 0x4f18df
shl esi, 2
mov word [edi + esi], bx
mov word [edi + esi + 2], dx
add eax, 8
lea edi, [ecx + 1]
movzx ecx, word [esp + 0x10]
lea esi, [ecx + 1]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x28]
mov word [esp + 0x10], si
cmp edi, ebx
jl 0x4f183f
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
cmp eax, ebx
ja 0x4f18d8
mov eax, edx
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov edx, esi
mov ebx, dword [esp + 0x3c]
jmp 0x4f17b6
call dbg.runtime.panicslice
ud2
call dbg.runtime.panicindex
ud2
call dbg.runtime.panicslice
ud2
add esp, 0x24
ret
call dbg.runtime.morestack_noctxt
jmp dbg.compress/flate.(*huffmanEncoder).assignEncodingAndSize
Function at 0x4f5710
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f575b
mov eax, dword [esp + 4]
not eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xor ebp, ebp
cmp ebp, ecx
jge 0x4f5754
test byte [edx], al
movzx esi, byte [ebx]
inc ebx
inc ebp
xor esi, eax
xchg esi, eax
movzx eax, al
xchg esi, eax
mov esi, dword [edx + esi*4]
shr eax, 8
xor eax, esi
cmp ebp, ecx
jl 0x4f573a
not eax
mov dword [esp + 0x18], eax
ret
call dbg.runtime.morestack_noctxt
jmp dbg.hash/crc32.simpleUpdate

Function at 0x4f5770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f581b
sub esp, 0xc
lea eax, [0x5ff1c0]
mov dword [esp], eax
call dbg.runtime.newobject
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call dbg.hash/crc32.simplePopulateTable
mov eax, dword [esp + 8]
xor ecx, ecx
cmp ecx, 0x100
jge 0x4f5805
test byte [eax], al
cmp ecx, 0x100
jae 0x4f5814
mov edx, dword [eax + ecx*4]
mov ebx, 1
cmp ebx, 8
jge 0x4f57fc
mov ebp, edx
and edx, 0xff
mov edx, dword [eax + edx*4]
shr ebp, 8
xor edx, ebp
cmp ebx, 8
jae 0x4f580d
mov ebp, ebx
shl ebx, 0xa
lea esi, [eax + ebx]
mov dword [esi + ecx*4], edx
lea ebx, [ebp + 1]
cmp ebx, 8
jl 0x4f57d4
inc ecx
cmp ecx, 0x100
jl 0x4f57bd
mov dword [esp + 0x14], eax
add esp, 0xc
ret
call dbg.runtime.panicindex
ud2
call dbg.runtime.panicindex
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.hash/crc32.slicingMakeTable
Function at 0x505270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50540e
sub esp, 0x70
mov eax, dword [0x7d17e4]
mov ecx, dword [0x7cd828]
mov dword [esp], ecx
lea ecx, [0x727240]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
call dbg.net.(*Resolver).LookupIPAddr
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
test edx, edx
jne 0x5053de
lea edx, [0x62cf00]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call dbg.runtime.makeslice
mov eax, dword [esp + 0xc]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x2c], edx
xor ebx, ebx
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x44], ebp
mov esi, edx
mov edx, dword [esp + 0x34]
cmp ebx, edx
jge 0x5053b2
test byte [ebp], al
lea edi, [esp + 0x5c]
mov esi, ebp
call fcn.0044a34e
lea edi, [esp + 0x48]
lea esi, [esp + 0x5c]
call fcn.0044a34e
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x40], ecx
mov esi, edx
mov edx, dword [esp + 0x4c]
mov edi, ebp
mov ebp, dword [esp + 0x50]
mov ecx, dword [esp + 0x28]
cmp ebx, ecx
jae 0x5053ab
lea ecx, [ebx + ebx*2]
mov dword [eax + ecx*4 + 4], edx
mov dword [eax + ecx*4 + 8], ebp
mov edx, dword [0x7e38e0]
lea ebp, [eax + ecx*4]
test edx, edx
jne 0x505389
mov edx, dword [esp + 0x40]
mov dword [eax + ecx*4], edx
lea ebp, [edi + 0x14]
inc ebx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
jmp 0x50530f
mov dword [esp], ebp
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
call dbg.runtime.writebarrierptr
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x44]
jmp 0x50537b
call dbg.runtime.panicindex
ud2
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
add esp, 0x70
ret
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], ebx
add esp, 0x70
ret
call dbg.runtime.morestack_noctxt
jmp dbg.net.LookupIP
Function at 0x51dbd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51dd38
sub esp, 0x64
mov eax, dword [esp + 0x74]
mov dword [esp], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 4], eax
call dbg.reflect.ValueOf
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call dbg.reflect.Value.Elem
mov eax, dword [esp + 0xc]
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x48], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x40], edx
mov ebx, dword [esp + 0x7c]
mov dword [esp], ebx
mov ebx, dword [esp + 0x80]
mov dword [esp + 4], ebx
call dbg.encoding/asn1.parseFieldParameters
lea esi, [esp + 8]
lea edi, [esp + 0x4c]
call fcn.0044a344
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
lea edi, [esp + 0x1c]
lea esi, [esp + 0x4c]
call fcn.0044a344
call dbg.encoding/asn1.parseField
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
test eax, eax
jne 0x51dd05
mov eax, dword [esp + 0x6c]
cmp ecx, eax
ja 0x51dcfe
mov edx, dword [esp + 0x70]
sub edx, ecx
lea ebx, [edx - 1]
sar ebx, 0x1f
xor ebx, 0xffffffff
and ebx, ecx
mov ebp, dword [esp + 0x68]
add ebx, ebp
mov dword [esp + 0x84], ebx
sub eax, ecx
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], edx
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
add esp, 0x64
ret
call dbg.runtime.panicslice
ud2
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], edx
add esp, 0x64
ret
call dbg.runtime.morestack_noctxt
jmp dbg.encoding/asn1.UnmarshalWithParams
Function at 0x530510
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53072d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x5305c7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x530640
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x5305a8
cmp ecx, 0xf
jne 0x5306b9
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x5305a8
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x5305a8
call dbg.runtime.morestack_noctxt
jmp dbg.crypto/sha512.(*digest).Reset
Function at 0x56b5b0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56b76e
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x56b5d9
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x56b5d3
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x56b5d3
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x56b760
cmp al, 0x2c
ja 0x56b73d
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x56b60d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x56b607
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x56b607
cmp al, 0x2f
ja 0x56b702
cmp al, 0x26
ja 0x56b6da
cmp al, 0x24
jne 0x56b6d0
cmp ecx, 2
jg 0x56b684
cmp ecx, 1
je 0x56b679
cmp ecx, 2
jne 0x56b673
cmp al, 0x2f
jne 0x56b653
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
jne 0x56b65f
mov eax, 1
jmp 0x56b64e
cmp al, 0x2c
jne 0x56b66b
mov eax, 1
jmp 0x56b64e
cmp al, 0x3f
sete al
jmp 0x56b64e
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x56b6b8
cmp al, 0x40
jne 0x56b698
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
jne 0x56b6a4
mov eax, 1
jmp 0x56b693
cmp al, 0x3f
jne 0x56b6b0
mov eax, 1
jmp 0x56b693
cmp al, 0x3a
sete al
jmp 0x56b693
cmp ecx, 6
je 0x56b6ca
cmp ecx, 7
je 0x56b6c4
jmp 0x56b673
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
jne 0x56b673
jmp 0x56b635
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x56b635
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x56b6f4
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
jne 0x56b673
jmp 0x56b635
cmp al, 0x3d
ja 0x56b721
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x56b635
cmp al, 0x3d
jne 0x56b673
jmp 0x56b635
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x56b635
cmp al, 0x5f
je 0x56b6ee
cmp al, 0x7e
jne 0x56b673
jmp 0x56b6ee
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x56b607
cmp al, 0x5b
je 0x56b607
cmp al, 0x5d
jne 0x56b61a
jmp 0x56b607
cmp ecx, 4
jne 0x56b61a
jmp 0x56b5f6
call dbg.runtime.morestack_noctxt
jmp dbg.net/url.shouldEscape
Function at 0x57c5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57c69f
sub esp, 0x20
mov eax, dword [esp + 0x24]
lea ecx, [eax + 0x100]
test byte [ecx], al
movzx ecx, byte [eax + 0x180]
mov byte [esp + 0x17], cl
movzx edx, cl
cmp edx, 0x80
ja 0x57c698
lea ebx, [edx - 0x80]
neg ebx
lea ebp, [ebx - 1]
sar ebp, 0x1f
xor ebp, 0xffffffff
and edx, ebp
lea edx, [eax + edx + 0x100]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebx
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], edx
call dbg.unicode/utf8.EncodeRune
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
movzx edx, byte [ecx + 0x180]
add edx, 4
mov byte [ecx + 0x180], dl
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
movzx edx, byte [esp + 0x17]
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], al
mov eax, dword [ecx + 0x184]
cmp eax, 0x20
jae 0x57c691
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
shl eax, 3
mov dword [ecx + eax], edx
mov dword [ecx + eax + 4], ebx
mov eax, dword [ecx + 0x184]
inc eax
mov dword [ecx + 0x184], eax
add esp, 0x20
ret
call dbg.runtime.panicindex
ud2
call dbg.runtime.panicslice
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.vendor/golang_org/x/text/unicode/norm.(*reorderBuffer).appendRune
Function at 0x588dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x588ebe
movzx eax, byte [esp + 0xc]
test al, al
je 0x588eb1
mov eax, dword [esp + 8]
cmp eax, 1
jle 0x588eab
mov ecx, dword [esp + 4]
movzx edx, byte [ecx]
cmp dl, 0x22
jne 0x588e37
lea edx, [eax - 1]
cmp edx, eax
jae 0x588ea4
movzx ebx, byte [ecx + eax - 1]
cmp bl, 0x22
jne 0x588e37
cmp edx, 1
jb 0x588e9d
lea edx, [eax - 3]
sar edx, 0x1f
xor edx, 0xffffffff
and edx, 1
add ecx, edx
add eax, 0xfffffffe
xor edx, edx
cmp edx, eax
jge 0x588e66
jae 0x588e96
movzx ebx, byte [ecx + edx]
lea ebp, [ebx - 0x20]
xchg ebp, eax
cmp al, 0x5f
xchg ebp, eax
jae 0x588e92
cmp bl, 0x22
je 0x588e8e
cmp bl, 0x3b
je 0x588e8a
cmp bl, 0x5c
setne bl
test bl, bl
je 0x588e74
inc edx
cmp edx, eax
jl 0x588e3d
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], 1
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
ret
xor ebx, ebx
jmp 0x588e5d
xor ebx, ebx
jmp 0x588e5d
xor ebx, ebx
jmp 0x588e5d
call dbg.runtime.panicindex
ud2
call dbg.runtime.panicslice
ud2
call dbg.runtime.panicindex
ud2
mov ecx, dword [esp + 4]
jmp 0x588e37
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
jmp 0x588e37
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.parseCookieValue

Function at 0x58d080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58d147
sub esp, 4
mov eax, dword [esp + 8]
test byte [eax], al
mov dword [esp], eax
call dbg.net/http.(*http2FrameHeader).checkValid
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
movzx ebx, word [esp + 0xc]
test edx, edx
jle 0x58d0f0
cmp eax, 2
jb 0x58d140
movzx ebp, byte [ecx + 1]
movzx esi, byte [ecx]
shl esi, 8
or esi, ebp
cmp bx, si
je 0x58d108
cmp edx, 6
jb 0x58d101
lea ebp, [eax - 7]
sar ebp, 0x1f
xor ebp, 0xffffffff
and ebp, 6
add ecx, ebp
add edx, 0xfffffffa
add eax, 0xfffffffa
test edx, edx
jg 0x58d0bd
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
add esp, 4
ret
call dbg.runtime.panicslice
ud2
cmp eax, 6
jb 0x58d139
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 2]
movzx ebx, byte [ecx + 5]
movzx ecx, byte [ecx + 4]
shl ecx, 8
or ecx, ebx
shl eax, 0x10
or ecx, eax
shl edx, 0x18
or ecx, edx
mov dword [esp + 0x10], ecx
mov byte [esp + 0x14], 1
add esp, 4
ret
call dbg.runtime.panicslice
ud2
call dbg.runtime.panicslice
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.(*http2SettingsFrame).Value
Function at 0x5c59f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c5bdf
sub esp, 0x54
lea eax, [0x5fe420]
mov dword [esp], eax
mov ecx, dword [esp + 0x64]
mov dword [esp + 4], ecx
lea edx, [0x637e26]
mov dword [esp + 8], edx
mov dword [esp + 0xc], 3
call dbg.runtime.mapaccess2_faststr
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov dword [esp + 0x40], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x24], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x28], eax
lea ebx, [0x5fe420]
mov dword [esp], ebx
mov ebx, dword [esp + 0x64]
mov dword [esp + 4], ebx
lea ebx, [0x637c7b]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 2
call dbg.runtime.mapaccess2_faststr
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x2c], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x40]
mov dword [esp], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], ebx
call dbg.crypto/aes.NewCipher
mov eax, dword [esp + 0xc]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test edx, edx
je 0x5c5ae5
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ebx
add esp, 0x54
ret
mov edx, dword [esp + 0x58]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x60]
mov dword [esp + 8], edx
call dbg.botlib.Pad
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
lea ebx, [0x5fc720]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call dbg.runtime.makeslice
mov eax, dword [esp + 0xc]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x38], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp], ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x10], ebx
call dbg.crypto/cipher.NewCBCEncrypter
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [eax + 0x18]
mov edx, dword [esp + 0x48]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x34]
mov dword [esp + 8], ebx
mov ebp, dword [esp + 0x38]
mov dword [esp + 0xc], ebp
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x18], esi
mov dword [esp], ecx
call eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x54
ret
call dbg.runtime.morestack_noctxt
jmp dbg.botlib.AES_Encrypt
Function at 0x5c7ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c808f
sub esp, 0xc
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
xor ecx, ecx
mov esi, ecx
mov dword [esp + 4], ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edx
cmp ecx, eax
jge 0x5c807a
test edx, edx
jbe 0x5c8073
movzx edi, byte [ebp]
xchg edi, eax
mov byte [esp + 3], al
xchg edi, eax
cmp edx, 1
jle 0x5c806c
movzx edx, byte [ebp + 1]
sar ecx, 0x1f
and ecx, 7
mov ebp, dword [esp + 4]
lea ebx, [ebp + ecx]
and ebx, 7
sub ebx, ecx
mov dword [esp + 8], ebx
cmp ebx, 4
jae 0x5c8017
lea ecx, [ebx - 3]
neg ecx
mov edx, 0x1f
shl edx, cl
cmp ecx, 0x20
sbb ebx, ebx
and ebx, edx
and edi, ebx
xchg edi, eax
shr al, cl
xchg edi, eax
cmp ecx, 8
sbb edx, edx
and edx, edi
test eax, eax
jl 0x5c8013
lea ecx, [ebp + 5]
cmp ecx, eax
jle 0x5c8013
sub ecx, eax
mov ebx, 0xffffffff
shl ebx, cl
cmp ecx, 0x20
sbb edi, edi
and edi, ebx
and edi, edx
xchg edi, eax
movzx edx, al
xchg edi, eax
cmp edx, 0x20
jae 0x5c800c
lea ebx, [0x64179a]
movzx edx, byte [ebx + edx]
mov edi, dword [esp + 0x14]
cmp esi, edi
jae 0x5c800c
mov ecx, edi
mov edi, dword [esp + 0x10]
mov byte [edi + esi], dl
mov edx, dword [esp + 8]
cmp edx, 2
jbe 0x5c7ffe
mov edx, dword [esp + 0x24]
lea edi, [edx - 2]
sar edi, 0x1f
xor edi, 0xffffffff
and edi, 1
mov ebx, dword [esp + 0x1c]
add ebx, edi
mov edi, dword [esp + 0x20]
dec edi
dec edx
mov dword [esp + 0x20], edi
lea edi, [ebp + 5]
inc esi
mov ebp, dword [esp + 0x20]
mov ecx, edi
mov ebp, ebx
mov ebx, edx
mov edx, dword [esp + 0x20]
jmp 0x5c7efd
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
jmp 0x5c7fe3
call dbg.runtime.panicindex
ud2
mov edi, edx
jmp 0x5c7f99
lea ecx, [ebx - 3]
mov ebx, 0x1f
shr bl, cl
cmp ecx, 8
sbb edi, edi
and edi, ebx
movzx ebx, byte [esp + 3]
and ebx, edi
shl ebx, cl
cmp ecx, 0x20
sbb edi, edi
and edi, ebx
xchg edi, eax
mov byte [esp + 2], al
xchg edi, eax
mov ebx, dword [esp + 8]
lea ecx, [ebx - 0xb]
neg ecx
mov ebx, 0xffffffff
shl ebx, cl
cmp ecx, 0x20
sbb edi, edi
and ebx, edi
and edx, ebx
shr dl, cl
cmp ecx, 8
sbb ebx, ebx
and edx, ebx
movzx ebx, byte [esp + 2]
or edx, ebx
jmp 0x5c7f74
xor edx, edx
jmp 0x5c7f34
call dbg.runtime.panicindex
ud2
test eax, eax
jge 0x5c8087
test edx, edx
jle 0x5c8087
jmp 0x5c7f15
mov dword [esp + 0x2c], esi
add esp, 0xc
ret
call dbg.runtime.morestack_noctxt
jmp dbg.botlib.z32encode
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x725e69aa
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x134b26e8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219