joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0980
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c0b18
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], r8
mov qword [rsp + 0xa0], r10
cmp r10, 0x19
je 0x4c0a81
nop
cmp r10, 0x23
jne 0x4c0ad0
mov rax, r9
lea rbx, [0x006b0332]
mov ecx, 0x23
call fcn.00402d80
nop
test al, al
jne 0x4c0a45
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xa0]
nop dword [rax + rax]
jmp 0x4c0ad0
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
mov r9d, 1
call fcn.004c6a20
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, r9
lea rbx, [0x006ab9cb]
mov ecx, 0x19
call fcn.00402d80
test al, al
jne 0x4c0adf
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xa0]
call fcn.004c0b80
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
xor r9d, r9d
call fcn.004c6a20
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.004c0980
Function at 0x4c36a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c37a9
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x40], rax
cmp rbx, 0x19
je 0x4c36d6
xor edx, edx
jmp 0x4c3700
lea rbx, [0x006ab9cb]
mov ecx, 0x19
call fcn.00402d80
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
je 0x4c370b
mov edx, 1
jmp 0x4c3740
cmp rbx, 0x23
je 0x4c3715
xor edx, edx
jmp 0x4c3740
lea rbx, [0x006b0332]
mov ecx, 0x23
call fcn.00402d80
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
je 0x4c377e
mov rdx, qword [0x00892318]
lea rax, [0x0071ac60]
mov rbx, rcx
mov rcx, rdi
mov rdi, rdx
nop dword [rax + rax]
call fcn.004cdb60
test dil, dil
jne 0x4c379b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov r8, qword [0x00892318]
mov rsi, qword [0x00892320]
call fcn.004c37e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004c36a0

Function at 0x4c6f00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c6f46
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x4c6f2f
add rax, 8
nop
call fcn.00462240
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006576e0]
lea rbx, [0x007187f0]
nop dword [rax]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.004c6f00

Function at 0x4c7040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c709a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x4c7086
mov qword [rsp + 0x20], rax
mov rax, rbx
call fcn.004c6e80
mov rcx, qword [rsp + 0x20]
add rcx, 8
mov rbx, rax
mov rax, rcx
call fcn.00462280
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006576e0]
lea rbx, [0x00718e00]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004c7040
Function at 0x4d2de0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x4d2f83
sub rsp, 0xb8
mov qword [rsp + 0xb0], rbp
lea rbp, [rsp + 0xb0]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
nop dword [rax]
call fcn.00496460
cmp rax, 1
je 0x4d2f44
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
mov rcx, qword [rsp + 0xc0]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0x80]
call fcn.00498ec0
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rcx, qword [rsp + 0xc0]
mov rbx, qword [rcx]
test byte [rbx], al
test byte [rax], al
mov rcx, rax
lea rax, [rsp + 0x60]
nop dword [rax]
call fcn.00496860
mov rcx, qword [rsp + 0xc8]
test byte [rcx], al
movups xmmword [rsp + 0x44], xmm15
movups xmmword [rsp + 0x50], xmm15
lea rax, [rsp + 0x60]
lea rbx, [rsp + 0x44]
call fcn.00496500
cmp rbx, 0x1c
ja 0x4d2ec2
mov rcx, rbx
mov rdx, qword [rsp + 0xc8]
mov esi, 0x1c
jmp 0x4d2efe
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0xc8]
mov ecx, 0x1c
mov rdi, rbx
lea rsi, [0x006578a0]
call fcn.0044a920
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.004662e0
mov rax, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x23
lea rcx, [0x006b039b]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007191c0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax]
jmp fcn.004d2de0
Function at 0x4d3a60
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4d3c0d
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
cmp cl, 0x10
jae 0x4d3bf9
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xc0], cl
mov qword [rsp + 0xb8], rbx
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
nop
movabs rdx, 0xffffffff00000000
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0xffffffffffffffff
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x90], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x98], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x90]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x98]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov edx, 1
jmp 0x4d3bc0
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.004d3960
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
movzx r8d, byte [rsp + 0xc0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xb8]
nop dword [rax + rax]
cmp dl, 0x10
jae 0x4d3bdc
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x4d3b6e
jmp 0x4d3bec
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465940
lea rax, [0x006576e0]
lea rbx, [0x007184a0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax + rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004d3a60
Function at 0x4d5e80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d5faf
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rcx, rax
lea rax, [rsp + 0x38]
mov rbx, rcx
call fcn.004d5cc0
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.004e19e0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x58]
xor eax, eax
xor edx, edx
jmp 0x4d5f20
test byte [rcx], al
lea rsi, [rax + 1]
mov rdi, qword [rsp + rax*8 + 0x18]
xor rdi, qword [rcx + rax*8]
or rdx, rdi
mov rax, rsi
nop dword [rax]
cmp rax, 4
jl 0x4d5f08
nop
not rdx
mov rcx, rdx
shr rdx, 0x20
and rcx, rdx
mov rdx, rcx
shr rcx, 0x10
and rcx, rdx
mov rdx, rcx
shr rcx, 8
and rcx, rdx
mov rdx, rcx
shr rcx, 4
and rcx, rdx
mov rdx, rcx
shr rcx, 2
and rcx, rdx
mov rdx, rcx
shr rcx, 1
and rcx, rdx
and ecx, 1
cmp rcx, 1
je 0x4d5fa1
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x17
lea rcx, [0x006aac3d]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
nop
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004d5e80
Function at 0x4d7080
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d7234
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
xor ecx, ecx
xor edx, edx
nop
jmp 0x4d70c0
lea rsi, [rcx + 1]
mov rdi, qword [rax + rcx*8 + 0x40]
lea r8, [0x008f2da0]
xor rdi, qword [r8 + rcx*8]
or rdx, rdi
mov rcx, rsi
nop dword [rax]
cmp rcx, 4
jl 0x4d70a2
nop
not rdx
mov rcx, rdx
shr rdx, 0x20
and rdx, rcx
mov rcx, rdx
shr rdx, 0x10
and rdx, rcx
mov rcx, rdx
shr rdx, 8
and rdx, rcx
mov rcx, rdx
shr rdx, 4
and rdx, rcx
mov rcx, rdx
shr rdx, 2
and rdx, rcx
mov rcx, rdx
shr rdx, 1
and rdx, rcx
and edx, 1
cmp rdx, 1
jne 0x4d7147
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x23
lea rcx, [0x006b03be]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007191c0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rbx, [rax + 0x40]
lea rax, [rsp + 0x18]
call fcn.004d7260
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.004e19e0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
call fcn.004e1bc0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rcx
call fcn.004e1e20
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x50]
test byte [rcx], al
mov qword [rsp], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 8], rdx
call fcn.004e1800
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov ebx, 0x20
mov rcx, rbx
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004d7080
Function at 0x4da0a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x68]
cmp r12, qword [r14 + 0x10]
jbe 0x4da25e
sub rsp, 0xe8
mov qword [rsp + 0xe0], rbp
lea rbp, [rsp + 0xe0]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
nop dword [rax]
call fcn.00499400
cmp rax, 1
je 0x4da21f
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov rcx, qword [rsp + 0xf0]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0xa0]
nop
call fcn.0049ffe0
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
mov rcx, qword [rsp + 0xf0]
mov rbx, qword [rcx]
test byte [rbx], al
test byte [rax], al
mov rcx, rax
lea rax, [rsp + 0x70]
call fcn.00499880
mov rcx, qword [rsp + 0xf8]
test byte [rcx], al
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
lea rax, [rsp + 0x70]
lea rbx, [rsp + 0x40]
nop
call fcn.004994a0
cmp rbx, 0x30
ja 0x4da19d
mov rcx, rbx
mov rdx, qword [rsp + 0xf8]
mov esi, 0x30
jmp 0x4da1d9
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0xf8]
mov ecx, 0x30
mov rdi, rbx
lea rsi, [0x006578a0]
call fcn.0044a920
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.004662e0
mov rax, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x23
lea rcx, [0x006b03e1]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007191c0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004da0a0
Function at 0x4dae40
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x4db033
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
cmp cl, 0x10
jae 0x4db01f
mov qword [rsp + 0xe0], rax
mov byte [rsp + 0xf0], cl
mov qword [rsp + 0xe8], rbx
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
movabs rdx, 0xffffffff00000001
mov qword [rsp + 0x58], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 1
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb8], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xc0], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0xc8], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0xc0]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0xc8]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov edx, 1
jmp 0x4dafe5
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.004dad40
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
movzx r8d, byte [rsp + 0xf0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xe8]
cmp dl, 0x10
jae 0x4db002
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x4daf98
nop
jmp 0x4db012
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465940
lea rax, [0x006576e0]
lea rbx, [0x007184b0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004dae40
Function at 0x4ddac0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb0]
cmp r12, qword [r14 + 0x10]
jbe 0x4ddcbd
sub rsp, 0x130
mov qword [rsp + 0x128], rbp
lea rbp, [rsp + 0x128]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
call fcn.004a0660
cmp rax, 1
je 0x4ddc7e
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xd8], xmm15
movups xmmword [rsp + 0xe8], xmm15
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x108], xmm15
mov rcx, qword [rsp + 0x138]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0xd0]
call fcn.004ae020
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov rcx, qword [rsp + 0x138]
mov rbx, qword [rcx]
test byte [rbx], al
test byte [rax], al
mov rcx, rax
lea rax, [rsp + 0x88]
nop dword [rax]
call fcn.004a0b80
mov rcx, qword [rsp + 0x140]
test byte [rcx], al
movups xmmword [rsp + 0x46], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
lea rax, [rsp + 0x88]
lea rbx, [rsp + 0x46]
call fcn.004a0740
nop
cmp rbx, 0x42
ja 0x4ddbf8
mov rcx, rbx
mov rdx, qword [rsp + 0x140]
mov esi, 0x42
jmp 0x4ddc38
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x140]
mov ecx, 0x42
mov rdi, rbx
lea rsi, [0x006578a0]
nop dword [rax]
call fcn.0044a920
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x120], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.004662e0
mov rax, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x23
lea rcx, [0x006b0404]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007191c0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ddac0
Function at 0x4dea80
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x4deccd
sub rsp, 0x120
mov qword [rsp + 0x118], rbp
lea rbp, [rsp + 0x118]
cmp cl, 0x10
jae 0x4decb9
mov qword [rsp + 0x128], rax
mov byte [rsp + 0x138], cl
mov qword [rsp + 0x130], rbx
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0x110], 0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x108], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x110], rdx
mov rdx, qword [rbx]
mov rsi, qword [rsp + 0xb8]
mov qword [rdx], rsi
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
jmp 0x4dec80
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.004de980
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x4dec9c
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x4dec33
jmp 0x4decac
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465940
lea rax, [0x006576e0]
lea rbx, [0x007184c0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax + rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004dea80