joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b6c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b846
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x18], rcx
cmp rcx, 0x15
ja 0x48b765
cmp rcx, 0x12
je 0x48b7a6
nop dword [rax]
cmp rcx, 0x13
jne 0x48b755
bt edx, 9
jb 0x48b744
nop
cmp qword [rax], 8
jne 0x48b832
cmp qword [rax + 8], 0
nop dword [rax]
je 0x48b832
bt edx, 7
jae 0x48b72f
mov rbx, qword [rbx]
test rbx, rbx
je 0x48b737
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0048d7e0]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x15
je 0x48b7a6
nop dword [rax + rax]
jmp 0x48b7e9
cmp rcx, 0x16
jne 0x48b797
cmp qword [rax + 8], 0
jne 0x48b7a6
mov rax, qword [rbx]
mov qword [rsp + 0x10], rax
call fcn.0045eee0
nop
test al, al
je 0x48b81f
mov rax, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x17
je 0x48b7c9
nop dword [rax]
cmp rcx, 0x1a
jne 0x48b7e9
cmp qword [rax], 8
jne 0x48b7d6
cmp qword [rax + 8], 0
je 0x48b7d6
bt edx, 7
jae 0x48b7bc
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rbx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006576e0]
lea rbx, [0x00718950]
call fcn.00436420
lea rax, [0x00676300]
call fcn.0040d960
mov qword [rax + 8], 0x15
lea rcx, [0x006aa08d]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00661520]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718900]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718950]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0048b6c0
Function at 0x48bee0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c13b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x18], rcx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
jne 0x48bf31
bt edx, 8
jae 0x48c127
mov rcx, qword [rax + 0x40]
mov rax, qword [rax + 0x38]
jmp 0x48bf45
cmp rcx, 0x17
jne 0x48c040
mov r8, qword [rbx]
mov rcx, qword [rbx + 0x10]
mov rbx, r8
test rdi, rdi
jl 0x48c114
cmp rsi, rdi
jl 0x48c114
nop word [rax + rax]
cmp rsi, rcx
jg 0x48c114
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x10], rcx
lea rax, [0x00655180]
nop
call fcn.0040d960
mov qword [rax], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x10]
sub rcx, rdx
mov qword [rax + 0x10], rcx
test rcx, rcx
jle 0x48bfde
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsi + 0x30]
mov r8, qword [r8]
imul rdx, r8
mov r8, qword [rsp + 0x28]
add rdx, r8
cmp dword [0x008f2cf0], 0
jne 0x48bfd4
mov qword [rax], rdx
jmp 0x48c003
mov rdi, rax
call fcn.004655c0
jmp 0x48c003
cmp dword [0x008f2cf0], 0
jne 0x48bff1
mov rdx, qword [rsp + 0x28]
mov qword [rax], rdx
jmp 0x48bffe
mov rdi, rax
mov rdx, qword [rsp + 0x28]
call fcn.004655c0
mov rsi, qword [rsp + 0x20]
test byte [rsi], al
mov rdx, qword [rsp + 0x18]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
or rcx, 0x97
mov rbx, rax
mov rax, rsi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp rcx, 0x18
jne 0x48c0d9
test rdi, rdi
jl 0x48c0c6
cmp rsi, rdi
jl 0x48c0c6
cmp qword [rbx + 8], rsi
jl 0x48c0c6
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x00675180]
call fcn.0040d960
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x38]
nop word [rax + rax]
cmp qword [rdx + 8], rcx
jle 0x48c0af
mov rdx, qword [rdx]
mov rsi, qword [rsp + 0x70]
sub rsi, rcx
nop
mov qword [rax + 8], rsi
add rdx, rcx
cmp dword [0x008f2cf0], 0
jne 0x48c0a7
mov qword [rax], rdx
jmp 0x48c0af
mov rdi, rax
call fcn.004655c0
mov rbx, rax
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006576e0]
lea rbx, [0x00718930]
call fcn.00436420
mov qword [rsp + 0x18], rcx
lea rax, [0x00676300]
call fcn.0040d960
mov qword [rax + 8], 0x13
lea rcx, [0x006a92f6]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00661520]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718940]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718920]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0048bee0
Function at 0x48c2e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c40f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
test rcx, rcx
je 0x48c3d8
bt ecx, 9
jae 0x48c399
sar rcx, 0xa
movzx edx, byte [rax + 0x17]
and edx, 0x1f
cmp rdx, 0x14
jne 0x48c351
mov rdx, qword [rax + 0x38]
cmp qword [rax + 0x40], rcx
jbe 0x48c3c5
mov ebx, dword [rdx + rcx*8 + 4]
call fcn.004608a0
mov rbx, rax
lea rax, [0x0071d9c8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x10], rcx
nop dword [rax + rax]
call fcn.00485260
mov rcx, qword [rsp + 0x10]
cmp rbx, rcx
jbe 0x48c3ad
shl rcx, 4
mov ebx, dword [rax + rcx + 4]
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.004608a0
mov rbx, rax
lea rax, [0x0071d9c8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, rax
lea rax, [0x0071d9c8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006576e0]
lea rbx, [0x00718a90]
nop dword [rax + rax]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718a90]
call fcn.00436420
lea rax, [0x00676300]
nop
call fcn.0040d960
mov qword [rax + 8], 0x12
lea rcx, [0x006a89d8]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00661520]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0048c2e0
Function at 0x48c440
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c5cc
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x15
ja 0x48c4e5
cmp rcx, 0x12
je 0x48c52c
nop dword [rax]
cmp rcx, 0x13
jne 0x48c4d6
bt edx, 9
jb 0x48c4c4
nop
cmp qword [rax], 8
jne 0x48c5b8
cmp qword [rax + 8], 0
nop dword [rax]
je 0x48c5b8
bt edx, 7
jae 0x48c4af
mov rbx, qword [rbx]
test rbx, rbx
je 0x48c4b7
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
lea rax, [0x0048d7e0]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x15
je 0x48c52c
nop dword [rax]
jmp 0x48c56f
cmp rcx, 0x16
jne 0x48c520
cmp qword [rax + 8], 0
jne 0x48c52c
mov qword [rsp + 0x18], rbx
mov rax, qword [rbx]
call fcn.0045eee0
nop
test al, al
je 0x48c5a5
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x17
je 0x48c54f
cmp rcx, 0x1a
jne 0x48c56f
cmp qword [rax], 8
jne 0x48c55c
cmp qword [rax + 8], 0
je 0x48c55c
bt edx, 7
jae 0x48c542
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rbx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006576e0]
lea rbx, [0x00718950]
call fcn.00436420
lea rax, [0x00676300]
call fcn.0040d960
mov qword [rax + 8], 0x1b
lea rcx, [0x006ace2e]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00661520]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718960]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718950]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0048c440
Function at 0x48cba0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48cd26
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x98]
mov rax, rbx
call rdx
nop dword [rax + rax]
cmp rax, 0x17
jne 0x48cd0d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jl 0x48ccfa
mov rdx, qword [rsp + 0x48]
nop dword [rax]
test rdx, rdx
jl 0x48cce7
cmp rcx, rdx
jg 0x48ccd4
lea rax, [0x0067d260]
call fcn.0040d960
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x38]
call rdx
mov rcx, qword [0x0071d9d0]
lea rdx, [0x0071d9c8]
cmp rax, rdx
jne 0x48ccc5
mov rax, rbx
mov rbx, qword [rsp + 0x48]
call fcn.0045eae0
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rbx + 0x10], rcx
cmp dword [0x008f2cf0], 0
jne 0x48cc78
mov qword [rbx], rax
jmp 0x48cc85
mov rdi, rbx
nop dword [rax + rax]
call fcn.004654a0
mov rdx, qword [0x0071d9d0]
mov rax, qword [rsp + 0x30]
lea rsi, [0x0071d9c8]
cmp rax, rsi
jne 0x48ccb1
mov rax, qword [rsp + 0x38]
mov ecx, 0x97
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, rdx
lea rcx, [0x00695640]
nop dword [rax + rax]
call fcn.0040ac60
mov rbx, rcx
lea rcx, [0x00695640]
call fcn.0040ac60
lea rax, [0x006576e0]
lea rbx, [0x007189a0]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718990]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718980]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718970]
nop dword [rax + rax]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0048cba0
Function at 0x493100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49322e
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rbx
call fcn.00490ee0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jl 0x49321a
mov rdx, qword [rsp + 0x40]
nop dword [rax]
cmp rdx, 0x10
jl 0x493207
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rdx, rsi
je 0x49319d
nop
mov rdi, rdx
lea r8, [rsi + 0xf]
cmp r8, rdx
jb 0x49319a
mov rdx, rsi
lea r8, [rdi + 0xf]
cmp r8, rsi
jae 0x4931f4
mov rsi, rdx
mov rdx, rdi
jmp 0x49319d
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rbx + 8]
mov rbx, qword [rbx]
test rdi, rdi
jbe 0x4931ea
shr rdi, 2
lea rax, [rdi - 1]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rsi
call fcn.00493600
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rcx, rax
call fcn.00465940
lea rax, [0x006576e0]
lea rbx, [0x007182c0]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x007182b0]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x007182a0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00493100
Function at 0x493280
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4933af
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rbx
call fcn.00490ee0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jl 0x49339b
mov rdx, qword [rsp + 0x40]
nop dword [rax]
cmp rdx, 0x10
jl 0x493388
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rdx, rsi
je 0x49331d
nop
mov rdi, rdx
lea r8, [rsi + 0xf]
cmp r8, rdx
jb 0x49331a
mov rdx, rsi
lea r8, [rdi + 0xf]
cmp r8, rsi
jae 0x493375
mov rsi, rdx
mov rdx, rdi
jmp 0x49331d
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rbx + 0x20]
mov rbx, qword [rbx + 0x18]
test rdi, rdi
jbe 0x49336b
shr rdi, 2
lea rax, [rdi - 1]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rsi
call fcn.004936c0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rcx, rax
call fcn.00465940
lea rax, [0x006576e0]
lea rbx, [0x007182c0]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x007182b0]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x007182a0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00493280

Function at 0x493600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x49363f
jb 0x493654
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4936c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4936ff
jb 0x493714
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x493780
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x493850
jb 0x4938af
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004935a0
aeskeygenassist xmm1, xmm0, 1
call fcn.004935c0
aeskeygenassist xmm1, xmm2, 2
call fcn.004935a0
aeskeygenassist xmm1, xmm0, 2
call fcn.004935c0
aeskeygenassist xmm1, xmm2, 4
call fcn.004935a0
aeskeygenassist xmm1, xmm0, 4
call fcn.004935c0
aeskeygenassist xmm1, xmm2, 8
call fcn.004935a0
aeskeygenassist xmm1, xmm0, 8
call fcn.004935c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004935a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004935c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004935a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004935c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004935a0
jmp 0x49391d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00493500
aeskeygenassist xmm1, xmm2, 2
call fcn.00493560
aeskeygenassist xmm1, xmm2, 4
call fcn.00493500
aeskeygenassist xmm1, xmm2, 8
call fcn.00493560
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00493500
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00493560
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00493500
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00493560
jmp 0x49391d
aeskeygenassist xmm1, xmm0, 1
call fcn.004934c0
aeskeygenassist xmm1, xmm0, 2
call fcn.004934c0
aeskeygenassist xmm1, xmm0, 4
call fcn.004934c0
aeskeygenassist xmm1, xmm0, 8
call fcn.004934c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004934c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004934c0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004934c0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004934c0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004934c0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004934c0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x49392a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x498c80
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x498e8c
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movzx ecx, byte [rbx + 0x1b]
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r15
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r15d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r15
movzx r13d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r13
movzx r12d, byte [rbx + 9]
mov qword [rsp + 8], r12
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r10d, byte [rbx + 7]
shl r10, 0x38
movzx r9d, byte [rbx + 6]
shl r9, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r12d, byte [rbx + 3]
shl r12, 0x18
movzx r13d, byte [rbx + 2]
shl r13, 0x10
movzx r15d, byte [rbx + 1]
shl r15, 8
movzx ebx, byte [rbx]
add rbx, r15
add rbx, r13
add rbx, r12
add rbx, r11
add rbx, r8
add rbx, r9
add rbx, r10
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x78]
shl rcx, 0x18
mov rdx, qword [rsp + 0x70]
shl rdx, 0x10
mov rbx, qword [rsp + 0x68]
shl rbx, 8
mov rsi, qword [rsp + 0x60]
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00498c80
Function at 0x4b1d20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b1d72
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
call fcn.004b1a00
nop
test rdi, rdi
jne 0x4b1d5e
test rbx, rbx
jbe 0x4b1d54
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
mov rcx, rax
call fcn.00465940
lea rax, [0x006576e0]
lea rbx, [0x00718dc0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b1d20

Function at 0x4b3400
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b351b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov dword [rsp + 0x1c], eax
mov qword [rsp + 0x20], 0
mov ebx, eax
xor ecx, ecx
lea rdi, [rsp + 0x20]
xor eax, eax
call fcn.004b5fe0
lea rdx, [0x00719e00]
nop dword [rax]
cmp rax, rdx
jne 0x4b3469
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
lea rcx, [0x00718140]
call fcn.00403fe0
test al, al
jne 0x4b34b5
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
test rax, rax
je 0x4b3481
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x42
lea rcx, [0x006b7864]
mov qword [rax], rcx
lea rbx, [0x007191c0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x20]
lea rax, [0x006578a0]
mov rbx, rcx
call fcn.0044a840
cmp qword [rsp + 0x20], 0
jbe 0x4b3510
mov qword [rsp + 0x30], rax
mov ebx, dword [rsp + 0x1c]
xor ecx, ecx
lea rdi, [rsp + 0x20]
call fcn.004b5fe0
test rax, rax
je 0x4b34fd
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x30]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
mov rcx, rax
call fcn.00465940
nop
mov dword [rsp + 8], eax
nop
call fcn.004632e0
mov eax, dword [rsp + 8]
jmp fcn.004b3400