joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x457736
push rbp
mov rbp, rsp
sub rsp, 0x48
cmp rcx, rbx
jae 0x45765d
mov rdx, qword [rax]
mov qword [rsp + 0x30], rdx
mov rsi, rax
mov rax, rbx
mul rdx
jo 0x457721
movabs rdx, 0x1000000000000
nop dword [rax + rax]
cmp rax, rdx
ja 0x457721
test rbx, rbx
jl 0x457721
mov rdx, qword [rsp + 0x30]
imul rcx, rdx
jmp 0x45766a
mov rcx, qword [rax]
imul rcx, rbx
mov rsi, rax
mov rax, rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x28], rcx
cmp qword [rsi + 8], 0
jne 0x4576b8
mov qword [rsp + 0x20], rax
xor ebx, ebx
xor ecx, ecx
call fcn.00411dc0
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
cmp rcx, rbx
jae 0x457707
mov qword [rsp + 0x38], rax
sub rbx, rcx
lea rdx, [rax + rcx]
mov rax, rdx
call fcn.0047a5a0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
jmp 0x457707
mov qword [rsp + 0x40], rsi
mov rbx, rsi
mov ecx, 1
call fcn.00411dc0
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x457707
cmp byte [0x0203df10], 0
je 0x457707
mov qword [rsp + 0x38], rax
mov rdx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, rbx
mov rdi, qword [rsp + 0x40]
mov rax, rdx
mov rbx, rsi
call fcn.0041aca0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x70]
call fcn.0047a8a0
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbp
ret
nop
lea rax, [0x00f35ee0]
lea rbx, [0x0179d4a0]
call fcn.0043f400
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00457600

Function at 0x457780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45781f
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rsi, rax
mov rax, rdx
mov rdi, rax
mul rcx
jo 0x457813
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x4577cf
test rbx, rbx
jl 0x4577cf
cmp rcx, rbx
jl 0x4577cf
mov rbx, rsi
mov ecx, 1
call fcn.00411dc0
add rsp, 0x18
pop rbp
ret
mov rax, rdi
mul rbx
jno 0x4577eb
nop
lea rax, [0x00f35ee0]
lea rbx, [0x0179d4a0]
call fcn.0043f400
movabs rcx, 0x1000000000000
cmp rax, rcx
ja 0x4577d7
test rbx, rbx
jl 0x4577d7
nop
lea rax, [0x00f35ee0]
lea rbx, [0x0179d4b0]
call fcn.0043f400
movabs rdx, 0x1000000000000
jmp 0x4577cf
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00457780
Function at 0x458d20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458ece
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x38], rsi
mov rdx, rax
mov qword [rsp + 0x30], rax
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
mov r10, qword [rcx + 0x10]
movsxd r11, dword [rbx]
mov qword [rsp + 0x28], r11
mov rcx, qword [rcx + 0x18]
xor r12d, r12d
nop
jmp 0x458d66
lea r12, [r13 + 8]
cmp r12, r11
jae 0x458d82
mov qword [rsp + 0x20], r12
mov r13, r12
shr r12, 3
add r12, qword [rbx + 8]
movzx r12d, byte [r12]
jmp 0x458d92
add rsp, 0x50
pop rbp
ret
mov rbx, qword [rsp + 0x68]
mov r11, qword [rsp + 0x28]
test r12b, r12b
je 0x458d62
bsf r15d, r12d
lea ebx, [r12 - 1]
add r15, r13
and r12d, ebx
lea rbx, [rdx + r15*8]
jmp 0x458dd1
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
jmp 0x458d88
add r11, r10
mov qword [rdx + r15*8], r11
nop
jmp 0x458d88
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r11, qword [rsp + 0x28]
mov r11, qword [rdx + r15*8]
mov qword [rsp + 0x18], r11
test rdi, rdi
je 0x458e01
lea r13, [r11 - 1]
cmp r13, 0xfff
jae 0x458dfc
cmp dword [0x0203e6e8], 0
jne 0x458e32
mov r13, qword [rsp + 0x20]
jmp 0x458e01
mov r13, qword [rsp + 0x20]
cmp r11, r8
jb 0x458d88
cmp r11, r9
jae 0x458d88
cmp rcx, rax
jbe 0x458db8
mov rsi, qword [rsp + 0x18]
add rsi, r10
mov rax, r11
lock cmpxchg qword [rbx], rsi
sete sil
test sil, sil
je 0x458dc2
jmp 0x458dac
mov qword [rsp + 0x48], rbx
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf1], 2
mov ebx, dword [rdi + 4]
mov rax, rsi
call fcn.0045de00
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x10], rbx
call fcn.00441a60
lea rax, [0x010b07b3]
mov ebx, 0x1e
call fcn.004422e0
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x10]
call fcn.004422e0
lea rax, [0x01088804]
mov ebx, 4
call fcn.004422e0
mov rax, qword [rsp + 0x48]
call fcn.00442260
lea rax, [0x01087843]
mov ebx, 2
call fcn.004422e0
mov rax, qword [rsp + 0x18]
call fcn.00442160
call fcn.00441ca0
call fcn.00441ac0
lea rax, [0x010b07d1]
mov ebx, 0x1e
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00458d20
Function at 0x45a520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a68a
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [rax], 0
je 0x45a678
nop
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x45a572
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
cmp rax, rdx
jne 0x45a667
mov rsi, r14
cmp rsi, rdx
je 0x45a667
cmp ecx, 2
jne 0x45a667
cmp qword [rax + 0x70], 0
jne 0x45a594
cmp byte [rax + 0xb4], 0
je 0x45a586
xor ecx, ecx
jmp 0x45a596
nop
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x45a596
xor ecx, ecx
test cl, cl
je 0x45a656
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x45a5bd
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x3f0], 0
jne 0x45a645
cmp dword [0x0203e6dc], 0
jg 0x45a63f
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x128]
mov rax, rcx
call fcn.0045e220
test rax, rax
je 0x45a5eb
cmp byte [rax + 0x28], 7
jne 0x45a5eb
add rsp, 0x10
pop rbp
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rdx, rcx
mov rcx, rdx
shr rdx, 1
cmp rdx, 0x2000
jb 0x45a639
mov rsi, qword [rax + 0x38]
sub rbx, rsi
lea rsi, [rbx + 0x320]
shr rcx, 2
nop
cmp rcx, rsi
ja 0x45a62b
add rsp, 0x10
pop rbp
ret
mov rbx, rdx
call fcn.00459420
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
lea rax, [0x010a7dc6]
mov ebx, 0x1a
call fcn.0043ffc0
lea rax, [0x010a2517]
mov ebx, 0x17
call fcn.0043ffc0
lea rax, [0x010a5de2]
mov ebx, 0x19
call fcn.0043ffc0
lea rax, [0x010ac03c]
mov ebx, 0x1c
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
call fcn.00477be0
mov rax, qword [rsp + 8]
jmp fcn.0045a520
Function at 0x45b3c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b5a7
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x78], rbx
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x45b3fa
add r10, 0x10
lea r11, [rbx + 1]
mov rbx, r10
mov r9, r8
mov r8, rsi
mov rsi, r11
cmp rcx, rsi
jle 0x45b431
mov r10, rbx
mov r11, qword [rbx + 8]
test r11, r11
jne 0x45b416
mov rbx, rsi
mov rsi, r8
mov r8, r9
jmp 0x45b3e6
lea r8, [r9 + r11]
nop word [rax + rax]
cmp r9, r8
jg 0x45b595
inc rdi
mov rbx, rsi
jmp 0x45b3e6
test rdi, rdi
je 0x45b4be
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x58], rdx
cmp rdi, 1
jne 0x45b49c
test rax, rax
jne 0x45b476
cmp rcx, r8
jbe 0x45b58d
mov rsi, r8
shl r8, 4
mov rdi, qword [rdx + r8]
cmp qword [r14], rdi
ja 0x45b480
mov r8, qword [r14 + 8]
cmp rdi, r8
jb 0x45b49c
jmp 0x45b480
mov rsi, r8
nop dword [rax]
cmp rcx, rsi
jbe 0x45b585
shl rsi, 4
mov rax, qword [rdx + rsi]
mov rbx, qword [rdx + rsi + 8]
add rsp, 0x60
pop rbp
ret
mov rbx, r9
nop
call fcn.0045ba60
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x80]
jmp 0x45b4e8
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
sub rsi, r9
mov r10, rsi
neg r10
sar r10, 0x3f
and r10, r9
add rdx, 0x10
dec r8
sub r11, r9
add rcx, r10
mov rdi, r11
test r8, r8
jle 0x45b571
mov r9, qword [rdx + 8]
mov r10, qword [rdx]
cmp rdi, r9
mov r11, rdi
cmovg rdi, r9
cmp rcx, r10
jne 0x45b50c
cmp r11, r9
jmp 0x45b569
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x18], r9
mov rax, rcx
mov rbx, r10
mov rcx, rdi
call fcn.0047a8a0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, rax
mov r11, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jae 0x45b4c8
jmp 0x45b577
add rsp, 0x60
pop rbp
ret
mov rax, r9
mov rcx, r11
nop dword [rax]
call fcn.00479f80
mov rax, rsi
call fcn.00479ec0
mov rax, r8
call fcn.00479ec0
lea rax, [0x010ae287]
mov ebx, 0x1d
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045b3c0
Function at 0x45f020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x45f197
movzx edx, byte [rax]
test edx, edx
jne 0x45f054
nop dword [rax]
test r8b, r8b
jne 0x45f054
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x45f067
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x45f157
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x45f145
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x45f137
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x45f0bd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x45f100
mov eax, 1
cmp rax, rbx
ja 0x45f0eb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00479f80
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45f12f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x45f0f3
mov rcx, r11
mov eax, r12d
jmp 0x45f0c2
mov rcx, rbx
call fcn.00479ec0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00479ec0
mov eax, r8d
mov rcx, rbx
call fcn.00479f80
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45f18d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x45f150
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x45f06d
mov eax, edx
mov rcx, rbx
call fcn.00479ec0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00479ec0
nop
int3

Function at 0x465e40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465f17
push rbp
mov rbp, rsp
sub rsp, 0x18
lea rdx, [rbx + 7]
nop
and rdx, 0xfffffffffffffff8
cmp qword [rax], 0
nop
je 0x465e72
mov rsi, qword [rax + 8]
add rsi, rdx
cmp rsi, 0xfff8
jbe 0x465ebd
cmp rdx, 0xfff8
ja 0x465f05
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x10], rdx
mov eax, 0x10000
lea rbx, [0x02043ee0]
call fcn.0041c6a0
test rax, rax
je 0x465ef4
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rax], rbx
mov qword [rdx], rax
mov qword [rdx + 8], 0
mov rax, rdx
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rax + 8]
cmp rbx, 0xfff8
jae 0x465ee7
mov rcx, qword [rax]
test byte [rcx], al
lea rcx, [rcx + rbx]
lea rcx, [rcx + 8]
add rdx, rbx
mov qword [rax + 8], rdx
mov rax, rcx
add rsp, 0x18
pop rbp
ret
mov rax, rbx
mov ecx, 0xfff8
call fcn.00479ee0
lea rax, [0x010a7e14]
mov ebx, 0x1a
call fcn.0043ffc0
lea rax, [0x010ac0ac]
mov ebx, 0x1c
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00465e40
Function at 0x468dc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x468e75
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.004659a0
nop
test bl, bl
je 0x468e6f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00468ec0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00477ac0
xorps xmm15, xmm15
mov r14, qword [0x0203daa8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00468dc0
Function at 0x46bde0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bf8e
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
call fcn.00441a60
lea rax, [0x010ac0c8]
mov ebx, 0x1c
call fcn.004422e0
mov rax, qword [rsp + 0x50]
call fcn.00442020
lea rax, [0x01087c8a]
mov ebx, 3
call fcn.004422e0
call fcn.00441ac0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rcx
xor edx, edx
jmp 0x46be79
mov rdx, qword [rsp + 0x30]
inc rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
jge 0x46befd
mov qword [rsp + 0x30], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.0045e220
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
nop
test rax, rax
je 0x46beb3
mov edx, dword [rax + 4]
mov r9d, dword [rax + 0x24]
movzx r10d, byte [rax + 0x28]
jmp 0x46bebd
xor r10d, r10d
xor r9d, r9d
xor edx, edx
xor ebx, ebx
mov r11, qword [rsp + 0x30]
test r11, r11
sete sil
mov rax, rbx
mov ebx, edx
mov ecx, r9d
mov edi, r10d
xor r8d, r8d
call fcn.0046c560
nop dword [rax]
test al, al
je 0x46be67
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.0046bfe0
jmp 0x46be67
cmp qword [rsp + 0x78], 0x32
jne 0x46bf25
call fcn.00441a60
lea rax, [0x010b2cf9]
mov ebx, 0x1f
call fcn.004422e0
nop dword [rax + rax]
call fcn.00441ac0
mov rax, qword [rsp + 0x90]
call fcn.0045e220
test rax, rax
jne 0x46bf3b
xor ecx, ecx
jmp 0x46bf6a
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rax
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0x24]
movzx edi, byte [rax + 0x28]
xor esi, esi
xor r8d, r8d
mov rax, rbx
mov ebx, edx
call fcn.0046c560
mov rbx, qword [rsp + 0x20]
mov ecx, eax
mov rax, qword [rsp + 0x40]
test cl, cl
je 0x46bf88
cmp qword [rsp + 0x88], 1
je 0x46bf88
mov rcx, qword [rsp + 0x90]
xor edi, edi
call fcn.0046ad20
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0046bde0
Function at 0x46c1c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c26f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0046c2c0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00477ac0
xorps xmm15, xmm15
mov r14, qword [0x0203daa8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0046c1c0
Function at 0x47e980
Capabilities:
Reference http user-agent string

Disassembly:
xorps xmm15, xmm15
mov r14, qword [0x0203daa8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp fcn.004434e0
Function at 0x180004760
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x3d0], xmm13
movdqa xmmword [rbp + 0x3c0], xmm12
movdqa xmmword [rbp + 0x3b0], xmm11
movdqa xmmword [rbp + 0x3a0], xmm10
movdqa xmmword [rbp + 0x390], xmm9
movdqa xmmword [rbp + 0x380], xmm8
movdqa xmmword [rbp + 0x370], xmm7
movdqa xmmword [rbp + 0x360], xmm6
mov qword [rbp + 0x348], 0xfffffffffffffffe
mov rdi, qword [0x1800444c0]
cmp byte [0x18004584a], 0
jne 0x1800048b8
movabs rax, 0x57c1e57263a05217
add rax, rdi
movabs rcx, 0x57c1e57263a0522c
add rcx, rdi
xor edx, edx
lea r8, [0x180045842]
nop word cs:[rax + rax]
movzx r10d, byte [rcx + rdx]
movzx r9d, byte [rax + rdx]
mov ebx, r10d
and bl, 0xb0
mov r11d, r10d
and r11b, 0x4c
or r11b, 0xa1
xor r11b, bl
mov esi, ebx
xor sil, 0xb0
mov ebx, r10d
and bl, 0x4f
mov r14d, ebx
not r14b
mov r15d, r14d
and r15b, 0xa1
mov r12d, r10d
and r12b, 2
or r12b, r15b
or r12b, 0x5c
xor r11b, r12b
xor r11b, 0xec
or bl, sil
and sil, 0x10
mov r15d, r10d
and r15b, 0xa0
or r15b, sil
and r10b, 0x4d
and r14b, 0xa2
or r14b, r10b
or r15b, 2
xor r15b, r14b
not bl
or bl, r15b
not bl
or bl, r11b
mov r10d, r9d
xor r10b, 0xb0
xor r9b, 0x4f
or r9b, r10b
not r9b
or r9b, r10b
xor r9b, bl
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 8
jne 0x180004810
mov byte [0x18004584a], 1
lea rcx, [0x180045842]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
cmp byte [0x180045858], 0
jne 0x18000498c
movabs rax, 0x57c1e57263a0524c
add rax, rdi
movabs rcx, 0x57c1e57263a05268
add rcx, rdi
xor edx, edx
lea r8, [0x18004584b]
nop dword [rax + rax]
movzx r9d, byte [rcx + rdx]
mov esi, r9d
not sil
mov r11d, r9d
and r11b, 0xa0
or r11b, 0x59
mov r10d, r9d
and r10b, 0x5f
xor r10b, r11b
mov r11d, r10d
xor r11b, 0x6c
and r10b, 0x35
xor r10b, 0x11
or r10b, r11b
and sil, 0xca
mov r11d, r9d
xor r11b, 0x35
or r11b, sil
mov esi, r11d
and sil, 0xd0
mov r14d, r11d
and r14b, 0x2e
and r9b, 1
or r9b, r14b
or r9b, 0xd0
xor r9b, sil
xor r9b, r10b
xor r9b, 0xd1
or r11b, r10b
not r11b
or r11b, r9b
xor r11b, byte [rax + rdx]
xor r11b, 0xca
mov byte [rdx + r8], r11b
inc rdx
cmp rdx, 0xd
jne 0x180004900
mov byte [0x180045858], 1
lea rcx, [0x18004584b]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, qword [0x1800444d8]
movabs rdx, 0x57c1e57263a04fae
add rdx, rcx
movabs r8, 0x57c1e57263a04f5e
add r8, rcx
test rbx, rbx
cmovne r8, rdx
mov r12, rax
movabs rdx, 0xca8f01b361c2250f
mov rax, qword [r8]
add rax, rdx
jmp rax
Function at 0x18000a0f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rax, qword [rcx + 8]
test rax, rax
jne 0x18000a2a8
cmp byte [0x1800459c2], 0
jne 0x18000a297
mov rdx, qword [0x180044590]
movabs rax, 0xbd48b80e3a0dbe6
add rax, rdx
movabs rcx, 0xbd48b80e3a0dc03
add rcx, rdx
movabs r9, 0xbd48b80e3a0dc15
add r9, rdx
lea r8, [0x1800459b0]
cmp r9, r8
jbe 0x18000a1ad
lea r9, [0x1800459c2]
cmp rax, r9
jae 0x18000a1ad
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, byte [rcx + rdx]
movzx r10d, byte [rax + rdx]
mov r11d, r10d
and r11b, 0x92
or r11b, 0x25
mov ebx, r10d
and bl, 0x6d
xor bl, r11b
xor bl, 0xda
mov r11d, ebx
xor r11b, r9b
or bl, r9b
not bl
or bl, r11b
not r10b
or r10b, r9b
and r10b, bl
not r10b
mov byte [rdx + r8], r10b
inc rdx
cmp rdx, 0x12
jne 0x18000a160
jmp 0x18000a290
movdqu xmm1, xmmword [rcx]
movdqu xmm2, xmmword [rax]
movdqa xmm0, xmmword [0x180038190]
pand xmm0, xmm2
por xmm0, xmmword [str.________________mmmmmmmmmmmmmmmm]
movdqa xmm3, xmmword [0x180038330]
pand xmm3, xmm2
pxor xmm3, xmm0
pxor xmm3, xmmword [0x180038340]
movdqa xmm4, xmm3
pxor xmm4, xmm1
por xmm3, xmm1
pcmpeqd xmm0, xmm0
pxor xmm3, xmm0
por xmm3, xmm4
pxor xmm2, xmm0
por xmm2, xmm1
pand xmm2, xmm3
pxor xmm2, xmm0
movdqa xmmword [0x1800459b0], xmm2
movabs rax, 0xbd48b80e3a0dc13
movzx eax, word [rdx + rax]
movabs rcx, 0xbd48b80e3a0dbf6
movzx ecx, word [rdx + rcx]
movd xmm1, ecx
movdqa xmm2, xmmword [0x180038210]
pand xmm2, xmm1
por xmm2, xmmword [0x180038350]
movdqa xmm3, xmmword [0x180038360]
pand xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmmword [0x180038370]
movd xmm2, eax
movdqa xmm4, xmm3
pxor xmm4, xmm2
por xmm3, xmm2
pxor xmm3, xmm0
por xmm3, xmm4
pxor xmm1, xmm0
por xmm1, xmm2
pand xmm1, xmm3
pxor xmm1, xmm0
movd eax, xmm1
mov word [0x1800459c0], ax
mov byte [0x1800459c2], 1
movabs rax, 0xbd48b80e3a0d3c3
add rax, qword [0x180044598]
pop rbx
ret
Function at 0x18000a600
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x1800459f6], 0
jne 0x18000a70d
mov rax, qword [0x1800445c0]
movabs r9, 0x938a255a605077d6
add r9, rax
movabs r10, 0x938a255a605077c4
add r10, rax
xor r8d, r8d
movabs r11, 0xe38e38e38e38e38f
lea rsi, [0x1800459e1]
nop dword [rax + rax]
mov rax, r8
mul r11
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
mov rdx, r10
sub rdx, rax
movzx eax, byte [r9 + r8]
movzx edx, byte [rdx + r8]
mov ebp, edx
not bpl
mov ebx, edx
and bl, 0xa8
or bl, 1
mov edi, edx
and dil, 0x41
xor dil, bl
mov ebx, edx
and bl, 0x16
or bl, dil
mov edi, ebx
xor dil, 1
xor bl, 0x5b
or bl, dil
mov edi, ebx
not dil
and bpl, 0xa5
xor dl, 0x5a
or dl, bpl
mov ebp, eax
and bpl, 0xa5
or bpl, 0x12
and al, 0x5a
xor al, bpl
mov ebp, eax
xor bpl, 0xb7
mov r14d, edi
and r14b, 0x20
or r14b, 0x9e
xor r14b, dl
or dl, bl
and bl, 0x9e
and dil, 0x41
or dil, bl
or dil, 0x20
xor r14b, dil
xor r14b, 0xdf
not dl
or dl, r14b
xor al, 0x48
or al, dl
not dl
or dl, bpl
xor al, dl
mov byte [r8 + rsi], al
inc r8
cmp r8, 0x15
jne 0x18000a650
mov byte [0x1800459f6], 1
mov qword [rcx + 0x10], 0
lea rax, [0x1800459e1]
mov qword [rcx + 8], rax
lea rax, vtable.std::bad_array_new_length.0
mov qword [rcx], rax
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret