joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005cf90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1402792b8]
xor rax, rsp
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
xor r15d, r15d
mov qword [rbp], r15
lea rdx, [rsp + 0x50]
call fcn.14005c7b0
test al, al
je 0x14005d165
mov dword [rsp + 0x30], 0x140e1e47
mov word [rsp + 0x34], 0x19
mov byte [rsp + 0x36], 1
mov eax, r15d
nop word [rax + rax]
lea ecx, [rax + 0x69]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 5
jb 0x14005d000
mov byte [rsp + 0x36], 0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14005c960
mov rsi, rax
mov dword [rsp + 0x38], 0xd0f1847
mov dword [rsp + 0x3c], 0x1000f19
mov rdx, r15
nop word [rax + rax]
lea ecx, [rdx + 0x69]
xor byte [rsp + rdx + 0x38], cl
inc rdx
cmp rdx, 6
jb 0x14005d040
mov byte [rsp + 0x3f], 0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.14005c960
mov r14, rax
test rsi, rsi
je 0x14005d165
cmp rsi, rax
jae 0x14005d165
mov dword [rbp + 0x20], 1
mov dword [rbp + 0x24], 2
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x2c], 8
mov dword [rbp + 0x30], 0x10
mov dword [rbp + 0x34], 0x20
mov dword [rbp + 0x38], 0x40
mov dword [rbp + 0x3c], 0x80
mov dword [rbp + 0x40], 0x100
mov dword [rbp + 0x44], 0x200
mov dword [rbp + 0x48], 0x400
mov dword [rbp + 0x4c], 0x80000000
lea rdi, [rbp + 0x20]
mov edx, dword [rsi + 8]
add edx, 0x1000
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x18]
mov qword [rbp + 0x18], rcx
mov qword [rsp + 0x40], rdx
mov dword [rbp + 0x10], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rdi]
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x18]
call fcn.14005c4d0
mov edx, dword [r14 + 8]
mov ecx, dword [r14 + 0xc]
mov rax, qword [rsp + 0x68]
add rcx, qword [rax + 0x18]
mov qword [rsp + 0x40], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x10], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rdi]
lea r8, [rbp + 0x18]
lea rdx, [rsp + 0x40]
call fcn.14005c4d0
add rdi, 4
lea rax, [rbp + 0x50]
cmp rdi, rax
jne 0x14005d0d1
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14005d1a6
mov rdx, qword [rbp]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d1a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005d1a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005d57c
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.14005db50
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14005d1d0
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1402792b8]
xor rax, rsp
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
xor ebx, ebx
mov qword [rbp - 0x20], rbx
lea rdx, [rsp + 0x30]
call fcn.14005c7b0
test al, al
je 0x14005d30e
mov dword [rsp + 0x20], 0x140e1e47
mov word [rsp + 0x24], 0x19
mov byte [rsp + 0x26], 1
mov ecx, ebx
lea eax, [rcx + 0x69]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 5
jb 0x14005d230
mov byte [rsp + 0x26], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14005c960
mov rsi, rax
mov dword [rsp + 0x28], 0xd0f1847
mov dword [rsp + 0x2c], 0x1000f19
mov rdx, rbx
nop word [rax + rax]
lea ecx, [rdx + 0x69]
xor byte [rsp + rdx + 0x28], cl
inc rdx
cmp rdx, 6
jb 0x14005d270
mov byte [rsp + 0x2f], 0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.14005c960
mov rdi, rax
mov dword [rsp + 0x20], 0x180a0e47
mov word [rsp + 0x24], 0xc
mov byte [rsp + 0x26], 1
nop dword [rax + rax]
lea ecx, [rbx + 0x69]
xor byte [rsp + rbx + 0x20], cl
inc rbx
cmp rbx, 5
jb 0x14005d2b0
mov byte [rsp + 0x26], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14005c960
mov rbx, rax
test rsi, rsi
je 0x14005d30e
cmp rsi, rdi
jae 0x14005d30e
cmp rdi, rax
jae 0x14005d30e
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov eax, dword [rdi + 0xc]
mov rcx, qword [rbp + 0x18]
div ecx
test edx, edx
jne 0x14005d30e
xor edx, edx
mov eax, dword [rbx + 0xc]
div ecx
test edx, edx
jne 0x14005d30e
mov bl, 1
jmp 0x14005d310
xor bl, bl
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14005d351
mov rdx, qword [rbp - 0x20]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d34c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005d34c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005d57c
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14005db50
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14005e1fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005e246
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005e246
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005e246
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005e246
cmp dword [rcx + 0x84], 0xe
jbe 0x14005e246
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005e248
xor al, al
add rsp, 0x28
ret
Function at 0x14005e634
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14005e6b8
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14023c5e0]
cmp byte [rcx + rax], 0
je 0x14005e6b8
dec r8
sub rdx, 1
jne 0x14005e69e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x417f20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4180cb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x011ee048]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x417f8e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417fa1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417fc5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417fd9
cmp rbx, 0x1000
jae 0x417f98
nop
jmp 0x418049
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x417fed
xor edx, edx
jmp 0x418040
mov rcx, qword [0x011ee048]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x417fcf
jmp 0x417fb5
call fcn.00465c80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438080
lea rax, [0x00b9aff8]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00438980
mov rax, qword [rsp + 0x38]
call fcn.00438680
lea rax, [0x00b9b2c8]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438980
mov rax, qword [rsp + 0x30]
call fcn.00438680
call fcn.004382e0
call fcn.00438100
lea rax, [0x00ba4dd8]
mov ebx, 0x21
call fcn.00436900
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004620e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417f20
Function at 0x418100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41832a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x011ee050]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432f40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41817b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41818e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4181b0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4181c4
cmp rbx, 0x1000
jae 0x418185
jmp 0x41824e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4181d6
xor esi, esi
jmp 0x418240
mov rax, qword [0x011ee050]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00432f40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4181ba
jmp 0x4181a2
call fcn.00465c80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4182c9
call fcn.00438080
lea rax, [0x00b9c204]
mov ebx, 0x19
call fcn.00438980
mov rax, qword [rsp + 0x68]
call fcn.00438680
lea rax, [0x00b9b2c8]
mov ebx, 0x19
nop
call fcn.00438980
mov eax, dword [rsp + 0x34]
call fcn.00438680
call fcn.004382e0
call fcn.00438100
lea rax, [0x00b8fa93]
mov ebx, 0xd
call fcn.00436900
cmp eax, 0x5af
je 0x418273
call fcn.00438080
lea rax, [0x00b9c204]
mov ebx, 0x19
call fcn.00438980
mov rax, qword [rsp + 0x38]
call fcn.00438680
lea rax, [0x00b9b2c8]
mov ebx, 0x19
nop dword [rax]
call fcn.00438980
mov eax, dword [rsp + 0x34]
call fcn.00438680
call fcn.004382e0
call fcn.00438100
lea rax, [0x00ba2915]
mov ebx, 0x1f
call fcn.00436900
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004620e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418100
Function at 0x41fa00
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x0135f51e], 0
jne 0x41faf9
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and rbx, 7
mov rsi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41faef
lea rbx, [0x01331958]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41faca
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x16a8], rsi
add qword [rax + 0x16b0], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00464800
lea rax, [0x00bae1a3]
mov ebx, 0x2c
call fcn.00436900
nop
int3
Function at 0x42ef40
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42f1e6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x16d0]
mov rcx, qword [rax + 0x16c0]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42f1da
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x16c0], 0
cmp byte [0x0135f51e], 0
jne 0x42efa2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42efeb
xor edx, edx
jmp 0x42efce
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x16d0]
mov rax, rcx
call fcn.0041f220
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42efa6
add rax, 0x16c0
call fcn.0042ee00
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42f172
mov rsi, qword [rax + rdx*8 + 0x16d0]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42efe8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00413f60
test rax, rax
jne 0x42f042
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42efe8
nop
mov rsi, rcx
shr rcx, 3
and rsi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42f085
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42efe8
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42f1cd
lea r10, [0x01331958]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42f10c
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42f145
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x16a8]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x16a8], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42efe8
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42f1c5
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x16d0], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42efe8
cmp rbx, 0x200
ja 0x42f1b7
lea rdx, [rax + 0x16d0]
lea rsi, [rax + 0x1698]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004248e0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x16c0]
call fcn.0042ee00
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.00464860
mov rax, r8
call fcn.004647e0
mov rax, r8
mov ecx, 0x40
call fcn.00464800
mov edx, 0x200
nop
call fcn.00464840
nop
mov qword [rsp + 8], rax
call fcn.00466800
mov rax, qword [rsp + 8]
jmp fcn.0042ef40
Function at 0x430f80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43121d
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x013053a0]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.00432ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x43108e
nop
jne 0x431016
cmp dword [rsp + 0x4c], 0
jne 0x431016
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x43108e
mov rax, qword [0x01305398]
nop dword [rax]
call fcn.00432d60
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x01360fca]
mov ebx, 0x20
mov ecx, 0x21
call fcn.004317c0
mov rcx, qword [0x0135f7f8]
nop word [rax + rax]
cmp rcx, 0x105
ja 0x431212
mov qword [rsp + 0x58], rcx
lea rax, [0x01360de0]
lea rbx, [0x013607e0]
call fcn.00465140
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x4310a0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rdx + rbx + 1], dil
inc rax
cmp rax, 0x20
jge 0x43110e
lea rdx, [rcx + rax*2]
lea rbx, [0x01360de0]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x00b91c63]
movzx esi, byte [rdi + rsi]
cmp rdx, 0x20b
jae 0x431205
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
nop word [rax + rax]
cmp rsi, 0x20b
jb 0x431098
jmp 0x4311f5
lea rdx, [rcx + 0x40]
jmp 0x431122
lea rbx, [0x01360de0]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x431139
cmp rdx, 0x20b
jb 0x431114
jmp 0x4311e8
mov rax, qword [0x011ee140]
lea rcx, [0x01360de0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.004330c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.00465c80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x4311d7
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.00438080
lea rax, [0x00bb9314]
mov ebx, 0x5f
call fcn.00438980
call fcn.00438100
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [0x0135f50b], 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.004647e0
mov rax, rsi
mov ecx, 0x20b
nop dword [rax]
call fcn.004647e0
mov rax, rdx
mov ecx, 0x20b
call fcn.004647e0
mov edx, 0x105
call fcn.00464840
nop
nop dword [rax]
call fcn.004620e0
jmp fcn.00430f80
Function at 0x4314e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x431799
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.00430160
cmp dword [0x0135fa40], 0
jne 0x43155c
mov qword [0x01305360], rax
jmp 0x431568
lea rdi, [0x01305360]
call fcn.00464340
test rax, rax
je 0x431787
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.00430160
cmp dword [0x0135fa40], 0
jne 0x4315c7
mov qword [0x01305380], rax
jmp 0x4315d3
lea rdi, [0x01305380]
call fcn.00464340
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.00430160
cmp dword [0x0135fa40], 0
jne 0x43163b
mov qword [0x01305388], rax
jmp 0x431647
lea rdi, [0x01305388]
call fcn.00464340
cmp qword [0x01305380], 0
je 0x431776
test rax, rax
je 0x431776
mov qword [rsp + 0x20], 0
mov rax, qword [0x01305388]
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop dword [rax]
call fcn.00432dc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x431765
cmp rax, 0x7fffffff
jg 0x431751
mov qword [rsp + 0x28], rax
mov rax, qword [0x01305380]
lea rcx, [0x0135f7d0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00432dc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x431703
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x431722
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x4316fd
sub rbx, rsi
bts edi, ecx
nop
jmp 0x4316fd
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x0135f7c8], rax
mov byte [0x0135f520], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x00bb8c24]
mov ebx, 0x56
nop dword [rax]
call fcn.00436900
lea rax, [0x00bb8561]
mov ebx, 0x50
call fcn.00436900
lea rax, [0x00b9db46]
mov ebx, 0x1b
call fcn.00436900
lea rax, [0x00bb0b2b]
mov ebx, 0x30
call fcn.00436900
nop
mov qword [rsp + 8], rax
nop
call fcn.004620e0
mov rax, qword [rsp + 8]
jmp fcn.004314e0
Function at 0x451160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4512d8
movzx edx, byte [rax]
nop
test edx, edx
jne 0x45119c
test r8b, r8b
jne 0x45119c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x4511af
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x451298
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x451286
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x45127c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x451203
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x451246
mov eax, 1
cmp rax, rbx
ja 0x451235
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.004648a0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x451274
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x45123d
mov r8d, eax
mov eax, r10d
jmp 0x451208
mov rcx, rbx
call fcn.004647e0
xor eax, eax
mov rcx, rbx
call fcn.004647e0
mov eax, r8d
mov rcx, rbx
call fcn.004648a0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4512ce
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x451291
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4511b5
mov eax, edx
mov rcx, rbx
call fcn.004647e0
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.004647e0
nop
int3