joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b0e0
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x50b27b
push rbp
mov rbp, rsp
sub rsp, 0xa0
nop word [rax + rax]
cmp cl, 0x10
jae 0x50b267
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xc0], cl
mov qword [rsp + 0xb8], rbx
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
nop
movabs rdx, 0xffffffff00000000
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0xffffffffffffffff
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x90], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x98], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x90]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x98]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov edx, 1
jmp 0x50b235
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.0050b000
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
movzx r8d, byte [rsp + 0xc0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xb8]
cmp dl, 0x10
jae 0x50b251
test byte [rax], al
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x50b1e8
jmp 0x50b25a
add rsp, 0xa0
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00466960
lea rax, [0x0065b7a0]
lea rbx, [0x00728240]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop dword [rax]
jmp fcn.0050b0e0
Function at 0x50d480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d59e
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rcx, rax
lea rax, [rsp + 0x38]
mov rbx, rcx
call fcn.0050d2e0
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.00518c40
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x58]
xor eax, eax
xor edx, edx
jmp 0x50d513
test byte [rcx], al
mov rsi, qword [rsp + rax*8 + 0x18]
xor rsi, qword [rcx + rax*8]
inc rax
or rdx, rsi
cmp rax, 4
jl 0x50d502
not rdx
mov rcx, rdx
shr rdx, 0x20
and rcx, rdx
mov rdx, rcx
shr rcx, 0x10
and rcx, rdx
mov rdx, rcx
shr rcx, 8
and rcx, rdx
mov rdx, rcx
shr rcx, 4
and rcx, rdx
mov rdx, rcx
shr rcx, 2
and rcx, rdx
mov rdx, rcx
shr rcx, 1
and rcx, rdx
and ecx, 1
nop
nop dword [rax + rax]
cmp rcx, 1
je 0x50d594
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x17
lea rcx, [0x006b7798]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x68
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0050d480
Function at 0x50e5c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e75f
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
xor ecx, ecx
xor edx, edx
jmp 0x50e5f0
mov rsi, qword [rax + rcx*8 + 0x40]
lea rdi, [0x00921680]
xor rsi, qword [rdi + rcx*8]
inc rcx
or rdx, rsi
cmp rcx, 4
jl 0x50e5da
not rdx
mov rcx, rdx
shr rdx, 0x20
and rdx, rcx
mov rcx, rdx
shr rdx, 0x10
and rdx, rcx
mov rcx, rdx
shr rdx, 8
and rdx, rcx
mov rcx, rdx
shr rdx, 4
and rdx, rcx
mov rcx, rdx
shr rdx, 2
and rdx, rcx
mov rcx, rdx
shr rdx, 1
and rdx, rcx
and edx, 1
nop
cmp rdx, 1
jne 0x50e673
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x23
lea rcx, [0x006bcea6]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00728640]
mov rsi, rax
xor eax, eax
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rbx, [rax + 0x40]
lea rax, [rsp + 0x18]
call fcn.0050e780
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.00518c40
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
nop dword [rax]
call fcn.00518e20
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rcx
call fcn.00519080
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x50]
test byte [rcx], al
mov qword [rsp], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 8], rdx
call fcn.00518a60
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov ebx, 0x20
mov rcx, rbx
xor edi, edi
xor esi, esi
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0050e5c0
Function at 0x511540
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x68]
cmp r12, qword [r14 + 0x10]
jbe 0x5116f1
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
call fcn.004fe3c0
nop word [rax + rax]
nop
cmp rax, 1
je 0x5116b7
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov rcx, qword [rsp + 0xf0]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0xa0]
call fcn.00501d00
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
test byte [rax], al
mov rcx, qword [rsp + 0xf0]
mov rbx, qword [rcx]
test byte [rbx], al
mov rcx, rax
lea rax, [rsp + 0x70]
call fcn.004fe7e0
mov rcx, qword [rsp + 0xf8]
test byte [rcx], al
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
lea rax, [rsp + 0x70]
lea rbx, [rsp + 0x40]
call fcn.004fe460
nop dword [rax]
cmp rbx, 0x30
ja 0x511638
mov rcx, rbx
mov rdx, qword [rsp + 0xf8]
mov esi, 0x30
jmp 0x511678
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0xf8]
mov ecx, 0x30
mov rdi, rbx
lea rsi, [0x0065bae0]
nop dword [rax]
call fcn.0044b880
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.00467360
mov rax, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
add rsp, 0xe0
pop rbp
ret
lea rax, [0x00673e00]
nop
call fcn.0040d680
mov qword [rax + 8], 0x23
lea rcx, [0x006bcec9]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00728640]
mov rsi, rax
xor eax, eax
add rsp, 0xe0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00511540
Function at 0x512280
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x512466
push rbp
mov rbp, rsp
sub rsp, 0xd0
nop word [rax + rax]
cmp cl, 0x10
jae 0x512452
mov qword [rsp + 0xe0], rax
mov byte [rsp + 0xf0], cl
mov qword [rsp + 0xe8], rbx
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
movabs rdx, 0xffffffff00000001
mov qword [rsp + 0x58], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 1
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb8], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xc0], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0xc8], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0xc0]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0xc8]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov edx, 1
jmp 0x512420
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.005121a0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
movzx r8d, byte [rsp + 0xf0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xe8]
nop
cmp dl, 0x10
jae 0x51243c
test byte [rax], al
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x5123d2
jmp 0x512445
add rsp, 0xd0
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00466960
lea rax, [0x0065b7a0]
lea rbx, [0x00728250]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00512280
Function at 0x514e40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb0]
cmp r12, qword [r14 + 0x10]
jbe 0x515021
push rbp
mov rbp, rsp
sub rsp, 0x128
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
call fcn.00502340
nop dword [rax]
cmp rax, 1
je 0x514fe9
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xd8], xmm15
movups xmmword [rsp + 0xe8], xmm15
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x108], xmm15
mov rcx, qword [rsp + 0x138]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0xd0]
call fcn.005093e0
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
test byte [rax], al
mov rcx, qword [rsp + 0x138]
mov rbx, qword [rcx]
test byte [rbx], al
mov rcx, rax
lea rax, [rsp + 0x88]
call fcn.00502800
mov rcx, qword [rsp + 0x140]
test byte [rcx], al
movups xmmword [rsp + 0x46], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
lea rax, [rsp + 0x88]
lea rbx, [rsp + 0x46]
call fcn.00502400
cmp rbx, 0x42
ja 0x514f6e
mov rcx, rbx
mov rdx, qword [rsp + 0x140]
mov esi, 0x42
jmp 0x514faa
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x140]
mov ecx, 0x42
mov rdi, rbx
lea rsi, [0x0065bae0]
call fcn.0044b880
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x120], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.00467360
mov rax, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
add rsp, 0x128
pop rbp
ret
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x23
lea rcx, [0x006bceec]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00728640]
mov rsi, rax
xor eax, eax
add rsp, 0x128
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00514e40
Function at 0x515da0
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x515fdd
push rbp
mov rbp, rsp
sub rsp, 0x118
nop dword [rax]
cmp cl, 0x10
jae 0x515fc9
mov qword [rsp + 0x128], rax
mov byte [rsp + 0x138], cl
mov qword [rsp + 0x130], rbx
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0x110], 0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x108], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x110], rdx
mov rdx, qword [rbx]
mov rsi, qword [rsp + 0xb8]
mov qword [rdx], rsi
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
jmp 0x515f97
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.00515cc0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x515fb3
test byte [rax], al
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x515f4a
jmp 0x515fbc
add rsp, 0x118
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00466960
lea rax, [0x0065b7a0]
lea rbx, [0x00728260]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop
jmp fcn.00515da0
Function at 0x519180
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x5191cd
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x519260
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x5192a5
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x51be40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51bee5
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
cmp rcx, 0x20
je 0x51be8d
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x2e
lea rcx, [0x006c0e46]
mov qword [rax], rcx
lea rbx, [0x00728640]
mov rcx, rax
xor eax, eax
add rsp, 0x10
pop rbp
ret
mov rdx, qword [rbx]
movabs rsi, 0x7ffffffffffff
and rdx, rsi
mov qword [rax], rdx
mov rdx, qword [rbx + 6]
shr rdx, 3
and rdx, rsi
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0xc]
shr rdx, 6
and rdx, rsi
mov qword [rax + 0x10], rdx
mov rdx, qword [rbx + 0x13]
shr rdx, 1
and rdx, rsi
mov qword [rax + 0x18], rdx
mov rdx, qword [rbx + 0x18]
shr rdx, 0xc
and rsi, rdx
mov qword [rax + 0x20], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0051be40

Function at 0x51bf20
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c054
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call fcn.0051b3e0
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x51bfb4
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x51bff7
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x51c021
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
movzx edi, byte [rsp + rcx + 0x10]
movzx r9d, byte [rbx + rsi]
or r9d, edi
mov byte [rbx + rsi], r9b
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x51bfae
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x51bfae
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x51c00a
mov rax, rsi
mov ecx, 0x20
call fcn.00466960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0051bf20
Function at 0x51d520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51d5ad
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
cmp qword [rbx], rdx
jne 0x51d55b
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rsi, qword [rax + 8]
mov rcx, qword [rbx + 8]
mov rax, rdx
mov rbx, rsi
call fcn.00404940
test al, al
jne 0x51d590
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x3b
lea rcx, [0x006c363a]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00728640]
mov rsi, rax
xor eax, eax
add rsp, 0x18
pop rbp
ret
mov rbx, qword [rsp + 0x28]
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
mov rdx, qword [rdx + 0x30]
mov rcx, qword [rsp + 0x30]
call rdx
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0051d520

Function at 0x51d720
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x51d886
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc8], rdi
cmp rsi, rbx
jne 0x51d86e
cmp rbx, 0x48
jg 0x51d85b
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
xor ecx, ecx
jmp 0x51d7c0
movzx r9d, byte [rax + rbx - 1]
mov byte [rsp + rcx + 0x58], r9b
mov byte [rsp + rcx + 0x10], sil
inc rcx
mov rbx, r8
mov rsi, rdx
nop dword [rax]
cmp rbx, rcx
jle 0x51d7ea
mov rdx, rsi
sub rsi, rcx
lea r8, [rsi - 1]
cmp rdx, r8
jbe 0x51d850
mov r8, rbx
sub rbx, rcx
lea r9, [rbx - 1]
movzx esi, byte [rdi + rsi - 1]
cmp r8, r9
ja 0x51d7a3
jmp 0x51d845
xor eax, eax
xor ecx, ecx
jmp 0x51d809
mov rdx, qword [rsp + rbx + 0x58]
mov rbx, qword [rsp + rbx + 0x10]
add rax, 8
neg ecx
sbb rdx, rbx
sbb rcx, rcx
neg rcx
cmp rax, 0x48
jge 0x51d828
lea rdx, [rax - 0x48]
mov rbx, rdx
neg rdx
sar rbx, 0x3f
and rbx, rax
cmp rdx, 7
ja 0x51d7f0
jmp 0x51d838
cmp rcx, 1
sete al
add rsp, 0xa0
pop rbp
ret
mov eax, 7
mov rcx, rdx
call fcn.00466960
mov rax, r9
mov rcx, r8
call fcn.00466960
mov rax, r8
mov rcx, rdx
call fcn.00466960
lea rax, [0x0065b7a0]
lea rbx, [0x00728150]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728140]
nop dword [rax]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0051d720