joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a80a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a8331
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movups xmmword [rsp + 0x68], xmm15
mov qword [rsp + 0x88], rax
mov byte [rsp + 0x2b], 0
mov qword [rsp + 0x38], 0
movups xmmword [rsp + 0x48], xmm15
mov rcx, qword [rax + 8]
mov qword [rsp + 0x30], rcx
mov ebx, 0xffffffff
mov rax, rcx
call fcn.00490620
test eax, eax
je 0x4a8182
cmp eax, 0xffffffff
jne 0x4a8141
lea rax, [0x0064975f]
mov rdi, rcx
mov rcx, rbx
mov ebx, 0x13
call fcn.004a7580
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rcx, rbx
mov rbx, rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006551e8]
mov ebx, 0x2e
call fcn.00468600
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rdx, rbx
mov rbx, rcx
mov rcx, rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x2c]
call fcn.0048f8e0
nop dword [rax]
test rax, rax
jne 0x4a82cf
lea rax, [0x0062a8a0]
call fcn.0040d1e0
mov qword [rsp + 0x40], rax
lea rcx, [rax + 8]
lea rdi, [rax + 0x10]
lea rsi, [rax + 0x18]
mov rbx, rax
mov rax, qword [rsp + 0x30]
call fcn.0048fc80
test rax, rax
je 0x4a821c
mov rcx, rax
mov rdi, rbx
lea rax, [0x006479fe]
mov ebx, 0xf
call fcn.004a7580
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rcx, rbx
mov rbx, rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rax, qword [rsp + 0x88]
call fcn.004a7700
lea rcx, fcn.004ac620
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x2b], 1
movups xmmword [rsp + 0x58], xmm15
lea rcx, [0x004a8360]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x60], rcx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x68], rdx
mov byte [rsp + 0x2b], 3
lea rax, [0x00621ae0]
call fcn.0040d1e0
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x2c]
mov dword [rax + 8], ecx
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x48], xmm15
mov byte [rsp + 0x2b], 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rdx]
call rcx
mov byte [rsp + 0x2b], 0
call fcn.004ac620
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rcx, rax
mov rdi, rbx
lea rax, [0x00648e15]
mov ebx, 0x12
call fcn.004a7580
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rcx, rbx
mov rbx, rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.004a80a0
Function at 0x4a8880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a8af8
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
xor ecx, ecx
xor edx, edx
xor esi, esi
xor edi, edi
xor r8d, r8d
jmp 0x4a88c3
dec rbx
mov r10, rbx
neg rbx
sar rbx, 0x3f
and ebx, 1
add rax, rbx
mov rbx, r10
mov rcx, r9
test rbx, rbx
je 0x4a8ad9
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x46], r8b
movzx r9d, byte [rax]
mov byte [rsp + 0x47], r9b
cmp r9b, 0x20
jbe 0x4a8a20
cmp r9b, 0x22
je 0x4a8904
cmp r9b, 0x5c
jne 0x4a8a31
lea r9, [rcx + 1]
jmp 0x4a88aa
mov qword [rsp + 0x48], rcx
mov r8, rcx
shr rcx, 0x3f
lea r9, [rcx + r8]
sar r9, 1
mov rax, rdi
mov rbx, rdx
mov rcx, rsi
mov rdi, r9
call fcn.004a87e0
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x48]
bt edx, 0
jb 0x4a89c7
movzx edx, byte [rsp + 0x46]
test dl, dl
je 0x4a89ad
mov r8, qword [rsp + 0x58]
cmp r8, 1
jle 0x4a89a6
mov r9, qword [rsp + 0x60]
cmp byte [r9 + 1], 0x22
jne 0x4a89b7
lea rsi, [rbx + 1]
cmp rcx, rsi
jae 0x4a8992
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
lea rax, [0x005fe2e0]
call fcn.00448f20
lea rsi, [rbx + 1]
movzx edx, byte [rsp + 0x46]
mov rbx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
movzx r10d, byte [rsp + 0x47]
mov byte [rax + rbx], r10b
lea rbx, [r8 - 1]
lea r8, [r9 + 1]
jmp 0x4a89c2
mov r9, qword [rsp + 0x60]
jmp 0x4a89b7
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
mov rbx, r8
mov r8, r9
mov rsi, qword [rsp + 0x50]
xor edx, 1
jmp 0x4a8a07
lea rsi, [rbx + 1]
cmp rcx, rsi
jae 0x4a89ee
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
lea rax, [0x005fe2e0]
call fcn.00448f20
lea rsi, [rbx + 1]
mov rbx, qword [rsp + 0x50]
movzx r9d, byte [rsp + 0x47]
mov byte [rax + rbx], r9b
mov rbx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
movzx edx, byte [rsp + 0x46]
xor r9d, r9d
mov rdi, rax
mov rax, r8
mov r8d, edx
mov rdx, rsi
mov rsi, rcx
jmp 0x4a88aa
cmp r9b, 9
je 0x4a8a2c
cmp r9b, 0x20
jne 0x4a8a31
test r8b, r8b
je 0x4a8a9c
mov rax, rdi
mov rbx, rdx
mov rdi, rcx
mov rcx, rsi
nop dword [rax]
call fcn.004a87e0
lea rsi, [rbx + 1]
cmp rcx, rsi
jae 0x4a8a71
mov qword [rsp + 0x50], rbx
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
lea rax, [0x005fe2e0]
call fcn.00448f20
lea rsi, [rbx + 1]
mov rbx, qword [rsp + 0x50]
movzx r10d, byte [rsp + 0x47]
mov byte [rax + rbx], r10b
mov rbx, qword [rsp + 0x58]
mov rdx, rsi
mov rsi, rcx
xor r9d, r9d
mov rdi, rax
movzx r8d, byte [rsp + 0x46]
mov rax, qword [rsp + 0x60]
jmp 0x4a88aa
mov rax, rdi
mov rbx, rdx
mov rdi, rcx
mov rcx, rsi
call fcn.004a87e0
mov rdx, qword [rsp + 0x58]
lea rsi, [rdx - 1]
mov rdx, rsi
neg rsi
sar rsi, 0x3f
and esi, 1
mov r8, qword [rsp + 0x60]
lea rdi, [rsi + r8]
mov rsi, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdi
mov rbx, rdx
mov rdi, rcx
mov rcx, rsi
call fcn.004a87e0
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004a8880
Function at 0x4aad60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aaefb
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
nop dword [rax]
cmp rbx, 2
jl 0x4aae36
movzx ecx, byte [rax]
cmp byte [rax + 1], 0x3a
jne 0x4aadbc
lea edx, [rcx - 0x30]
cmp dl, 9
jbe 0x4aadad
lea edx, [rcx - 0x61]
nop
cmp dl, 0x19
jbe 0x4aadad
lea edx, [rcx - 0x41]
cmp dl, 0x19
ja 0x4aadbc
mov ebx, 2
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
cmp rbx, 5
jge 0x4aadd0
xor ecx, ecx
jmp 0x4aade3
mov eax, ecx
call fcn.004aac00
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x20]
test cl, cl
jne 0x4aadeb
xor ecx, ecx
jmp 0x4aae25
movzx ecx, byte [rax + 1]
mov eax, ecx
call fcn.004aac00
test al, al
jne 0x4aae08
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
jmp 0x4aae25
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + 2]
call fcn.004aac00
xor eax, 1
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x20]
test cl, cl
je 0x4aae44
cmp byte [rax + 2], 0x2e
je 0x4aae44
mov ecx, 3
jmp 0x4aae65
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rdx, qword [rsp + 8]
lea rcx, [rdx + 1]
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
lea rdx, [rbx - 1]
cmp rcx, rdx
jge 0x4aae44
mov qword [rsp + 8], rcx
movzx edx, byte [rcx + rax]
mov eax, edx
call fcn.004aac00
nop
test al, al
je 0x4aae52
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
movzx eax, byte [rdx + rcx + 1]
call fcn.004aac00
test al, al
jne 0x4aae44
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
movzx edx, byte [rcx + rax + 1]
cmp dl, 0x2e
je 0x4aae44
inc rcx
jmp 0x4aaec3
mov rdx, qword [rsp + 8]
lea rcx, [rdx + 1]
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jle 0x4aaeee
mov qword [rsp + 8], rcx
movzx edx, byte [rcx + rax]
mov eax, edx
call fcn.004aac00
nop dword [rax]
test al, al
je 0x4aaeb5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004aad60

Function at 0x4ab1e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab236
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
test rax, rax
jne 0x4ab213
mov qword [rsp + 0x20], rax
nop
call fcn.004a1900
test al, al
jne 0x4ab222
call fcn.0045c2c0
mov rax, qword [rsp + 0x20]
call fcn.0045c6c0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x00684c10]
call fcn.00436780
nop
mov qword [rsp + 8], rax
nop dword [rax + rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.004ab1e0
Function at 0x4b3980
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3a91
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
test rax, rax
je 0x4b3a7d
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rax
lea rax, [0x0062ff40]
call fcn.0040d1e0
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
call fcn.004b3b20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], edi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x60], r11
movups xmm0, xmmword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
movups xmmword [rdi], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rdi + 0x30], xmm0
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
lea rcx, [0x006863d8]
call fcn.004b3ba0
lea rax, [0x006149c0]
call fcn.0040d1e0
lea rcx, [0x004b3ac0]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x20]
mov qword [rax + 8], rbx
mov rcx, rax
lea rax, [0x00687250]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x005fe120]
lea rbx, [0x00684670]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b3980
Function at 0x4b44a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4b467b
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdi
test rcx, rcx
je 0x4b4667
mov byte [rsp + 0xa8], bl
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], rcx
test byte [rax], al
lea rcx, [rax + 0x10]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.00472620
mov rcx, qword [rsp + 0xa0]
cmp qword [rcx + 0x30], 0
nop
jne 0x4b45c7
mov rdx, qword [rsp + 0xb0]
mov qword [rcx + 0x30], rdx
mov rbx, qword [rsp + 0xb8]
mov qword [rcx + 0x38], rbx
lea rax, [rcx + 0x18]
mov qword [rsp + 0x20], rax
call fcn.00466b40
lea rcx, [0x005fc9e0]
cmp rax, rcx
je 0x4b455a
xor ebx, ebx
test rbx, rbx
je 0x4b4569
mov rax, rbx
call fcn.00405dc0
jmp 0x4b4585
mov rdx, qword [0x007ddde0]
mov rax, qword [rsp + 0x20]
mov rbx, rcx
mov rcx, rdx
nop dword [rax + rax]
call fcn.00466ba0
mov rdx, qword [rsp + 0xa0]
mov rbx, qword [rdx + 0x28]
lea rdi, [rsp + 0x30]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004618eb
mov rbp, qword [rbp]
lea rax, [0x00608ce0]
lea rcx, [rsp + 0x30]
nop
call fcn.0040f400
jmp 0x4b460c
mov rax, qword [rsp + 0x28]
call fcn.00472920
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov rsi, qword [rdx]
mov rax, qword [rdx + 8]
mov rdx, qword [rsi + 0x20]
xor ebx, ebx
mov rcx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
nop
call rdx
lea rax, [rsp + 0x30]
call fcn.0040f580
mov rdx, qword [rsp + 0x30]
test rdx, rdx
jne 0x4b45e1
mov rcx, qword [rsp + 0xa0]
mov qword [rcx + 0x28], 0
mov rax, qword [rsp + 0x28]
call fcn.00472920
movzx ecx, byte [rsp + 0xa8]
test cl, cl
je 0x4b4657
mov rdi, qword [rsp + 0xa0]
mov rax, qword [rdi]
mov rbx, qword [rdi + 8]
lea rcx, [0x006863d8]
call fcn.004b3f80
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
lea rax, [0x005fe120]
lea rbx, [0x00684680]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004b44a0
Function at 0x4b4f40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b504e
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r8
test rax, rax
je 0x4b503a
nop
test rcx, rcx
je 0x4b5027
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], r8
mov rax, rcx
mov rbx, rdi
call fcn.00467e00
mov rcx, qword [rax + 0x20]
mov rax, rbx
call rcx
test al, al
je 0x4b5014
lea rax, [0x0062cc80]
call fcn.0040d1e0
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x28], rcx
mov rbx, rax
lea rax, [0x006872f8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x006846a0]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684690]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684670]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004b4f40

Function at 0x4bf100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf1cf
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403180
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4bf199
xor eax, eax
lea rbx, [0x006443ab]
mov ecx, 1
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
lea r8, [0x0064445d]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x70]
call fcn.0044cb40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x0064439d]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
nop dword [rax + rax]
call fcn.0044ca60
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004bf100
Function at 0x4ca180
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ca22e
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor ebx, ebx
xor ecx, ecx
nop dword [rax]
call fcn.0048b780
test r8, r8
jne 0x4ca214
cmp esi, 1
je 0x4ca205
movups xmmword [rsp + 0x28], xmm15
mov eax, esi
call fcn.0040a740
lea rcx, [0x005fe260]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x00653def]
mov ebx, 0x29
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
xor ecx, ecx
xor edi, edi
mov rsi, rax
mov r8, rbx
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rcx, rax
mov rdi, rbx
mov rsi, r8
mov r8, r9
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.004ca180

Function at 0x4cab00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cab57
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rax]
test rcx, rcx
je 0x4cab27
nop dword [rax]
cmp rax, rcx
je 0x4cab39
jmp 0x4cab43
mov qword [rsp + 0x20], rax
call fcn.004caae0
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x006850a0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.004cab00

Function at 0x4cacc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cad28
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
nop
call fcn.004cab00
mov rbx, qword [rsp + 0x28]
test rbx, rbx
jl 0x4cad14
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
sub rcx, qword [rax + 0x10]
nop dword [rax]
cmp rbx, rcx
jle 0x4cad0a
call fcn.004cac00
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x006850b0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004cacc0
Function at 0x4cb3a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cb46a
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
bt ebx, 0
jb 0x4cb456
mov qword [rsp + 0x50], rbx
test rbx, rbx
ja 0x4cb3d7
xor ecx, ecx
xor edx, edx
jmp 0x4cb402
mov qword [rsp + 0x48], rax
lea rax, [0x005fe120]
xor ecx, ecx
mov rdi, rcx
mov rsi, rbx
xor ebx, ebx
call fcn.00448f20
mov rbx, qword [rsp + 0x50]
mov rdx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rdi, rax
mov rsi, rbx
lea rax, [0x005fe120]
mov rbx, rcx
mov rcx, rsi
nop
call fcn.00414620
lea rax, [0x006227a0]
call fcn.0040d1e0
mov rdx, qword [rsp + 0x50]
mov qword [rax + 0x28], rdx
mov rdx, qword [rsp + 0x28]
mov qword [rax + 0x30], rdx
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x20], rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x005fe120]
lea rbx, [0x006850d0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004cb3a0
Function at 0x4d1460
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d14d5
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
test rbx, rbx
jne 0x4d1488
call fcn.004d1500
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov byte [rax + 0x20], 0
jl 0x4d14c1
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.004d1440
mov rcx, qword [rsp + 0x28]
cmp rax, rcx
jl 0x4d14c1
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x18]
add rcx, rdx
mov qword [rax + 8], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x00684600]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004d1460

Function at 0x4d3280
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d32c7
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rcx, [rax - 1]
cmp rcx, 0x13
jae 0x4d32b3
mov rcx, qword [0x007d4bd0]
movzx eax, byte [rcx + rax]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x006846b0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.004d3280

Function at 0x4d33c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d3406
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp rax, 0x14
jae 0x4d33f2
shl rax, 3
add rax, qword [0x007e0500]
mov qword [rax], rbx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x006846c0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004d33c0
Function at 0x4d5c80
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4d5ceb
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4d5ca4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4d5cc1
cmp rdx, 0
je 0x4d5d0d
test rdx, 0xf
je 0x4d5c9d
test rdx, 7
jne 0x4d5cc1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4d5c9d
ret
Function at 0x4d83c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4d83ff
jb 0x4d8414
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x4d8480
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4d84bf
jb 0x4d84d4
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret