joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4021a3
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
movzx ecx, ax
mov ebx, eax
shr ebx, 0x10
mov eax, 1
test esi, esi
je 0x4022b9
test edi, edi
je 0x4022b2
mov edx, edi
cmp edi, 0x15b0
jbe 0x4021de
mov edx, 0x15b0
sub edi, edx
cmp edx, 0xf
jle 0x402277
movzx eax, byte [esi]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 1]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 2]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 3]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 4]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 5]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 6]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 7]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 8]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 9]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xa]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xb]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xc]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xd]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xe]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xf]
add ecx, eax
add ebx, ecx
add esi, 0x10
sub edx, 0x10
cmp edx, 0xf
jg 0x4021e9
test edx, edx
je 0x402286
movzx eax, byte [esi]
add ecx, eax
inc esi
add ebx, ecx
dec edx
jne 0x40227b
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xfff1
sub ecx, edx
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul edx, edx, 0xfff1
sub ebx, edx
test edi, edi
jne 0x4021cf
mov eax, ebx
shl eax, 0x10
or eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402e8f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 8]
mov dword [ebp - 0x10], eax
mov edi, dword [esi + 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov dword [esi], eax
cmp dword [0x406040], 0x2fd70bbd
jne 0x402ec6
call fcn.00404ea2
mov dword [esp + 4], 0x409120
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.0040240f
mov word [ebx], 0x17
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00404cbe
mov dword [esi + 0x6c], eax
mov dword [esp + 4], 0x409139
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.0040240f
mov word [ebx], 0xc
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00404cbe
mov dword [esi + 0x74], eax
mov dword [esp + 4], 0x40914a
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.0040240f
mov word [ebx], 0xf
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00404cbe
mov dword [esi + 0x78], eax
mov dword [esp + 4], 0x40915b
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.0040240f
mov word [ebx], 9
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00404cbe
mov dword [esi + 0x7c], eax
mov dword [esp + 4], 0x40916c
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.0040240f
mov word [ebx], 0xd
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00404cbe
mov dword [esi + 0x80], eax
mov dword [esp + 4], 0x40917d
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.0040240f
mov word [ebx], 0x14
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00404cbe
mov dword [esi + 0x68], eax
mov dword [esp + 4], 0x409196
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.0040240f
mov word [ebx], 0x13
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00404cbe
mov dword [esi + 0x70], eax
mov dword [esp], esi
call fcn.00404542
test eax, eax
je 0x40307b
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call dword [esi + 0x74]
sub esp, 0x1c
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
test eax, eax
sete dl
cmp eax, 0xffffffff
sete al
or eax, edx
test al, 1
je 0x403094
call sub.msvcrt.dll_abort
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x1000
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.00403c73
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404542
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + 0x48]
mov dword [esp + 4], 0x409225
lea eax, [ebp - 0x38]
mov dword [esp], eax
call fcn.0040256b
cmp word [ebx], 0
je 0x4045cc
cld
mov dword [ebp - 0x44], ebx
movzx eax, word [ebx]
add ebx, 2
test ax, ax
jne 0x40458c
mov esi, dword [ebp - 0x44]
lea edi, [ebp - 0x38]
mov ecx, 0x10
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
cmp dl, al
jne 0x4045c6
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 1
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
jmp 0x4045ff
cmp word [ebx], 0
jne 0x404589
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x30]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx + 0x18]
cmp eax, dword [edx + 8]
jne 0x4045eb
mov eax, dword [ecx + 0x28]
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
jmp 0x4045ff
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
jne 0x4045cc
mov eax, 0
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404cbe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, esi
add eax, dword [esi + 0x3c]
mov edi, esi
add edi, dword [eax + 0x78]
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0040233a
test eax, eax
jne 0x404d2d
mov ebx, 0
cmp ebx, dword [edi + 0x18]
jae 0x404d4a
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0040233a
test eax, eax
je 0x404d44
lea eax, [ebx + ebx]
add eax, dword [edi + 0x24]
movzx eax, word [eax + esi]
shl eax, 2
add eax, dword [edi + 0x1c]
add esi, dword [eax + esi]
mov eax, esi
jmp 0x404d4f
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x404d0a
mov eax, 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x404d5c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
mov ebx, dword [esi]
cmp ebx, esi
je 0x404dbb
test edi, edi
jne 0x404d9c
mov dword [esp], ebx
call fcn.00402879
test eax, eax
je 0x404d9c
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x10], ebx
jmp 0x404dbb
cmp edi, 1
jne 0x404db5
mov dword [esp], ebx
call fcn.00402957
test eax, eax
je 0x404db5
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x10], ebx
jmp 0x404dbb
mov ebx, dword [ebx]
cmp ebx, esi
jne 0x404d84
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c493
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x42a018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [0x41d020]
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.00403ff0
mov edi, eax
mov dword [ebp - 4], 0
call dword [0x41d020]
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.00403ef0
push eax
mov edx, 0x42789c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00406900
push 0x42788c
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00406970
push edi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00406b30
push 0x427880
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.00406970
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.00402da0
lea ecx, [ebp - 0x58]
call fcn.00402da0
lea ecx, [ebp - 0x70]
call fcn.00402da0
lea ecx, [ebp - 0x88]
call fcn.00402da0
lea ecx, [ebp - 0xa0]
call fcn.00402da0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00402d90
push eax
push 0x4278b0
push 0
push 0
call dword [0x41d15c]
push 0
call fcn.0040d1ef
int3
Function at 0x406190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x15], 0
je 0x4061ba
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x427a50]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x16
jb 0x4061b0
mov eax, ecx
ret

Function at 0x4061e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xb], 0
je 0x4061f2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xc
jb 0x4061e8
mov eax, ecx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401662
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x401737
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x401737
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x401737
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x4016bd
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x401737
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401702
test dl, dl
je 0x4016fe
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401702
add ecx, 2
add eax, 2
test dl, dl
jne 0x4016e2
xor eax, eax
jmp 0x401707
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401719
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x401724
inc esi
cmp esi, ebp
jae 0x401737
mov edx, dword [esp + 0x10]
jmp 0x4016d8
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x40199b
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4019a6
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x4019ba
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x4019be
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x4019f7
cmp dword [edi + ecx], 0x4550
jne 0x4019f7
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x4019f7
test byte [edi + ecx + 0x16], 2
je 0x4019f7
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x4019fc
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x401a38
xor eax, eax
jmp 0x401a1b
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x401a41
inc edx
movzx eax, dx
cmp eax, edi
jl 0x401a1b
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x401a47
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x401a7f
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x401a8d
add edx, 0x20
cmp eax, edx
jne 0x401a9e
test bx, bx
je 0x401ad3
add esi, 2
add edi, 2
jmp 0x401a6f
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x401aac
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x401aba
add edx, 0x20
sub ecx, edx
je 0x401ad3
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x401a68
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40254c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x40260d
test ecx, ecx
je 0x40260d
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x40260d
test ebx, ebx
je 0x40260d
mov ebx, eax
add ebx, edx
je 0x40260d
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x40260d
cmp dword [edx + eax + 0x14], 0
je 0x40260d
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x40260d
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4025fd
test dl, dl
je 0x4025f9
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4025fd
add edi, 2
add esi, 2
test dl, dl
jne 0x4025dd
xor eax, eax
jmp 0x402602
sbb eax, eax
or eax, 1
test eax, eax
je 0x402619
inc ebp
cmp ebp, dword [esp + 4]
jb 0x4025ca
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x5ad375
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xffffffffffffffff
push 0xa
push 0x16264ac3
push 0x5226480e
call fcn.00793912
add esp, 0x10
mov dword [ebp - 4], eax
push 0x94c217
push dword [ebp - 4]
call fcn.004043a9
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5ad3c5
push ebx
call fcn.007938e8
add esp, 4
cmp dword [ebp - 8], 0
je 0x5ad52a
push 0
push 0
push 0xffffffffffffffff
push 6
push 0x16264abb
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 0
push 0xffffffffffffffff
push 6
push 0x16264ac1
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 0
push 0xffffffffffffffff
push 6
push 0x16264aa8
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 1
push 0xffffffffffffffff
push 6
push 0x16264abf
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 1
push 0xffffffffffffffff
push 6
push 0x16264abe
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 0
push 0xffffffffffffffff
push 8
push 0x16264a97
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 1
push 0xffffffffffffffff
push 9
push 0x16264ac3
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 0x94c229
push 0xffffffffffffffff
push 0xa
push 0x16264ac3
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 0x94c220
push 0xffffffffffffffff
push 8
push 0x16264a96
push 0x5226480e
call fcn.0079390c
add esp, 0x18
mov eax, 0x94c22e
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x16264ac5
push 0x5226480e
call fcn.00413a8d
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5ad4ff
push ebx
call fcn.007938e8
add esp, 4
push 0x20004
push 0x16264975
push 0x5226480e
push 1
mov eax, 1
mov ebx, 0x803550
call fcn.00793906
add esp, 0x10
jmp 0x5ad5b3
push 0xffffffffffffffff
push 0x13
push 0x16264abb
push 0x5226480e
call fcn.00793912
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5ad571
mov eax, str.User_Agent:_Mozilla_5.0__iPhone__CPU_iPhone_OS_14_6_like_Mac_OS_X__AppleWebKit_605.1.15__KHTML__like_Gecko__Version_14.0.3_Mobile_15E148_Safari_604.1_r_nfromApi:_1
push eax
mov ebx, dword [0xe64cc4]
test ebx, ebx
je 0x5ad566
push ebx
call fcn.007938e8
add esp, 4
pop eax
mov dword [0xe64cc4], eax
jmp 0x5ad590
mov eax, str.User_Agent:_Mozilla_5.0__Windows_NT_6.1__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_75.0.3770.90_Safari_537.36
push eax
mov ebx, dword [0xe64cc4]
test ebx, ebx
je 0x5ad58a
push ebx
call fcn.007938e8
add esp, 4
pop eax
mov dword [0xe64cc4], eax
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
push 0x5b07eb
call fcn.00404580
mov esp, ebp
pop ebp
ret
Function at 0x5fba9b
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xffffffffffffffff
push 0xa
push 0x16264b33
push 0x5226480e
call fcn.00793912
add esp, 0x10
mov dword [ebp - 4], eax
push 0x94c217
push dword [ebp - 4]
call fcn.004043a9
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5fbaeb
push ebx
call fcn.007938e8
add esp, 4
cmp dword [ebp - 8], 0
je 0x5fbc50
push 0
push 0
push 0xffffffffffffffff
push 6
push 0x16264b2b
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 0
push 0xffffffffffffffff
push 6
push 0x16264b31
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 0
push 0xffffffffffffffff
push 6
push 0x16264a88
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 1
push 0xffffffffffffffff
push 6
push 0x16264b2f
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 1
push 0xffffffffffffffff
push 6
push 0x16264b2e
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 0
push 0xffffffffffffffff
push 8
push 0x16264ac6
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 1
push 0xffffffffffffffff
push 9
push 0x16264b33
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 0x94c229
push 0xffffffffffffffff
push 0xa
push 0x16264b33
push 0x5226480e
call fcn.0079390c
add esp, 0x18
push 0
push 0x94c220
push 0xffffffffffffffff
push 8
push 0x16264b36
push 0x5226480e
call fcn.0079390c
add esp, 0x18
mov eax, 0x94c22e
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x16264b37
push 0x5226480e
call fcn.00413a8d
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5fbc25
push ebx
call fcn.007938e8
add esp, 4
push 0x20004
push 0x16264938
push 0x5226480e
push 1
mov eax, 1
mov ebx, 0x803550
call fcn.00793906
add esp, 0x10
jmp 0x5fbcd9
push 0xffffffffffffffff
push 0x13
push 0x16264b2b
push 0x5226480e
call fcn.00793912
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5fbc97
mov eax, str.User_Agent:_Mozilla_5.0__iPhone__CPU_iPhone_OS_14_6_like_Mac_OS_X__AppleWebKit_605.1.15__KHTML__like_Gecko__Version_14.0.3_Mobile_15E148_Safari_604.1_r_nfromApi:_1
push eax
mov ebx, dword [0xe64bc0]
test ebx, ebx
je 0x5fbc8c
push ebx
call fcn.007938e8
add esp, 4
pop eax
mov dword [0xe64bc0], eax
jmp 0x5fbcb6
mov eax, str.User_Agent:_Mozilla_5.0__Windows_NT_6.1__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_75.0.3770.90_Safari_537.36
push eax
mov ebx, dword [0xe64bc0]
test ebx, ebx
je 0x5fbcb0
push ebx
call fcn.007938e8
add esp, 4
pop eax
mov dword [0xe64bc0], eax
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
push 0x5fe86e
call fcn.00404580
mov esp, ebp
pop ebp
ret
Function at 0x7395b8
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x7395d9
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x7395d0
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x7395c8
mov eax, ebx
leave
ret

Function at 0x7395ff
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x73965e
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x73968b
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x73967a
xor ecx, eax
xor edx, ebx
dec edi
jne 0x73966b
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x7396b1
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x739652
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8