joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56db00
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x1f8]
cmp r12, qword [r14 + 0x10]
jbe 0x56dd8e
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x288], rbx
nop
nop
call sym.crypto_internal_boring_sig.StandardCrypto.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x280]
mov rcx, qword [rax]
mov rax, rcx
call sym.crypto_internal_bigmod.NewModulusFromBig
test rbx, rbx
jne 0x56dd02
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x130]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046c7f4
mov rbp, qword [rbp]
mov qword [rsp + 0x258], 0
movups xmmword [rsp + 0x260], xmm15
mov qword [rsp + 0x260], 0
mov qword [rsp + 0x268], 0x20
lea rdx, [rsp + 0x130]
mov qword [rsp + 0x258], rdx
mov rbx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x298]
mov rsi, rax
lea rax, [rsp + 0x258]
call sym.crypto_internal_bigmod._Nat_.SetBytes
nop dword [rax + rax]
test rbx, rbx
jne 0x56dcec
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rdx + 8]
lea rdi, [rsp + 0x30]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046c7f4
mov rbp, qword [rbp]
mov qword [rsp + 0x240], 0
movups xmmword [rsp + 0x248], xmm15
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], 0x20
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x240], rdx
mov rbx, rax
mov rdi, qword [rsp + 0x238]
lea rax, [rsp + 0x240]
call sym.crypto_internal_bigmod._Nat_.ExpShortVarTime
mov qword [rsp + 0x230], rax
mov rdx, qword [rsp + 0x238]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 8]
shl rsi, 6
sub rsi, qword [rdx + 8]
lea rdx, [rsi + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rcx, [rdx + rsi]
lea rcx, [rcx + 7]
sar rcx, 3
mov qword [rsp + 0x28], rcx
nop
mov rbx, rcx
lea rax, [0x0067b400]
call sym.runtime.makeslice
mov rdx, qword [rsp + 0x230]
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
mov r8, qword [rsp + 0x28]
mov rcx, r8
xor ebx, ebx
jmp 0x56dd20
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x270
pop rbp
ret
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x270
pop rbp
ret
inc rbx
mov r8, r10
nop
cmp rbx, rdx
jge 0x56dd39
mov r9, qword [rsi + rbx*8]
xor edi, edi
jmp 0x56dd58
test r9, r9
je 0x56dd18
jmp 0x56dd6e
mov r10, r8
jmp 0x56dd18
mov rbx, rcx
xor edi, edi
xor esi, esi
add rsp, 0x270
pop rbp
ret
mov byte [r8 + rax - 1], r9b
inc rdi
shr r9, 8
mov r8, r10
cmp rdi, 8
jge 0x56dd34
lea r10, [r8 - 1]
test r10, r10
jl 0x56dd2d
cmp rcx, r10
ja 0x56dd49
jmp 0x56dd85
lea rax, [0x0067b380]
lea rbx, [0x00757720]
nop dword [rax]
call sym.runtime.gopanic
mov rax, r10
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp sym.crypto_rsa.encrypt
Function at 0x56e440
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56e67b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call sym.crypto_internal_boring_sig.StandardCrypto.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x56e58a
nop dword [rax]
cmp rdx, 0x40
ja 0x56e66d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x56e4f9
mov rax, rdx
mov rcx, rsi
nop
call sym.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x56e561
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_sha256.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x56e662
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x56e597
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x56e615
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_sha256.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x56e658
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x56e654
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call sym.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_sha256._digest_.Write
Function at 0x575100
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x575118
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x575118
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x575120
xor eax, eax
ret
cmp rbx, 3
je 0x57512c
cmp rbx, 4
jne 0x575159
cmp al, 0x2c
ja 0x575146
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x575156
cmp al, 0x24
je 0x575156
nop dword [rax]
cmp al, 0x26
jae 0x575156
jmp 0x575159
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x575156
cmp al, 0x5b
je 0x575156
cmp al, 0x5d
jne 0x575159
xor eax, eax
ret
cmp al, 0x2f
ja 0x575192
nop dword [rax]
cmp al, 0x26
ja 0x575171
cmp al, 0x24
je 0x5751b1
cmp al, 0x26
je 0x5751b1
jmp 0x57522b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5751b1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x575228
cmp al, 0x2f
je 0x5751b1
jmp 0x57522b
cmp al, 0x3d
ja 0x5751a9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5751b1
nop
cmp al, 0x3d
je 0x5751b1
jmp 0x57522b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x575220
cmp rbx, 2
jg 0x5751e7
cmp rbx, 1
je 0x5751e1
nop dword [rax]
cmp rbx, 2
jne 0x57522b
cmp al, 0x2f
je 0x5751d2
cmp al, 0x3b
je 0x5751d2
cmp al, 0x2c
jne 0x5751d9
mov ecx, 1
jmp 0x5751de
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x57520a
cmp al, 0x40
je 0x5751f9
cmp al, 0x2f
je 0x5751f9
cmp al, 0x3f
jne 0x575202
mov ecx, 1
nop
jmp 0x575207
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x575219
cmp rbx, 7
jne 0x57522b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x575228
cmp al, 0x7e
jne 0x57522b
xor eax, eax
ret
cmp rbx, 7
jne 0x575241
cmp al, 0x21
je 0x57523d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x575241
xor eax, eax
nop
ret
mov eax, 1
ret

Function at 0x57a1a0
Capabilities:
Encrypt data using des

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
xor eax, eax
jmp 0x57a1af
inc rax
cmp rax, 8
jge 0x57a1b9
xor ecx, ecx
jmp 0x57a1c2
add rsp, 0x10
pop rbp
ret
inc rcx
cmp rcx, 4
jge 0x57a1ac
xor edx, edx
jmp 0x57a1e0
mov dword [rbx + rax*4], ecx
lea rbx, [rdi + 1]
mov rax, r10
mov rcx, r9
mov rdx, rbx
nop dword [rax]
cmp rdx, 0x10
jge 0x57a1bf
mov rbx, rax
shl rax, 6
lea rsi, [0x008d1960]
lea rdi, [rsi + rax]
mov r8, rcx
shl rcx, 4
add rdi, rcx
movzx edi, byte [rdi + rdx]
lea rcx, [rbx - 7]
neg rcx
shl rcx, 2
shl rdi, cl
cmp rcx, 0x40
sbb r9, r9
and rdi, r9
xor eax, eax
xor ecx, ecx
jmp 0x57a2b6
mov rdi, r8
and r8d, 2
shl r8, 4
mov r9, rdi
and edi, 1
or r8, rdi
mov rdi, rdx
shl rdx, 1
or r8d, edx
mov rdx, rcx
shl rcx, 1
shr rdx, 0x1f
mov r10, rbx
shl rbx, 8
movzx eax, r8b
or rcx, rdx
lea rdx, [0x0098e440]
add rbx, rdx
cmp rax, 0x40
jb 0x57a1cc
jmp 0x57a2c5
lea r9, [0x008ced80]
movzx r10d, byte [r9 + rax]
mov r11, rcx
mov ecx, r10d
mov r12, rdi
shr r12, cl
lea r13, [rax - 0x1f]
neg r13
inc rax
cmp cl, 0x40
sbb rcx, rcx
and rcx, r12
and ecx, 1
mov r10, rcx
mov rcx, r13
shl r10, cl
cmp rcx, 0x40
sbb rcx, rcx
and rcx, r10
or rcx, r11
cmp rax, 0x20
jl 0x57a272
nop dword [rax]
jmp 0x57a227
mov ecx, 0x40
call sym.runtime.panicIndex
nop
int3
Function at 0x57a7c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57a7f7
push rbp
mov rbp, rsp
sub rsp, 0x28
mov ebx, 0xa
call sym.strconv.FormatInt
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006dbed1]
call sym.runtime.concatstring2
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 8], rax
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.crypto_des.KeySizeError.Error

Function at 0x57b160
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57b1b1
push rbp
mov rbp, rsp
sub rsp, 0x28
mov r12, qword [r14 + 0x20]
test r12, r12
jne 0x57b1c2
test rax, rax
je 0x57b1ab
mov rax, qword [rax]
mov ebx, 0xa
call sym.strconv.FormatInt
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006dbed1]
nop dword [rax]
call sym.runtime.concatstring2
add rsp, 0x28
pop rbp
ret
call sym.runtime.panicwrap
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.crypto_des._KeySizeError_.Error
lea r13, [rsp + 0x38]
cmp qword [r12], r13
jne 0x57b177
mov qword [r12], rsp
jmp 0x57b177
Function at 0x57b620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57b82b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x57b744
cmp rdx, 0x40
ja 0x57b81d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x57b6b4
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x57b720
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x57b815
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x57b747
mov r8, rcx
cmp r8, 0x40
jl 0x57b7c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x57b808
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x57b804
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x582dc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x582f05
push rbp
mov rbp, rsp
sub rsp, 0x28
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x582df9
cmp byte [rcx], 0x17
je 0x582e96
test rdx, rdx
je 0x582e02
cmp byte [rcx], 0x18
nop
je 0x582e45
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x1d
lea rcx, [0x006dbe40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
lea rdi, [0x00758260]
mov rsi, rax
mov rax, rcx
mov rcx, rdx
add rsp, 0x28
pop rbp
ret
lea rbx, [rsp + 0x10]
call sym.vendor_golang.org_x_crypto_cryptobyte._String_.ReadASN1GeneralizedTime
test al, al
jne 0x582ea9
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x1f
lea rcx, [0x006dd198]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
lea rdi, [0x00758260]
mov rsi, rax
mov rax, rcx
mov rcx, rdx
add rsp, 0x28
pop rbp
ret
lea rbx, [rsp + 0x10]
nop dword [rax + rax]
call sym.vendor_golang.org_x_crypto_cryptobyte._String_.ReadASN1UTCTime
test al, al
je 0x582ec2
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
xor edi, edi
xor esi, esi
add rsp, 0x28
pop rbp
ret
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x17
lea rcx, [0x006d8451]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
lea rdi, [0x00758260]
mov rsi, rax
mov rax, rcx
mov rcx, rdx
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.crypto_x509.parseTime
Function at 0x5921a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5921d7
push rbp
mov rbp, rsp
sub rsp, 0x28
mov ebx, 0xa
call sym.strconv.FormatInt
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006dbeee]
call sym.runtime.concatstring2
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 8], rax
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.crypto_rc4.KeySizeError.Error

Function at 0x592360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59245e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x5923e2
cmp rdi, r8
jb 0x592452
cmp rbx, rsi
je 0x5923c5
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x5923c2
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x59243f
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x5923c5
mov rbx, rdx
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x592437
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
nop
jmp 0x592420
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x5923e8
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call sym.runtime.panicIndex
lea rax, [0x0067b380]
lea rbx, [0x007578e0]
call sym.runtime.gopanic
mov rcx, r8
mov rdx, rdi
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.crypto_rc4._Cipher_.XORKeyStream

Function at 0x5924c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x592511
push rbp
mov rbp, rsp
sub rsp, 0x28
mov r12, qword [r14 + 0x20]
test r12, r12
jne 0x592522
test rax, rax
je 0x59250b
mov rax, qword [rax]
mov ebx, 0xa
call sym.strconv.FormatInt
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006dbeee]
nop dword [rax]
call sym.runtime.concatstring2
add rsp, 0x28
pop rbp
ret
call sym.runtime.panicwrap
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.crypto_rc4._KeySizeError_.Error
lea r13, [rsp + 0x38]
cmp qword [r12], r13
jne 0x5924d7
mov qword [r12], rsp
jmp 0x5924d7
Function at 0x595120
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x5951e7
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x59514c
test r15, r15
je 0x59522a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x5951fc
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x59515b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x596720
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5967c7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x59686a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5967c7
cmp r9, 0
je 0x596923
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x596880
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5a15a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a1682
push rbp
mov rbp, rsp
sub rsp, 0x38
lea rax, [0x00689ee0]
mov ebx, 0x21
xor ecx, ecx
call sym.runtime.makemap
mov qword [rsp + 0x30], rax
xor ecx, ecx
jmp 0x5a15e0
mov qword [rax], rdx
mov rcx, qword [rsp + 0x20]
inc rcx
mov rax, qword [rsp + 0x30]
nop
cmp rcx, 0x21
jge 0x5a1659
mov qword [rsp + 0x20], rcx
lea rdx, [0x00758f60]
lea rsi, [rdx + rcx]
shl rcx, 4
lea r8, [0x0075ddc0]
mov r9, qword [r8 + rcx + 8]
mov qword [rsp + 0x18], r9
mov r10, qword [r8 + rcx]
mov qword [rsp + 0x28], r10
mov rbx, rax
mov rcx, rsi
lea rax, [0x00689ee0]
call sym.runtime.mapassign
mov rdx, qword [rsp + 0x18]
mov qword [rax + 8], rdx
cmp dword [0x0098c4d0], 0
jne 0x5a1640
mov rdx, qword [rsp + 0x28]
jmp 0x5a15ce
call sym.runtime.gcWriteBarrier2
mov rdx, qword [rsp + 0x28]
mov qword [r11], rdx
mov rsi, qword [rax]
mov qword [r11 + 8], rsi
jmp 0x5a15ce
cmp dword [0x0098c4d0], 0
je 0x5a1675
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [0x009050f0]
mov qword [r11 + 8], rcx
mov qword [0x009050f0], rax
add rsp, 0x38
pop rbp
ret
call sym.runtime.morestack_noctxt.abi0
jmp sym.crypto_tls.map.init.0
Function at 0x5a56a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a579d
push rbp
mov rbp, rsp
sub rsp, 0x38
lea esi, [rax - 0x17]
cmp si, 2
ja 0x5a5720
movzx esi, si
nop
cmp rsi, 4
jae 0x5a578f
lea edi, [rax - 0x16]
movzx eax, di
lea rdi, [0x008ce460]
movzx esi, byte [rsi + rdi]
nop dword [rax + rax]
cmp rax, 4
jae 0x5a5785
movzx ecx, byte [rax + rdi]
cmp rcx, 0x1b
ja 0x5a5779
cmp rcx, rsi
jb 0x5a5771
sub rcx, rsi
mov rbx, rcx
neg rcx
sar rcx, 0x3f
and rsi, rcx
lea rcx, [0x006da8c6]
lea rax, [rcx + rsi]
add rsp, 0x38
pop rbp
ret
cmp ax, 0x1d
jne 0x5a5738
lea rax, [0x006d13da]
mov ebx, 6
add rsp, 0x38
pop rbp
ret
movzx eax, ax
mov ebx, 0xa
call sym.strconv.FormatInt
mov ecx, 8
mov rdi, rax
mov rsi, rbx
lea r8, [0x00754f10]
mov r9d, 1
xor eax, eax
lea rbx, [0x006d1acd]
call sym.runtime.concatstring3
add rsp, 0x38
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov edx, 0x1b
nop
call sym.runtime.panicSliceAlen
mov ecx, 4
call sym.runtime.panicIndex
mov rax, rsi
mov ecx, 4
call sym.runtime.panicIndex
nop
mov word [rsp + 8], ax
call sym.runtime.morestack_noctxt.abi0
movzx eax, word [rsp + 8]
jmp sym.crypto_tls.CurveID.String