joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b2360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b245e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x5b23e2
cmp rdi, r8
jb 0x5b2452
cmp rbx, rsi
je 0x5b23c5
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x5b23c2
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x5b243f
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x5b23c5
mov rbx, rdx
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x5b2437
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
nop
jmp 0x5b2420
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x5b23e8
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call sym.runtime.panicIndex
lea rax, [0x0068c740]
lea rbx, [0x0076cdb0]
call sym.runtime.gopanic
mov rcx, r8
mov rdx, rdi
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.crypto_rc4._Cipher_.XORKeyStream
Function at 0x5b5120
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x5b51e7
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x5b514c
test r15, r15
je 0x5b522a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x5b51fc
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x5b515b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x5b6800
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5b68a7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5b694a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5b68a7
cmp r9, 0
je 0x5b6a03
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5b6960
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x61c8e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x61ca7b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x61c901
inc rcx
cmp rbx, rcx
jle 0x61ca71
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x61c8fe
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call sym.net.SplitHostPort
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x00e27818]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call sym.vendor_golang.org_x_net_idna._Profile_.process
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x61ca65
test rdx, rdx
je 0x61ca5a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00e7d110]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x61ca29
xor eax, eax
lea rbx, [0x006eb9ff]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006eba40]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x61ca50
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0076a320]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.vendor_golang.org_x_net_http_httpguts.PunycodeHostPort
Function at 0x65d7a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x65d8a2
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call sym.net_url.splitHostPort
test rdi, rdi
jne 0x65d7f3
mov rbx, qword [0x00e35a70]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0069cf00]
call sym.runtime.mapaccess1_faststr
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call sym.net_http.idnaASCIIFromURL
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00e7d110]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x65d875
xor eax, eax
lea rbx, [0x006eb9ff]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006eba40]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x65d89c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0076a320]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net_http.canonicalAddr
Function at 0x180003ea0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180003efd
lea rbx, [0x180086010]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180003ee4
cmp r10, 2
jb 0x180003ee4
cmp byte [r9], r8b
jne 0x180003ee4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180003ec0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180003f3f
lea rbx, [0x180086010]
cmp r8b, 0x23
jne 0x180003f23
cmp byte [r9], r8b
jne 0x180003f23
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180003f10
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180007440
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x100]
mov rdi, rcx
movsxd rsi, edx
test eax, eax
jg 0x180007483
mov r8d, 0x78f
lea rdx, str.D:PANELES_CCOSMOS_IMIGUISCOSMOS_PANEL_LINDOImGui_CHAMSimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rdi + 0x100]
movsxd rcx, eax
lea rdx, [0x180086010]
mov rax, qword [rdi + 0x108]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, sil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rdi]
not ebx
cmp dword [rcx + 0x4084], ebx
jne 0x1800074f9
mov r8, rsi
mov edx, 4
mov ecx, ebx
call fcn.18001fad0
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180007510
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x100]
mov rdi, rdx
mov rbx, rcx
test eax, eax
jg 0x18000754a
mov r8d, 0x78f
lea rdx, str.D:PANELES_CCOSMOS_IMIGUISCOSMOS_PANEL_LINDOImGui_CHAMSimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx + 0x100]
movss xmm2, dword [rbx + 0x120]
lea r9, [0x180086010]
movss xmm0, dword [rdi]
movss xmm3, dword [rbx + 0x124]
subss xmm0, xmm2
movss xmm1, dword [rdi + 4]
movsxd rcx, eax
subss xmm1, xmm3
mov rax, qword [rbx + 0x108]
movss dword [rsp + 0x20], xmm0
movss xmm0, dword [rdi + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movzx eax, byte [rsp + 0x20]
not r8d
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x23]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x24]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x25]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x26]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x27]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x28]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x29]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2a]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2b]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2c]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
mov rbx, qword [rsp + 0x40]
xor rcx, rax
movzx eax, byte [rsp + 0x2d]
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2e]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0x2f]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x30
pop rdi
ret
Function at 0x18001e030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6000], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x18001e0b3
xor edx, edx
add rcx, 0x6008
call fcn.180020cc0
mov r8, rsi
lea rcx, [rbx + 0x6008]
mov rdx, rbp
call fcn.180004710
mov eax, dword [rbx + 0x6008]
xor edx, edx
mov r9, qword [rbx + 0x6000]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x6010]
cmove ecx, edx
test rax, rax
movsxd r8, ecx
mov edx, 1
lea rcx, [0x1801d6ed8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18001e0bf
add rcx, 0x6008
call fcn.180004710
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18001e320
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1801d6ee0]
cmp byte [rbx + 0x5f58], 0
jne 0x18001e450
cmp dword [rbx + 0x5f80], 0
je 0x18001e36b
mov r8d, 0x33eb
lea rdx, str.D:PANELES_CCOSMOS_IMIGUISCOSMOS_PANEL_LINDOImGui_CHAMSimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18001e449
lea rdx, [0x1800857f8]
call fcn.180003f50
mov rdi, rax
test rax, rax
je 0x18001e449
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18001e440
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001e440
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x18001e440
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001e440
cmp rsi, 0xffffffffffffffff
je 0x18001e440
mov rcx, rsi
call fcn.180007ee0
mov rbp, rax
test rax, rax
je 0x18001e440
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rsi
je 0x18001e420
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbp
call fcn.180007f90
jmp 0x18001e449
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x18001e436
mov rdx, rsi
mov rcx, rbp
call fcn.18001e6d0
mov rcx, rbp
call fcn.180007f90
jmp 0x18001e449
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov byte [rbx + 0x5f58], 1
movss xmm0, dword [rbx + 0x5f5c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x18001e4df
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f5c], xmm0
jb 0x18001e4df
mov rdi, qword [rbx + 0x20]
xor ebp, ebp
test rdi, rdi
je 0x18001e4d2
mov rax, qword [0x1801d6ee0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f5c], ebp
call fcn.18001e930
lea rdx, [0x1800857fc]
mov rcx, rdi
mov rsi, rax
call fcn.180003f50
mov rdi, rax
test rax, rax
je 0x18001e4d9
mov r8, qword [rsp + 0x30]
lea edx, [rbp + 1]
mov r9, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18001e4d9
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5f5c], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18001e630
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1801d6ee0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18001e693
mov qword [rsp], rbx
lea rbx, [0x180086010]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001e673
cmp byte [r8], r9b
jne 0x18001e673
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18001e660
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f70]
not eax
mov r8, qword [r10 + 0x5f78]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18001e6bf
cmp dword [r8 + 8], eax
je 0x18001e6c6
add r8, 0x48
cmp r8, rcx
jne 0x18001e6b0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x180051250
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rsi, rcx
mov r8d, 0x4d
lea rdx, str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:89.0__Gecko_20100101_Firefox_89.0
call fcn.1800398d0
lea rcx, [rsi + 0x20]
xor r8d, r8d
lea rdx, [0x1800803ef]
call fcn.1800398d0
lea rcx, [rsi + 0x40]
xor r8d, r8d
lea rdx, [0x1800803ef]
call fcn.1800398d0
lea rcx, [rsi + 0x60]
xor r8d, r8d
lea rdx, [0x1800803ef]
call fcn.1800398d0
lea rcx, [rsi + 0x80]
mov r8d, 3
lea rdx, [0x18008eea0]
call fcn.1800398d0
lea rcx, [rsi + 0xa0]
xor r8d, r8d
lea rdx, [0x1800803ef]
call fcn.1800398d0
lea rcx, [rsi + 0xc0]
mov r8d, 0xf
lea rdx, str.www.example.com
call fcn.1800398d0
xor r14d, r14d
mov qword [rbp - 0x40], r14
movdqa xmm0, xmmword [0x180091b50]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], r14b
xor r8d, r8d
lea rdx, [0x1800803ef]
lea rcx, [rbp - 0x40]
call fcn.1800398d0
nop
mov qword [rbp - 0x20], r14
movdqa xmm0, xmmword [0x180091b50]
movdqa xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], r14b
xor r8d, r8d
lea rdx, [0x1800803ef]
lea rcx, [rbp - 0x20]
call fcn.1800398d0
nop
lea rax, [rbp - 0x40]
mov qword [rbp - 0x50], rax
lea rax, [rbp]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x60]
call fcn.1800510b0
lea rdi, [rsi + 0x160]
lea rax, [rbp - 0x60]
cmp rdi, rax
je 0x1800513c4
mov rbx, qword [rdi]
mov r8, qword [rbx + 8]
mov rdx, rdi
mov rcx, rdi
call fcn.18005b420
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rdi + 8], r14
mov r8, qword [rdi]
mov rax, qword [rbp - 0x60]
mov qword [rdi], rax
mov qword [rbp - 0x60], r8
mov rax, qword [rbp - 0x58]
mov qword [rdi + 8], rax
mov qword [rbp - 0x58], r14
jmp 0x1800513c8
mov r8, qword [rbp - 0x60]
mov r8, qword [r8 + 8]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.18005b420
mov edx, 0x60
mov rcx, qword [rbp - 0x60]
call fcn.18007b5a8
nop
lea r9, [fcn.180051440]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
lea rcx, [rbp - 0x40]
call fcn.18007b5dc
mov qword [rsi + 0x170], r14
mov word [rsi + 0x151], 1
mov byte [rsi + 0x150], 1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800514f0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [0x1801d80c0]
mov qword [rsp + 0x80], rdi
xor ebx, ebx
mov qword [0x1801d80c0], rbx
mov qword [0x1801d80d0], rbx
mov qword [0x1801d80d8], 0xf
lea r8d, [rbx + 0x4d]
lea rdx, str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:89.0__Gecko_20100101_Firefox_89.0
mov rcx, rdi
call fcn.1800398d0
nop
mov qword [0x1801d80e0], rbx
mov qword [0x1801d80f0], rbx
mov qword [0x1801d80f8], 0xf
mov qword [0x1801d8100], rbx
mov qword [0x1801d8110], rbx
mov qword [0x1801d8118], 0xf
mov qword [0x1801d8120], rbx
mov qword [0x1801d8130], rbx
mov qword [0x1801d8138], 0xf
mov qword [0x1801d8140], rbx
mov qword [0x1801d8150], rbx
mov qword [0x1801d8158], 0xf
lea r8d, [rbx + 3]
lea rdx, [0x18008eea0]
lea rcx, [0x1801d8140]
call fcn.1800398d0
nop
mov qword [0x1801d8160], rbx
mov qword [0x1801d8170], rbx
mov qword [0x1801d8178], 0xf
mov qword [0x1801d8180], rbx
mov qword [0x1801d8190], rbx
mov qword [0x1801d8198], 0xf
lea r8d, [rbx + 0xf]
lea rdx, str.www.example.com
lea rcx, [0x1801d8180]
call fcn.1800398d0
nop
lea rax, [0x1801d81a0]
mov qword [rsp + 0x88], rax
mov qword [0x1801d81a0], rbx
mov qword [0x1801d81b0], rbx
mov qword [0x1801d81b8], 0xf
mov qword [0x1801d81c0], rbx
mov qword [0x1801d81d0], rbx
mov qword [0x1801d81d8], 0xf
xor r8d, r8d
lea rdx, [0x1800803ef]
lea rcx, [0x1801d81c0]
call fcn.1800398d0
nop
mov qword [0x1801d81e0], rbx
mov qword [0x1801d81f0], rbx
mov qword [0x1801d81f8], 0xf
xor r8d, r8d
lea rdx, [0x1800803ef]
lea rcx, [0x1801d81e0]
call fcn.1800398d0
nop
mov qword [0x1801d8200], rbx
mov qword [0x1801d8208], rbx
lea ecx, [rbx + 0x60]
call fcn.18007b1ec
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1801d8200], rax
mov word [0x1801d8210], 0x101
mov byte [0x1801d8212], 1
mov qword [0x1801d8218], rbx
mov qword [rsp + 0x30], rbx
movdqa xmm0, xmmword [0x180091b50]
movdqa xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], bl
xor r8d, r8d
lea rdx, [0x1800803ef]
lea rcx, [rsp + 0x30]
call fcn.1800398d0
nop
mov qword [rsp + 0x50], rbx
movdqa xmm0, xmmword [0x180091b50]
movdqa xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], bl
xor r8d, r8d
lea rdx, [0x1800803ef]
lea rcx, [rsp + 0x50]
call fcn.1800398d0
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [0x1801d8220]
call fcn.1800510b0
nop
lea r9, [fcn.180051440]
lea edx, [rbx + 0x40]
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x30]
call fcn.18007b5dc
mov qword [0x1801d8230], rbx
mov dword [0x1801d8238], 1
mov rax, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret