joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bdae0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bdc39
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov r13, 0
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x23], 0
movups xmmword [rsp + 0x28], xmm15
test byte [rax], al
jmp 0x4bdb16
mov rax, rsi
mov rdx, qword [rax]
bt edx, 0
jb 0x4bdb4b
lea r8, [rdx + 8]
test r8, 0x7ffff8
je 0x4bdc0a
mov rsi, rax
mov rax, rdx
lock cmpxchg qword [rsi], r8
sete r8b
nop
test r8b, r8b
je 0x4bdb13
bt edx, 0
jmp 0x4bdb4e
mov rsi, rax
jae 0x4bdb79
cmp byte [rsi + 0x21f], 0
je 0x4bdb69
mov rdx, qword [0x009af3d0]
mov r8, qword [0x009af3d8]
jmp 0x4bdb80
lea rdx, [0x007f2460]
lea r8, [0x00a04c58]
jmp 0x4bdb80
xor edx, edx
xor r8d, r8d
nop
test rdx, rdx
je 0x4bdb9f
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
mov rax, rdx
mov rbx, r8
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x004bdc80]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x23], 1
mov rax, qword [rsi + 0x10]
mov dword [rsp + 0x24], edi
lea rdi, [rsp + 0x24]
mov esi, 4
call fcn.004a0720
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x23], 0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx]
call r8
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0c40]
call fcn.00436580
nop
nop
call fcn.00435a20
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004bdae0
Function at 0x4bdce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bde29
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov r13, 0
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x4f], 0
movups xmmword [rsp + 0x50], xmm15
test byte [rax], al
jmp 0x4bdd16
mov rax, r13
mov rdx, qword [rax]
bt edx, 0
jb 0x4bdd4b
lea r12, [rdx + 8]
test r12, 0x7ffff8
je 0x4bddfc
mov r13, rax
mov rax, rdx
lock cmpxchg qword [r13], r12
sete r12b
test r12b, r12b
je 0x4bdd13
bt edx, 0
jmp 0x4bdd4e
mov r13, rax
jae 0x4bdd7a
cmp byte [r13 + 0x21f], 0
je 0x4bdd6a
mov rdx, qword [0x009af3d0]
mov r12, qword [0x009af3d8]
jmp 0x4bdd80
lea rdx, [0x007f2460]
lea r12, [0x00a04c58]
jmp 0x4bdd80
xor edx, edx
xor r12d, r12d
nop
test rdx, rdx
je 0x4bdd9f
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r12
mov rax, rdx
mov rbx, r12
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x004bdea0]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r13
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x4f], 1
mov rax, qword [r13 + 0x10]
call fcn.0049f8a0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x4f], 0
mov rdx, qword [rsp + 0x70]
mov r12, qword [rdx]
call r12
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0c40]
call fcn.00436580
nop
call fcn.00435a20
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00463860
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004bdce0

Function at 0x4c0520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c057b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x4c054e
nop
call fcn.004b87a0
test al, al
jne 0x4c0567
mov rax, qword [rsp + 0x20]
call fcn.004603a0
mov rax, qword [rsp + 0x20]
call fcn.004607e0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0ed0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.004c0520
Function at 0x4ce380
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ce426
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rax, rax
je 0x4ce40e
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
nop
lea rax, [0x00701dc0]
call fcn.0040daa0
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
cmp dword [0x00a04ed0], 0
jne 0x4ce3da
mov rbx, qword [rsp + 0x40]
mov qword [rax + 8], rbx
jmp 0x4ce3e8
lea rdi, [rax + 8]
mov rbx, qword [rsp + 0x40]
call fcn.00465b60
mov qword [rsp + 0x20], rax
mov rdi, rax
mov rax, rcx
lea rcx, [0x007f2bc0]
call fcn.004ce600
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f05b0]
nop dword [rax]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004ce380
Function at 0x4cfc00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cfd19
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
mov byte [rsp + 0x48], bl
mov qword [rsp + 0x40], rax
mov rdx, qword [rax]
mov rax, rdx
xor ebx, ebx
nop dword [rax]
call fcn.004cf100
movzx edx, byte [rsp + 0x48]
test dl, dl
je 0x4cfc69
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rdi]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
lea rcx, [0x007f2be8]
call fcn.004ceaa0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx + 0x10], esi
sete sil
test sil, sil
jne 0x4cfc94
lea rax, [rdx + 0x10]
call fcn.0047d500
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + 8]
test rax, rax
je 0x4cfcdf
nop
cmp qword [rax + 0x20], 0
je 0x4cfd05
add rax, 8
call fcn.004627c0
cmp dword [0x00a04ed0], 0
jne 0x4cfcc6
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], 0
jmp 0x4cfcdf
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 8]
mov rax, rdi
mov rdi, rcx
xor edx, edx
call fcn.00465b40
mov rcx, rax
mov rax, qword [rcx]
mov ebx, 0xffffffff
lock xadd dword [rax + 0x10], ebx
dec ebx
test ebx, ebx
je 0x4cfcfb
add rax, 0x10
call fcn.0047d800
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0e80]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463860
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004cfc00
Function at 0x4cfde0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cff59
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
test rax, rax
je 0x4cff45
nop
test rcx, rcx
je 0x4cff2d
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x4cfe64
lea r9, [0x007f5968]
jmp 0x4cfe69
xor r9d, r9d
xor edx, edx
mov rcx, qword [r9 + 0x20]
mov rax, rdx
call rcx
test al, al
je 0x4cff1a
lea rax, [0x006fbc40]
call fcn.0040daa0
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
cmp dword [0x00a04ed0], 0
jne 0x4cfea2
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
jmp 0x4cfeb0
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x48]
call fcn.00465b20
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
cmp dword [0x00a04ed0], 0
jne 0x4cfecd
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x18], rcx
jmp 0x4cfedb
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x58]
call fcn.00465b20
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x20], rcx
cmp dword [0x00a04ed0], 0
jne 0x4cfef8
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x28], rcx
jmp 0x4cff06
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x68]
call fcn.00465b20
mov rbx, rax
lea rax, [0x007f4000]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f05e0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f05d0]
nop dword [rax + rax]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f05b0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004cfde0

Function at 0x4d38c0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4d392b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4d38e4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4d3901
cmp rdx, 0
je 0x4d394d
test rdx, 0xf
je 0x4d38dd
test rdx, 7
jne 0x4d3901
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4d38dd
ret
Function at 0x4d8040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d816e
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rbx
call fcn.004d5e20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jl 0x4d815a
mov rdx, qword [rsp + 0x40]
nop dword [rax]
cmp rdx, 0x10
jl 0x4d8147
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rdx, rsi
je 0x4d80dd
nop
mov rdi, rdx
lea r8, [rsi + 0xf]
cmp r8, rdx
jb 0x4d80da
mov rdx, rsi
lea r8, [rdi + 0xf]
cmp r8, rsi
jae 0x4d8134
mov rsi, rdx
mov rdx, rdi
jmp 0x4d80dd
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rbx + 8]
mov rbx, qword [rbx]
test rdi, rdi
jbe 0x4d812a
shr rdi, 2
lea rax, [rdi - 1]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rsi
call fcn.004d8540
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rcx, rax
call fcn.00465ec0
lea rax, [0x006bb4c0]
lea rbx, [0x007f0650]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0640]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0630]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004d8040
Function at 0x4d81c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d82ef
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rbx
call fcn.004d5e20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jl 0x4d82db
mov rdx, qword [rsp + 0x40]
nop dword [rax]
cmp rdx, 0x10
jl 0x4d82c8
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rdx, rsi
je 0x4d825d
nop
mov rdi, rdx
lea r8, [rsi + 0xf]
cmp r8, rdx
jb 0x4d825a
mov rdx, rsi
lea r8, [rdi + 0xf]
cmp r8, rsi
jae 0x4d82b5
mov rsi, rdx
mov rdx, rdi
jmp 0x4d825d
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rbx + 0x20]
mov rbx, qword [rbx + 0x18]
test rdi, rdi
jbe 0x4d82ab
shr rdi, 2
lea rax, [rdi - 1]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rsi
call fcn.004d8600
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rcx, rax
call fcn.00465ec0
lea rax, [0x006bb4c0]
lea rbx, [0x007f0650]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0640]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0630]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004d81c0

Function at 0x4d8540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4d857f
jb 0x4d8594
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4d8600
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4d863f
jb 0x4d8654
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4d86c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4d8790
jb 0x4d87ef
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004d84e0
aeskeygenassist xmm1, xmm0, 1
call fcn.004d8500
aeskeygenassist xmm1, xmm2, 2
call fcn.004d84e0
aeskeygenassist xmm1, xmm0, 2
call fcn.004d8500
aeskeygenassist xmm1, xmm2, 4
call fcn.004d84e0
aeskeygenassist xmm1, xmm0, 4
call fcn.004d8500
aeskeygenassist xmm1, xmm2, 8
call fcn.004d84e0
aeskeygenassist xmm1, xmm0, 8
call fcn.004d8500
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004d84e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004d8500
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004d84e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004d8500
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004d84e0
jmp 0x4d885d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004d8440
aeskeygenassist xmm1, xmm2, 2
call fcn.004d84a0
aeskeygenassist xmm1, xmm2, 4
call fcn.004d8440
aeskeygenassist xmm1, xmm2, 8
call fcn.004d84a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004d8440
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004d84a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004d8440
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004d84a0
jmp 0x4d885d
aeskeygenassist xmm1, xmm0, 1
call fcn.004d8400
aeskeygenassist xmm1, xmm0, 2
call fcn.004d8400
aeskeygenassist xmm1, xmm0, 4
call fcn.004d8400
aeskeygenassist xmm1, xmm0, 8
call fcn.004d8400
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004d8400
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004d8400
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004d8400
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004d8400
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004d8400
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004d8400
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4d886a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x4ddbc0
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4dddcc
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movzx ecx, byte [rbx + 0x1b]
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r15
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r15d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r15
movzx r13d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r13
movzx r12d, byte [rbx + 9]
mov qword [rsp + 8], r12
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r10d, byte [rbx + 7]
shl r10, 0x38
movzx r9d, byte [rbx + 6]
shl r9, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r12d, byte [rbx + 3]
shl r12, 0x18
movzx r13d, byte [rbx + 2]
shl r13, 0x10
movzx r15d, byte [rbx + 1]
shl r15, 8
movzx ebx, byte [rbx]
add rbx, r15
add rbx, r13
add rbx, r12
add rbx, r11
add rbx, r8
add rbx, r9
add rbx, r10
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x78]
shl rcx, 0x18
mov rdx, qword [rsp + 0x70]
shl rdx, 0x10
mov rbx, qword [rsp + 0x68]
shl rbx, 8
mov rsi, qword [rsp + 0x60]
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ddbc0
Function at 0x4f40a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x4f4243
sub rsp, 0xb8
mov qword [rsp + 0xb0], rbp
lea rbp, [rsp + 0xb0]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
nop dword [rax]
call fcn.004db3a0
cmp rax, 1
je 0x4f4204
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
mov rcx, qword [rsp + 0xc0]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0x80]
call fcn.004dde00
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rcx, qword [rsp + 0xc0]
mov rbx, qword [rcx]
test byte [rbx], al
test byte [rax], al
mov rcx, rax
lea rax, [rsp + 0x60]
nop dword [rax]
call fcn.004db7a0
mov rcx, qword [rsp + 0xc8]
test byte [rcx], al
movups xmmword [rsp + 0x44], xmm15
movups xmmword [rsp + 0x50], xmm15
lea rax, [rsp + 0x60]
lea rbx, [rsp + 0x44]
call fcn.004db440
cmp rbx, 0x1c
ja 0x4f4182
mov rcx, rbx
mov rdx, qword [rsp + 0xc8]
mov esi, 0x1c
jmp 0x4f41be
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0xc8]
mov ecx, 0x1c
mov rdi, rbx
lea rsi, [0x006bb680]
call fcn.0044aa20
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.00466860
mov rax, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x23
lea rcx, [0x0072861e]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007f1c00]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax]
jmp fcn.004f40a0