joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e1b60
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x4e1d53
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
cmp cl, 0x10
jae 0x4e1d3f
mov qword [rsp + 0xe0], rax
mov byte [rsp + 0xf0], cl
mov qword [rsp + 0xe8], rbx
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
movabs rdx, 0xffffffff00000001
mov qword [rsp + 0x58], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 1
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb8], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xc0], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0xc8], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0xc0]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0xc8]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov edx, 1
jmp 0x4e1d05
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.004e1a60
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
movzx r8d, byte [rsp + 0xf0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xe8]
cmp dl, 0x10
jae 0x4e1d22
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x4e1cb8
nop
jmp 0x4e1d32
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465aa0
lea rax, [0x00667a40]
lea rbx, [0x0072d9a0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004e1b60
Function at 0x4e47e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb0]
cmp r12, qword [r14 + 0x10]
jbe 0x4e49dd
sub rsp, 0x130
mov qword [rsp + 0x128], rbp
lea rbp, [rsp + 0x128]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
call fcn.004cb0a0
cmp rax, 1
je 0x4e499e
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xd8], xmm15
movups xmmword [rsp + 0xe8], xmm15
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x108], xmm15
mov rcx, qword [rsp + 0x138]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0xd0]
call fcn.004d8a60
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov rcx, qword [rsp + 0x138]
mov rbx, qword [rcx]
test byte [rbx], al
test byte [rax], al
mov rcx, rax
lea rax, [rsp + 0x88]
nop dword [rax]
call fcn.004cb5c0
mov rcx, qword [rsp + 0x140]
test byte [rcx], al
movups xmmword [rsp + 0x46], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
lea rax, [rsp + 0x88]
lea rbx, [rsp + 0x46]
call fcn.004cb180
nop
cmp rbx, 0x42
ja 0x4e4918
mov rcx, rbx
mov rdx, qword [rsp + 0x140]
mov esi, 0x42
jmp 0x4e4958
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x140]
mov ecx, 0x42
mov rdi, rbx
lea rsi, [0x00667c00]
nop dword [rax]
call fcn.0044a700
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x120], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.00466460
mov rax, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
ret
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x23
lea rcx, [0x006c4a13]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0072e7e0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004e47e0
Function at 0x4e57a0
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x4e59ed
sub rsp, 0x120
mov qword [rsp + 0x118], rbp
lea rbp, [rsp + 0x118]
cmp cl, 0x10
jae 0x4e59d9
mov qword [rsp + 0x128], rax
mov byte [rsp + 0x138], cl
mov qword [rsp + 0x130], rbx
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0x110], 0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x108], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x110], rdx
mov rdx, qword [rbx]
mov rsi, qword [rsp + 0xb8]
mov qword [rdx], rsi
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
jmp 0x4e59a0
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.004e56a0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x4e59bc
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x4e5953
jmp 0x4e59cc
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465aa0
lea rax, [0x00667a40]
lea rbx, [0x0072d9b0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004e57a0
Function at 0x4e8c40
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x4e8c8d
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x4e8d20
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x4e8d65
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x4eb9a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eba56
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
nop dword [rax]
cmp rcx, 0x20
je 0x4eb9fa
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x2e
lea rcx, [0x006c893c]
mov qword [rax], rcx
lea rbx, [0x0072e7e0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rdx, qword [rbx]
movabs rsi, 0x7ffffffffffff
and rdx, rsi
mov qword [rax], rdx
mov rdx, qword [rbx + 6]
shr rdx, 3
and rdx, rsi
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0xc]
shr rdx, 6
and rdx, rsi
mov qword [rax + 0x10], rdx
mov rdx, qword [rbx + 0x13]
shr rdx, 1
and rdx, rsi
mov qword [rax + 0x18], rdx
mov rdx, qword [rbx + 0x18]
shr rdx, 0xc
and rdx, rsi
mov qword [rax + 0x20], rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004eb9a0

Function at 0x4ebaa0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ebbe6
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
nop
call fcn.004eaee0
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x4ebb40
inc rax
mov rcx, rbx
nop dword [rax + rax]
cmp rax, 5
jge 0x4ebb83
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
mov rdi, rdx
and rdx, 0xfffffffffffffff8
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x40]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
xor ecx, ecx
jmp 0x4ebbac
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rbx + rdi]
or r8d, edx
mov byte [rbx + rdi], r8b
inc rcx
mov rdi, rsi
cmp rcx, 8
jge 0x4ebb35
movzx edx, byte [rsp + rcx + 0x10]
mov rsi, rdi
sar rdi, 3
add rdi, rcx
cmp rdi, 0x20
jge 0x4ebb35
test byte [rbx], al
cmp rdi, 0x20
jb 0x4ebb9a
mov rax, rdi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.00465aa0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004ebaa0
Function at 0x4ed220
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4ed3a6
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc8], rdi
cmp rsi, rbx
jne 0x4ed38e
nop
cmp rbx, 0x48
jg 0x4ed37b
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
xor ecx, ecx
jmp 0x4ed2c9
movzx r9d, byte [rax + rbx - 1]
mov byte [rsp + rcx + 0x58], r9b
mov byte [rsp + rcx + 0x10], sil
inc rcx
mov rbx, r8
mov rsi, rdx
cmp rbx, rcx
jle 0x4ed2ff
mov rdx, rsi
sub rsi, rcx
lea r8, [rsi - 1]
nop dword [rax + rax]
cmp rdx, r8
jbe 0x4ed370
mov r8, rbx
sub rbx, rcx
lea r9, [rbx - 1]
movzx esi, byte [rdi + rsi - 1]
cmp r8, r9
ja 0x4ed2b0
jmp 0x4ed365
xor eax, eax
xor ecx, ecx
jmp 0x4ed320
mov rbx, qword [rsp + rdx + 0x58]
mov rdx, qword [rsp + rdx + 0x10]
neg ecx
sbb rbx, rdx
sbb rcx, rcx
add rax, 8
neg rcx
nop
cmp rax, 0x48
jge 0x4ed33f
lea rdx, [rax - 0x48]
mov rbx, rdx
sar rdx, 0x3f
and rdx, rax
neg rbx
cmp rbx, 7
ja 0x4ed305
jmp 0x4ed356
cmp rcx, 1
sete al
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov eax, 7
mov rcx, rbx
nop
call fcn.00465aa0
mov rax, r9
mov rcx, r8
call fcn.00465aa0
mov rax, r8
mov rcx, rdx
call fcn.00465aa0
lea rax, [0x00667a40]
lea rbx, [0x0072d850]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d840]
nop dword [rax]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004ed220
Function at 0x4ee3e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ee56c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
call fcn.004bb9a0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rbx, qword [rax + 8]
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rdx + 0x80]
cmp rsi, rcx
jne 0x4ee558
mov rax, rcx
mov rcx, qword [rsp + 0x48]
call fcn.004040a0
test al, al
je 0x4ee558
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov rbx, rsi
mov r10, rcx
mov rcx, rdi
mov rdi, r8
call r10
test rbx, rbx
jne 0x4ee545
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx + 8]
mov rbx, qword [rdx + 8]
mov rdx, rcx
call rbx
cmp rbx, 1
je 0x4ee52f
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rax, [0x0068ed40]
call fcn.0040da20
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rax], rcx
cmp dword [0x00918a90], 0
jne 0x4ee4e8
mov qword [rax + 8], rdx
jmp 0x4ee4f1
lea rdi, [rax + 8]
call fcn.00465720
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
cmp dword [0x00918a90], 0
jne 0x4ee517
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
jmp 0x4ee525
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465700
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d880]
nop dword [rax]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d870]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d860]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004ee3e0
Function at 0x4ee5a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ee743
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], rcx
mov rdx, qword [rax + 0x20]
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
cmp rdi, rdx
jne 0x4ee5d6
xor r10d, r10d
xor r11d, r11d
jmp 0x4ee618
lea rax, [0x0067fd60]
nop dword [rax]
call fcn.0040da20
mov qword [rax + 8], 0x25
lea rcx, [0x006c5858]
mov qword [rax], rcx
lea rbx, [0x0072e7e0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r12d, byte [rcx + r10]
inc r10
or r11d, r12d
cmp rdi, r10
jg 0x4ee60d
nop dword [rax]
test r11b, r11b
je 0x4ee729
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
mov rdi, r9
mov rsi, rdx
call fcn.004ed220
test al, al
je 0x4ee729
mov rdi, qword [rsp + 0x70]
nop
test rdi, rdi
ja 0x4ee672
lea rax, [0x00918838]
xor ecx, ecx
xor ebx, ebx
jmp 0x4ee68f
lea rax, [0x00918838]
mov rbx, rdi
xor ecx, ecx
lea rsi, [0x00667c00]
call fcn.0044a700
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call fcn.00466460
lea rax, [0x0069d540]
call fcn.0040da20
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx + 0x78]
mov qword [rax], rdx
cmp dword [0x00918a90], 0
jne 0x4ee6d7
mov rdx, qword [rsp + 0x58]
mov qword [rax + 8], rdx
jmp 0x4ee6e5
lea rdi, [rax + 8]
mov rdx, qword [rsp + 0x58]
call fcn.00465720
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x18], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x20], rdx
cmp dword [0x00918a90], 0
nop
jne 0x4ee70d
mov rdx, qword [rsp + 0x40]
mov qword [rax + 0x10], rdx
jmp 0x4ee71b
lea rdi, [rax + 0x10]
mov rdx, qword [rsp + 0x40]
call fcn.00465720
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbx, qword [0x008b5b80]
mov rcx, qword [0x008b5b88]
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop dword [rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.004ee5a0
Function at 0x4faaa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fabaa
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, qword [rax]
nop dword [rax + rax]
test rdx, rdx
je 0x4faacf
cmp rax, rdx
je 0x4faae5
jmp 0x4fab96
cmp dword [0x00918a90], 0
jne 0x4faadd
mov qword [rax], rax
jmp 0x4faae5
mov rdi, rax
call fcn.00465600
mov qword [rsp + 0x58], rax
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov qword [rsp + 0x40], r8
nop dword [rax + rax]
cmp ebx, 0x7f
ja 0x4fab44
lea r9, [r8 + 1]
cmp rcx, r9
jae 0x4fab3d
mov dword [rsp + 0x60], ebx
mov rax, rdx
mov rbx, r9
mov edi, 1
lea rsi, [0x00667c00]
call fcn.0044a700
mov r8, qword [rsp + 0x40]
mov r9, rbx
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x60]
mov byte [r9 + rdx - 1], bl
jmp 0x4fab61
mov rax, rdx
mov edi, ebx
mov rbx, r8
call fcn.0048c7e0
mov r8, qword [rsp + 0x40]
mov r9, rbx
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x10], r9
mov qword [rax + 0x18], rcx
sub r9, r8
cmp dword [0x00918a90], 0
jne 0x4fab7b
mov qword [rax + 8], rdx
jmp 0x4fab85
lea rdi, [rax + 8]
nop
call fcn.00465720
mov rax, r9
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00667a40]
lea rbx, [0x0072dd30]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.004faaa0
Function at 0x502bc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x502cc6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rcx, qword [rax + 0x10]
shl rcx, 3
mov qword [rsp + 0x18], rcx
mov rbx, rcx
lea rax, [0x00667c00]
call fcn.0044a620
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov rdi, qword [rsp + 0x18]
mov rcx, rdi
xor ebx, ebx
jmp 0x502c15
inc rbx
cmp rbx, rdx
jge 0x502c23
mov r8, qword [rsi + rbx*8]
xor r9d, r9d
jmp 0x502c80
test rdi, rdi
jge 0x502c2f
xor edi, edi
jmp 0x502c2f
inc rdi
cmp rdi, rcx
jge 0x502c43
jae 0x502c6d
movzx edx, byte [rax + rdi]
test dl, dl
je 0x502c2c
nop
cmp rdi, rcx
ja 0x502c65
sub rcx, rdi
mov rbx, rcx
neg rcx
sar rcx, 0x3f
and rdi, rcx
add rax, rdi
mov rcx, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rdi
call fcn.00465b60
mov rax, rdi
call fcn.00465aa0
inc r9
shr r8, 8
mov rdi, r10
nop
cmp r9, 8
jge 0x502c12
lea r10, [rdi - 1]
test r10, r10
jl 0x502ca0
cmp rcx, r10
jbe 0x502cb8
mov byte [rdi + rax - 1], r8b
jmp 0x502c75
test r8b, r8b
je 0x502c75
lea rax, [0x00667a40]
lea rbx, [0x0072dc90]
call fcn.00436260
mov rax, r10
nop dword [rax + rax]
call fcn.00465aa0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00502bc0

Function at 0x502ce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x502de6
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
nop dword [rax]
test rcx, rcx
je 0x502d39
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov rax, rbx
mov rbx, rcx
nop
call fcn.00466160
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
mov rsi, qword [rax + 0x10]
mov rax, rcx
xor r8d, r8d
jmp 0x502d4c
inc r8
cmp r8, rsi
jge 0x502d5a
mov r9, qword [rdx + r8*8]
xor r10d, r10d
jmp 0x502da3
test rcx, rcx
jge 0x502d66
xor ecx, ecx
jmp 0x502d66
inc rcx
cmp rax, rcx
jle 0x502d75
jbe 0x502d8b
movzx edx, byte [rbx + rcx]
test dl, dl
je 0x502d63
mov rcx, rdi
mov rdx, rax
mov rax, rbx
mov rbx, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.00465aa0
inc r10
shr r9, 8
mov rcx, r11
cmp r10, 8
jge 0x502d49
lea r11, [rcx - 1]
test r11, r11
jl 0x502dc0
cmp rax, r11
jbe 0x502dd8
mov byte [rcx + rbx - 1], r9b
jmp 0x502d99
test r9b, r9b
je 0x502d99
lea rax, [0x00667a40]
lea rbx, [0x0072dc90]
call fcn.00436260
mov rcx, rax
mov rax, r11
nop
call fcn.00465aa0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00502ce0