joyce8/EMBER2024-capa huggingface dataset:
Function at 0x518610
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x518827
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b3feb]
cmp al, 1
jbe 0x51864d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x518656
call fcn.00429680
ud2
mov byte [0x008b3feb], 1
call fcn.004cb700
call fcn.0045cd90
lea rax, [0x006d9c6b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a4a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x00896f10], rcx
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x51880d
mov qword [0x00896f18], rax
lea rax, [0x006d8379]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896f20], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x5187f3
mov qword [0x00896f28], rcx
lea rax, [0x006dc11e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2d
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896f00], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x5187d9
mov qword [0x00896f08], rcx
lea rax, [0x006dbb91]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896f30], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x5187c2
mov qword [0x00896f38], rcx
lea rax, [0x006d8e0b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896f40], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x5187ab
mov qword [0x00896f48], rcx
mov byte [0x008b3feb], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00896f48]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x51879a
lea rax, [0x00896f38]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x51875f
lea rax, [0x00896f08]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x518724
lea rax, [0x00896f28]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x5186e5
lea rcx, [0x00896f18]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x5186a6
call fcn.00452210
jmp fcn.00518610
Function at 0x529110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5292d0
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rcx
mov rsi, qword [rsp + 0x68]
cmp rax, rsi
jge 0x5292c6
mov edi, dword [rcx]
shl edx, 1
mov word [rsp + 0x26], dx
test rax, rax
jne 0x529178
add rcx, 4
inc rax
jmp 0x529149
test edi, edi
jne 0x52917e
jmp 0x52916f
movsxd rdi, edi
mov r8, rbx
sub rbx, rdi
mov qword [rsp + 0x80], rbx
cmp rbx, r8
ja 0x5292bf
mov rdi, qword [rsp + 0x58]
test byte [rdi], al
lea r9, [rdi + 0x78]
mov qword [rsp], r9
mov r9, qword [rsp + 0x88]
sub r9, rbx
mov r11, rbx
shl rbx, 3
lea r12, [r9 - 1]
sar r12, 0x3f
xor r12, 0xffffffffffffffff
and rbx, r12
mov r12, qword [rsp + 0x78]
add rbx, r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 8], rbx
sub r8, r11
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call fcn.00529590
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
movzx ebx, word [rsp + 0x26]
mov rsi, qword [rsp + 0x38]
xor edi, edi
cmp rdi, rcx
jge 0x529283
lea r8d, [rax - 0x10]
neg r8d
mov r9, rcx
mov ecx, r8d
mov r10d, ebx
shl ebx, cl
cmp cl, 0x20
sbb r8d, r8d
and r8d, ebx
movzx ebx, r8b
lea r11, [0x007ebd60]
movzx ebx, byte [r11 + rbx]
shr r8w, 8
movzx r8d, r8w
movzx r8d, byte [r11 + r8]
movzx r12d, word [rsi]
shl ebx, 8
or r8d, ebx
mov rbx, qword [rdx + 8]
mov r13, qword [rdx]
cmp r12, rbx
jae 0x5292b8
shl r12, 2
mov word [r13 + r12], r8w
mov word [r13 + r12 + 2], ax
add rsi, 8
inc rdi
lea ebx, [r10 + 1]
mov rcx, r9
cmp rdi, rcx
jl 0x529211
mov rcx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
cmp rcx, rsi
ja 0x5292b1
mov rcx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
mov edx, ebx
mov rbx, qword [rsp + 0x80]
jmp 0x52916f
call fcn.00429450
ud2
call fcn.004293e0
ud2
call fcn.00429450
ud2
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00452210
jmp fcn.00529110

Function at 0x52e120
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 8]
not eax
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
xor esi, esi
cmp rsi, rcx
jge 0x52e15a
test byte [rdx], al
movzx edi, byte [rbx]
inc rbx
inc rsi
xor edi, eax
movzx edi, dil
mov edi, dword [rdx + rdi*4]
shr eax, 8
xor eax, edi
cmp rsi, rcx
jl 0x52e13c
not eax
mov dword [rsp + 0x30], eax
ret
Function at 0x52ff00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x530055
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x78]
lea rcx, [rax + 2]
cmp rcx, 0xb
jbe 0x52ffe5
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
lea rax, [0x0066f400]
mov qword [rsp], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
lea rax, [0x006d9a5e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
lea rax, [rsp + 0x48]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 1
mov qword [rsp + 0x20], 1
call fcn.004b0de0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rcx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rcx, [0x006bc720]
mov qword [rsp], rcx
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp], rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x18], rcx
call fcn.00530060
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.00452210
jmp fcn.0052ff00
Function at 0x5301b0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x53030f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x60]
cmp rax, 0xffff
jle 0x530252
lea rax, [0x0068d4a0]
mov qword [rsp], rax
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x38], rax
mov qword [rax + 8], 0x23
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x530236
lea rcx, [0x006d9a3b]
mov qword [rax], rcx
lea rcx, [0x007e49c0]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp], rax
lea rcx, [0x006d9a3b]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x38]
jmp 0x53021b
mov rcx, qword [rsp + 0x50]
lea rdx, [rcx + 0x89]
test byte [rdx], al
mov byte [rcx + 0x89], al
shr ax, 8
mov byte [rcx + 0x8a], al
mov rax, qword [rcx + 0x60]
mov rsi, qword [rcx + 0x58]
mov rsi, qword [rsi + 0x20]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 2
mov qword [rsp + 0x18], 0xa
mov qword [rsp], rax
call rsi
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
test rax, rax
je 0x5302bc
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x58]
mov rax, qword [rax + 0x60]
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp], rax
call rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00452210
jmp fcn.005301b0
Function at 0x552020
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x552191
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
mov rdx, qword [rsp + 0x58]
mov qword [rsp], rdx
call rcx
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
jne 0x552148
lea rax, [0x00687d60]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
call fcn.0040d0e0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
movzx edx, byte [rsp + 0x28]
test dl, dl
je 0x5520ef
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x18], rdx
mov qword [rsp], rax
call rcx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.00551df0
mov rax, qword [rsp + 0x28]
lea rcx, [0x007e6680]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006dddd1]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x37
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.00552020
Function at 0x552590
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x552701
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
mov rdx, qword [rsp + 0x58]
mov qword [rsp], rdx
call rcx
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
jne 0x5526b8
lea rax, [0x00687ce0]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
call fcn.0040d0e0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
movzx edx, byte [rsp + 0x28]
test dl, dl
je 0x55265f
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x18], rdx
mov qword [rsp], rax
call rcx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.00551df0
mov rax, qword [rsp + 0x28]
lea rcx, [0x007e6640]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006ddd9a]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x37
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.00552590

Function at 0x555490
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x55554a
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b3fca]
cmp al, 1
jbe 0x5554cd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x5554d6
call fcn.00429680
ud2
mov byte [0x008b3fca], 1
call fcn.0045cd90
call fcn.00451ac0
lea rax, [0x006da1a4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896cd0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x555533
mov qword [0x00896cd8], rcx
mov byte [0x008b3fca], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00896cd8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x555522
call fcn.00452210
jmp fcn.00555490
Function at 0x5583e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5584a9
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b3fc8]
cmp al, 1
jbe 0x55841d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x558426
call fcn.00429680
ud2
mov byte [0x008b3fc8], 1
call fcn.00555490
call fcn.00496290
lea rax, [0x006da1a4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896cc0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x558492
mov qword [0x00896cc8], rcx
call fcn.00555910
movzx eax, byte [rsp]
mov byte [0x008b3fc9], al
mov byte [0x008b3fc8], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00896cc8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x558472
call fcn.00452210
jmp fcn.005583e0
Function at 0x558710
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x55887e
jb 0x55880b
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.005589a0
aeskeygenassist xmm1, xmm0, 1
call fcn.005589b0
aeskeygenassist xmm1, xmm2, 2
call fcn.005589a0
aeskeygenassist xmm1, xmm0, 2
call fcn.005589b0
aeskeygenassist xmm1, xmm2, 4
call fcn.005589a0
aeskeygenassist xmm1, xmm0, 4
call fcn.005589b0
aeskeygenassist xmm1, xmm2, 8
call fcn.005589a0
aeskeygenassist xmm1, xmm0, 8
call fcn.005589b0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005589a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005589b0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005589a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005589b0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005589a0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x5587e8
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
aeskeygenassist xmm1, xmm0, 1
call fcn.005588e0
aeskeygenassist xmm1, xmm0, 2
call fcn.005588e0
aeskeygenassist xmm1, xmm0, 4
call fcn.005588e0
aeskeygenassist xmm1, xmm0, 8
call fcn.005588e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005588e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005588e0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.005588e0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.005588e0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.005588e0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.005588e0
jmp 0x5587db
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00558910
aeskeygenassist xmm1, xmm2, 2
call fcn.00558960
aeskeygenassist xmm1, xmm2, 4
call fcn.00558910
aeskeygenassist xmm1, xmm2, 8
call fcn.00558960
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00558910
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00558960
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00558910
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00558960
jmp 0x5587db
Function at 0x55b3c0
Capabilities:
Encrypt data using des

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x55b4ff
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
xor eax, eax
mov qword [rsp + 0x28], rax
cmp rax, 8
jge 0x55b4ee
xor ecx, ecx
mov qword [rsp + 0x38], rcx
cmp rcx, 4
jge 0x55b4dc
xor edx, edx
mov qword [rsp + 0x30], rdx
cmp rdx, 0x10
jge 0x55b4ca
mov rbx, rax
shl rax, 6
lea rsi, [0x007ef260]
add rax, rsi
shl rcx, 4
mov qword [rsp + 0x40], rcx
add rax, rcx
movzx eax, byte [rax + rdx]
lea r8, [rbx - 7]
neg r8
shl r8, 2
mov rcx, r8
shl rax, cl
cmp rcx, 0x40
sbb r8, r8
and r8, rax
mov qword [rsp], r8
lea rax, [0x007e3fe0]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x20
mov qword [rsp + 0x18], 0x20
call fcn.0055b350
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rdx, rbx
cmp rdx, 0x40
jae 0x55b4f8
mov rsi, qword [rsp + 0x28]
mov rdi, rsi
shl rsi, 8
lea r8, [0x008b56c0]
add rsi, r8
mov dword [rsi + rdx*4], eax
lea rdx, [rbx + 1]
mov rax, rdi
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rdx
cmp rdx, 0x10
jl 0x55b41b
inc rcx
mov qword [rsp + 0x38], rcx
cmp rcx, 4
jl 0x55b40a
inc rax
mov qword [rsp + 0x28], rax
cmp rax, 8
jl 0x55b3f9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.004293e0
ud2
call fcn.00452210
jmp fcn.0055b3c0
Function at 0x55d3a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x55d5c8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x55d573
cmp rax, 1
jne 0x55d4ee
xor ecx, ecx
xor edx, edx
test rcx, rcx
jne 0x55d4cb
cmp rax, 8
jg 0x55d45d
mov rbx, qword [rsp + 0x60]
xor esi, esi
xor edi, edi
cmp rsi, rax
jge 0x55d419
lea r8, [rsi + 1]
shl rdi, 8
movzx r9d, byte [rbx + rsi]
or rdi, r9
mov rsi, r8
cmp rsi, rax
jl 0x55d401
shl eax, 3
add eax, 0xffffffc0
neg eax
mov rbx, rcx
mov ecx, eax
shl rdi, cl
cmp al, 0x40
sbb rsi, rsi
and rdi, rsi
cmp al, 0x40
sbb esi, esi
not esi
or esi, eax
mov ecx, esi
sar rdi, cl
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdx
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [0x006d318d]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x11
lea rax, [0x007e5800]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040cd80
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rcx
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdx
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rdx, qword [rsp + 0x60]
movzx ebx, byte [rdx]
test bl, bl
jne 0x55d504
movzx esi, byte [rdx + 1]
test sil, 0x80
je 0x55d51e
cmp bl, 0xff
jne 0x55d515
movzx ebx, byte [rdx + 1]
and ebx, 0xffffff80
cmp bl, 0x80
je 0x55d51e
xor ecx, ecx
xor edx, edx
jmp 0x55d3e4
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea rcx, [0x006d7ab7]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0x1d
lea rcx, [0x007e5800]
mov qword [rsp], rcx
lea rbx, [rsp + 0x40]
mov qword [rsp + 8], rbx
call fcn.0040cd80
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x68]
jmp 0x55d3e4
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea rcx, [0x006d1d40]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0xd
lea rcx, [0x007e5800]
mov qword [rsp], rcx
lea rdx, [rsp + 0x20]
mov qword [rsp + 8], rdx
call fcn.0040cd80
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x68]
jmp 0x55d3e4
call fcn.00452210
jmp fcn.0055d3a0
Function at 0x55d5e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x55d829
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x55d7d4
cmp rax, 1
jne 0x55d750
xor ecx, ecx
xor edx, edx
test rdx, rdx
jne 0x55d72b
mov rcx, qword [rsp + 0x70]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x10], rax
call fcn.0055d3a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
test rcx, rcx
jne 0x55d706
movsxd rcx, eax
cmp rax, rcx
je 0x55d6dd
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [0x006d318d]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x11
lea rax, [0x007e5800]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040cd80
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rcx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x88], eax
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rdx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rcx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rcx, qword [rsp + 0x70]
movzx edx, byte [rcx]
test dl, dl
jne 0x55d7ba
movzx ebx, byte [rcx + 1]
test bl, 0x80
jne 0x55d7ba
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea rdx, [0x006d7ab7]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], 0x1d
lea rdx, [0x007e5800]
mov qword [rsp], rdx
lea rbx, [rsp + 0x40]
mov qword [rsp + 8], rbx
call fcn.0040cd80
mov rdx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x78]
jmp 0x55d624
cmp dl, 0xff
jne 0x55d7cb
movzx edx, byte [rcx + 1]
and edx, 0xffffff80
cmp dl, 0x80
je 0x55d765
xor ecx, ecx
xor edx, edx
jmp 0x55d624
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea rcx, [0x006d1d40]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 0xd
lea rcx, [0x007e5800]
mov qword [rsp], rcx
lea rdx, [rsp + 0x50]
mov qword [rsp + 8], rdx
call fcn.0040cd80
mov rdx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x78]
jmp 0x55d624
call fcn.00452210
jmp fcn.0055d5e0