joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b6ab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x45b44e
nop dword [rax]
cmp ebx, 0xffffffff
je 0x45b44e
lea rcx, [0x0086af80]
jmp 0x45b461
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x230]
test rcx, rcx
je 0x45b47a
cmp qword [rcx + 0x128], rax
ja 0x45b45a
cmp qword [rcx + 0x130], rax
jbe 0x45b45a
jmp 0x45b47c
xor ecx, ecx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x45b4e8
mov qword [rsp + 0x40], rcx
mov rdx, qword [rcx + 0x220]
lea rax, [0x00663800]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
nop
call fcn.00410a20
mov rax, qword [rax]
test rax, rax
jne 0x45b4de
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x128]
mov ebx, dword [rsp + 0x60]
movsxd rsi, ebx
lea rax, [rdx + rsi]
mov rcx, qword [rcx + 0x130]
cmp rcx, rax
jb 0x45b625
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x18], rax
nop
nop
nop
lea rax, [0x0089e360]
call fcn.0040b7a0
mov rbx, qword [0x0089e370]
lea rax, [0x006630e0]
mov ecx, dword [rsp + 0x60]
call fcn.00410a20
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x0089e360]
call fcn.0040b9c0
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x45b593
call fcn.00438500
lea rax, [0x006a8436]
mov ebx, 0x11
call fcn.00438e00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438c60
lea rax, [0x006a48f6]
mov ebx, 6
call fcn.00438e00
mov rax, qword [rsp + 0x18]
call fcn.00438c60
lea rax, [0x006a78ec]
mov ebx, 0x10
nop dword [rax]
call fcn.00438e00
call fcn.00438580
lea rax, [0x0086af80]
jmp 0x45b60b
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x20], rdx
call fcn.00438500
lea rax, [0x006a4e8b]
mov ebx, 7
call fcn.00438e00
mov rax, qword [rsp + 0x28]
call fcn.00438c60
lea rax, [0x006a4fac]
mov ebx, 8
call fcn.00438e00
mov rax, qword [rsp + 0x20]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x230]
test rax, rax
jne 0x45b59d
lea rax, [0x006b41ef]
mov ebx, 0x2e
nop dword [rax]
call fcn.00436bc0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.00438500
lea rax, [0x006a8436]
mov ebx, 0x11
call fcn.00438e00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438c60
lea rax, [0x006a6e7e]
mov ebx, 0xe
nop dword [rax]
call fcn.00438e00
mov rax, qword [rsp + 0x28]
call fcn.00438c60
lea rax, [0x006a42b9]
mov ebx, 3
nop dword [rax + rax]
call fcn.00438e00
mov rax, qword [rsp + 0x20]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
lea rax, [0x006af9b6]
mov ebx, 0x21
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0045b420
Function at 0x45b6e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b8bb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp ebx, 0xffffffff
je 0x45b706
lea rcx, [0x0086af80]
jmp 0x45b720
lea rax, [0x0040b4e0]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x230]
nop
test rcx, rcx
je 0x45b739
cmp qword [rcx + 0x128], rax
ja 0x45b717
cmp qword [rcx + 0x130], rax
jbe 0x45b717
jmp 0x45b740
xor ecx, ecx
nop dword [rax + rax]
test rcx, rcx
jne 0x45b811
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x58], ebx
nop
nop
nop
lea rax, [0x0089e360]
nop dword [rax]
call fcn.0040b7a0
mov rbx, qword [0x0089e370]
lea rax, [0x006630e0]
mov ecx, dword [rsp + 0x58]
call fcn.00410a20
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x0089e360]
call fcn.0040b9c0
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x45b807
nop dword [rax]
call fcn.00438500
lea rax, [0x006a8425]
mov ebx, 0x11
call fcn.00438e00
mov eax, dword [rsp + 0x58]
movsxd rax, eax
nop dword [rax]
call fcn.00438c60
lea rax, [0x006a48f6]
mov ebx, 6
call fcn.00438e00
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00438c60
lea rax, [0x006a78ec]
mov ebx, 0x10
call fcn.00438e00
call fcn.00438580
lea rax, [0x0086af80]
jmp 0x45b8a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rcx
call fcn.00451040
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x20], rdx
call fcn.00438500
lea rax, [0x006a4e8b]
mov ebx, 7
call fcn.00438e00
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438c60
lea rax, [0x006a4fac]
mov ebx, 8
call fcn.00438e00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x230]
nop dword [rax + rax]
test rax, rax
jne 0x45b823
lea rax, [0x006b41c1]
mov ebx, 0x2e
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0045b6e0
Function at 0x45f0e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f277
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
lea rax, [0x008f2ce0]
call fcn.004308c0
mov qword [rsp + 0x18], rax
test byte [rax], al
lea rcx, [rax + 0x28]
mov qword [rsp + 0x20], rcx
nop
mov rax, rcx
nop dword [rax]
call fcn.0040b7a0
nop
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x20]
test rdx, rdx
je 0x45f13e
cmp rdx, 1
jne 0x45f265
nop
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x45f152
cmp rdx, 1
jne 0x45f252
mov rdx, qword [rsp + 0x38]
mov qword [rcx + 8], rdx
mov byte [rcx + 0x30], 0
nop
nop
mov ebx, dword [rcx + 0x10]
jmp 0x45f16a
nop
mov ebx, dword [rcx + 0x10]
bt ebx, 1
jae 0x45f182
mov eax, ebx
xor ebx, 2
lock cmpxchg dword [rcx + 0x10], ebx
sete bl
xor ebx, 1
jmp 0x45f184
xor ebx, ebx
test bl, bl
jne 0x45f166
inc qword [rcx + 0x38]
nop
xor ebx, ebx
xchg qword [rcx + 0x18], rbx
mov qword [rcx + 0x88], 0
inc qword [rcx + 0x90]
nop
xor ebx, ebx
xchg qword [rcx + 0x20], rbx
mov qword [rcx + 0xe0], 0
mov qword [rcx + 0xe8], rcx
nop
movzx ebx, byte [rcx + 0x30]
nop
mov rsi, qword [rcx + 0x88]
mov edi, dword [rcx + 0x10]
mov r8d, ebx
or ebx, 4
test rsi, rsi
cmovl r8d, ebx
jmp 0x45f1e1
nop
mov edi, dword [rcx + 0x10]
mov eax, edi
and edi, 2
or edi, r8d
lock cmpxchg dword [rcx + 0x10], edi
sete bl
test bl, bl
je 0x45f1dd
nop
nop
mov rax, qword [rsp + 0x20]
nop dword [rax]
call fcn.0040b9c0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x18]
call fcn.00430a80
test eax, eax
je 0x45f241
mov dword [rsp + 0x14], eax
lea rax, [0x008f2ce0]
mov rbx, qword [rsp + 0x18]
call fcn.00430140
mov ecx, dword [rsp + 0x14]
movsxd rbx, ecx
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov rax, qword [rsp + 0x18]
xor ebx, ebx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006b1ac2]
mov ebx, 0x26
nop
call fcn.00436bc0
lea rax, [0x006b1f46]
mov ebx, 0x27
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.0045f0e0

Function at 0x45f2a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f32b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [rax + 0x30], 0
je 0x45f319
nop
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x45f2ce
cmp rcx, 1
jne 0x45f308
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x45f2de
cmp rcx, 1
jne 0x45f2f7
mov rbx, rax
lea rax, [0x008f2ce0]
call fcn.00430140
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006b2b08]
mov ebx, 0x29
call fcn.00436bc0
lea rax, [0x006b2f43]
mov ebx, 0x2a
call fcn.00436bc0
lea rax, [0x006b0729]
mov ebx, 0x23
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.0045f2a0
Function at 0x45fc00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45fe2d
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
test byte [rax], al
lea rcx, [rax + 0x28]
mov qword [rsp + 0x28], rcx
nop
mov rax, rcx
call fcn.0040b7a0
mov rcx, qword [rsp + 0x40]
cmp byte [rcx + 0x30], 0
nop word [rax + rax]
jne 0x45fe1b
mov byte [rcx + 0x30], 1
inc qword [rcx + 0x38]
inc qword [rcx + 0x90]
nop
movzx edx, byte [rcx + 0x30]
nop
mov rbx, qword [rcx + 0x88]
mov rsi, qword [rcx + 0xe0]
mov edi, dword [rcx + 0x10]
mov r8d, edx
or edx, 4
test rbx, rbx
cmovl r8d, edx
mov edx, r8d
or r8d, 8
test rsi, rsi
cmovl edx, r8d
jmp 0x45fc8d
nop
mov edi, dword [rcx + 0x10]
mov eax, edi
and edi, 2
or edi, edx
lock cmpxchg dword [rcx + 0x10], edi
sete bl
nop dword [rax]
test bl, bl
je 0x45fc89
nop
mov rax, qword [rcx + 0x18]
cmp rax, 1
je 0x45fcdd
test rax, rax
je 0x45fcd7
mov qword [rsp + 0x10], rax
xor edx, edx
lock cmpxchg qword [rcx + 0x18], rdx
sete bl
test bl, bl
je 0x45fca4
mov rbx, qword [rsp + 0x10]
cmp rbx, 2
cmove rbx, rdx
jmp 0x45fce1
xor edx, edx
xor ebx, ebx
jmp 0x45fce1
xor edx, edx
xor ebx, ebx
nop
mov rax, qword [rcx + 0x20]
cmp rax, 1
je 0x45fd18
test rax, rax
je 0x45fd14
mov qword [rsp + 0x10], rax
lock cmpxchg qword [rcx + 0x20], rdx
sete sil
test sil, sil
je 0x45fce1
mov rsi, qword [rsp + 0x10]
cmp rsi, 2
cmove rsi, rdx
jmp 0x45fd1a
xor esi, esi
jmp 0x45fd1a
xor esi, esi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], rsi
cmp qword [rcx + 0x58], 0
je 0x45fd72
lea rax, [rcx + 0x40]
call fcn.00453140
cmp dword [0x008f2cf0], 0
jne 0x45fd4c
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x58], 0
jmp 0x45fd65
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 0x58]
mov rax, rdi
mov rdi, rcx
xor edx, edx
nop dword [rax]
call fcn.004655c0
mov rcx, rax
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
cmp qword [rcx + 0xb0], 0
je 0x45fdb6
lea rax, [rcx + 0x98]
call fcn.00453140
cmp dword [0x008f2cf0], 0
jne 0x45fda3
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0xb0], 0
jmp 0x45fdb6
mov rdi, qword [rsp + 0x40]
add rdi, 0xb0
xor ecx, ecx
call fcn.004655a0
nop
nop
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.0040b9c0
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x45fdeb
nop
nop
mov ecx, 0xffffffff
lea rdx, [0x008f28b8]
lock xadd dword [rdx], ecx
mov ebx, 4
call fcn.00439820
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x45fe11
nop
nop
mov ecx, 0xffffffff
lea rdx, [0x008f28b8]
lock xadd dword [rdx], ecx
mov ebx, 4
call fcn.00439820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006b0e45]
mov ebx, 0x24
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.0045fc00
Function at 0x45ff80
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x40]
nop dword [rax]
cmp qword [r14 + 0x70], rcx
jb 0x4601ec
mov qword [rsp + 0x10], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rax
mov qword [rcx + 0xb0], 0
call fcn.004413c0
test al, al
jne 0x460005
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], 0
cmp byte [0x008a4a30], 0
je 0x46012f
mov rax, qword [rsp + 0x18]
jmp 0x4601a9
cmp byte [0x00897804], 0
je 0x46004a
movups xmmword [rsp + 0x20], xmm15
lea rax, [0x00441380]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.004631a0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp byte [0x008a4a30], 0
je 0x4600a2
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x18]
cmp rsi, rdi
jne 0x460078
mov edx, dword [rdx + 0x26c]
cmp dword [rsi + 0x14], edx
je 0x4600a7
lea rax, fcn.00456880
mov qword [rsp], rax
call fcn.004631a0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
nop
jmp 0x4600a7
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
nop
call fcn.0043b080
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rdx, qword [rax + 0x30]
dec dword [rdx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x4600ef
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x4600fd
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x0089f320], 0
je 0x460125
mov ebx, 1
call fcn.0045aa80
test al, al
jne 0x460125
nop dword [rax + rax]
call fcn.00439640
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x006d48f8]
call fcn.00463120
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006d4b78]
mov qword [rsp], rax
nop dword [rax]
call fcn.004631a0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, rcx
mov rcx, qword [rsp + 0x10]
test rax, rax
je 0x4601bd
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rax + 0x14]
cmp dword [rdx + 0x26c], ebx
je 0x460171
nop dword [rax]
call fcn.00465320
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], rax
jmp 0x46012f
lea rax, [0x006b3a78]
mov ebx, 0x2d
call fcn.00436bc0
nop
int3
Function at 0x461120
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4611ab
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp rax, 0x20
jne 0x461148
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 0x20], rax
call fcn.00438500
lea rax, [0x006b0d49]
mov ebx, 0x24
nop
call fcn.00438e00
mov rax, qword [rsp + 0x20]
call fcn.00438b00
lea rax, [0x006a54b0]
mov ebx, 9
nop dword [rax + rax]
call fcn.00438e00
mov eax, 0x20
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006a8f66]
mov ebx, 0x13
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.00461120
Function at 0x461ee0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
cmp rcx, 4
jge 0x461f70
lea rdx, [rsp + 0x38]
cmp rbx, rdx
je 0x461f64
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
shl rcx, 3
mov rax, rdx
call fcn.004662e0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov edx, 4
lea rbx, [rsp + 0x38]
jmp 0x461f7d
cmp rcx, 0x2a
jg 0x46203f
mov rdx, rcx
mov rsi, qword [r14 + 0x30]
nop
inc dword [rsi + 0x23c]
mov rsi, qword [r14 + 0x30]
nop
mov rdi, r14
mov qword [rsi + 0x130], rdi
mov rsi, qword [r14 + 0x30]
mov qword [r14 + 0xe8], rsi
lea rsi, fcn.00442880
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x1f], 1
mov rsi, qword [r14 + 0x30]
mov qword [rsi + 0x2c0], rax
mov qword [rsi + 0x2c8], rcx
test rdx, rdx
jbe 0x462035
mov qword [rsp + 0x58], rsi
mov qword [rsi + 0x2d0], rbx
lea rbx, [rsi + 0x2c0]
mov rax, qword [0x0089c950]
call fcn.00404520
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x2d8]
mov rsi, qword [rcx + 0x2e0]
mov rcx, qword [rcx + 0x2e8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
call fcn.00442880
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
mov rcx, rax
call fcn.00465940
lea rax, [0x006576e0]
lea rbx, [0x00718bc0]
call fcn.00436420
nop
call fcn.004358c0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
Function at 0x465380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40348f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409de0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403460
cmp byte [0x008f2861], 0
je 0x465395
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x4623e0
jmp 0x403460

Function at 0x4653a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x008f2dc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x008f2861], 0
je 0x4653d5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x008f3140]
aesenc xmm0, xmmword [0x008f3150]
aesenc xmm0, xmmword [0x008f3160]
movq rax, xmm0
ret
jmp 0x409fe0

Function at 0x4653e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x008f2dc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x008f2861], 0
je 0x465416
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x008f3140]
aesenc xmm0, xmmword [0x008f3150]
aesenc xmm0, xmmword [0x008f3160]
movq rax, xmm0
ret
jmp 0x40a040

Function at 0x466e20
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x008f30c0]
mov qword [rsp + 8], rdx
lea r8d, [0x008f2884]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.004652c0
add rsp, 0x30
ret

Function at 0x467360
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x467390
mov rcx, 0x28
jmp 0x46739b
shl rcx, 3
add rcx, 0x1480
mov qword [0x008f2a80], rcx
ret
Function at 0x467920
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4322d4
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
cmp dword [0x008f2cf0], 0
nop
jne 0x432192
lea rdx, [0x00466da0]
mov qword [0x0089c950], rdx
jmp 0x4321a5
lea rdi, [0x0089c950]
lea rdx, [0x00466da0]
call fcn.004655c0
xor eax, eax
jmp 0x4321c0
lea r8, [0x008f30c0]
mov byte [r8 + rax], sil
inc dword [0x008f2884]
mov rax, rdi
nop dword [rax]
cmp rax, 0x36
jge 0x432210
lea rdx, [0x006b6013]
movzx esi, byte [rdx + rax]
cmp esi, 0x80
jge 0x4321df
lea rdi, [rax + 1]
jmp 0x432205
mov qword [rsp + 0x20], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
call fcn.0045d080
lea rdx, [0x006b6013]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x20]
cmp rax, 0x64
jb 0x4321a9
jmp 0x4322c9
call fcn.00431380
call fcn.00449ba0
call fcn.00449c40
nop
call fcn.00431e00
xor eax, eax
call fcn.00431d40
mov dword [0x008f28d0], eax
call fcn.00431ec0
call fcn.00431c20
mov dword [0x008f28b0], eax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [sym.imp.kernel32.dll_GetSystemInfo]
lea rcx, [rsp + 0x28]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433cc0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x2c]
mov qword [0x008f2a08], rax
mov rax, qword [sym.imp.kernel32.dll_SetProcessPriorityBoost]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 1
call fcn.00433d40
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov ecx, 0x64
call fcn.00465940
nop
call fcn.004632e0
jmp 0x432160
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x432160
Function at 0x467d60
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x006b5225]
mov ebx, 0x32
call fcn.00436bc0
nop
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x461220

Function at 0x46b1a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b299
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x46b285
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
test rcx, rcx
je 0x46b1e7
lea rdx, [0x008f2868]
nop
cmp rcx, rdx
je 0x46b1d0
jmp 0x46b217
call fcn.00460240
mov rax, qword [rsp + 0x28]
xor ebx, ebx
lea rcx, [0x008f2868]
call fcn.0045e880
nop
test al, al
jne 0x46b236
call fcn.00460260
mov rax, qword [rsp + 0x28]
lea rdx, [0x008f2868]
jmp 0x46b1d0
cmp qword [rsp + 0x30], rcx
jne 0x46b26f
add rax, 8
mov rbx, qword [rsp + 0x38]
call fcn.0045e7c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 8]
mov rbx, qword [rsp + 0x38]
mov rax, rcx
call fcn.0045e7c0
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
call fcn.0045e7c0
nop dword [rax + rax]
call fcn.00460260
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006576e0]
lea rbx, [0x00718db0]
nop dword [rax]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718da0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.0046b1a0