joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ae390
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x5ae511
sub esp, 0x84
mov dword [esp + 0x80], 0
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x80], ecx
xor eax, eax
jmp 0x5ae3d7
mov ecx, dword [esp + 0x8c]
mov eax, 1
test eax, eax
jg 0x5ae460
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x6c], ecx
lea edi, [esp + 0x38]
xor eax, eax
call fcn.004690f6
mov ecx, dword [esp + 0x6c]
test byte [ecx], al
mov dword [esp], ecx
lea edx, [esp + 0x38]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x28
call fcn.004034e0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x5ae3cb
mov ecx, dword [esp + 0x6c]
add ecx, 0x28
mov dword [esp + 0x7c], ecx
lea edi, [esp + 0x10]
xor eax, eax
call fcn.004690f6
mov ecx, dword [esp + 0x7c]
mov dword [esp], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x28
call fcn.004034e0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x5ae3cb
jmp 0x5ae4f8
mov eax, dword [esp + 0x88]
test byte [eax], al
test byte [ecx], al
lea edx, [eax + 0x28]
mov dword [esp + 0x68], edx
lea ebx, [ecx + 0x28]
mov dword [esp + 0x78], ebx
lea ebp, [eax + 0x50]
mov dword [esp + 0x64], ebp
lea esi, [ecx + 0x50]
mov dword [esp + 0x74], esi
lea edi, [eax + 0x78]
mov dword [esp + 0x60], edi
lea edi, [ecx + 0x78]
mov dword [esp + 0x70], edi
mov edi, dword [0x966df0]
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], ecx
call fcn.00589740
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0x78]
call fcn.004695ac
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x74]
call fcn.004695ac
mov eax, dword [0x966df0]
mov ecx, dword [esp + 0x60]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
call fcn.00589740
mov eax, dword [esp + 0x88]
mov dword [esp + 0x90], eax
add esp, 0x84
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b09d0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005ae390
Function at 0x5ae9e0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5aeb5a
sub esp, 0x40
mov eax, dword [esp + 0x4c]
cmp eax, 0x40
je 0x5aea3b
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x32
lea ecx, [0x74e413]
mov dword [eax], ecx
mov dword [esp + 0x54], 0
lea ecx, [0x7b0bb8]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
add esp, 0x40
ret
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x15
mov edx, dword [esp + 0x50]
mov dword [esp + 0xc], edx
call fcn.005aeb70
lea edi, [esp + 0x18]
xor eax, eax
call fcn.004690f8
lea eax, [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x50]
lea ecx, [eax - 0x15]
mov edx, dword [esp + 0x48]
lea ebx, [edx + 0x15]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x15
mov dword [esp + 0xc], ecx
call fcn.005aeb70
mov eax, dword [esp + 0x10]
mov dword [esp + 0x38], eax
test byte [eax], al
mov ecx, dword [0x966de8]
test byte [ecx], al
mov edx, dword [esp + 0x48]
add edx, 0x2a
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x50]
add ebx, 0xffffffd6
mov dword [esp + 0x14], ebx
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.005af480
mov eax, dword [esp + 0x44]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x38]
mov dword [esp + 8], ecx
call fcn.005b1840
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x16
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
call fcn.005aeb70
mov eax, dword [0x966dec]
test byte [eax], al
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.005af480
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x38]
mov dword [esp + 8], ecx
call fcn.005b1840
mov eax, dword [esp + 0x44]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
add esp, 0x40
ret
call fcn.00467a60
jmp fcn.005ae9e0

Function at 0x5aeb70
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5aec06
sub esp, 0x2c
mov ecx, dword [esp + 0x38]
cmp ecx, 0x20
jge 0x5aebed
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004690f8
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0xc]
cmp ecx, edx
je 0x5aebbb
mov dword [esp], edx
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
call fcn.004697f0
mov eax, dword [esp + 0x30]
test byte [eax], al
mov dword [esp], eax
lea ecx, [esp + 0xc]
mov dword [esp + 4], ecx
call fcn.005b4ec0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], eax
call fcn.005b2c40
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
add esp, 0x2c
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b09d8]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005aeb70
Function at 0x5aed30
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5aee19
sub esp, 0x5c
mov ecx, dword [esp + 0x68]
cmp ecx, 0x20
jne 0x5aedde
lea edi, [esp + 0x1c]
xor eax, eax
call fcn.004690f0
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x5aed7f
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
call fcn.004697f0
movzx eax, byte [esp + 0x1c]
and eax, 0xfffffff8
mov byte [esp + 0x1c], al
movzx eax, byte [esp + 0x3b]
and eax, 0x3f
mov byte [esp + 0x3b], al
or eax, 0x40
mov byte [esp + 0x3b], al
mov eax, dword [esp + 0x60]
mov dword [esp], eax
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], 0x40
call fcn.005ae9e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x5c
ret
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x37
lea ecx, [0x74f754]
mov dword [eax], ecx
mov dword [esp + 0x70], 0
lea ecx, [0x7b0bb8]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
add esp, 0x5c
ret
call fcn.00467a60
jmp fcn.005aed30
Function at 0x5b68b0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0xfc]
cmp eax, dword [ecx + 8]
jbe 0x5b6adb
sub esp, 0x17c
mov eax, dword [esp + 0x190]
cmp eax, 0x20
jne 0x5b6a79
mov ecx, dword [esp + 0x18c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 8], eax
call fcn.00598410
lea edi, [esp + 0x90]
lea esi, [esp + 0xc]
call fcn.00469570
lea edi, [esp + 0x70]
xor eax, eax
call fcn.004690f8
lea ecx, [esp + 0x70]
mov dword [esp], ecx
lea ecx, [esp + 0x90]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x20
mov dword [esp + 0xc], 0x40
call fcn.005aed30
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x5b6a61
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x174], ecx
lea edi, [esp + 0xd0]
xor eax, eax
call fcn.004690d8
lea ecx, [esp + 0xd0]
mov dword [esp], ecx
mov ecx, dword [esp + 0x174]
mov dword [esp + 4], ecx
call fcn.005b5230
mov ecx, dword [esp + 8]
mov dword [esp + 0x178], ecx
nop
lea edi, [esp + 0x50]
xor eax, eax
call fcn.004690f8
mov ecx, dword [esp + 0x178]
mov dword [esp], ecx
lea ecx, [esp + 0x50]
mov dword [esp + 4], ecx
call fcn.005acd10
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x184]
cmp ebx, 0x20
jle 0x5b69c9
mov eax, 0x20
jmp 0x5b69cb
mov eax, ebx
mov ebp, dword [esp + 0x18c]
mov esi, dword [esp + 0x180]
cmp ebp, esi
je 0x5b6a18
mov dword [esp + 0x170], ecx
mov dword [esp + 0x4c], edx
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.004697f0
mov ecx, dword [esp + 0x184]
cmp ecx, 0x20
mov edx, dword [esp + 0x4c]
mov ebx, ecx
mov esi, dword [esp + 0x180]
mov ecx, dword [esp + 0x170]
jmp 0x5b6a1b
cmp ebx, 0x20
jb 0x5b6a55
lea eax, [ebx - 0x20]
mov ebx, dword [esp + 0x188]
add ebx, 0xffffffe0
neg ebx
sar ebx, 0x1f
and ebx, 0x20
add ebx, esi
cmp edx, eax
jl 0x5b6a3a
mov edx, eax
cmp ecx, ebx
je 0x5b6a4e
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.004697f0
add esp, 0x17c
ret
mov eax, 0x20
mov ecx, ebx
call fcn.00468f30
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b08d8]
mov dword [esp + 4], eax
call fcn.00438b10
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0xa
call fcn.004ab6e0
mov dword [esp], 0
lea eax, [0x7439e8]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.00452120
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005b68b0
Function at 0x5ba4f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ba68b
sub esp, 0x30
lea eax, [0x6efb40]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x5ba52f
mov ecx, ebp
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x38]
cmp ebp, ecx
jle 0x5ba65d
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x48]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x44]
mov dword [esp], esi
call ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x1c]
xor esi, esi
jmp 0x5ba677
mov eax, dword [esp + 0x2c]
movzx esi, byte [eax + 3]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 3], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5ba525
movzx esi, byte [eax + 2]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 2], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5ba525
movzx esi, byte [eax + 1]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 1], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5ba525
movzx esi, byte [eax]
inc esi
xchg esi, ebx
mov byte [eax], bl
xchg esi, ebx
jmp 0x5ba525
add esp, 0x30
ret
movzx edi, byte [ebp + ecx]
movzx edx, byte [edx + esi]
xor edi, edx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edx, dword [esp + 0x28]
cmp esi, eax
jge 0x5ba5ff
cmp ebx, ebp
jle 0x5ba5ff
ja 0x5ba661
mov eax, ebp
mov ecx, ebx
call fcn.00468ed0
nop
call fcn.00467a60
jmp fcn.005ba4f0
Function at 0x5c0ec0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c1031
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5c0ef1
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5c0ef1
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5c0ef7
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5c0f05
cmp ecx, 4
jne 0x5c0f36
cmp al, 0x2c
ja 0x5c0f1e
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5c0f30
cmp al, 0x24
je 0x5c0f30
cmp al, 0x26
jae 0x5c0f30
jmp 0x5c0f36
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5c0f30
cmp al, 0x5b
je 0x5c0f30
cmp al, 0x5d
jne 0x5c0f36
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5c0f6d
cmp al, 0x26
ja 0x5c0f4f
cmp al, 0x24
je 0x5c0f8c
cmp al, 0x26
je 0x5c0f8c
jmp 0x5c1013
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5c0f8c
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5c100d
cmp al, 0x2f
je 0x5c0f8c
jmp 0x5c1013
cmp al, 0x3d
ja 0x5c0f84
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5c0f8c
cmp al, 0x3d
je 0x5c0f8c
jmp 0x5c1013
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5c1003
cmp ecx, 2
jg 0x5c0fc7
cmp ecx, 1
je 0x5c0fbc
cmp ecx, 2
jne 0x5c1013
cmp al, 0x2f
je 0x5c0faa
cmp al, 0x3b
je 0x5c0faa
cmp al, 0x2c
jne 0x5c0fb1
mov eax, 1
jmp 0x5c0fb7
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5c0fed
cmp al, 0x40
je 0x5c0fdb
cmp al, 0x2f
je 0x5c0fdb
cmp al, 0x3f
jne 0x5c0fe2
mov eax, 1
jmp 0x5c0fe8
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5c0ffd
cmp ecx, 7
jne 0x5c1013
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5c100d
cmp al, 0x7e
jne 0x5c1013
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5c102b
cmp al, 0x21
je 0x5c1025
add eax, 0xffffffd8
cmp al, 2
ja 0x5c102b
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.00467a60
jmp fcn.005c0ec0
Function at 0x5ca560
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ca711
sub esp, 0x38
lea edi, [esp + 0x48]
xor eax, eax
call fcn.004690f9
lea edi, [esp + 0x1c]
call fcn.004690f9
lea ecx, [esp + 0x3c]
mov dword [esp], ecx
lea edx, [esp + 0x1c]
mov dword [esp + 4], edx
call fcn.005a5120
movzx ecx, byte [esp + 8]
test cl, cl
je 0x5ca6d1
mov eax, dword [esp + 0x40]
test eax, eax
je 0x5ca5de
mov eax, dword [esp + 0x3c]
cmp byte [eax], 1
jne 0x5ca5de
lea eax, [esp + 0x3c]
mov dword [esp], eax
lea ecx, [esp + 0x28]
mov dword [esp + 4], ecx
call fcn.005a4390
movzx eax, byte [esp + 8]
test al, al
je 0x5ca691
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
lea eax, [esp + 0x3c]
mov dword [esp], eax
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 4
call fcn.005a58a0
movzx eax, byte [esp + 0xc]
test al, al
je 0x5ca651
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
lea edi, [esp + 0x48]
lea esi, [esp + 0x1c]
call fcn.004695ca
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
add esp, 0x38
ret
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x25
lea ecx, [0x7493c2]
mov dword [eax], ecx
lea edi, [esp + 0x48]
lea esi, [esp + 0x1c]
call fcn.004695ca
lea ecx, [0x7b0bb8]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], eax
add esp, 0x38
ret
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x28
lea ecx, [0x74aaef]
mov dword [eax], ecx
lea edi, [esp + 0x48]
lea esi, [esp + 0x1c]
call fcn.004695ca
lea ecx, [0x7b0bb8]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], eax
add esp, 0x38
ret
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x23
lea ecx, [0x7483c0]
mov dword [eax], ecx
lea edi, [esp + 0x48]
lea esi, [esp + 0x1c]
call fcn.004695ca
lea ecx, [0x7b0bb8]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], eax
add esp, 0x38
ret
call fcn.00467a60
jmp fcn.005ca560
Function at 0x5cb6d0
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5cb820
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.005a58a0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5cb738
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x74a2da]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5cb80c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.005a5ef0
movzx eax, byte [esp + 0x10]
test al, al
je 0x5cb7d9
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5cb738
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x28
ret
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x749b70]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.00467a60
jmp fcn.005cb6d0
Function at 0x5d4110
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d42c9
sub esp, 0x50
mov eax, dword [esp + 0x58]
test eax, eax
je 0x5d42b2
mov eax, dword [esp + 0x60]
mov ecx, dword [eax + 0x13c]
mov edx, dword [eax + 0x138]
test ecx, ecx
jne 0x5d41f5
mov ecx, dword [eax + 0xec]
test ecx, ecx
je 0x5d4165
mov eax, dword [eax + 0xe8]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x5d41f7
mov eax, dword [eax + 0x5c]
test eax, eax
jne 0x5d4179
mov ecx, 5
lea eax, [0x73aa67]
jmp 0x5d41c5
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov ebx, dword [eax + 0xc]
movzx eax, byte [eax]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov byte [esp + 0xc], al
mov dword [esp + 0x10], 0xa
call fcn.004f76c0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.004523c0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp], 0
lea edx, [0x73b206]
mov dword [esp + 4], edx
mov dword [esp + 8], 7
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.00452120
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
jmp 0x5d41f7
mov eax, edx
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov edx, dword [esp + 0x58]
test edx, edx
je 0x5d4222
mov edx, dword [edx + 4]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x44], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
lea eax, [0x752284]
mov dword [esp], eax
mov dword [esp + 4], 0x53
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004c4b20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
lea edx, [0x74c878]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.00452120
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
jmp 0x5d42bd
mov ecx, 0x2d
lea eax, [0x74c878]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
add esp, 0x50
ret
call fcn.00467a60
jmp fcn.005d4110
Function at 0x5d4ca0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d4e4a
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov ecx, dword [esp + 0x44]
mov dword [esp + 4], ecx
lea edx, [0x7aead8]
mov dword [esp + 8], edx
mov dword [esp + 0xc], 1
call fcn.004d0c90
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x5d4e09
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov ecx, dword [esp + 0x44]
mov dword [esp + 4], ecx
call fcn.005d43b0
movzx eax, byte [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
test al, al
je 0x5d4d8c
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x34]
cmp ebx, eax
je 0x5d4d1e
xor eax, eax
jmp 0x5d4d74
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
call fcn.004034e0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5d4d4b
xor eax, eax
jmp 0x5d4d74
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
call fcn.004d0a40
movzx eax, byte [esp + 0x10]
mov byte [esp + 0x48], al
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
add esp, 0x2c
ret
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea eax, [0x74d8b6]
mov dword [esp], eax
mov dword [esp + 4], 0x30
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c1f50
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x2c
ret
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], eax
call fcn.005d5180
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov byte [esp + 0x48], al
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], edx
add esp, 0x2c
ret
call fcn.00467a60
jmp fcn.005d4ca0