joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55ff60
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x560134
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rax, qword [rsp + 0x88]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x18], rdx
lea rdx, [0x0065b6fa]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0xa
call fcn.00540160
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0053f9e0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
test rcx, rcx
jne 0x560051
cmp word [rax + 0x20], 1
jne 0x56004b
lea rax, [0x00609080]
nop dword [rax]
cmp rax, rsi
jne 0x560119
mov rax, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rcx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
xor ecx, ecx
xor eax, eax
jmp 0x560031
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rdx
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x90]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x50]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x00664512]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
lea rax, [rsp + 0x68]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 1
mov qword [rsp + 0x20], 1
nop
call fcn.004e4700
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
jmp 0x56000b
mov qword [rsp], rsi
mov qword [rsp + 8], rax
lea rax, [0x0061a280]
mov qword [rsp + 0x10], rax
call fcn.0040b2a0
nop
call fcn.0046abe0
jmp fcn.0055ff60
Function at 0x5644c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5645fa
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [0x007cb640]
cmp qword [rax + 0x38], 0
jne 0x5645c8
xor eax, eax
xor ecx, ecx
mov rdx, qword [0x007cb640]
cmp qword [rdx + 0x68], 0
jne 0x564596
mov rdx, qword [0x007cb640]
mov rbx, qword [rdx + 0x48]
mov rdx, qword [rdx + 0x40]
nop
test rbx, rbx
jne 0x564539
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
call fcn.004f1f20
cmp qword [rsp + 0x10], 0
je 0x564565
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
jmp 0x564525
nop
lea rax, [0x00625ba0]
mov qword [rsp], rax
call fcn.0040e560
mov rcx, qword [rsp + 8]
mov qword [rcx + 8], 0x20
lea rax, [0x0066344e]
mov qword [rcx], rax
lea rax, [0x006a4760]
jmp 0x564525
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rax, qword [rax + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp], xmm0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.004fcd00
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
jmp 0x564510
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rax + 0x38]
xorps xmm0, xmm0
movups xmmword [rsp], xmm0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
call fcn.004fcd00
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
jmp 0x5644fe
call fcn.0046abe0
nop
jmp fcn.005644c0
Function at 0x56be40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x28]
cmp rax, qword [rcx + 0x10]
jbe 0x56bf6c
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0x48], 0
lea rdi, [rsp + 0x50]
xorps xmm0, xmm0
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046d055
mov rbp, qword [rbp]
mov rax, qword [rsp + 0xd0]
mov qword [rsp], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.0056c3e0
nop
cmp byte [rsp + 0x98], 0
jne 0x56bf4f
lea rax, [rsp + 0x48]
mov qword [rsp], rax
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x18], rcx
call fcn.0056c040
mov rax, qword [rsp + 0xb0]
test byte [rax], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rcx, [rsp + 0x48]
mov qword [rsp], rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 8], rcx
call fcn.0056c300
mov byte [rsp + 0x98], 1
movups xmm0, xmmword [rsp + 0x38]
mov rax, qword [rsp + 0xb0]
movups xmmword [rax], xmm0
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1360]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.0056be40

Function at 0x56c4a0
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x56c567
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x56c4cc
test r15, r15
je 0x56c5aa
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x56c57c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x56c4db
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x5712e0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x57136c
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
xorps xmm0, xmm0
movups xmmword [rax + 0xc0], xmm0
ret
cmp rcx, 0xe
jne 0x5713e6
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x571361
cmp rcx, 0xf
jne 0x571465
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
nop dword [rax + rax]
jmp 0x571361
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
jmp 0x571361
Function at 0x57ae00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x57b0ae
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
lea rax, [0x00646f80]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 0x38], 5
lea rcx, [0x0065a7bf]
mov qword [rax + 0x30], rcx
cmp dword [0x00811460], 0
jne 0x57b09d
mov qword [0x007cb698], rax
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669b5e]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x74
mov qword [rsp + 0x18], 0xa
nop dword [rax + rax]
call fcn.0051bd60
mov rdi, qword [0x007cb698]
test byte [rdi], al
mov rax, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop word [rax + rax]
jne 0x57b093
mov qword [rdi], rax
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669bd2]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x74
mov qword [rsp + 0x18], 0xa
call fcn.0051bd60
mov rax, qword [0x007cb698]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop word [rax + rax]
jne 0x57b085
mov qword [rax + 8], rcx
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669882]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x60
mov qword [rsp + 0x18], 0x10
call fcn.0051bd60
mov rax, qword [0x007cb698]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop dword [rax + rax]
jne 0x57b075
mov qword [rax + 0x10], rcx
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669822]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x60
mov qword [rsp + 0x18], 0x10
call fcn.0051bd60
mov rax, qword [0x007cb698]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop dword [rax + rax]
jne 0x57b067
mov qword [rax + 0x18], rcx
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x006697c2]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x60
mov qword [rsp + 0x18], 0x10
call fcn.0051bd60
mov rax, qword [0x007cb698]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
jne 0x57b05a
mov qword [rax + 0x20], rcx
mov rax, qword [0x007cb698]
mov qword [rax + 0x28], 0x180
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rdi, [rax + 0x20]
nop
call fcn.0046ca20
jmp 0x57b041
lea rdi, [rax + 0x18]
call fcn.0046ca20
jmp 0x57afea
lea rdi, [rax + 0x10]
call fcn.0046ca20
nop
jmp 0x57af8a
lea rdi, [rax + 8]
call fcn.0046ca20
jmp 0x57af2a
call fcn.0046c920
jmp 0x57aec9
lea rdi, [0x007cb698]
call fcn.0046c920
jmp 0x57ae64
call fcn.0046abe0
jmp fcn.0057ae00
Function at 0x57b0c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x57b36e
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
lea rax, [0x00646f80]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 0x38], 5
lea rcx, [0x0065a7c4]
mov qword [rax + 0x30], rcx
cmp dword [0x00811460], 0
jne 0x57b35d
mov qword [0x007cb6a0], rax
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669dce]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x9d
mov qword [rsp + 0x18], 0xa
nop dword [rax + rax]
call fcn.0051bd60
mov rdi, qword [0x007cb6a0]
test byte [rdi], al
mov rax, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop word [rax + rax]
jne 0x57b353
mov qword [rdi], rax
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669e6b]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x9d
mov qword [rsp + 0x18], 0xa
call fcn.0051bd60
mov rax, qword [0x007cb6a0]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop word [rax + rax]
jne 0x57b345
mov qword [rax + 8], rcx
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669cc8]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x83
mov qword [rsp + 0x18], 0x10
call fcn.0051bd60
mov rax, qword [0x007cb6a0]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop dword [rax + rax]
jne 0x57b335
mov qword [rax + 0x10], rcx
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669c46]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x82
mov qword [rsp + 0x18], 0x10
call fcn.0051bd60
mov rax, qword [0x007cb6a0]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop dword [rax + rax]
jne 0x57b327
mov qword [rax + 0x18], rcx
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669d4b]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x83
mov qword [rsp + 0x18], 0x10
call fcn.0051bd60
mov rax, qword [0x007cb6a0]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
jne 0x57b31a
mov qword [rax + 0x20], rcx
mov rax, qword [0x007cb6a0]
mov qword [rax + 0x28], 0x209
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rdi, [rax + 0x20]
nop
call fcn.0046ca20
jmp 0x57b301
lea rdi, [rax + 0x18]
call fcn.0046ca20
jmp 0x57b2aa
lea rdi, [rax + 0x10]
call fcn.0046ca20
nop
jmp 0x57b24a
lea rdi, [rax + 8]
call fcn.0046ca20
jmp 0x57b1ea
call fcn.0046c920
jmp 0x57b189
lea rdi, [0x007cb6a0]
call fcn.0046c920
jmp 0x57b124
call fcn.0046abe0
jmp fcn.0057b0c0
Function at 0x57e7a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x57ea4e
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
lea rax, [0x00646f80]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 0x38], 5
lea rcx, [0x0065a7ba]
mov qword [rax + 0x30], rcx
cmp dword [0x00811460], 0
jne 0x57ea3d
mov qword [0x007cb688], rax
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669361]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x4e
mov qword [rsp + 0x18], 0xa
nop dword [rax + rax]
call fcn.0051bd60
mov rdi, qword [0x007cb688]
test byte [rdi], al
mov rax, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop word [rax + rax]
jne 0x57ea33
mov qword [rdi], rax
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00669313]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x4e
mov qword [rsp + 0x18], 0xa
call fcn.0051bd60
mov rax, qword [0x007cb688]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop word [rax + rax]
jne 0x57ea25
mov qword [rax + 8], rcx
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00668ea8]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x10
call fcn.0051bd60
mov rax, qword [0x007cb688]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop dword [rax + rax]
jne 0x57ea15
mov qword [rax + 0x10], rcx
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00668ee8]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x10
call fcn.0051bd60
mov rax, qword [0x007cb688]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop dword [rax + rax]
jne 0x57ea07
mov qword [rax + 0x18], rcx
lea rax, [0x0062df20]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp], rax
lea rax, [0x00668e68]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x10
call fcn.0051bd60
mov rax, qword [0x007cb688]
test byte [rax], al
mov rcx, qword [rsp + 0x20]
cmp dword [0x00811460], 0
jne 0x57e9fa
mov qword [rax + 0x20], rcx
mov rax, qword [0x007cb688]
mov qword [rax + 0x28], 0x100
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rdi, [rax + 0x20]
nop
call fcn.0046ca20
jmp 0x57e9e1
lea rdi, [rax + 0x18]
call fcn.0046ca20
jmp 0x57e98a
lea rdi, [rax + 0x10]
call fcn.0046ca20
nop
jmp 0x57e92a
lea rdi, [rax + 8]
call fcn.0046ca20
jmp 0x57e8ca
call fcn.0046c920
jmp 0x57e869
lea rdi, [0x007cb688]
call fcn.0046c920
jmp 0x57e804
call fcn.0046abe0
jmp fcn.0057e7a0
Function at 0x583680
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x5836cd
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x583760
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x5837a5
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x586840
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5869ec
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x5869bd
nop word [rax + rax]
nop
cmp rcx, 1
jne 0x586961
xor eax, eax
xor edx, edx
test rax, rax
jne 0x586944
cmp rcx, 8
jg 0x586902
mov rbx, qword [rsp + 0x28]
xor esi, esi
xor edi, edi
jmp 0x5868c0
lea r8, [rsi + 1]
shl rdi, 8
movzx r9d, byte [rbx + rsi]
or rdi, r9
mov rsi, r8
nop dword [rax + rax]
cmp rcx, rsi
jg 0x5868a8
shl ecx, 3
lea ebx, [rcx - 0x40]
neg ebx
cmp bl, 0x40
sbb rsi, rsi
sbb r8d, r8d
neg ecx
shl rdi, cl
and rdi, rsi
not r8d
or ebx, r8d
mov ecx, ebx
sar rdi, cl
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0065d843]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0040b600
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x40], 0
lea rcx, [0x006a4c20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x28]
movzx edx, byte [rax]
test dl, dl
jne 0x586976
movzx ebx, byte [rax + 1]
test bl, 0x80
je 0x58698e
cmp dl, 0xff
jne 0x586985
movzx edx, byte [rax + 1]
nop
test dl, 0x80
jne 0x58698e
xor eax, eax
xor edx, edx
jmp 0x58688e
lea rax, [0x006624de]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0040b600
mov rdx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
lea rax, [0x006a4c20]
jmp 0x58688e
lea rax, [0x0065c5a5]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0040b600
mov rdx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
lea rax, [0x006a4c20]
jmp 0x58688e
call fcn.0046abe0
jmp fcn.00586840
Function at 0x586a00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x586bac
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x586b7d
nop word [rax + rax]
nop
cmp rax, 1
jne 0x586b22
xor ecx, ecx
xor edx, edx
test rcx, rcx
jne 0x586b06
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x10], rax
call fcn.00586840
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
cmp qword [rsp + 0x20], 0
jne 0x586aea
movsxd rcx, eax
cmp rax, rcx
je 0x586ad4
lea rax, [0x0065d843]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0040b600
mov rax, qword [rsp + 0x10]
mov dword [rsp + 0x58], 0
lea rcx, [0x006a4c20]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov dword [rsp + 0x58], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x40]
movzx edx, byte [rcx]
test dl, dl
jne 0x586b66
movzx ebx, byte [rcx + 1]
test bl, 0x80
jne 0x586b66
lea rax, [0x006624de]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0040b600
mov rdx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x48]
lea rcx, [0x006a4c20]
jmp 0x586a4e
cmp dl, 0xff
jne 0x586b74
movzx edx, byte [rcx + 1]
test dl, 0x80
jne 0x586b37
xor ecx, ecx
xor edx, edx
jmp 0x586a4e
lea rax, [0x0065c5a5]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0040b600
mov rdx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x48]
lea rcx, [0x006a4c20]
jmp 0x586a4e
call fcn.0046abe0
jmp fcn.00586a00