joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4214c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421577
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x00509f56]
mov ebx, 0xa
call fcn.00407b60
test rbx, rbx
je 0x421502
cmp rbx, 3
jne 0x421516
cmp word [rax], 0x666f
jne 0x421516
cmp byte [rax + 2], 0x66
nop
jne 0x421516
movabs rax, 0x7fffffffffffffff
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f2c0
test bl, bl
je 0x421533
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00438680
lea rax, [0x0050a263]
mov ebx, 0xb
call fcn.00438f80
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
call fcn.00438f80
call fcn.004388e0
nop dword [rax]
call fcn.00438700
lea rax, [0x00513a9b]
mov ebx, 0x3f
call fcn.00436dc0
nop
call fcn.004612c0
nop dword [rax]
jmp fcn.004214c0

Function at 0x422620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422721
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x422660
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x422711
test byte [rax], al
lea rcx, [rax + 0x100c0]
mov rax, rcx
call fcn.00423180
nop dword [rax]
test rax, rax
je 0x422711
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00422760]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 8]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00461180
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x4226ff
xor eax, eax
jmp 0x422709
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x422652
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004612c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00422620

Function at 0x427020
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42705b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test cl, cl
je 0x427049
xor edi, edi
call fcn.00427400
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00513839]
mov ebx, 0x3c
call fcn.00436dc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00465a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00427020
Function at 0x42e900
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42e951
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
movabs rcx, 0x800000000000
lea rdx, [rcx + rax]
cmp rax, rdx
setbe dl
add rcx, rbx
cmp rbx, rcx
setbe cl
cmp cl, dl
jne 0x42e93f
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005137fd]
mov ebx, 0x3c
call fcn.00436dc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.004612c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0042e900
Function at 0x42fc00
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42fea6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1278]
mov rcx, qword [rax + 0x1268]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42fe9a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x00630453], 0
jne 0x42fc62
xor edx, edx
xor ebx, ebx
nop
jmp 0x42fcaa
xor edx, edx
jmp 0x42fc8d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041f600
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42fc66
add rax, 0x1268
call fcn.0042fa80
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42fe34
mov rsi, qword [rax + rdx*8 + 0x1278]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42fca7
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.004135a0
test rax, rax
jne 0x42fd02
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42fca7
nop
mov rsi, rcx
shr rcx, 3
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42fd45
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42fca7
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42fe8d
lea r10, [0x006028b0]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42fdcb
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42fe05
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42fca7
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42fe85
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42fca7
cmp rbx, 0x200
ja 0x42fe78
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00425780
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042fa80
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.00463a20
mov rax, r8
call fcn.004639a0
mov rax, r8
mov ecx, 0x40
call fcn.004639c0
mov edx, 0x200
nop
call fcn.00463a00
nop
mov qword [rsp + 8], rax
call fcn.00465a20
mov rax, qword [rsp + 8]
jmp fcn.0042fc00
Function at 0x430940
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430a2d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor eax, eax
lea rcx, [0x006304ac]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
je 0x4309b8
mov rax, qword [0x005c3388]
mov rcx, qword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.00433fa0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
je 0x4309c2
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00464e80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438680
lea rax, [0x005138ed]
mov ebx, 0x3c
call fcn.00438f80
mov rax, qword [rsp + 0x30]
nop
call fcn.00438c80
lea rax, [0x00508e27]
mov ebx, 3
call fcn.00438f80
call fcn.00438700
lea rax, [0x005130c0]
mov ebx, 0x33
call fcn.00436dc0
nop
call fcn.004612c0
jmp fcn.00430940

Function at 0x430de0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430e67
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov edx, dword [rbx + 0x28]
nop dword [rax + rax]
cmp edx, 0x72
je 0x430e0a
cmp edx, 0x77
jne 0x430e25
mov dword [rbx + 0x2c], ecx
mov dword [rbx + 0x30], edi
mov rbx, qword [rbx + 0x20]
mov ecx, edx
call fcn.0042ffc0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edx
call fcn.00438680
lea rax, [0x005138b1]
mov ebx, 0x3c
call fcn.00438f80
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.00438d80
call fcn.004388e0
call fcn.00438700
lea rax, [0x0050dba4]
mov ebx, 0x17
call fcn.00436dc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.004612c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.00430de0
Function at 0x431d40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x431fdd
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x005db5e0]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.00433f20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x431e4e
nop
jne 0x431dd6
cmp dword [rsp + 0x4c], 0
jne 0x431dd6
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x431e4e
mov rax, qword [0x005db5d8]
nop dword [rax]
call fcn.00433dc0
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x0063142a]
mov ebx, 0x20
mov ecx, 0x21
call fcn.00432600
mov rcx, qword [0x00630640]
nop word [rax + rax]
cmp rcx, 0x105
ja 0x431fd2
mov qword [rsp + 0x58], rcx
lea rax, [0x00631240]
lea rbx, [0x00630d60]
call fcn.00464340
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x431e60
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rdx + rbx + 1], dil
inc rax
cmp rax, 0x20
jge 0x431ece
lea rdx, [rcx + rax*2]
lea rbx, [0x00631240]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x0050b417]
movzx esi, byte [rdi + rsi]
cmp rdx, 0x20b
jae 0x431fc5
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
nop word [rax + rax]
cmp rsi, 0x20b
jb 0x431e58
jmp 0x431fb5
lea rdx, [rcx + 0x40]
jmp 0x431ee2
lea rbx, [0x00631240]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x431ef9
cmp rdx, 0x20b
jb 0x431ed4
jmp 0x431fa8
mov rax, qword [sym.imp.kernel32.dll_CreateFileA]
lea rcx, [0x00631240]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.00434120
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.00464e80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x431f97
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.00438680
lea rax, [0x00513e10]
mov ebx, 0x5f
call fcn.00438f80
call fcn.00438700
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [0x00630444], 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.004639a0
mov rax, rsi
mov ecx, 0x20b
nop dword [rax]
call fcn.004639a0
mov rax, rdx
mov ecx, 0x20b
call fcn.004639a0
mov edx, 0x105
call fcn.00463a00
nop
nop dword [rax]
call fcn.004612c0
jmp fcn.00431d40
Function at 0x432320
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4325d9
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.00430ea0
cmp dword [0x00630760], 0
jne 0x43239c
mov qword [0x005db5a0], rax
jmp 0x4323a8
lea rdi, [0x005db5a0]
call fcn.00463500
test rax, rax
je 0x4325c7
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.00430ea0
cmp dword [0x00630760], 0
jne 0x432407
mov qword [0x005db5c0], rax
jmp 0x432413
lea rdi, [0x005db5c0]
call fcn.00463500
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.00430ea0
cmp dword [0x00630760], 0
jne 0x43247b
mov qword [0x005db5c8], rax
jmp 0x432487
lea rdi, [0x005db5c8]
call fcn.00463500
cmp qword [0x005db5c0], 0
je 0x4325b6
test rax, rax
je 0x4325b6
mov qword [rsp + 0x20], 0
mov rax, qword [0x005db5c8]
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop dword [rax]
call fcn.00433e20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x4325a5
cmp rax, 0x7fffffff
jg 0x432591
mov qword [rsp + 0x28], rax
mov rax, qword [0x005db5c0]
lea rcx, [0x00630618]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433e20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x432543
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x432562
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x43253d
sub rbx, rsi
bts edi, ecx
nop
jmp 0x43253d
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x00630610], rax
mov byte [0x00630455], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x00513d64]
mov ebx, 0x56
nop dword [rax]
call fcn.00436dc0
lea rax, [0x00513cbf]
mov ebx, 0x50
call fcn.00436dc0
lea rax, [0x0050eb99]
mov ebx, 0x1b
call fcn.00436dc0
lea rax, [0x00512aff]
mov ebx, 0x30
call fcn.00436dc0
nop
mov qword [rsp + 8], rax
nop
call fcn.004612c0
mov rax, qword [rsp + 8]
jmp fcn.00432320
Function at 0x443a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x443d70
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp byte [0x0063044e], 0
nop
jne 0x443c4e
cmp byte [0x0063044c], 0
jne 0x443c4e
cmp dword [0x006304b4], 0
nop word [rax + rax]
ja 0x443c44
cmp byte [0x0063044d], 0
jne 0x443ad8
cmp byte [0x00630445], 0
jne 0x443adc
xor ecx, ecx
jmp 0x443afe
mov eax, 1
call fcn.0043cee0
nop
cmp dword [0x00630478], 0
lea rcx, [0x00630550]
xchg qword [rcx], rax
seta cl
movzx ecx, cl
mov edx, dword [0x005dcfc8]
mov rbx, qword [0x005dcfd0]
sub rbx, qword [0x005dcfe0]
mov rsi, rbx
sub ebx, edx
mov edi, dword [0x005dcfcc]
sub ebx, edi
mov r8d, dword [0x005dcfdc]
sub ebx, r8d
cmp ecx, ebx
jl 0x443c3a
test ebx, ebx
jl 0x443cc8
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00443d80]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x30]
call fcn.0043a360
cmp qword [rsp + 0x20], 0
jne 0x443b8f
nop
nop
lea rax, [0x005dcfb8]
call fcn.0040b260
lea rax, [0x005133d8]
mov ebx, 0x36
call fcn.00436ec0
cmp qword [0x00630558], 0
je 0x443bad
call fcn.00454940
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jl 0x443bc5
mov rcx, qword [0x005dc3c0]
mov rdx, qword [0x005dc3c8]
xor eax, eax
nop dword [rax]
jmp 0x443c80
mov qword [0x00630558], rax
call fcn.00445580
test rax, rax
je 0x443c69
nop
mov rcx, qword [0x005dcfc0]
test rcx, rcx
je 0x443c03
mov rdx, qword [rcx + 0x128]
mov qword [0x005dcfc0], rdx
dec dword [0x005dcfc8]
nop dword [rax + rax]
test rcx, rcx
je 0x443c58
mov edx, 1
lea rbx, [0x005dcffc]
lock xadd dword [rbx], edx
mov byte [rcx + 0xe4], 1
nop
mov qword [rcx + 0xa8], rax
lea rax, [rcx + 0x118]
call fcn.0040b340
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0050e3a6]
mov ebx, 0x19
call fcn.00436dc0
lea rax, [0x0050e3bf]
mov ebx, 0x19
call fcn.00436dc0
inc rax
nop dword [rax]
cmp rax, rdx
jge 0x443c9f
mov rbx, qword [rcx + rax*8]
test byte [rbx], al
cmp qword [rbx + 0x2290], 0
je 0x443c7a
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
nop
nop
lea rax, [0x005dcfb8]
call fcn.0040b260
lea rax, [0x0051104b]
mov ebx, 0x25
call fcn.00436ec0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x14], r8d
call fcn.00438680
lea rax, [0x0050ed7f]
mov ebx, 0x1b
call fcn.00438f80
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.00438d80
lea rax, [0x0050acb6]
mov ebx, 0xe
call fcn.00438f80
mov eax, dword [rsp + 0x18]
movsxd rax, eax
call fcn.00438d80
lea rax, [0x0050978c]
mov ebx, 8
call fcn.00438f80
mov rax, qword [rsp + 0x28]
movsxd rax, eax
call fcn.00438d80
lea rax, [0x00509512]
mov ebx, 7
call fcn.00438f80
mov eax, dword [rsp + 0x14]
movsxd rax, eax
call fcn.00438d80
call fcn.004388e0
call fcn.00438700
lea rax, [0x0050f8dd]
mov ebx, 0x1e
call fcn.00436dc0
nop
call fcn.004612c0
jmp fcn.00443a80
Function at 0x4453e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44554f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4453f8
cmp edx, ecx
jne 0x44553d
nop dword [rax]
test rsi, rsi
jne 0x44553d
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x445456
nop
call fcn.004652e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.004452e0
mov rcx, qword [0x005dc448]
mov rdx, qword [0x005dc440]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
test edi, edi
jl 0x445538
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x44552d
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x005dcff0]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x005dcff0], rbx
mov edx, 1
lea rsi, [0x005dcff8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x44551c
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1228], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x005118f5]
mov ebx, 0x28
call fcn.00436dc0
mov rcx, rax
mov rax, rsi
call fcn.004639a0
call fcn.004351e0
lea rax, [0x00510b64]
mov ebx, 0x23
call fcn.00436dc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004612c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004453e0
Function at 0x44de80
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x44dfa6
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
lea rdi, [rsp + 0x20]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463c2b
mov rbp, qword [rbp]
lea rcx, [0x004fc480]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + 0x17]
test dl, 0x40
jne 0x44df90
lea rdx, [0x00630730]
lea rax, [0x005c8ec0]
jmp 0x44df12
mov rax, qword [rax + 0x220]
test rax, rax
je 0x44df34
nop word [rax + rax]
cmp qword [rax + 0x130], rdx
ja 0x44df0b
cmp qword [rax + 0x100], rdx
jbe 0x44df0b
jmp 0x44df36
xor eax, eax
test rax, rax
je 0x44df7f
mov rdx, qword [rcx]
lea rbx, [rdx + 7]
and rbx, 0xfffffffffffffff8
neg ebx
mov rsi, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rax + 0x128]
mov dword [0x00630730], ebx
mov dword [0x00630734], edx
mov dword [0x00630738], esi
mov dword [0x0063073c], ecx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
lea rax, [0x00511fbd]
mov ebx, 0x2b
call fcn.00436dc0
lea rax, [0x00513929]
mov ebx, 0x3d
nop dword [rax]
call fcn.00436dc0
nop
call fcn.004612c0
jmp fcn.0044de80

Function at 0x451e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x451fb8
movzx edx, byte [rax]
nop
test edx, edx
jne 0x451e7c
test r8b, r8b
jne 0x451e7c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x451e8f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x451f78
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x451f66
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x451f5c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x451ee3
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x451f26
mov eax, 1
cmp rax, rbx
ja 0x451f15
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00463a60
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x451f54
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x451f1d
mov r8d, eax
mov eax, r10d
jmp 0x451ee8
mov rcx, rbx
call fcn.004639a0
xor eax, eax
mov rcx, rax
call fcn.004639a0
mov eax, r8d
mov rcx, rbx
call fcn.00463a60
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x451fae
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x451f71
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x451e95
mov eax, edx
mov rcx, rbx
call fcn.004639a0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004639a0
nop
int3
Function at 0x4522c0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x452640
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
movzx edx, byte [rbx + 0x17]
and edx, 0x1f
dec rdx
cmp rdx, 0x19
ja 0x4525fb
mov qword [rsp + 0xb8], rax
lea rsi, [0x00537940]
jmp qword [rsi + rdx*8]
mov rax, rbx
nop
call fcn.0045ad40
mov ecx, 0x16
mov rdi, rax
mov rsi, rbx
lea r8, [0x0051347a]
mov r9d, 0x37
xor eax, eax
lea rbx, [0x0050d36a]
call fcn.0044e3c0
call fcn.0040a940
mov rbx, rax
lea rax, [0x004ea4e0]
call fcn.00436620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004612c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004522c0
Function at 0x459c60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459d1b
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00459d60]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00461180
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004612c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00459c60