joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58fee0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x590031
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x70], rbx
xor ecx, ecx
jmp 0x58ff2f
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov ecx, 1
cmp rcx, 1
jge 0x58ff9c
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
test byte [rax], al
lea rbx, [rsp + 0x40]
mov ecx, 0x28
nop dword [rax]
call fcn.00402d80
test al, al
je 0x58ff1a
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
mov rax, qword [rsp + 0x68]
add rax, 0x28
lea rbx, [rsp + 0x18]
mov ecx, 0x28
call fcn.00402d80
test al, al
je 0x58ff1a
jmp 0x59001d
test byte [rax], al
test byte [rbx], al
mov rdx, qword [0x008ca500]
mov rcx, rbx
mov rbx, rdx
call fcn.0056baa0
nop
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rcx + 0x28]
mov rax, qword [rsp + 0x88]
mov qword [rax + 0x28], rdx
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
nop
mov rdx, qword [rcx + 0x50]
mov qword [rax + 0x50], rdx
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rax + 0x58], xmm0
movups xmm0, xmmword [rcx + 0x68]
movups xmmword [rax + 0x68], xmm0
lea rdx, [rax + 0x78]
add rcx, 0x78
mov rbx, qword [0x008ca500]
mov rax, rdx
call fcn.0056baa0
mov rax, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x00679500]
lea rbx, [0x00741c90]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0058fee0
Function at 0x590060
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59018e
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
nop dword [rax]
cmp rcx, 0x40
je 0x5900ba
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x32
lea rcx, [0x006db111]
mov qword [rax], rcx
lea rbx, [0x00742c00]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov ecx, 0x15
call fcn.005901e0
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
mov rdi, qword [rsp + 0x70]
lea rdx, [rdi - 0x15]
mov rbx, qword [rsp + 0x60]
lea rsi, [rbx + 0x15]
lea rax, [rsp + 0x20]
mov ecx, 0x15
mov rbx, rsi
mov rdi, rdx
call fcn.005901e0
mov qword [rsp + 0x40], rax
test byte [rax], al
mov rcx, qword [0x008ca4e8]
test byte [rcx], al
mov rbx, rax
call fcn.00590740
mov rbx, qword [rsp + 0x58]
test byte [rbx], al
mov rax, rbx
mov rcx, qword [rsp + 0x40]
call fcn.00591120
mov rdi, qword [rsp + 0x70]
add rdi, 0xffffffffffffffd6
mov rbx, qword [rsp + 0x60]
add rbx, 0x2a
mov rax, qword [rsp + 0x40]
mov ecx, 0x16
call fcn.005901e0
mov rcx, qword [0x008ca4f0]
test byte [rcx], al
mov rax, qword [rsp + 0x40]
mov rbx, rax
call fcn.00590740
mov rax, qword [rsp + 0x58]
mov rbx, rax
mov rcx, qword [rsp + 0x40]
call fcn.00591120
mov rax, qword [rsp + 0x58]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.00590060

Function at 0x5901e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x590275
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
nop dword [rax]
cmp rcx, 0x20
jge 0x590261
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rdx, [rsp + 0x18]
nop dword [rax]
cmp rbx, rdx
je 0x590237
mov rax, rdx
call fcn.00466740
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x18]
test byte [rax], al
mov rbx, rdx
nop dword [rax]
call fcn.00592040
mov rax, qword [rsp + 0x48]
mov rbx, rax
call fcn.00591680
mov rax, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00679500]
lea rbx, [0x00741ca0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005901e0
Function at 0x590460
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xe0]
cmp r12, qword [r14 + 0x10]
jbe 0x59070c
sub rsp, 0x160
mov qword [rsp + 0x158], rbp
lea rbp, [rsp + 0x158]
mov qword [rsp + 0x270], rbx
lea rdi, [rsp + 0x168]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466034
mov rbp, qword [rbp]
nop
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
lea rbx, [rsp + 0x10]
call fcn.005903e0
cmp rbx, 0x1f
jbe 0x5906fe
cmp byte [rax + 0x1f], 0x7f
ja 0x5906eb
mov rdx, qword [rsp + 0x270]
cmp rdx, 2
jb 0x5906d8
cmp rdx, 8
ja 0x5906c5
lea rdi, [rsp + 0x58]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466034
mov rbp, qword [rbp]
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
xor esi, esi
jmp 0x590539
mov r10, qword [rax + r10]
mov qword [rsp + r8*8 + 0x30], r10
lea rsi, [r8 + 1]
mov rbx, r9
cmp rsi, 4
jge 0x59056d
mov r8, rsi
shl rsi, 3
cmp rbx, rsi
jb 0x5906b6
mov r9, rbx
sub rbx, rsi
mov r10, rsi
sub rsi, rcx
sar rsi, 0x3f
and r10, rsi
cmp rbx, 7
ja 0x590529
jmp 0x5906a9
mov rcx, rdx
mov ebx, 1
shl rbx, cl
lea r8, [rbx - 1]
xor eax, eax
xor esi, esi
jmp 0x59058e
mov rcx, rdx
mov rbx, r11
mov rsi, rax
mov rax, r9
cmp rax, 0x100
jae 0x590658
mov r9, rax
shr rax, 6
mov r10, r9
and r9d, 0x3f
lea r11, [rcx - 0x40]
neg r11
cmp r11, r9
jbe 0x5905cb
cmp rax, 5
jae 0x59069f
mov r9, qword [rsp + rax*8 + 0x30]
mov rcx, r10
shr r9, cl
jmp 0x590610
cmp rax, 5
jae 0x590695
mov r11, qword [rsp + rax*8 + 0x30]
mov rcx, r10
shr r11, cl
lea r12, [rax + 1]
cmp r12, 5
jae 0x590688
lea r12, [r9 - 0x40]
neg r12
cmp r12, 0x40
sbb r9, r9
mov r12, qword [rsp + rax*8 + 0x38]
neg rcx
shl r12, cl
and r9, r12
or r9, r11
mov rcx, r10
and r9, r8
add r9, rsi
bt r9d, 0
jb 0x59062c
lea r9, [rcx + 1]
mov r11, rbx
mov rax, rsi
jmp 0x590582
mov r11, rbx
shr rbx, 1
cmp rbx, r9
jbe 0x590642
mov byte [rsp + rcx + 0x58], r9b
xor eax, eax
nop
jmp 0x59064f
sub r9d, r11d
mov byte [rsp + rcx + 0x58], r9b
mov eax, 1
lea r9, [rcx + rdx]
jmp 0x590582
lea rdi, [rsp + 0x168]
lea rsi, [rsp + 0x58]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466340
mov rbp, qword [rbp]
mov rbp, qword [rsp + 0x158]
add rsp, 0x160
ret
mov rax, r12
mov ecx, 5
call fcn.00465dc0
mov ecx, 5
call fcn.00465dc0
mov ecx, 5
call fcn.00465dc0
mov eax, 7
mov rcx, rbx
call fcn.00465da0
mov rax, rsi
mov rcx, rbx
nop dword [rax]
call fcn.00465e60
lea rax, [0x00679500]
lea rbx, [0x00741c80]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c70]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741cb0]
call fcn.00436420
mov eax, 0x1f
mov rcx, rbx
call fcn.00465da0
nop
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rbx
nop dword [rax]
call fcn.00463740
mov rax, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
jmp fcn.00590460
Function at 0x592040
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5922bc
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
movzx ecx, byte [rbx + 0x1f]
mov qword [rsp + 0x98], rcx
movzx edx, byte [rbx + 0x1e]
mov qword [rsp + 0x90], rdx
movzx esi, byte [rbx + 0x1d]
mov qword [rsp + 0x88], rsi
movzx edi, byte [rbx + 0x1c]
mov qword [rsp + 0x80], rdi
movzx r8d, byte [rbx + 0x1b]
mov qword [rsp + 0x78], r8
movzx r9d, byte [rbx + 0x1a]
mov qword [rsp + 0x70], r9
movzx r10d, byte [rbx + 0x19]
mov qword [rsp + 0x68], r10
movzx r11d, byte [rbx + 0x18]
mov qword [rsp + 0x60], r11
movzx r12d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r12
movzx r13d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r13
movzx r15d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r15
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r10d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r10
movzx r9d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r9
movzx r8d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r8
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r8d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r8
movzx r9d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r9
movzx r10d, byte [rbx + 9]
mov qword [rsp + 8], r10
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r15d, byte [rbx + 7]
shl r15, 0x38
movzx r13d, byte [rbx + 6]
shl r13, 0x30
movzx r12d, byte [rbx + 5]
shl r12, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r10d, byte [rbx + 3]
shl r10, 0x18
movzx r9d, byte [rbx + 2]
shl r9, 0x10
movzx r8d, byte [rbx + 1]
shl r8, 8
movzx ebx, byte [rbx]
add rbx, r8
add rbx, r9
add rbx, r10
add rbx, r11
add rbx, r12
add rbx, r13
add rbx, r15
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x98]
shl rcx, 0x38
mov rdx, qword [rsp + 0x90]
shl rdx, 0x30
mov rbx, qword [rsp + 0x88]
shl rbx, 0x28
mov rsi, qword [rsp + 0x80]
shl rsi, 0x20
mov rdi, qword [rsp + 0x78]
shl rdi, 0x18
mov r8, qword [rsp + 0x70]
shl r8, 0x10
mov r9, qword [rsp + 0x68]
shl r9, 8
mov r10, qword [rsp + 0x60]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00592040
Function at 0x594a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x594c20
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [0x0067b760]
call fcn.0040d960
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x594aab
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x594bd9
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x594c00
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x594a9d
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x594a9d
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x594a9d
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x594a9d
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [r8 + rax]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
nop word [rax + rax]
cmp rdx, rax
jle 0x594b68
cmp r9, r10
jle 0x594b68
ja 0x594be3
mov rax, r10
mov rcx, r9
call fcn.00465da0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.00594a40
Function at 0x595d00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x595f3c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.0053c3e0
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x595e4a
nop
cmp rdx, 0x40
ja 0x595f2e
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x595db9
mov rax, rdx
mov rcx, rsi
nop
call fcn.00466740
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x595e21
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00596480
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x595f23
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x595e57
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x595ed7
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.00596480
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x595f12
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x595f0e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.00466740
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00465e60
mov rax, rdx
mov ecx, 0x40
call fcn.00465e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00595d00
Function at 0x59c1c0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x59c1d8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x59c1d8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x59c1e0
xor eax, eax
ret
cmp rbx, 3
je 0x59c1ec
cmp rbx, 4
jne 0x59c219
cmp al, 0x2c
ja 0x59c206
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x59c216
cmp al, 0x24
je 0x59c216
nop dword [rax]
cmp al, 0x26
jae 0x59c216
jmp 0x59c219
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x59c216
cmp al, 0x5b
je 0x59c216
cmp al, 0x5d
jne 0x59c219
xor eax, eax
ret
cmp al, 0x2f
ja 0x59c252
nop dword [rax]
cmp al, 0x26
ja 0x59c231
cmp al, 0x24
je 0x59c271
cmp al, 0x26
je 0x59c271
jmp 0x59c2eb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x59c271
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x59c2e8
cmp al, 0x2f
je 0x59c271
jmp 0x59c2eb
cmp al, 0x3d
ja 0x59c269
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x59c271
nop
cmp al, 0x3d
je 0x59c271
jmp 0x59c2eb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x59c2e0
cmp rbx, 2
jg 0x59c2a7
cmp rbx, 1
je 0x59c2a1
nop dword [rax]
cmp rbx, 2
jne 0x59c2eb
cmp al, 0x2f
je 0x59c292
cmp al, 0x3b
je 0x59c292
cmp al, 0x2c
jne 0x59c299
mov ecx, 1
jmp 0x59c29e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x59c2ca
cmp al, 0x40
je 0x59c2b9
cmp al, 0x2f
je 0x59c2b9
cmp al, 0x3f
jne 0x59c2c2
mov ecx, 1
nop
jmp 0x59c2c7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x59c2d9
cmp rbx, 7
jne 0x59c2eb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x59c2e8
cmp al, 0x7e
jne 0x59c2eb
xor eax, eax
ret
cmp rbx, 7
jne 0x59c301
cmp al, 0x21
je 0x59c2fd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x59c301
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x5a24a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a26b7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x5a25ce
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x5a26a9
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x5a2542
mov rax, rdx
mov rcx, rsi
call fcn.00466740
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x5a25aa
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.005a2940
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x5a26a1
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x5a25d4
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x5a2651
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.005a2940
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x5a268f
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x5a268b
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00466740
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.00465e60
mov rax, rdx
mov ecx, 0x40
call fcn.00465e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005a24a0
Function at 0x5a9f20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5aa04f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
mov rbx, rax
mov ecx, 0x30
call fcn.00589c80
nop
test al, al
jne 0x5a9f96
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x27
lea rcx, [0x006d7cf9]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00742c00]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp qword [rsp + 0x58], 0
nop dword [rax]
je 0x5aa041
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x30], xmm15
mov byte [rsp + 0x27], 0
lea rax, [rsp + 0x50]
lea rbx, [rsp + 0x28]
lea rcx, [rsp + 0x27]
mov edi, 1
call fcn.0058a480
test al, al
je 0x5aa00f
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx]
movzx r8d, byte [rsp + 0x27]
xor r8d, 0xffffff80
movzx eax, r8b
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
call rsi
nop
test rax, rax
je 0x5a9f96
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x26
lea rcx, [0x006d781a]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00742c00]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.005a9f20