joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f4d20
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4f4ecd
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
cmp cl, 0x10
jae 0x4f4eb9
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xc0], cl
mov qword [rsp + 0xb8], rbx
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
nop
movabs rdx, 0xffffffff00000000
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0xffffffffffffffff
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x90], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x98], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x90]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x98]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov edx, 1
jmp 0x4f4e80
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.004f4c20
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
movzx r8d, byte [rsp + 0xc0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xb8]
nop dword [rax + rax]
cmp dl, 0x10
jae 0x4f4e9c
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x4f4e2e
jmp 0x4f4eac
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465ec0
lea rax, [0x006bb4c0]
lea rbx, [0x007f0820]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax + rax]
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004f4d20
Function at 0x4f7140
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f726f
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rcx, rax
lea rax, [rsp + 0x38]
mov rbx, rcx
call fcn.004f6f80
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.00502ca0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x58]
xor eax, eax
xor edx, edx
jmp 0x4f71e0
test byte [rcx], al
lea rsi, [rax + 1]
mov rdi, qword [rsp + rax*8 + 0x18]
xor rdi, qword [rcx + rax*8]
or rdx, rdi
mov rax, rsi
nop dword [rax]
cmp rax, 4
jl 0x4f71c8
nop
not rdx
mov rcx, rdx
shr rdx, 0x20
and rcx, rdx
mov rdx, rcx
shr rcx, 0x10
and rcx, rdx
mov rdx, rcx
shr rcx, 8
and rcx, rdx
mov rdx, rcx
shr rcx, 4
and rcx, rdx
mov rdx, rcx
shr rcx, 2
and rcx, rdx
mov rdx, rcx
shr rcx, 1
and rcx, rdx
and ecx, 1
cmp rcx, 1
je 0x4f7261
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x17
lea rcx, [0x00721c79]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007f1c00]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
nop
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004f7140
Function at 0x4f8340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f84f4
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
xor ecx, ecx
xor edx, edx
nop
jmp 0x4f8380
lea rsi, [rcx + 1]
mov rdi, qword [rax + rcx*8 + 0x40]
lea r8, [0x00a04fc0]
xor rdi, qword [r8 + rcx*8]
or rdx, rdi
mov rcx, rsi
nop dword [rax]
cmp rcx, 4
jl 0x4f8362
nop
not rdx
mov rcx, rdx
shr rdx, 0x20
and rdx, rcx
mov rcx, rdx
shr rdx, 0x10
and rdx, rcx
mov rcx, rdx
shr rdx, 8
and rdx, rcx
mov rcx, rdx
shr rdx, 4
and rdx, rcx
mov rcx, rdx
shr rdx, 2
and rdx, rcx
mov rcx, rdx
shr rdx, 1
and rdx, rcx
and edx, 1
cmp rdx, 1
jne 0x4f8407
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x23
lea rcx, [0x00728641]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007f1c00]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rbx, [rax + 0x40]
lea rax, [rsp + 0x18]
call fcn.004f8520
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.00502ca0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
call fcn.00502e80
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rcx
call fcn.005030e0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x50]
test byte [rcx], al
mov qword [rsp], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 8], rdx
call fcn.00502ac0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov ebx, 0x20
mov rcx, rbx
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004f8340
Function at 0x4fb360
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x68]
cmp r12, qword [r14 + 0x10]
jbe 0x4fb51e
sub rsp, 0xe8
mov qword [rsp + 0xe0], rbp
lea rbp, [rsp + 0xe0]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
nop dword [rax]
call fcn.004de340
cmp rax, 1
je 0x4fb4df
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov rcx, qword [rsp + 0xf0]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0xa0]
nop
call fcn.004e4f20
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
mov rcx, qword [rsp + 0xf0]
mov rbx, qword [rcx]
test byte [rbx], al
test byte [rax], al
mov rcx, rax
lea rax, [rsp + 0x70]
call fcn.004de7c0
mov rcx, qword [rsp + 0xf8]
test byte [rcx], al
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
lea rax, [rsp + 0x70]
lea rbx, [rsp + 0x40]
nop
call fcn.004de3e0
cmp rbx, 0x30
ja 0x4fb45d
mov rcx, rbx
mov rdx, qword [rsp + 0xf8]
mov esi, 0x30
jmp 0x4fb499
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0xf8]
mov ecx, 0x30
mov rdi, rbx
lea rsi, [0x006bb680]
call fcn.0044aa20
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.00466860
mov rax, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x23
lea rcx, [0x00728664]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007f1c00]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004fb360
Function at 0x4fc100
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x4fc2f3
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
cmp cl, 0x10
jae 0x4fc2df
mov qword [rsp + 0xe0], rax
mov byte [rsp + 0xf0], cl
mov qword [rsp + 0xe8], rbx
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
movabs rdx, 0xffffffff00000001
mov qword [rsp + 0x58], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 1
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb8], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xc0], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0xc8], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0xc0]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0xc8]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov edx, 1
jmp 0x4fc2a5
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.004fc000
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
movzx r8d, byte [rsp + 0xf0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xe8]
cmp dl, 0x10
jae 0x4fc2c2
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x4fc258
nop
jmp 0x4fc2d2
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465ec0
lea rax, [0x006bb4c0]
lea rbx, [0x007f0830]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004fc100
Function at 0x4fed80
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb0]
cmp r12, qword [r14 + 0x10]
jbe 0x4fef7d
sub rsp, 0x130
mov qword [rsp + 0x128], rbp
lea rbp, [rsp + 0x128]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
call fcn.004e55a0
cmp rax, 1
je 0x4fef3e
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xd8], xmm15
movups xmmword [rsp + 0xe8], xmm15
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x108], xmm15
mov rcx, qword [rsp + 0x138]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0xd0]
call fcn.004f2f60
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov rcx, qword [rsp + 0x138]
mov rbx, qword [rcx]
test byte [rbx], al
test byte [rax], al
mov rcx, rax
lea rax, [rsp + 0x88]
nop dword [rax]
call fcn.004e5ac0
mov rcx, qword [rsp + 0x140]
test byte [rcx], al
movups xmmword [rsp + 0x46], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
lea rax, [rsp + 0x88]
lea rbx, [rsp + 0x46]
call fcn.004e5680
nop
cmp rbx, 0x42
ja 0x4feeb8
mov rcx, rbx
mov rdx, qword [rsp + 0x140]
mov esi, 0x42
jmp 0x4feef8
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x140]
mov ecx, 0x42
mov rdi, rbx
lea rsi, [0x006bb680]
nop dword [rax]
call fcn.0044aa20
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x120], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.00466860
mov rax, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
ret
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x23
lea rcx, [0x00728687]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007f1c00]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004fed80
Function at 0x4ffd40
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x4fff8d
sub rsp, 0x120
mov qword [rsp + 0x118], rbp
lea rbp, [rsp + 0x118]
cmp cl, 0x10
jae 0x4fff79
mov qword [rsp + 0x128], rax
mov byte [rsp + 0x138], cl
mov qword [rsp + 0x130], rbx
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0x110], 0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x108], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x110], rdx
mov rdx, qword [rbx]
mov rsi, qword [rsp + 0xb8]
mov qword [rdx], rsi
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
jmp 0x4fff40
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.004ffc40
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x4fff5c
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x4ffef3
jmp 0x4fff6c
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465ec0
lea rax, [0x006bb4c0]
lea rbx, [0x007f0840]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax + rax]
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004ffd40
Function at 0x5031e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x50322d
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x5032c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x503305
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x505f40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505ff6
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
nop dword [rax]
cmp rcx, 0x20
je 0x505f9a
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x2e
lea rcx, [0x0072ccc3]
mov qword [rax], rcx
lea rbx, [0x007f1c00]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rdx, qword [rbx]
movabs rsi, 0x7ffffffffffff
and rdx, rsi
mov qword [rax], rdx
mov rdx, qword [rbx + 6]
shr rdx, 3
and rdx, rsi
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0xc]
shr rdx, 6
and rdx, rsi
mov qword [rax + 0x10], rdx
mov rdx, qword [rbx + 0x13]
shr rdx, 1
and rdx, rsi
mov qword [rax + 0x18], rdx
mov rdx, qword [rbx + 0x18]
shr rdx, 0xc
and rdx, rsi
mov qword [rax + 0x20], rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00505f40

Function at 0x506040
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x506186
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
nop
call fcn.00505480
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x5060e0
inc rax
mov rcx, rbx
nop dword [rax + rax]
cmp rax, 5
jge 0x506123
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
mov rdi, rdx
and rdx, 0xfffffffffffffff8
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x40]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
xor ecx, ecx
jmp 0x50614c
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rbx + rdi]
or r8d, edx
mov byte [rbx + rdi], r8b
inc rcx
mov rdi, rsi
cmp rcx, 8
jge 0x5060d5
movzx edx, byte [rsp + rcx + 0x10]
mov rsi, rdi
sar rdi, 3
add rdi, rcx
cmp rdi, 0x20
jge 0x5060d5
test byte [rbx], al
cmp rdi, 0x20
jb 0x50613a
mov rax, rdi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.00465ec0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00506040
Function at 0x507680
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50771e
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rsi, qword [rax + 8]
mov rcx, qword [rbx + 8]
cmp qword [rbx], rdx
jne 0x5076c4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, rdx
mov rbx, rsi
call fcn.00403fe0
nop dword [rax]
test al, al
jne 0x5076fd
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x3b
lea rcx, [0x0072fcb2]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007f1c00]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbx, qword [rsp + 0x28]
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
mov rdx, qword [rdx + 0x30]
mov rcx, qword [rsp + 0x30]
call rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00507680

Function at 0x507880
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x507a06
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc8], rdi
cmp rsi, rbx
jne 0x5079ee
nop
cmp rbx, 0x48
jg 0x5079db
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
xor ecx, ecx
jmp 0x507929
movzx r9d, byte [rax + rbx - 1]
mov byte [rsp + rcx + 0x58], r9b
mov byte [rsp + rcx + 0x10], sil
inc rcx
mov rbx, r8
mov rsi, rdx
cmp rbx, rcx
jle 0x50795f
mov rdx, rsi
sub rsi, rcx
lea r8, [rsi - 1]
nop dword [rax + rax]
cmp rdx, r8
jbe 0x5079d0
mov r8, rbx
sub rbx, rcx
lea r9, [rbx - 1]
movzx esi, byte [rdi + rsi - 1]
cmp r8, r9
ja 0x507910
jmp 0x5079c5
xor eax, eax
xor ecx, ecx
jmp 0x507980
mov rbx, qword [rsp + rdx + 0x58]
mov rdx, qword [rsp + rdx + 0x10]
neg ecx
sbb rbx, rdx
sbb rcx, rcx
add rax, 8
neg rcx
nop
cmp rax, 0x48
jge 0x50799f
lea rdx, [rax - 0x48]
mov rbx, rdx
sar rdx, 0x3f
and rdx, rax
neg rbx
cmp rbx, 7
ja 0x507965
jmp 0x5079b6
cmp rcx, 1
sete al
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov eax, 7
mov rcx, rbx
nop
call fcn.00465ec0
mov rax, r9
mov rcx, r8
call fcn.00465ec0
mov rax, r8
mov rcx, rdx
call fcn.00465ec0
lea rax, [0x006bb4c0]
lea rbx, [0x007f06e0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0720]
nop dword [rax]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00507880