joyce8/EMBER2024-capa huggingface dataset:
Function at 0x523600
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5237f1
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xb8], rbx
cmp rcx, 0x42
jne 0x523638
xor ecx, ecx
jmp 0x523676
lea rax, [0x0067c040]
nop
call fcn.0040d780
mov qword [rax + 8], 0x1c
lea rcx, [0x006beab8]
mov qword [rax], rcx
lea rbx, [0x0073b260]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
inc rcx
cmp rcx, 0x42
jge 0x5236e1
movzx edx, byte [rbx + rcx]
mov rsi, qword [0x008bdfc0]
mov rdi, qword [0x008bdfc8]
cmp rcx, rdi
jae 0x5237e5
movzx esi, byte [rsi + rcx]
nop dword [rax + rax]
cmp sil, dl
ja 0x5236e1
jae 0x523673
lea rax, [0x0067c040]
call fcn.0040d780
mov qword [rax + 8], 0x1c
lea rcx, [0x006beab8]
mov qword [rax], rcx
lea rbx, [0x0073b260]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
movups xmmword [rsp + 0x16], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [rsp + 0x16]
cmp rbx, rdx
je 0x523735
mov rsi, qword [rbx]
mov qword [rsp + 0x16], rsi
movups xmm0, xmmword [rbx + 2]
movups xmmword [rsp + 0x18], xmm0
movups xmm0, xmmword [rbx + 0x12]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rbx + 0x22]
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [rbx + 0x32]
movups xmmword [rsp + 0x48], xmm0
xor ecx, ecx
jmp 0x52374c
movzx r8d, byte [rsp + rsi + 0x16]
mov byte [rsp + rcx + 0x16], r8b
mov byte [rsp + rsi + 0x16], dil
inc rcx
cmp rcx, 0x21
jge 0x523768
lea rsi, [rcx - 0x41]
neg rsi
movzx edi, byte [rsp + rcx + 0x16]
nop
cmp rsi, 0x42
jb 0x523739
jmp 0x5237d5
mov qword [rsp + 0xb0], rax
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
lea rax, [rsp + 0x58]
mov rbx, rdx
nop dword [rax]
call fcn.00530ee0
mov rax, qword [rsp + 0xb0]
test byte [rax], al
lea rbx, [rsp + 0x58]
call fcn.0052eca0
mov rax, qword [rsp + 0xb0]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, rsi
mov ecx, 0x42
nop dword [rax]
call fcn.00465080
mov rax, rcx
mov rcx, rdi
call fcn.00465080
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.00523600
Function at 0x535ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x535fcf
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rcx, rax
lea rax, [rsp + 0x38]
mov rbx, rcx
call fcn.00535ce0
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.00540e80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x58]
xor eax, eax
xor edx, edx
jmp 0x535f40
test byte [rcx], al
lea rsi, [rax + 1]
mov rdi, qword [rsp + rax*8 + 0x18]
xor rdi, qword [rcx + rax*8]
or rdx, rdi
mov rax, rsi
nop
cmp rax, 4
jl 0x535f2a
nop
not rdx
mov rcx, rdx
shr rdx, 0x20
and rcx, rdx
mov rdx, rcx
shr rcx, 0x10
and rcx, rdx
mov rdx, rcx
shr rcx, 8
and rcx, rdx
mov rdx, rcx
shr rcx, 4
and rcx, rdx
mov rdx, rcx
shr rcx, 2
and rcx, rdx
mov rdx, rcx
shr rcx, 1
and rcx, rdx
and ecx, 1
cmp rcx, 1
je 0x535fc1
lea rax, [0x0067c040]
call fcn.0040d780
mov qword [rax + 8], 0x17
lea rcx, [0x006bb66c]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x0073b260]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
nop
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00535ea0
Function at 0x5413c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x54140d
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x5414a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x5414e5
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x549900
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x549985
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x549ae6
cmp rcx, 0xe
jne 0x549a00
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x549ae6
cmp rcx, 0xf
jne 0x549a77
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x549ae6
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x54fb40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54fcbf
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
test rbx, rbx
je 0x54fbd5
cmp rbx, 1
jne 0x54fb76
xor ecx, ecx
xor edx, edx
jmp 0x54fc0d
movzx edx, byte [rax]
test dl, dl
jne 0x54fb87
movzx esi, byte [rax + 1]
test sil, 0x80
je 0x54fb95
cmp dl, 0xff
jne 0x54fbcf
movzx edx, byte [rax + 1]
test dl, 0x80
je 0x54fbcf
lea rcx, [0x006bf26e]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0x1d
mov rax, qword [rsp + 0x20]
mov ebx, 0x1d
call fcn.0040aec0
mov rbx, qword [rsp + 0x58]
lea rcx, [0x0073b9c0]
mov rdx, rax
mov rax, qword [rsp + 0x50]
jmp 0x54fc0d
xor ecx, ecx
xor edx, edx
jmp 0x54fc0d
lea rcx, [0x006b7251]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0xd
mov rax, qword [rsp + 0x30]
mov ebx, 0xd
call fcn.0040aec0
mov rbx, qword [rsp + 0x58]
lea rcx, [0x0073b9c0]
mov rdx, rax
mov rax, qword [rsp + 0x50]
test rcx, rcx
jne 0x54fc5b
cmp rbx, 8
jg 0x54fc1e
xor esi, esi
xor edi, edi
jmp 0x54fc80
lea rcx, [0x006b88fa]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], 0x11
mov rax, qword [rsp + 0x10]
mov ebx, 0x11
nop dword [rax]
call fcn.0040aec0
lea rbx, [0x0073b9c0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
mov rbx, rcx
mov rcx, rdx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea r8, [rsi + 1]
shl rdi, 8
movzx r9d, byte [rax + rsi]
or rdi, r9
mov rsi, r8
cmp rbx, rsi
jg 0x54fc6d
shl ebx, 3
lea esi, [rbx - 0x40]
neg esi
cmp sil, 0x40
sbb rax, rax
sbb r8d, r8d
neg ebx
mov r9, rcx
mov ecx, ebx
shl rdi, cl
and rax, rdi
not r8d
or esi, r8d
mov ecx, esi
sar rax, cl
mov rbx, r9
mov rcx, rdx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0054fb40
Function at 0x54fd00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54fe67
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
test rbx, rbx
je 0x54fda8
cmp rbx, 1
jne 0x54fd3b
xor edx, edx
xor esi, esi
jmp 0x54fde5
movzx edx, byte [rax]
nop
test dl, dl
jne 0x54fd4e
movzx esi, byte [rax + 1]
test sil, 0x80
je 0x54fd5c
cmp dl, 0xff
jne 0x54fda2
movzx edx, byte [rax + 1]
test dl, 0x80
je 0x54fda2
lea rcx, [0x006bf26e]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0x1d
mov rax, qword [rsp + 0x28]
mov ebx, 0x1d
nop dword [rax + rax]
call fcn.0040aec0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
lea rdx, [0x0073b9c0]
mov rsi, rax
mov rax, qword [rsp + 0x58]
nop
jmp 0x54fde5
xor edx, edx
xor esi, esi
jmp 0x54fde5
lea rcx, [0x006b7251]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0xd
mov rax, qword [rsp + 0x38]
mov ebx, 0xd
call fcn.0040aec0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
lea rdx, [0x0073b9c0]
mov rsi, rax
mov rax, qword [rsp + 0x58]
test rdx, rdx
jne 0x54fe55
call fcn.0054fb40
test rbx, rbx
jne 0x54fe49
movsxd rdx, eax
cmp rax, rdx
je 0x54fe3b
lea rcx, [0x006b88fa]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0x11
mov rax, qword [rsp + 0x18]
mov ebx, 0x11
nop dword [rax + rax]
call fcn.0040aec0
lea rbx, [0x0073b9c0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
mov rbx, rdx
mov rcx, rsi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0054fd00
Function at 0x54fea0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5500f6
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x68], rax
test rbx, rbx
je 0x54ff48
cmp rbx, 1
jne 0x54fedb
xor edx, edx
xor esi, esi
jmp 0x54ff85
movzx edx, byte [rax]
nop
test dl, dl
jne 0x54feee
movzx esi, byte [rax + 1]
test sil, 0x80
je 0x54fefc
cmp dl, 0xff
jne 0x54ff42
movzx edx, byte [rax + 1]
test dl, 0x80
je 0x54ff42
lea rcx, [0x006bf26e]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0x1d
mov rax, qword [rsp + 0x38]
mov ebx, 0x1d
nop dword [rax + rax]
call fcn.0040aec0
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
lea rdx, [0x0073b9c0]
mov rsi, rax
mov rax, qword [rsp + 0x68]
nop
jmp 0x54ff85
xor edx, edx
xor esi, esi
jmp 0x54ff85
lea rcx, [0x006b7251]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], 0xd
mov rax, qword [rsp + 0x48]
mov ebx, 0xd
call fcn.0040aec0
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
lea rdx, [0x0073b9c0]
mov rsi, rax
mov rax, qword [rsp + 0x68]
test rdx, rdx
jne 0x55003c
lea rax, [0x00683f60]
call fcn.0040d780
mov qword [rsp + 0x30], rax
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x54ffd9
mov rdi, qword [rsp + 0x68]
movzx edx, byte [rdi]
test dl, 0x80
je 0x54ffde
lea rax, [0x006656a0]
mov rbx, rsi
mov rcx, rbx
call fcn.0044b520
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
xor ebx, ebx
jmp 0x550060
mov rdi, qword [rsp + 0x68]
nop
mov rdx, qword [rax + 8]
mov rbx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov r8, qword [rsp + 0x78]
mov rax, rdx
call fcn.00511d40
mov rdi, qword [rsp + 0x30]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rcx
cmp dword [0x00913f20], 0
jne 0x550014
mov qword [rdi + 8], rax
jmp 0x550028
lea rdx, [rdi + 8]
mov rcx, rdi
mov rdi, rdx
nop
call fcn.00464be0
mov rdi, rcx
mov byte [rdi], 0
mov rax, rdi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
xor eax, eax
mov rbx, rdx
mov rcx, rsi
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
movzx r9d, byte [rdx + rbx]
not r9d
mov byte [rax + rbx], r9b
inc rbx
nop dword [rax]
cmp rcx, rbx
jg 0x55004e
nop
mov rdx, qword [rsp + 0x30]
mov r9, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
mov r10, qword [rdx + 0x18]
mov rdi, rax
mov rsi, rcx
mov r8, rsi
mov rax, r9
mov rcx, r10
call fcn.00511d40
mov rdi, qword [rsp + 0x30]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rcx
cmp dword [0x00913f20], 0
nop
jne 0x5500a8
mov qword [rdi + 8], rax
jmp 0x5500ba
lea rdx, [rdi + 8]
mov rcx, rdi
mov rdi, rdx
call fcn.00464be0
mov rdi, rcx
mov byte [rdi], 0
mov rcx, qword [0x008bc6d8]
mov rax, rdi
mov rbx, rax
call fcn.005073e0
nop
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
je 0x5500e4
movzx edx, byte [rax]
xor edx, 1
jmp 0x5500e6
xor edx, edx
mov byte [rax], dl
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0054fea0
Function at 0x550120
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55020c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3d
lea rsi, [rdi + rdx]
sar rsi, 3
shl rsi, 3
sub rdx, rsi
lea rsi, [rdx - 8]
neg rsi
nop
cmp rsi, 8
je 0x5501bb
test rbx, rbx
je 0x5501bb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x006656a0]
mov rcx, rbx
call fcn.0044b520
mov rcx, qword [rsp + 0x20]
cmp rcx, 8
sbb edx, edx
mov rsi, qword [rsp + 0x30]
movzx edi, byte [rsi]
shr dil, cl
and edi, edx
mov byte [rax], dil
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
mov r8d, 1
jmp 0x5501fa
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp rdi, 0x20
sbb r9d, r9d
movzx r10d, byte [r8 + rsi - 1]
mov r11, rcx
mov rcx, rdi
shl r10d, cl
and r10d, r9d
mov byte [rax + r8], r10b
movzx r9d, byte [rsi + r8]
mov rcx, r11
shr r9b, cl
and r9d, edx
or r10d, r9d
mov byte [rax + r8], r10b
inc r8
cmp rbx, r8
jg 0x5501c5
mov rcx, rbx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00550120
Function at 0x550340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x550567
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
nop dword [rax]
test rbx, rbx
je 0x550463
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
lea rcx, [rbx + 1]
mov qword [rsp + 0x28], rcx
lea rax, [0x00664c60]
mov rbx, rcx
call fcn.0044b520
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor edi, edi
mov rax, qword [rsp + 0x58]
call fcn.005505a0
test rcx, rcx
jne 0x550446
cmp rax, 0x50
jge 0x550410
mov rdx, rax
movabs rax, 0xcccccccccccccccd
mov rsi, rdx
imul rdx
lea r8, [rsi + rdx]
sar r8, 5
mov r9, rsi
sar rsi, 0x3f
sub r8, rsi
mov rdx, qword [rsp + 0x28]
test rdx, rdx
jbe 0x55055c
mov rax, qword [rsp + 0x30]
mov qword [rax], r8
lea r8, [r8 + r8*4]
shl r8, 3
sub r9, r8
cmp rdx, 1
jbe 0x55054f
mov qword [rax + 8], r9
jmp 0x55043f
mov rdx, qword [rsp + 0x28]
test rdx, rdx
jbe 0x550545
mov r8, qword [rsp + 0x30]
mov qword [r8], 2
cmp rdx, 1
jbe 0x550537
lea r9, [rax - 0x50]
mov qword [r8 + 8], r9
mov rax, r8
mov esi, 2
jmp 0x5504b2
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rsi, rdi
mov rdi, rcx
mov rcx, rbx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rcx, [0x006bf74d]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0x1d
mov rax, qword [rsp + 0x38]
mov ebx, 0x1d
call fcn.0040aec0
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0073b9e0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov r9, qword [rsp + 0x30]
mov qword [r9 + r8*8], rax
lea rsi, [r8 + 1]
mov rax, r9
mov r8, qword [rsp + 0x60]
cmp r8, rbx
jle 0x550509
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rdi, rbx
mov rbx, r8
call fcn.005505a0
test rcx, rcx
jne 0x5504ec
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
cmp r8, rdx
jb 0x5504a2
jmp 0x55052c
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rsi, rdi
mov rdi, rcx
mov rcx, rbx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp rsi, rdx
ja 0x550524
mov rbx, rsi
mov rsi, rdi
mov rdi, rcx
mov rcx, rdx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rsi
call fcn.00465100
mov rax, r8
mov rcx, rdx
call fcn.00465080
mov eax, 1
mov rcx, rax
nop
call fcn.00465080
xor eax, eax
mov rcx, rax
call fcn.00465080
mov eax, 1
mov rcx, rax
call fcn.00465080
xor eax, eax
mov rcx, rax
call fcn.00465080
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00550340
Function at 0x550ce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x550e91
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
bt ebx, 0
jb 0x550d72
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x78], rax
cmp rbx, 2
jl 0x550d39
movzx edx, byte [rbx + rax - 1]
test dl, dl
jne 0x550d39
lea rdx, [rbx - 2]
cmp rbx, rdx
jbe 0x550e85
movzx esi, byte [rbx + rax - 2]
test sil, sil
jne 0x550d39
mov rbx, rdx
mov qword [rsp + 0x58], rbx
mov rcx, rbx
shr rcx, 1
mov qword [rsp + 0x50], rcx
lea rax, [0x006655e0]
xor ebx, ebx
call fcn.0044b520
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor ebx, ebx
jmp 0x550dcb
lea rax, [0x0067c040]
call fcn.0040d780
mov qword [rax + 8], 0x1d
lea rcx, [0x006bf404]
mov qword [rax], rcx
xor ebx, ebx
lea rcx, [0x0073b260]
mov rdi, rax
xor eax, eax
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov word [rax + rbx*2], r8w
add rsi, 0xfffffffffffffffe
mov r8, rsi
neg rsi
sar rsi, 0x3f
and esi, 2
add rdi, rsi
add rcx, 0xfffffffffffffffe
mov rsi, r8
mov rbx, r9
test rcx, rcx
je 0x550e4b
movzx r8d, byte [rdi]
cmp rcx, 1
jbe 0x550e73
lea r9, [rbx + 1]
shl r8d, 8
movzx r10d, byte [rdi + 1]
add r8d, r10d
cmp rdx, r9
jae 0x550da8
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x46], r8w
mov qword [rsp + 0x50], rcx
mov rcx, rbx
mov rdi, rdx
mov rsi, r9
mov rbx, rax
lea rax, [0x006655e0]
call fcn.0044b680
lea r9, [rbx + 1]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
movzx r8d, word [rsp + 0x46]
mov rdx, rcx
mov rcx, qword [rsp + 0x50]
jmp 0x550da8
mov rcx, rdx
call fcn.00472b00
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
xor eax, eax
nop
call fcn.0044fa40
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, 1
mov rcx, rax
nop dword [rax + rax]
call fcn.00465080
mov rax, rdx
mov rcx, rbx
call fcn.00465080
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00550ce0
Function at 0x55f660
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55f7b4
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.0055ea60
mov qword [rsp + 0x10], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x55f704
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x55f755
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x55f780
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
nop dword [rax + rax]
cmp rcx, 8
jge 0x55f6fe
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
cmp rsi, 0x20
jge 0x55f6fe
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x55f76c
mov rax, rsi
mov ecx, 0x20
call fcn.00465080
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0055f660