joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52c3c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52c59c
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], r10
test rsi, rsi
je 0x52c4f7
test r9, r9
je 0x52c4f7
mov qword [rsp + 0x98], rsi
lea rbx, [rsi + 1]
mov qword [rsp + 0x58], rbx
cmp rcx, rbx
jl 0x52c41c
jae 0x52c47b
jmp 0x52c590
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rcx, [rsi + 5]
mov qword [rsp + 0x50], rcx
lea rax, [0x00678f80]
call fcn.0044a840
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
nop dword [rax + rax]
cmp rsi, rcx
ja 0x52c585
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.00538240
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
jae 0x52c579
mov rsi, qword [rsp + 0x60]
mov qword [rsi + rcx*8], rax
jmp 0x52c542
test r10, r10
jne 0x52c502
xor edx, edx
nop
jmp 0x52c532
nop
cmp rcx, 1
jge 0x52c52a
lea rax, [0x00678f80]
mov ebx, 1
mov rcx, rbx
call fcn.0044a840
mov r10, qword [rsp + 0xb0]
mov ecx, 1
mov qword [rax], r10
mov edx, 1
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
dec rdx
test rdx, rdx
jle 0x52c551
mov rdi, qword [rsi + rdx*8 - 8]
test rdi, rdi
je 0x52c53f
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
ja 0x52c56b
mov rax, rsi
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00465e20
mov rax, rcx
mov rcx, rdx
nop
call fcn.00465da0
mov rdx, rcx
mov rcx, rsi
call fcn.00465e20
mov rdx, rcx
mov rcx, rbx
call fcn.00465e20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.0052c3c0
Function at 0x52ce20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52cf71
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x52cf65
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00537ee0
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x52cf41
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x52cf60
cmp rsi, rcx
ja 0x52cf53
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x52cf4b
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00538020
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00465e60
mov rax, rsi
call fcn.00465e60
nop dword [rax + rax]
call fcn.00465e20
mov rdx, rcx
mov rcx, r9
call fcn.00465e20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.0052ce20
Function at 0x52cfe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52d131
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x52d125
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00537f80
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x52d101
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x52d120
cmp rsi, rcx
ja 0x52d113
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x52d10b
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.005380c0
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00465e60
mov rax, rsi
call fcn.00465e60
nop dword [rax + rax]
call fcn.00465e20
mov rdx, rcx
mov rcx, r9
call fcn.00465e20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.0052cfe0
Function at 0x532b40
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x532cfc
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x532b87
nop
jae 0x532bfe
jmp 0x532cf0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x532bcb
lea rax, [0x00678f80]
mov ebx, 1
mov rcx, rbx
call fcn.0044a840
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x532bfe
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x00678f80]
call fcn.0044a840
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x532c13
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x532c45
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x532c06
nop dword [rax + rax]
jmp 0x532ce5
test rsi, rsi
jle 0x532c52
xor r8d, r8d
xor r9d, r9d
jmp 0x532cae
jmp 0x532c57
dec rbx
test rbx, rbx
jle 0x532c66
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x532c54
cmp rbx, rcx
ja 0x532c75
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, rcx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00465e20
cmp r8, 0x40
sbb r11, r11
lea r12, [r8 + 8]
movzx r13d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r13, cl
and r13, r11
or r9, r13
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x532cbe
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x532c85
jmp 0x532cd9
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x532cce
mov qword [rax + rbx*8 - 8], r9
jmp 0x532c52
mov rax, rsi
mov rcx, rbx
call fcn.00465da0
mov rax, r10
mov rcx, rdx
nop
call fcn.00465da0
mov rax, r9
mov rcx, rbx
call fcn.00465da0
mov rdx, rcx
mov rcx, rbx
call fcn.00465e20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.00532b40
Function at 0x539f00
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x539f6b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x539f24
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x539f41
cmp rdx, 0
je 0x539f8d
test rdx, 0xf
je 0x539f1d
test rdx, 7
jne 0x539f41
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x539f1d
ret
Function at 0x53e600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53e72e
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rbx
call fcn.0053c3e0
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jl 0x53e71a
mov rdx, qword [rsp + 0x40]
nop dword [rax]
cmp rdx, 0x10
jl 0x53e707
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rdx, rsi
je 0x53e69d
nop
mov rdi, rdx
lea r8, [rsi + 0xf]
cmp r8, rdx
jb 0x53e69a
mov rdx, rsi
lea r8, [rdi + 0xf]
cmp r8, rsi
jae 0x53e6f4
mov rsi, rdx
mov rdx, rdi
jmp 0x53e69d
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rbx + 8]
mov rbx, qword [rbx]
test rdi, rdi
jbe 0x53e6ea
shr rdi, 2
lea rax, [rdi - 1]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rsi
call fcn.0053eb00
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rcx, rax
call fcn.00465da0
lea rax, [0x00679500]
lea rbx, [0x00741ae0]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741ad0]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741ac0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.0053e600
Function at 0x53e780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53e8af
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rbx
call fcn.0053c3e0
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jl 0x53e89b
mov rdx, qword [rsp + 0x40]
nop dword [rax]
cmp rdx, 0x10
jl 0x53e888
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rdx, rsi
je 0x53e81d
nop
mov rdi, rdx
lea r8, [rsi + 0xf]
cmp r8, rdx
jb 0x53e81a
mov rdx, rsi
lea r8, [rdi + 0xf]
cmp r8, rsi
jae 0x53e875
mov rsi, rdx
mov rdx, rdi
jmp 0x53e81d
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rbx + 0x20]
mov rbx, qword [rbx + 0x18]
test rdi, rdi
jbe 0x53e86b
shr rdi, 2
lea rax, [rdi - 1]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rsi
call fcn.0053ebc0
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rcx, rax
call fcn.00465da0
lea rax, [0x00679500]
lea rbx, [0x00741ae0]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741ad0]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741ac0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.0053e780

Function at 0x53eb00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x53eb3f
jb 0x53eb54
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x53ebc0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x53ebff
jb 0x53ec14
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x53ec80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x53ed50
jb 0x53edaf
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0053eaa0
aeskeygenassist xmm1, xmm0, 1
call fcn.0053eac0
aeskeygenassist xmm1, xmm2, 2
call fcn.0053eaa0
aeskeygenassist xmm1, xmm0, 2
call fcn.0053eac0
aeskeygenassist xmm1, xmm2, 4
call fcn.0053eaa0
aeskeygenassist xmm1, xmm0, 4
call fcn.0053eac0
aeskeygenassist xmm1, xmm2, 8
call fcn.0053eaa0
aeskeygenassist xmm1, xmm0, 8
call fcn.0053eac0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0053eaa0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0053eac0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0053eaa0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0053eac0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0053eaa0
jmp 0x53ee1d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0053ea00
aeskeygenassist xmm1, xmm2, 2
call fcn.0053ea60
aeskeygenassist xmm1, xmm2, 4
call fcn.0053ea00
aeskeygenassist xmm1, xmm2, 8
call fcn.0053ea60
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0053ea00
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0053ea60
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0053ea00
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0053ea60
jmp 0x53ee1d
aeskeygenassist xmm1, xmm0, 1
call fcn.0053e9c0
aeskeygenassist xmm1, xmm0, 2
call fcn.0053e9c0
aeskeygenassist xmm1, xmm0, 4
call fcn.0053e9c0
aeskeygenassist xmm1, xmm0, 8
call fcn.0053e9c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0053e9c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0053e9c0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0053e9c0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0053e9c0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0053e9c0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0053e9c0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x53ee2a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x544180
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x54438c
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movzx ecx, byte [rbx + 0x1b]
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r15
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r15d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r15
movzx r13d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r13
movzx r12d, byte [rbx + 9]
mov qword [rsp + 8], r12
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r10d, byte [rbx + 7]
shl r10, 0x38
movzx r9d, byte [rbx + 6]
shl r9, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r12d, byte [rbx + 3]
shl r12, 0x18
movzx r13d, byte [rbx + 2]
shl r13, 0x10
movzx r15d, byte [rbx + 1]
shl r15, 8
movzx ebx, byte [rbx]
add rbx, r15
add rbx, r13
add rbx, r12
add rbx, r11
add rbx, r8
add rbx, r9
add rbx, r10
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x78]
shl rcx, 0x18
mov rdx, qword [rsp + 0x70]
shl rdx, 0x10
mov rbx, qword [rsp + 0x68]
shl rbx, 8
mov rsi, qword [rsp + 0x60]
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00544180
Function at 0x55a660
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x55a803
sub rsp, 0xb8
mov qword [rsp + 0xb0], rbp
lea rbp, [rsp + 0xb0]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
nop dword [rax]
call fcn.00541960
cmp rax, 1
je 0x55a7c4
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
mov rcx, qword [rsp + 0xc0]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0x80]
call fcn.005443c0
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rcx, qword [rsp + 0xc0]
mov rbx, qword [rcx]
test byte [rbx], al
test byte [rax], al
mov rcx, rax
lea rax, [rsp + 0x60]
nop dword [rax]
call fcn.00541d60
mov rcx, qword [rsp + 0xc8]
test byte [rcx], al
movups xmmword [rsp + 0x44], xmm15
movups xmmword [rsp + 0x50], xmm15
lea rax, [rsp + 0x60]
lea rbx, [rsp + 0x44]
call fcn.00541a00
cmp rbx, 0x1c
ja 0x55a742
mov rcx, rbx
mov rdx, qword [rsp + 0xc8]
mov esi, 0x1c
jmp 0x55a77e
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0xc8]
mov ecx, 0x1c
mov rdi, rbx
lea rsi, [0x006796c0]
call fcn.0044a920
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.00466740
mov rax, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x23
lea rcx, [0x006d5d94]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00742c00]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax]
jmp fcn.0055a660