joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b50a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b5226
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x98]
mov rax, rbx
call rdx
nop dword [rax + rax]
cmp rax, 0x17
jne 0x4b520d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jl 0x4b51fa
mov rdx, qword [rsp + 0x48]
nop dword [rax]
test rdx, rdx
jl 0x4b51e7
cmp rcx, rdx
jg 0x4b51d4
lea rax, [0x0068fa00]
call fcn.0040da20
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x38]
call rdx
mov rcx, qword [0x007331f0]
lea rdx, [0x007331e8]
cmp rax, rdx
jne 0x4b51c5
mov rax, rbx
mov rbx, qword [rsp + 0x48]
call fcn.0045ec60
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rbx + 0x10], rcx
cmp dword [0x00918a90], 0
jne 0x4b5178
mov qword [rbx], rax
jmp 0x4b5185
mov rdi, rbx
nop dword [rax + rax]
call fcn.00465600
mov rdx, qword [0x007331f0]
mov rax, qword [rsp + 0x30]
lea rsi, [0x007331e8]
cmp rax, rsi
jne 0x4b51b1
mov rax, qword [rsp + 0x38]
mov ecx, 0x97
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, rdx
lea rcx, [0x006a8aa0]
nop dword [rax + rax]
call fcn.0040ad20
mov rbx, rcx
lea rcx, [0x006a8aa0]
call fcn.0040ad20
lea rax, [0x00667a40]
lea rbx, [0x0072dfc0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072dfb0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072dfa0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072df90]
nop dword [rax + rax]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004b50a0

Function at 0x4b5360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b540c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
test rax, rax
je 0x4b53f8
mov rdx, qword [0x007331f0]
lea rsi, [0x007331e8]
cmp rax, rsi
jne 0x4b53e9
mov qword [rsp + 0x38], rbx
mov rax, rbx
call fcn.004ae280
movzx ecx, byte [rax + 0x17]
test cl, 0x20
je 0x4b53d6
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
call fcn.0045eba0
mov rbx, rax
mov ecx, 0x16
mov rax, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667a40]
lea rbx, [0x0072dff0]
call fcn.00436260
mov rbx, rdx
lea rcx, [0x006a8aa0]
call fcn.0040ad20
lea rax, [0x00667a40]
lea rbx, [0x0072dfe0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b5360
Function at 0x4bdbc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bdcee
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rbx
call fcn.004bb9a0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jl 0x4bdcda
mov rdx, qword [rsp + 0x40]
nop dword [rax]
cmp rdx, 0x10
jl 0x4bdcc7
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rdx, rsi
je 0x4bdc5d
nop
mov rdi, rdx
lea r8, [rsi + 0xf]
cmp r8, rdx
jb 0x4bdc5a
mov rdx, rsi
lea r8, [rdi + 0xf]
cmp r8, rsi
jae 0x4bdcb4
mov rsi, rdx
mov rdx, rdi
jmp 0x4bdc5d
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rbx + 8]
mov rbx, qword [rbx]
test rdi, rdi
jbe 0x4bdcaa
shr rdi, 2
lea rax, [rdi - 1]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rsi
call fcn.004be040
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rcx, rax
call fcn.00465aa0
lea rax, [0x00667a40]
lea rbx, [0x0072d7b0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d7a0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d790]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004bdbc0
Function at 0x4bdd40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bde6f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rbx
call fcn.004bb9a0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jl 0x4bde5b
mov rdx, qword [rsp + 0x40]
nop dword [rax]
cmp rdx, 0x10
jl 0x4bde48
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rdx, rsi
je 0x4bdddd
nop
mov rdi, rdx
lea r8, [rsi + 0xf]
cmp r8, rdx
jb 0x4bddda
mov rdx, rsi
lea r8, [rdi + 0xf]
cmp r8, rsi
jae 0x4bde35
mov rsi, rdx
mov rdx, rdi
jmp 0x4bdddd
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rbx + 0x20]
mov rbx, qword [rbx + 0x18]
test rdi, rdi
jbe 0x4bde2b
shr rdi, 2
lea rax, [rdi - 1]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rsi
call fcn.004be100
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rcx, rax
call fcn.00465aa0
lea rax, [0x00667a40]
lea rbx, [0x0072d7b0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d7a0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d790]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004bdd40

Function at 0x4be040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4be07f
jb 0x4be094
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4be100
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4be13f
jb 0x4be154
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4be1c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4be290
jb 0x4be2ef
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004bdfe0
aeskeygenassist xmm1, xmm0, 1
call fcn.004be000
aeskeygenassist xmm1, xmm2, 2
call fcn.004bdfe0
aeskeygenassist xmm1, xmm0, 2
call fcn.004be000
aeskeygenassist xmm1, xmm2, 4
call fcn.004bdfe0
aeskeygenassist xmm1, xmm0, 4
call fcn.004be000
aeskeygenassist xmm1, xmm2, 8
call fcn.004bdfe0
aeskeygenassist xmm1, xmm0, 8
call fcn.004be000
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004bdfe0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004be000
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004bdfe0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004be000
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004bdfe0
jmp 0x4be35d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004bdf40
aeskeygenassist xmm1, xmm2, 2
call fcn.004bdfa0
aeskeygenassist xmm1, xmm2, 4
call fcn.004bdf40
aeskeygenassist xmm1, xmm2, 8
call fcn.004bdfa0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004bdf40
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004bdfa0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004bdf40
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004bdfa0
jmp 0x4be35d
aeskeygenassist xmm1, xmm0, 1
call fcn.004bdf00
aeskeygenassist xmm1, xmm0, 2
call fcn.004bdf00
aeskeygenassist xmm1, xmm0, 4
call fcn.004bdf00
aeskeygenassist xmm1, xmm0, 8
call fcn.004bdf00
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004bdf00
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004bdf00
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004bdf00
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004bdf00
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004bdf00
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004bdf00
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4be36a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x4c36c0
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4c38cc
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movzx ecx, byte [rbx + 0x1b]
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r15
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r15d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r15
movzx r13d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r13
movzx r12d, byte [rbx + 9]
mov qword [rsp + 8], r12
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r10d, byte [rbx + 7]
shl r10, 0x38
movzx r9d, byte [rbx + 6]
shl r9, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r12d, byte [rbx + 3]
shl r12, 0x18
movzx r13d, byte [rbx + 2]
shl r13, 0x10
movzx r15d, byte [rbx + 1]
shl r15, 8
movzx ebx, byte [rbx]
add rbx, r15
add rbx, r13
add rbx, r12
add rbx, r11
add rbx, r8
add rbx, r9
add rbx, r10
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x78]
shl rcx, 0x18
mov rdx, qword [rsp + 0x70]
shl rdx, 0x10
mov rbx, qword [rsp + 0x68]
shl rbx, 8
mov rsi, qword [rsp + 0x60]
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004c36c0
Function at 0x4d9ba0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x4d9d43
sub rsp, 0xb8
mov qword [rsp + 0xb0], rbp
lea rbp, [rsp + 0xb0]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
nop dword [rax]
call fcn.004c0ea0
cmp rax, 1
je 0x4d9d04
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
mov rcx, qword [rsp + 0xc0]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0x80]
call fcn.004c3900
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rcx, qword [rsp + 0xc0]
mov rbx, qword [rcx]
test byte [rbx], al
test byte [rax], al
mov rcx, rax
lea rax, [rsp + 0x60]
nop dword [rax]
call fcn.004c12a0
mov rcx, qword [rsp + 0xc8]
test byte [rcx], al
movups xmmword [rsp + 0x44], xmm15
movups xmmword [rsp + 0x50], xmm15
lea rax, [rsp + 0x60]
lea rbx, [rsp + 0x44]
call fcn.004c0f40
cmp rbx, 0x1c
ja 0x4d9c82
mov rcx, rbx
mov rdx, qword [rsp + 0xc8]
mov esi, 0x1c
jmp 0x4d9cbe
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0xc8]
mov ecx, 0x1c
mov rdi, rbx
lea rsi, [0x00667c00]
call fcn.0044a700
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.00466460
mov rax, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x23
lea rcx, [0x006c49aa]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0072e7e0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax]
jmp fcn.004d9ba0
Function at 0x4da820
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4da9cd
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
cmp cl, 0x10
jae 0x4da9b9
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xc0], cl
mov qword [rsp + 0xb8], rbx
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
nop
movabs rdx, 0xffffffff00000000
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0xffffffffffffffff
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x90], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x98], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x90]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x98]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov edx, 1
jmp 0x4da980
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.004da720
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
movzx r8d, byte [rsp + 0xc0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xb8]
nop dword [rax + rax]
cmp dl, 0x10
jae 0x4da99c
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x4da92e
jmp 0x4da9ac
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465aa0
lea rax, [0x00667a40]
lea rbx, [0x0072d990]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004da820
Function at 0x4dcc40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dcd6f
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rcx, rax
lea rax, [rsp + 0x38]
mov rbx, rcx
call fcn.004dca80
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.004e8700
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x58]
xor eax, eax
xor edx, edx
jmp 0x4dcce0
test byte [rcx], al
lea rsi, [rax + 1]
mov rdi, qword [rsp + rax*8 + 0x18]
xor rdi, qword [rcx + rax*8]
or rdx, rdi
mov rax, rsi
nop dword [rax]
cmp rax, 4
jl 0x4dccc8
nop
not rdx
mov rcx, rdx
shr rdx, 0x20
and rcx, rdx
mov rdx, rcx
shr rcx, 0x10
and rcx, rdx
mov rdx, rcx
shr rcx, 8
and rcx, rdx
mov rdx, rcx
shr rcx, 4
and rcx, rdx
mov rdx, rcx
shr rcx, 2
and rcx, rdx
mov rdx, rcx
shr rcx, 1
and rcx, rdx
and ecx, 1
cmp rcx, 1
je 0x4dcd61
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x17
lea rcx, [0x006bef1f]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x0072e7e0]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
nop
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004dcc40
Function at 0x4ddda0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ddf54
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
xor ecx, ecx
xor edx, edx
nop
jmp 0x4ddde0
lea rsi, [rcx + 1]
mov rdi, qword [rax + rcx*8 + 0x40]
lea r8, [0x00918b60]
xor rdi, qword [r8 + rcx*8]
or rdx, rdi
mov rcx, rsi
nop dword [rax]
cmp rcx, 4
jl 0x4dddc2
nop
not rdx
mov rcx, rdx
shr rdx, 0x20
and rdx, rcx
mov rcx, rdx
shr rdx, 0x10
and rdx, rcx
mov rcx, rdx
shr rdx, 8
and rdx, rcx
mov rcx, rdx
shr rdx, 4
and rdx, rcx
mov rcx, rdx
shr rdx, 2
and rdx, rcx
mov rcx, rdx
shr rdx, 1
and rdx, rcx
and edx, 1
cmp rdx, 1
jne 0x4dde67
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x23
lea rcx, [0x006c49cd]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0072e7e0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rbx, [rax + 0x40]
lea rax, [rsp + 0x18]
call fcn.004ddf80
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.004e8700
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
call fcn.004e88e0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rcx
call fcn.004e8b40
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x50]
test byte [rcx], al
mov qword [rsp], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 8], rdx
call fcn.004e8520
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov ebx, 0x20
mov rcx, rbx
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ddda0
Function at 0x4e0dc0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x68]
cmp r12, qword [r14 + 0x10]
jbe 0x4e0f7e
sub rsp, 0xe8
mov qword [rsp + 0xe0], rbp
lea rbp, [rsp + 0xe0]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
nop dword [rax]
call fcn.004c3e40
cmp rax, 1
je 0x4e0f3f
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov rcx, qword [rsp + 0xf0]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0xa0]
nop
call fcn.004caa20
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
mov rcx, qword [rsp + 0xf0]
mov rbx, qword [rcx]
test byte [rbx], al
test byte [rax], al
mov rcx, rax
lea rax, [rsp + 0x70]
call fcn.004c42c0
mov rcx, qword [rsp + 0xf8]
test byte [rcx], al
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
lea rax, [rsp + 0x70]
lea rbx, [rsp + 0x40]
nop
call fcn.004c3ee0
cmp rbx, 0x30
ja 0x4e0ebd
mov rcx, rbx
mov rdx, qword [rsp + 0xf8]
mov esi, 0x30
jmp 0x4e0ef9
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0xf8]
mov ecx, 0x30
mov rdi, rbx
lea rsi, [0x00667c00]
call fcn.0044a700
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.00466460
mov rax, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x23
lea rcx, [0x006c49f0]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0072e7e0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004e0dc0