joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c8640
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c880e
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rsi, qword [rax + 0x28]
test rsi, rsi
jle 0x5c86ca
mov rdx, qword [rax + 0x10]
mov r8, qword [rax]
mov rcx, qword [rax + 8]
mov r9, qword [rax + 0x30]
cmp rdx, r9
jb 0x5c8805
nop
cmp r9, rsi
jb 0x5c87f9
sub r9, rsi
cmp rcx, r9
cmovg rcx, r9
mov r9, rsi
sub rsi, rdx
sar rsi, 0x3f
and r9, rsi
lea rbx, [r9 + r8]
test r9, r9
je 0x5c86b6
mov rax, r8
call fcn.00466460
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 0x30]
sub rdx, qword [rax + 0x28]
mov qword [rax + 0x30], rdx
mov qword [rax + 0x28], 0
mov rdx, qword [rax + 8]
cmp qword [rax + 0x30], rdx
jge 0x5c87e6
mov ecx, 0x64
jmp 0x5c86ea
mov rcx, qword [rsp + 0x20]
dec rcx
mov rax, rdi
test rcx, rcx
jle 0x5c8788
mov rdx, qword [rax + 8]
mov rsi, qword [rax]
mov rdi, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
cmp r8, rdx
ja 0x5c87db
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
mov r9, qword [r9 + 0x18]
sub rdi, r8
sub rdx, r8
mov r11, rdi
neg rdi
sar rdi, 0x3f
and rdi, r8
lea rbx, [rdi + rsi]
mov rcx, rdx
mov rdi, r11
mov rax, r10
call r9
nop
test rax, rax
jl 0x5c87bc
mov rdi, qword [rsp + 0x38]
add qword [rdi + 0x30], rax
test rbx, rbx
jne 0x5c8762
test rax, rax
jle 0x5c86df
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rdi + 0x38], rbx
cmp dword [0x00918a90], 0
jne 0x5c8775
mov qword [rdi + 0x40], rcx
jmp 0x5c877e
add rdi, 0x40
call fcn.00465700
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rcx, qword [0x008b5fa8]
mov rdx, qword [0x008b5fa0]
mov qword [rax + 0x38], rdx
cmp dword [0x00918a90], 0
jne 0x5c87a9
mov qword [rax + 0x40], rcx
jmp 0x5c87b2
lea rdi, [rax + 0x40]
call fcn.00465700
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rcx, qword [0x008b5a20]
mov rbx, qword [0x008b5a28]
test rcx, rcx
je 0x5c87d3
mov rcx, qword [rcx + 8]
mov rax, rcx
call fcn.00436260
mov rax, r8
mov rcx, rdx
call fcn.00465b60
lea rax, [0x00667a40]
lea rbx, [0x0072d660]
call fcn.00436260
mov rax, rsi
mov rcx, r9
nop
call fcn.00465b60
mov rcx, r9
call fcn.00465b20
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.005c8640
Function at 0x5c92c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c9439
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov ebx, 0xa
call fcn.005c9060
mov rdx, qword [0x008b59f8]
cmp qword [0x008b59f0], rdi
jne 0x5c93a4
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x28], rax
mov rax, rdi
mov rbx, rsi
mov rcx, rdx
nop dword [rax]
call fcn.004040a0
test al, al
je 0x5c938b
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x5c936a
mov rax, qword [rsp + 0x28]
movzx r9d, byte [rax + rdx - 1]
nop
cmp r9b, 0xd
jne 0x5c9365
mov r9, qword [rsp + 0x50]
mov r10, qword [r9 + 0x28]
test r10, r10
je 0x5c9425
dec r10
mov qword [r9 + 0x28], r10
lea rbx, [rdx - 1]
jmp 0x5c9372
mov rbx, rdx
jmp 0x5c9372
mov rax, qword [rsp + 0x28]
mov rbx, rdx
mov rcx, qword [rsp + 0x18]
mov edi, 1
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
test rbx, rbx
je 0x5c93ec
movzx r9d, byte [rax + rbx - 1]
cmp r9b, 0xa
jne 0x5c93db
cmp rbx, 1
jle 0x5c93ce
movzx r9d, byte [rbx + rax - 2]
cmp r9b, 0xd
jne 0x5c93ce
mov edx, 2
jmp 0x5c93d3
mov edx, 1
sub rbx, rdx
cmp rcx, rbx
jb 0x5c9417
xor edi, edi
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test rdi, rdi
mov edx, 0
cmovne rbx, rdx
cmovne rcx, rdx
mov edx, 0
cmovne rax, rdx
mov r8, rsi
mov rsi, rdi
xor edi, edi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdx, rcx
mov rcx, rbx
nop dword [rax]
call fcn.00465b20
lea rax, [0x00667a40]
lea rbx, [0x0072d670]
call fcn.00436260
nop
mov qword [rsp + 8], rax
nop
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.005c92c0
Function at 0x5cc720
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5cc935
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], r8
test rdi, rdi
je 0x5cc866
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
call fcn.005587c0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0xc0]
mov rax, rdx
mov ebx, 0xa
call fcn.004a04a0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x80]
mov qword [rsp], rdx
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 8], rsi
mov byte [rsp + 0x10], 0x3a
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5cc82c
xor eax, eax
lea rbx, [0x006b8622]
mov ecx, 1
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006b86c7]
mov r9d, 2
mov r10, qword [rsp + 0x70]
mov r11, qword [rsp + 0x50]
call fcn.0044e6c0
jmp 0x5cc856
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x0072bd48]
mov esi, 1
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x50]
call fcn.0044e5e0
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rax, r8
mov ebx, 0xa
call fcn.004a04a0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x78], rcx
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x58], rdx
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5cc8fa
xor eax, eax
lea rbx, [0x006b8622]
mov ecx, 1
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x58]
lea r8, [0x006b86c7]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x48]
call fcn.0044e6c0
jmp 0x5cc925
xor eax, eax
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
lea rdi, [0x0072bd48]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x48]
nop dword [rax]
call fcn.0044e5e0
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.005cc720
Function at 0x5d0080
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d01b9
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
cmp qword [rax], 0
nop dword [rax]
jle 0x5d0197
cmp qword [rax + 0x10], 0
je 0x5d0175
cmp dword [rax + 0x20], 0x40000
jb 0x5d012f
mov rdx, qword [rax + 0x38]
nop
test rdx, rdx
je 0x5d00f3
cmp qword [rax + 0x48], 0
jne 0x5d00d1
test rdx, rdx
jmp 0x5d00f3
lea rax, [0x006ca393]
mov ebx, 0x34
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.004f0a80
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
jne 0x5d00fc
cmp qword [rax + 0x48], 0
je 0x5d010a
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006c9f9f]
mov ebx, 0x32
xor ecx, ecx
xor edi, edi
mov rsi, rdi
nop dword [rax]
call fcn.004f0a80
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
lea rdx, [0x00667b80]
mov qword [rsp + 0x28], rdx
lea rdx, [0x0072d384]
mov qword [rsp + 0x30], rdx
lea rax, [0x006c7574]
mov ebx, 0x2a
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004f0a80
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006c51f4]
mov ebx, 0x24
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.004f0a80
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006bf8d3]
mov ebx, 0x18
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.004f0a80
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
nop
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.005d0080
Function at 0x5d39c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d3aa8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x34], ebx
mov rcx, rax
xor eax, eax
mov edx, 1
lock cmpxchg dword [rcx + 0x60], edx
sete dl
lea rax, [rcx + 0x60]
mov qword [rsp + 0x38], rax
nop dword [rax]
test dl, dl
jne 0x5d3a12
call fcn.00470b60
mov rcx, qword [rsp + 0x50]
mov ebx, dword [rsp + 0x34]
mov rdx, qword [rcx + 0x58]
lea rax, [0x006754e0]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
call fcn.00410c80
test bl, bl
je 0x5d3a65
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rcx + 0x68]
xor eax, eax
call fcn.00407060
nop dword [rax]
test al, al
jne 0x5d3a65
mov rdx, qword [rsp + 0x50]
mov rax, qword [rdx + 0x18]
lea rbx, [0x006c56c1]
mov ecx, 0x25
xor edi, edi
xor esi, esi
mov r8, rsi
call fcn.005cba80
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x50]
lea rax, [0x00675300]
mov ecx, dword [rsp + 0x34]
call fcn.00411160
nop
mov ebx, 0xffffffff
mov rdx, qword [rsp + 0x50]
lock xadd dword [rdx + 0x60], ebx
dec ebx
test ebx, ebx
je 0x5d3a9e
mov rax, qword [rsp + 0x38]
call fcn.00470e60
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop
jmp fcn.005d39c0

Function at 0x5d3ae0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d3be8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x34], ebx
mov rcx, rax
xor eax, eax
mov edx, 1
lock cmpxchg dword [rcx + 0x60], edx
sete dl
lea rax, [rcx + 0x60]
mov qword [rsp + 0x38], rax
nop dword [rax]
test dl, dl
jne 0x5d3b32
call fcn.00470b60
mov rcx, qword [rsp + 0x50]
mov ebx, dword [rsp + 0x34]
mov rdx, qword [rcx + 0x58]
lea rax, [0x006754e0]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
call fcn.00410c80
test bl, bl
je 0x5d3b68
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x58]
lea rax, [0x006754e0]
mov ecx, dword [rsp + 0x34]
call fcn.00411160
jmp 0x5d3b89
mov rdx, qword [rsp + 0x50]
mov rax, qword [rdx + 0x18]
lea rbx, [0x006cc9fd]
mov ecx, 0x48
xor edi, edi
xor esi, esi
mov r8, rsi
call fcn.005cba80
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rcx + 0x68]
xor eax, eax
call fcn.00407060
test al, al
jne 0x5d3bbe
mov rdx, qword [rsp + 0x50]
mov rax, qword [rdx + 0x18]
lea rbx, [0x006ccd70]
mov ecx, 0x4c
xor edi, edi
xor esi, esi
mov r8, rsi
call fcn.005cba80
nop
mov ebx, 0xffffffff
mov rcx, qword [rsp + 0x50]
lock xadd dword [rcx + 0x60], ebx
dec ebx
test ebx, ebx
je 0x5d3bde
mov rax, qword [rsp + 0x38]
call fcn.00470e60
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop
jmp fcn.005d3ae0
Function at 0x5da260
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5da3b3
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.005db000
test rbx, rbx
je 0x5da381
test rdi, rdi
je 0x5da373
cmp byte [rcx], 0x2f
nop word [rax + rax]
jne 0x5da341
lea rbx, [rdi - 1]
mov rdx, rbx
neg rbx
sar rbx, 0x3f
and ebx, 1
lea rax, [rcx + rbx]
mov rbx, rdx
nop
call fcn.005db000
test rbx, rbx
je 0x5da30f
test rdi, rdi
je 0x5da301
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x2c
lea rcx, [0x006c815c]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x0072e7e0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x20
lea rcx, [0x006c357b]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x0072e7e0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x26
lea rcx, [0x006c61dc]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x0072e7e0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x13
lea rcx, [0x006bd3f4]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x0072e7e0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005da260
Function at 0x5dcca0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5dced9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
cmp qword [rax], 2
jl 0x5dcd71
cmp qword [rax + 0xa0070], 0
jne 0x5dcec5
cmp qword [rax + 0xa0090], 0
nop dword [rax]
jne 0x5dcec5
cmp rcx, 0x8000
jle 0x5dcd12
sub rdi, rcx
lea r9, [rdi + 0x8000]
neg r9
sar r9, 0x3f
lea r10, [rcx - 0x8000]
and r9, r10
add rbx, r9
mov ecx, 0x8000
mov qword [rsp + 0x68], rax
mov r9, qword [rax + 0xa0080]
cmp rcx, r9
cmovl r9, rcx
mov qword [rsp + 0x30], r9
mov r10, qword [rax + 0xa0078]
cmp rbx, r10
je 0x5dcd4f
mov rax, r10
mov rcx, r9
nop dword [rax]
call fcn.00466460
mov rax, qword [rsp + 0x68]
mov r9, qword [rsp + 0x30]
lea r10, [r9 + 0xfc]
mov r11, r10
sar r10, 0x3f
shr r10, 0x38
add r10, r11
sar r10, 8
mov qword [rsp + 0x38], r10
xor ecx, ecx
jmp 0x5dcd80
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
inc rcx
nop
cmp rcx, r10
jge 0x5dce46
mov rsi, rcx
shl rsi, 8
lea rbx, [rsi + 0x103]
cmp r9, rbx
cmovl rbx, r9
mov rdx, qword [rax + 0xa0088]
mov r11, qword [rax + 0xa0078]
cmp rdx, rbx
jb 0x5dceba
cmp rbx, rsi
jb 0x5dceaf
sub rbx, rsi
sub rdx, rsi
mov r12, rdx
neg rdx
sar rdx, 0x3f
and rdx, rsi
add r11, rdx
lea r13, [rbx - 3]
test r13, r13
jle 0x5dcd7b
nop dword [rax]
cmp r13, 0x101
ja 0x5dcea2
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r13
lea rdi, [rax + 0xa00e8]
mov rdx, qword [rax + 0x38]
mov r9, qword [rdx]
mov rcx, r12
mov rsi, r13
mov r8d, 0x101
mov rax, r11
call r9
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x68]
mov r9, qword [rsp + 0x50]
xor eax, eax
jmp 0x5dce9a
mov rax, rdi
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
jmp 0x5dcd7b
mov qword [rax + 0xa0090], r9
mov qword [rax + 0xa0070], r9
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov r10d, dword [rdi + rax*4 + 0xa00e8]
lea r11, [rax + r9]
and r10d, 0x1ffff
mov r12, r11
and r11d, 0x7fff
mov r13d, dword [rdi + r10*4 + 0x68]
mov dword [rdi + r11*4 + 0x80068], r13d
mov r11, qword [rdi + 0xa0068]
add r11, r12
mov dword [rdi + r10*4 + 0x68], r11d
inc rax
cmp rax, rsi
jl 0x5dce5e
nop
jmp 0x5dce2f
mov rcx, r13
mov edx, 0x101
call fcn.00465ae0
mov rax, rsi
mov rcx, rbx
call fcn.00465b60
mov rcx, rbx
nop dword [rax]
call fcn.00465b20
lea rax, [0x00667a40]
lea rbx, [0x0072d6e0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005dcca0
Function at 0x5e6fc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5e7095
movdqa xmm0, xmmword [0x0072de60]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5e7001
movdqa xmm0, xmmword [0x0072de70]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5e7117
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5e70eb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0072d600]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0072e2e0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5f4580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f472b
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5f45a7
inc rcx
cmp rbx, rcx
jle 0x5f471d
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5f45a4
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0055be60
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x008b5980]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005f0640
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5f470d
test rdx, rdx
je 0x5f46fe
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5f46c9
xor eax, eax
lea rbx, [0x006b8622]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006b86c7]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044e6c0
jmp 0x5f46f0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0072bd48]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044e5e0
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005f4580
Function at 0x5f7060
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f71dd
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
cmp byte [rax + 0x98], 0
nop
jne 0x5f708c
cmp dword [rax + 0x30], 0
ja 0x5f7183
mov qword [rsp + 0x58], rax
mov rbx, qword [rax + 0x58]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rax + 0x68]
mov eax, 5
call fcn.005f7200
test rsi, rsi
jne 0x5f7173
mov rdx, qword [rsp + 0x58]
mov esi, dword [rdx + 0x38]
cmp rax, rsi
ja 0x5f711f
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
nop
mov dword [rdx + 0x34], eax
mov rax, rdx
call fcn.005f6360
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov qword [rdi + 0x60], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rdi + 0x68], rcx
cmp dword [0x00918a90], 0
jne 0x5f7103
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x58], rcx
jmp 0x5f7111
add rdi, 0x58
mov rcx, qword [rsp + 0x30]
call fcn.00465700
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x23
lea rcx, [0x006c4ac2]
mov qword [rax], rcx
lea rcx, [0x0072e7e0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00685c40]
lea rbx, [rsp + 0x38]
call fcn.0040ae00
mov rbx, rax
lea rax, [0x0072f520]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
mov rbx, r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x47
lea rcx, [0x006cc8e1]
mov qword [rax], rcx
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x0072e7e0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00685c40]
lea rbx, [rsp + 0x38]
call fcn.0040ae00
mov rbx, rax
lea rax, [0x0072f520]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.005f7060
Function at 0x5fa1c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5fa2b1
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, qword [rbx]
mov rsi, qword [rbx + 8]
nop
cmp rsi, 5
jne 0x5fa200
cmp dword [rdx], 0x70747468
jne 0x5fa200
cmp byte [rdx + 4], 0x73
jne 0x5fa200
mov rdx, qword [rax + 0x38]
jmp 0x5fa253
cmp rsi, 4
jne 0x5fa251
cmp dword [rdx], 0x70747468
jne 0x5fa251
mov rdx, qword [rax + 0x40]
test rdx, rdx
je 0x5fa253
cmp byte [rax + 0x30], 0
je 0x5fa253
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x52
lea rcx, [0x006cd255]
mov qword [rax], rcx
lea rbx, [0x0072e7e0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor edx, edx
test rdx, rdx
je 0x5fa2a1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x18], rdx
mov rax, rbx
call fcn.005fae60
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x30]
call fcn.005fa4a0
test al, al
je 0x5fa291
mov rax, qword [rsp + 0x18]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005fa1c0