joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b45c0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x5b47f8
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
movzx edx, word [rax + 0x30]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
mov rsi, qword [rax + 0x28]
mov eax, edx
nop dword [rax]
call fcn.005b22e0
test rbx, rbx
jne 0x5b463e
mov rdx, qword [rsp + 0xa0]
cmp qword [rdx + 8], 0
je 0x5b4631
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
mov qword [rsp + 0x48], r8
xor eax, eax
jmp 0x5b4654
xor eax, eax
xor ebx, ebx
add rsp, 0x90
pop rbp
ret
mov rax, rbx
mov rbx, rcx
add rsp, 0x90
pop rbp
ret
add rdi, 0x18
inc rax
cmp rax, r8
jge 0x5b474e
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x68], rdi
test rax, rax
jne 0x5b4675
mov r9, qword [rsi + 0x70]
test r9, r9
jne 0x5b46ac
mov rax, qword [rdi]
mov rbx, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
call fcn.00599920
test rbx, rbx
jne 0x5b46c5
mov rdx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x48]
mov r9, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], r9
mov r10, qword [rdx]
mov r11, qword [rdx + 8]
mov qword [rsp + 0x40], r11
xor ecx, ecx
nop
jmp 0x5b4786
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x58], rcx
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
mov rax, qword [rsp + 0x28]
call fcn.0040adc0
lea rcx, [0x0065b920]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x30]
nop
test rcx, rcx
je 0x5b470b
mov rbx, qword [rcx + 8]
jmp 0x5b470e
mov rbx, rcx
mov qword [rsp + 0x80], rbx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x88], rdx
lea rax, [0x006c1547]
mov ebx, 0x30
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
nop dword [rax]
call fcn.004dd6a0
add rsp, 0x90
pop rbp
ret
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x27
lea rcx, [0x006be6dc]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x90
pop rbp
ret
add r10, 0x18
inc rcx
cmp rcx, r11
jge 0x5b464d
mov r12, qword [r9 + 0x68]
cmp qword [r10 + 8], r12
jne 0x5b477f
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x60], r10
mov rbx, qword [r10]
mov rax, qword [r9 + 0x60]
mov rcx, r12
call fcn.00403880
test al, al
jne 0x5b47eb
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x40]
jmp 0x5b477f
xor eax, eax
xor ebx, ebx
add rsp, 0x90
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005b45c0
Function at 0x5b4b40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b4d1d
push rbp
mov rbp, rsp
sub rsp, 0x38
cmp ax, 0x201
je 0x5b4ce1
nop dword [rax]
cmp ax, 0x203
je 0x5b4ccf
cmp ax, 0x401
je 0x5b4cbd
cmp ax, 0x403
je 0x5b4cab
nop
cmp ax, 0x501
je 0x5b4c99
cmp ax, 0x503
je 0x5b4c87
cmp ax, 0x601
je 0x5b4c75
nop
cmp ax, 0x603
je 0x5b4c63
lea esi, [rax - 0x804]
cmp si, 3
ja 0x5b4c2a
movzx esi, si
nop dword [rax]
cmp rsi, 5
jae 0x5b4d0f
lea edi, [rax - 0x803]
movzx eax, di
lea rdi, [0x0088c414]
movzx esi, byte [rsi + rdi]
nop
cmp rax, 5
jae 0x5b4d05
movzx ecx, byte [rax + rdi]
cmp rcx, 0x2e
ja 0x5b4cfb
nop dword [rax + rax]
cmp rsi, rcx
ja 0x5b4cf3
sub rcx, rsi
mov rbx, rcx
neg rcx
sar rcx, 0x3f
and rsi, rcx
lea rcx, [0x006c0b0a]
lea rax, [rcx + rsi]
add rsp, 0x38
pop rbp
ret
movzx eax, ax
mov ebx, 0xa
call fcn.0047a080
mov ecx, 0x10
mov rdi, rax
mov rsi, rbx
lea r8, [0x00725940]
mov r9d, 1
xor eax, eax
lea rbx, [0x006b3f5e]
call fcn.0044f6c0
add rsp, 0x38
pop rbp
ret
lea rax, [0x006b6a7d]
mov ebx, 0x16
add rsp, 0x38
pop rbp
ret
lea rax, [0x006b3958]
mov ebx, 0xf
add rsp, 0x38
pop rbp
ret
lea rax, [0x006b6a67]
mov ebx, 0x16
add rsp, 0x38
pop rbp
ret
lea rax, [0x006b3949]
mov ebx, 0xf
add rsp, 0x38
pop rbp
ret
lea rax, [0x006b6a51]
mov ebx, 0x16
add rsp, 0x38
pop rbp
ret
lea rax, [0x006b393a]
mov ebx, 0xf
add rsp, 0x38
pop rbp
ret
lea rax, [0x006b2fb3]
mov ebx, 0xd
add rsp, 0x38
pop rbp
ret
lea rax, [0x006b2fa6]
mov ebx, 0xd
add rsp, 0x38
pop rbp
ret
mov rax, rsi
call fcn.00466a20
mov edx, 0x2e
call fcn.004669a0
mov ecx, 5
call fcn.00466960
mov rax, rsi
mov ecx, 5
call fcn.00466960
nop
mov word [rsp + 8], ax
call fcn.004646a0
movzx eax, word [rsp + 8]
jmp fcn.005b4b40
Function at 0x5bc7c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5bc9f2
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp word [rax + 0x48], 0x304
jne 0x5bc9e7
mov qword [rsp + 0x70], rax
xor ebx, ebx
xor ecx, ecx
call fcn.005bb200
test rcx, rcx
jne 0x5bc9db
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x350]
inc rdx
mov qword [rcx + 0x350], rdx
cmp rdx, 0x10
jg 0x5bc8b8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rbx
nop
test rax, rax
je 0x5bc86d
mov edx, dword [rax + 0x10]
cmp edx, 0x657fdec6
jne 0x5bc84b
lea rdx, [0x0066ec80]
cmp rax, rdx
jne 0x5bc86d
mov rax, rcx
nop
call fcn.005bca20
add rsp, 0x60
pop rbp
ret
cmp edx, 0x82cd91e9
jne 0x5bc86d
lea rdx, [0x0066ed00]
cmp rax, rdx
jne 0x5bc86d
mov rax, rcx
call fcn.005c9080
add rsp, 0x60
pop rbp
ret
mov rax, rcx
mov ebx, 0xa
call fcn.005b9d20
movups xmmword [rsp + 0x50], xmm15
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rax, [0x006c26a6]
mov ebx, 0x35
lea rcx, [rsp + 0x50]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
add rsp, 0x60
pop rbp
ret
mov rax, rcx
mov ebx, 0xa
call fcn.005b9d20
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rsp + 0x40], rax
mov qword [rax + 8], 0x23
lea rcx, [0x006bcc0d]
mov qword [rax], rcx
lea rbx, [0x00728640]
mov rcx, rax
lea rax, [0x00675780]
call fcn.0040b0a0
nop
test rax, rax
jne 0x5bc94a
lea rcx, [0x00728640]
mov rdx, qword [rsp + 0x70]
mov qword [rdx + 0x180], rcx
cmp dword [0x00921500], 0
nop
jne 0x5bc929
mov rcx, qword [rsp + 0x40]
jmp 0x5bc941
call fcn.004665c0
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rsi, qword [rdx + 0x188]
mov qword [r11 + 8], rsi
mov qword [rdx + 0x188], rcx
jmp 0x5bc9c7
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rax
lea rax, [0x00674e80]
nop dword [rax + rax]
call fcn.0040d680
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
cmp dword [0x00921500], 0
jne 0x5bc980
mov rcx, qword [rsp + 0x38]
jmp 0x5bc98d
call fcn.004665a0
mov rcx, qword [rsp + 0x38]
mov qword [r11], rcx
mov qword [rax + 8], rcx
lea rcx, [0x007289e0]
mov rdx, qword [rsp + 0x70]
mov qword [rdx + 0x180], rcx
cmp dword [0x00921500], 0
je 0x5bc9c0
call fcn.004665c0
mov qword [r11], rax
mov rcx, qword [rdx + 0x188]
mov qword [r11 + 8], rcx
mov qword [rdx + 0x188], rax
mov rax, qword [rdx + 0x180]
mov rbx, qword [rdx + 0x188]
add rsp, 0x60
pop rbp
ret
mov rax, rcx
mov rbx, rdi
add rsp, 0x60
pop rbp
ret
call fcn.005bc3e0
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.005bc7c0
Function at 0x5bd520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5bd62a
push rbp
mov rbp, rsp
sub rsp, 0x50
jmp 0x5bd537
mov rax, rbx
mov ecx, dword [rax + 0x358]
bt ecx, 0
jb 0x5bd616
mov edx, ecx
or ecx, 1
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx + 0x358], ecx
sete cl
nop dword [rax]
test cl, cl
je 0x5bd534
test edx, edx
jne 0x5bd603
mov ecx, dword [rbx + 0x28]
test ecx, ecx
jne 0x5bd579
xor eax, eax
xor ecx, ecx
jmp 0x5bd5ce
mov qword [rsp + 0x38], rbx
mov rax, rbx
call fcn.005bd640
test rax, rax
je 0x5bd5c2
movups xmmword [rsp + 0x40], xmm15
je 0x5bd597
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x006c4c38]
mov ebx, 0x4c
lea rcx, [rsp + 0x40]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
nop
jmp 0x5bd5c6
xor eax, eax
xor ebx, ebx
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov rdx, qword [rbx]
mov rbx, qword [rbx + 8]
mov rdx, qword [rdx + 0x18]
mov rax, rbx
call rdx
test rax, rax
je 0x5bd5f3
add rsp, 0x50
pop rbp
ret
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov rcx, qword [rcx + 0x18]
call rcx
add rsp, 0x50
pop rbp
ret
mov rax, qword [0x008bdea0]
mov rbx, qword [0x008bdea8]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.005bd520
Function at 0x5c0e20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c0efd
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
movzx edx, word [rbx + 0xa0]
movzx r8d, word [rbx + 0x18]
mov word [rsp + 0x2e], 0
test dx, dx
cmovne r8w, dx
mov word [rsp + 0x2c], r8w
mov word [rsp + 0x2e], r8w
mov rdx, qword [rax + 0x50]
mov ebx, 1
lea rcx, [rsp + 0x2e]
mov edi, 1
mov rsi, rdi
mov rax, rdx
call fcn.005b4500
nop dword [rax]
test bl, bl
je 0x5c0ea9
mov rcx, qword [rsp + 0x50]
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 1
mov word [rcx + 0x190], ax
mov word [rcx + 0x228], ax
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
mov rax, qword [rsp + 0x50]
mov ebx, 0x46
call fcn.005b9d20
movups xmmword [rsp + 0x30], xmm15
movzx eax, word [rsp + 0x2c]
call fcn.0040ace0
lea rcx, [0x0065bc20]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x006c2504]
mov ebx, 0x34
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005c0e20

Function at 0x5c1b60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c1c3e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x50]
mov rcx, qword [rcx + 0x58]
movzx edx, word [rdx + 0x50]
xor ebx, ebx
jmp 0x5c1b8d
inc rbx
cmp rbx, rcx
jge 0x5c1bae
movzx edi, word [rsi + rbx*2]
cmp di, dx
jne 0x5c1b8a
nop
mov rcx, qword [0x008bf200]
mov rdx, qword [0x008bf208]
xor ebx, ebx
jmp 0x5c1c24
xor ecx, ecx
cmp dword [0x00921500], 0
je 0x5c1bc9
call fcn.004665c0
mov qword [r11], rcx
mov rdx, qword [rax + 0x28]
mov qword [r11 + 8], rdx
mov qword [rax + 0x28], rcx
test rcx, rcx
je 0x5c1be6
mov rdx, qword [rax]
movzx ecx, word [rcx]
mov word [rdx + 0x62], cx
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
mov rax, qword [rax]
mov ebx, 0x28
call fcn.005b9d20
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x2e
lea rcx, [0x006c0b38]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x10
pop rbp
ret
inc rbx
cmp rbx, rdx
jge 0x5c1c34
mov rsi, qword [rcx + rbx*8]
cmp word [rsi], di
jne 0x5c1c21
jmp 0x5c1c36
xor esi, esi
mov rcx, rsi
jmp 0x5c1bb0
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.005c1b60
Function at 0x5c36a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xc0]
cmp r12, qword [r14 + 0x10]
jbe 0x5c3981
push rbp
mov rbp, rsp
sub rsp, 0x138
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x158], rcx
mov rdx, qword [rax]
mov qword [rsp + 0x98], rdx
mov rax, rdx
mov ebx, 1
call fcn.005b6d20
test rax, rax
jne 0x5c3887
mov rax, qword [rsp + 0x98]
xor ebx, ebx
xor ecx, ecx
call fcn.005bb200
test rcx, rcx
jne 0x5c3878
lea rdx, [0x0066ef80]
cmp rax, rdx
jne 0x5c3722
mov rcx, rbx
nop
jmp 0x5c372a
mov rcx, rbx
mov ebx, 0
mov qword [rsp + 0x90], rbx
jne 0x5c37db
mov rsi, qword [rsp + 0x148]
mov rdx, qword [rsi + 0x30]
lea r8, [rsi + 0x38]
mov qword [rsp + 0xd0], rdx
lea rdi, [rsp + 0xd8]
mov rax, rsi
mov rsi, r8
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466fec
mov rbp, qword [rbp]
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rax + 0x98]
mov rbx, qword [rax + 0xa0]
mov rcx, qword [rax + 0xa8]
mov qword [rsp], rdx
lea rdi, [rsp + 8]
lea rsi, [rsp + 0xd8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466fec
mov rbp, qword [rbp]
mov rax, r8
call fcn.005e3200
mov rdx, qword [rsp + 0x90]
cmp qword [rdx + 0x20], rbx
jne 0x5c3890
mov rsi, qword [rdx + 0x18]
xor ecx, ecx
xor edi, edi
jmp 0x5c38e9
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xa0], rcx
mov rax, qword [rsp + 0x98]
mov ebx, 0xa
call fcn.005b9d20
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0xb0], rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xb8], rcx
lea rcx, [0x0066ef80]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0xc8], rcx
lea rax, [0x006c4a32]
mov ebx, 0x49
lea rcx, [rsp + 0xb0]
mov edi, 2
mov rsi, rdi
call fcn.004dd6a0
add rsp, 0x138
pop rbp
ret
mov rax, rcx
mov rbx, rdi
add rsp, 0x138
pop rbp
ret
add rsp, 0x138
pop rbp
ret
mov rax, qword [rsp + 0x98]
mov ebx, 0x28
nop dword [rax]
call fcn.005b9d20
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x2c
lea rcx, [0x006c0132]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x138
pop rbp
ret
movzx r8d, byte [rcx + rax]
movzx r9d, byte [rcx + rsi]
xor r8d, r9d
inc rcx
or edi, r8d
cmp rbx, rcx
jg 0x5c38d6
movzx esi, dil
dec esi
shr esi, 0x1f
nop
cmp rsi, 1
jne 0x5c3890
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rax
mov rdi, qword [rsp + 0x148]
add rdi, 0x30
lea rax, [0x007296f8]
mov rbx, rdx
lea rcx, [0x00728920]
call fcn.005de3a0
test rax, rax
jne 0x5c3977
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x158]
cmp rdx, rcx
cmovl rcx, rdx
mov rbx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x150]
nop dword [rax]
cmp rbx, rax
je 0x5c396a
call fcn.00467360
xor eax, eax
xor ebx, ebx
add rsp, 0x138
pop rbp
ret
add rsp, 0x138
pop rbp
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005c36a0
Function at 0x5c39c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c3b3e
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdx, qword [rax + 0x18]
cmp byte [rdx + 0x54], 0
nop word [rax + rax]
je 0x5c3b34
mov rdx, qword [rax + 0x20]
mov rsi, qword [rax]
cmp byte [rdx + 0xc8], 0
je 0x5c3af9
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x28], rsi
lea rcx, [rax + 0x30]
lea rbx, [0x00728920]
mov rax, rsi
call fcn.005bb200
nop word [rax + rax]
test rcx, rcx
jne 0x5c3aed
lea rcx, [0x0066f180]
cmp rax, rcx
jne 0x5c3a84
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
mov rsi, qword [rbx + 0x18]
mov rdi, qword [rsp + 0x70]
mov qword [rdi + 0xc0], rcx
mov qword [rdi + 0xc8], rdx
cmp dword [0x00921500], 0
je 0x5c3a73
nop dword [rax]
call fcn.004665c0
mov qword [r11], rsi
mov rcx, qword [rdi + 0xb8]
mov qword [r11 + 8], rcx
mov qword [rdi + 0xb8], rsi
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x28]
mov ebx, 0xa
call fcn.005b9d20
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x48], rcx
lea rcx, [0x0066f180]
mov qword [rsp + 0x50], rcx
lea rax, [0x006c4a32]
mov ebx, 0x49
lea rcx, [rsp + 0x40]
mov edi, 2
mov rsi, rdi
call fcn.004dd6a0
add rsp, 0x60
pop rbp
ret
mov rax, rcx
mov rbx, rdi
add rsp, 0x60
pop rbp
ret
mov rax, rsi
mov ebx, 0x2f
call fcn.005b9d20
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x2b
lea rcx, [0x006bfc71]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x60
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.005c39c0
Function at 0x5cf380
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5cf5a6
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0xa0], rbx
mov rdx, qword [rax + 0x1e8]
cmp rcx, rdx
jne 0x5cf3ba
mov rsi, qword [rax + 0x1e0]
xor r8d, r8d
jmp 0x5cf3ee
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x2f
lea rcx, [0x006c1106]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x88
pop rbp
ret
inc r8
cmp r8, rdx
jge 0x5cf437
lea r9, [r8 + r8*2]
mov r10, qword [rbx + r9*8 + 8]
mov r9, qword [rsi + r9*8 + 8]
cmp r9, r10
je 0x5cf3eb
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x2f
lea rcx, [0x006c1106]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x88
pop rbp
ret
mov qword [rax + 0x1e8], rcx
mov qword [rax + 0x1f0], rdi
cmp dword [0x00921500], 0
je 0x5cf461
call fcn.004665c0
mov qword [r11], rbx
mov rcx, qword [rax + 0x1e0]
mov qword [r11 + 8], rcx
mov qword [rax + 0x1e0], rbx
cmp qword [rax], 0
je 0x5cf57a
mov qword [rsp + 0x98], rax
call fcn.005cf2e0
nop
test rdi, rdi
jne 0x5cf587
mov rsi, qword [rsp + 0x98]
mov rdx, qword [rsi + 0x10]
cmp rbx, rdx
ja 0x5cf59b
mov r8, qword [rsi]
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466c90
mov rbp, qword [rbp]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x58], 1
movups xmmword [rsp + 0x20], xmm15
lea rdx, [0x005cf5e0]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x30]
mov ebx, 2
xor ecx, ecx
lea rdi, [rsp + 0x20]
call fcn.0054bd00
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x5cf522
xor ecx, ecx
jmp 0x5cf536
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x68]
cmp rax, rcx
ja 0x5cf596
sub rcx, rax
xor edx, edx
test rdx, rdx
jne 0x5cf549
mov rdx, qword [rsp + 0x98]
cmp qword [rdx + 8], rcx
je 0x5cf57a
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x2d
lea rcx, [0x006c0587]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x88
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x88
pop rbp
ret
mov rax, rdi
mov rbx, rsi
add rsp, 0x88
pop rbp
ret
call fcn.00466a20
mov rcx, rbx
nop
call fcn.004669e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005cf380
Function at 0x5d70a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5d72be
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov rdx, qword [rax]
nop dword [rax]
test rdx, rdx
jne 0x5d728d
movups xmmword [rsp + 0x48], xmm15
lea rdi, [rsp + 0x50]
lea rdi, [rdi - 0x30]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466c90
mov rbp, qword [rbp]
nop
cmp qword [rsp + 0x78], 0
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0x18
jne 0x5d72aa
mov qword [rsp + 0xb0], rax
cmp byte [rsp + 0x70], 0
je 0x5d7162
mov rdx, qword [rsp + 0x60]
inc rdx
cmp qword [rsp + 0x68], rdx
jge 0x5d7162
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x36
lea rcx, [0x006c2a9c]
mov qword [rax], rcx
lea rcx, [0x00728640]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
nop
jmp 0x5d71c1
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
lea rdx, [rbx + 1]
mov r8, qword [rsp + 0x58]
cmp rcx, rdx
jae 0x5d71a9
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 1
lea rsi, [0x0065bae0]
call fcn.0044b880
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rsp + 0x2f]
mov byte [r8 + rbx], sil
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], r8
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x005d72e0]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x38]
lea rax, [rsp + 0x48]
call fcn.0054bd00
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x5d7207
mov r8, qword [rsp + 0x50]
xor r11d, r11d
xor ecx, ecx
xor r9d, r9d
jmp 0x5d7242
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x80]
cmp rax, rcx
ja 0x5d72a5
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x68]
sub r10, rax
mov r11, r10
neg r10
sar r10, 0x3f
and r10, rax
sub rcx, rax
add r9, r10
xor edx, edx
xor r8d, r8d
mov r10, qword [rsp + 0xb0]
mov qword [r10 + 8], rcx
mov qword [r10 + 0x10], r11
cmp dword [0x00921500], 0
je 0x5d7272
mov rax, r11
nop
call fcn.004665c0
mov qword [r11], r9
mov r12, qword [r10]
mov qword [r11 + 8], r12
mov r11, rax
mov qword [r10], r9
mov rax, r9
mov rbx, rcx
mov rcx, r11
mov rdi, rdx
mov rsi, r8
add rsp, 0xa0
pop rbp
ret
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rax, rdx
xor edi, edi
xor esi, esi
add rsp, 0xa0
pop rbp
ret
call fcn.00466a20
lea rax, [0x0065b7a0]
lea rbx, [0x007279c0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.005d70a0
Function at 0x5de4a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5de71c
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rcx
lea rax, [0x0065bae0]
mov ebx, 0x30
mov rcx, rbx
call fcn.0044b7a0
mov rdx, qword [rsp + 0x70]
movzx esi, word [rdx + 0x18]
shr si, 8
mov byte [rax], sil
movzx edx, word [rdx + 0x18]
mov byte [rax + 1], dl
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx]
test rsi, rsi
je 0x5de4ff
mov r9, qword [rdx + 8]
jmp 0x5de50d
mov rsi, qword [0x008cc3c0]
mov r9, qword [0x008cc3c8]
mov qword [rsp + 0x50], rax
lea rcx, [rax + 2]
mov rbx, r9
mov edi, 0x2e
mov r8, rdi
mov rax, rsi
mov rsi, rdi
call fcn.00482a20
test rbx, rbx
jne 0x5de6e8
lea rdx, [0x00670d00]
mov r9, qword [rsp + 0x78]
cmp qword [r9 + 0xa0], rdx
jne 0x5de6b1
mov rdx, qword [rsp + 0x68]
mov r10, qword [rdx]
test r10, r10
je 0x5de562
mov rdx, qword [rdx + 8]
nop
jmp 0x5de570
mov r10, qword [0x008cc3c0]
mov rdx, qword [0x008cc3c8]
mov rcx, qword [r9 + 0xa8]
mov rax, r10
mov rbx, rdx
mov rdi, qword [rsp + 0x50]
mov esi, 0x30
mov r8, rsi
call fcn.00553f20
test rdi, rdi
jne 0x5de69c
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rax
lea rax, [0x0067e040]
call fcn.0040d680
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x30]
lea rbx, [rcx + 2]
mov qword [rsp + 0x38], rbx
lea rax, [0x0065bae0]
mov rcx, rbx
call fcn.0044b7a0
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], rcx
cmp dword [0x00921500], 0
je 0x5de5fb
call fcn.004665c0
mov qword [r11], rax
mov rdx, qword [rdi + 0x18]
mov qword [r11 + 8], rdx
mov qword [rdi + 0x18], rax
nop
test rcx, rcx
jbe 0x5de711
mov rdx, qword [rdi + 0x18]
mov r9, qword [rsp + 0x30]
mov r10, r9
sar r9, 8
mov byte [rdx], r9b
mov rcx, qword [rdi + 0x20]
cmp rcx, 1
jbe 0x5de707
mov rdx, qword [rdi + 0x18]
mov byte [rdx + 1], r10b
mov rcx, qword [rdi + 0x20]
nop word [rax + rax]
nop
cmp rcx, 2
jb 0x5de6fd
mov rdx, qword [rdi + 0x18]
mov r9, qword [rdi + 0x28]
add rcx, 0xfffffffffffffffe
add r9, 0xfffffffffffffffe
neg r9
sar r9, 0x3f
and r9d, 2
lea rax, [rdx + r9]
cmp r10, rcx
cmovl rcx, r10
mov rbx, qword [rsp + 0x40]
cmp rbx, rax
je 0x5de684
call fcn.00467360
mov rdi, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov ebx, 0x30
mov rcx, rbx
xor esi, esi
xor r8d, r8d
add rsp, 0x58
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
mov r8, rsi
mov rsi, rdi
xor edi, edi
add rsp, 0x58
pop rbp
ret
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x4c
lea rcx, [0x006c4c84]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
xor edi, edi
lea rsi, [0x00728640]
mov r8, rax
xor eax, eax
add rsp, 0x58
pop rbp
ret
xor eax, eax
xor edi, edi
mov rsi, rbx
mov r8, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x58
pop rbp
ret
mov eax, 2
call fcn.00466a20
mov eax, 1
call fcn.00466960
xor eax, eax
mov rcx, rax
call fcn.00466960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.005de4a0