joyce8/EMBER2024-capa huggingface dataset:
Function at 0x587b80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x587ce6
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x98], r8
mov rax, rsi
mov rbx, r8
lea rcx, [0x006a41dd]
mov edi, 1
nop dword [rax + rax]
call fcn.00505180
test rax, rax
jl 0x587cbd
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
nop
call fcn.00587320
test sil, sil
je 0x587c61
mov rdx, qword [rsp + 0x30]
cmp rbx, rdx
je 0x587c18
xor eax, eax
jmp 0x587c53
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov rbx, rax
mov rcx, rdx
mov rax, qword [rsp + 0x48]
call fcn.00402d80
test al, al
jne 0x587c3a
xor eax, eax
jmp 0x587c53
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
call fcn.00504ee0
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
movups xmmword [rsp + 0x50], xmm15
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x006b4cca]
mov ebx, 0x30
lea rcx, [rsp + 0x50]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
call fcn.00587f80
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00587b80
Function at 0x587d40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x587f46
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov rdx, qword [rax + 0x30]
mov rsi, qword [rax + 0x28]
test rdx, rdx
je 0x587ef0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov rax, rsi
mov rbx, rdx
lea rcx, [0x007169c0]
mov edi, 1
call fcn.00505180
nop
test rax, rax
jge 0x587da9
xor eax, eax
jmp 0x587dcf
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
lea rax, [rsi + rdx]
lea rax, [rax - 1]
lea rbx, [0x00716b18]
mov ecx, 1
call fcn.00402d80
xor eax, 1
test al, al
jne 0x587ddf
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
jmp 0x587dfa
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0x28]
mov rbx, qword [rcx + 0x30]
call fcn.00561780
test rsi, rsi
jne 0x587ede
nop word [rax + rax]
cmp rbx, 1
jl 0x587e0e
cmp byte [rax], 0x5b
sete dl
jmp 0x587e10
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
test dl, dl
je 0x587e54
nop
cmp rbx, 1
jge 0x587e2a
xor ecx, ecx
jmp 0x587e56
lea rdx, [rax + rbx]
lea rdx, [rdx - 1]
mov ecx, 1
mov rax, rdx
lea rbx, [0x00716b18]
call fcn.00402d80
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x30]
jmp 0x587e56
xor ecx, ecx
test cl, cl
jne 0x587e65
call fcn.00560280
nop
test rax, rax
je 0x587ebb
mov rax, qword [rsp + 0x58]
call fcn.00574ae0
movups xmmword [rsp + 0x38], xmm15
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x006b5dc1]
mov ebx, 0x36
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
call fcn.00587f80
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
mov rbx, rsi
mov rcx, r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00574ae0
movups xmmword [rsp + 0x38], xmm15
nop dword [rax + rax]
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x006b70ab]
mov ebx, 0x3e
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00587d40
Function at 0x587f80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5881ac
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
test rdi, rdi
je 0x588127
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
call fcn.00587880
test dil, dil
je 0x5880cb
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x98]
movzx edx, byte [rcx]
mov byte [rsp + 0x2f], dl
cmp dl, 0x2e
jne 0x58801a
mov rdi, qword [rsp + 0xa0]
dec rdi
mov rsi, rdi
neg rdi
sar rdi, 0x3f
and edi, 1
add rcx, rdi
jmp 0x588022
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rsi
mov rax, rcx
mov rbx, rsi
call fcn.00587880
test dil, dil
je 0x588075
mov rdx, qword [rsp + 0x38]
cmp rdx, rbx
jl 0x588065
movzx esi, byte [rsp + 0x2f]
cmp sil, 0x2e
jne 0x588056
cmp rdx, rbx
je 0x588065
mov qword [rsp + 0x40], rbx
xor ecx, ecx
nop dword [rax]
jmp 0x588150
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006b393f]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006b393f]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rax, qword [rsp + 0x58]
add rax, 0x10
mov rcx, qword [rsp + 0x30]
inc rcx
mov rbx, qword [rsp + 0x40]
cmp rbx, rcx
jle 0x588199
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x58], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
shl rcx, 4
mov r8, qword [rsp + 0x50]
mov r9, qword [r8 + rcx]
mov rdi, qword [r8 + rcx + 8]
mov rcx, r9
mov rax, rdx
nop
call fcn.00504ee0
test al, al
jne 0x58813a
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00587f80
Function at 0x58ca40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58caf7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
lea rdx, [rax - 1]
cmp rdx, 4
jae 0x58ca82
shl rax, 4
lea rdx, [0x00898080]
mov rsi, qword [rdx + rax + 8]
mov rdx, qword [rdx + rax]
jmp 0x58ca93
nop
mov ebx, 0xa
call fcn.0047dfc0
mov rsi, rbx
mov rdx, rax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
mov rax, rdx
mov rbx, rsi
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rax, [0x006b8713]
mov ebx, 0x54
lea rcx, [rsp + 0x28]
mov edi, 2
mov rsi, rdi
call fcn.004f54c0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0058ca40
Function at 0x59dbe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59ddbd
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
cmp ax, 0x501
ja 0x59dc31
nop
cmp ax, 0x203
ja 0x59dc17
cmp ax, 0x201
je 0x59dc4a
cmp ax, 0x203
je 0x59dc57
jmp 0x59dd6f
cmp ax, 0x401
je 0x59dc4a
nop dword [rax]
cmp ax, 0x403
je 0x59dc57
cmp ax, 0x501
je 0x59dc4a
jmp 0x59dd6f
cmp ax, 0x601
ja 0x59dc51
cmp ax, 0x503
je 0x59dc57
nop dword [rax]
cmp ax, 0x601
jne 0x59dd6f
mov ecx, 0xffffffe1
jmp 0x59dc80
cmp ax, 0x603
jne 0x59dc5e
mov ecx, 0xffffffe3
jmp 0x59dc80
lea edx, [rax - 0x804]
cmp dx, 2
ja 0x59dc71
mov ecx, 0xffffffe2
jmp 0x59dc80
cmp ax, 0x807
jne 0x59dd6f
mov ecx, 0xffffffe4
cmp ax, 0x503
ja 0x59dcc0
cmp ax, 0x401
ja 0x59dca8
cmp ax, 0x201
je 0x59dc98
cmp ax, 0x203
jne 0x59dca0
mov edx, 3
jmp 0x59dd0d
cmp ax, 0x401
je 0x59dcd8
jmp 0x59dd21
cmp ax, 0x403
je 0x59dcd8
cmp ax, 0x501
je 0x59dce6
cmp ax, 0x503
je 0x59dce6
jmp 0x59dd21
cmp ax, 0x804
ja 0x59dce0
cmp ax, 0x601
je 0x59dcf3
cmp ax, 0x603
je 0x59dcf3
cmp ax, 0x804
jne 0x59dd21
mov edx, 5
jmp 0x59dd0d
cmp ax, 0x805
jne 0x59dced
mov edx, 6
jmp 0x59dd0d
cmp ax, 0x806
jne 0x59dd00
mov edx, 7
jmp 0x59dd0d
cmp ax, 0x807
jne 0x59dd21
mov rdx, qword [0x008f28e8]
mov eax, ecx
mov rbx, rdx
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
movups xmmword [rsp + 0x28], xmm15
call fcn.0040ae40
lea rcx, [0x0065dac0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006b08aa]
mov ebx, 0x23
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
call fcn.0040ae40
lea rcx, [0x0065dac0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006b08aa]
mov ebx, 0x23
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov word [rsp + 8], ax
call fcn.004632e0
movzx eax, word [rsp + 8]
jmp fcn.0059dbe0
Function at 0x59dde0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59def3
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
test rax, rax
je 0x59deb1
mov edx, dword [rax + 0x10]
cmp edx, 0x4bcec15d
jne 0x59de41
lea rdx, [0x00666120]
nop dword [rax]
cmp rax, rdx
jne 0x59deb1
mov eax, 0xffffffe1
mov ebx, 8
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp edx, 0x8c7bd38d
jne 0x59de6d
lea rdx, [0x006885a0]
cmp rax, rdx
jne 0x59deb1
mov eax, 0xffffffe3
mov ebx, 3
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp edx, 0xc0d9e4a4
jne 0x59deb1
lea rdx, [0x006620c0]
nop dword [rax]
cmp rax, rdx
jne 0x59deb1
lea rax, [0x006b6850]
mov ebx, 0x39
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.004f54c0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
lea rax, [0x006aeb73]
mov ebx, 0x1f
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004f54c0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0059dde0
Function at 0x59e460
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59e565
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov word [rsp + 0x30], ax
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
call fcn.0059df20
test rbx, rbx
je 0x59e4dd
mov rdx, qword [rsp + 0x48]
nop dword [rax + rax]
test rdx, rdx
jne 0x59e4d4
movzx esi, word [rsp + 0x30]
cmp si, 0x303
jne 0x59e4cd
mov dword [rsp + 0x14], 0
mov dword [rsp + 0x14], 0x2030201
mov edx, 2
lea rcx, [rsp + 0x14]
jmp 0x59e4d9
mov rcx, qword [rsp + 0x40]
jmp 0x59e4d9
mov rcx, qword [rsp + 0x40]
xor esi, esi
jmp 0x59e500
mov rax, qword [rsp + 0x18]
call fcn.0059e5c0
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
inc rsi
nop dword [rax]
cmp rsi, rdx
jge 0x59e50e
movzx edi, word [rcx + rsi*2]
xor r8d, r8d
jmp 0x59e545
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x47
lea rcx, [0x006b7dc0]
mov qword [rax], rcx
lea rbx, [0x007191c0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
inc r8
cmp rbx, r8
jle 0x59e4f9
movzx r9d, word [rax + r8*2]
cmp r9w, di
jne 0x59e542
mov eax, edi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov word [rsp + 8], ax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.004632e0
movzx eax, word [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.0059e460
Function at 0x5a08a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x5a0b1c
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
movzx edx, word [rax + 0x30]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
mov rsi, qword [rax + 0x28]
mov eax, edx
call fcn.0059e460
test rbx, rbx
jne 0x5a092e
mov rdx, qword [rsp + 0xa0]
cmp qword [rdx + 8], 0
nop
je 0x5a091a
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
mov qword [rsp + 0x48], r8
xor eax, eax
jmp 0x5a094b
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov rax, rbx
mov rbx, rcx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
add rdi, 0x18
inc rax
cmp rax, r8
jge 0x5a0a55
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x68], rdi
mov r9, qword [rdi]
mov rbx, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
mov r10, qword [rsi + 0x70]
test rax, rax
jne 0x5a0977
test r10, r10
jne 0x5a09a7
mov rax, r9
call fcn.00584da0
nop
test rbx, rbx
jne 0x5a09bf
mov rdx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x48]
mov r10, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], r10
mov r9, qword [rdx]
mov r11, qword [rdx + 8]
mov qword [rsp + 0x40], r11
xor ecx, ecx
jmp 0x5a0aa0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x58], rcx
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.0040af40
lea rcx, [0x00656f20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x30]
nop dword [rax + rax]
test rcx, rcx
je 0x5a0a0b
mov rbx, qword [rcx + 8]
jmp 0x5a0a0e
mov rbx, rcx
mov qword [rsp + 0x80], rbx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x88], rdx
lea rax, [0x006b49ca]
mov ebx, 0x30
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
nop dword [rax]
call fcn.004f54c0
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
lea rax, [0x0066df60]
nop dword [rax]
call fcn.0040d960
mov qword [rax + 8], 0x27
lea rcx, [0x006b1d72]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
add r9, 0x18
inc rcx
nop dword [rax + rax]
cmp rcx, r11
jge 0x5a0944
mov rbx, qword [r9]
mov r12, qword [r10 + 0x68]
mov r13, qword [r10 + 0x60]
cmp qword [r9 + 8], r12
jne 0x5a0a91
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x60], r9
mov rax, r13
mov rcx, r12
call fcn.00402d80
test al, al
jne 0x5a0b08
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x40]
jmp 0x5a0a91
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005a08a0
Function at 0x5a87e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a8a37
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
cmp word [rax + 0x40], 0x304
nop
jne 0x5a8a28
mov qword [rsp + 0x70], rax
xor ebx, ebx
xor ecx, ecx
call fcn.005a71c0
test rcx, rcx
jne 0x5a8a18
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x338]
inc rdx
mov qword [rcx + 0x338], rdx
cmp rdx, 0x10
jg 0x5a88ef
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
test rax, rax
je 0x5a889d
mov edx, dword [rax + 0x10]
cmp edx, 0x657fdec6
jne 0x5a8877
lea rdx, [0x00666920]
nop
cmp rax, rdx
jne 0x5a889d
mov rax, rcx
call fcn.005a8a60
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
cmp edx, 0x82cd91e9
jne 0x5a889d
lea rdx, [0x00666a20]
cmp rax, rdx
jne 0x5a889d
mov rax, rcx
call fcn.005b3980
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, rcx
mov ebx, 0xa
call fcn.005a5fe0
movups xmmword [rsp + 0x50], xmm15
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x58], rcx
lea rax, [0x006b5d57]
mov ebx, 0x35
lea rcx, [rsp + 0x50]
mov edi, 1
mov rsi, rdi
nop dword [rax]
call fcn.004f54c0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, rcx
mov ebx, 0xa
call fcn.005a5fe0
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rsp + 0x38], rax
mov qword [rax + 8], 0x23
lea rcx, [0x006b07fb]
mov qword [rax], rcx
lea rbx, [0x007191c0]
mov rcx, rax
lea rax, [0x0066e1e0]
call fcn.0040b260
test rax, rax
jne 0x5a8983
lea rcx, [0x007191c0]
mov rdi, qword [rsp + 0x70]
mov qword [rdi + 0x178], rcx
cmp dword [0x008f2cf0], 0
jne 0x5a8967
mov rcx, qword [rsp + 0x38]
mov qword [rdi + 0x180], rcx
jmp 0x5a8a00
lea rcx, [rdi + 0x180]
mov rax, rdi
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.004655c0
mov rdi, rax
jmp 0x5a8a00
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
lea rax, [0x0066de60]
call fcn.0040d960
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
cmp dword [0x008f2cf0], 0
jne 0x5a89b5
mov rcx, qword [rsp + 0x30]
mov qword [rax + 8], rcx
jmp 0x5a89c5
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x30]
nop
call fcn.004655a0
lea rcx, [0x00719180]
mov rdi, qword [rsp + 0x70]
mov qword [rdi + 0x178], rcx
cmp dword [0x008f2cf0], 0
nop
jne 0x5a89eb
mov qword [rdi + 0x180], rax
jmp 0x5a8a00
lea rcx, [rdi + 0x180]
mov rdx, rdi
mov rdi, rcx
call fcn.004654a0
mov rdi, rdx
mov rax, qword [rdi + 0x178]
mov rbx, qword [rdi + 0x180]
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.005a83a0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.005a87e0
Function at 0x5a9460
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a957f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
jmp 0x5a947d
mov rax, rbx
mov ecx, dword [rax + 0x340]
bt ecx, 0
jb 0x5a9567
mov edx, ecx
or ecx, 1
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx + 0x340], ecx
sete cl
test cl, cl
je 0x5a947a
test edx, edx
jne 0x5a9550
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jne 0x5a94bb
xor eax, eax
xor ecx, ecx
jmp 0x5a9513
mov qword [rsp + 0x38], rbx
mov rax, rbx
call fcn.005a95a0
test rax, rax
je 0x5a9507
movups xmmword [rsp + 0x40], xmm15
je 0x5a94d9
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x006b812b]
mov ebx, 0x4c
lea rcx, [rsp + 0x40]
mov edi, 1
mov rsi, rdi
nop dword [rax]
call fcn.004f54c0
jmp 0x5a950b
xor eax, eax
xor ebx, ebx
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov rdx, qword [rbx]
mov rbx, qword [rbx + 8]
mov rdx, qword [rdx + 0x18]
mov rax, rbx
call rdx
test rax, rax
je 0x5a953c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov rcx, qword [rcx + 0x18]
call rcx
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [0x00892b90]
mov rbx, qword [0x00892b98]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.005a9460
Function at 0x5ac880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ac96f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
movzx edx, word [rbx + 0x18]
movzx r8d, word [rbx + 0x98]
test r8w, r8w
cmovne dx, r8w
mov word [rsp + 0x2c], dx
mov word [rsp + 0x2e], 0
mov word [rsp + 0x2e], dx
mov r8, qword [rax + 0x48]
mov ebx, 1
lea rcx, [rsp + 0x2e]
mov edi, 1
mov rsi, rdi
mov rax, r8
nop dword [rax]
call fcn.005a07e0
test bl, bl
je 0x5ac912
mov rcx, qword [rsp + 0x50]
mov word [rcx + 0x40], ax
mov byte [rcx + 0x42], 1
mov word [rcx + 0x188], ax
mov word [rcx + 0x218], ax
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x50]
mov ebx, 0x46
nop dword [rax]
call fcn.005a5fe0
movups xmmword [rsp + 0x30], xmm15
movzx eax, word [rsp + 0x2c]
call fcn.0040ae40
lea rcx, [0x006577e0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x006b5add]
mov ebx, 0x34
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
nop
call fcn.004f54c0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005ac880

Function at 0x5acfa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ad092
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x50]
mov rcx, qword [rcx + 0x58]
movzx edx, word [rdx + 0x50]
xor ebx, ebx
jmp 0x5acfd3
inc rbx
cmp rbx, rcx
jge 0x5acff9
movzx r8d, word [rsi + rbx*2]
nop dword [rax]
cmp r8w, dx
jne 0x5acfd0
nop
mov rcx, qword [0x00892e30]
mov rdx, qword [0x00892e38]
xor ebx, ebx
jmp 0x5ad072
xor ecx, ecx
cmp dword [0x008f2cf0], 0
jne 0x5ad00a
mov qword [rax + 0x28], rcx
jmp 0x5ad013
lea rdi, [rax + 0x28]
call fcn.004655a0
test rcx, rcx
je 0x5ad030
mov rdx, qword [rax]
movzx ecx, word [rcx]
mov word [rdx + 0x5a], cx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rax]
mov ebx, 0x28
call fcn.005a5fe0
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x2e
lea rcx, [0x006b4331]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
cmp rbx, rdx
jge 0x5ad088
mov rsi, qword [rcx + rbx*8]
nop dword [rax + rax]
cmp word [rsi], r8w
jne 0x5ad06f
jmp 0x5ad08a
xor esi, esi
mov rcx, rsi
jmp 0x5acffb
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.005acfa0