joyce8/EMBER2024-capa huggingface dataset:
Function at 0x530a20
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x530caf
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x128], rax
xor ecx, ecx
jmp 0x530a86
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
mov ecx, 1
cmp rcx, 1
jge 0x530b19
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x120], rax
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x100], xmm15
movups xmmword [rsp + 0x110], xmm15
test byte [rax], al
lea rbx, [rsp + 0xf8]
mov ecx, 0x28
call fcn.00402de0
test al, al
je 0x530a71
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xd8], xmm15
movups xmmword [rsp + 0xe8], xmm15
mov rax, qword [rsp + 0x120]
add rax, 0x28
lea rbx, [rsp + 0xd0]
mov ecx, 0x28
call fcn.00402de0
test al, al
je 0x530a71
jmp 0x530c9b
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
test byte [rax], al
lea rbx, [rax + 0x50]
lea rax, [rsp + 0x58]
call fcn.004eb140
lea rcx, [rsp + 0xa8]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x140]
mov qword [rsp + 8], rdx
lea rsi, [rsp + 0x58]
mov qword [rsp + 0x10], rsi
call fcn.004ecc00
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x80]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x140]
add rdx, 0x28
mov qword [rsp + 8], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x10], rdx
call fcn.004ecc00
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x148]
test byte [rcx], al
nop
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rax, [rsp + 0x80]
lea rbx, [rsp + 0x38]
call fcn.004ebaa0
cmp rbx, 0x20
mov ecx, 0x20
cmovl rcx, rbx
mov rdx, qword [rsp + 0x148]
cmp rax, rdx
je 0x530c37
mov rbx, rax
mov rax, rdx
call fcn.00466460
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rax, [rsp + 0xa8]
lea rbx, [rsp + 0x18]
call fcn.004ebaa0
test rbx, rbx
jbe 0x530c91
mov rdx, qword [rsp + 0x148]
movzx esi, byte [rdx + 0x1f]
movzx edi, byte [rax]
and edi, 1
shl rdi, 7
or esi, edi
mov byte [rdx + 0x1f], sil
mov rax, rdx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
xor eax, eax
mov rcx, rax
call fcn.00465aa0
lea rax, [0x00667a40]
lea rbx, [0x0072d960]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00530a20
Function at 0x5316a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x158]
cmp r12, qword [r14 + 0x10]
jbe 0x53183c
sub rsp, 0x1d8
mov qword [rsp + 0x1d0], rbp
lea rbp, [rsp + 0x1d0]
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f0], rcx
movups xmmword [rsp + 0x1c0], xmm15
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], rcx
xor edx, edx
jmp 0x531720
mov rdx, qword [rsp + 0x18]
inc rdx
mov rax, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x1e8]
nop
cmp rdx, 2
jge 0x53179e
mov qword [rsp + 0x18], rdx
mov rax, qword [rsp + rdx*8 + 0x1c0]
mov qword [rsp + 0x1b0], rax
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
test byte [rax], al
lea rbx, [rsp + 0x48]
mov ecx, 0x28
call fcn.00402de0
nop
test al, al
je 0x5316fe
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
mov rax, qword [rsp + 0x1b0]
add rax, 0x28
lea rbx, [rsp + 0x20]
mov ecx, 0x28
call fcn.00402de0
test al, al
je 0x5316fe
jmp 0x531828
lea rdi, [rsp + 0x110]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d74
mov rbp, qword [rbp]
lea rax, [rsp + 0x110]
mov rbx, rcx
call fcn.00531420
lea rdi, [rsp + 0x70]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d74
mov rbp, qword [rbp]
mov rbx, qword [rsp + 0x1e8]
mov rcx, rax
lea rax, [rsp + 0x70]
call fcn.00531880
mov rbx, rax
mov rax, qword [rsp + 0x1b8]
call fcn.005311a0
mov rbp, qword [rsp + 0x1d0]
add rsp, 0x1d8
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d960]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.005316a0
Function at 0x532600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x532751
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x70], rbx
xor ecx, ecx
jmp 0x53264f
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov ecx, 1
cmp rcx, 1
jge 0x5326bc
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
test byte [rax], al
lea rbx, [rsp + 0x40]
mov ecx, 0x28
nop dword [rax]
call fcn.00402de0
test al, al
je 0x53263a
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
mov rax, qword [rsp + 0x68]
add rax, 0x28
lea rbx, [rsp + 0x18]
mov ecx, 0x28
call fcn.00402de0
test al, al
je 0x53263a
jmp 0x53273d
test byte [rax], al
test byte [rbx], al
mov rdx, qword [0x008b4f20]
mov rcx, rbx
mov rbx, rdx
call fcn.004eb080
nop
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rcx + 0x28]
mov rax, qword [rsp + 0x88]
mov qword [rax + 0x28], rdx
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
nop
mov rdx, qword [rcx + 0x50]
mov qword [rax + 0x50], rdx
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rax + 0x58], xmm0
movups xmm0, xmmword [rcx + 0x68]
movups xmmword [rax + 0x68], xmm0
lea rdx, [rax + 0x78]
add rcx, 0x78
mov rbx, qword [0x008b4f20]
mov rax, rdx
call fcn.004eb080
mov rax, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d960]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00532600
Function at 0x532780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5328ae
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
nop dword [rax]
cmp rcx, 0x40
je 0x5327da
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x32
lea rcx, [0x006c9ddd]
mov qword [rax], rcx
lea rbx, [0x0072e7e0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov ecx, 0x15
call fcn.00532900
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
mov rdi, qword [rsp + 0x70]
lea rdx, [rdi - 0x15]
mov rbx, qword [rsp + 0x60]
lea rsi, [rbx + 0x15]
lea rax, [rsp + 0x20]
mov ecx, 0x15
mov rbx, rsi
mov rdi, rdx
call fcn.00532900
mov qword [rsp + 0x40], rax
test byte [rax], al
mov rcx, qword [0x008b4f08]
test byte [rcx], al
mov rbx, rax
call fcn.00532e60
mov rbx, qword [rsp + 0x58]
test byte [rbx], al
mov rax, rbx
mov rcx, qword [rsp + 0x40]
call fcn.00533840
mov rdi, qword [rsp + 0x70]
add rdi, 0xffffffffffffffd6
mov rbx, qword [rsp + 0x60]
add rbx, 0x2a
mov rax, qword [rsp + 0x40]
mov ecx, 0x16
call fcn.00532900
mov rcx, qword [0x008b4f10]
test byte [rcx], al
mov rax, qword [rsp + 0x40]
mov rbx, rax
call fcn.00532e60
mov rax, qword [rsp + 0x58]
mov rbx, rax
mov rcx, qword [rsp + 0x40]
call fcn.00533840
mov rax, qword [rsp + 0x58]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.00532780

Function at 0x532900
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x532995
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
nop dword [rax]
cmp rcx, 0x20
jge 0x532981
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rdx, [rsp + 0x18]
nop dword [rax]
cmp rbx, rdx
je 0x532957
mov rax, rdx
call fcn.00466460
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x18]
test byte [rax], al
mov rbx, rdx
nop dword [rax]
call fcn.00534760
mov rax, qword [rsp + 0x48]
mov rbx, rax
call fcn.00533da0
mov rax, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d970]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00532900
Function at 0x532b80
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xe0]
cmp r12, qword [r14 + 0x10]
jbe 0x532e2c
sub rsp, 0x160
mov qword [rsp + 0x158], rbp
lea rbp, [rsp + 0x158]
mov qword [rsp + 0x270], rbx
lea rdi, [rsp + 0x168]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d54
mov rbp, qword [rbp]
nop
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
lea rbx, [rsp + 0x10]
call fcn.00532b00
cmp rbx, 0x1f
jbe 0x532e1e
cmp byte [rax + 0x1f], 0x7f
ja 0x532e0b
mov rdx, qword [rsp + 0x270]
cmp rdx, 2
jb 0x532df8
cmp rdx, 8
ja 0x532de5
lea rdi, [rsp + 0x58]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d54
mov rbp, qword [rbp]
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
xor esi, esi
jmp 0x532c59
mov r10, qword [rax + r10]
mov qword [rsp + r8*8 + 0x30], r10
lea rsi, [r8 + 1]
mov rbx, r9
cmp rsi, 4
jge 0x532c8d
mov r8, rsi
shl rsi, 3
cmp rbx, rsi
jb 0x532dd6
mov r9, rbx
sub rbx, rsi
mov r10, rsi
sub rsi, rcx
sar rsi, 0x3f
and r10, rsi
cmp rbx, 7
ja 0x532c49
jmp 0x532dc9
mov rcx, rdx
mov ebx, 1
shl rbx, cl
lea r8, [rbx - 1]
xor eax, eax
xor esi, esi
jmp 0x532cae
mov rcx, rdx
mov rbx, r11
mov rsi, rax
mov rax, r9
cmp rax, 0x100
jae 0x532d78
mov r9, rax
shr rax, 6
mov r10, r9
and r9d, 0x3f
lea r11, [rcx - 0x40]
neg r11
cmp r11, r9
jbe 0x532ceb
cmp rax, 5
jae 0x532dbf
mov r9, qword [rsp + rax*8 + 0x30]
mov rcx, r10
shr r9, cl
jmp 0x532d30
cmp rax, 5
jae 0x532db5
mov r11, qword [rsp + rax*8 + 0x30]
mov rcx, r10
shr r11, cl
lea r12, [rax + 1]
cmp r12, 5
jae 0x532da8
lea r12, [r9 - 0x40]
neg r12
cmp r12, 0x40
sbb r9, r9
mov r12, qword [rsp + rax*8 + 0x38]
neg rcx
shl r12, cl
and r9, r12
or r9, r11
mov rcx, r10
and r9, r8
add r9, rsi
bt r9d, 0
jb 0x532d4c
lea r9, [rcx + 1]
mov r11, rbx
mov rax, rsi
jmp 0x532ca2
mov r11, rbx
shr rbx, 1
cmp rbx, r9
jbe 0x532d62
mov byte [rsp + rcx + 0x58], r9b
xor eax, eax
nop
jmp 0x532d6f
sub r9d, r11d
mov byte [rsp + rcx + 0x58], r9b
mov eax, 1
lea r9, [rcx + rdx]
jmp 0x532ca2
lea rdi, [rsp + 0x168]
lea rsi, [rsp + 0x58]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466060
mov rbp, qword [rbp]
mov rbp, qword [rsp + 0x158]
add rsp, 0x160
ret
mov rax, r12
mov ecx, 5
call fcn.00465ac0
mov ecx, 5
call fcn.00465ac0
mov ecx, 5
call fcn.00465ac0
mov eax, 7
mov rcx, rbx
call fcn.00465aa0
mov rax, rsi
mov rcx, rbx
nop dword [rax]
call fcn.00465b60
lea rax, [0x00667a40]
lea rbx, [0x0072d950]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d940]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d980]
call fcn.00436260
mov eax, 0x1f
mov rcx, rbx
call fcn.00465aa0
nop
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rbx
nop dword [rax]
call fcn.00463440
mov rax, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
jmp fcn.00532b80
Function at 0x534760
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5349dc
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
movzx ecx, byte [rbx + 0x1f]
mov qword [rsp + 0x98], rcx
movzx edx, byte [rbx + 0x1e]
mov qword [rsp + 0x90], rdx
movzx esi, byte [rbx + 0x1d]
mov qword [rsp + 0x88], rsi
movzx edi, byte [rbx + 0x1c]
mov qword [rsp + 0x80], rdi
movzx r8d, byte [rbx + 0x1b]
mov qword [rsp + 0x78], r8
movzx r9d, byte [rbx + 0x1a]
mov qword [rsp + 0x70], r9
movzx r10d, byte [rbx + 0x19]
mov qword [rsp + 0x68], r10
movzx r11d, byte [rbx + 0x18]
mov qword [rsp + 0x60], r11
movzx r12d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r12
movzx r13d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r13
movzx r15d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r15
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r10d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r10
movzx r9d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r9
movzx r8d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r8
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r8d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r8
movzx r9d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r9
movzx r10d, byte [rbx + 9]
mov qword [rsp + 8], r10
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r15d, byte [rbx + 7]
shl r15, 0x38
movzx r13d, byte [rbx + 6]
shl r13, 0x30
movzx r12d, byte [rbx + 5]
shl r12, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r10d, byte [rbx + 3]
shl r10, 0x18
movzx r9d, byte [rbx + 2]
shl r9, 0x10
movzx r8d, byte [rbx + 1]
shl r8, 8
movzx ebx, byte [rbx]
add rbx, r8
add rbx, r9
add rbx, r10
add rbx, r11
add rbx, r12
add rbx, r13
add rbx, r15
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x98]
shl rcx, 0x38
mov rdx, qword [rsp + 0x90]
shl rdx, 0x30
mov rbx, qword [rsp + 0x88]
shl rbx, 0x28
mov rsi, qword [rsp + 0x80]
shl rsi, 0x20
mov rdi, qword [rsp + 0x78]
shl rdi, 0x18
mov r8, qword [rsp + 0x70]
shl r8, 0x10
mov r9, qword [rsp + 0x68]
shl r9, 8
mov r10, qword [rsp + 0x60]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00534760
Function at 0x537480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x537660
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [0x00669f80]
call fcn.0040da20
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x5374eb
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x537619
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x537640
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x5374dd
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x5374dd
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x5374dd
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x5374dd
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [r8 + rax]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
nop word [rax + rax]
cmp rdx, rax
jle 0x5375a8
cmp r9, r10
jle 0x5375a8
ja 0x537623
mov rax, r10
mov rcx, r9
call fcn.00465aa0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.00537480
Function at 0x538500
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53873c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.004bb9a0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x53864a
nop
cmp rdx, 0x40
ja 0x53872e
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rdi + 0x20]
add rdx, rcx
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x5385b9
mov rax, rdx
mov rcx, rsi
nop
call fcn.00466460
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x538621
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00538c80
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x538723
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x538657
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x5386d7
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.00538c80
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x538712
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x53870e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.00466460
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00465b60
mov rax, rdx
mov ecx, 0x40
call fcn.00465b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00538500
Function at 0x541280
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x541326
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rax, rax
je 0x54130e
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
nop
lea rax, [0x006a2c60]
call fcn.0040da20
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
cmp dword [0x00918a90], 0
jne 0x5412da
mov rbx, qword [rsp + 0x40]
mov qword [rax + 8], rbx
jmp 0x5412e8
lea rdi, [rax + 8]
mov rbx, qword [rsp + 0x40]
call fcn.00465740
mov qword [rsp + 0x20], rax
mov rdi, rax
mov rax, rcx
lea rcx, [0x0072f738]
call fcn.00541500
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d700]
nop dword [rax]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00541280
Function at 0x542b00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x542c19
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
mov byte [rsp + 0x48], bl
mov qword [rsp + 0x40], rax
mov rdx, qword [rax]
mov rax, rdx
xor ebx, ebx
nop dword [rax]
call fcn.00542000
movzx edx, byte [rsp + 0x48]
test dl, dl
je 0x542b69
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rdi]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
lea rcx, [0x0072f760]
call fcn.005419a0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx + 0x10], esi
sete sil
test sil, sil
jne 0x542b94
lea rax, [rdx + 0x10]
call fcn.00470b60
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + 8]
test rax, rax
je 0x542bdf
nop
cmp qword [rax + 0x20], 0
je 0x542c05
add rax, 8
call fcn.004623a0
cmp dword [0x00918a90], 0
jne 0x542bc6
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], 0
jmp 0x542bdf
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 8]
mov rax, rdi
mov rdi, rcx
xor edx, edx
call fcn.00465720
mov rcx, rax
mov rax, qword [rcx]
mov ebx, 0xffffffff
lock xadd dword [rax + 0x10], ebx
dec ebx
test ebx, ebx
je 0x542bfb
add rax, 0x10
call fcn.00470e60
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d720]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463440
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00542b00