joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542ce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x542e59
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
test rax, rax
je 0x542e45
nop
test rcx, rcx
je 0x542e2d
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x542d64
lea r9, [0x00731cc8]
jmp 0x542d69
xor r9d, r9d
xor edx, edx
mov rcx, qword [r9 + 0x20]
mov rax, rdx
call rcx
test al, al
je 0x542e1a
lea rax, [0x0069d460]
call fcn.0040da20
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
cmp dword [0x00918a90], 0
jne 0x542da2
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
jmp 0x542db0
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x48]
call fcn.00465700
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
cmp dword [0x00918a90], 0
jne 0x542dcd
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x18], rcx
jmp 0x542ddb
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x58]
call fcn.00465700
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x20], rcx
cmp dword [0x00918a90], 0
jne 0x542df8
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x28], rcx
jmp 0x542e06
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x68]
call fcn.00465700
mov rbx, rax
lea rax, [0x00730858]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d740]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d730]
nop dword [rax + rax]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d700]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00542ce0
Function at 0x544960
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xc0]
cmp r12, qword [r14 + 0x10]
jbe 0x544c08
sub rsp, 0x140
mov qword [rsp + 0x138], rbp
lea rbp, [rsp + 0x138]
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d54
mov rbp, qword [rbp]
cmp byte [rax + 0x38], 0
jne 0x544bc9
movzx edx, byte [rax + 0x24]
cmp bl, dl
jbe 0x5449d8
mov rdx, qword [0x008b6a30]
mov r8, qword [0x008b6a38]
jmp 0x544a56
jae 0x5449ea
mov rdx, qword [0x008b6a40]
mov r8, qword [0x008b6a48]
jmp 0x544a56
mov byte [rax + 0x38], 0
cmp bl, 3
ja 0x544a0b
cmp bl, 2
jne 0x544a00
movzx edx, word [rax + 0x1c]
jmp 0x544a24
cmp bl, 3
jne 0x544a22
movzx edx, word [rax + 0x1e]
jmp 0x544a24
cmp bl, 4
jne 0x544a16
movzx edx, word [rax + 0x20]
jmp 0x544a24
cmp bl, 5
jne 0x544a22
movzx edx, word [rax + 0x22]
nop
jmp 0x544a24
xor edx, edx
movzx edx, dx
cmp qword [rax + 0x30], rdx
jne 0x544a51
mov qword [rax + 0x30], 0
movzx r9d, byte [rax + 0x24]
inc r9d
mov byte [rax + 0x24], r9b
mov rdx, qword [0x008b6a40]
mov r8, qword [0x008b6a48]
jmp 0x544a56
xor edx, edx
xor r8d, r8d
test rdx, rdx
jne 0x544b87
mov qword [rsp + 0x258], rax
movups xmmword [rsp + 0x2c], xmm15
lea rdi, [rsp + 0x38]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d54
mov rbp, qword [rbp]
mov rbx, qword [rax]
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rsi, qword [rax + 0x28]
lea rax, [rsp + 0x2c]
call fcn.00546640
test rbx, rbx
je 0x544aeb
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d54
mov rbp, qword [rbp]
mov rax, rbx
mov rbx, rcx
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
mov rdi, qword [rsp + 0x258]
mov byte [rdi + 0x38], 1
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rdi + 0x3c], xmm0
lea rcx, [rdi + 0x48]
lea rsi, [rsp + 0x38]
mov rdx, rdi
mov rdi, rcx
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466060
mov rbp, qword [rbp]
mov qword [rdx + 0x28], rax
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsp + 0x148], xmm0
lea rdi, [rsp + 0x154]
lea rsi, [rsp + 0x38]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466060
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d54
mov rbp, qword [rbp]
mov rax, rdx
mov rbx, r8
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
movups xmm0, xmmword [rax + 0x3c]
movups xmmword [rsp + 0x148], xmm0
lea rsi, [rax + 0x48]
lea rdi, [rsp + 0x154]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466060
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
mov qword [rsp + 0x118], rax
mov byte [rsp + 0x120], bl
call fcn.00463440
mov rax, qword [rsp + 0x118]
movzx ebx, byte [rsp + 0x120]
jmp fcn.00544960
Function at 0x544c40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x544e5e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov byte [rsp + 0x58], bl
cmp byte [rax + 0x38], 0
je 0x544ca5
movzx ecx, word [rax + 0x144]
add rcx, qword [rax + 0x28]
cmp qword [rax + 8], rcx
jge 0x544c8b
mov rax, qword [0x008b6ac0]
mov rbx, qword [0x008b6ac8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
movzx edx, byte [rax + 0x24]
cmp bl, dl
jbe 0x544cc5
mov rdx, qword [0x008b6a30]
mov rsi, qword [0x008b6a38]
nop dword [rax + rax]
jmp 0x544d4e
jae 0x544cd7
mov rdx, qword [0x008b6a40]
mov rsi, qword [0x008b6a48]
jmp 0x544d4e
mov byte [rax + 0x38], 0
nop dword [rax + rax]
cmp bl, 3
ja 0x544d00
cmp bl, 2
jne 0x544cf0
movzx edx, word [rax + 0x1c]
jmp 0x544d18
cmp bl, 3
jne 0x544d16
movzx edx, word [rax + 0x1e]
jmp 0x544d18
cmp bl, 4
jne 0x544d0b
movzx edx, word [rax + 0x20]
jmp 0x544d18
cmp bl, 5
jne 0x544d16
movzx edx, word [rax + 0x22]
jmp 0x544d18
xor edx, edx
movzx edx, dx
nop dword [rax + rax]
cmp qword [rax + 0x30], rdx
jne 0x544d4a
mov qword [rax + 0x30], 0
movzx r8d, byte [rax + 0x24]
inc r8d
mov byte [rax + 0x24], r8b
mov rdx, qword [0x008b6a40]
mov rsi, qword [0x008b6a48]
jmp 0x544d4e
xor edx, edx
xor esi, esi
test rdx, rdx
jne 0x544e4e
mov qword [rsp + 0x50], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rdi, qword [rax + 0x28]
mov rax, rdx
call fcn.00546b00
mov rdx, qword [rsp + 0x50]
mov qword [rdx + 0x28], rax
nop dword [rax]
test rbx, rbx
je 0x544e3c
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
lea rax, [0x0068a900]
call fcn.0040da20
mov qword [rsp + 0x38], rax
mov rbx, qword [0x008c3788]
lea rcx, [rsp + 0x58]
lea rax, [0x00675720]
call fcn.0040ea00
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
xor eax, eax
lea rbx, [0x006ba08f]
mov ecx, 0xa
call fcn.0044e540
mov rdi, qword [rsp + 0x38]
mov qword [rdi + 8], rbx
cmp dword [0x00918a90], 0
jne 0x544ded
mov qword [rdi], rax
jmp 0x544df2
call fcn.00465600
mov rcx, qword [rsp + 0x28]
mov qword [rdi + 0x10], rcx
cmp dword [0x00918a90], 0
jne 0x544e0f
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x18], rcx
jmp 0x544e28
lea rcx, [rdi + 0x18]
mov rax, rdi
mov rdi, rcx
mov rdx, qword [rsp + 0x30]
nop
call fcn.00465720
mov rdi, rax
lea rax, [0x0072ed40]
mov rbx, rdi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
inc qword [rdx + 0x30]
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rdx
mov rbx, rsi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00463440
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00544c40
Function at 0x545620
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x2a8]
cmp r12, qword [r14 + 0x10]
jbe 0x5457a5
sub rsp, 0x328
mov qword [rsp + 0x320], rbp
lea rbp, [rsp + 0x320]
lea rdi, [rsp + 0x330]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d54
mov rbp, qword [rbp]
cmp byte [rax + 0x38], 0
je 0x545787
cmp word [rax + 0x13c], 5
jne 0x545787
mov qword [rsp + 0x430], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rdi, qword [rax + 0x28]
mov rax, rdx
call fcn.00547a80
lea rdi, [rsp + 0x220]
mov rsi, rsp
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466060
mov rbp, qword [rbp]
lea rdi, [rsp + 0x120]
lea rsi, [rsp + 0x220]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466060
mov rbp, qword [rbp]
test rax, rax
je 0x545726
lea rdi, [rsp + 0x330]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d54
mov rbp, qword [rbp]
mov rbp, qword [rsp + 0x320]
add rsp, 0x328
ret
mov rcx, qword [rsp + 0x430]
movzx edx, word [rcx + 0x144]
add qword [rcx + 0x28], rdx
mov byte [rcx + 0x38], 0
inc qword [rcx + 0x30]
lea rdi, [rsp + 0x330]
lea rsi, [rsp + 0x120]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466060
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x320]
add rsp, 0x328
ret
mov rax, qword [0x008b6a30]
mov rbx, qword [0x008b6a38]
mov rbp, qword [rsp + 0x320]
add rsp, 0x328
ret
mov qword [rsp + 0x108], rax
call fcn.00463440
mov rax, qword [rsp + 0x108]
jmp fcn.00545620
Function at 0x5457c0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov dword [rsp + 0x30], 0
cmp byte [rax + 0x38], 0
nop word [rax + rax]
je 0x5458d2
cmp word [rax + 0x13c], 1
jne 0x5458d2
mov rdx, qword [rax + 0x10]
mov rsi, qword [rax]
mov rcx, qword [rax + 0x28]
lea rdi, [rcx + 4]
cmp qword [rax + 8], rdi
mov dword [rsp + 0x14], 0
mov dword [rsp + 0x1c], 0
jge 0x545829
mov rcx, qword [0x008b6a50]
mov rdx, qword [0x008b6a58]
jmp 0x545861
cmp rdx, rdi
jb 0x5458f5
cmp rcx, rdi
ja 0x5458ea
mov rdi, rcx
sub rcx, rdx
sar rcx, 0x3f
and rdi, rcx
lea rcx, [rsi + rdi]
lea rdx, [rsp + 0x1c]
cmp rdx, rcx
je 0x54585d
mov ecx, dword [rsi + rdi]
mov dword [rsp + 0x1c], ecx
xor ecx, ecx
xor edx, edx
test rcx, rcx
je 0x545870
mov dword [rsp + 0x14], 0
jmp 0x545884
mov dword [rsp + 0x14], 0
mov esi, dword [rsp + 0x1c]
mov dword [rsp + 0x14], esi
xor ecx, ecx
xor edx, edx
mov esi, dword [rsp + 0x14]
mov dword [rsp + 0x18], esi
test rcx, rcx
je 0x5458a9
mov dword [rsp + 0x30], 0
mov rax, rcx
mov rbx, rdx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
movzx ecx, word [rax + 0x144]
add qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
mov ecx, dword [rsp + 0x18]
mov dword [rsp + 0x30], ecx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [0x008b6a30]
mov rbx, qword [0x008b6a38]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rcx
mov rcx, rdi
call fcn.00465b60
mov rcx, rdi
call fcn.00465b20
nop
int3

Function at 0x545900
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movups xmmword [rsp + 0x50], xmm15
cmp byte [rax + 0x38], 0
je 0x545a0a
cmp word [rax + 0x13c], 0x1c
jne 0x545a0a
mov rdx, qword [rax + 0x10]
mov rsi, qword [rax]
mov rcx, qword [rax + 0x28]
lea rdi, [rcx + 0x10]
cmp qword [rax + 8], rdi
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x30], xmm15
jge 0x545960
mov rcx, qword [0x008b6a50]
mov rdx, qword [0x008b6a58]
jmp 0x545999
cmp rdx, rdi
jb 0x545a2d
cmp rcx, rdi
ja 0x545a22
mov rdi, rcx
sub rcx, rdx
sar rcx, 0x3f
and rdi, rcx
lea rcx, [rsi + rdi]
lea rdx, [rsp + 0x30]
cmp rdx, rcx
je 0x545995
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm0
xor ecx, ecx
xor edx, edx
test rcx, rcx
je 0x5459a6
movups xmmword [rsp + 0x10], xmm15
jmp 0x5459ba
movups xmmword [rsp + 0x10], xmm15
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x10], xmm0
xor ecx, ecx
xor edx, edx
movups xmm0, xmmword [rsp + 0x10]
movups xmmword [rsp + 0x20], xmm0
test rcx, rcx
je 0x5459df
movups xmmword [rsp + 0x50], xmm15
mov rax, rcx
mov rbx, rdx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
movzx ecx, word [rax + 0x144]
add qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x50], xmm0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [0x008b6a30]
mov rbx, qword [0x008b6a38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rcx
mov rcx, rdi
call fcn.00465b60
mov rcx, rdi
call fcn.00465b20
nop
int3
Function at 0x545c80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x545df5
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movzx edx, byte [rax + 0x18]
nop dword [rax]
cmp dl, 2
jb 0x545ddd
ja 0x545dc5
mov qword [rsp + 0x148], rax
mov rbx, qword [rax]
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rsi, qword [rax + 0x30]
mov r8, qword [rax + 0x28]
lea rax, [rsp + 0x40]
call fcn.005478e0
test rdi, rdi
jne 0x545db5
mov rdi, qword [rsp + 0x148]
movzx edx, byte [rdi + 0x18]
cmp dl, 3
ja 0x545d22
cmp dl, 2
jne 0x545d07
lea rdx, [rdi + 0x1e]
mov rsi, qword [0x008b6b20]
mov r8, qword [0x008b6b28]
jmp 0x545d60
cmp dl, 3
jne 0x545d59
lea rdx, [rdi + 0x20]
mov rsi, qword [0x008b6af0]
mov r8, qword [0x008b6af8]
nop
jmp 0x545d60
cmp dl, 4
jne 0x545d40
lea rdx, [rdi + 0x22]
mov rsi, qword [0x008b6b00]
mov r8, qword [0x008b6b08]
jmp 0x545d60
cmp dl, 5
jne 0x545d59
lea rdx, [rdi + 0x24]
mov rsi, qword [0x008b6ae0]
mov r8, qword [0x008b6ae8]
jmp 0x545d60
xor esi, esi
xor r8d, r8d
xor edx, edx
movzx r9d, word [rdx]
cmp r9w, 0xffff
je 0x545d77
inc r9d
mov word [rdx], r9w
xor esi, esi
xor r8d, r8d
test rsi, rsi
jne 0x545da5
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rcx
cmp dword [0x00918a90], 0
jne 0x545d92
mov qword [rdi], rax
jmp 0x545d97
call fcn.00465600
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rsi
mov rbx, r8
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [0x008b6a40]
mov rbx, qword [0x008b6a48]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [0x008b6a30]
mov rbx, qword [0x008b6a38]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x110], rax
nop dword [rax]
call fcn.00463440
mov rax, qword [rsp + 0x110]
jmp fcn.00545c80
Function at 0x546340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5463dc
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
cmp byte [rax + 0x18], 1
jb 0x5463b7
mov byte [rax + 0x18], 6
mov rdx, qword [rax + 0x10]
mov rsi, qword [rax]
mov rcx, qword [rax + 0x28]
cmp rdx, rcx
jb 0x5463d6
mov qword [rsp + 0x30], rax
lea r8, [rax + 0x1a]
sub rdx, rcx
mov rdi, rdx
neg rdx
sar rdx, 0x3f
and rcx, rdx
lea rbx, [rsi + rcx]
xor ecx, ecx
mov rax, r8
call fcn.00543f20
mov rdx, qword [rsp + 0x30]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rdi, qword [0x008b6a30]
mov rsi, qword [0x008b6a38]
xor eax, eax
xor ebx, ebx
mov rcx, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00465b20
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00546340
Function at 0x54b6e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54b83b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x008b4fe0]
call fcn.00500d60
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x0054b860]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x54b7fb
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x54b835
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x54b82a
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.00465b60
call fcn.00465ae0
nop
nop dword [rax + rax]
call fcn.00463440
jmp fcn.0054b6e0
Function at 0x551180
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x1c8]
cmp r12, qword [r14 + 0x10]
jbe 0x55133f
sub rsp, 0x248
mov qword [rsp + 0x240], rbp
lea rbp, [rsp + 0x240]
cmp word [rsp + 0x25c], 3
je 0x551321
nop
mov ebx, 3
nop
call fcn.00544960
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x12c], xmm0
lea rdi, [rsp + 0x138]
lea rsi, [rsp + 0xc]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466060
mov rbp, qword [rbp]
test rax, rax
je 0x55125c
mov rcx, qword [0x008b6a48]
nop
cmp qword [0x008b6a40], rax
je 0x551210
mov ecx, 1
jmp 0x55123a
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x238], rbx
call fcn.004040a0
xor eax, 1
mov rbx, qword [rsp + 0x238]
mov ecx, eax
mov rax, qword [rsp + 0x120]
test cl, cl
je 0x55125c
mov rax, qword [0x008b6150]
mov rbx, qword [0x008b6158]
mov rbp, qword [rsp + 0x240]
add rsp, 0x248
ret
cmp word [rsp + 0x25c], 0
jne 0x5512b6
cmp byte [rsp + 0x256], 0
jne 0x5512b6
cmp byte [rsp + 0x259], 0
jne 0x5512b6
mov rcx, qword [0x008b6a48]
cmp qword [0x008b6a40], rax
je 0x55128f
xor eax, eax
jmp 0x551294
call fcn.004040a0
test al, al
je 0x5512b6
mov rax, qword [0x008b6170]
mov rbx, qword [0x008b6178]
mov rbp, qword [rsp + 0x240]
add rsp, 0x248
ret
movzx ecx, word [rsp + 0x25c]
nop
test cx, cx
je 0x55130d
cmp cx, 3
je 0x55130d
cmp cx, 2
jne 0x5512ef
mov rax, qword [0x008b61d0]
mov rbx, qword [0x008b61d8]
mov rbp, qword [rsp + 0x240]
add rsp, 0x248
ret
mov rax, qword [0x008b61c0]
mov rbx, qword [0x008b61c8]
mov rbp, qword [rsp + 0x240]
add rsp, 0x248
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x240]
add rsp, 0x248
ret
mov rax, qword [0x008b61a0]
mov rbx, qword [0x008b61a8]
mov rbp, qword [rsp + 0x240]
add rsp, 0x248
ret
mov qword [rsp + 0x18], rax
call fcn.00463440
mov rax, qword [rsp + 0x18]
jmp fcn.00551180
Function at 0x551360
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x2d0]
cmp r12, qword [r14 + 0x10]
jbe 0x5514e6
sub rsp, 0x350
mov qword [rsp + 0x348], rbp
lea rbp, [rsp + 0x348]
mov word [rsp + 0x360], bx
mov qword [rsp + 0x340], rax
jmp 0x5513a3
mov rax, qword [rsp + 0x340]
mov ebx, 3
call fcn.00544960
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x22c], xmm0
lea rdi, [rsp + 0x238]
lea rsi, [rsp + 0xc]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466060
mov rbp, qword [rbp]
movups xmm0, xmmword [rsp + 0x22c]
movups xmmword [rsp + 0x120], xmm0
lea rdi, [rsp + 0x12c]
lea rsi, [rsp + 0x238]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466060
mov rbp, qword [rbp]
mov rcx, qword [0x008b6a48]
nop word [rax + rax]
cmp qword [0x008b6a40], rax
jne 0x551446
mov qword [rsp + 0x338], rax
call fcn.004040a0
test al, al
jne 0x5514c8
mov rax, qword [rsp + 0x338]
test rax, rax
jne 0x5514aa
movzx ecx, word [rsp + 0x360]
cmp word [rsp + 0x220], cx
je 0x551496
mov rax, qword [rsp + 0x340]
mov ebx, 3
call fcn.00544c40
test rax, rax
je 0x55139b
mov rax, qword [0x008b6150]
mov rbx, qword [0x008b6158]
mov rbp, qword [rsp + 0x348]
add rsp, 0x350
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x348]
add rsp, 0x350
ret
mov rax, qword [0x008b6150]
mov rbx, qword [0x008b6158]
mov rbp, qword [rsp + 0x348]
add rsp, 0x350
ret
mov rax, qword [0x008b61a0]
mov rbx, qword [0x008b61a8]
mov rbp, qword [rsp + 0x348]
add rsp, 0x350
ret
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.00463440
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
nop
jmp fcn.00551360
Function at 0x567f80
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x5681e1
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x5681c5
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x567fcd
xor ebx, ebx
xor ecx, ecx
jmp 0x567fe0
mov rax, rdx
call fcn.005587c0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x5680f8
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00472b80
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0072bc90]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e5e0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5680bb
xor eax, eax
lea rbx, [0x006b8622]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006b86c7]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e6c0
jmp 0x5680e8
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x0072bd48]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e5e0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.00472b80
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x568188
xor eax, eax
lea rbx, [0x006b8622]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006b86c7]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e6c0
jmp 0x5681b5
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0072bd48]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e5e0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006b8b7a]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00567f80