joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5065e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5067bc
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], r10
test rsi, rsi
je 0x506717
test r9, r9
je 0x506717
mov qword [rsp + 0x98], rsi
lea rbx, [rsi + 1]
mov qword [rsp + 0x58], rbx
cmp rcx, rbx
jl 0x50663c
jae 0x50669b
jmp 0x5067b0
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rcx, [rsi + 5]
mov qword [rsp + 0x50], rcx
lea rax, [0x006674c0]
call fcn.0044a620
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
nop dword [rax + rax]
cmp rsi, rcx
ja 0x5067a5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.00512360
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
jae 0x506799
mov rsi, qword [rsp + 0x60]
mov qword [rsi + rcx*8], rax
jmp 0x506762
test r10, r10
jne 0x506722
xor edx, edx
nop
jmp 0x506752
nop
cmp rcx, 1
jge 0x50674a
lea rax, [0x006674c0]
mov ebx, 1
mov rcx, rbx
call fcn.0044a620
mov r10, qword [rsp + 0xb0]
mov ecx, 1
mov qword [rax], r10
mov edx, 1
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
dec rdx
test rdx, rdx
jle 0x506771
mov rdi, qword [rsi + rdx*8 - 8]
test rdi, rdi
je 0x50675f
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
ja 0x50678b
mov rax, rsi
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00465b20
mov rax, rcx
mov rcx, rdx
nop
call fcn.00465aa0
mov rdx, rcx
mov rcx, rsi
call fcn.00465b20
mov rdx, rcx
mov rcx, rbx
call fcn.00465b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.005065e0
Function at 0x507040
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x507191
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x507185
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00512000
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x507161
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x507180
cmp rsi, rcx
ja 0x507173
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x50716b
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00512140
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00465b60
mov rax, rsi
call fcn.00465b60
nop dword [rax + rax]
call fcn.00465b20
mov rdx, rcx
mov rcx, r9
call fcn.00465b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.00507040
Function at 0x507200
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x507351
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x507345
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.005120a0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x507321
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x507340
cmp rsi, rcx
ja 0x507333
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x50732b
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.005121e0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00465b60
mov rax, rsi
call fcn.00465b60
nop dword [rax + rax]
call fcn.00465b20
mov rdx, rcx
mov rcx, r9
call fcn.00465b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.00507200
Function at 0x50cd40
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50cefc
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
add r9, 7
lea rbx, [rsi + r9]
sar rbx, 3
cmp rcx, rbx
jl 0x50cd87
nop
jae 0x50cdfe
jmp 0x50cef0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x50cdcb
lea rax, [0x006674c0]
mov ebx, 1
mov rcx, rbx
call fcn.0044a620
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x50cdfe
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x006674c0]
call fcn.0044a620
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x50ce13
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x50ce45
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x50ce06
nop dword [rax + rax]
jmp 0x50cee5
test rsi, rsi
jle 0x50ce52
xor r8d, r8d
xor r9d, r9d
jmp 0x50ceae
jmp 0x50ce57
dec rbx
test rbx, rbx
jle 0x50ce66
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x50ce54
cmp rbx, rcx
ja 0x50ce75
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, rcx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00465b20
cmp r8, 0x40
sbb r11, r11
lea r12, [r8 + 8]
movzx r13d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r13, cl
and r13, r11
or r9, r13
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x50cebe
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x50ce85
jmp 0x50ced9
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x50cece
mov qword [rax + rbx*8 - 8], r9
jmp 0x50ce52
mov rax, rsi
mov rcx, rbx
call fcn.00465aa0
mov rax, r10
mov rcx, rdx
nop
call fcn.00465aa0
mov rax, r9
mov rcx, rbx
call fcn.00465aa0
mov rdx, rcx
mov rcx, rbx
call fcn.00465b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.0050cd40
Function at 0x512bc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x512c66
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
cmp qword [rcx + 0x10], 0
jne 0x512bed
xor edx, edx
jmp 0x512c00
cmp byte [rcx], 0
je 0x512bfb
mov rdx, 0xffffffffffffffff
jmp 0x512c00
mov edx, 1
test rdx, rdx
jne 0x512c32
cmp qword [rdi + 0x10], 0
jne 0x512c10
xor edx, edx
jmp 0x512c23
cmp byte [rdi], 0
je 0x512c1e
mov rdx, 0xffffffffffffffff
jmp 0x512c23
mov edx, 1
test rdx, rdx
jne 0x512c32
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rax + 0x28]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
nop
call rdx
test al, al
je 0x512c50
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d900]
nop
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00512bc0
Function at 0x512ce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x512f1f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x00687de0]
nop
call fcn.0040da20
lea rbx, [0x006cc3c5]
mov ecx, 0x44
mov edi, 0xa
call fcn.00502a00
nop dword [rax + rax]
test bl, bl
je 0x512f0b
mov qword [rsp + 0x40], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cc381]
mov ecx, 0x44
mov edi, 0xa
call fcn.00502a00
test bl, bl
je 0x512ef8
mov qword [rsp + 0x38], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cb020]
mov ecx, 0x38
mov edi, 0x10
call fcn.00502a00
nop
test bl, bl
je 0x512ee5
mov qword [rsp + 0x30], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cb058]
mov ecx, 0x38
mov edi, 0x10
call fcn.00502a00
test bl, bl
je 0x512ed1
mov qword [rsp + 0x28], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cb090]
mov ecx, 0x38
mov edi, 0x10
call fcn.00502a00
nop
test bl, bl
je 0x512ebe
mov qword [rsp + 0x20], rax
lea rax, [0x006a3660]
call fcn.0040da20
mov qword [rax + 0x38], 5
lea rcx, [0x006b8be8]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0xe0
cmp dword [0x00918a90], 0
jne 0x512e4b
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
jmp 0x512e93
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465700
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00465720
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465700
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465700
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00465700
mov rdi, qword [0x008b4ee8]
test byte [rdi], al
cmp dword [0x00918a90], 0
jne 0x512eab
mov qword [rdi + 8], rax
jmp 0x512eb4
add rdi, 8
call fcn.00465600
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
nop
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
nop
nop
call fcn.00463440
jmp fcn.00512ce0
Function at 0x512f40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51317f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x00687de0]
nop
call fcn.0040da20
lea rbx, [0x006ccf3c]
mov ecx, 0x4e
mov edi, 0xa
call fcn.00502a00
nop dword [rax + rax]
test bl, bl
je 0x51316b
mov qword [rsp + 0x40], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cceee]
mov ecx, 0x4e
mov edi, 0xa
call fcn.00502a00
test bl, bl
je 0x513158
mov qword [rsp + 0x38], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cbe73]
mov ecx, 0x40
mov edi, 0x10
call fcn.00502a00
nop
test bl, bl
je 0x513145
mov qword [rsp + 0x30], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cbeb3]
mov ecx, 0x40
mov edi, 0x10
call fcn.00502a00
test bl, bl
je 0x513131
mov qword [rsp + 0x28], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cbe33]
mov ecx, 0x40
mov edi, 0x10
call fcn.00502a00
nop
test bl, bl
je 0x51311e
mov qword [rsp + 0x20], rax
lea rax, [0x006a3660]
call fcn.0040da20
mov qword [rax + 0x38], 5
lea rcx, [0x006b8bed]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x100
cmp dword [0x00918a90], 0
jne 0x5130ab
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
jmp 0x5130f3
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465700
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00465720
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465700
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465700
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00465700
mov rdi, qword [0x008b4ef0]
test byte [rdi], al
cmp dword [0x00918a90], 0
jne 0x51310b
mov qword [rdi + 8], rax
jmp 0x513114
add rdi, 8
call fcn.00465600
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
nop
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
nop
nop
call fcn.00463440
jmp fcn.00512f40
Function at 0x5131a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5133df
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x00687de0]
nop
call fcn.0040da20
lea rbx, [0x006cdb16]
mov ecx, 0x74
mov edi, 0xa
call fcn.00502a00
nop dword [rax + rax]
test bl, bl
je 0x5133cb
mov qword [rsp + 0x40], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cdaa2]
mov ecx, 0x74
mov edi, 0xa
call fcn.00502a00
test bl, bl
je 0x5133b8
mov qword [rsp + 0x38], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cd7d0]
mov ecx, 0x60
mov edi, 0x10
call fcn.00502a00
nop
test bl, bl
je 0x5133a5
mov qword [rsp + 0x30], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cd770]
mov ecx, 0x60
mov edi, 0x10
call fcn.00502a00
test bl, bl
je 0x513391
mov qword [rsp + 0x28], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cd710]
mov ecx, 0x60
mov edi, 0x10
call fcn.00502a00
nop
test bl, bl
je 0x51337e
mov qword [rsp + 0x20], rax
lea rax, [0x006a3660]
call fcn.0040da20
mov qword [rax + 0x38], 5
lea rcx, [0x006b8bf2]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x180
cmp dword [0x00918a90], 0
jne 0x51330b
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
jmp 0x513353
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465700
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00465720
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465700
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465700
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00465700
mov rdi, qword [0x008b4ef8]
test byte [rdi], al
cmp dword [0x00918a90], 0
jne 0x51336b
mov qword [rdi + 8], rax
jmp 0x513374
add rdi, 8
call fcn.00465600
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
nop
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
nop
nop
call fcn.00463440
jmp fcn.005131a0
Function at 0x513400
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51363f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x00687de0]
nop
call fcn.0040da20
lea rbx, [0x006cdd16]
mov ecx, 0x9d
mov edi, 0xa
call fcn.00502a00
nop dword [rax + rax]
test bl, bl
je 0x51362b
mov qword [rsp + 0x40], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cddb3]
mov ecx, 0x9d
mov edi, 0xa
call fcn.00502a00
test bl, bl
je 0x513618
mov qword [rsp + 0x38], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cdc0e]
mov ecx, 0x84
mov edi, 0x10
call fcn.00502a00
nop
test bl, bl
je 0x513605
mov qword [rsp + 0x30], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cdb8a]
mov ecx, 0x84
mov edi, 0x10
call fcn.00502a00
test bl, bl
je 0x5135f1
mov qword [rsp + 0x28], rax
lea rax, [0x00687de0]
call fcn.0040da20
lea rbx, [0x006cdc92]
mov ecx, 0x84
mov edi, 0x10
call fcn.00502a00
nop
test bl, bl
je 0x5135de
mov qword [rsp + 0x20], rax
lea rax, [0x006a3660]
call fcn.0040da20
mov qword [rax + 0x38], 5
lea rcx, [0x006b8bf7]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x209
cmp dword [0x00918a90], 0
jne 0x51356b
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
jmp 0x5135b3
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465700
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00465720
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465700
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465700
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00465700
mov rdi, qword [0x008b4f00]
test byte [rdi], al
cmp dword [0x00918a90], 0
jne 0x5135cb
mov qword [rdi + 8], rax
jmp 0x5135d4
add rdi, 8
call fcn.00465600
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
nop
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d910]
call fcn.00436260
nop
nop
call fcn.00463440
jmp fcn.00513400
Function at 0x5160e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51618e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov rdx, qword [rbx + 0x50]
mov rbx, rdx
call fcn.00516320
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx]
mov r9, qword [r8]
mov rdx, r8
call r9
mov rdx, qword [rsp + 0x58]
lea r8, [rdx + 0x28]
mov r9, qword [rdx + 0x28]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rdx, r8
call r9
test rbx, rbx
jne 0x51617a
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rdx + 0x50]
mov rcx, rax
mov rax, qword [rsp + 0x50]
call fcn.00516600
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d8d0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.005160e0

Function at 0x5161e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5162c0
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x78], r9
mov rdx, qword [rbx + 0x48]
mov rbx, rdx
call fcn.00516840
nop dword [rax]
test rbx, rbx
jne 0x5162ac
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x48]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
call fcn.00516320
mov rdx, qword [rsp + 0x50]
lea r8, [rdx + 0x20]
mov r9, qword [rdx + 0x20]
mov rdi, rbx
mov rsi, rcx
mov rbx, qword [rsp + 0x28]
mov rcx, rax
mov rax, rbx
mov rdx, r8
call r9
test rbx, rbx
jne 0x516299
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x48]
mov rcx, rax
mov rax, qword [rsp + 0x30]
call fcn.00516600
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d8d0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072d8e0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005161e0