joyce8/EMBER2024-capa huggingface dataset:
Function at 0x557000
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5571e7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov rdx, qword [rax + 0x30]
mov rsi, qword [rax + 0x28]
test rdx, rdx
je 0x557196
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov rax, rsi
mov rbx, rdx
lea rcx, [0x0064439d]
mov edi, 1
call fcn.004cd3e0
nop
test al, al
jne 0x557068
xor eax, eax
jmp 0x557088
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
lea rcx, [0x006443ae]
mov edi, 1
nop
call fcn.004ce400
xor eax, 1
test al, al
jne 0x557098
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
jmp 0x5570b3
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0x28]
mov rbx, qword [rcx + 0x30]
call fcn.004becc0
test rsi, rsi
jne 0x557184
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
lea rcx, [0x006443ab]
mov edi, 1
call fcn.004ce380
test al, al
jne 0x5570d6
xor eax, eax
jmp 0x5570f1
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
lea rcx, [0x006443ae]
mov edi, 1
call fcn.004ce400
test al, al
jne 0x55710a
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
nop
call fcn.004bd8e0
test rax, rax
je 0x557161
mov rax, qword [rsp + 0x58]
call fcn.0054b7a0
movups xmmword [rsp + 0x38], xmm15
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00656d48]
mov ebx, 0x36
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
call fcn.00557280
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
mov rbx, rsi
mov rcx, r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0054b7a0
movups xmmword [rsp + 0x38], xmm15
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00657deb]
mov ebx, 0x3e
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00557000
Function at 0x557280
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5574bf
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
test rdi, rdi
je 0x557437
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
call fcn.00556b60
test dil, dil
je 0x5573db
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x98]
movzx edx, byte [rcx]
mov byte [rsp + 0x2f], dl
cmp dl, 0x2e
jne 0x55731b
mov rsi, qword [rsp + 0xa0]
lea rdi, [rsi - 1]
mov rsi, rdi
neg rdi
sar rdi, 0x3f
and edi, 1
add rcx, rdi
jmp 0x557323
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rsi
mov rax, rcx
mov rbx, rsi
call fcn.00556b60
test dil, dil
je 0x557385
mov rdx, qword [rsp + 0x38]
cmp rbx, rdx
jg 0x557375
movzx esi, byte [rsp + 0x2f]
cmp sil, 0x2e
jne 0x557360
cmp rbx, rdx
je 0x557375
nop word [rax + rax]
test rbx, rbx
je 0x55744a
mov qword [rsp + 0x40], rbx
xor ecx, ecx
jmp 0x557469
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x00654b31]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x00654b31]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov r8, qword [rsp + 0x58]
lea rax, [r8 + 0x10]
mov rcx, rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x58], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
shl rcx, 4
mov r8, qword [rsp + 0x50]
mov r9, qword [r8 + rcx]
mov rdi, qword [r8 + rcx + 8]
mov rcx, r9
mov rax, rdx
call fcn.004cf8a0
test al, al
je 0x5574af
mov rdx, qword [rsp + 0x30]
inc rdx
mov rsi, qword [rsp + 0x40]
cmp rsi, rdx
jg 0x55745d
jmp 0x55744a
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00557280
Function at 0x55b200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55b29d
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
cmp rax, 3
je 0x55b226
nop
cmp rax, 9
jne 0x55b234
mov ecx, 0x2f
lea rdx, [0x00655580]
jmp 0x55b238
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
movups xmmword [rsp + 0x38], xmm15
call fcn.0040a7c0
lea rcx, [0x0060a8e0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00656acd]
mov ebx, 0x34
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004af1a0
mov rcx, rbx
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rbx, rax
xor eax, eax
call fcn.0044c9c0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0055b200

Function at 0x55b760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55b7e3
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
nop
call fcn.0055a940
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rax, [0x0065916b]
mov ebx, 0x54
lea rcx, [rsp + 0x28]
mov edi, 2
mov rsi, rdi
call fcn.004acb60
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0055b760
Function at 0x55bf60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55c00d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
xor ecx, ecx
jmp 0x55bf89
mov rcx, rsi
cmp rbx, rcx
jle 0x55bfff
movzx edx, byte [rax + rcx]
cmp edx, 0x80
jge 0x55bfa2
lea rsi, [rcx + 1]
nop
jmp 0x55bfb6
call fcn.0045ada0
mov edx, eax
mov rsi, rbx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
cmp edx, 0x7f
jle 0x55bf86
movups xmmword [rsp + 0x28], xmm15
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006541b3]
mov ebx, 0x2a
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0055bf60

Function at 0x55d1c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55d316
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
nop dword [rax]
cmp rcx, 0x20
jne 0x55d302
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov ebx, 8
mov rcx, rdi
call fcn.004d37a0
movabs rdx, 0x7ffffffffffff
and rax, rdx
mov rsi, qword [rsp + 0x28]
mov qword [rsi], rax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi - 6]
mov r8, qword [rsp + 0x30]
lea rax, [r8 + 6]
mov ebx, 8
call fcn.004d37a0
shr rax, 3
movabs rdx, 0x7ffffffffffff
and rax, rdx
mov rsi, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi - 0xc]
mov r8, qword [rsp + 0x30]
lea rax, [r8 + 0xc]
mov ebx, 8
call fcn.004d37a0
shr rax, 6
movabs rdx, 0x7ffffffffffff
and rax, rdx
mov rsi, qword [rsp + 0x28]
mov qword [rsi + 0x10], rax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi - 0x13]
mov r8, qword [rsp + 0x30]
lea rax, [r8 + 0x13]
mov ebx, 8
call fcn.004d37a0
shr rax, 1
movabs rdx, 0x7ffffffffffff
and rax, rdx
mov rsi, qword [rsp + 0x28]
mov qword [rsi + 0x18], rax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi - 0x18]
mov rdi, qword [rsp + 0x30]
lea rax, [rdi + 0x18]
mov ebx, 8
call fcn.004d37a0
shr rax, 0xc
movabs rdx, 0x7ffffffffffff
and rax, rdx
mov rdx, qword [rsp + 0x28]
mov qword [rdx + 0x20], rax
mov rax, rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x005fe120]
lea rbx, [0x006852b0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0055d1c0
Function at 0x55d3c0
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x55d53f
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa8], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x58], xmm0
lea rax, [rsp + 0x40]
call fcn.0055ca80
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x80], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x88], rcx
xor eax, eax
jmp 0x55d475
mov rsi, qword [rsp + 0x20]
lea rax, [rsi + 1]
cmp rax, 5
jge 0x55d4e5
mov qword [rsp + 0x20], rax
imul rcx, rax, 0x33
mov rdx, rcx
sar rcx, 0x3f
shr rcx, 0x3d
lea rsi, [rcx + rdx]
sar rsi, 3
mov qword [rsp + 0x30], rsi
shl rsi, 3
sub rdx, rsi
cmp rdx, 0x40
sbb rdi, rdi
mov rsi, qword [rsp + rax*8 + 0x68]
mov rcx, rdx
shl rsi, cl
and rdi, rsi
mov ebx, 8
mov rcx, rbx
lea rax, [rsp + 0x28]
call fcn.004d37c0
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x30]
xor eax, eax
jmp 0x55d520
mov rax, qword [rsp + 0xa8]
test byte [rax], al
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
test byte [rdx], al
movzx r10d, byte [rdx + r9]
or r10d, r8d
mov byte [rdx + r9], r10b
inc rax
nop dword [rax + rax]
cmp rax, 8
jge 0x55d46c
movzx r8d, byte [rsp + rax + 0x38]
lea r9, [rsi + rax]
cmp r9, 0x20
jl 0x55d507
jmp 0x55d46c
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0055d3c0

Function at 0x55e2c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55e330
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
mov byte [rsp + 0x30], 9
mov rax, qword [0x007e0980]
mov rbx, qword [0x007e0988]
mov rcx, qword [0x007e0990]
lea rdi, [rsp + 0x30]
mov esi, 0x20
mov r8, rsi
call fcn.004d3640
cmp rax, 1
jne 0x55e31c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x005fe120]
lea rbx, [0x006852a0]
call fcn.00436780
nop
call fcn.0045f280
jmp fcn.0055e2c0
Function at 0x55e400
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x55e697
sub rsp, 0xb8
mov qword [rsp + 0xb0], rbp
lea rbp, [rsp + 0xb0]
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xe0], rsi
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
cmp rcx, 0x20
jne 0x55e611
cmp r8, 0x20
jne 0x55e58b
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x50]
cmp rbx, rdx
je 0x55e492
mov qword [rsp + 0xe0], rsi
mov rax, rdx
mov ecx, 0x20
call fcn.00461f80
mov rax, qword [rsp + 0xc0]
lea rdx, [rsp + 0x50]
mov rsi, qword [rsp + 0xe0]
cmp qword [0x007e0980], rsi
je 0x55e54c
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [rsp + 0x70]
nop
cmp rsi, rcx
je 0x55e4e7
mov rax, rcx
mov rbx, rsi
mov ecx, 0x20
call fcn.00461f80
mov rax, qword [rsp + 0xc0]
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov rbx, rdx
call fcn.0055dda0
mov rax, qword [rsp + 0xc0]
test byte [rax], al
mov ebx, 0x20
mov rcx, rbx
lea rdi, [rsp + 0x30]
mov rsi, rcx
mov r8, rcx
call fcn.004d3640
cmp rax, 1
jne 0x55e565
lea rax, [0x00650141]
mov ebx, 0x20
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.004acb60
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
call fcn.0055e2c0
mov rax, qword [rsp + 0xc0]
lea rbx, [rsp + 0x50]
nop
call fcn.0055e220
mov rax, qword [rsp + 0xc0]
test byte [rax], al
mov ebx, 0x20
mov rcx, rbx
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
mov rax, r8
call fcn.0040a7c0
lea rcx, [0x005fd960]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
lea rcx, [0x00684348]
mov qword [rsp + 0xa8], rcx
lea rax, [0x006508ee]
mov ebx, 0x21
lea rcx, [rsp + 0x90]
mov edi, 2
mov rsi, rdi
call fcn.004acb60
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
mov rax, rcx
call fcn.0040a7c0
lea rcx, [0x005fd960]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
lea rcx, [0x00684348]
mov qword [rsp + 0xa8], rcx
lea rax, [0x00651202]
mov ebx, 0x22
lea rcx, [rsp + 0x90]
mov edi, 2
mov rsi, rdi
call fcn.004acb60
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.0055e400
Function at 0x55f1e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55f3bd
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
cmp ax, 0x501
ja 0x55f231
nop
cmp ax, 0x203
ja 0x55f217
cmp ax, 0x201
je 0x55f24a
cmp ax, 0x203
je 0x55f257
jmp 0x55f36f
cmp ax, 0x401
je 0x55f24a
nop dword [rax]
cmp ax, 0x403
je 0x55f257
cmp ax, 0x501
je 0x55f24a
jmp 0x55f36f
cmp ax, 0x601
ja 0x55f251
cmp ax, 0x503
je 0x55f257
nop dword [rax]
cmp ax, 0x601
jne 0x55f36f
mov ecx, 0xffffffe1
jmp 0x55f280
cmp ax, 0x603
jne 0x55f25e
mov ecx, 0xffffffe3
jmp 0x55f280
lea edx, [rax - 0x804]
cmp dx, 2
ja 0x55f271
mov ecx, 0xffffffe2
jmp 0x55f280
cmp ax, 0x807
jne 0x55f36f
mov ecx, 0xffffffe4
cmp ax, 0x503
ja 0x55f2c0
cmp ax, 0x401
ja 0x55f2a8
cmp ax, 0x201
je 0x55f298
cmp ax, 0x203
jne 0x55f2a0
mov edx, 3
jmp 0x55f30d
cmp ax, 0x401
je 0x55f2d8
jmp 0x55f321
cmp ax, 0x403
je 0x55f2d8
cmp ax, 0x501
je 0x55f2e6
cmp ax, 0x503
je 0x55f2e6
jmp 0x55f321
cmp ax, 0x804
ja 0x55f2e0
cmp ax, 0x601
je 0x55f2f3
cmp ax, 0x603
je 0x55f2f3
cmp ax, 0x804
jne 0x55f321
mov edx, 5
jmp 0x55f30d
cmp ax, 0x805
jne 0x55f2ed
mov edx, 6
jmp 0x55f30d
cmp ax, 0x806
jne 0x55f300
mov edx, 7
jmp 0x55f30d
cmp ax, 0x807
jne 0x55f321
mov rdx, qword [0x00838010]
mov eax, ecx
mov rbx, rdx
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
movups xmmword [rsp + 0x28], xmm15
call fcn.0040a6c0
lea rcx, [0x00604040]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x00651bda]
mov ebx, 0x23
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
call fcn.0040a6c0
lea rcx, [0x00604040]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x00651bda]
mov ebx, 0x23
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov word [rsp + 8], ax
call fcn.0045f280
movzx eax, word [rsp + 8]
jmp fcn.0055f1e0
Function at 0x55f3e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55f4ff
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
test rax, rax
je 0x55f4bd
mov edx, dword [rax + 0x10]
cmp edx, 0x188a5798
jne 0x55f460
lea rdx, [0x00608200]
nop dword [rax]
cmp rax, rdx
jne 0x55f4bd
lea rax, [0x0065772e]
mov ebx, 0x39
xor ecx, ecx
xor edi, edi
mov rsi, rdi
nop dword [rax]
call fcn.004acb60
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp edx, 0x2fd00e80
jne 0x55f48c
lea rdx, [0x006269a0]
cmp rax, rdx
jne 0x55f4bd
mov eax, 0xffffffe3
mov ebx, 3
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp edx, 0xcc456746
jne 0x55f4bd
lea rdx, [0x0060b8c0]
nop dword [rax + rax]
cmp rax, rdx
jne 0x55f4bd
mov eax, 0xffffffe1
mov ebx, 8
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
lea rax, [0x0064fec8]
mov ebx, 0x1f
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0055f3e0
Function at 0x55f9c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55faff
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x88], rdi
mov word [rsp + 0x70], ax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x80], rcx
call fcn.0055f520
test rbx, rbx
je 0x55fa56
mov rdx, qword [rsp + 0x88]
test rdx, rdx
jne 0x55fa31
movzx esi, word [rsp + 0x70]
cmp si, 0x303
jne 0x55fa31
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x24], 0x2030201
mov edx, 2
lea rsi, [rsp + 0x24]
jmp 0x55fa39
mov rsi, qword [rsp + 0x80]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x28], rbx
xor edi, edi
jmp 0x55fa99
mov rax, qword [rsp + 0x58]
nop dword [rax + rax]
call fcn.0055fb40
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov r8, qword [rsp + 0x38]
lea rdi, [r8 + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
cmp rdi, rdx
jge 0x55fadc
mov qword [rsp + 0x38], rdi
movzx edx, word [rsi + rdi*2]
mov word [rsp + 0x22], dx
mov r8, rax
mov eax, edx
mov r9, rbx
mov rbx, r8
mov r10, rcx
mov rcx, r9
mov rdi, r10
call fcn.00561fe0
test al, al
je 0x55fa77
movzx eax, word [rsp + 0x22]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x006588b0]
mov ebx, 0x47
call fcn.00468600
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov word [rsp + 8], ax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0045f280
movzx eax, word [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0055f9c0
Function at 0x561a20
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x561c8f
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rbx
movzx edx, word [rax + 0x30]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
mov rsi, qword [rax + 0x28]
mov eax, edx
call fcn.0055f9c0
test rbx, rbx
jne 0x561ab3
mov rdx, qword [rsp + 0xa8]
cmp qword [rdx + 8], 0
nop
je 0x561a9f
mov r9, qword [rsp + 0xb0]
mov r10, qword [r9 + 8]
mov r11, qword [r9]
test r10, r10
je 0x561ac9
mov qword [rsp + 0x50], r10
xor eax, eax
jmp 0x561af1
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rax, rbx
mov rbx, rcx
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
lea rax, [0x00652f86]
mov ebx, 0x27
call fcn.00468600
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
add r11, 0x18
mov rax, r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x70], r11
mov r12, qword [r11]
mov rbx, qword [r11 + 8]
mov rcx, qword [r11 + 0x10]
mov r13, qword [r9 + 0x70]
test rax, rax
jne 0x561b14
test r13, r13
jne 0x561b47
mov rax, r12
call fcn.00554700
nop dword [rax]
test rbx, rbx
jne 0x561b96
mov rdx, qword [rsp + 0xa8]
mov r9, qword [rsp + 0xb0]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x70]
mov r13, rax
mov rax, qword [rsp + 0x30]
mov r12, qword [rdx + 8]
mov r15, qword [rdx]
test r12, r12
je 0x561b84
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r12
xor ecx, ecx
nop
jmp 0x561c34
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0xa8]
mov r9, qword [rsp + 0xb0]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x70]
lea r12, [rax + 1]
cmp r10, r12
jg 0x561aea
jmp 0x561ac9
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x60], rcx
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
mov rax, qword [rsp + 0x30]
call fcn.0040a7c0
lea rcx, [0x005fd960]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x561bdd
mov rbx, qword [rcx + 8]
jmp 0x561be0
mov rbx, rcx
mov qword [rsp + 0x88], rbx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x90], rdx
lea rax, [0x00655aa8]
mov ebx, 0x30
lea rcx, [rsp + 0x78]
mov edi, 2
mov rsi, rdi
call fcn.004acb60
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov r10, qword [rsp + 0x68]
lea r15, [r10 + 0x18]
mov r13, qword [rsp + 0x58]
mov rcx, rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x68], r15
mov rdi, qword [r15]
mov rsi, qword [r15 + 8]
mov r8, qword [r15 + 0x10]
mov rax, qword [r13 + 0x60]
mov rbx, qword [r13 + 0x68]
mov rdx, qword [r13 + 0x70]
mov rcx, rdx
call fcn.004d20c0
nop dword [rax]
test al, al
jne 0x561c7b
mov rdx, qword [rsp + 0x40]
inc rdx
mov r9, qword [rsp + 0x48]
cmp r9, rdx
jg 0x561c23
jmp 0x561b65
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00561a20