joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55d840
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x55daf9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x55daa4
cmp rax, 1
jne 0x55da20
xor ecx, ecx
xor edx, edx
test rcx, rcx
jne 0x55d9fa
lea rcx, [0x00694c00]
mov qword [rsp], rcx
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jle 0x55d9f3
mov rdx, qword [rsp + 0x68]
movzx ebx, byte [rdx]
and ebx, 0xffffff80
cmp bl, 0x80
jne 0x55d9a7
lea rbx, [0x0066fcc0]
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rcx
call fcn.0043e630
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
xor edi, edi
cmp rdi, rcx
jge 0x55d920
cmp rdi, rbx
jae 0x55d9a0
movzx r8d, byte [rsi + rdi]
not r8d
mov byte [rax + rdi], r8b
inc rdi
cmp rdi, rcx
jl 0x55d903
mov rbx, qword [rsp + 0x30]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
call fcn.004ce140
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rax
mov rcx, qword [0x008962a8]
mov qword [rsp + 0x10], rcx
call fcn.004cd1e0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x10]
test rcx, rcx
jle 0x55d99c
movzx ecx, byte [rax]
xor ecx, 1
mov byte [rax], cl
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
xor ecx, ecx
jmp 0x55d970
call fcn.004293e0
ud2
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x18], rcx
call fcn.004ce140
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rdx, qword [rsp + 0x68]
jmp 0x55d9a7
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rdx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rcx, qword [rsp + 0x68]
movzx edx, byte [rcx]
test dl, dl
jne 0x55da8a
movzx ebx, byte [rcx + 1]
test bl, 0x80
jne 0x55da8a
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x006d7ab7]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], 0x1d
lea rdx, [0x007e5800]
mov qword [rsp], rdx
lea rdx, [rsp + 0x38]
mov qword [rsp + 8], rdx
call fcn.0040cd80
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x70]
jmp 0x55d884
cmp dl, 0xff
jne 0x55da9b
movzx edx, byte [rcx + 1]
and edx, 0xffffff80
cmp dl, 0x80
je 0x55da35
xor ecx, ecx
xor edx, edx
jmp 0x55d884
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
lea rcx, [0x006d1d40]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], 0xd
lea rcx, [0x007e5800]
mov qword [rsp], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 8], rcx
call fcn.0040cd80
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x70]
jmp 0x55d884
call fcn.00452210
jmp fcn.0055d840
Function at 0x55e7d0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x58]
cmp rax, qword [rcx + 0x10]
jbe 0x55eac6
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
mov qword [rsp], 0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x18], rax
call fcn.004426a0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x70], rcx
lea rdx, [0x006d38a7]
mov qword [rsp], rdx
mov qword [rsp + 8], 0x13
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.00475900
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x88], rax
mov ecx, dword [rsp + 0x28]
mov dword [rsp + 0x4c], ecx
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x60], rdx
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x80], rbx
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x78], rsi
test rbx, rbx
jne 0x55ea8f
mov qword [rsp], rdx
mov dword [rsp + 8], ecx
mov qword [rsp + 0x10], rax
lea rdi, [0x006d38a7]
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], 0x13
call fcn.00472ea0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
je 0x55ea46
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rcx, [rsp + 0xa0]
mov qword [rsp + 8], rcx
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rcx
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rcx
lea rax, [0x006df6df]
mov qword [rsp], rax
mov qword [rsp + 8], 0x6a
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 2
call fcn.004b0de0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0xf8], rdx
mov edx, dword [rsp + 0x4c]
mov dword [rsp + 0x100], edx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x108], rdx
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rcx
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdx
call fcn.00454360
movzx eax, byte [rsp + 0x20]
test al, al
je 0x55ea7b
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
jmp 0x55e9fe
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
jmp 0x55e8f9
mov qword [rsp + 0xf8], rdx
mov dword [rsp + 0x100], ecx
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rsi
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
call fcn.00452210
jmp fcn.0055e7d0
Function at 0x55ead0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x55ec92
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
xor ebx, ebx
cmp rbx, rax
jge 0x55eb31
movzx esi, byte [rcx]
lea edi, [rsi - 0x61]
cmp dil, 0x19
ja 0x55ebf9
mov esi, 1
test sil, sil
je 0x55eb85
inc rcx
inc rbx
cmp rbx, rax
jl 0x55eb0c
mov qword [rsp], 0
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x18], rax
call fcn.004426a0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [0x006db53e]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x2a
lea rax, [0x007e5840]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040cd80
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea edi, [rsi - 0x41]
cmp dil, 0x19
ja 0x55ec0c
mov esi, 1
jmp 0x55eb21
lea edi, [rsi - 0x30]
cmp dil, 9
ja 0x55ec1f
mov esi, 1
jmp 0x55eb21
lea edi, [rsi - 0x27]
cmp dil, 2
ja 0x55ec32
mov esi, 1
jmp 0x55eb21
lea edi, [rsi - 0x2b]
cmp dil, 4
ja 0x55ec45
mov esi, 1
jmp 0x55eb21
cmp sil, 0x20
jne 0x55ec55
mov esi, 1
jmp 0x55eb21
cmp sil, 0x3a
jne 0x55ec65
mov esi, 1
jmp 0x55eb21
cmp sil, 0x3d
jne 0x55ec75
mov esi, 1
jmp 0x55eb21
cmp sil, 0x3f
jne 0x55ec85
mov esi, 1
jmp 0x55eb21
cmp sil, 0x2a
sete sil
jmp 0x55eb21
call fcn.00452210
jmp fcn.0055ead0

Function at 0x55eca0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x55edb8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
xor ebx, ebx
cmp rbx, rax
jge 0x55ecf0
movzx esi, byte [rcx]
cmp sil, 0x80
jae 0x55ed44
inc rcx
inc rbx
cmp rbx, rax
jl 0x55ecdc
mov qword [rsp], 0
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x18], rax
call fcn.004426a0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [0x006d9d64]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x24
lea rax, [0x007e5840]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040cd80
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00452210
jmp fcn.0055eca0
Function at 0x583170
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x58322a
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b3fcc]
cmp al, 1
jbe 0x5831ad
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x5831b6
call fcn.00429680
ud2
mov byte [0x008b3fcc], 1
call fcn.0045cd90
call fcn.004da440
lea rax, [0x006d808b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896ce0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x583213
mov qword [0x00896ce8], rcx
mov byte [0x008b3fcc], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00896ce8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x583202
call fcn.00452210
jmp fcn.00583170
Function at 0x589510
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x589774
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
lea rax, [0x0069e3e0]
mov qword [rsp], rax
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x10], rcx
lea rcx, [0x00662800]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
call fcn.00563620
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
test rcx, rcx
jne 0x589742
test rax, rax
je 0x589634
lea rax, [0x0068d4a0]
mov qword [rsp], rax
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x50], rax
mov qword [rax + 8], 0x2d
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x589618
lea rcx, [0x006dc178]
mov qword [rax], rcx
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
lea rcx, [0x007e49c0]
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp], rax
lea rcx, [0x006dc178]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x50]
jmp 0x5895df
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
mov rbx, qword [rax + 0x28]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rbx
call fcn.00589e00
mov rax, qword [rsp + 0x18]
test rax, rax
jne 0x5896f1
lea rax, [0x0068d4a0]
mov qword [rsp], rax
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x50], rax
mov qword [rax + 8], 0x22
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x5896d5
lea rcx, [0x006d9852]
mov qword [rax], rcx
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
lea rcx, [0x007e49c0]
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp], rax
lea rcx, [0x006d9852]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x50]
jmp 0x58969c
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 8], rcx
mov qword [rsp], rax
call fcn.0058b1a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rbx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.00452210
jmp fcn.00589510
Function at 0x58fa60
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x58fc42
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b3fda]
cmp al, 1
jbe 0x58fa9d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x58faa6
call fcn.00429680
ud2
mov byte [0x008b3fda], 1
call fcn.0055d220
call fcn.00451ac0
call fcn.005583e0
call fcn.00555490
call fcn.0055bf30
call fcn.0050eba0
call fcn.00517c60
call fcn.0045cd90
call fcn.004c82e0
call fcn.004e1820
call fcn.0056a350
call fcn.004da440
call fcn.0056ca40
call fcn.004b9c90
call fcn.0045bcb0
call fcn.0046a3f0
call fcn.00581b40
call fcn.00578020
call fcn.004cb700
call fcn.0054d9b0
call fcn.0047cd30
call fcn.004db5d0
call fcn.00583170
call fcn.00510390
call fcn.00514060
call fcn.0057c770
call fcn.00496290
lea rax, [0x006d9cb1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896de0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x58fc28
mov qword [0x00896de8], rcx
lea rax, [0x006dd279]
mov qword [rsp], rax
mov qword [rsp + 8], 0x32
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896df0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x58fc11
mov qword [0x00896df8], rcx
lea rax, [0x006ddc89]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00896dd0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x58fbfa
mov qword [0x00896dd8], rcx
mov byte [0x008b3fda], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00896dd8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x58fbe9
lea rax, [0x00896df8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x58fbae
lea rax, [0x00896de8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x58fb73
call fcn.00452210
jmp fcn.0058fa60

Function at 0x592b40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x592c04
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b403a]
cmp al, 1
jbe 0x592b7d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x592b86
call fcn.00429680
ud2
mov byte [0x008b403a], 1
call fcn.00555490
call fcn.004c8790
call fcn.00590f00
lea rax, [0x006dc625]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2f
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00897630], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x592bed
mov qword [0x00897638], rcx
call fcn.00591690
mov byte [0x008b403a], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00897638]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x592bd7
call fcn.00452210
jmp fcn.00592b40
Function at 0x5c7980
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5c7c09
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x10], rdx
call fcn.00583e60
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x5c7bd9
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x10], rdx
call fcn.00584550
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
test rax, rax
jne 0x5c7af2
test rdx, rdx
je 0x5c7a70
mov eax, dword [rdx + 0x10]
cmp eax, 0xc81a15f
jne 0x5c7a5b
lea rbx, [0x00698f80]
cmp rbx, rdx
jne 0x5c7a5b
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp eax, 0xcabf83d1
jne 0x5c7a70
lea rax, [0x006aa0e0]
cmp rax, rdx
jne 0x5c7a70
jmp 0x5c7a32
lea rax, [0x0068d4a0]
mov qword [rsp], rax
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x38], rax
mov qword [rax + 8], 0x36
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x5c7ad6
lea rcx, [0x006ddbe7]
mov qword [rax], rcx
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
lea rcx, [0x007e49c0]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp], rax
lea rcx, [0x006ddbe7]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x38]
jmp 0x5c7aa6
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x10], rax
call fcn.00585eb0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x5c7ba9
lea rax, [0x0068d4a0]
mov qword [rsp], rax
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x38], rax
mov qword [rax + 8], 0x20
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x5c7b8d
lea rcx, [0x006d8dcb]
mov qword [rax], rcx
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
lea rcx, [0x007e49c0]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp], rax
lea rcx, [0x006d8dcb]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x38]
jmp 0x5c7b5d
lea rcx, [0x006aa0e0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [0x00698f80]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00452210
jmp fcn.005c7980
Function at 0x5cb040
Capabilities:
Parse credit card information

Disassembly:
movzx eax, byte [rsp + 8]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x5cb053
mov byte [rsp + 0x18], 0
ret
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x5cb04d
lea ecx, [rax - 0x30]
cmp cl, 9
jbe 0x5cb04d
mov rcx, qword [rsp + 0x10]
cmp rcx, 3
jne 0x5cb1cc
cmp al, 0x2c
ja 0x5cb1ab
lea edx, [rax - 0x21]
cmp dl, 1
ja 0x5cb088
mov byte [rsp + 0x18], 0
ret
cmp al, 0x24
je 0x5cb082
lea edx, [rax - 0x26]
cmp dl, 6
jbe 0x5cb082
cmp al, 0x2f
ja 0x5cb174
cmp al, 0x26
ja 0x5cb14d
cmp al, 0x24
jne 0x5cb144
cmp rcx, 2
jg 0x5cb0f9
cmp rcx, 1
je 0x5cb0ef
cmp rcx, 2
jne 0x5cb0e9
cmp al, 0x2f
jne 0x5cb0cc
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x3b
jne 0x5cb0d7
mov eax, 1
jmp 0x5cb0c7
cmp al, 0x2c
jne 0x5cb0e2
mov eax, 1
jmp 0x5cb0c7
cmp al, 0x3f
sete al
jmp 0x5cb0c7
mov byte [rsp + 0x18], 1
ret
cmp al, 0x3f
sete al
mov byte [rsp + 0x18], al
ret
cmp rcx, 5
jne 0x5cb12a
cmp al, 0x40
jne 0x5cb10d
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x2f
jne 0x5cb118
mov eax, 1
jmp 0x5cb108
cmp al, 0x3f
jne 0x5cb123
mov eax, 1
jmp 0x5cb108
cmp al, 0x3a
sete al
jmp 0x5cb108
cmp rcx, 6
je 0x5cb13e
cmp rcx, 7
je 0x5cb138
jmp 0x5cb0e9
mov byte [rsp + 0x18], 0
ret
mov byte [rsp + 0x18], 1
ret
cmp al, 0x26
jne 0x5cb0e9
jmp 0x5cb0ac
lea edx, [rax - 0x2b]
cmp dl, 1
jbe 0x5cb0ac
lea edx, [rax - 0x2d]
cmp dl, 1
ja 0x5cb167
mov byte [rsp + 0x18], 0
ret
cmp al, 0x2f
jne 0x5cb0e9
jmp 0x5cb0ac
cmp al, 0x3d
ja 0x5cb191
lea edx, [rax - 0x3a]
cmp dl, 1
jbe 0x5cb0ac
cmp al, 0x3d
jne 0x5cb0e9
jmp 0x5cb0ac
lea edx, [rax - 0x3f]
cmp dl, 1
jbe 0x5cb0ac
cmp al, 0x5f
je 0x5cb161
cmp al, 0x7e
jne 0x5cb0e9
jmp 0x5cb161
lea edx, [rax - 0x3a]
cmp dl, 4
jbe 0x5cb082
cmp al, 0x5b
je 0x5cb082
cmp al, 0x5d
jne 0x5cb094
jmp 0x5cb082
cmp rcx, 4
jne 0x5cb094
jmp 0x5cb072
Function at 0x5d2f80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5d3181
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movzx eax, byte [0x008b4000]
cmp al, 1
jbe 0x5d2fbd
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
jne 0x5d2fc6
call fcn.00429680
ud2
mov byte [0x008b4000], 1
call fcn.004cb700
call fcn.004e3090
call fcn.004b9c90
call fcn.0045cd90
call fcn.004c82e0
call fcn.0045bcb0
call fcn.004ba9f0
call fcn.004e5430
call fcn.00470f60
lea rax, [0x006d9b0d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a4a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x00896ff0], rcx
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x5d3167
mov qword [0x00896ff8], rax
mov rax, qword [0x008962c0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x3f
call fcn.004e3030
mov rax, qword [rsp + 0x10]
mov qword [0x008b40e0], rax
lea rax, [0x006835e0]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
call fcn.00407900
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov qword [rsp + 0x30], rcx
cmp rcx, 0xa
jge 0x5d3112
shl rcx, 4
mov qword [rsp + 0x28], rcx
lea rbx, [0x006f20c0]
lea rsi, [rcx + rbx]
mov qword [rsp + 0x10], rsi
lea rsi, [0x006835e0]
mov qword [rsp], rsi
mov qword [rsp + 8], rax
call fcn.00408570
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
lea rdx, [0x006f2160]
mov rbx, qword [rdx + rcx]
mov rcx, qword [rdx + rcx + 8]
mov qword [rax + 8], rcx
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x5d3150
mov qword [rax], rbx
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx + 1]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rcx
cmp rcx, 0xa
jl 0x5d30a0
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x5d3139
mov qword [0x008963f8], rax
call fcn.005d2d30
mov byte [0x008b4000], 2
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [0x008963f8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x5d3123
mov qword [rsp], rax
mov qword [rsp + 8], rbx
call fcn.00410240
lea rdx, [0x006f2160]
jmp 0x5d30f9
lea rcx, [0x00896ff8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x5d3039
call fcn.00452210
jmp fcn.005d2f80