joyce8/EMBER2024-capa huggingface dataset:
Function at 0x566a20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x566c3f
push rbp
mov rbp, rsp
sub rsp, 0x48
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d954b]
mov ecx, 0x9d
mov edi, 0xa
call fcn.00529340
test bl, bl
je 0x566c2b
mov qword [rsp + 0x40], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d95e8]
mov ecx, 0x9d
mov edi, 0xa
call fcn.00529340
test bl, bl
je 0x566c18
mov qword [rsp + 0x38], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d91f6]
mov ecx, 0x84
mov edi, 0x10
call fcn.00529340
test bl, bl
je 0x566c05
mov qword [rsp + 0x30], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d927a]
mov ecx, 0x84
mov edi, 0x10
call fcn.00529340
test bl, bl
je 0x566bf0
mov qword [rsp + 0x28], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d92fe]
mov ecx, 0x84
mov edi, 0x10
call fcn.00529340
test bl, bl
je 0x566bdd
mov qword [rsp + 0x20], rax
lea rax, [0x006aebc0]
call fcn.0040d480
mov qword [rax + 0x38], 5
lea rcx, [0x006c4f6d]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x209
cmp dword [0x0092d940], 0
jne 0x566b6d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x566b9e
call fcn.0045fea0
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rdx, qword [rsp + 0x38]
mov qword [r11 + 8], rdx
mov rbx, qword [rsp + 0x30]
mov qword [r11 + 0x10], rbx
mov rsi, qword [rsp + 0x28]
mov qword [r11 + 0x18], rsi
mov rdi, qword [rsp + 0x20]
mov qword [r11 + 0x20], rdi
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rcx, qword [0x008996a8]
test byte [rcx], al
cmp dword [0x0092d940], 0
je 0x566bd3
call fcn.0045fe40
mov qword [r11], rax
mov rdx, qword [rcx + 8]
mov qword [r11 + 8], rdx
mov qword [rcx + 8], rax
add rsp, 0x48
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
nop
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
nop
nop
call fcn.0045df00
jmp fcn.00566a20
Function at 0x569620
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5696c6
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov rdx, qword [rbx + 0x50]
mov rbx, rdx
call fcn.00569860
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx]
mov r9, qword [r8]
mov rdx, r8
call r9
mov rdx, qword [rsp + 0x58]
lea r8, [rdx + 0x28]
mov r9, qword [rdx + 0x28]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rdx, r8
call r9
test rbx, rbx
jne 0x5696b0
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rdx + 0x50]
mov rcx, rax
mov rax, qword [rsp + 0x50]
call fcn.00569b40
add rsp, 0x40
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740e70]
nop
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.00569620

Function at 0x569720
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5697fc
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r9
mov rdx, qword [rbx + 0x48]
mov rbx, rdx
call fcn.00569d80
nop word [rax + rax]
test rbx, rbx
jne 0x5697e8
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
call fcn.00569860
mov rdx, qword [rsp + 0x48]
lea r8, [rdx + 0x20]
mov r9, qword [rdx + 0x20]
mov rdi, rbx
mov rsi, rcx
mov rbx, qword [rsp + 0x28]
mov rcx, rax
mov rax, rbx
mov rdx, r8
call r9
test rbx, rbx
jne 0x5697d5
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x48]
mov rcx, rax
mov rax, qword [rsp + 0x40]
call fcn.00569b40
add rsp, 0x30
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740e70]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e80]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
nop
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00569720
Function at 0x569a20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x569ade
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov rdx, qword [rbx + 0x38]
mov rbx, rdx
call fcn.00569d80
test rbx, rbx
jne 0x569aca
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rdx + 0x38]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
call fcn.00569d80
test rbx, rbx
jne 0x569ab7
mov rdx, qword [rsp + 0x40]
lea rsi, [rdx + 0x10]
mov rdi, qword [rdx + 0x10]
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rax, rbx
mov rdx, rsi
call rdi
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsi + 0x38]
mov rcx, rax
mov rax, qword [rsp + 0x38]
call fcn.00569b40
add rsp, 0x28
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740e90]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e90]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax]
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00569a20
Function at 0x56f180
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x56f205
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x56f366
cmp rcx, 0xe
jne 0x56f280
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x56f366
cmp rcx, 0xf
jne 0x56f2f7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x56f366
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x575980
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x575a65
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3d
lea rsi, [rdi + rdx]
and rsi, 0xfffffffffffffff8
sub rdx, rsi
lea rsi, [rdx - 8]
neg rsi
cmp rsi, 8
je 0x575a18
test rbx, rbx
je 0x575a18
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
cmp rsi, 8
sbb edx, edx
mov byte [rsp + 0x1f], dl
lea rax, [0x0066d1c0]
mov rcx, rbx
call fcn.004479c0
mov rdx, qword [rsp + 0x38]
movzx esi, byte [rdx]
mov rcx, qword [rsp + 0x28]
shr sil, cl
movzx edi, byte [rsp + 0x1f]
and esi, edi
mov byte [rax], sil
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov r8d, 1
jmp 0x575a57
add rsp, 0x40
pop rbp
ret
movzx r9d, byte [r8 + rdx - 1]
mov r10, rcx
mov rcx, rsi
shl r9d, cl
lea r11, [r8 + 1]
cmp rcx, 0x20
sbb r12d, r12d
and r9d, r12d
mov byte [rax + r8], r9b
movzx r12d, byte [rdx + r8]
mov rcx, r10
shr r12b, cl
and r12d, edi
or r9d, r12d
mov byte [rax + r8], r9b
mov r8, r11
cmp rbx, r8
jg 0x575a1e
mov rcx, rbx
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00575980
Function at 0x575aa0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x575d51
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xc0], rax
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
lea rax, [rsp + 0x88]
mov ebx, 0x20
call fcn.00471f00
movups xmmword [rsp + 0x45], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc0]
xor eax, eax
jmp 0x575b80
mov qword [rsp + 0x78], r8
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0x70], rcx
add rdx, r9
mov rsi, rax
mov rax, rdx
mov rdi, rbx
mov rbx, rsi
mov rcx, rdi
call fcn.00460ba0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x98], rdx
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rdx
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rdx
mov rax, qword [rsp + 0x58]
inc rax
mov rdx, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc0]
mov rcx, rdx
mov rdx, rsi
nop
cmp rcx, rax
jle 0x575cf2
mov qword [rsp + 0x58], rax
mov rdi, qword [rdx + rax*8]
test rax, rax
jle 0x575c43
mov r8, qword [rsp + 0x88]
nop
nop
test r8, r8
je 0x575bbc
lea r9, [rsp + 0x88]
cmp r8, r9
je 0x575bcc
jmp 0x575d3d
lea r8, [rsp + 0x88]
mov qword [rsp + 0x88], r8
mov r8, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x98]
inc rbx
mov r9, qword [rsp + 0x90]
cmp r8, rbx
jae 0x575c35
mov qword [rsp + 0x68], rdi
mov rax, r9
mov rcx, r8
mov edi, 1
lea rsi, [0x0066d1c0]
call fcn.00447aa0
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0x68]
mov r9, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x98], rbx
mov byte [rbx + r9 - 1], 0x2e
lea rax, [rsp + 0x45]
xor ebx, ebx
mov ecx, 0x13
mov esi, 0xa
call fcn.004870e0
mov rdx, qword [rsp + 0x88]
nop
test rdx, rdx
je 0x575c79
lea r8, [rsp + 0x88]
cmp rdx, r8
je 0x575c89
jmp 0x575d2a
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x88], rdx
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
lea r8, [rdx + rbx]
mov r9, qword [rsp + 0x90]
cmp rcx, r8
jae 0x575b0e
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], rdx
mov rax, r9
mov rdi, rbx
lea rsi, [0x0066d1c0]
mov rbx, r8
call fcn.00447aa0
mov rdx, qword [rsp + 0x78]
mov r9, rax
mov r8, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x60]
jmp 0x575b0e
mov rax, qword [rsp + 0x90]
mov rcx, rax
neg rcx
mov rbx, qword [rsp + 0x98]
nop
cmp rbx, rcx
ja 0x575d17
add rsp, 0xb0
pop rbp
ret
test rax, rax
je 0x575d25
nop dword [rax]
call fcn.00456d40
call fcn.00456d80
lea rax, [0x0066d140]
lea rbx, [0x007401e0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007401e0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00575aa0
Function at 0x576560
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x576628
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
xor ecx, ecx
jmp 0x576580
inc rcx
nop
cmp rbx, rcx
jle 0x576611
movzx edx, byte [rax + rcx]
lea esi, [rdx - 0x61]
cmp sil, 0x19
jbe 0x57657b
lea esi, [rdx - 0x41]
cmp sil, 0x19
jbe 0x57657b
lea esi, [rdx - 0x30]
cmp sil, 9
jbe 0x57657b
lea esi, [rdx - 0x27]
cmp sil, 2
jbe 0x57657b
lea esi, [rdx - 0x2b]
cmp sil, 4
jbe 0x57657b
cmp dl, 0x20
je 0x57657b
nop
cmp dl, 0x3a
je 0x57657b
cmp dl, 0x3d
je 0x57657b
cmp dl, 0x3f
je 0x57657b
cmp dl, 0x2a
je 0x57657b
cmp dl, 0x26
je 0x57657b
lea rcx, [0x006d2ee4]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0x2a
mov rax, qword [rsp + 0x18]
mov ebx, 0x2a
call fcn.0040a940
xor ebx, ebx
lea rcx, [0x007424a0]
mov rdi, rax
xor eax, eax
add rsp, 0x28
pop rbp
ret
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044af60
xor ecx, ecx
xor edi, edi
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00576560
Function at 0x57ba00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57bac5
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
xor ecx, ecx
jmp 0x57ba20
inc rcx
nop
cmp rbx, rcx
jle 0x57baac
movzx edx, byte [rax + rcx]
lea esi, [rdx - 0x61]
cmp sil, 0x19
jbe 0x57ba1b
lea esi, [rdx - 0x41]
cmp sil, 0x19
jbe 0x57ba1b
lea esi, [rdx - 0x30]
cmp sil, 9
jbe 0x57ba1b
lea esi, [rdx - 0x27]
cmp sil, 2
jbe 0x57ba1b
lea esi, [rdx - 0x2b]
cmp sil, 4
jbe 0x57ba1b
cmp dl, 0x20
je 0x57ba1b
nop
cmp dl, 0x3a
je 0x57ba1b
cmp dl, 0x3d
je 0x57ba1b
cmp dl, 0x3f
je 0x57ba1b
cmp dl, 0x2a
je 0x57ba1b
lea rcx, [0x006d2ee4]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], 0x2a
mov rax, qword [rsp + 0x10]
mov ebx, 0x2a
call fcn.0040a940
xor ebx, ebx
lea rcx, [0x00742660]
mov rdi, rax
xor eax, eax
add rsp, 0x20
pop rbp
ret
call fcn.0040a940
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00743360]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0057ba00

Function at 0x57bfc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57c126
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x98], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x38], rdi
nop
mov rax, rdi
mov rbx, rsi
mov rcx, r8
xor edi, edi
call fcn.004ae540
cmp rax, 0x270f
ja 0x57c022
nop
mov dword [rsp + 0x34], 0
xor ecx, ecx
nop
jmp 0x57c06c
lea rcx, [0x006d2434]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 0x28
mov rax, qword [rsp + 0x50]
mov ebx, 0x28
call fcn.0040a940
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00742660]
mov rsi, rax
xor eax, eax
add rsp, 0x60
pop rbp
ret
add r9d, 0x30
mov byte [rsp + rsi + 0x34], r9b
inc rcx
mov rax, rdx
cmp rcx, 4
jge 0x57c0af
lea rdx, [rcx - 3]
neg rdx
mov rbx, rax
movabs rax, 0xcccccccccccccccd
mov rsi, rdx
imul rbx
add rdx, rbx
sar rdx, 3
mov r9, rbx
sar rbx, 0x3f
sub rdx, rbx
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rsi, 4
jb 0x57c05d
jmp 0x57c117
mov rbx, qword [rsp + 0x78]
lea rdx, [rbx + 4]
mov rcx, qword [rsp + 0x80]
cmp rcx, rdx
jb 0x57c0cc
mov rax, qword [rsp + 0x70]
jmp 0x57c0ed
mov rax, qword [rsp + 0x70]
mov rbx, rdx
mov edi, 4
lea rsi, [0x0066d1c0]
call fcn.00447aa0
mov rdx, rbx
mov rbx, qword [rsp + 0x78]
mov r9d, dword [rsp + 0x34]
mov dword [rax + rbx], r9d
mov rbx, rdx
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
call fcn.0057c180
xor edi, edi
xor esi, esi
add rsp, 0x60
pop rbp
ret
mov rax, rsi
mov ecx, 4
nop
call fcn.004601e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0057bfc0
Function at 0x580d40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5811e6
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rsp + 0xd8], r8
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xb8], rbx
mov byte [rsp + 0x37], 0
mov qword [rsp + 0x68], 0
movups xmmword [rsp + 0x70], xmm15
lea rbx, [rsp + 0x68]
lea rcx, [rsp + 0x37]
call fcn.00580c40
nop dword [rax]
test al, al
je 0x5811b2
cmp byte [rsp + 0x37], 0
jne 0x581173
mov rdx, qword [rsp + 0xb8]
nop dword [rax + rax]
test rdx, rdx
je 0x5811bd
mov esi, dword [rdx + 0x10]
shr esi, 7
and esi, 0x1f
lea rax, [0x00746340]
jmp qword [rax + rsi*8]
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
call fcn.0057f920
test al, al
je 0x5811a7
cmp qword [rsp + 0x70], 0
jne 0x5811a7
mov eax, 1
add rsp, 0xa0
pop rbp
ret
xor eax, eax
add rsp, 0xa0
pop rbp
ret
xor eax, eax
add rsp, 0xa0
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x007410e0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007410d0]
nop
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00580d40
Function at 0x581500
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x581686
push rbp
mov rbp, rsp
sub rsp, 0x38
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], bl
cmp qword [rax], 0
nop
jne 0x581667
cmp qword [rax + 0x30], 0
jne 0x58166d
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x18]
inc rdx
nop dword [rax]
test rdx, rdx
jg 0x581597
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x1b
lea rcx, [0x006cc659]
mov qword [rax], rcx
lea rcx, [0x00741740]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
cmp dword [0x0092d940], 0
je 0x581590
nop dword [rax]
call fcn.0045fe40
mov qword [r11], rax
mov r8, qword [rdx + 8]
mov qword [r11 + 8], r8
mov qword [rdx + 8], rax
mov rax, rdx
cmp byte [rax + 0x28], 0
je 0x5815f8
mov rdx, qword [rax + 0x18]
inc rdx
cmp qword [rax + 0x20], rdx
jge 0x5815f8
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x36
lea rcx, [0x006d5ff0]
mov qword [rax], rcx
lea rcx, [0x00741740]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
cmp dword [0x0092d940], 0
nop
je 0x5815f2
call fcn.0045fe40
mov qword [r11], rax
mov rcx, qword [rdx + 8]
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rax
jmp 0x581667
mov rcx, qword [rax + 0x20]
mov rbx, qword [rax + 0x18]
lea rdx, [rbx + 1]
mov r8, qword [rax + 0x10]
cmp rcx, rdx
jae 0x581639
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 1
lea rsi, [0x0066d1c0]
call fcn.00447aa0
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rsp + 0x2f]
mov byte [r8 + rbx], sil
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rcx
cmp dword [0x0092d940], 0
je 0x581663
call fcn.0045fe40
mov qword [r11], r8
mov rcx, qword [rax + 0x10]
mov qword [r11 + 8], rcx
mov qword [rax + 0x10], r8
add rsp, 0x38
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740ac0]
nop dword [rax + rax]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.0045df00
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
nop
jmp fcn.00581500
Function at 0x5816c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x581846
push rbp
mov rbp, rsp
sub rsp, 0x38
mov word [rsp + 0x2e], 0
rol bx, 8
mov word [rsp + 0x2e], bx
cmp qword [rax], 0
jne 0x58182a
cmp qword [rax + 0x30], 0
jne 0x581830
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x18]
add rdx, 2
cmp rdx, 2
jge 0x581759
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x1b
lea rcx, [0x006cc659]
mov qword [rax], rcx
lea rcx, [0x00741740]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
cmp dword [0x0092d940], 0
nop
je 0x581752
call fcn.0045fe40
mov qword [r11], rax
mov r8, qword [rdx + 8]
mov qword [r11 + 8], r8
mov qword [rdx + 8], rax
mov rax, rdx
cmp byte [rax + 0x28], 0
je 0x5817ba
mov rdx, qword [rax + 0x18]
add rdx, 2
cmp qword [rax + 0x20], rdx
jge 0x5817ba
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x36
lea rcx, [0x006d5ff0]
mov qword [rax], rcx
lea rcx, [0x00741740]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
cmp dword [0x0092d940], 0
je 0x5817b4
call fcn.0045fe40
mov qword [r11], rax
mov rcx, qword [rdx + 8]
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rax
jmp 0x58182a
mov rcx, qword [rax + 0x20]
mov rbx, qword [rax + 0x18]
lea rdx, [rbx + 2]
mov r8, qword [rax + 0x10]
cmp rcx, rdx
jae 0x5817fb
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 2
lea rsi, [0x0066d1c0]
call fcn.00447aa0
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
movzx esi, word [rsp + 0x2e]
mov word [r8 + rbx], si
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rcx
cmp dword [0x0092d940], 0
je 0x581826
call fcn.0045fe40
mov qword [r11], r8
mov rcx, qword [rax + 0x10]
mov qword [r11 + 8], rcx
mov qword [rax + 0x10], r8
add rsp, 0x38
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740ac0]
nop
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.0045df00
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
nop
jmp fcn.005816c0