joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b2180
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5b2451
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xb0], rax
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
mov rbx, qword [rax + 0x80]
mov rdx, qword [rax + 0x88]
mov qword [rsp + 0x78], rdx
lea rax, [0x00669b40]
call fcn.0040b120
mov rbx, rax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x60]
call fcn.005a71c0
test rcx, rcx
jne 0x5b2329
lea rdx, [0x00666720]
cmp rax, rdx
jne 0x5b2202
mov rcx, rbx
nop
jmp 0x5b220a
mov rcx, rbx
mov ebx, 0
mov qword [rsp + 0x58], rbx
jne 0x5b2297
mov rdx, qword [rsp + 0xb0]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x140]
mov rdx, qword [rdx + 0x138]
mov r8, qword [rbx + 0x20]
mov r9, qword [rbx + 0x18]
test r8, r8
je 0x5b228e
nop dword [rax]
test rsi, rsi
je 0x5b225b
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x30], r8
xor eax, eax
jmp 0x5b23c6
nop
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x31
lea rcx, [0x006b5161]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x58]
mov rcx, rax
lea rax, [0x007191c0]
jmp 0x5b2340
xor eax, eax
xor ecx, ecx
jmp 0x5b2340
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rcx
mov rax, qword [rsp + 0x60]
mov ebx, 0xa
call fcn.005a5fe0
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x88], rcx
lea rcx, [0x00666720]
mov qword [rsp + 0x90], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x98], rcx
lea rax, [0x006b7f6e]
mov ebx, 0x49
lea rcx, [rsp + 0x80]
mov edi, 2
mov rsi, rdi
call fcn.004f54c0
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
test rax, rax
jne 0x5b238b
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov rdi, qword [rsp + 0x60]
mov qword [rdi + 0x168], rdx
cmp dword [0x008f2cf0], 0
jne 0x5b236b
mov qword [rdi + 0x160], rcx
jmp 0x5b2377
add rdi, 0x160
call fcn.004655a0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov ebx, 0x6e
nop
call fcn.005a5fe0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
add rdx, 0x10
inc rax
cmp rax, rsi
jge 0x5b241e
mov rcx, qword [rdx + 8]
mov rdi, qword [rdx]
cmp rcx, r8
jne 0x5b23bf
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rdx
mov rax, rdi
mov rbx, r9
call fcn.00402d80
test al, al
jne 0x5b2410
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x50]
jmp 0x5b23bf
mov rbx, qword [rsp + 0x58]
xor eax, eax
xor ecx, ecx
jmp 0x5b2340
nop
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x2f
lea rcx, [0x006b4820]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x58]
mov rcx, rax
lea rax, [0x007191c0]
jmp 0x5b2340
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.005b2180
Function at 0x5b9940
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5b9b99
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0xa0], rbx
mov rdx, qword [rax + 0x1e0]
mov rsi, qword [rax + 0x1d8]
nop dword [rax]
cmp rcx, rdx
jne 0x5b998a
xor r8d, r8d
jmp 0x5b99c5
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x2f
lea rcx, [0x006b47c2]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
inc r8
cmp r8, rdx
jge 0x5b9a15
lea r9, [r8 + r8*2]
mov r10, qword [rbx + r9*8 + 8]
mov r9, qword [rsi + r9*8 + 8]
cmp r9, r10
je 0x5b99c2
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x2f
lea rcx, [0x006b47c2]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rax + 0x1e0], rcx
mov qword [rax + 0x1e8], rdi
cmp dword [0x008f2cf0], 0
jne 0x5b9a35
mov qword [rax + 0x1d8], rbx
jmp 0x5b9a45
lea rdi, [rax + 0x1d8]
nop dword [rax]
call fcn.004655e0
cmp qword [rax], 0
je 0x5b9b61
mov qword [rsp + 0x98], rax
call fcn.005b9880
nop dword [rax]
test rdi, rdi
jne 0x5b9b75
mov rsi, qword [rsp + 0x98]
mov rdx, qword [rsi + 0x10]
mov r8, qword [rsi]
nop dword [rax + rax]
cmp rbx, rdx
ja 0x5b9b90
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x30]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465c10
mov rbp, qword [rbp]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x58], 1
movups xmmword [rsp + 0x20], xmm15
lea rdx, [0x005b9be0]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x30]
mov ebx, 2
xor ecx, ecx
lea rdi, [rsp + 0x20]
call fcn.005326e0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x5b9b02
xor ecx, ecx
jmp 0x5b9b16
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x68]
cmp rax, rcx
ja 0x5b9b8b
sub rcx, rax
xor edx, edx
test rdx, rdx
jne 0x5b9b29
mov rdx, qword [rsp + 0x98]
cmp qword [rdx + 8], rcx
je 0x5b9b61
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x2d
lea rcx, [0x006b3c67]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
call fcn.00465a00
mov rcx, rbx
call fcn.004659c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005b9940
Function at 0x5c0f00
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5c111c
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
jne 0x5c10ec
movups xmmword [rsp + 0x48], xmm15
lea rdi, [rsp + 0x50]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465c10
mov rbp, qword [rbp]
nop
cmp qword [rsp + 0x78], 0
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0x18
jne 0x5c1108
mov qword [rsp + 0xb0], rax
cmp byte [rsp + 0x70], 0
je 0x5c0fca
mov rdx, qword [rsp + 0x60]
inc rdx
cmp qword [rsp + 0x68], rdx
jge 0x5c0fca
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x36
lea rcx, [0x006b5e63]
mov qword [rax], rcx
lea rcx, [0x007191c0]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
jmp 0x5c1030
mov rbx, qword [rsp + 0x60]
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x58]
nop dword [rax]
cmp rcx, rdx
jae 0x5c1018
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 1
lea rsi, [0x006578a0]
nop dword [rax]
call fcn.0044a920
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rsp + 0x2f]
mov byte [r8 + rbx], sil
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], r8
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x005c1140]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x38]
lea rax, [rsp + 0x48]
call fcn.005326e0
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
test rdx, rdx
je 0x5c1076
xor r8d, r8d
xor r9d, r9d
xor ecx, ecx
jmp 0x5c10ad
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
mov rax, qword [rsp + 0x80]
cmp rax, rcx
ja 0x5c1103
sub r8, rax
sub rcx, rax
mov r9, r8
neg r8
sar r8, 0x3f
and rax, r8
lea r8, [rdx + rax]
xor edx, edx
xor esi, esi
mov rdi, qword [rsp + 0xb0]
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r9
cmp dword [0x008f2cf0], 0
jne 0x5c10cb
mov qword [rdi], r8
jmp 0x5c10d0
call fcn.00465620
mov rax, r8
mov rbx, rcx
mov rcx, r9
mov rdi, rdx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, rdx
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
call fcn.00465a00
lea rax, [0x006576e0]
lea rbx, [0x007185a0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.005c0f00
Function at 0x5caf60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cb05c
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x98], r10
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
test r9, r9
jne 0x5cafc3
mov rcx, qword [rax + 0x18]
mov rax, rcx
call fcn.004809e0
mov r9, rax
mov r10, rbx
mov rdx, qword [r9 + 0x30]
mov rax, r10
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x18]
lea r8, [rsi - 1]
cmp r8, 0x13
jae 0x5cb048
mov r12, qword [0x00892d98]
mov r13, qword [0x00892d90]
cmp r12, rsi
jbe 0x5cb03d
movzx r12d, byte [r13 + rsi]
mov qword [rsp], r12
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9, rax
mov r10, rbx
mov r11, rcx
mov rax, rdx
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.005ca400
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rsi
mov rcx, r12
call fcn.00465960
lea rax, [0x006576e0]
lea rbx, [0x00718590]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.005caf60
Function at 0x5cb0c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cb1d1
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x80], rsi
test rbx, rbx
jne 0x5cb186
mov rdx, qword [rax + 0x18]
lea rdi, [rdx - 1]
nop word [rax + rax]
nop
cmp rdi, 0x13
jae 0x5cb1bd
mov rcx, qword [0x00892d98]
mov rdi, qword [0x00892d90]
nop dword [rax + rax]
cmp rcx, rdx
jbe 0x5cb1b5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x90], r9
movzx ecx, byte [rdi + rdx]
mov qword [rsp + 0x38], rcx
lea rax, [0x006578a0]
mov rbx, rcx
call fcn.0044a840
mov rsi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
mov rdi, rcx
mov rbx, rax
mov rax, qword [rsp + 0x60]
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x005cf260]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x40]
call fcn.0059cee0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rdx
call fcn.00465960
lea rax, [0x006576e0]
lea rbx, [0x00718590]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.005cb0c0

Function at 0x5cb240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cb2ce
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x68], rbx
mov rdx, qword [rax + 0x18]
lea r12, [rdx - 1]
cmp r12, 0x13
jae 0x5cb2ba
mov r12, qword [0x00892d98]
mov r13, qword [0x00892d90]
cmp r12, rdx
jbe 0x5cb2af
movzx edx, byte [r13 + rdx]
mov qword [rsp], rdx
lea rsi, [0x006a62d6]
mov r8d, 0xb
xor r9d, r9d
xor r10d, r10d
mov r11, r10
nop
call fcn.005ca400
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rdx
mov rcx, r12
call fcn.00465960
lea rax, [0x006576e0]
lea rbx, [0x00718590]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.005cb240
Function at 0x5cb420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cb57d
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r8
mov rdx, qword [rax + 0x18]
lea r12, [rdx - 1]
nop dword [rax + rax]
cmp r12, 0x13
jae 0x5cb569
mov r12, qword [0x00892d98]
mov r13, qword [0x00892d90]
nop dword [rax + rax]
cmp r12, rdx
jbe 0x5cb55e
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r8
movzx edx, byte [r13 + rdx]
mov qword [rsp], rdx
lea rsi, [0x006a52e4]
mov r8d, 8
xor r9d, r9d
xor r10d, r10d
mov r11, r10
call fcn.005ca400
movups xmmword [rsp + 0x58], xmm15
lea rdx, [0x005cf260]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx + 0x18]
mov qword [rsp + 0x60], rdx
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
lea rax, [rsp + 0x58]
call fcn.0058e7c0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rbx
mov rdx, qword [rsp + 0xa0]
mov rdx, qword [rdx + 0x30]
xor ecx, ecx
mov rdi, rcx
mov rax, qword [rsp + 0xa8]
xor ebx, ebx
call rdx
mov rdx, qword [rsp + 0x50]
mov r12, qword [rdx + 0x38]
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x68]
call r12
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0x30]
mov rax, qword [rsp + 0x68]
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, rdx
mov rcx, r12
call fcn.00465960
lea rax, [0x006576e0]
lea rbx, [0x00718590]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax + rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.005cb420
Function at 0x5cb8a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cb99b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
cmp cx, 0x18
ja 0x5cb906
cmp cx, 0x17
jne 0x5cb8e7
nop
mov rdx, qword [0x00892208]
lea rcx, [0x0071b2f8]
mov rsi, rdx
mov edx, 1
jmp 0x5cb94a
cmp cx, 0x18
jne 0x5cb944
nop
mov rdx, qword [0x00892210]
lea rcx, [0x0071b338]
mov rsi, rdx
mov edx, 1
jmp 0x5cb94a
cmp cx, 0x19
jne 0x5cb925
nop
mov rdx, qword [0x00892218]
lea rcx, [0x0071b378]
mov rsi, rdx
mov edx, 1
jmp 0x5cb94a
cmp cx, 0x1d
jne 0x5cb944
nop
mov rdx, qword [0x00892220]
lea rcx, [0x0071b3b8]
mov rsi, rdx
mov edx, 1
jmp 0x5cb94a
xor ecx, ecx
xor edx, edx
xor esi, esi
test dl, dl
je 0x5cb967
mov rdx, qword [rcx + 0x18]
mov rcx, rbx
mov rbx, rax
mov rax, rsi
call rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x26
lea rcx, [0x006b1b34]
mov qword [rax], rcx
lea rbx, [0x007191c0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x18], cx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, word [rsp + 0x18]
nop
jmp fcn.005cb8a0

Function at 0x5cd040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cd197
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movzx edx, word [rsp + 0xe0]
cmp dx, 0x303
jae 0x5cd06b
cmp al, 0xe4
jne 0x5cd0a7
cmp qword [rsp + 0xc8], 0
je 0x5cd183
cmp al, 0xe4
je 0x5cd085
cmp dx, 0x303
jmp 0x5cd0ac
mov rax, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
cmp dx, 0x303
jae 0x5cd122
cmp al, 0xe3
jne 0x5cd0d9
mov rdx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rdx + 0x30]
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rax, qword [rsp + 0x88]
mov qword [rsp], rax
lea rdi, [rsp + 8]
lea rsi, [rsp + 0x90]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465f6c
mov rbp, qword [rbp]
call fcn.005ccd40
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rax, rbx
call fcn.004809e0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov rcx, qword [rax + 0x38]
mov rdx, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rax, rbx
mov rbx, rdx
mov r9, rcx
mov rcx, rsi
call r9
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + 0x30]
mov rax, qword [rsp + 0x70]
xor ebx, ebx
xor edi, edi
mov rdx, rcx
mov rcx, rdi
call rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006576e0]
lea rbx, [0x00718530]
call fcn.00436420
nop
mov byte [rsp + 0x70], al
mov qword [rsp + 0x78], rbx
call fcn.004632e0
movzx eax, byte [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp fcn.005cd040
Function at 0x5d1ae0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d1c59
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov ebx, 0xa
call fcn.005d1880
mov rdx, qword [0x0089cfc8]
cmp qword [0x0089cfc0], rdi
jne 0x5d1bc4
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x28], rax
mov rax, rdi
mov rbx, rsi
mov rcx, rdx
nop dword [rax]
call fcn.00403fe0
test al, al
je 0x5d1bab
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x5d1b8a
mov rax, qword [rsp + 0x28]
movzx r9d, byte [rax + rdx - 1]
nop
cmp r9b, 0xd
jne 0x5d1b85
mov r9, qword [rsp + 0x50]
mov r10, qword [r9 + 0x28]
test r10, r10
je 0x5d1c45
dec r10
mov qword [r9 + 0x28], r10
lea rbx, [rdx - 1]
jmp 0x5d1b92
mov rbx, rdx
jmp 0x5d1b92
mov rax, qword [rsp + 0x28]
mov rbx, rdx
mov rcx, qword [rsp + 0x18]
mov edi, 1
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
test rbx, rbx
je 0x5d1c0c
movzx r9d, byte [rax + rbx - 1]
cmp r9b, 0xa
jne 0x5d1bfb
cmp rbx, 1
jle 0x5d1bee
movzx r9d, byte [rbx + rax - 2]
cmp r9b, 0xd
jne 0x5d1bee
mov edx, 2
jmp 0x5d1bf3
mov edx, 1
sub rbx, rdx
cmp rcx, rbx
jb 0x5d1c37
xor edi, edi
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test rdi, rdi
mov edx, 0
cmovne rbx, rdx
cmovne rcx, rdx
mov edx, 0
cmovne rax, rdx
mov r8, rsi
mov rsi, rdi
xor edi, edi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdx, rcx
mov rcx, rbx
nop dword [rax]
call fcn.004659c0
lea rax, [0x006576e0]
lea rbx, [0x007181a0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
nop
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.005d1ae0
Function at 0x5d6160
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d62b3
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.005d6f00
test rbx, rbx
je 0x5d6281
test rdi, rdi
je 0x5d6273
cmp byte [rcx], 0x2f
nop word [rax + rax]
jne 0x5d6241
lea rbx, [rdi - 1]
mov rdx, rbx
neg rbx
sar rbx, 0x3f
and ebx, 1
lea rax, [rcx + rbx]
mov rbx, rdx
nop
call fcn.005d6f00
test rbx, rbx
je 0x5d620f
test rdi, rdi
je 0x5d6201
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x2c
lea rcx, [0x006b375b]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x20
lea rcx, [0x006aef8b]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x26
lea rcx, [0x006b1a76]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x13
lea rcx, [0x006a9167]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005d6160
Function at 0x5df220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5df2f5
movdqa xmm0, xmmword [0x00718850]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5df261
movdqa xmm0, xmmword [0x00718860]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5df377
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5df34b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00718130]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00718cc0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret