joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5698e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5699f4
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [0x008b4fc0]
cmp qword [rax + 0x18], 1
jle 0x56995b
movzx ecx, byte [rax + 2]
mov byte [rsp + 0x17], cl
movzx eax, byte [rax + 1]
mov byte [rsp + 0x16], al
call fcn.00438340
lea rax, [0x006c3caf]
mov ebx, 0x21
call fcn.00438c40
movzx eax, byte [rsp + 0x17]
call fcn.004385e0
lea rax, [0x006b9bf3]
mov ebx, 0xa
call fcn.00438c40
movzx eax, byte [rsp + 0x16]
call fcn.004385e0
call fcn.004385a0
call fcn.004383c0
mov rax, qword [0x008b4fc0]
cmp byte [rax + 1], 0
je 0x5699ac
cmp byte [0x009185ee], 0
je 0x56998e
call fcn.00438340
lea rax, [0x006cc491]
mov ebx, 0x44
call fcn.00438c40
call fcn.004383c0
jmp 0x5699ea
call fcn.00438340
lea rax, [0x006cba16]
mov ebx, 0x3d
nop
call fcn.00438c40
call fcn.004383c0
jmp 0x5699ea
cmp byte [rax], 0
je 0x5699ce
call fcn.00438340
lea rax, [0x006c654e]
mov ebx, 0x27
call fcn.00438c40
call fcn.004383c0
jmp 0x5699ea
call fcn.00438340
lea rax, [0x006c9e0f]
mov ebx, 0x32
nop
call fcn.00438c40
call fcn.004383c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00463440
jmp fcn.005698e0

Function at 0x56c8a0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x56c8b8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x56c8b8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x56c8c0
xor eax, eax
ret
cmp rbx, 3
je 0x56c8cc
cmp rbx, 4
jne 0x56c8f9
cmp al, 0x2c
ja 0x56c8e6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x56c8f6
cmp al, 0x24
je 0x56c8f6
nop dword [rax]
cmp al, 0x26
jae 0x56c8f6
jmp 0x56c8f9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x56c8f6
cmp al, 0x5b
je 0x56c8f6
cmp al, 0x5d
jne 0x56c8f9
xor eax, eax
ret
cmp al, 0x2f
ja 0x56c932
nop dword [rax]
cmp al, 0x26
ja 0x56c911
cmp al, 0x24
je 0x56c951
cmp al, 0x26
je 0x56c951
jmp 0x56c9cb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x56c951
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x56c9c8
cmp al, 0x2f
je 0x56c951
jmp 0x56c9cb
cmp al, 0x3d
ja 0x56c949
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x56c951
nop
cmp al, 0x3d
je 0x56c951
jmp 0x56c9cb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x56c9c0
cmp rbx, 2
jg 0x56c987
cmp rbx, 1
je 0x56c981
nop dword [rax]
cmp rbx, 2
jne 0x56c9cb
cmp al, 0x2f
je 0x56c972
cmp al, 0x3b
je 0x56c972
cmp al, 0x2c
jne 0x56c979
mov ecx, 1
jmp 0x56c97e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x56c9aa
cmp al, 0x40
je 0x56c999
cmp al, 0x2f
je 0x56c999
cmp al, 0x3f
jne 0x56c9a2
mov ecx, 1
nop
jmp 0x56c9a7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x56c9b9
cmp rbx, 7
jne 0x56c9cb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x56c9c8
cmp al, 0x7e
jne 0x56c9cb
xor eax, eax
ret
cmp rbx, 7
jne 0x56c9e1
cmp al, 0x21
je 0x56c9dd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x56c9e1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x572b20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x572d35
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x572c4d
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x572d27
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [r8 + 0x10]
add rdx, rax
cmp rbx, rdx
je 0x572bc1
mov rax, rdx
mov rcx, rsi
call fcn.00466460
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x572c29
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00572fc0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x572d1f
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x572c53
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x572cd0
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00572fc0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x572d0e
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x572d0a
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00466460
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
call fcn.00465b60
mov rax, rdx
mov ecx, 0x40
call fcn.00465b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00572b20
Function at 0x57a580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57a6af
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
mov rbx, rax
mov ecx, 0x30
call fcn.0052c4a0
nop
test al, al
jne 0x57a5f6
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x27
lea rcx, [0x006c68cf]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x0072e7e0]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp qword [rsp + 0x58], 0
nop dword [rax]
je 0x57a6a1
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x30], xmm15
mov byte [rsp + 0x27], 0
lea rax, [rsp + 0x50]
lea rbx, [rsp + 0x28]
lea rcx, [rsp + 0x27]
mov edi, 1
call fcn.0052cca0
test al, al
je 0x57a66f
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx]
movzx r8d, byte [rsp + 0x27]
xor r8d, 0xffffff80
movzx eax, r8b
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
call rsi
nop
test rax, rax
je 0x57a5f6
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x26
lea rcx, [0x006c63f0]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x0072e7e0]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0057a580
Function at 0x57b3a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x57b5c8
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rcx
lea rax, [rsp + 0x98]
mov rbx, rax
mov ecx, 0x30
call fcn.0052c4a0
test al, al
je 0x57b3ff
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x57b44a
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x22
lea rcx, [0x006c4895]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0072e7e0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rdx, rbx
mov rsi, rax
mov rax, rcx
mov rcx, rsi
cmp qword [rsp + 0xa0], 0
je 0x57b5a8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x70], 0
movups xmmword [rsp + 0x78], xmm15
lea rax, [rsp + 0x98]
lea rbx, [rsp + 0x70]
mov ecx, 0x30
call fcn.0052c4a0
test al, al
je 0x57b569
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
lea rax, [rsp + 0x70]
lea rbx, [rsp + 0x58]
call fcn.0052bd60
test al, al
je 0x57b52a
mov rbx, qword [rsp + 0x40]
inc rbx
mov rcx, qword [rsp + 0x48]
cmp rcx, rbx
jb 0x57b4d1
mov rax, qword [rsp + 0x50]
jmp 0x57b4e7
mov rax, qword [rsp + 0x50]
mov edi, 1
lea rsi, [0x0067b2c0]
call fcn.0044a700
lea rdx, [rbx + rbx*2]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x68]
mov qword [rax + rdx*8 - 0x10], r9
mov qword [rax + rdx*8 - 8], r10
lea rdi, [rax + rdx*8]
lea rdi, [rdi - 0x18]
cmp dword [0x00918a90], 0
jne 0x57b520
mov qword [rax + rdx*8 - 0x18], r8
jmp 0x57b43e
call fcn.00465780
jmp 0x57b43e
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x22
lea rcx, [0x006c4895]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0072e7e0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x0067fd60]
call fcn.0040da20
mov qword [rax + 8], 0x22
lea rcx, [0x006c4895]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0072e7e0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rbx, rdx
xor edi, edi
xor esi, esi
mov rdx, rax
mov rax, rcx
mov rcx, rdx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0057b3a0
Function at 0x5815e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58177f
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdi
nop dword [rax + rax]
test rbx, rbx
je 0x581769
mov rdx, qword [rdi + 0x278]
mov r8, qword [rdi + 0x270]
nop word [rax + rax]
test rdx, rdx
jne 0x5816ef
mov rdx, qword [rdi + 0x1d0]
cmp qword [rdi + 0x1d8], 0
je 0x581669
mov rsi, qword [rdx + 8]
mov rdx, qword [rdx]
test rbx, rbx
jmp 0x5816f8
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x28], rbx
mov rdx, qword [rdi + 0xb8]
test rdx, rdx
jne 0x58168d
mov eax, 5
lea rdx, [0x006b8b7a]
jmp 0x5816bc
mov rax, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
mov rcx, qword [rdx + 0x18]
movzx edi, byte [rdx]
mov esi, 0xa
call fcn.0050dc40
mov rcx, rbx
mov rbx, rax
lea rax, [rsp + 0x30]
call fcn.0044e8e0
mov rdx, rax
mov rax, rbx
lea rbx, [0x006b9363]
mov ecx, 7
mov rdi, rdx
mov rsi, rax
xor eax, eax
call fcn.0044e540
mov rdx, qword [rsp + 0x28]
test rdx, rdx
mov rcx, qword [rsp + 0x50]
mov rsi, rbx
mov rdx, rax
mov rbx, qword [rsp + 0x28]
jmp 0x5816f8
test rbx, rbx
mov rsi, rdx
mov rdx, r8
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
je 0x58170a
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov rax, rdx
mov rbx, rsi
call fcn.0040b080
lea rcx, [0x00667a40]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006cd2f9]
mov ebx, 0x53
lea rcx, [rsp + 0x58]
mov edi, 2
mov rsi, rdi
call fcn.004f3aa0
mov ecx, 0x2d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006c87fc]
call fcn.0044e540
jmp 0x581775
mov ebx, 0x2d
lea rax, [0x006c87fc]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005815e0
Function at 0x5820e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x582246
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x98], r8
mov rax, rsi
mov rbx, r8
lea rcx, [0x006b861d]
mov edi, 1
nop dword [rax + rax]
call fcn.00500360
test rax, rax
jl 0x58221d
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
nop
call fcn.00581880
test sil, sil
je 0x5821c1
mov rdx, qword [rsp + 0x30]
cmp rbx, rdx
je 0x582178
xor eax, eax
jmp 0x5821b3
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov rbx, rax
mov rcx, rdx
mov rax, qword [rsp + 0x48]
call fcn.00402de0
test al, al
jne 0x58219a
xor eax, eax
jmp 0x5821b3
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
call fcn.005000c0
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
movups xmmword [rsp + 0x50], xmm15
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
call fcn.0040b080
lea rcx, [0x00667a40]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x006c9756]
mov ebx, 0x30
lea rcx, [rsp + 0x50]
mov edi, 1
mov rsi, rdi
call fcn.004f0a80
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
call fcn.005824e0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.005820e0
Function at 0x5822a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5824a6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov rdx, qword [rax + 0x30]
mov rsi, qword [rax + 0x28]
test rdx, rdx
je 0x582450
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov rax, rsi
mov rbx, rdx
lea rcx, [0x0072bd48]
mov edi, 1
call fcn.00500360
nop
test rax, rax
jge 0x582309
xor eax, eax
jmp 0x58232f
mov rdx, qword [rsp + 0x28]
lea rsi, [rdx - 1]
mov rdi, qword [rsp + 0x30]
lea rax, [rsi + rdi]
lea rbx, [0x0072bea0]
mov ecx, 1
call fcn.00402de0
xor eax, 1
test al, al
jne 0x58233f
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
jmp 0x58235a
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0x28]
mov rbx, qword [rcx + 0x30]
call fcn.0055be60
test rsi, rsi
jne 0x58243e
nop word [rax + rax]
cmp rbx, 1
jl 0x58236e
cmp byte [rax], 0x5b
sete dl
jmp 0x582370
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
test dl, dl
je 0x5823b3
nop
cmp rbx, 1
jge 0x58238a
xor ecx, ecx
jmp 0x5823b5
lea rdx, [rbx - 1]
add rdx, rax
mov ecx, 1
mov rax, rdx
lea rbx, [0x0072bea0]
call fcn.00402de0
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x30]
jmp 0x5823b5
xor ecx, ecx
test cl, cl
jne 0x5823c5
call fcn.0055a580
nop
test rax, rax
je 0x58241b
mov rax, qword [rsp + 0x58]
call fcn.0056f100
movups xmmword [rsp + 0x38], xmm15
call fcn.0040b080
lea rcx, [0x00667a40]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x006ca951]
mov ebx, 0x36
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004f0a80
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
call fcn.005824e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
mov rbx, rsi
mov rcx, r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0056f100
movups xmmword [rsp + 0x38], xmm15
nop dword [rax + rax]
call fcn.0040b080
lea rcx, [0x00667a40]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x006cbb85]
mov ebx, 0x3e
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004f0a80
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.005822a0
Function at 0x5824e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58270c
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
test rdi, rdi
je 0x582687
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
call fcn.00581de0
test dil, dil
je 0x58262b
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x98]
movzx edx, byte [rcx]
mov byte [rsp + 0x2f], dl
cmp dl, 0x2e
jne 0x58257a
mov rdi, qword [rsp + 0xa0]
dec rdi
mov rsi, rdi
neg rdi
sar rdi, 0x3f
and edi, 1
add rcx, rdi
jmp 0x582582
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rsi
mov rax, rcx
mov rbx, rsi
call fcn.00581de0
test dil, dil
je 0x5825d5
mov rdx, qword [rsp + 0x38]
cmp rdx, rbx
jl 0x5825c5
movzx esi, byte [rsp + 0x2f]
cmp sil, 0x2e
jne 0x5825b6
cmp rdx, rbx
je 0x5825c5
mov qword [rsp + 0x40], rbx
xor ecx, ecx
nop dword [rax]
jmp 0x5826b0
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
call fcn.0040b080
lea rcx, [0x00667a40]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006c836c]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004f0a80
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
call fcn.0040b080
lea rcx, [0x00667a40]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006c836c]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004f0a80
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rax, qword [rsp + 0x58]
add rax, 0x10
mov rcx, qword [rsp + 0x30]
inc rcx
mov rbx, qword [rsp + 0x40]
cmp rbx, rcx
jle 0x5826f9
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x58], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
shl rcx, 4
mov r8, qword [rsp + 0x50]
mov r9, qword [r8 + rcx]
mov rdi, qword [r8 + rcx + 8]
mov rcx, r9
mov rax, rdx
nop
call fcn.005000c0
test al, al
jne 0x58269a
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005824e0
Function at 0x586e80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x586f71
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
cmp qword [rbx + 0xb0], 3
jne 0x586eab
cmp byte [rbx + 0x360], 0
je 0x586ebd
cmp byte [rbx + 0x360], 0
je 0x586ed5
cmp byte [rbx + 0x361], 0
jne 0x586ed5
lea rax, [0x0072eec0]
lea rbx, [0x00918838]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rdx, qword [rbx + 0x2e0]
nop dword [rax]
test rdx, rdx
je 0x586f03
bt edx, 5
jb 0x586f03
lea rax, [0x0072eec0]
lea rbx, [0x00918838]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
cmp qword [rbx + 0x98], 0
jne 0x586f25
mov rax, qword [0x008b5d40]
mov rbx, qword [0x008b5d48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rdx, qword [rax + 0x90]
mov r12, qword [rax + 0x18]
mov rcx, qword [rax + 0x20]
mov rdi, qword [rax + 0x28]
mov rsi, qword [rax + 0x78]
mov r8, qword [rax + 0x80]
mov r9, qword [rax + 0x88]
mov r10, qword [rbx + 0xa0]
mov r11, qword [rbx + 0xa8]
mov byte [rsp], 0
mov rax, rdx
mov rbx, r12
call fcn.00587080
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00586e80

Function at 0x586fa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x587057
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
lea rdx, [rax - 1]
cmp rdx, 4
jae 0x586fe2
shl rax, 4
lea rdx, [0x008bf0c0]
mov rsi, qword [rdx + rax + 8]
mov rdx, qword [rdx + rax]
jmp 0x586ff3
nop
mov ebx, 0xa
call fcn.004a04a0
mov rsi, rbx
mov rdx, rax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
mov rax, rdx
mov rbx, rsi
call fcn.0040b080
lea rcx, [0x00667a40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rax, [0x006cd3f3]
mov ebx, 0x54
lea rcx, [rsp + 0x28]
mov edi, 2
mov rsi, rdi
call fcn.004f0a80
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00586fa0
Function at 0x597f20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5980fd
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
cmp ax, 0x501
ja 0x597f71
nop
cmp ax, 0x203
ja 0x597f57
cmp ax, 0x201
je 0x597f8a
cmp ax, 0x203
je 0x597f97
jmp 0x5980af
cmp ax, 0x401
je 0x597f8a
nop dword [rax]
cmp ax, 0x403
je 0x597f97
cmp ax, 0x501
je 0x597f8a
jmp 0x5980af
cmp ax, 0x601
ja 0x597f91
cmp ax, 0x503
je 0x597f97
nop dword [rax]
cmp ax, 0x601
jne 0x5980af
mov ecx, 0xffffffe1
jmp 0x597fc0
cmp ax, 0x603
jne 0x597f9e
mov ecx, 0xffffffe3
jmp 0x597fc0
lea edx, [rax - 0x804]
cmp dx, 2
ja 0x597fb1
mov ecx, 0xffffffe2
jmp 0x597fc0
cmp ax, 0x807
jne 0x5980af
mov ecx, 0xffffffe4
cmp ax, 0x503
ja 0x598000
cmp ax, 0x401
ja 0x597fe8
cmp ax, 0x201
je 0x597fd8
cmp ax, 0x203
jne 0x597fe0
mov edx, 3
jmp 0x59804d
cmp ax, 0x401
je 0x598018
jmp 0x598061
cmp ax, 0x403
je 0x598018
cmp ax, 0x501
je 0x598026
cmp ax, 0x503
je 0x598026
jmp 0x598061
cmp ax, 0x804
ja 0x598020
cmp ax, 0x601
je 0x598033
cmp ax, 0x603
je 0x598033
cmp ax, 0x804
jne 0x598061
mov edx, 5
jmp 0x59804d
cmp ax, 0x805
jne 0x59802d
mov edx, 6
jmp 0x59804d
cmp ax, 0x806
jne 0x598040
mov edx, 7
jmp 0x59804d
cmp ax, 0x807
jne 0x598061
mov rdx, qword [0x00918688]
mov eax, ecx
mov rbx, rdx
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
movups xmmword [rsp + 0x28], xmm15
call fcn.0040af00
lea rcx, [0x0066e460]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006c4e50]
mov ebx, 0x23
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004f0a80
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
call fcn.0040af00
lea rcx, [0x0066e460]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006c4e50]
mov ebx, 0x23
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004f0a80
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov word [rsp + 8], ax
call fcn.00463440
movzx eax, word [rsp + 8]
jmp fcn.00597f20