joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53dc80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53debc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.00490ee0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x53ddca
nop
cmp rdx, 0x40
ja 0x53deae
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x53dd39
mov rax, rdx
mov rcx, rsi
nop
call fcn.004662e0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x53dda1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0053e400
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x53dea3
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x53ddd7
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x53de57
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.0053e400
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x53de92
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x53de8e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.004662e0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00465a00
mov rax, rdx
mov ecx, 0x40
call fcn.00465a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0053dc80
Function at 0x546b40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x546be6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rax, rax
je 0x546bce
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
nop
lea rax, [0x0068f960]
call fcn.0040d960
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
cmp dword [0x008f2cf0], 0
jne 0x546b9a
mov rbx, qword [rsp + 0x40]
mov qword [rax + 8], rbx
jmp 0x546ba8
lea rdi, [rax + 8]
mov rbx, qword [rsp + 0x40]
call fcn.004655e0
mov qword [rsp + 0x20], rax
mov rdi, rax
mov rax, rcx
lea rcx, [0x0071a0b8]
call fcn.00546dc0
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006576e0]
lea rbx, [0x00718220]
nop dword [rax]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00546b40
Function at 0x5483c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5484d9
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
mov byte [rsp + 0x48], bl
mov qword [rsp + 0x40], rax
mov rdx, qword [rax]
mov rax, rdx
xor ebx, ebx
nop dword [rax]
call fcn.005478c0
movzx edx, byte [rsp + 0x48]
test dl, dl
je 0x548429
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rdi]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
lea rcx, [0x0071a0e0]
call fcn.00547260
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx + 0x10], esi
sete sil
test sil, sil
jne 0x548454
lea rax, [rdx + 0x10]
call fcn.0046e200
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + 8]
test rax, rax
je 0x54849f
nop
cmp qword [rax + 0x20], 0
je 0x5484c5
add rax, 8
call fcn.00462240
cmp dword [0x008f2cf0], 0
jne 0x548486
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], 0
jmp 0x54849f
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 8]
mov rax, rdi
mov rdi, rcx
xor edx, edx
call fcn.004655c0
mov rcx, rax
mov rax, qword [rcx]
mov ebx, 0xffffffff
lock xadd dword [rax + 0x10], ebx
dec ebx
test ebx, ebx
je 0x5484bb
add rax, 0x10
call fcn.0046e500
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006576e0]
lea rbx, [0x007187f0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004632e0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.005483c0
Function at 0x5485a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x548719
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
test rax, rax
je 0x548705
nop
test rcx, rcx
je 0x5486ed
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x548624
lea r9, [0x0071c4a8]
jmp 0x548629
xor r9d, r9d
xor edx, edx
mov rcx, qword [r9 + 0x20]
mov rax, rdx
call rcx
test al, al
je 0x5486da
lea rax, [0x0068a440]
call fcn.0040d960
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
cmp dword [0x008f2cf0], 0
jne 0x548662
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
jmp 0x548670
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x48]
call fcn.004655a0
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
cmp dword [0x008f2cf0], 0
jne 0x54868d
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x18], rcx
jmp 0x54869b
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x58]
call fcn.004655a0
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x20], rcx
cmp dword [0x008f2cf0], 0
jne 0x5486b8
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x28], rcx
jmp 0x5486c6
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x68]
call fcn.004655a0
mov rbx, rax
lea rax, [0x0071b138]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006576e0]
lea rbx, [0x00718250]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718240]
nop dword [rax + rax]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718220]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.005485a0
Function at 0x551580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5516db
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x0089c770]
call fcn.00505b80
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x00551700]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x55169b
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x5516d5
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x5516ca
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.00465a00
call fcn.00465980
nop
nop dword [rax + rax]
call fcn.004632e0
jmp fcn.00551580
Function at 0x56d6e0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x56d941
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x56d925
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x56d72d
xor ebx, ebx
xor ecx, ecx
jmp 0x56d740
mov rax, rdx
call fcn.0055e4a0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x56d858
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00480e00
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007168f8]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e800
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x56d81b
xor eax, eax
lea rbx, [0x006a41e2]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006a4288]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e8e0
jmp 0x56d848
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x007169c0]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e800
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.00480e00
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x56d8e8
xor eax, eax
lea rbx, [0x006a41e2]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006a4288]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e8e0
jmp 0x56d915
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007169c0]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e800
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006a4749]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.0056d6e0
Function at 0x56eec0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56efd4
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [0x00892298]
cmp qword [rax + 0x18], 1
jle 0x56ef3b
movzx ecx, byte [rax + 2]
mov byte [rsp + 0x17], cl
movzx eax, byte [rax + 1]
mov byte [rsp + 0x16], al
call fcn.00438500
lea rax, [0x006af65c]
mov ebx, 0x21
call fcn.00438e00
movzx eax, byte [rsp + 0x17]
call fcn.004387a0
lea rax, [0x006a5810]
mov ebx, 0xa
call fcn.00438e00
movzx eax, byte [rsp + 0x16]
call fcn.004387a0
call fcn.00438760
call fcn.00438580
mov rax, qword [0x00892298]
cmp byte [rax + 1], 0
je 0x56ef8c
cmp byte [0x008f284e], 0
je 0x56ef6e
call fcn.00438500
lea rax, [0x006b79b4]
mov ebx, 0x44
call fcn.00438e00
call fcn.00438580
jmp 0x56efca
call fcn.00438500
lea rax, [0x006b6f3c]
mov ebx, 0x3d
nop
call fcn.00438e00
call fcn.00438580
jmp 0x56efca
cmp byte [rax], 0
je 0x56efae
call fcn.00438500
lea rax, [0x006b1de7]
mov ebx, 0x27
call fcn.00438e00
call fcn.00438580
jmp 0x56efca
call fcn.00438500
lea rax, [0x006b5383]
mov ebx, 0x32
nop
call fcn.00438e00
call fcn.00438580
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.004632e0
jmp fcn.0056eec0

Function at 0x572280
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x572298
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x572298
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x5722a0
xor eax, eax
ret
cmp rbx, 3
je 0x5722ac
cmp rbx, 4
jne 0x5722d9
cmp al, 0x2c
ja 0x5722c6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5722d6
cmp al, 0x24
je 0x5722d6
nop dword [rax]
cmp al, 0x26
jae 0x5722d6
jmp 0x5722d9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5722d6
cmp al, 0x5b
je 0x5722d6
cmp al, 0x5d
jne 0x5722d9
xor eax, eax
ret
cmp al, 0x2f
ja 0x572312
nop dword [rax]
cmp al, 0x26
ja 0x5722f1
cmp al, 0x24
je 0x572331
cmp al, 0x26
je 0x572331
jmp 0x5723ab
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x572331
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5723a8
cmp al, 0x2f
je 0x572331
jmp 0x5723ab
cmp al, 0x3d
ja 0x572329
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x572331
nop
cmp al, 0x3d
je 0x572331
jmp 0x5723ab
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5723a0
cmp rbx, 2
jg 0x572367
cmp rbx, 1
je 0x572361
nop dword [rax]
cmp rbx, 2
jne 0x5723ab
cmp al, 0x2f
je 0x572352
cmp al, 0x3b
je 0x572352
cmp al, 0x2c
jne 0x572359
mov ecx, 1
jmp 0x57235e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x57238a
cmp al, 0x40
je 0x572379
cmp al, 0x2f
je 0x572379
cmp al, 0x3f
jne 0x572382
mov ecx, 1
nop
jmp 0x572387
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x572399
cmp rbx, 7
jne 0x5723ab
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5723a8
cmp al, 0x7e
jne 0x5723ab
xor eax, eax
ret
cmp rbx, 7
jne 0x5723c1
cmp al, 0x21
je 0x5723bd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5723c1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x578560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x578777
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x57868e
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x578769
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x578602
mov rax, rdx
mov rcx, rsi
call fcn.004662e0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x57866a
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00578a00
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x578761
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x578694
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x578711
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00578a00
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x57874f
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x57874b
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.004662e0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.00465a00
mov rax, rdx
mov ecx, 0x40
call fcn.00465a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00578560
Function at 0x580020
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58014f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
mov rbx, rax
mov ecx, 0x30
call fcn.005318c0
nop
test al, al
jne 0x580096
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x27
lea rcx, [0x006b211a]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp qword [rsp + 0x58], 0
nop dword [rax]
je 0x580141
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x30], xmm15
mov byte [rsp + 0x27], 0
lea rax, [rsp + 0x50]
lea rbx, [rsp + 0x28]
lea rcx, [rsp + 0x27]
mov edi, 1
call fcn.005320c0
test al, al
je 0x58010f
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx]
movzx r8d, byte [rsp + 0x27]
xor r8d, 0xffffff80
movzx eax, r8b
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
call rsi
nop
test rax, rax
je 0x580096
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x26
lea rcx, [0x006b1cb0]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007191c0]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00580020
Function at 0x580e40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x581068
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rcx
lea rax, [rsp + 0x98]
mov rbx, rax
mov ecx, 0x30
call fcn.005318c0
test al, al
je 0x580e9f
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x580eea
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x22
lea rcx, [0x006b0286]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007191c0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rdx, rbx
mov rsi, rax
mov rax, rcx
mov rcx, rsi
cmp qword [rsp + 0xa0], 0
je 0x581048
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x70], 0
movups xmmword [rsp + 0x78], xmm15
lea rax, [rsp + 0x98]
lea rbx, [rsp + 0x70]
mov ecx, 0x30
call fcn.005318c0
test al, al
je 0x581009
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
lea rax, [rsp + 0x70]
lea rbx, [rsp + 0x58]
call fcn.00531180
test al, al
je 0x580fca
mov rbx, qword [rsp + 0x40]
inc rbx
mov rcx, qword [rsp + 0x48]
cmp rcx, rbx
jb 0x580f71
mov rax, qword [rsp + 0x50]
jmp 0x580f87
mov rax, qword [rsp + 0x50]
mov edi, 1
lea rsi, [0x00669c40]
call fcn.0044a920
lea rdx, [rbx + rbx*2]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x68]
mov qword [rax + rdx*8 - 0x10], r9
mov qword [rax + rdx*8 - 8], r10
lea rdi, [rax + rdx*8]
lea rdi, [rdi - 0x18]
cmp dword [0x008f2cf0], 0
jne 0x580fc0
mov qword [rax + rdx*8 - 0x18], r8
jmp 0x580ede
call fcn.00465620
jmp 0x580ede
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x22
lea rcx, [0x006b0286]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007191c0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x22
lea rcx, [0x006b0286]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007191c0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rbx, rdx
xor edi, edi
xor esi, esi
mov rdx, rax
mov rax, rcx
mov rcx, rdx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00580e40
Function at 0x587080
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58721f
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdi
nop dword [rax + rax]
test rbx, rbx
je 0x587209
mov rdx, qword [rdi + 0x278]
mov r8, qword [rdi + 0x270]
nop word [rax + rax]
test rdx, rdx
jne 0x58718f
mov rdx, qword [rdi + 0x1d0]
cmp qword [rdi + 0x1d8], 0
je 0x587109
mov rsi, qword [rdx + 8]
mov rdx, qword [rdx]
test rbx, rbx
jmp 0x587198
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x28], rbx
mov rdx, qword [rdi + 0xb8]
test rdx, rdx
jne 0x58712d
mov eax, 5
lea rdx, [0x006a4749]
jmp 0x58715c
mov rax, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
mov rcx, qword [rdx + 0x18]
movzx edi, byte [rdx]
mov esi, 0xa
call fcn.00512b60
mov rcx, rbx
mov rbx, rax
lea rax, [rsp + 0x30]
call fcn.0044eb00
mov rdx, rax
mov rax, rbx
lea rbx, [0x006a4f4f]
mov ecx, 7
mov rdi, rdx
mov rsi, rax
xor eax, eax
call fcn.0044e760
mov rdx, qword [rsp + 0x28]
test rdx, rdx
mov rcx, qword [rsp + 0x50]
mov rsi, rbx
mov rdx, rax
mov rbx, qword [rsp + 0x28]
jmp 0x587198
test rbx, rbx
mov rsi, rdx
mov rdx, r8
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
je 0x5871aa
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov rax, rdx
mov rbx, rsi
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006b8619]
mov ebx, 0x53
lea rcx, [rsp + 0x58]
mov edi, 2
mov rsi, rdi
call fcn.004f8500
mov ecx, 0x2d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006b3dcf]
call fcn.0044e760
jmp 0x587215
mov ebx, 0x2d
lea rax, [0x006b3dcf]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00587080