joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ce180
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ce33f
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rdx + 8]
mov rbx, qword [rdx + 0x18]
cmp qword [rax], 0
nop
jne 0x5ce325
cmp qword [rax + 0x30], 0
jne 0x5ce32b
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rbx
mov rdi, qword [rdx + 0x20]
mov qword [rsp + 0x28], rdi
mov rdx, qword [rax + 0x18]
add rdx, rdi
cmp rdi, rdx
jle 0x5ce227
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x1b
lea rcx, [0x006da8fc]
mov qword [rax], rcx
lea rcx, [0x00758260]
mov rdx, qword [rsp + 0x60]
mov qword [rdx], rcx
cmp dword [0x0098c4d0], 0
je 0x5ce216
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov r8, qword [rdx + 8]
mov qword [r11 + 8], r8
mov qword [rdx + 8], rax
mov rax, rdx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
cmp byte [rax + 0x28], 0
je 0x5ce289
mov rdx, qword [rax + 0x18]
add rdx, rdi
cmp qword [rax + 0x20], rdx
jge 0x5ce289
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x36
lea rcx, [0x006e7c94]
mov qword [rax], rcx
lea rcx, [0x00758260]
mov rdx, qword [rsp + 0x60]
mov qword [rdx], rcx
cmp dword [0x0098c4d0], 0
je 0x5ce280
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [rdx + 8]
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rax
jmp 0x5ce325
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
lea r8, [rdi + rdx]
mov r9, qword [rax + 0x10]
cmp rcx, r8
jae 0x5ce2ca
mov qword [rsp + 0x38], rdx
mov rax, r9
mov rbx, r8
lea rsi, [0x0067b400]
call sym.runtime.growslice
mov rdx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
mov r9, rax
mov r8, rbx
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x48], r9
lea rax, [r9 + rdx]
mov rcx, rdi
call sym.runtime.memmove
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov qword [rsi + 0x18], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rsi + 0x20], rdx
cmp dword [0x0098c4d0], 0
jne 0x5ce30c
mov rax, qword [rsp + 0x48]
jmp 0x5ce321
call sym.runtime.gcWriteBarrier2
mov rax, qword [rsp + 0x48]
mov qword [r11], rax
mov rcx, qword [rsi + 0x10]
mov qword [r11 + 8], rcx
mov qword [rsi + 0x10], rax
add rsp, 0x50
pop rbp
ret
lea rax, [0x0067b380]
lea rbx, [0x00757000]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack.abi0
mov rax, qword [rsp + 8]
jmp sym.crypto_tls._finishedMsg_.marshal.func1
Function at 0x5cefe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cf1bf
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rdx + 8]
cmp byte [rdx + 0x18], 0
nop word [rax + rax]
je 0x5cf17b
movzx r8d, word [rdx + 0x1a]
rol r8w, 8
mov word [rsp + 0x2e], 0
mov word [rsp + 0x2e], r8w
cmp qword [rax], 0
jne 0x5cf17b
cmp qword [rax + 0x30], 0
jne 0x5cf1ab
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], rdx
mov r8, qword [rax + 0x18]
add r8, 2
cmp r8, 2
jge 0x5cf09e
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x1b
lea rcx, [0x006da8fc]
mov qword [rax], rcx
lea rcx, [0x00758260]
mov rdx, qword [rsp + 0x60]
mov qword [rdx], rcx
cmp dword [0x0098c4d0], 0
nop
je 0x5cf092
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov r8, qword [rdx + 8]
mov qword [r11 + 8], r8
mov qword [rdx + 8], rax
mov rax, rdx
mov rdx, qword [rsp + 0x38]
cmp byte [rax + 0x28], 0
je 0x5cf106
mov r8, qword [rax + 0x18]
add r8, 2
cmp qword [rax + 0x20], r8
jge 0x5cf106
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x36
lea rcx, [0x006e7c94]
mov qword [rax], rcx
lea rcx, [0x00758260]
mov rdx, qword [rsp + 0x60]
mov qword [rdx], rcx
cmp dword [0x0098c4d0], 0
je 0x5cf0f8
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rsi, qword [rdx + 8]
mov qword [r11 + 8], rsi
mov qword [rdx + 8], rax
mov rax, rdx
mov rdx, qword [rsp + 0x38]
jmp 0x5cf17b
mov rcx, qword [rax + 0x20]
mov rbx, qword [rax + 0x18]
lea r8, [rbx + 2]
mov r9, qword [rax + 0x10]
cmp rcx, r8
jae 0x5cf14c
mov qword [rsp + 0x30], rbx
mov rax, r9
mov rbx, r8
mov edi, 2
lea rsi, [0x0067b400]
call sym.runtime.growslice
mov rdx, qword [rsp + 0x38]
mov r9, rax
mov r8, rbx
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x30]
movzx esi, word [rsp + 0x2e]
mov word [r9 + rbx], si
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], rcx
cmp dword [0x0098c4d0], 0
je 0x5cf177
call sym.runtime.gcWriteBarrier2
mov qword [r11], r9
mov rsi, qword [rax + 0x10]
mov qword [r11 + 8], rsi
mov qword [rax + 0x10], r9
movups xmmword [rsp + 0x40], xmm15
lea rsi, [sym.crypto_tls._certificateVerifyMsg_.marshal.func1.1]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdx
mov ebx, 2
xor ecx, ecx
lea rdi, [rsp + 0x40]
nop
call sym.vendor_golang.org_x_crypto_cryptobyte._Builder_.addLengthPrefixed
add rsp, 0x50
pop rbp
ret
lea rax, [0x0067b380]
lea rbx, [0x00757000]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack.abi0
mov rax, qword [rsp + 8]
jmp sym.crypto_tls._certificateVerifyMsg_.marshal.func1
Function at 0x5cf1e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cf39f
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rdx + 8]
mov rbx, qword [rdx + 0x20]
cmp qword [rax], 0
nop
jne 0x5cf385
cmp qword [rax + 0x30], 0
jne 0x5cf38b
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rbx
mov rdi, qword [rdx + 0x28]
mov qword [rsp + 0x28], rdi
mov rdx, qword [rax + 0x18]
add rdx, rdi
cmp rdi, rdx
jle 0x5cf287
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x1b
lea rcx, [0x006da8fc]
mov qword [rax], rcx
lea rcx, [0x00758260]
mov rdx, qword [rsp + 0x60]
mov qword [rdx], rcx
cmp dword [0x0098c4d0], 0
je 0x5cf276
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov r8, qword [rdx + 8]
mov qword [r11 + 8], r8
mov qword [rdx + 8], rax
mov rax, rdx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
cmp byte [rax + 0x28], 0
je 0x5cf2e9
mov rdx, qword [rax + 0x18]
add rdx, rdi
cmp qword [rax + 0x20], rdx
jge 0x5cf2e9
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x36
lea rcx, [0x006e7c94]
mov qword [rax], rcx
lea rcx, [0x00758260]
mov rdx, qword [rsp + 0x60]
mov qword [rdx], rcx
cmp dword [0x0098c4d0], 0
je 0x5cf2e0
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [rdx + 8]
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rax
jmp 0x5cf385
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
lea r8, [rdi + rdx]
mov r9, qword [rax + 0x10]
cmp rcx, r8
jae 0x5cf32a
mov qword [rsp + 0x38], rdx
mov rax, r9
mov rbx, r8
lea rsi, [0x0067b400]
call sym.runtime.growslice
mov rdx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
mov r9, rax
mov r8, rbx
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x48], r9
lea rax, [r9 + rdx]
mov rcx, rdi
call sym.runtime.memmove
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov qword [rsi + 0x18], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rsi + 0x20], rdx
cmp dword [0x0098c4d0], 0
jne 0x5cf36c
mov rax, qword [rsp + 0x48]
jmp 0x5cf381
call sym.runtime.gcWriteBarrier2
mov rax, qword [rsp + 0x48]
mov qword [r11], rax
mov rcx, qword [rsi + 0x10]
mov qword [r11 + 8], rcx
mov qword [rsi + 0x10], rax
add rsp, 0x50
pop rbp
ret
lea rax, [0x0067b380]
lea rbx, [0x00757000]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack.abi0
mov rax, qword [rsp + 8]
jmp sym.crypto_tls._certificateVerifyMsg_.marshal.func1.1
Function at 0x5d10e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d129f
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, qword [rdx + 8]
nop
cmp qword [rax], 0
nop dword [rax + rax]
jne 0x5d1285
cmp qword [rax + 0x30], 0
jne 0x5d128b
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rbx
mov rdi, qword [rdx + 0x10]
mov qword [rsp + 0x28], rdi
mov rdx, qword [rax + 0x18]
add rdx, rdi
cmp rdi, rdx
jle 0x5d1187
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x1b
lea rcx, [0x006da8fc]
mov qword [rax], rcx
lea rcx, [0x00758260]
mov rdx, qword [rsp + 0x60]
mov qword [rdx], rcx
cmp dword [0x0098c4d0], 0
je 0x5d1176
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov r8, qword [rdx + 8]
mov qword [r11 + 8], r8
mov qword [rdx + 8], rax
mov rax, rdx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
cmp byte [rax + 0x28], 0
je 0x5d11e9
mov rdx, qword [rax + 0x18]
add rdx, rdi
cmp qword [rax + 0x20], rdx
jge 0x5d11e9
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x36
lea rcx, [0x006e7c94]
mov qword [rax], rcx
lea rcx, [0x00758260]
mov rdx, qword [rsp + 0x60]
mov qword [rdx], rcx
cmp dword [0x0098c4d0], 0
je 0x5d11e0
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rcx, qword [rdx + 8]
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rax
jmp 0x5d1285
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
lea r8, [rdi + rdx]
mov r9, qword [rax + 0x10]
cmp rcx, r8
jae 0x5d122a
mov qword [rsp + 0x38], rdx
mov rax, r9
mov rbx, r8
lea rsi, [0x0067b400]
call sym.runtime.growslice
mov rdx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
mov r9, rax
mov r8, rbx
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x48], r9
lea rax, [r9 + rdx]
mov rcx, rdi
call sym.runtime.memmove
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov qword [rsi + 0x18], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rsi + 0x20], rdx
cmp dword [0x0098c4d0], 0
jne 0x5d126c
mov rax, qword [rsp + 0x48]
jmp 0x5d1281
call sym.runtime.gcWriteBarrier2
mov rax, qword [rsp + 0x48]
mov qword [r11], rax
mov rcx, qword [rsi + 0x10]
mov qword [r11 + 8], rcx
mov qword [rsi + 0x10], rax
add rsp, 0x50
pop rbp
ret
lea rax, [0x0067b380]
lea rbx, [0x00757000]
call sym.runtime.gopanic
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack.abi0
mov rax, qword [rsp + 8]
jmp sym.crypto_tls._cipherSuiteTLS13_.expandLabel.func2
Function at 0x5e05a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e07a3
push rbp
mov rbp, rsp
sub rsp, 0x60
mov eax, 0x80000000
call sym.internal_syscall_windows_registry.Key.ReadSubKeyNames
nop dword [rax]
test rdi, rdi
jne 0x5e05c7
jmp 0x5e05d4
add rsp, 0x60
pop rbp
ret
add rax, 0x10
dec rbx
test rbx, rbx
jle 0x5e079d
mov rcx, qword [rax + 8]
cmp rcx, 2
jl 0x5e05cd
mov rdx, qword [rax]
cmp byte [rdx], 0x2e
jne 0x5e05cd
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x50], rdx
mov eax, 0x80000000
mov rbx, rdx
mov edi, 0x20019
call sym.internal_syscall_windows_registry.OpenKey
test rbx, rbx
je 0x5e0626
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
jmp 0x5e05cd
mov qword [rsp + 0x30], rax
lea rbx, [0x006d3108]
mov ecx, 0xc
call sym.internal_syscall_windows_registry.Key.GetStringValue
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
nop
mov rax, qword [rsp + 0x30]
call sym.syscall.RegCloseKey
mov rdx, qword [rsp + 0x38]
nop dword [rax + rax]
test rdx, rdx
je 0x5e0674
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
jmp 0x5e05cd
mov rbx, qword [rsp + 0x28]
nop dword [rax]
cmp rbx, 3
jne 0x5e075a
mov rax, qword [rsp + 0x50]
cmp word [rax], 0x6a2e
jne 0x5e0742
cmp byte [rax + 2], 0x73
nop
jne 0x5e0729
mov rdi, qword [rsp + 0x20]
cmp rdi, 0xa
jne 0x5e06d7
movabs rdx, 0x616c702f74786574
mov rcx, qword [rsp + 0x48]
cmp qword [rcx], rdx
jne 0x5e06e6
cmp word [rcx + 8], 0x6e69
jne 0x5e06e6
mov esi, 1
jmp 0x5e0775
mov rcx, qword [rsp + 0x48]
movabs rdx, 0x616c702f74786574
cmp rdi, 0x19
je 0x5e06f3
xor esi, esi
jmp 0x5e0775
mov rax, rcx
lea rbx, [0x006d944a]
mov ecx, 0x19
call sym.runtime.memequal
mov rcx, qword [rsp + 0x48]
movabs rdx, 0x616c702f74786574
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov esi, eax
mov rax, qword [rsp + 0x50]
jmp 0x5e0775
mov rcx, qword [rsp + 0x48]
movabs rdx, 0x616c702f74786574
mov rdi, qword [rsp + 0x20]
xor esi, esi
nop
jmp 0x5e0775
mov rcx, qword [rsp + 0x48]
movabs rdx, 0x616c702f74786574
mov rdi, qword [rsp + 0x20]
xor esi, esi
jmp 0x5e0775
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
movabs rdx, 0x616c702f74786574
mov rdi, qword [rsp + 0x20]
xor esi, esi
test sil, sil
je 0x5e0789
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
jmp 0x5e05cd
call sym.mime.setExtensionType
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
jmp 0x5e05cd
add rsp, 0x60
pop rbp
ret
call sym.runtime.morestack_noctxt.abi0
jmp sym.mime.initMimeWindows
Function at 0x5e54c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5e5595
movdqa xmm0, xmmword [0x00756be0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5e5501
movdqa xmm0, xmmword [0x00756bf0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5e5617
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5e55eb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00756890]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00756c00]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5f2400
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f259b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5f2421
inc rcx
cmp rbx, rcx
jle 0x5f2591
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5f241e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call sym.net.SplitHostPort
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x008f4f20]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call sym.vendor_golang.org_x_net_idna._Profile_.process
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x5f2585
test rdx, rdx
je 0x5f257a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5f2549
xor eax, eax
lea rbx, [0x006d0b12]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006d0b9a]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x5f2570
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00755048]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.vendor_golang.org_x_net_http_httpguts.PunycodeHostPort
Function at 0x5f3a60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f3b5a
push rbp
mov rbp, rsp
sub rsp, 0x60
mov byte [rsp + 0x2f], sil
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdi
mov byte [rsp + 0x90], sil
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
call sym.runtime.convTstring
lea rcx, [0x0067b380]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
nop dword [rax + rax]
call sym.runtime.convTstring
lea rcx, [0x0067b380]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
movzx edx, byte [rsp + 0x2f]
movzx edx, dl
test rdx, rdx
mov ebx, 0
mov edx, 0xc
cmovne rbx, rdx
mov eax, 0
lea rdx, [0x006d3114]
cmovne rax, rdx
nop
call sym.runtime.convTstring
lea rcx, [0x0067b380]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x006d78ef]
mov ebx, 0x16
lea rcx, [rsp + 0x30]
mov edi, 3
mov rsi, rdi
call sym.fmt.Sprintf
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp sym.vendor_golang.org_x_net_http2_hpack.HeaderField.String

Function at 0x5f7020
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f7126
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
je 0x5f7042
xor ecx, ecx
xor edx, edx
jmp 0x5f7080
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x21
lea rcx, [0x006de5a5]
mov qword [rax], rcx
lea rbx, [0x00758260]
mov rcx, rax
xor eax, eax
add rsp, 0x10
pop rbp
ret
shl rdx, 4
movzx esi, dil
inc rcx
or rdx, rsi
cmp rbx, rcx
jle 0x5f7119
movzx esi, byte [rax + rcx]
lea edi, [rsi - 0x30]
cmp dil, 9
jbe 0x5f70b0
lea edi, [rsi - 0x61]
cmp dil, 5
ja 0x5f70a4
lea edi, [rsi - 0x57]
jmp 0x5f70b0
lea edi, [rsi - 0x41]
cmp dil, 5
ja 0x5f70e9
lea edi, [rsi - 0x37]
cmp rcx, 0x10
jne 0x5f7072
lea rax, [0x006951a0]
nop dword [rax]
call sym.runtime.newobject
mov qword [rax + 8], 0x1b
lea rcx, [0x006dabba]
mov qword [rax], rcx
lea rbx, [0x00758260]
mov rcx, rax
xor eax, eax
add rsp, 0x10
pop rbp
ret
lea rax, [0x006951a0]
call sym.runtime.newobject
mov qword [rax + 8], 0x1c
lea rcx, [0x006db4fd]
mov qword [rax], rcx
lea rbx, [0x00758260]
mov rcx, rax
xor eax, eax
add rsp, 0x10
pop rbp
ret
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.net_http_internal.parseHexUint
Function at 0x5f7a60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f7be9
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x70], rax
nop word [rax + rax]
test rbx, rbx
je 0x5f7bdd
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rax
call sym.net_url.Parse
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
test rbx, rbx
jne 0x5f7af8
mov rdx, qword [rax + 8]
mov r8, qword [rax]
cmp rdx, 4
jne 0x5f7ac6
cmp dword [r8], 0x70747468
je 0x5f7b4b
cmp rdx, 5
jne 0x5f7ae0
cmp dword [r8], 0x70747468
jne 0x5f7ae0
cmp byte [r8 + 4], 0x73
je 0x5f7b46
nop dword [rax]
cmp rdx, 6
jne 0x5f7af8
cmp dword [r8], 0x6b636f73
jne 0x5f7af8
cmp word [r8 + 4], 0x3573
je 0x5f7b41
xor eax, eax
lea rbx, [0x006d1508]
mov ecx, 7
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
call sym.runtime.concatstring2
call sym.net_url.Parse
test rbx, rbx
je 0x5f7b36
mov rdx, qword [rsp + 0x28]
test rdx, rdx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rbx, rdx
jmp 0x5f7b4e
xor ebx, ebx
xor ecx, ecx
add rsp, 0x60
pop rbp
nop
ret
test rbx, rbx
jmp 0x5f7b4e
test rbx, rbx
jmp 0x5f7b4e
test rbx, rbx
je 0x5f7bd3
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
call sym.runtime.convTstring
lea rcx, [0x0067b380]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x5f7b90
mov rbx, qword [rcx + 8]
jmp 0x5f7b93
mov rbx, rcx
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rdx
lea rax, [0x006db519]
mov ebx, 0x1c
lea rcx, [rsp + 0x40]
mov edi, 2
mov rsi, rdi
nop dword [rax + rax]
call sym.fmt.Errorf
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x60
pop rbp
ret
xor ebx, ebx
xor ecx, ecx
add rsp, 0x60
pop rbp
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.vendor_golang.org_x_net_http_httpproxy.parseProxy
Function at 0x600320
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6003b9
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
lea rcx, vtable.L_.0
mov rdi, rax
mov rsi, rbx
lea rax, [0x006d2eec]
mov ebx, 0xc
call sym.net_http.sanitizeOrWarn
test rbx, rbx
je 0x6003b3
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rcx, [0x006d0bdc]
mov edi, 2
call sym.strings.IndexAny
test rax, rax
jl 0x6003a3
xor eax, eax
lea rbx, [0x00754ff0]
mov ecx, 1
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov r8, rbx
mov r9, rcx
call sym.runtime.concatstring3
add rsp, 0x48
pop rbp
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x48
pop rbp
ret
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.net_http.sanitizeCookieValue

Function at 0x602be0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x602c33
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x28], xmm15
call sym.runtime.convTstring
lea rcx, [0x0067b380]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006db25d]
mov ebx, 0x1c
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call sym.fmt.Sprintf
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.net_http.http2headerFieldNameError.Error