joyce8/EMBER2024-capa huggingface dataset:
Function at 0x508ac0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x508c4c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
call fcn.004d5e20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rbx, qword [rax + 8]
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rdx + 0x80]
cmp rsi, rcx
jne 0x508c38
mov rax, rcx
mov rcx, qword [rsp + 0x48]
call fcn.00403fe0
test al, al
je 0x508c38
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov rbx, rsi
mov r10, rcx
mov rcx, rdi
mov rdi, r8
call r10
test rbx, rbx
jne 0x508c25
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx + 8]
mov rbx, qword [rdx + 8]
mov rdx, rcx
call rbx
cmp rbx, 1
je 0x508c0f
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rax, [0x006eb880]
call fcn.0040daa0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rax], rcx
cmp dword [0x00a04ed0], 0
jne 0x508bc8
mov qword [rax + 8], rdx
jmp 0x508bd1
lea rdi, [rax + 8]
call fcn.00465b40
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
cmp dword [0x00a04ed0], 0
jne 0x508bf7
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
jmp 0x508c05
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465b20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0710]
nop dword [rax]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0700]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f06f0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00508ac0
Function at 0x508c80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x508e23
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], rcx
mov rdx, qword [rax + 0x20]
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
cmp rdi, rdx
jne 0x508cb6
xor r10d, r10d
xor r11d, r11d
jmp 0x508cf8
lea rax, [0x006d8800]
nop dword [rax]
call fcn.0040daa0
mov qword [rax + 8], 0x25
lea rcx, [0x00729677]
mov qword [rax], rcx
lea rbx, [0x007f1c00]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r12d, byte [rcx + r10]
inc r10
or r11d, r12d
cmp rdi, r10
jg 0x508ced
nop dword [rax]
test r11b, r11b
je 0x508e09
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
mov rdi, r9
mov rsi, rdx
call fcn.00507880
test al, al
je 0x508e09
mov rdi, qword [rsp + 0x70]
nop
test rdi, rdi
ja 0x508d52
lea rax, [0x00a04c58]
xor ecx, ecx
xor ebx, ebx
jmp 0x508d6f
lea rax, [0x00a04c58]
mov rbx, rdi
xor ecx, ecx
lea rsi, [0x006bb680]
call fcn.0044aa20
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call fcn.00466860
lea rax, [0x006fbd20]
call fcn.0040daa0
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx + 0x78]
mov qword [rax], rdx
cmp dword [0x00a04ed0], 0
jne 0x508db7
mov rdx, qword [rsp + 0x58]
mov qword [rax + 8], rdx
jmp 0x508dc5
lea rdi, [rax + 8]
mov rdx, qword [rsp + 0x58]
call fcn.00465b40
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x18], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x20], rdx
cmp dword [0x00a04ed0], 0
nop
jne 0x508ded
mov rdx, qword [rsp + 0x40]
mov qword [rax + 0x10], rdx
jmp 0x508dfb
lea rdi, [rax + 0x10]
mov rdx, qword [rsp + 0x40]
call fcn.00465b40
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbx, qword [0x009af0a0]
mov rcx, qword [0x009af0a8]
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop dword [rax]
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.00508c80
Function at 0x5099e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x509aea
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, qword [rax]
nop dword [rax + rax]
test rdx, rdx
je 0x509a0f
cmp rax, rdx
je 0x509a25
jmp 0x509ad6
cmp dword [0x00a04ed0], 0
jne 0x509a1d
mov qword [rax], rax
jmp 0x509a25
mov rdi, rax
call fcn.00465a20
mov qword [rsp + 0x58], rax
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov qword [rsp + 0x40], r8
nop dword [rax + rax]
cmp ebx, 0x7f
ja 0x509a84
lea r9, [r8 + 1]
cmp rcx, r9
jae 0x509a7d
mov dword [rsp + 0x60], ebx
mov rax, rdx
mov rbx, r9
mov edi, 1
lea rsi, [0x006bb680]
call fcn.0044aa20
mov r8, qword [rsp + 0x40]
mov r9, rbx
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x60]
mov byte [r9 + rdx - 1], bl
jmp 0x509aa1
mov rax, rdx
mov edi, ebx
mov rbx, r8
call fcn.004711c0
mov r8, qword [rsp + 0x40]
mov r9, rbx
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x10], r9
mov qword [rax + 0x18], rcx
sub r9, r8
cmp dword [0x00a04ed0], 0
jne 0x509abb
mov qword [rax + 8], rdx
jmp 0x509ac5
lea rdi, [rax + 8]
nop
call fcn.00465b40
mov rax, r9
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0e90]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463860
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.005099e0
Function at 0x511e20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511f26
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rcx, qword [rax + 0x10]
shl rcx, 3
mov qword [rsp + 0x18], rcx
mov rbx, rcx
lea rax, [0x006bb680]
call fcn.0044a940
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov rdi, qword [rsp + 0x18]
mov rcx, rdi
xor ebx, ebx
jmp 0x511e75
inc rbx
cmp rbx, rdx
jge 0x511e83
mov r8, qword [rsi + rbx*8]
xor r9d, r9d
jmp 0x511ee0
test rdi, rdi
jge 0x511e8f
xor edi, edi
jmp 0x511e8f
inc rdi
cmp rdi, rcx
jge 0x511ea3
jae 0x511ecd
movzx edx, byte [rax + rdi]
test dl, dl
je 0x511e8c
nop
cmp rdi, rcx
ja 0x511ec5
sub rcx, rdi
mov rbx, rcx
neg rcx
sar rcx, 0x3f
and rdi, rcx
add rax, rdi
mov rcx, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rdi
call fcn.00465f80
mov rax, rdi
call fcn.00465ec0
inc r9
shr r8, 8
mov rdi, r10
nop
cmp r9, 8
jge 0x511e72
lea r10, [rdi - 1]
test r10, r10
jl 0x511f00
cmp rcx, r10
jbe 0x511f18
mov byte [rdi + rax - 1], r8b
jmp 0x511ed5
test r8b, r8b
je 0x511ed5
lea rax, [0x006bb4c0]
lea rbx, [0x007f0cf0]
call fcn.00436580
mov rax, r10
nop dword [rax + rax]
call fcn.00465ec0
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00511e20

Function at 0x511f40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x512046
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
nop dword [rax]
test rcx, rcx
je 0x511f99
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov rax, rbx
mov rbx, rcx
nop
call fcn.00466560
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
mov rsi, qword [rax + 0x10]
mov rax, rcx
xor r8d, r8d
jmp 0x511fac
inc r8
cmp r8, rsi
jge 0x511fba
mov r9, qword [rdx + r8*8]
xor r10d, r10d
jmp 0x512003
test rcx, rcx
jge 0x511fc6
xor ecx, ecx
jmp 0x511fc6
inc rcx
cmp rax, rcx
jle 0x511fd5
jbe 0x511feb
movzx edx, byte [rbx + rcx]
test dl, dl
je 0x511fc3
mov rcx, rdi
mov rdx, rax
mov rax, rbx
mov rbx, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.00465ec0
inc r10
shr r9, 8
mov rcx, r11
cmp r10, 8
jge 0x511fa9
lea r11, [rcx - 1]
test r11, r11
jl 0x512020
cmp rax, r11
jbe 0x512038
mov byte [rcx + rbx - 1], r9b
jmp 0x511ff9
test r9b, r9b
je 0x511ff9
lea rax, [0x006bb4c0]
lea rbx, [0x007f0cf0]
call fcn.00436580
mov rcx, rax
mov rax, r11
nop
call fcn.00465ec0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00511f40
Function at 0x515b20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515cfc
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], r10
test rsi, rsi
je 0x515c57
test r9, r9
je 0x515c57
mov qword [rsp + 0x98], rsi
lea rbx, [rsi + 1]
mov qword [rsp + 0x58], rbx
cmp rcx, rbx
jl 0x515b7c
jae 0x515bdb
jmp 0x515cf0
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rcx, [rsi + 5]
mov qword [rsp + 0x50], rcx
lea rax, [0x006baec0]
call fcn.0044a940
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
nop dword [rax + rax]
cmp rsi, rcx
ja 0x515ce5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.005219a0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
jae 0x515cd9
mov rsi, qword [rsp + 0x60]
mov qword [rsi + rcx*8], rax
jmp 0x515ca2
test r10, r10
jne 0x515c62
xor edx, edx
nop
jmp 0x515c92
nop
cmp rcx, 1
jge 0x515c8a
lea rax, [0x006baec0]
mov ebx, 1
mov rcx, rbx
call fcn.0044a940
mov r10, qword [rsp + 0xb0]
mov ecx, 1
mov qword [rax], r10
mov edx, 1
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
dec rdx
test rdx, rdx
jle 0x515cb1
mov rdi, qword [rsi + rdx*8 - 8]
test rdi, rdi
je 0x515c9f
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
ja 0x515ccb
mov rax, rsi
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00465f40
mov rax, rcx
mov rcx, rdx
nop
call fcn.00465ec0
mov rdx, rcx
mov rcx, rsi
call fcn.00465f40
mov rdx, rcx
mov rcx, rbx
call fcn.00465f40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.00515b20
Function at 0x516580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5166d1
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x5166c5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00521640
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x5166a1
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x5166c0
cmp rsi, rcx
ja 0x5166b3
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x5166ab
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00521780
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00465f80
mov rax, rsi
call fcn.00465f80
nop dword [rax + rax]
call fcn.00465f40
mov rdx, rcx
mov rcx, r9
call fcn.00465f40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.00516580
Function at 0x516740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x516891
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x516885
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.005216e0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x516861
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x516880
cmp rsi, rcx
ja 0x516873
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x51686b
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00521820
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00465f80
mov rax, rsi
call fcn.00465f80
nop dword [rax + rax]
call fcn.00465f40
mov rdx, rcx
mov rcx, r9
call fcn.00465f40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.00516740
Function at 0x51c2a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c45c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x51c2e7
nop
jae 0x51c35e
jmp 0x51c450
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x51c32b
lea rax, [0x006baec0]
mov ebx, 1
mov rcx, rbx
call fcn.0044a940
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x51c35e
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x006baec0]
call fcn.0044a940
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x51c373
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x51c3a5
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x51c366
nop dword [rax + rax]
jmp 0x51c445
test rsi, rsi
jle 0x51c3b2
xor r8d, r8d
xor r9d, r9d
jmp 0x51c40e
jmp 0x51c3b7
dec rbx
test rbx, rbx
jle 0x51c3c6
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x51c3b4
cmp rbx, rcx
ja 0x51c3d5
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, rcx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00465f40
cmp r8, 0x40
sbb r11, r11
lea r12, [r8 + 8]
movzx r13d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r13, cl
and r13, r11
or r9, r13
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x51c41e
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x51c3e5
jmp 0x51c439
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x51c42e
mov qword [rax + rbx*8 - 8], r9
jmp 0x51c3b2
mov rax, rsi
mov rcx, rbx
call fcn.00465ec0
mov rax, r10
mov rcx, rdx
nop
call fcn.00465ec0
mov rax, r9
mov rcx, rbx
call fcn.00465ec0
mov rdx, rcx
mov rcx, rbx
call fcn.00465f40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.0051c2a0
Function at 0x522200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5222a6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
cmp qword [rcx + 0x10], 0
jne 0x52222d
xor edx, edx
jmp 0x522240
cmp byte [rcx], 0
je 0x52223b
mov rdx, 0xffffffffffffffff
jmp 0x522240
mov edx, 1
test rdx, rdx
jne 0x522272
cmp qword [rdi + 0x10], 0
jne 0x522250
xor edx, edx
jmp 0x522263
cmp byte [rdi], 0
je 0x52225e
mov rdx, 0xffffffffffffffff
jmp 0x522263
mov edx, 1
test rdx, rdx
jne 0x522272
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rax + 0x28]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
nop
call rdx
test al, al
je 0x522290
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0790]
nop
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00522200
Function at 0x522320
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52255f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x006e38a0]
nop
call fcn.0040daa0
lea rbx, [0x00730bcc]
mov ecx, 0x44
mov edi, 0xa
call fcn.00511c60
nop dword [rax + rax]
test bl, bl
je 0x52254b
mov qword [rsp + 0x40], rax
lea rax, [0x006e38a0]
call fcn.0040daa0
lea rbx, [0x00730b88]
mov ecx, 0x44
mov edi, 0xa
call fcn.00511c60
test bl, bl
je 0x522538
mov qword [rsp + 0x38], rax
lea rax, [0x006e38a0]
call fcn.0040daa0
lea rbx, [0x0072f640]
mov ecx, 0x38
mov edi, 0x10
call fcn.00511c60
nop
test bl, bl
je 0x522525
mov qword [rsp + 0x30], rax
lea rax, [0x006e38a0]
call fcn.0040daa0
lea rbx, [0x0072f678]
mov ecx, 0x38
mov edi, 0x10
call fcn.00511c60
test bl, bl
je 0x522511
mov qword [rsp + 0x28], rax
lea rax, [0x006e38a0]
call fcn.0040daa0
lea rbx, [0x0072f6b0]
mov ecx, 0x38
mov edi, 0x10
call fcn.00511c60
nop
test bl, bl
je 0x5224fe
mov qword [rsp + 0x20], rax
lea rax, [0x007027c0]
call fcn.0040daa0
mov qword [rax + 0x38], 5
lea rcx, [0x00719df7]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0xe0
cmp dword [0x00a04ed0], 0
jne 0x52248b
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
jmp 0x5224d3
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465b20
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00465b40
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465b20
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465b20
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00465b20
mov rdi, qword [0x009a2ce8]
test byte [rdi], al
cmp dword [0x00a04ed0], 0
jne 0x5224eb
mov qword [rdi + 8], rax
jmp 0x5224f4
add rdi, 8
call fcn.00465a20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f07a0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f07a0]
nop
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f07a0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f07a0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f07a0]
call fcn.00436580
nop
nop
call fcn.00463860
jmp fcn.00522320
Function at 0x522580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5227bf
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x006e38a0]
nop
call fcn.0040daa0
lea rbx, [0x00731662]
mov ecx, 0x4e
mov edi, 0xa
call fcn.00511c60
nop dword [rax + rax]
test bl, bl
je 0x5227ab
mov qword [rsp + 0x40], rax
lea rax, [0x006e38a0]
call fcn.0040daa0
lea rbx, [0x00731614]
mov ecx, 0x4e
mov edi, 0xa
call fcn.00511c60
test bl, bl
je 0x522798
mov qword [rsp + 0x38], rax
lea rax, [0x006e38a0]
call fcn.0040daa0
lea rbx, [0x007305f8]
mov ecx, 0x40
mov edi, 0x10
call fcn.00511c60
nop
test bl, bl
je 0x522785
mov qword [rsp + 0x30], rax
lea rax, [0x006e38a0]
call fcn.0040daa0
lea rbx, [0x00730638]
mov ecx, 0x40
mov edi, 0x10
call fcn.00511c60
test bl, bl
je 0x522771
mov qword [rsp + 0x28], rax
lea rax, [0x006e38a0]
call fcn.0040daa0
lea rbx, [0x007305b8]
mov ecx, 0x40
mov edi, 0x10
call fcn.00511c60
nop
test bl, bl
je 0x52275e
mov qword [rsp + 0x20], rax
lea rax, [0x007027c0]
call fcn.0040daa0
mov qword [rax + 0x38], 5
lea rcx, [0x00719dfc]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x100
cmp dword [0x00a04ed0], 0
jne 0x5226eb
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
jmp 0x522733
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465b20
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00465b40
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465b20
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465b20
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00465b20
mov rdi, qword [0x009a2cf0]
test byte [rdi], al
cmp dword [0x00a04ed0], 0
jne 0x52274b
mov qword [rdi + 8], rax
jmp 0x522754
add rdi, 8
call fcn.00465a20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f07a0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f07a0]
nop
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f07a0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f07a0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f07a0]
call fcn.00436580
nop
nop
call fcn.00463860
jmp fcn.00522580