joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50a920
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50aa0e
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
lea rax, [0x006584ec]
mov ebx, 0x44
call fcn.0050fe40
mov qword [rsp + 0x28], rax
mov ebx, 0x44
lea rax, [0x006584a8]
call fcn.0050fe40
mov qword [rsp + 0x20], rax
mov ebx, 0x38
lea rax, [0x006573aa]
call fcn.0050fee0
mov qword [rsp + 0x18], rax
mov ebx, 0x38
lea rax, [0x006573e2]
call fcn.0050fee0
mov qword [rsp + 0x10], rax
mov ebx, 0x38
lea rax, [0x0065741a]
nop dword [rax]
call fcn.0050fee0
mov qword [rsp + 0x30], rax
lea rax, [0x006323e0]
call fcn.0040d1e0
mov qword [rax + 0x38], 5
lea rcx, [0x006449c5]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0xe0
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x20], rcx
mov qword [0x007dde20], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.0045f280
jmp fcn.0050a920

Function at 0x50ac20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50acc8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
call fcn.00503b00
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
cmp rbx, 1
jne 0x50ac88
cmp byte [rax], 0
jne 0x50ac88
lea rax, [0x00619c80]
nop
call fcn.0040d1e0
mov qword [rsp + 0x40], rax
lea rax, [0x00619c80]
call fcn.0040d1e0
mov rbx, rax
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0050a7a0
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
nop dword [rax]
call fcn.0050a540
test rax, rax
je 0x50acb4
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x005fe120]
lea rbx, [0x00684810]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0050ac20

Function at 0x50ace0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50ad35
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
call fcn.0050a7a0
mov rcx, qword [0x007df8d0]
mov rdi, qword [0x007df8d8]
call fcn.0050a1c0
test r8, r8
jne 0x50ad21
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00684820]
call fcn.00436780
nop
call fcn.0045f280
jmp fcn.0050ace0
Function at 0x50af60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50b09f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x006323e0]
nop
call fcn.0040d1e0
mov qword [rax + 0x38], 5
lea rcx, [0x006449ca]
mov qword [rax + 0x30], rcx
mov qword [0x007dde28], rax
lea rax, [0x00619c80]
call fcn.0040d1e0
lea rbx, [0x00658d54]
mov ecx, 0x4e
mov edi, 0xa
nop dword [rax]
call fcn.004dc660
mov rcx, qword [0x007dde28]
mov qword [rcx], rax
lea rax, [0x00619c80]
call fcn.0040d1e0
lea rbx, [0x00658d06]
mov ecx, 0x4e
mov edi, 0xa
call fcn.004dc660
mov rcx, qword [0x007dde28]
mov qword [rcx + 8], rax
lea rax, [0x00619c80]
call fcn.0040d1e0
lea rbx, [0x0065809b]
mov ecx, 0x40
mov edi, 0x10
call fcn.004dc660
mov rcx, qword [0x007dde28]
mov qword [rcx + 0x10], rax
lea rax, [0x00619c80]
call fcn.0040d1e0
lea rbx, [0x006580db]
mov ecx, 0x40
mov edi, 0x10
call fcn.004dc660
mov rcx, qword [0x007dde28]
mov qword [rcx + 0x18], rax
lea rax, [0x00619c80]
nop dword [rax]
call fcn.0040d1e0
lea rbx, [0x0065805b]
mov ecx, 0x40
mov edi, 0x10
call fcn.004dc660
mov rcx, qword [0x007dde28]
mov qword [rcx + 0x20], rax
mov rcx, qword [0x007dde28]
mov qword [rcx + 0x28], 0x100
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
call fcn.0045f280
jmp fcn.0050af60
Function at 0x50f1c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50f2ae
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
lea rax, [0x0065981d]
mov ebx, 0x74
call fcn.0050fe40
mov qword [rsp + 0x28], rax
mov ebx, 0x74
lea rax, [0x00659891]
call fcn.0050fe40
mov qword [rsp + 0x20], rax
mov ebx, 0x60
lea rax, [0x00659548]
call fcn.0050fee0
mov qword [rsp + 0x18], rax
mov ebx, 0x60
lea rax, [0x006594e8]
call fcn.0050fee0
mov qword [rsp + 0x10], rax
mov ebx, 0x60
lea rax, [0x00659488]
nop dword [rax]
call fcn.0050fee0
mov qword [rsp + 0x30], rax
lea rax, [0x006323e0]
call fcn.0040d1e0
mov qword [rax + 0x38], 5
lea rcx, [0x006449cf]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x180
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x20], rcx
mov qword [0x007dde30], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.0045f280
jmp fcn.0050f1c0

Function at 0x50f4c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50f568
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
call fcn.00505380
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
cmp rbx, 1
jne 0x50f528
cmp byte [rax], 0
jne 0x50f528
lea rax, [0x00619c80]
nop
call fcn.0040d1e0
mov qword [rsp + 0x40], rax
lea rax, [0x00619c80]
call fcn.0040d1e0
mov rbx, rax
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0050a860
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
nop dword [rax]
call fcn.0050a540
test rax, rax
je 0x50f554
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x005fe120]
lea rbx, [0x00684810]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0050f4c0

Function at 0x50f580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50f5d5
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
call fcn.0050a860
mov rcx, qword [0x007df8d0]
mov rdi, qword [0x007df8d8]
call fcn.0050a1c0
test r8, r8
jne 0x50f5c1
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00684820]
call fcn.00436780
nop
call fcn.0045f280
jmp fcn.0050f580
Function at 0x50fb00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50fba8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
call fcn.00506d20
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
cmp rbx, 1
jne 0x50fb68
cmp byte [rax], 0
jne 0x50fb68
lea rax, [0x00619c80]
nop
call fcn.0040d1e0
mov qword [rsp + 0x40], rax
lea rax, [0x00619c80]
call fcn.0040d1e0
mov rbx, rax
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0050a8c0
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
nop dword [rax]
call fcn.0050a540
test rax, rax
je 0x50fb94
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x005fe120]
lea rbx, [0x00684810]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0050fb00

Function at 0x50fbc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50fc15
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
call fcn.0050a8c0
mov rcx, qword [0x007df8d0]
mov rdi, qword [0x007df8d8]
call fcn.0050a1c0
test r8, r8
jne 0x50fc01
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00684820]
call fcn.00436780
nop
call fcn.0045f280
jmp fcn.0050fbc0

Function at 0x5106a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x5106ed
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret
Function at 0x510780
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x5107c5
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x513640
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x5136c5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x513826
cmp rcx, 0xe
jne 0x513740
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x513826
cmp rcx, 0xf
jne 0x5137b7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x513826
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x519c20
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x519d0c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3d
lea rsi, [rdi + rdx]
sar rsi, 3
shl rsi, 3
sub rdx, rsi
lea rsi, [rdx - 8]
neg rsi
nop
cmp rsi, 8
je 0x519cbb
test rbx, rbx
je 0x519cbb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x005fe2e0]
mov rcx, rbx
call fcn.00448e60
mov rcx, qword [rsp + 0x20]
cmp rcx, 8
sbb edx, edx
mov rsi, qword [rsp + 0x30]
movzx edi, byte [rsi]
shr dil, cl
and edi, edx
mov byte [rax], dil
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
mov r8d, 1
jmp 0x519cfa
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp rdi, 0x20
sbb r9d, r9d
movzx r10d, byte [r8 + rsi - 1]
mov r11, rcx
mov rcx, rdi
shl r10d, cl
and r10d, r9d
mov byte [rax + r8], r10b
movzx r9d, byte [rsi + r8]
mov rcx, r11
shr r9b, cl
and r9d, edx
or r10d, r9d
mov byte [rax + r8], r10b
inc r8
cmp rbx, r8
jg 0x519cc5
mov rcx, rbx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00519c20

Function at 0x519d40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x519e51
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
nop dword [rax]
test rbx, rbx
je 0x519e0f
movzx edx, byte [rax]
cmp rdx, 7
jg 0x519d99
cmp rbx, 1
jne 0x519d7d
test rdx, rdx
jne 0x519d99
movzx r9d, byte [rbx + rax - 1]
mov rsi, rcx
mov ecx, edx
mov r10d, 1
shl r10d, cl
dec r10d
test r10b, r9b
je 0x519ddb
lea rcx, [0x00651400]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], 0x22
mov rax, qword [rsp + 0x10]
mov ebx, 0x22
call fcn.0040a840
xor ebx, ebx
mov rcx, rbx
mov rdi, rcx
lea rsi, [0x00685ce0]
mov r8, rax
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rdi, [rbx - 1]
mov rbx, rdi
shl rdi, 3
sub rdi, rcx
lea rcx, [rsi - 1]
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and ecx, 1
add rax, rcx
mov rcx, rdx
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rcx, [0x0064b4e2]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0x16
mov rax, qword [rsp + 0x20]
mov ebx, 0x16
call fcn.0040a840
xor ebx, ebx
mov rcx, rbx
mov rdi, rcx
lea rsi, [0x00685ce0]
mov r8, rax
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00519d40
Function at 0x51a380
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x51a58f
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
mov qword [rsp + 0xa8], rax
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044cd60
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], rbx
mov rcx, rax
mov rdi, rbx
lea rax, [0x00647896]
mov ebx, 0xf
call fcn.004989e0
nop dword [rax]
test rdi, rdi
jne 0x51a3f3
mov edx, 0xf
lea r8, [0x00647896]
jmp 0x51a420
lea rax, [0x00648638]
mov ebx, 0x11
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x38]
call fcn.004989e0
mov edx, 0x11
lea r8, [0x00648638]
nop word [rax + rax]
test rdi, rdi
jne 0x51a57f
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rcx
mov rdi, r8
mov rsi, rdx
call fcn.00496280
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbx
mov rdx, qword [rsp + 0x38]
nop dword [rax]
cmp rbx, rdx
jne 0x51a47f
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
call fcn.00402c80
test al, al
jne 0x51a518
mov rdx, qword [rsp + 0x38]
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
mov rax, qword [rsp + 0x60]
mov rbx, rdx
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x30]
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
lea rax, [0x006596cf]
mov ebx, 0x6a
lea rcx, [rsp + 0x78]
mov edi, 2
mov rsi, rdi
call fcn.004acb60
mov rcx, qword [rsp + 0x68]
mov rdi, rax
mov rsi, rbx
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
call fcn.0049c040
cmp rax, 0x802
jge 0x51a545
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
jmp 0x51a565
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
mov rdi, 0xffffffffffffff9c
xor esi, esi
mov r8, rsi
call fcn.0049cd20
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0051a380
Function at 0x51a5c0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x51a72f
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044cd60
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbx
mov rcx, rax
mov rdi, rbx
lea rax, [0x006493bc]
mov ebx, 0x13
call fcn.004989e0
nop dword [rax]
test rdi, rdi
jne 0x51a71f
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
lea rdi, [0x006493bc]
mov esi, 0x13
call fcn.00496280
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rsp + 0x30]
cmp rbx, rdx
jne 0x51a689
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
call fcn.00402c80
test al, al
je 0x51a684
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
jmp 0x51a6fa
mov rdx, qword [rsp + 0x30]
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
mov rax, qword [rsp + 0x58]
mov rbx, rdx
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, [0x006596cf]
mov ebx, 0x6a
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
call fcn.004acb60
mov rcx, qword [rsp + 0x68]
mov rdi, rax
mov rsi, rbx
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0051a5c0

Function at 0x51a760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51a809
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
jmp 0x51a799
mov rdx, qword [rsp + 0x18]
lea rcx, [rdx + 1]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
cmp rbx, rcx
jle 0x51a7ee
mov qword [rsp + 0x18], rcx
movzx edx, byte [rax + rcx]
mov eax, edx
call fcn.0051a840
test al, al
jne 0x51a786
lea rcx, [0x0065341f]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0x28
mov rax, qword [rsp + 0x20]
mov ebx, 0x28
call fcn.0040a840
xor ebx, ebx
lea rcx, [0x00685ce0]
mov rdi, rax
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044cd60
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0051a760
Function at 0x51a860
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51a913
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
jmp 0x51a899
mov rdx, qword [rsp + 0x18]
lea rcx, [rdx + 1]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
cmp rbx, rcx
jle 0x51a8f5
mov qword [rsp + 0x18], rcx
movzx edx, byte [rax + rcx]
mov ebx, 1
mov eax, edx
mov ecx, ebx
call fcn.0051a940
test al, al
jne 0x51a886
lea rcx, [0x00653ee9]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0x2a
mov rax, qword [rsp + 0x20]
mov ebx, 0x2a
call fcn.0040a840
xor ebx, ebx
lea rcx, [0x00685ce0]
mov rdi, rax
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, rbx
mov rbx, rax
xor eax, eax
nop dword [rax]
call fcn.0044cd60
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0051a860

Function at 0x51a9a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51aa25
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
xor ecx, ecx
jmp 0x51a9c0
inc rcx
cmp rbx, rcx
jle 0x51aa0a
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x51a9bd
lea rcx, [0x00651d61]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0x24
mov rax, qword [rsp + 0x18]
mov ebx, 0x24
call fcn.0040a840
xor ebx, ebx
lea rcx, [0x00685ce0]
mov rdi, rax
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044cd60
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0051a9a0