joyce8/EMBER2024-capa huggingface dataset:
Function at 0x547160
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x547259
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
nop dword [rax]
cmp rbx, 0x40
jne 0x547245
xor ecx, ecx
jmp 0x547191
inc rcx
cmp rbx, rcx
jle 0x5471b3
movzx edx, byte [rax + rcx]
nop word [rax + rax]
cmp dl, 0xa
je 0x54722f
cmp dl, 0xd
jne 0x54718e
jmp 0x54722f
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x0062f220]
call fcn.0040d1e0
mov dword [rax + 0x140], 0x3d
mov rbx, qword [rsp + 0x30]
cmp rax, rbx
je 0x5471f6
mov qword [rsp + 0x18], rax
mov ecx, 0x40
call fcn.00461f80
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
jmp 0x547202
mov byte [rax + rcx + 0x40], 0xff
inc rcx
cmp rcx, 0x100
jl 0x5471fa
mov rcx, qword [rsp + 0x38]
xor edx, edx
jmp 0x547220
movzx esi, byte [rbx + rdx]
mov byte [rax + rsi + 0x40], dl
inc rdx
nop
cmp rcx, rdx
jg 0x547214
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00684920]
nop dword [rax]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684910]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00547160

Function at 0x549940
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x549958
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x549958
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x549960
xor eax, eax
ret
cmp rbx, 3
je 0x54996c
cmp rbx, 4
jne 0x549999
cmp al, 0x2c
ja 0x549986
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x549996
cmp al, 0x24
je 0x549996
nop dword [rax]
cmp al, 0x26
jae 0x549996
jmp 0x549999
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x549996
cmp al, 0x5b
je 0x549996
cmp al, 0x5d
jne 0x549999
xor eax, eax
ret
cmp al, 0x2f
ja 0x5499d2
nop dword [rax]
cmp al, 0x26
ja 0x5499b1
cmp al, 0x24
je 0x5499f1
cmp al, 0x26
je 0x5499f1
jmp 0x549a6b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5499f1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x549a68
cmp al, 0x2f
je 0x5499f1
jmp 0x549a6b
cmp al, 0x3d
ja 0x5499e9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5499f1
nop
cmp al, 0x3d
je 0x5499f1
jmp 0x549a6b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x549a60
cmp rbx, 2
jg 0x549a27
cmp rbx, 1
je 0x549a21
nop dword [rax]
cmp rbx, 2
jne 0x549a6b
cmp al, 0x2f
je 0x549a12
cmp al, 0x3b
je 0x549a12
cmp al, 0x2c
jne 0x549a19
mov ecx, 1
jmp 0x549a1e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x549a4a
cmp al, 0x40
je 0x549a39
cmp al, 0x2f
je 0x549a39
cmp al, 0x3f
jne 0x549a42
mov ecx, 1
nop
jmp 0x549a47
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x549a59
cmp rbx, 7
jne 0x549a6b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x549a68
cmp al, 0x7e
jne 0x549a6b
xor eax, eax
ret
cmp rbx, 7
jne 0x549a81
cmp al, 0x21
je 0x549a7d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x549a81
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x54d040
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54d232
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x54d15a
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x54d0d0
mov rax, rdx
mov rcx, rsi
call fcn.00461f80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop dword [rax + rax]
cmp rdx, 0x40
jne 0x54d13f
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0054d540
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x54d160
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x54d1e3
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.0054d540
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
mov rcx, qword [rsp + 0x30]
mov rbx, rcx
sub rcx, rdx
sar rax, 0x3f
and rax, rbx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x54d221
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x54d21d
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00461f80
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.0054d040
Function at 0x54e560
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x54e660
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
test rbx, rbx
je 0x54e64c
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x98], rbx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov rbx, rdx
call fcn.00534ae0
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x4c], xmm0
movups xmm0, xmmword [rsp + 0xc]
movups xmmword [rsp + 0x58], xmm0
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rdx + 0x50]
mov qword [rsp + 0x40], rsi
mov rdi, qword [rdx + 0x48]
mov qword [rsp + 0x68], rdi
lea rax, [0x00614bc0]
call fcn.0040d1e0
mov qword [rsp + 0x78], rax
lea rdx, [0x0054e680]
mov qword [rax], rdx
mov rdx, qword [rsp + 0x98]
mov qword [rax + 8], rdx
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor eax, eax
call fcn.0044cd60
movups xmm0, xmmword [rsp + 0x4c]
movups xmmword [rsp], xmm0
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0xc], xmm0
mov rcx, rbx
mov rdi, qword [rsp + 0x78]
mov rbx, rax
mov rax, qword [rsp + 0x70]
call fcn.0054e6a0
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
lea rax, [0x005fe120]
lea rbx, [0x006848f0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0054e560
Function at 0x5506a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5507a3
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
mov rbx, rax
mov ecx, 0x30
call fcn.00523fa0
nop
test al, al
jne 0x5506ff
lea rax, [0x006532e0]
mov ebx, 0x27
call fcn.00468600
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.00525a00
test al, al
jne 0x550795
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x30], xmm15
mov byte [rsp + 0x27], 0
lea rax, [rsp + 0x50]
lea rbx, [rsp + 0x28]
lea rcx, [rsp + 0x27]
call fcn.005240a0
nop
test al, al
je 0x55077a
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
movzx r8d, byte [rsp + 0x27]
xor r8d, 0xffffff80
movzx eax, r8b
call rsi
test rax, rax
je 0x5506ff
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00652dda]
mov ebx, 0x26
call fcn.00468600
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005506a0
Function at 0x551100
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x551306
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rcx
lea rax, [rsp + 0x98]
mov rbx, rax
mov ecx, 0x30
call fcn.00523fa0
test al, al
je 0x55115f
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x5511b7
lea rax, [0x00651664]
mov ebx, 0x22
call fcn.00468600
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea r8, [rcx + rcx*2]
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x68]
mov qword [rax + r8*8 + 8], r10
mov qword [rax + r8*8 + 0x10], r11
mov qword [rax + r8*8], r9
mov rcx, rdi
mov rdx, rax
mov rax, rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov rax, rsi
mov rcx, rdi
call fcn.00525a00
test al, al
jne 0x5512e3
mov qword [rsp + 0x70], 0
movups xmmword [rsp + 0x78], xmm15
lea rax, [rsp + 0x98]
lea rbx, [rsp + 0x70]
mov ecx, 0x30
call fcn.00523fa0
test al, al
je 0x5512b5
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
lea rax, [rsp + 0x70]
lea rbx, [rsp + 0x58]
call fcn.00523b40
nop dword [rax]
test al, al
je 0x551287
mov rcx, qword [rsp + 0x40]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x48]
cmp rdi, rsi
jb 0x551265
mov rax, qword [rsp + 0x50]
nop dword [rax]
jmp 0x55118d
lea rax, [0x0060ef80]
mov rbx, qword [rsp + 0x50]
call fcn.00448f20
lea rsi, [rbx + 1]
mov rdi, rcx
mov rcx, qword [rsp + 0x40]
jmp 0x55118d
lea rax, [0x00651664]
mov ebx, 0x22
call fcn.00468600
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x00651664]
mov ebx, 0x22
call fcn.00468600
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00551100
Function at 0x555500
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5556c2
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x98], rcx
call fcn.00554f80
test rax, rax
jne 0x55560d
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x555581
cmp qword [rcx + 8], 0
je 0x555581
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x90]
nop dword [rax]
call fcn.005550c0
test rax, rax
je 0x555581
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx + 0x10]
mov ebx, dword [rcx + 0xc]
call fcn.00554de0
test rdi, rdi
jne 0x5555fc
test rbx, rbx
je 0x5555d1
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
lea rdx, [rcx - 1]
neg rdx
sar rdx, 0x3f
and edx, 8
add rdx, rax
mov qword [rsp + 0x60], rdx
lea r11, [rbx - 1]
mov qword [rsp + 0x48], r11
xor esi, esi
jmp 0x555627
lea rax, [0x00657d70]
mov ebx, 0x3d
nop dword [rax]
call fcn.00468600
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
inc rsi
cmp rsi, r11
jge 0x5556b4
mov r12, qword [rdx + rsi*8]
cmp qword [r12 + 0x98], 3
jne 0x555624
mov qword [rsp + 0x40], rsi
mov rdx, qword [rax + rsi*8]
mov rbx, qword [rdx + 0x90]
mov rcx, qword [rdx + 0x18]
mov rdi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
mov r8, qword [rdx + 0x78]
mov r9, qword [rdx + 0x80]
mov r10, qword [rdx + 0x88]
mov rax, r12
mov rsi, r11
call fcn.0055b500
test rax, rax
jne 0x55569d
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp 0x555624
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00555500
Function at 0x555f40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5560c8
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
cmp rbx, 3
jg 0x556005
cmp rbx, 1
jg 0x555fc5
test rbx, rbx
je 0x555faf
nop word [rax + rax]
cmp rbx, 1
jne 0x556052
xor eax, eax
lea rbx, [0x006567c2]
mov rsi, rdi
mov rdi, rcx
mov ecx, 0x33
nop
call fcn.0044c9c0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00657f21]
mov ebx, 0x3e
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rbx, 2
jne 0x555fef
xor eax, eax
lea rbx, [0x0065901f]
mov rsi, rdi
mov rdi, rcx
mov ecx, 0x52
nop
call fcn.0044c9c0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00657373]
mov ebx, 0x37
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rbx, 5
jg 0x556040
cmp rbx, 4
jne 0x556027
lea rax, [0x00656d13]
mov ebx, 0x35
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006583a1]
mov ebx, 0x41
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rbx, 6
je 0x5560b2
cmp rbx, 7
je 0x55608f
cmp rbx, 9
je 0x556068
lea rax, [0x00649ca4]
mov ebx, 0x13
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
xor eax, eax
lea rbx, [0x006592c0]
mov rsi, rdi
mov rdi, rcx
mov ecx, 0x56
nop dword [rax]
call fcn.0044c9c0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
xor eax, eax
lea rbx, [0x006590c4]
mov rsi, rdi
mov rdi, rcx
mov ecx, 0x53
call fcn.0044c9c0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x0065893e]
mov ebx, 0x47
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00555f40
Function at 0x556100
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x55638e
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x90], rbx
call fcn.0055b360
test al, al
jne 0x556188
mov rdx, qword [rsp + 0x98]
mov rax, qword [rdx + 0x270]
mov rbx, qword [rdx + 0x278]
mov rcx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x70]
call fcn.0055a060
nop dword [rax]
test al, al
jne 0x556237
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x70]
call fcn.004bd8e0
test rax, rax
je 0x556207
mov rdx, qword [rsp + 0x98]
mov r10, qword [rdx + 0x410]
mov rdx, qword [rdx + 0x408]
test r10, r10
je 0x5561ca
mov qword [rsp + 0x68], r10
xor eax, eax
xor ecx, ecx
xor ebx, ebx
jmp 0x5562e6
xor eax, eax
lea rbx, [0x00652d68]
mov ecx, 0x26
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x70]
lea r8, [0x00652e75]
mov r9d, 0x27
call fcn.0044ca60
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rdx, qword [rsp + 0x98]
mov rax, qword [rdx + 0x3d8]
mov rbx, qword [rdx + 0x3e0]
mov rcx, qword [rdx + 0x3e8]
lea rdi, [0x006443d3]
mov esi, 2
call fcn.004ce1a0
jmp 0x556253
lea rax, [0x00658823]
mov ebx, 0x46
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
test rbx, rbx
jne 0x556288
xor eax, eax
lea rbx, [0x00658466]
mov ecx, 0x42
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x70]
call fcn.0044c9c0
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov ecx, 0x1f
mov rdi, rax
mov rsi, rbx
lea r8, [0x00644b6b]
mov r9d, 6
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x70]
xor eax, eax
lea rbx, [0x0064ff25]
call fcn.0044cb40
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov r8, qword [rsp + 0x88]
add r8, 0x18
mov r10, rsi
mov rcx, rbx
mov rbx, rax
mov rax, rdx
mov rdx, r8
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x88], rdx
mov r8, qword [rdx]
mov r9, qword [rdx + 8]
mov r11, qword [rdx + 0x10]
nop
test rcx, rcx
je 0x556342
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r11
xor eax, eax
lea rdi, [0x006443d3]
mov esi, 2
call fcn.0044c9c0
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x50]
mov r11, qword [rsp + 0x58]
mov rcx, rbx
mov rbx, rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x48], rcx
mov rax, r8
mov rbx, r9
mov rcx, r11
call fcn.004bc620
mov rcx, qword [rsp + 0x48]
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, qword [rsp + 0x78]
call fcn.0044c9c0
mov rdx, qword [rsp + 0x60]
inc rdx
mov rsi, qword [rsp + 0x68]
nop
cmp rsi, rdx
jg 0x5562cb
jmp 0x556253
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00556100
Function at 0x5563c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5564fd
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rdi
test rbx, rbx
je 0x5564e7
mov rdx, qword [rdi + 0x278]
mov rsi, qword [rdi + 0x270]
test rdx, rdx
jne 0x556471
mov rdx, qword [rdi + 0x1d0]
cmp qword [rdi + 0x1d8], 0
je 0x556428
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
test rbx, rbx
jmp 0x556474
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov rax, qword [rdi + 0xb8]
call fcn.004ddfc0
mov ecx, 7
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00645172]
call fcn.0044c9c0
mov rcx, qword [rsp + 0x28]
test rcx, rcx
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
mov rsi, rax
mov rbx, qword [rsp + 0x28]
jmp 0x556474
test rbx, rbx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
je 0x556486
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rsi
mov rbx, rdx
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, [0x00659071]
mov ebx, 0x53
lea rcx, [rsp + 0x38]
mov edi, 2
mov rsi, rdi
call fcn.004af1a0
mov ecx, 0x2d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00654f94]
nop
call fcn.0044c9c0
jmp 0x5564f3
mov ebx, 0x2d
lea rax, [0x00654f94]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005563c0

Function at 0x556540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5565b3
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
nop
test rax, rax
je 0x55659d
mov rcx, qword [rax + 0x18]
mov rax, rbx
call rcx
mov ecx, 0x37
lea rdi, [0x006443ef]
mov esi, 2
mov r8, rax
mov r9, rbx
xor eax, eax
lea rbx, [0x0065733c]
call fcn.0044ca60
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x0065733c]
mov ebx, 0x37
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00556540
Function at 0x556e40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x556fa6
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], r8
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rbx
mov rax, rsi
mov rbx, r8
lea rcx, [0x006443a3]
mov edi, 1
nop dword [rax + rax]
call fcn.004cd3e0
test al, al
je 0x556f7d
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
nop dword [rax]
call fcn.00556600
test sil, sil
je 0x556f21
mov rdx, qword [rsp + 0x28]
cmp rbx, rdx
je 0x556ed8
xor eax, eax
jmp 0x556f13
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], rdi
mov rbx, rax
mov rcx, rdx
mov rax, qword [rsp + 0x40]
call fcn.00402c80
test al, al
jne 0x556efa
xor eax, eax
jmp 0x556f13
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
call fcn.004cf8a0
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
movups xmmword [rsp + 0x50], xmm15
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
call fcn.0040a840
lea rcx, [0x005fe120]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x00655d48]
mov ebx, 0x30
lea rcx, [rsp + 0x50]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
call fcn.00557280
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00556e40