joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dfbe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5dfd33
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.005e0980
test rbx, rbx
je 0x5dfd01
test rdi, rdi
je 0x5dfcf3
cmp byte [rcx], 0x2f
nop word [rax + rax]
jne 0x5dfcc1
lea rbx, [rdi - 1]
mov rdx, rbx
neg rbx
sar rbx, 0x3f
and ebx, 1
lea rax, [rcx + rbx]
mov rbx, rdx
nop
call fcn.005e0980
test rbx, rbx
je 0x5dfc8f
test rdi, rdi
je 0x5dfc81
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x2c
lea rcx, [0x0072c3a6]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007f1c00]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x20
lea rcx, [0x00726fd8]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007f1c00]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x26
lea rcx, [0x0072a020]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007f1c00]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x13
lea rcx, [0x0071fb66]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007f1c00]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005dfbe0
Function at 0x5e8ae0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5e8bb5
movdqa xmm0, xmmword [0x007f0ee0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5e8b21
movdqa xmm0, xmmword [0x007f0ef0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5e8c37
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5e8c0b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x007f04d0]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x007f1500]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5f6460
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f660b
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5f6487
inc rcx
cmp rbx, rcx
jle 0x5f65fd
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5f6484
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0056c040
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x009a3570]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005f2520
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5f65ed
test rdx, rdx
je 0x5f65de
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5f65a9
xor eax, eax
lea rbx, [0x007eed20]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x00719896]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044e9e0
jmp 0x5f65d0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x007eeb98]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044e900
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005f6460
Function at 0x5f9060
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f91dd
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
cmp byte [rax + 0x98], 0
nop
jne 0x5f908c
cmp dword [rax + 0x30], 0
ja 0x5f9183
mov qword [rsp + 0x58], rax
mov rbx, qword [rax + 0x58]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rax + 0x68]
mov eax, 5
call fcn.005f9200
test rsi, rsi
jne 0x5f9173
mov rdx, qword [rsp + 0x58]
mov esi, dword [rdx + 0x38]
cmp rax, rsi
ja 0x5f911f
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
nop
mov dword [rdx + 0x34], eax
mov rax, rdx
call fcn.005f8240
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov qword [rdi + 0x60], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rdi + 0x68], rcx
cmp dword [0x00a04ed0], 0
jne 0x5f9103
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x58], rcx
jmp 0x5f9111
add rdi, 0x58
mov rcx, qword [rsp + 0x30]
call fcn.00465b20
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x23
lea rcx, [0x0072877c]
mov qword [rax], rcx
lea rcx, [0x007f1c00]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x006e0060]
lea rbx, [rsp + 0x38]
call fcn.0040ae80
mov rbx, rax
lea rax, [0x007f2980]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
mov rbx, r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x47
lea rcx, [0x007310a0]
mov qword [rax], rcx
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x007f1c00]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x006e0060]
lea rbx, [rsp + 0x38]
call fcn.0040ae80
mov rbx, rax
lea rax, [0x007f2980]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.005f9060
Function at 0x5fc060
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5fc151
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, qword [rbx]
mov rsi, qword [rbx + 8]
nop
cmp rsi, 5
jne 0x5fc0a0
cmp dword [rdx], 0x70747468
jne 0x5fc0a0
cmp byte [rdx + 4], 0x73
jne 0x5fc0a0
mov rdx, qword [rax + 0x38]
jmp 0x5fc0f3
cmp rsi, 4
jne 0x5fc0f1
cmp dword [rdx], 0x70747468
jne 0x5fc0f1
mov rdx, qword [rax + 0x40]
test rdx, rdx
je 0x5fc0f3
cmp byte [rax + 0x30], 0
je 0x5fc0f3
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x52
lea rcx, [0x0073192c]
mov qword [rax], rcx
lea rbx, [0x007f1c00]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor edx, edx
test rdx, rdx
je 0x5fc141
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x18], rdx
mov rax, rbx
call fcn.005fcd00
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x30]
call fcn.005fc340
test al, al
je 0x5fc131
mov rax, qword [rsp + 0x18]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005fc060
Function at 0x604300
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x60452d
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
xor edx, edx
jmp 0x604382
mov rdx, qword [rsp + 0x50]
inc rdx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xb8]
cmp rsi, rdx
jle 0x604453
mov qword [rsp + 0x50], rdx
mov rbx, qword [rcx]
movzx eax, byte [rdi + rdx]
mov rdx, rcx
call rbx
nop dword [rax]
test al, al
jne 0x604352
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xb8]
movzx ecx, byte [rdx + rcx]
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
lea rsi, [0x006bb680]
mov qword [rsp + 0x70], rsi
lea rdi, [0x00984980]
lea rcx, [rdi + rcx*8]
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
call fcn.0040b100
lea rcx, [0x006bb4c0]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, [0x0072f487]
mov ebx, 0x37
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
call fcn.004cde40
lea rax, [0x006bb680]
xor ebx, ebx
mov rcx, qword [rsp + 0xc0]
nop dword [rax + rax]
call fcn.0044a940
xor ecx, ecx
mov rdx, qword [rsp + 0xc0]
xor ebx, ebx
jmp 0x604477
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov rsi, qword [rsp + 0x48]
inc rsi
mov rdx, rcx
mov rcx, rsi
mov rsi, qword [rsp + 0xc0]
nop
cmp rsi, rcx
jle 0x604510
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rdx
mov rbx, qword [rsp + 0xb8]
movzx eax, byte [rbx + rcx]
mov byte [rsp + 0x47], al
mov rdx, qword [rsp + 0xb0]
mov rsi, qword [rdx]
call rsi
test al, al
je 0x6044fc
mov rbx, qword [rsp + 0x58]
inc rbx
mov rcx, qword [rsp + 0x60]
cmp rcx, rbx
jb 0x6044d7
mov rax, qword [rsp + 0x68]
jmp 0x6044ed
mov rax, qword [rsp + 0x68]
mov edi, 1
lea rsi, [0x006bb680]
call fcn.0044aa20
movzx esi, byte [rsp + 0x47]
mov byte [rbx + rax - 1], sil
jmp 0x604469
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
jmp 0x604469
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044ec00
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00604300
Function at 0x606880
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x6069d6
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0x2c], ebx
nop word [rax + rax]
test rcx, rcx
je 0x60696c
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
call fcn.0040b000
lea rcx, [0x006bb600]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x2c]
call fcn.0040b000
lea rcx, [0x006ce320]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x30]
nop dword [rax]
test rcx, rcx
je 0x606929
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x80], rcx
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x88], rdx
lea rax, [0x007283f9]
mov ebx, 0x22
lea rcx, [rsp + 0x60]
mov edi, 3
mov rsi, rdi
call fcn.004c51a0
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
call fcn.0040b000
lea rcx, [0x006bb600]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x2c]
call fcn.0040b000
lea rcx, [0x006ce320]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x00726270]
mov ebx, 0x1e
lea rcx, [rsp + 0x40]
mov edi, 2
mov rsi, rdi
call fcn.004c51a0
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov dword [rsp + 8], eax
mov dword [rsp + 0xc], ebx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
call fcn.00463860
mov eax, dword [rsp + 8]
mov ebx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
nop
jmp fcn.00606880
Function at 0x607520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x607743
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
cmp qword [rax + 0xb8], 0
jne 0x6075e2
lea rax, [0x006eb580]
call fcn.0040daa0
cmp dword [0x00a04ed0], 0
nop
jne 0x607570
mov rdx, qword [rsp + 0x50]
mov qword [rdx + 0xc0], rax
jmp 0x607585
mov rdi, qword [rsp + 0x50]
lea rdx, [rdi + 0xc0]
mov rdi, rdx
nop
call fcn.00465a20
xor ebx, ebx
lea rcx, [0x007f19e0]
mov rdi, rax
xor eax, eax
call fcn.00607760
cmp dword [0x00a04ed0], 0
nop
jne 0x6075b0
mov rdx, qword [rsp + 0x50]
mov qword [rdx + 0xb8], rax
jmp 0x6075ca
mov rdi, qword [rsp + 0x50]
lea rdx, [rdi + 0xb8]
mov rcx, rdi
mov rdi, rdx
call fcn.00465a20
mov rdx, rcx
mov byte [rax + 0xb4], 0
mov rsi, qword [rdx + 0xb8]
mov byte [rsi + 0xa1], 1
mov rax, rdx
mov rdx, qword [rax + 0xc0]
mov rbx, qword [rax + 0x88]
mov rcx, qword [rax + 0x90]
mov rdi, qword [rax + 0x98]
mov rax, rdx
call fcn.004d1300
mov rdx, qword [rsp + 0x50]
mov rax, qword [rdx + 0xb8]
call fcn.006079a0
test rcx, rcx
je 0x607682
lea rax, [0x006bce40]
call fcn.0040daa0
lea rcx, [0x0070e880]
mov qword [rax], rcx
cmp dword [0x00a04ed0], 0
jne 0x607646
mov r8, qword [rsp + 0x50]
mov qword [rax + 8], r8
jmp 0x607654
lea rdi, [rax + 8]
mov r8, qword [rsp + 0x50]
call fcn.00465ba0
mov rdx, qword [r8 + 0xd0]
mov r8, qword [rdx]
mov ebx, 0x35
mov rcx, rax
mov edi, 1
mov rsi, rdi
lea rax, [0x0072ec81]
call r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.0060c3c0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
lea rax, [0x006bd7a0]
call fcn.0040daa0
mov qword [rsp + 0x30], rax
lea rcx, [0x0070e880]
mov qword [rax], rcx
cmp dword [0x00a04ed0], 0
jne 0x6076c2
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
nop
jmp 0x6076d0
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x50]
call fcn.00465b20
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.0040b100
lea rcx, [0x006bb4c0]
mov rdi, qword [rsp + 0x30]
mov qword [rdi + 0x10], rcx
cmp dword [0x00a04ed0], 0
jne 0x6076fe
mov qword [rdi + 0x18], rax
jmp 0x607710
lea r8, [rdi + 0x18]
mov rcx, rdi
mov rdi, r8
call fcn.00465a20
mov rdi, rcx
mov r8, qword [rsp + 0x50]
mov rdx, qword [r8 + 0xd0]
mov r8, qword [rdx]
lea rax, [0x00723c33]
mov ebx, 0x1a
mov rcx, rdi
mov edi, 2
mov rsi, rdi
call r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00607520
Function at 0x608c20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x608d4c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [rax], 0
nop dword [rax + rax]
je 0x608d38
xor ecx, ecx
jmp 0x608c50
inc rcx
mov rax, r8
mov rdx, qword [rax + 0x20]
mov rsi, qword [rax + 0x10]
mov rdi, qword [rax + 0x18]
mov r8, rax
movabs rax, 0xaaaaaaaaaaaaaaab
mov r9, rdx
imul rdi
add rdi, rdx
sar rdi, 2
cmp rcx, rdi
jge 0x608d04
lea rax, [rcx + rcx*2]
lea rdi, [rax + rax]
lea rdi, [rdi + 2]
cmp r9, rdi
jb 0x608d2d
mov r10, rax
shl rax, 1
nop word [rax + rax]
cmp rdi, rax
jb 0x608d25
mov rdx, r9
sub r9, rax
mov r11, r9
neg r9
sar r9, 0x3f
and rax, r9
lea r9, [r10 + r10]
lea r9, [r9 + 6]
movzx r10d, word [rsi + rax]
cmp rdx, r9
jb 0x608d1d
cmp r9, rdi
jb 0x608d12
lea r9, [r11 - 2]
neg r9
sar r9, 0x3f
and rdi, r9
rol r10w, 8
mov eax, dword [rsi + rdi]
cmp bx, r10w
jne 0x608c4a
bswap eax
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdi
mov rcx, r9
call fcn.00465f80
mov rcx, r9
call fcn.00465f40
mov rcx, rdi
call fcn.00465f80
mov rcx, rdi
mov rdx, r9
call fcn.00465f40
lea rax, [0x006bb4c0]
lea rbx, [0x007f0ec0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.00463860
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
jmp fcn.00608c20

Function at 0x608d80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x608ec6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp byte [rax], 0
nop dword [rax + rax]
je 0x608eb2
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
xor ecx, ecx
jmp 0x608dc6
mov rcx, qword [rsp + 0x10]
inc rcx
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rax + 0x20]
mov rsi, qword [rax + 0x10]
mov rdi, qword [rax + 0x18]
movabs rax, 0xaaaaaaaaaaaaaaab
mov r9, rdx
imul rdi
add rdi, rdx
sar rdi, 2
cmp rcx, rdi
jge 0x608e7e
lea rax, [rcx + rcx*2]
lea rdi, [rax + rax]
lea rdi, [rdi + 2]
nop
cmp r9, rdi
jb 0x608ea7
mov r10, rax
shl rax, 1
cmp rdi, rax
jb 0x608e9f
mov rdx, r9
sub r9, rax
mov r11, r9
neg r9
sar r9, 0x3f
and rax, r9
lea r9, [r10 + r10]
lea r9, [r9 + 6]
movzx eax, word [rsi + rax]
cmp rdx, r9
jb 0x608e97
nop dword [rax]
cmp r9, rdi
jb 0x608e8c
mov qword [rsp + 0x10], rcx
mov rcx, qword [rbx]
lea r8, [r11 - 2]
neg r8
sar r8, 0x3f
and rdi, r8
rol ax, 8
mov esi, dword [rsi + rdi]
bswap esi
mov rdx, rbx
mov ebx, esi
call rcx
test rax, rax
je 0x608db4
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rdi
mov rcx, r9
call fcn.00465f80
mov rcx, r9
call fcn.00465f40
mov rcx, rdi
call fcn.00465f80
mov rcx, rdi
mov rdx, r9
call fcn.00465f40
lea rax, [0x006bb4c0]
lea rbx, [0x007f0ec0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00608d80
Function at 0x610360
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x118]
cmp r12, qword [r14 + 0x10]
jbe 0x610587
sub rsp, 0x198
mov qword [rsp + 0x190], rbp
lea rbp, [rsp + 0x190]
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x1b8], rdi
mov qword [rsp + 0x1c8], r8
mov rdx, qword [rax]
test rdx, rdx
jne 0x61055c
mov rdx, qword [rax + 8]
nop dword [rax]
test rdx, rdx
jne 0x610537
call fcn.0060caa0
test rbx, rbx
jne 0x61051d
mov qword [rsp + 0xb8], rax
nop
call fcn.005b5320
lea rdi, [rsp + 0xe0]
mov rsi, rsp
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004664a6
mov rbp, qword [rbp]
mov rax, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xf0]
cmp rbx, 2
jne 0x610434
cmp word [rax], 0x3268
je 0x6104b4
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
call fcn.0040b100
lea rcx, [0x006bb4c0]
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rcx
lea rcx, [0x007f0de0]
mov qword [rsp + 0xd8], rcx
lea rax, [0x0072bd60]
mov ebx, 0x2b
lea rcx, [rsp + 0xc0]
mov edi, 2
mov rsi, rdi
call fcn.004c2160
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
cmp byte [rsp + 0xf8], 0
je 0x6104e1
lea rax, [0x007f5558]
mov rbx, qword [rsp + 0xb8]
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x2c
lea rcx, [0x0072c2ca]
mov qword [rax], rcx
xor ebx, ebx
lea rcx, [0x007f1c00]
mov rdi, rax
xor eax, eax
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
xor eax, eax
mov rdi, rcx
mov rcx, rbx
xor ebx, ebx
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
mov r11, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
mov rsi, r10
call r11
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
mov r11, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
mov r9, r10
call r11
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
nop dword [rax]
jmp fcn.00610360
Function at 0x6113e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x61152f
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov r13, 0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x2f], 0
mov rdx, qword [rax]
cmp qword [rdx + 0x48], 0
jne 0x611424
movabs rdx, 0x37e11d600
jmp 0x611428
mov rdx, qword [rdx + 0x48]
mov rbx, qword [0x009ad278]
lea rax, [0x007f3f90]
mov rcx, rdx
call fcn.004cfd60
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x2f], 1
nop
nop
cmp byte [0x00a049f1], 0
je 0x611480
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
nop
lea rax, [0x0072979f]
mov ebx, 0x25
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.004cde40
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x68]
call fcn.0061c7c0
test rax, rax
je 0x6114e2
movups xmmword [rsp + 0x40], xmm15
je 0x6114a1
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
nop
cmp byte [0x00a049f1], 0
je 0x6114d4
nop
lea rax, [0x0072b2e8]
mov ebx, 0x29
lea rcx, [rsp + 0x40]
mov edi, 1
mov rsi, rdi
call fcn.004cde40
mov rax, qword [rsp + 0x68]
call fcn.00612340
nop
jmp 0x611506
nop
nop
cmp byte [0x00a049f1], 0
je 0x611506
nop
lea rax, [0x0072977a]
mov ebx, 0x25
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.004cde40
mov byte [rsp + 0x2f], 0
mov rdx, qword [rsp + 0x50]
mov rax, qword [rdx]
call rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
nop
jmp fcn.006113e0