joyce8/EMBER2024-capa huggingface dataset:
Function at 0x551d20
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x551eb9
push rbp
mov rbp, rsp
sub rsp, 0xa0
nop word [rax + rax]
cmp cl, 0x10
jae 0x551ea5
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbx
mov byte [rsp + 0xc0], cl
nop
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
nop
movabs rdx, 0xffffffff00000000
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0xffffffffffffffff
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x88], rdx
lea rsi, [rsp + 0x48]
mov qword [rsp + 0x90], rsi
lea rsi, [rsp + 0x28]
mov qword [rsp + 0x98], rsi
mov rsi, qword [rbx]
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rsi + 0x10], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x90]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x98]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov edx, 1
jmp 0x551e75
mov byte [rsp + 0x27], r8b
test byte [rax], al
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.00551c40
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
movzx r8d, byte [rsp + 0xc0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xb8]
cmp dl, 0x10
jae 0x551e8f
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x551e26
jmp 0x551e98
add rsp, 0xa0
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.004601e0
lea rax, [0x0066d140]
lea rbx, [0x00741130]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop dword [rax + rax]
jmp fcn.00551d20
Function at 0x558e80
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x559059
push rbp
mov rbp, rsp
sub rsp, 0xd0
nop word [rax + rax]
cmp cl, 0x10
jae 0x559045
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rbx
mov byte [rsp + 0xf0], cl
nop
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
movabs rdx, 0xffffffff00000001
mov qword [rsp + 0x58], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 1
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb8], rdx
lea rsi, [rsp + 0x58]
mov qword [rsp + 0xc0], rsi
lea rsi, [rsp + 0x28]
mov qword [rsp + 0xc8], rsi
mov rsi, qword [rbx]
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rsi + 0x20], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0xc0]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0xc8]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov edx, 1
jmp 0x559015
mov byte [rsp + 0x27], r8b
test byte [rax], al
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.00558da0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
movzx r8d, byte [rsp + 0xf0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xe8]
cmp dl, 0x10
jae 0x55902f
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x558fc6
jmp 0x559038
add rsp, 0xd0
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.004601e0
lea rax, [0x0066d140]
lea rbx, [0x00741140]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop dword [rax + rax]
jmp fcn.00558e80
Function at 0x55c9c0
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x55cbe9
push rbp
mov rbp, rsp
sub rsp, 0x118
nop dword [rax]
cmp cl, 0x10
jae 0x55cbd5
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rbx
mov byte [rsp + 0x138], cl
nop
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0x110], 0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x108], rsi
lea rsi, [rsp + 0x28]
mov qword [rsp + 0x110], rsi
mov rsi, qword [rbx]
mov r8, qword [rdx]
mov qword [rsi], r8
movups xmm0, xmmword [rdx + 8]
movups xmmword [rsi + 8], xmm0
movups xmm0, xmmword [rdx + 0x18]
movups xmmword [rsi + 0x18], xmm0
movups xmm0, xmmword [rdx + 0x28]
movups xmmword [rsi + 0x28], xmm0
movups xmm0, xmmword [rdx + 0x38]
movups xmmword [rsi + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
jmp 0x55cba5
mov byte [rsp + 0x27], r8b
test byte [rax], al
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.0055c8e0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x55cbbf
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x55cb56
jmp 0x55cbc8
add rsp, 0x118
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.004601e0
lea rax, [0x0066d140]
lea rbx, [0x00741150]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.0055c9c0
Function at 0x55fd60
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x55fdad
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x55fe40
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x55fe85
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x562900
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5629a7
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
cmp rcx, 0x20
je 0x56294e
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x2e
lea rcx, [0x006d435d]
mov qword [rax], rcx
lea rbx, [0x00741740]
mov rcx, rax
xor eax, eax
add rsp, 0x10
pop rbp
ret
mov rdx, qword [rbx]
movabs rsi, 0x7ffffffffffff
and rdx, rsi
nop
mov qword [rax], rdx
mov rdx, qword [rbx + 6]
shr rdx, 3
and rdx, rsi
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0xc]
shr rdx, 6
and rdx, rsi
mov qword [rax + 0x10], rdx
mov rdx, qword [rbx + 0x13]
shr rdx, 1
and rdx, rsi
mov qword [rax + 0x18], rdx
mov rdx, qword [rbx + 0x18]
shr rdx, 0xc
and rsi, rdx
mov qword [rax + 0x20], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00562900

Function at 0x5629e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x562b10
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call fcn.00561e80
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x562a74
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x562ab7
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x562ae3
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
test byte [rbx], al
movzx edi, byte [rbx + rsi]
movzx r9d, byte [rsp + rcx + 0x10]
or edi, r9d
mov byte [rbx + rsi], dil
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x562a6e
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x562a6e
nop
jb 0x562aca
mov rax, rsi
mov ecx, 0x20
call fcn.004601e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005629e0
Function at 0x563fe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56406e
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
cmp qword [rbx], rdx
jne 0x56401b
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rsi, qword [rax + 8]
mov rcx, qword [rbx + 8]
mov rax, rdx
mov rbx, rsi
call fcn.00405280
test al, al
jne 0x564051
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x3b
lea rcx, [0x006d6c3d]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00741740]
mov rsi, rax
xor eax, eax
add rsp, 0x18
pop rbp
ret
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx + 8]
mov rdx, qword [rbx]
mov rdx, qword [rdx + 0x30]
mov rcx, qword [rsp + 0x30]
call rdx
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00563fe0

Function at 0x5641e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x564346
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc8], rdi
cmp rbx, rsi
jne 0x56432f
cmp rbx, 0x48
jg 0x56431c
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
xor ecx, ecx
jmp 0x564280
movzx r9d, byte [rax + rbx - 1]
mov byte [rsp + rcx + 0x58], r9b
mov byte [rsp + rcx + 0x10], sil
inc rcx
mov rbx, r8
mov rsi, rdx
nop dword [rax]
cmp rbx, rcx
jle 0x5642aa
mov rdx, rsi
sub rsi, rcx
lea r8, [rsi - 1]
cmp rdx, r8
jbe 0x564311
mov r8, rbx
sub rbx, rcx
lea r9, [rbx - 1]
movzx esi, byte [rdi + rsi - 1]
cmp r8, r9
ja 0x564263
jmp 0x564306
xor eax, eax
xor ecx, ecx
jmp 0x5642ca
mov rbx, qword [rsp + rdx + 0x58]
mov rdx, qword [rsp + rdx + 0x10]
add rax, 8
nop
neg ecx
sbb rbx, rdx
sbb rcx, rcx
neg rcx
cmp rax, 0x48
jge 0x5642e9
lea rdx, [rax - 0x48]
mov rbx, rdx
sar rdx, 0x3f
neg rbx
and rdx, rax
cmp rbx, 7
ja 0x5642b0
jmp 0x5642f9
cmp rcx, 1
sete al
add rsp, 0xa0
pop rbp
ret
mov eax, 7
mov rcx, rbx
call fcn.004601e0
mov rax, r9
mov rcx, r8
call fcn.004601e0
mov rax, r8
mov rcx, rdx
call fcn.004601e0
lea rax, [0x0066d140]
lea rbx, [0x00741080]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00741070]
nop dword [rax]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.005641e0
Function at 0x565320
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56548f
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
nop
call fcn.0053dba0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x78]
cmp rbx, rcx
jne 0x56547b
mov rbx, qword [rax + 8]
mov rax, rcx
mov rcx, qword [rsp + 0x48]
nop
call fcn.00405280
test al, al
je 0x56547b
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov rbx, rsi
mov r10, rcx
mov rcx, rdi
mov rdi, r8
call r10
test rbx, rbx
jne 0x565468
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx + 8]
mov rbx, qword [rdx + 8]
mov rdx, rcx
call rbx
nop
cmp rbx, 1
je 0x565455
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x0069b440]
nop dword [rax]
call fcn.0040d480
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
mov qword [rax], rdx
cmp dword [0x0092d940], 0
jne 0x565424
mov rdx, qword [rsp + 0x30]
jmp 0x565435
call fcn.0045fe40
mov qword [r11], rcx
mov rdx, qword [rsp + 0x30]
mov qword [r11 + 8], rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
mov qword [rax + 0x10], rdx
add rsp, 0x38
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x007410b0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007410a0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00741090]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00565320
Function at 0x566240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5662d8
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
cmp qword [rcx + 0x10], 0
jne 0x566267
xor edx, edx
jmp 0x56627a
cmp byte [rcx], 0
je 0x566275
mov rdx, 0xffffffffffffffff
jmp 0x56627a
mov edx, 1
test rdx, rdx
jne 0x5662ab
cmp qword [rdi + 0x10], 0
jne 0x56628a
xor edx, edx
jmp 0x5662a0
cmp byte [rdi], 0
je 0x566298
mov rdx, 0xffffffffffffffff
jmp 0x5662a0
mov edx, 1
nop dword [rax]
test rdx, rdx
jne 0x5662ab
add rsp, 0x18
pop rbp
ret
mov rdx, qword [rax + 0x28]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call rdx
test al, al
je 0x5662c4
add rsp, 0x18
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740e50]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00566240
Function at 0x5665a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5667bf
push rbp
mov rbp, rsp
sub rsp, 0x48
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d8557]
mov ecx, 0x4e
mov edi, 0xa
call fcn.00529340
test bl, bl
je 0x5667ab
mov qword [rsp + 0x40], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d85a5]
mov ecx, 0x4e
mov edi, 0xa
call fcn.00529340
test bl, bl
je 0x566798
mov qword [rsp + 0x38], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d7562]
mov ecx, 0x40
mov edi, 0x10
call fcn.00529340
test bl, bl
je 0x566785
mov qword [rsp + 0x30], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d75a2]
mov ecx, 0x40
mov edi, 0x10
call fcn.00529340
test bl, bl
je 0x566770
mov qword [rsp + 0x28], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d75e2]
mov ecx, 0x40
mov edi, 0x10
call fcn.00529340
test bl, bl
je 0x56675d
mov qword [rsp + 0x20], rax
lea rax, [0x006aebc0]
call fcn.0040d480
mov qword [rax + 0x38], 5
lea rcx, [0x006c4f63]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x100
cmp dword [0x0092d940], 0
jne 0x5666ed
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x56671e
call fcn.0045fea0
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rdx, qword [rsp + 0x38]
mov qword [r11 + 8], rdx
mov rbx, qword [rsp + 0x30]
mov qword [r11 + 0x10], rbx
mov rsi, qword [rsp + 0x28]
mov qword [r11 + 0x18], rsi
mov rdi, qword [rsp + 0x20]
mov qword [r11 + 0x20], rdi
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rcx, qword [0x00899698]
test byte [rcx], al
cmp dword [0x0092d940], 0
je 0x566753
call fcn.0045fe40
mov qword [r11], rax
mov rdx, qword [rcx + 8]
mov qword [r11 + 8], rdx
mov qword [rcx + 8], rax
add rsp, 0x48
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
nop
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
nop
nop
call fcn.0045df00
jmp fcn.005665a0
Function at 0x5667e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5669ff
push rbp
mov rbp, rsp
sub rsp, 0x48
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d910e]
mov ecx, 0x74
mov edi, 0xa
call fcn.00529340
test bl, bl
je 0x5669eb
mov qword [rsp + 0x40], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d9182]
mov ecx, 0x74
mov edi, 0xa
call fcn.00529340
test bl, bl
je 0x5669d8
mov qword [rsp + 0x38], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d8d85]
mov ecx, 0x60
mov edi, 0x10
call fcn.00529340
test bl, bl
je 0x5669c5
mov qword [rsp + 0x30], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d8de5]
mov ecx, 0x60
mov edi, 0x10
call fcn.00529340
test bl, bl
je 0x5669b0
mov qword [rsp + 0x28], rax
nop
lea rax, [0x00693040]
call fcn.0040d480
lea rbx, [0x006d8e45]
mov ecx, 0x60
mov edi, 0x10
call fcn.00529340
test bl, bl
je 0x56699d
mov qword [rsp + 0x20], rax
lea rax, [0x006aebc0]
call fcn.0040d480
mov qword [rax + 0x38], 5
lea rcx, [0x006c4f68]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x180
cmp dword [0x0092d940], 0
jne 0x56692d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x56695e
call fcn.0045fea0
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rdx, qword [rsp + 0x38]
mov qword [r11 + 8], rdx
mov rbx, qword [rsp + 0x30]
mov qword [r11 + 0x10], rbx
mov rsi, qword [rsp + 0x28]
mov qword [r11 + 0x18], rsi
mov rdi, qword [rsp + 0x20]
mov qword [r11 + 0x20], rdi
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rcx, qword [0x008996a0]
test byte [rcx], al
cmp dword [0x0092d940], 0
je 0x566993
call fcn.0045fe40
mov qword [r11], rax
mov rdx, qword [rcx + 8]
mov qword [r11 + 8], rdx
mov qword [rcx + 8], rax
add rsp, 0x48
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
nop
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740e60]
call fcn.004337c0
nop
nop
call fcn.0045df00
jmp fcn.005667e0