joyce8/EMBER2024-capa huggingface dataset:
Function at 0x587320
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x587506
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
xor eax, eax
xor ecx, ecx
jmp 0x587360
inc rax
mov qword [rsp + 0x28], rsi
cmp rsi, rbx
jge 0x5874ad
cmp rax, 5
je 0x587461
nop dword [rax + rax]
cmp rsi, rbx
jae 0x5874f9
movzx edi, byte [rdx + rsi]
test rax, rax
jne 0x587398
cmp dil, 0x80
je 0x587414
shl rcx, 7
mov r8d, edi
and edi, 0x7f
or rcx, rdi
inc rsi
test r8b, 0x80
jne 0x58735d
cmp rcx, 0x7fffffff
jg 0x5873d9
xor eax, eax
xor edx, edx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rsi
lea rax, [0x006612ac]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1a
call fcn.0040b600
mov rdx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
lea rax, [0x006a4c20]
jmp 0x5873bb
lea rax, [0x006635ce]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0040b600
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x68], rcx
lea rcx, [0x006a4c40]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
nop
ret
lea rax, [0x006612ac]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1a
call fcn.0040b600
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x68], rcx
lea rcx, [0x006a4c20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00661654]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1a
call fcn.0040b600
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x68], rcx
lea rcx, [0x006a4c40]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rsi
mov rcx, rbx
nop
call fcn.0046cdc0
nop
call fcn.0046abe0
jmp fcn.00587320
Function at 0x587940
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x48]
cmp rax, qword [rcx + 0x10]
jbe 0x587c04
sub rsp, 0xc8
mov qword [rsp + 0xc0], rbp
lea rbp, [rsp + 0xc0]
mov qword [rsp], 0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x10], rax
call fcn.00452060
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x60], rcx
mov rdx, qword [0x007c3710]
mov rbx, qword [0x007c3718]
lea rsi, [0x0065e04e]
mov qword [rsp], rsi
mov qword [rsp + 8], 0x13
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rdx
call fcn.004bc660
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
test rdi, rdi
jne 0x587bcc
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x98], rsi
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
lea rax, [0x0065e04e]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0x13
call fcn.004b9440
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x90], rcx
mov rdx, qword [rsp + 0x60]
nop dword [rax]
cmp rdx, rax
je 0x587b91
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
mov rax, qword [rsp + 0x88]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 8], rax
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rax
lea rax, [0x00669a12]
mov qword [rsp], rax
mov qword [rsp + 8], 0x6a
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 2
call fcn.004d6e60
mov rdi, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], rcx
mov rbp, qword [rsp + 0xc0]
add rsp, 0xc8
ret
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rax
call fcn.00402a40
cmp byte [rsp + 0x18], 0
je 0x587bc2
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x80]
jmp 0x587b47
mov rdx, qword [rsp + 0x60]
jmp 0x587a89
mov qword [rsp + 0xe8], rdx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rcx
mov rbp, qword [rsp + 0xc0]
add rsp, 0xc8
ret
call fcn.0046abe0
jmp fcn.00587940
Function at 0x587c20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x587cee
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor edx, edx
jmp 0x587c59
inc rdx
cmp rax, rdx
jle 0x587cb1
movzx ebx, byte [rcx + rdx]
lea esi, [rbx - 0x30]
cmp sil, 9
jbe 0x587c56
cmp bl, 0x20
je 0x587c56
lea rax, [0x00665ccf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0040b600
mov rax, qword [rsp + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rcx, [0x006a4c40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp], 0
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.00452060
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0046abe0
jmp fcn.00587c20

Function at 0x587d00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x587e17
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor edx, edx
jmp 0x587d40
inc rdx
nop dword [rax]
cmp rax, rdx
jle 0x587dda
movzx ebx, byte [rcx + rdx]
lea esi, [rbx - 0x61]
cmp sil, 0x19
jbe 0x587d36
lea esi, [rbx - 0x41]
cmp sil, 0x19
jbe 0x587d36
lea esi, [rbx - 0x30]
cmp sil, 9
jbe 0x587d36
lea esi, [rbx - 0x27]
cmp sil, 2
jbe 0x587d36
lea esi, [rbx - 0x2b]
cmp sil, 4
jbe 0x587d36
cmp bl, 0x20
je 0x587d36
nop
cmp bl, 0x3a
je 0x587d36
cmp bl, 0x3d
je 0x587d36
cmp bl, 0x3f
je 0x587d36
cmp bl, 0x2a
je 0x587d36
cmp bl, 0x26
je 0x587d36
lea rax, [0x006664e6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
call fcn.0040b600
mov rax, qword [rsp + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rcx, [0x006a4c40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp], 0
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.00452060
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0046abe0
nop dword [rax]
jmp fcn.00587d00
Function at 0x587e40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x587f0b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor edx, edx
jmp 0x587e79
inc rdx
cmp rax, rdx
jle 0x587ecd
movzx ebx, byte [rcx + rdx]
cmp bl, 0x80
jb 0x587e76
lea rax, [0x00664afc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
nop dword [rax + rax]
call fcn.0040b600
mov rax, qword [rsp + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rcx, [0x006a4c40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp], 0
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
nop
call fcn.00452060
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0046abe0
jmp fcn.00587e40
Function at 0x587f20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x58818b
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
bt ecx, 0
jb 0x588123
nop word [rax + rax]
cmp rcx, 2
jl 0x58811c
mov rdx, qword [rsp + 0x68]
movzx ebx, byte [rcx + rdx - 1]
test bl, bl
jne 0x588114
lea rax, [rcx - 2]
cmp rax, rcx
jae 0x588185
movzx ebx, byte [rcx + rdx - 2]
test bl, bl
jne 0x588114
mov qword [rsp + 0x70], rax
lea rcx, [0x00613f40]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
shr rax, 1
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x10], rax
nop dword [rax]
call fcn.0044dcc0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
xor edi, edi
jmp 0x588006
mov word [rax + rdi*2], r8w
add rdx, 0xfffffffffffffffe
mov r8, rdx
neg rdx
sar rdx, 0x3f
and rdx, 2
add rbx, rdx
add rsi, 0xfffffffffffffffe
mov rdx, r8
mov rdi, r9
test rsi, rsi
jle 0x5880a5
movzx r8d, byte [rbx]
cmp rsi, 1
jbe 0x588176
lea r9, [rdi + 1]
shl r8d, 8
movzx r10d, byte [rbx + 1]
add r8d, r10d
cmp r9, rcx
jbe 0x587fe2
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rdx
mov word [rsp + 0x46], r8w
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x48], rdi
lea rdx, [0x00613f40]
mov qword [rsp], rdx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], r9
call fcn.0044ddc0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
lea r9, [rcx + 1]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x48]
movzx r8d, word [rsp + 0x46]
mov rcx, rdx
mov rdx, qword [rsp + 0x78]
jmp 0x587fe2
mov qword [rsp], rax
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rcx
call fcn.004a53e0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov qword [rsp], 0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
nop
call fcn.004524e0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, rcx
jmp 0x587f96
mov rdx, qword [rsp + 0x68]
jmp 0x588114
lea rax, [0x00625ba0]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x1d
lea rcx, [0x00662600]
mov qword [rax], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
lea rcx, [0x006a4760]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, 1
mov rcx, rsi
nop
call fcn.0046cdc0
call fcn.0046cdc0
nop
call fcn.0046abe0
jmp fcn.00587f20
Function at 0x58eaa0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x58ebad
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor edx, edx
jmp 0x58eae0
inc rdx
nop dword [rax]
cmp rdx, rax
jge 0x58eb75
movzx ebx, byte [rcx + rdx]
lea esi, [rbx - 0x61]
cmp sil, 0x19
jbe 0x58ead6
lea esi, [rbx - 0x41]
cmp sil, 0x19
jbe 0x58ead6
lea esi, [rbx - 0x30]
cmp sil, 9
jbe 0x58ead6
lea esi, [rbx - 0x27]
cmp sil, 2
jbe 0x58ead6
lea esi, [rbx - 0x2b]
cmp sil, 4
jbe 0x58ead6
cmp bl, 0x20
je 0x58ead6
nop
cmp bl, 0x3a
je 0x58ead6
cmp bl, 0x3d
je 0x58ead6
cmp bl, 0x3f
je 0x58ead6
cmp bl, 0x2a
je 0x58ead6
lea rax, [0x006664e6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
call fcn.0040b600
mov rax, qword [rsp + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rcx, [0x006a4c20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp], rcx
mov qword [rsp + 8], rax
nop
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x006a5e80]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.0046abe0
jmp fcn.0058eaa0
Function at 0x58f340
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x58f4a0
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x10], rdx
mov byte [rsp + 0x18], 0
call fcn.004c2fe0
mov rax, qword [rsp + 0x20]
cmp rax, 0x270f
jbe 0x58f3f5
lea rax, [0x00665d6f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0040b600
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x88], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [0x006a4c20]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rsp + 0x58]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.0058ebc0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
call fcn.0058f4c0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0046abe0
jmp fcn.0058f340
Function at 0x59e4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x59e700
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
lea rax, [0x00616200]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp + 0x68], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x59e57a
movzx r8d, byte [rsi + rcx]
movzx r9d, byte [rdx + rdi]
xor r8d, r9d
mov byte [rcx + rsi], r8b
inc rdi
inc rsi
cmp rdi, rax
jge 0x59e552
cmp rbx, rsi
jle 0x59e552
ja 0x59e52a
jmp 0x59e6ef
mov rax, qword [rsp + 0x68]
movzx edi, byte [rax + 3]
lea r8d, [rdi + 1]
mov byte [rax + 3], r8b
cmp dil, 0xff
je 0x59e6a8
mov rcx, rsi
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x88]
cmp rcx, rsi
jge 0x59e6e5
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], rbx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 0x38]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp], rdx
mov rbx, qword [rsp + 0xa8]
mov qword [rsp + 8], rbx
mov rsi, qword [rsp + 0xb0]
mov qword [rsp + 0x10], rsi
mov rdi, qword [rsp + 0xb8]
mov qword [rsp + 0x18], rdi
call rcx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 0x38]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp], rdx
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], 4
mov qword [rsp + 0x18], 4
call rcx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp], rdx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], 0
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x18], rbx
call rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x50], rdx
mov rbx, qword [rsp + 0x98]
mov rsi, qword [rbx + 0x20]
mov rdi, qword [rsp + 0xa0]
mov qword [rsp], rdi
nop
call rsi
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x38]
xor edi, edi
jmp 0x59e541
movzx edi, byte [rax + 2]
lea r8d, [rdi + 1]
mov byte [rax + 2], r8b
cmp dil, 0xff
jne 0x59e56d
movzx edi, byte [rax + 1]
lea r8d, [rdi + 1]
mov byte [rax + 1], r8b
cmp dil, 0xff
jne 0x59e56d
movzx edi, byte [rax]
inc edi
mov byte [rax], dil
nop dword [rax]
jmp 0x59e56d
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, rsi
mov rcx, rbx
call fcn.0046cdc0
nop
nop dword [rax + rax]
call fcn.0046abe0
jmp fcn.0059e4e0
Function at 0x5a8500
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5a866f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0xa8]
mov qword [rsp], rcx
call rax
cmp qword [rsp + 8], 0
je 0x5a85a9
lea rax, [0x00625ba0]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x23
lea rcx, [0x006645c1]
mov qword [rax], rcx
mov qword [rsp + 0xb0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
lea rcx, [0x006a4760]
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], rax
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x00614000]
mov qword [rsp], rax
mov qword [rsp + 8], 0x40
mov qword [rsp + 0x10], 0x40
call fcn.0044dcc0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov qword [rsp], rax
mov qword [rsp + 8], 0x40
mov qword [rsp + 0x10], 0x40
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x40], rcx
call fcn.005a8960
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 0x40
mov qword [rsp + 0xc0], 0x40
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.0046abe0
jmp fcn.005a8500
Function at 0x5acaa0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5acccb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rax, qword [rbx + 0x28]
test rax, rax
jle 0x5acb2f
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rbx]
mov r8, qword [rbx + 8]
mov rcx, qword [rbx + 0x30]
cmp rcx, rdx
ja 0x5accc5
cmp rax, rcx
ja 0x5accc0
sub rcx, rax
cmp r8, rcx
cmovg r8, rcx
mov r9, rax
sub rax, rdx
sar rax, 0x3f
and rax, r9
lea rdx, [rax + rsi]
test rax, rax
jne 0x5acc4f
mov rdx, qword [rbx + 0x30]
sub rdx, qword [rbx + 0x28]
mov qword [rbx + 0x30], rdx
mov qword [rbx + 0x28], 0
mov rdx, qword [rbx + 0x30]
cmp qword [rbx + 8], rdx
jle 0x5acc9f
mov eax, 0x64
jmp 0x5acb50
mov rdx, qword [rsp + 0x38]
lea rax, [rdx - 1]
mov rbx, rsi
test rax, rax
jle 0x5acc1b
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov rsi, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x30]
cmp rcx, rdi
jb 0x5acc97
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov rax, qword [rax + 0x18]
mov qword [rsp], r8
sub rsi, rdi
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rsi, rdi
add rdx, rsi
mov qword [rsp + 8], rdx
sub rcx, rdi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x28]
test rax, rax
jl 0x5acc6f
mov rsi, qword [rsp + 0x50]
add qword [rsi + 0x30], rax
test rbx, rbx
jne 0x5acbf3
nop dword [rax + rax]
test rax, rax
jle 0x5acb44
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsi + 0x38], rdx
cmp dword [0x00811460], 0
nop
jne 0x5acc10
mov qword [rsi + 0x40], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rdi, [rsi + 0x40]
call fcn.0046ca20
jmp 0x5acc06
mov rax, qword [0x007ccf08]
mov rcx, qword [0x007ccf00]
mov qword [rbx + 0x38], rcx
cmp dword [0x00811460], 0
jne 0x5acc44
mov qword [rbx + 0x40], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rdi, [rbx + 0x40]
call fcn.0046c920
jmp 0x5acc3a
mov qword [rsp], rsi
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
nop dword [rax]
call fcn.0046d6c0
mov rbx, qword [rsp + 0x50]
jmp 0x5acb1b
mov rax, qword [0x007ccb00]
mov rcx, qword [0x007ccb08]
nop dword [rax]
test rax, rax
je 0x5acc89
mov rax, qword [rax + 8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00438920
mov rax, rdi
call fcn.0046ce80
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a10f0]
mov qword [rsp + 8], rax
call fcn.00438920
nop dword [rax + rax]
call fcn.0046ce80
call fcn.0046ce40
nop
call fcn.0046abe0
jmp fcn.005acaa0
Function at 0x5b2160
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5b2380
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x5b232e
nop word [rax + rax]
cmp eax, 1
jne 0x5b22a3
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x90]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.005ae720
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
test rax, rax
jg 0x5b221b
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp], rcx
mov dword [rsp + 8], eax
call fcn.005b2040
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [0x007ccee8]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
cmp qword [0x007ccee0], rax
je 0x5b2275
xor eax, eax
test al, al
je 0x5b226d
xor eax, eax
xor ecx, ecx
mov rdx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x40]
jmp 0x5b21f9
mov rax, rbx
mov rcx, rsi
jmp 0x5b2260
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
call fcn.00404320
movzx eax, byte [rsp + 0x18]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
jmp 0x5b2258
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp], eax
call fcn.0040b500
mov rax, qword [rsp + 8]
lea rcx, [0x00613f80]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x00664837]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
lea rax, [rsp + 0x50]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 1
mov qword [rsp + 0x20], 1
call fcn.004d6e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rcx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x88]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x18], rcx
call fcn.005ae720
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
jmp 0x5b21f4
call fcn.0046abe0
jmp fcn.005b2160