joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d7b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d7d5d
sub esp, 0x6c
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.004690f5
lea ecx, [0x5d7d70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x88]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005c8b70
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x5d7c53
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + eax*4]
mov ebp, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ebx
lea edx, [esp + 0x40]
call ebp
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5d7c2a
mov eax, dword [esp + 0x84]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.005c8b70
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5d7cb0
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5d7c85
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x5d7cd5
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x5d7d59
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x5d7d59
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x71a960]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00409b00
mov eax, dword [esp + 8]
lea ecx, [0x7b140c]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
call fcn.00467a60
jmp fcn.005d7b30
Function at 0x5d97a0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d9876
sub esp, 0x2c
mov eax, dword [esp + 0x30]
cmp eax, 3
je 0x5d97c5
cmp eax, 9
jne 0x5d97d2
mov ecx, 0x2f
lea edx, [0x74d43b]
jmp 0x5d97d6
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp], eax
call fcn.00409c30
mov eax, dword [esp + 4]
lea ecx, [0x703a40]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea eax, [0x74eae9]
mov dword [esp], eax
mov dword [esp + 4], 0x34
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c4b20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
call fcn.00452120
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x2c
ret
call fcn.00467a60
jmp fcn.005d97a0

Function at 0x5d98b0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d99c3
sub esp, 0x38
mov eax, dword [esp + 0x40]
cmp dword [eax + 0x58], 3
jne 0x5d98dc
movzx ecx, byte [eax + 0x1c0]
test cl, cl
je 0x5d98f2
movzx ecx, byte [eax + 0x1c0]
test cl, cl
je 0x5d990a
movzx ecx, byte [eax + 0x1c1]
test cl, cl
jne 0x5d990a
lea eax, [0x7b1420]
mov dword [esp + 0x44], eax
lea eax, [0x994f00]
mov dword [esp + 0x48], eax
add esp, 0x38
ret
mov ecx, dword [eax + 0x180]
test ecx, ecx
je 0x5d9934
test ecx, 0x20
jne 0x5d9934
lea eax, [0x7b1420]
mov dword [esp + 0x44], eax
lea eax, [0x994f00]
mov dword [esp + 0x48], eax
add esp, 0x38
ret
mov ecx, dword [eax + 0x4c]
test ecx, ecx
jne 0x5d9953
mov eax, dword [0x9677e8]
mov ecx, dword [0x9677ec]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x38
ret
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx + 0x48]
mov ebx, dword [ecx + 0xc]
mov ebp, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edi, dword [ecx + 0x3c]
mov dword [esp + 0x34], edi
mov edi, dword [ecx + 0x40]
mov ecx, dword [ecx + 0x44]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 0x50]
mov eax, dword [eax + 0x54]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0x34]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edi
mov edx, dword [esp + 0x30]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], 0
call fcn.005d9ac0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x38
ret
call fcn.00467a60
jmp fcn.005d98b0
Function at 0x5da0c0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5da1a1
sub esp, 0x24
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
xor edx, edx
cmp ecx, edx
jle 0x5da18d
movzx ebx, byte [eax + edx]
cmp ebx, 0x80
jge 0x5da0f8
inc edx
jmp 0x5da118
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.004600b0
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
cmp ebx, 0x7f
jle 0x5da0e1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
lea eax, [0x74b701]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c1f50
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x24
ret
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x24
ret
call fcn.00467a60
jmp fcn.005da0c0
Function at 0x5de140
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5de224
sub esp, 0x2c
mov eax, dword [esp + 0x30]
movzx ecx, byte [eax + 0x4c]
nop
test cl, cl
jne 0x5de20b
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0xc], edx
call fcn.005dce40
mov eax, dword [esp + 0x38]
and eax, 0xf
test eax, eax
je 0x5de1e5
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
lea ecx, [eax - 0x10]
neg ecx
cmp ecx, 0x10
ja 0x5de201
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + 0x4c]
test dl, dl
jne 0x5de1e9
mov dword [esp], eax
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x10
call fcn.005dce40
add esp, 0x2c
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0900]
mov dword [esp + 4], eax
call fcn.00438b10
mov edx, 0x10
call fcn.00468ef0
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0900]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005de140

Function at 0x5de230
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5de2e6
sub esp, 0x24
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 8
mov edx, ecx
shr ecx, 0x10
mov ebx, edx
shr edx, 0x18
mov ebp, ebx
sar ebx, 0x1f
mov esi, ebx
shl ebx, 0x18
or eax, ebx
mov ebx, esi
shl esi, 0x10
or esi, ecx
mov ecx, ebx
shl ebx, 8
or ebx, edx
xchg ebp, eax
mov byte [esp + 0x1c], al
xchg ebp, eax
mov byte [esp + 0x1d], al
xchg esi, eax
mov byte [esp + 0x1e], al
xchg esi, eax
mov byte [esp + 0x1f], bl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x28]
movzx ecx, byte [eax + 0x4c]
nop
test cl, cl
jne 0x5de2cd
mov dword [esp], eax
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
mov dword [esp + 0xc], 8
call fcn.005dce40
add esp, 0x24
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0900]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005de230
Function at 0x5dff30
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e00a3
sub esp, 0x24
mov eax, dword [esp + 0x28]
test eax, eax
je 0x5e0034
mov eax, dword [eax + 8]
cmp eax, 0x4bcec15d
jne 0x5dff90
mov eax, dword [esp + 0x28]
lea ecx, [0x706680]
cmp eax, ecx
jne 0x5e0038
mov byte [esp + 0x30], 0xe1
mov dword [esp + 0x34], 8
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
add esp, 0x24
ret
cmp eax, 0x8c7bd38d
jne 0x5dffca
mov eax, dword [esp + 0x28]
lea ecx, [0x725f00]
cmp eax, ecx
jne 0x5e0038
mov byte [esp + 0x30], 0xe3
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
add esp, 0x24
ret
cmp eax, 0xc0d9e4a4
jne 0x5e002e
mov eax, dword [esp + 0x28]
lea ecx, [0x6fdca0]
cmp eax, ecx
jne 0x5e0038
lea eax, [0x74fc28]
mov dword [esp], eax
mov dword [esp + 4], 0x39
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004c1f50
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x24
ret
mov eax, dword [esp + 0x28]
jmp 0x5e0038
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
lea eax, [0x74628a]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c1f50
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x24
ret
call fcn.00467a60
jmp fcn.005dff30
Function at 0x5e0590
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e06a2
sub esp, 0x1c
movzx eax, word [esp + 0x20]
mov word [esp], ax
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
call fcn.005e00b0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
test eax, eax
je 0x5e060a
mov edx, dword [esp + 0x2c]
test edx, edx
jne 0x5e05fe
movzx ebx, word [esp + 0x20]
cmp bx, 0x303
jne 0x5e05f8
mov dword [esp + 0x14], 0
mov dword [esp + 0x14], 0x2030201
mov edx, 2
lea ebx, [esp + 0x14]
jmp 0x5e0602
mov ebx, dword [esp + 0x28]
jmp 0x5e0602
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
xor ebp, ebp
jmp 0x5e0632
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.005e06b0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov word [esp + 0x34], 0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x1c
ret
inc ebp
cmp edx, ebp
jle 0x5e063e
movzx esi, word [ebx + ebp*2]
xor edi, edi
jmp 0x5e067d
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x47
lea ecx, [0x751817]
mov dword [eax], ecx
mov word [esp + 0x34], 0
lea ecx, [0x7b0bb8]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x1c
ret
inc edi
mov ebx, dword [esp + 0x18]
cmp edi, eax
jge 0x5e0631
lea ebx, [ecx + edi*2]
cmp word [ebx], si
jne 0x5e0678
mov word [esp + 0x34], si
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
add esp, 0x1c
ret
call fcn.00467a60
jmp fcn.005e0590
Function at 0x5e52a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e5382
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x5e52f1
mov edx, dword [esp + 0x18]
movzx ebx, byte [edx + ecx - 1]
movzx ebp, bl
mov esi, ebp
sub ebp, ecx
cmp ecx, 0x100
jge 0x5e52db
mov eax, ecx
jmp 0x5e52e2
mov eax, ecx
mov ecx, 0x100
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
sar ebp, 0x1f
xor edi, edi
jmp 0x5e5334
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
add esp, 0x14
ret
xchg esi, ebx
not ebx
xchg esi, ebx
sar esi, 0x1f
movzx eax, byte [eax + edx - 1]
mov ecx, esi
and esi, ebx
and eax, ecx
xor esi, eax
xchg esi, ebx
not ebx
xchg esi, ebx
inc edi
movzx eax, byte [esp + 0xb]
and eax, esi
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jle 0x5e534f
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
sub eax, edi
lea ecx, [eax - 1]
sub esi, edi
mov ebp, dword [esp + 0x1c]
cmp ebp, ecx
ja 0x5e5302
jmp 0x5e5378
mov eax, ebp
shl ebp, 4
and eax, ebp
mov ecx, eax
shl eax, 2
and eax, ecx
mov ecx, eax
shl eax, 1
and eax, ecx
sar al, 7
and ebx, eax
movzx ecx, bl
inc ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], al
add esp, 0x14
ret
mov eax, ecx
mov ecx, ebp
call fcn.00468ed0
nop
call fcn.00467a60
jmp fcn.005e52a0
Function at 0x5ee210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ee37f
sub esp, 0x64
lea edi, [esp + 0x6c]
xor eax, eax
call fcn.004690e9
lea edi, [esp + 8]
call fcn.004690e9
mov ecx, dword [esp + 0x68]
test byte [ecx], al
lea edx, [ecx + 0x14]
mov dword [esp], edx
call fcn.0046d740
mov ecx, dword [esp + 4]
test ecx, ecx
setne cl
mov byte [esp + 0xa], cl
mov ecx, dword [esp + 0x68]
movzx edx, word [ecx + 0x28]
mov word [esp + 8], dx
mov edx, dword [ecx + 0xc4]
mov ebx, dword [ecx + 0xc8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx + 0x35]
mov byte [esp + 0xb], dl
mov byte [esp + 0x18], 1
mov edx, dword [ecx + 0x74]
mov ebx, dword [ecx + 0x78]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
movzx edx, word [ecx + 0x36]
mov word [esp + 0xc], dx
mov edx, dword [ecx + 0x50]
mov ebx, dword [ecx + 0x54]
mov ebp, dword [ecx + 0x58]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov edx, dword [ecx + 0x68]
mov ebx, dword [ecx + 0x6c]
mov ebp, dword [ecx + 0x70]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
mov edx, dword [ecx + 0x44]
mov ebx, dword [ecx + 0x48]
mov ebp, dword [ecx + 0x4c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebp
mov edx, dword [ecx + 0x38]
mov ebx, dword [ecx + 0x3c]
mov ebp, dword [ecx + 0x40]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebp
movzx edx, byte [ecx + 0x35]
test dl, dl
je 0x5ee302
movzx eax, byte [ecx + 0x34]
test al, al
je 0x5ee34b
cmp word [ecx + 0x28], 0x304
je 0x5ee34b
movzx eax, byte [ecx + 0x9c]
test al, al
je 0x5ee331
lea eax, [ecx + 0xa9]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
jmp 0x5ee34b
lea eax, [ecx + 0xb5]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0xa8]
test eax, eax
je 0x5ee364
lea eax, [0x758a54]
mov dword [esp + 0x60], eax
jmp 0x5ee36e
mov eax, dword [ecx + 0x80]
mov dword [esp + 0x60], eax
lea edi, [esp + 0x6c]
lea esi, [esp + 8]
call fcn.0046952a
add esp, 0x64
ret
call fcn.00467a60
jmp fcn.005ee210
Function at 0x5f0fa0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f10c6
sub esp, 0x28
mov eax, dword [esp + 0x30]
movzx ecx, word [eax + 0x54]
movzx eax, word [eax + 0xc]
test cx, cx
jne 0x5f0fca
mov ecx, eax
mov word [esp + 0x1c], cx
mov word [esp + 0x1e], 0
mov word [esp + 0x1e], cx
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0x2c]
mov dword [esp], edx
mov byte [esp + 4], 1
lea edx, [esp + 0x1e]
mov dword [esp + 8], edx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.005e3680
movzx eax, byte [esp + 0x16]
test al, al
je 0x5f1043
movzx eax, word [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov word [ecx + 0x28], ax
mov byte [ecx + 0x2a], 1
mov word [ecx + 0xdc], ax
mov word [ecx + 0x138], ax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
add esp, 0x28
ret
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov byte [esp + 4], 0x46
call fcn.005e9f50
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
movzx eax, word [esp + 0x1c]
mov word [esp], ax
call fcn.00409bc0
mov eax, dword [esp + 4]
lea ecx, [0x6f4960]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
lea eax, [0x74e949]
mov dword [esp], eax
mov dword [esp + 4], 0x34
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c1f50
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x28
ret
call fcn.00467a60
jmp fcn.005f0fa0
Function at 0x5f1e10
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f1ef9
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
movzx edx, word [edx + 0x28]
mov ebx, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x2c]
xor ebp, ebp
jmp 0x5f1e40
inc ebp
cmp ebp, ecx
jge 0x5f1e61
movzx esi, word [ebx + ebp*2]
cmp si, dx
jne 0x5f1e3f
nop
mov ecx, dword [0x967b70]
mov edx, dword [0x967b74]
xor ebx, ebx
jmp 0x5f1ee1
xor ecx, ecx
mov edx, dword [0x995310]
test edx, edx
je 0x5f1e7a
call fcn.00468e70
mov dword [edi], ecx
mov edx, dword [eax + 0x14]
mov dword [edi + 4], edx
mov dword [eax + 0x14], ecx
test ecx, ecx
je 0x5f1e9e
mov eax, dword [eax]
movzx ecx, word [ecx]
mov word [eax + 0x36], cx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov byte [esp + 4], 0x28
call fcn.005e9f50
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2e
lea ecx, [0x74ccc5]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
inc ebx
cmp ebx, edx
jge 0x5f1ef0
mov ebp, dword [ecx + ebx*4]
cmp word [ebp], si
jne 0x5f1ee0
jmp 0x5f1ef2
xor ebp, ebp
mov ecx, ebp
jmp 0x5f1e63
call fcn.00467a60
jmp fcn.005f1e10
Function at 0x5f3e10
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f3fc8
sub esp, 0x38
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0xc]
movzx ecx, byte [ecx + 0x2c]
test cl, cl
je 0x5f3fb4
mov ecx, dword [eax + 0x10]
movzx ecx, byte [ecx + 0x64]
mov edx, dword [eax]
test cl, cl
je 0x5f3f74
mov dword [esp + 0x20], edx
mov dword [esp], edx
lea ecx, [0x7b1010]
mov dword [esp + 4], ecx
lea ecx, [eax + 0x18]
mov dword [esp + 8], ecx
call fcn.005eb1b0
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x5f3f60
mov eax, dword [esp + 0xc]
lea ecx, [0x705ba0]
cmp eax, ecx
jne 0x5f3ec7
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
mov ebx, dword [esp + 0x3c]
mov dword [ebx + 0x60], ecx
mov dword [ebx + 0x64], edx
mov ecx, dword [0x995310]
test ecx, ecx
je 0x5f3eb0
call fcn.00468e70
mov dword [edi], eax
mov ecx, dword [ebx + 0x5c]
mov dword [edi + 4], ecx
mov dword [ebx + 0x5c], eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
add esp, 0x38
ret
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov byte [esp + 4], 0xa
call fcn.005e9f50
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
lea eax, [0x705ba0]
mov dword [esp + 0x30], eax
lea eax, [0x751a0c]
mov dword [esp], eax
mov dword [esp + 4], 0x49
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004c1f50
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x38
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x38
ret
mov dword [esp], edx
mov byte [esp + 4], 0x2f
call fcn.005e9f50
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2b
lea ecx, [0x74bb05]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
add esp, 0x38
ret
call fcn.00467a60
jmp fcn.005f3e10