joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bbe0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x48bcc5
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x00689e60]
mov qword [rsp], rax
call fcn.00410b80
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
lea rdi, [rax + 8]
lea rsi, [rsp + 0x28]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00455858
mov rbp, qword [rbp]
mov ecx, dword [rsp + 0x168]
cmp ecx, 0xd
je 0x48bca7
cmp ecx, 0xa
je 0x48bca7
cmp ecx, 0xff
jg 0x48bca7
xor edx, edx
jmp 0x48bc61
inc rdx
cmp rdx, 0x40
jge 0x48bc71
movzx ebx, byte [rax + rdx]
cmp ebx, ecx
je 0x48bc89
jmp 0x48bc5e
mov dword [rax + 0x140], ecx
mov qword [rsp + 0x170], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6670]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6660]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.0048bbe0

Function at 0x48d9a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0xe8]
cmp rax, qword [rcx + 0x10]
jbe 0x48db92
sub rsp, 0x168
mov qword [rsp + 0x160], rbp
lea rbp, [rsp + 0x160]
movzx eax, byte [0x00850a22]
cmp al, 1
jbe 0x48d9f4
mov rbp, qword [rsp + 0x160]
add rsp, 0x168
ret
jne 0x48d9fd
call fcn.00429df0
ud2
mov byte [0x00850a22], 1
call fcn.0048b9e0
call fcn.0045f790
call fcn.00474990
lea rax, [0x006babb7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x40
call fcn.0048bab0
mov eax, dword [0x00850df0]
mov rcx, qword [rsp + 0x10]
test eax, eax
jne 0x48db7e
mov qword [0x00833800], rcx
lea rax, [0x006babf7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x40
call fcn.0048bab0
mov eax, dword [0x00850df0]
mov rcx, qword [rsp + 0x10]
test eax, eax
jne 0x48db6a
mov qword [0x00833808], rcx
mov rax, qword [0x00833800]
mov rcx, qword [rax]
mov qword [rsp], rcx
lea rdi, [rsp + 8]
mov qword [rsp + 0x158], rdi
lea rsi, [rax + 8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00455858
mov rbp, qword [rbp]
mov dword [rsp + 0x148], 0xffffffff
call fcn.0048bbe0
mov eax, dword [0x00850df0]
mov rcx, qword [rsp + 0x150]
test eax, eax
jne 0x48db56
mov qword [0x008337f0], rcx
mov rax, qword [0x00833808]
mov rcx, qword [rax]
mov qword [rsp], rcx
lea rsi, [rax + 8]
mov rdi, qword [rsp + 0x158]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00455858
mov rbp, qword [rbp]
mov dword [rsp + 0x148], 0xffffffff
call fcn.0048bbe0
mov eax, dword [0x00850df0]
mov rcx, qword [rsp + 0x150]
test eax, eax
jne 0x48db45
mov qword [0x008337f8], rcx
mov byte [0x00850a22], 2
mov rbp, qword [rsp + 0x160]
add rsp, 0x168
ret
lea rdi, [0x008337f8]
mov rax, rcx
call fcn.004553b0
jmp 0x48db2e
lea rdi, [0x008337f0]
mov rax, rcx
call fcn.004553b0
jmp 0x48dad8
lea rdi, [0x00833808]
mov rax, rcx
call fcn.004553b0
jmp 0x48da79
lea rdi, [0x00833800]
mov rax, rcx
call fcn.004553b0
jmp 0x48da46
call fcn.00452950
jmp fcn.0048d9a0
Function at 0x4a3790
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a3800
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x4a37e2
add rax, 8
mov qword [rsp], rax
call fcn.004465c0
movzx eax, byte [rsp + 8]
mov byte [rsp + 0x28], al
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6fa0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.004a3790
Function at 0x4aee20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4aef8c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a33]
cmp al, 1
jbe 0x4aee5d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4aee66
call fcn.00429df0
ud2
mov byte [0x00850a33], 1
call fcn.0045de10
call fcn.00495270
call fcn.004a7ec0
call fcn.0045f790
call fcn.004a99c0
call fcn.004522b0
lea rax, [0x006b497b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x008344b0], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4aef78
mov qword [0x008344b8], rcx
lea rax, [0x006af006]
mov qword [rsp], rax
mov qword [rsp + 8], 0x12
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x008344a0], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4aef67
mov qword [0x008344a8], rcx
lea rax, [0x006b5608]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x008344c0], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4aef56
mov qword [0x008344c8], rcx
call fcn.004abcf0
mov byte [0x00850a33], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x008344c8]
mov rax, rcx
call fcn.004553b0
jmp 0x4aef40
lea rdi, [0x008344a8]
mov rax, rcx
call fcn.004553b0
jmp 0x4aef05
lea rdi, [0x008344b8]
mov rax, rcx
call fcn.004553b0
jmp 0x4aeeca
call fcn.00452950
jmp fcn.004aee20
Function at 0x4bf4a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4bf5b4
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a27]
cmp al, 1
jbe 0x4bf4dd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4bf4e6
call fcn.00429df0
ud2
mov byte [0x00850a27], 1
call fcn.00474990
call fcn.0045f790
call fcn.004b38f0
call fcn.004871b0
call fcn.0045de10
call fcn.00469ae0
lea rax, [0x006b5dab]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834480], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4bf5a3
mov qword [0x00834488], rcx
lea rax, [0x006b376b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834470], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4bf592
mov qword [0x00834478], rcx
mov byte [0x00850a27], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x00834478]
mov rax, rcx
call fcn.004553b0
jmp 0x4bf581
lea rdi, [0x00834488]
mov rax, rcx
call fcn.004553b0
jmp 0x4bf546
call fcn.00452950
jmp fcn.004bf4a0
Function at 0x4d7ce0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4d7e15
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x28]
test rcx, rcx
jne 0x4d7e02
movzx ecx, byte [rax + 8]
test cl, cl
jne 0x4d7def
mov rdx, qword [rax]
mov qword [rsp], rax
mov byte [rsp + 8], 0x20
mov rcx, qword [rdx]
call rcx
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rax + 8]
test cl, cl
jne 0x4d7ddc
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x4d7d64
mov qword [rsp + 0x30], 0xb
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0066f680]
mov qword [rsp], rax
call fcn.00410b80
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x1c
mov ecx, dword [0x00850df0]
test ecx, ecx
jne 0x4d7dc8
lea rcx, [0x006b316b]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x50]
mov qword [rax + 0x10], rdx
lea rdx, [0x006f7560]
mov qword [rcx + 0x28], rdx
mov edx, dword [0x00850df0]
lea rdi, [rcx + 0x30]
test edx, edx
jne 0x4d7dc1
mov qword [rcx + 0x30], rax
jmp 0x4d7d51
call fcn.004553b0
jmp 0x4d7d51
mov rdi, rax
lea rax, [0x006b316b]
call fcn.004553b0
mov rax, rdi
jmp 0x4d7d95
mov qword [rsp + 0x30], 0xa
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x30], 0xa
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x30], 0xb
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00452950
jmp fcn.004d7ce0
Function at 0x4daa90
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4dac84
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x1a8]
cmp rcx, 3
je 0x4dabb4
cmp rcx, 6
je 0x4daae6
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp], rax
call fcn.004dac90
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rsp + 8]
test rcx, rcx
jne 0x4daba0
cmp dl, 0x3a
jne 0x4dab25
mov rax, qword [rsp + 0x40]
inc qword [rax + 0x130]
mov qword [rax + 0x1a8], 7
jmp 0x4daad4
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x138]
add rcx, qword [rax + 0x130]
mov qword [rsp + 0x20], rcx
lea rax, [0x0066f680]
mov qword [rsp], rax
call fcn.00410b80
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x1f
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4dab92
lea rax, [0x006b4077]
mov qword [rdi], rax
mov rax, qword [rsp + 0x20]
mov qword [rdi + 0x10], rax
lea rax, [0x006f7560]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006b4077]
call fcn.004553b0
jmp 0x4dab6e
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp], rax
call fcn.004dac90
movzx eax, byte [rsp + 8]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x10]
test rdx, rdx
jne 0x4dac70
cmp al, 0x2c
jne 0x4dabf5
mov rax, qword [rsp + 0x40]
inc qword [rax + 0x130]
mov qword [rax + 0x1a8], 2
jmp 0x4daad4
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x138]
add rcx, qword [rax + 0x130]
mov qword [rsp + 0x28], rcx
lea rax, [0x0066f680]
mov qword [rsp], rax
call fcn.00410b80
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x22
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4dac62
lea rax, [0x006b517c]
mov qword [rdi], rax
mov rax, qword [rsp + 0x28]
mov qword [rdi + 0x10], rax
lea rax, [0x006f7560]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006b517c]
call fcn.004553b0
jmp 0x4dac3e
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00452950
jmp fcn.004daa90
Function at 0x4dfda0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4dfe54
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a0b]
cmp al, 1
jbe 0x4dfddd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4dfde6
call fcn.00429df0
ud2
mov byte [0x00850a0b], 1
call fcn.0045f790
call fcn.004522b0
lea rax, [0x006b5f3e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834220], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4dfe43
mov qword [0x00834228], rcx
mov byte [0x00850a0b], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x00834228]
mov rax, rcx
call fcn.004553b0
jmp 0x4dfe32
call fcn.00452950
jmp fcn.004dfda0

Function at 0x4e2600
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e26c3
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a09]
cmp al, 1
jbe 0x4e263d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4e2646
call fcn.00429df0
ud2
mov byte [0x00850a09], 1
call fcn.004dfda0
call fcn.00474990
lea rax, [0x006b5f3e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834210], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4e26b2
mov qword [0x00834218], rcx
call fcn.004dffa0
movzx eax, byte [rsp]
mov byte [0x00850a0a], al
mov byte [0x00850a09], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x00834218]
mov rax, rcx
call fcn.004553b0
jmp 0x4e2692
call fcn.00452950
jmp fcn.004e2600

Function at 0x4e5980
Capabilities:
Encrypt data using des

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e5abc
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
xor eax, eax
jmp 0x4e5a9c
mov rbx, qword [rsp + 0x28]
mov r8, rbx
shl rbx, 8
lea r9, [0x008520c0]
add rbx, r9
mov dword [rbx + rdx*4], eax
lea rdx, [rdi + 1]
mov rax, r8
mov rcx, rsi
cmp rdx, 0x10
jge 0x4e5a84
mov qword [rsp + 0x30], rdx
mov rbx, rax
shl rax, 6
lea rsi, [0x007fec60]
add rax, rsi
shl rcx, 4
add rax, rcx
movzx eax, byte [rax + rdx]
lea rcx, [rbx - 7]
neg rcx
shl rcx, 2
shl rax, cl
cmp rcx, 0x40
sbb r8, r8
and rax, r8
mov qword [rsp], rax
lea rax, [0x007f7ec0]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x20
mov qword [rsp + 0x18], 0x20
call fcn.004e5920
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rbx, rdx
and rdx, 2
shl rdx, 4
mov rsi, rbx
and rbx, 1
or rdx, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, rbx
shl rbx, 1
or edx, ebx
mov rbx, rax
shl rax, 1
shr rbx, 0x1f
or rax, rbx
movzx edx, dl
cmp rdx, 0x40
jb 0x4e59af
jmp 0x4e5ab5
inc rcx
cmp rcx, 4
jge 0x4e5a99
mov qword [rsp + 0x38], rcx
xor edx, edx
jmp 0x4e59d2
inc rax
cmp rax, 8
jge 0x4e5aab
mov qword [rsp + 0x28], rax
xor ecx, ecx
jmp 0x4e5a87
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00429b50
ud2
call fcn.00452950
jmp fcn.004e5980
Function at 0x4e7910
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e79a4
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x20]
cmp rcx, 0x14
jae 0x4e7986
mov rdx, qword [0x00834ce8]
mov rbx, qword [0x00834ce0]
cmp rcx, rdx
jae 0x4e797f
mov edx, dword [0x00850df0]
lea rdi, [rbx + rcx*8]
test edx, edx
jne 0x4e7973
mov rax, qword [rsp + 0x28]
mov qword [rbx + rcx*8], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rsp + 0x28]
call fcn.004553b0
jmp 0x4e7969
call fcn.00429b50
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6380]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.004e7910

Function at 0x4f14f0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4f15a9
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a24]
cmp al, 1
jbe 0x4f152d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x4f1536
call fcn.00429df0
ud2
mov byte [0x00850a24], 1
call fcn.00469820
call fcn.004bf4a0
call fcn.0045f790
lea rax, [0x006b55e5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834410], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4f1598
mov qword [0x00834418], rcx
mov byte [0x00850a24], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x00834418]
mov rax, rcx
call fcn.004553b0
jmp 0x4f1587
call fcn.00452950
jmp fcn.004f14f0
Function at 0x54bc30
Capabilities:
Parse credit card information

Disassembly:
movzx eax, byte [rsp + 8]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x54bc43
mov byte [rsp + 0x18], 0
ret
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x54bc3d
lea ecx, [rax - 0x30]
cmp cl, 9
jbe 0x54bc3d
mov rcx, qword [rsp + 0x10]
cmp rcx, 3
jne 0x54bdbb
cmp al, 0x2c
ja 0x54bd9a
lea edx, [rax - 0x21]
cmp dl, 1
ja 0x54bc78
mov byte [rsp + 0x18], 0
ret
cmp al, 0x24
je 0x54bc72
lea edx, [rax - 0x26]
cmp dl, 6
jbe 0x54bc72
cmp al, 0x2f
ja 0x54bd64
cmp al, 0x26
ja 0x54bd3d
cmp al, 0x24
jne 0x54bd33
cmp rcx, 2
jg 0x54bcea
cmp rcx, 1
je 0x54bcdf
cmp rcx, 2
jne 0x54bcd9
cmp al, 0x2f
jne 0x54bcbc
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x3b
jne 0x54bcc7
mov eax, 1
jmp 0x54bcb7
cmp al, 0x2c
jne 0x54bcd2
mov eax, 1
jmp 0x54bcb7
cmp al, 0x3f
sete al
jmp 0x54bcb7
mov byte [rsp + 0x18], 1
ret
cmp al, 0x3f
lea rax, [rsp + 0x18]
sete byte [rax]
ret
cmp rcx, 5
jne 0x54bd1b
cmp al, 0x40
jne 0x54bcfe
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x2f
jne 0x54bd09
mov eax, 1
jmp 0x54bcf9
cmp al, 0x3f
jne 0x54bd14
mov eax, 1
jmp 0x54bcf9
cmp al, 0x3a
sete al
jmp 0x54bcf9
cmp rcx, 6
je 0x54bd2d
cmp rcx, 7
jne 0x54bcd9
mov byte [rsp + 0x18], 0
ret
mov byte [rsp + 0x18], 1
ret
cmp al, 0x26
je 0x54bc9c
jmp 0x54bcd9
lea edx, [rax - 0x2b]
cmp dl, 1
jbe 0x54bc9c
lea edx, [rax - 0x2d]
cmp dl, 1
ja 0x54bd57
mov byte [rsp + 0x18], 0
ret
cmp al, 0x2f
je 0x54bc9c
jmp 0x54bcd9
cmp al, 0x3d
ja 0x54bd81
lea edx, [rax - 0x3a]
cmp dl, 1
jbe 0x54bc9c
cmp al, 0x3d
je 0x54bc9c
jmp 0x54bcd9
lea edx, [rax - 0x3f]
cmp dl, 1
jbe 0x54bc9c
cmp al, 0x5f
je 0x54bd51
cmp al, 0x7e
je 0x54bd51
jmp 0x54bcd9
lea edx, [rax - 0x3a]
cmp dl, 4
jbe 0x54bc72
cmp al, 0x5b
je 0x54bc72
cmp al, 0x5d
je 0x54bc72
jmp 0x54bc84
cmp rcx, 4
je 0x54bc62
jmp 0x54bc84
Function at 0x5513a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x551454
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a0d]
cmp al, 1
jbe 0x5513dd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x5513e6
call fcn.00429df0
ud2
mov byte [0x00850a0d], 1
call fcn.0045f790
call fcn.00505970
lea rax, [0x006b3a6b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834230], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x551443
mov qword [0x00834238], rcx
mov byte [0x00850a0d], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x00834238]
mov rax, rcx
call fcn.004553b0
jmp 0x551432
call fcn.00452950
jmp fcn.005513a0

Function at 0x561860
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x561a3f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a1d]
cmp al, 1
jbe 0x56189d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x5618a6
call fcn.00429df0
ud2
mov byte [0x00850a1d], 1
call fcn.004eff40
call fcn.004522b0
call fcn.004e2600
call fcn.004dfda0
call fcn.004e6700
call fcn.004f0710
call fcn.004f14f0
call fcn.0045f790
call fcn.004c7d30
call fcn.00507fd0
call fcn.00515060
call fcn.00505970
call fcn.0052a910
call fcn.0052d3a0
call fcn.004bf4a0
call fcn.0045de10
call fcn.00495270
call fcn.00520e50
call fcn.00469820
call fcn.005476a0
call fcn.005506b0
call fcn.004871b0
call fcn.004a7ec0
call fcn.004e79b0
call fcn.005513a0
call fcn.004e88f0
call fcn.004ec550
call fcn.00525410
call fcn.00474990
call fcn.00551a20
lea rax, [0x006b5950]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834320], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x561a2b
mov qword [0x00834328], rcx
lea rax, [0x006b92d6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x32
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834330], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x561a1a
mov qword [0x00834338], rcx
lea rax, [0x006b9e1f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834310], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x561a09
mov qword [0x00834318], rcx
mov byte [0x00850a1d], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x00834318]
mov rax, rcx
call fcn.004553b0
jmp 0x5619f8
lea rdi, [0x00834338]
mov rax, rcx
call fcn.004553b0
jmp 0x5619bd
lea rdi, [0x00834328]
mov rax, rcx
call fcn.004553b0
jmp 0x561982
call fcn.00452950
jmp fcn.00561860
Function at 0x564860
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x56491e
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a7e]
cmp al, 1
jbe 0x56489d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x5648a6
call fcn.00429df0
ud2
mov byte [0x00850a7e], 1
call fcn.004dfda0
call fcn.0048b9e0
call fcn.00562d60
lea rax, [0x006b852f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2f
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834c20], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x56490d
mov qword [0x00834c28], rcx
call fcn.005633f0
mov byte [0x00850a7e], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x00834c28]
mov rax, rcx
call fcn.004553b0
jmp 0x5648f7
call fcn.00452950
jmp fcn.00564860
Function at 0x5a1e90
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x180]
cmp rax, qword [rcx + 0x10]
jbe 0x5a20ef
sub rsp, 0x200
mov qword [rsp + 0x1f8], rbp
lea rbp, [rsp + 0x1f8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
lea rdi, [rsp + 0xa8]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00455579
mov rbp, qword [rbp]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x88], rax
call fcn.00442ff0
mov eax, dword [rsp]
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x210]
mov qword [rsp], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 8], rax
call fcn.005a1e20
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp], rax
mov rax, qword [rsp + 0x228]
mov qword [rsp + 8], rax
call fcn.005a1e20
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x58], xmm1
movups xmmword [rsp + 0x68], xmm1
lea rax, [0x00649960]
mov qword [rsp], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 8], rcx
call fcn.0040e0f0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.0040e0f0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
lea rax, [0x006b5694]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
lea rax, [rsp + 0x58]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 2
call fcn.004b7380
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x78]
mov qword [rsp], rdx
lea rbx, [0x006af134]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], 0x13
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.0059f2b0
lea rax, [rsp + 0x78]
mov qword [rsp], rax
lea rcx, [0x006acd16]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0xc
lea rcx, [0x006b1483]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0x18
call fcn.0059f2b0
mov rax, qword [rsp + 0x208]
mov qword [rsp], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 8], rax
call fcn.005a1770
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], rcx
mov qword [rsp + 0x240], rdx
mov qword [rsp + 0x248], rbx
mov rbp, qword [rsp + 0x1f8]
add rsp, 0x200
ret
call fcn.00452950
jmp fcn.005a1e90