joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a8b20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a8d32
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
test rdi, rdi
je 0x5a8cbb
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x88], rax
call fcn.005a8440
test dil, dil
je 0x5a8c63
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x98]
movzx edx, byte [rcx]
mov byte [rsp + 0x2f], dl
cmp dl, 0x2e
jne 0x5a8bb4
mov rdi, qword [rsp + 0xa0]
dec rdi
mov rsi, rdi
neg rsi
sar rsi, 0x3f
and esi, 1
add rcx, rsi
jmp 0x5a8bbc
mov rdi, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x60], rcx
mov rax, rcx
mov rbx, rdi
call fcn.005a8440
test dil, dil
je 0x5a8c11
mov rdx, qword [rsp + 0x38]
nop dword [rax + rax]
cmp rbx, rdx
jg 0x5a8c05
movzx esi, byte [rsp + 0x2f]
cmp sil, 0x2e
jne 0x5a8bf5
cmp rbx, rdx
je 0x5a8c05
mov qword [rsp + 0x30], rbx
xor ecx, ecx
nop dword [rax]
jmp 0x5a8ce0
xor eax, eax
xor ebx, ebx
xor ecx, ecx
add rsp, 0x78
pop rbp
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
call fcn.0040a940
lea rcx, [0x0066d140]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006d38e5]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004bfac0
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x78
pop rbp
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
call fcn.0040a940
lea rcx, [0x0066d140]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006d38e5]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004bfac0
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x78
pop rbp
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
add rsp, 0x78
pop rbp
ret
mov rax, qword [rsp + 0x58]
add rax, 0x10
mov rcx, qword [rsp + 0x40]
inc rcx
mov rbx, qword [rsp + 0x30]
cmp rbx, rcx
jle 0x5a8d23
mov qword [rsp + 0x40], rcx
shl rcx, 4
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsi + rcx]
mov rdi, qword [rsi + rcx + 8]
mov qword [rsp + 0x58], rax
mov r9, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, r8
mov rax, r9
call fcn.00476f20
test al, al
jne 0x5a8cca
xor eax, eax
xor ebx, ebx
xor ecx, ecx
add rsp, 0x78
pop rbp
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.005a8b20
Function at 0x5ad2e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ad371
push rbp
mov rbp, rsp
sub rsp, 0x48
cmp rax, 3
je 0x5ad2fe
cmp rax, 9
jne 0x5ad30c
mov ecx, 0x2f
lea rdx, [0x006d4822]
jmp 0x5ad310
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
movups xmmword [rsp + 0x38], xmm15
call fcn.0040a8c0
lea rcx, [0x0067e980]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x006d5b25]
mov ebx, 0x34
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004c2a60
mov rcx, rbx
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rbx, rax
xor eax, eax
call fcn.0044abe0
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.005ad2e0

Function at 0x5ad3c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ad497
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [rbx + 0xb0], 3
jne 0x5ad3e5
cmp byte [rbx + 0x360], 0
je 0x5ad3f7
cmp byte [rbx + 0x360], 0
je 0x5ad40b
cmp byte [rbx + 0x361], 0
jne 0x5ad40b
lea rax, [0x00742540]
lea rbx, [0x0092d4c0]
add rsp, 0x50
pop rbp
ret
mov rdx, qword [rbx + 0x2e0]
test rdx, rdx
je 0x5ad431
bt edx, 5
jb 0x5ad431
lea rax, [0x00742540]
lea rbx, [0x0092d4c0]
add rsp, 0x50
pop rbp
ret
cmp qword [rbx + 0x98], 0
jne 0x5ad44f
mov rax, qword [0x0089a6d0]
mov rbx, qword [0x0089a6d8]
add rsp, 0x50
pop rbp
ret
mov rdx, qword [rax + 0x90]
mov r12, qword [rax + 0x18]
mov rcx, qword [rax + 0x20]
mov rdi, qword [rax + 0x28]
mov rsi, qword [rax + 0x78]
mov r8, qword [rax + 0x80]
mov r9, qword [rax + 0x88]
mov r10, qword [rbx + 0xa0]
mov r11, qword [rbx + 0xa8]
mov byte [rsp], 0
mov rax, rdx
mov rbx, r12
call fcn.005ad5a0
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005ad3c0
Function at 0x5adb60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5adc04
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
xor ecx, ecx
nop
jmp 0x5adb85
mov rcx, rsi
cmp rbx, rcx
jle 0x5adbfa
movzx edx, byte [rax + rcx]
cmp edx, 0x80
jge 0x5adb9c
lea rsi, [rcx + 1]
jmp 0x5adbb4
nop dword [rax]
call fcn.00456f00
mov edx, eax
mov rsi, rbx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
cmp edx, 0x7f
jle 0x5adb82
movups xmmword [rsp + 0x28], xmm15
nop
call fcn.0040a940
lea rcx, [0x0066d140]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006d2e12]
mov ebx, 0x2a
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004bfac0
add rsp, 0x38
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax]
jmp fcn.005adb60
Function at 0x5b21c0
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x5b2287
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x5b21ec
test r15, r15
je 0x5b22ca
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x5b229c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x5b21fb
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x5b2d00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b2da6
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x48], rbx
nop
cmp byte [rax + 0x50], 0
jne 0x5b2d8f
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rcx
call fcn.005b1d60
mov rcx, qword [rsp + 0x50]
and ecx, 0xf
test rcx, rcx
je 0x5b2d67
movups xmmword [rsp + 0x20], xmm15
add rcx, 0xfffffffffffffff0
neg rcx
cmp rcx, 0x10
ja 0x5b2d85
mov rax, qword [rsp + 0x40]
cmp byte [rax + 0x50], 0
jne 0x5b2d6d
lea rbx, [rsp + 0x20]
mov edi, 0x10
call fcn.005b1d60
add rsp, 0x30
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00741040]
nop dword [rax + rax]
call fcn.004337c0
mov edx, 0x10
call fcn.00460220
lea rax, [0x0066d140]
lea rbx, [0x00741040]
nop dword [rax]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005b2d00

Function at 0x5b2de0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b2e30
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x20], 0
nop
mov qword [rsp + 0x20], rbx
nop
cmp byte [rax + 0x50], 0
jne 0x5b2e1c
lea rbx, [rsp + 0x20]
mov ecx, 8
mov rdi, rcx
call fcn.005b1d60
add rsp, 0x28
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00741040]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005b2de0
Function at 0x5b3740
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5b37e7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5b388a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5b37e7
cmp r9, 0
je 0x5b3943
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5b38a0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5bf140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5bf246
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
nop dword [rax]
test rax, rax
je 0x5bf208
mov edx, dword [rax + 0x10]
cmp edx, 0x3c66ff
jne 0x5bf1a0
lea rdx, [0x00683400]
nop dword [rax + rax]
cmp rax, rdx
jne 0x5bf208
mov eax, 0xffffffe1
mov ebx, 8
xor ecx, ecx
xor edi, edi
add rsp, 0x38
pop rbp
ret
cmp edx, 0xcef3083
jne 0x5bf1e0
lea rdx, [0x0067ac00]
cmp rax, rdx
jne 0x5bf208
lea rax, [0x006d67ea]
mov ebx, 0x39
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.004bfac0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
cmp edx, 0x21565112
jne 0x5bf208
lea rdx, [0x006a62a0]
cmp rax, rdx
jne 0x5bf208
mov eax, 0xffffffe3
mov ebx, 3
xor ecx, ecx
xor edi, edi
add rsp, 0x38
pop rbp
ret
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
lea rax, [0x006ce4c2]
mov ebx, 0x1f
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004bfac0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.005bf140
Function at 0x5c1fa0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5c21c1
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
movzx edx, word [rax + 0x30]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
mov rsi, qword [rax + 0x28]
mov eax, edx
nop dword [rax]
call fcn.005bf820
test rbx, rbx
jne 0x5c201e
mov rdx, qword [rsp + 0x98]
cmp qword [rdx + 8], 0
je 0x5c2011
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
mov qword [rsp + 0x40], r8
xor eax, eax
jmp 0x5c2034
xor eax, eax
xor ebx, ebx
add rsp, 0x88
pop rbp
ret
mov rax, rbx
mov rbx, rcx
add rsp, 0x88
pop rbp
ret
add rdi, 0x18
inc rax
cmp rax, r8
jge 0x5c211a
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x60], rdi
test rax, rax
jne 0x5c2055
mov r9, qword [rsi + 0x70]
test r9, r9
jne 0x5c208c
mov rax, qword [rdi]
mov rbx, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
call fcn.005a5b00
test rbx, rbx
jne 0x5c209d
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x40]
mov r9, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], r9
mov r10, qword [rdx]
mov r11, qword [rdx + 8]
jmp 0x5c2153
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x50], rcx
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
mov rax, qword [rsp + 0x28]
call fcn.0040a8c0
lea rcx, [0x0066d380]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x5c20de
mov rbx, qword [rcx + 8]
jmp 0x5c20e1
mov rbx, rcx
mov qword [rsp + 0x78], rbx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x80], rdx
lea rax, [0x006d499e]
mov ebx, 0x30
lea rcx, [rsp + 0x68]
mov edi, 2
mov rsi, rdi
call fcn.004bfac0
add rsp, 0x88
pop rbp
ret
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x27
lea rcx, [0x006d1a73]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x88
pop rbp
ret
add r10, 0x18
dec r11
test r11, r11
jle 0x5c202d
mov rcx, qword [r9 + 0x68]
cmp qword [r10 + 8], rcx
jne 0x5c214c
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x58], r10
mov rbx, qword [r10]
mov rax, qword [r9 + 0x60]
call fcn.004035a0
nop dword [rax]
test al, al
jne 0x5c21b4
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x38]
jmp 0x5c214c
xor eax, eax
xor ebx, ebx
add rsp, 0x88
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005c1fa0
Function at 0x5c2500
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c26dd
push rbp
mov rbp, rsp
sub rsp, 0x38
cmp ax, 0x201
je 0x5c26a1
nop dword [rax]
cmp ax, 0x203
je 0x5c268f
cmp ax, 0x401
je 0x5c267d
cmp ax, 0x403
je 0x5c266b
nop
cmp ax, 0x501
je 0x5c2659
cmp ax, 0x503
je 0x5c2647
cmp ax, 0x601
je 0x5c2635
nop
cmp ax, 0x603
je 0x5c2623
lea esi, [rax - 0x804]
cmp si, 3
ja 0x5c25ea
movzx esi, si
nop dword [rax]
cmp rsi, 5
jae 0x5c26cf
lea edi, [rax - 0x803]
movzx eax, di
lea rdi, [0x008711ec]
movzx esi, byte [rsi + rdi]
nop
cmp rax, 5
jae 0x5c26c5
movzx ecx, byte [rax + rdi]
cmp rcx, 0x2e
ja 0x5c26bb
nop dword [rax + rax]
cmp rsi, rcx
ja 0x5c26b3
sub rcx, rsi
mov rbx, rcx
neg rcx
sar rcx, 0x3f
and rsi, rcx
lea rcx, [0x006d3f3b]
lea rax, [rcx + rsi]
add rsp, 0x38
pop rbp
ret
movzx eax, ax
mov ebx, 0xa
call fcn.00486fa0
mov ecx, 0x10
mov rdi, rax
mov rsi, rbx
lea r8, [0x0073e480]
mov r9d, 1
xor eax, eax
lea rbx, [0x006c775d]
call fcn.0044ac80
add rsp, 0x38
pop rbp
ret
lea rax, [0x006c9fd6]
mov ebx, 0x16
add rsp, 0x38
pop rbp
ret
lea rax, [0x006c71c6]
mov ebx, 0xf
add rsp, 0x38
pop rbp
ret
lea rax, [0x006c9fc0]
mov ebx, 0x16
add rsp, 0x38
pop rbp
ret
lea rax, [0x006c71b7]
mov ebx, 0xf
add rsp, 0x38
pop rbp
ret
lea rax, [0x006c9faa]
mov ebx, 0x16
add rsp, 0x38
pop rbp
ret
lea rax, [0x006c71a8]
mov ebx, 0xf
add rsp, 0x38
pop rbp
ret
lea rax, [0x006c683b]
mov ebx, 0xd
add rsp, 0x38
pop rbp
ret
lea rax, [0x006c682e]
mov ebx, 0xd
add rsp, 0x38
pop rbp
ret
mov rax, rsi
call fcn.004602a0
mov edx, 0x2e
call fcn.00460220
mov ecx, 5
call fcn.004601e0
mov rax, rsi
mov ecx, 5
call fcn.004601e0
nop
mov word [rsp + 8], ax
call fcn.0045df00
movzx eax, word [rsp + 8]
jmp fcn.005c2500
Function at 0x5ca8c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cab10
push rbp
mov rbp, rsp
sub rsp, 0x58
cmp word [rax + 0x48], 0x304
jne 0x5caa0f
mov qword [rsp + 0x68], rax
xor ebx, ebx
xor ecx, ecx
call fcn.005c91e0
test rcx, rcx
jne 0x5caa03
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx + 0x350]
inc rdx
mov qword [rcx + 0x350], rdx
cmp rdx, 0x10
jle 0x5ca95f
mov rax, rcx
mov ebx, 0xa
call fcn.005c7da0
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rsp + 0x40], rax
mov qword [rax + 8], 0x23
lea rcx, [0x006d0098]
mov qword [rax], rcx
nop
mov rbx, qword [0x00741748]
mov rcx, qword [0x0089c0b0]
mov rdx, qword [rcx]
mov esi, dword [0x00741750]
jmp 0x5caa1a
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
test rax, rax
je 0x5ca9b5
mov edx, dword [rax + 0x10]
cmp edx, 0x888ea414
jne 0x5ca993
lea rdx, [0x00681600]
cmp rax, rdx
jne 0x5ca9b5
mov rax, rcx
call fcn.005d77c0
add rsp, 0x58
pop rbp
ret
cmp edx, 0x9220fa55
jne 0x5ca9b5
lea rdx, [0x00681680]
cmp rax, rdx
jne 0x5ca9b5
mov rax, rcx
call fcn.005cab40
add rsp, 0x58
pop rbp
ret
mov rax, rcx
mov ebx, 0xa
nop dword [rax]
call fcn.005c7da0
movups xmmword [rsp + 0x48], xmm15
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x50], rcx
lea rax, [0x006d5c62]
mov ebx, 0x35
lea rcx, [rsp + 0x48]
mov edi, 1
mov rsi, rdi
call fcn.004bfac0
add rsp, 0x58
pop rbp
ret
mov rax, rcx
mov rbx, rdi
add rsp, 0x58
pop rbp
ret
call fcn.005ca4e0
add rsp, 0x58
pop rbp
ret
mov rdi, rsi
and rsi, rdx
shl rsi, 4
mov r8, qword [rsi + rcx + 8]
cmp r8, rbx
je 0x5caa4f
lea rsi, [rdi + 1]
test r8, r8
jne 0x5caa1a
lea rax, [0x0089c0b0]
nop
call fcn.0040aaa0
mov rcx, rax
mov rax, qword [rsp + 0x40]
jmp 0x5caa54
mov rcx, qword [rsi + rcx + 0x10]
test rcx, rcx
jne 0x5caa91
lea rcx, [0x00741740]
mov rdx, qword [rsp + 0x68]
mov qword [rdx + 0x180], rcx
cmp dword [0x0092d940], 0
je 0x5caa88
call fcn.0045fe40
mov qword [r11], rax
mov rcx, qword [rdx + 0x188]
mov qword [r11 + 8], rcx
mov qword [rdx + 0x188], rax
jmp 0x5caafc
mov qword [rsp + 0x38], rcx
lea rax, [0x006874a0]
nop dword [rax]
call fcn.0040d480
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
cmp dword [0x0092d940], 0
jne 0x5caac2
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
jmp 0x5caae3
call fcn.0045fe60
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov qword [r11 + 8], rax
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx + 0x188]
mov qword [r11 + 0x10], rsi
mov qword [rax + 8], rcx
lea rcx, [0x007421c0]
mov qword [rdx + 0x180], rcx
mov qword [rdx + 0x188], rax
mov rax, qword [rdx + 0x180]
mov rbx, qword [rdx + 0x188]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
nop
jmp fcn.005ca8c0
Function at 0x5cf100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cf1da
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
movzx edx, word [rbx + 0x18]
movzx r8d, word [rbx + 0xa0]
mov word [rsp + 0x2e], 0
test r8w, r8w
cmovne dx, r8w
mov word [rsp + 0x2c], dx
mov word [rsp + 0x2e], dx
mov r8, qword [rax + 0x50]
mov ebx, 1
lea rcx, [rsp + 0x2e]
mov edi, 1
mov rsi, rdi
mov rax, r8
call fcn.005c1ee0
test bl, bl
je 0x5cf184
mov rcx, qword [rsp + 0x50]
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 1
mov word [rcx + 0x190], ax
mov word [rcx + 0x228], ax
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
mov rax, qword [rsp + 0x50]
mov ebx, 0x46
call fcn.005c7da0
movups xmmword [rsp + 0x30], xmm15
movzx eax, word [rsp + 0x2c]
nop
call fcn.0040a7e0
lea rcx, [0x0066d240]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x006d59b9]
mov ebx, 0x34
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
call fcn.004bfac0
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005cf100

Function at 0x5cfde0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cff14
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax + 0x20]
mov rsi, qword [rax + 0x18]
mov rdi, qword [rdx + 0x50]
mov rdx, qword [rdx + 0x58]
movzx esi, word [rsi + 0x50]
xor ecx, ecx
jmp 0x5cfe0d
inc rcx
cmp rcx, rdx
jge 0x5cfe33
movzx r8d, word [rdi + rcx*2]
cmp r8w, si
jne 0x5cfe0a
nop
mov rdx, qword [0x0089b930]
mov rsi, qword [0x0089b938]
xor ecx, ecx
jmp 0x5cfef9
xor ecx, ecx
cmp dword [0x0092d940], 0
je 0x5cfe50
nop
call fcn.0045fe40
mov qword [r11], rcx
mov rdx, qword [rax + 0x28]
mov qword [r11 + 8], rdx
mov qword [rax + 0x28], rcx
test rcx, rcx
je 0x5cfeba
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x50]
cmp qword [rdx + 0xa8], 0
jne 0x5cfea2
mov qword [rsp + 0x28], rax
mov rbx, qword [0x008a65f0]
lea rax, [0x0067d0c0]
nop dword [rax]
call fcn.0040e360
cmp byte [rax], 0
jne 0x5cfe91
mov rax, qword [rsp + 0x28]
jmp 0x5cfea2
mov rax, qword [0x00899570]
call fcn.004f0f40
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov rdx, qword [rax + 0x28]
movzx edx, word [rdx]
mov word [rcx + 0x62], dx
xor eax, eax
xor ebx, ebx
add rsp, 0x18
pop rbp
ret
mov rax, qword [rax]
mov ebx, 0x28
call fcn.005c7da0
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x2e
lea rcx, [0x006d3f69]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x18
pop rbp
ret
inc rcx
cmp rcx, rsi
jge 0x5cff0a
mov rdi, qword [rdx + rcx*8]
cmp word [rdi], r8w
jne 0x5cfef6
jmp 0x5cff0c
xor edi, edi
mov rcx, rdi
jmp 0x5cfe35
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.005cfde0