joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e0160
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e0259
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x98], r10
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
test r9, r9
jne 0x5e01bd
mov rcx, qword [rax + 0x18]
mov rax, rcx
call fcn.004b49c0
mov r9, rax
mov r10, rbx
mov rdx, qword [r9 + 0x30]
mov rax, r10
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x18]
lea r8, [rsi - 1]
nop word [rax + rax]
cmp r8, 0x13
jae 0x5e0245
mov r12, qword [0x008bf6c8]
cmp r12, rsi
jbe 0x5e0238
mov r12, qword [0x008bf6c0]
movzx r12d, byte [r12 + rsi]
mov qword [rsp], r12
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9, rax
mov r10, rbx
mov r11, rcx
mov rax, rdx
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.005df640
add rsp, 0x50
pop rbp
ret
mov rax, rsi
mov rcx, r12
nop
call fcn.00466980
lea rax, [0x0065b7a0]
lea rbx, [0x007279b0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.005e0160

Function at 0x5e02c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e03b9
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x80], rsi
nop
test rbx, rbx
jne 0x5e036f
mov rdx, qword [rax + 0x18]
lea rdi, [rdx - 1]
cmp rdi, 0x13
jae 0x5e03a5
mov rcx, qword [0x008bf6c8]
cmp rcx, rdx
jbe 0x5e039a
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x90], r9
mov rsi, qword [0x008bf6c0]
movzx ecx, byte [rsi + rdx]
mov qword [rsp + 0x38], rcx
lea rax, [0x0065bae0]
mov rbx, rcx
call fcn.0044b7a0
mov rsi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
mov rdi, rcx
mov rbx, rax
mov rax, qword [rsp + 0x60]
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x005e5480]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x40]
call fcn.005b0de0
add rsp, 0x50
pop rbp
ret
mov rax, rdx
nop dword [rax]
call fcn.00466980
lea rax, [0x0065b7a0]
lea rbx, [0x007279b0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005e02c0
Function at 0x5e0420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e04a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x68], rbx
mov rdx, qword [rax + 0x18]
lea r12, [rdx - 1]
nop
cmp r12, 0x13
jae 0x5e048e
mov r12, qword [0x008bf6c8]
cmp r12, rdx
jbe 0x5e0483
mov r12, qword [0x008bf6c0]
movzx edx, byte [r12 + rdx]
mov qword [rsp], rdx
lea rsi, [0x006b245c]
mov r8d, 0xb
xor r9d, r9d
xor r10d, r10d
mov r11, r10
call fcn.005df640
add rsp, 0x50
pop rbp
ret
mov rax, rdx
mov rcx, r12
call fcn.00466980
lea rax, [0x0065b7a0]
lea rbx, [0x007279b0]
nop dword [rax]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005e0420

Function at 0x5e05e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e0726
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r8
mov rdx, qword [rax + 0x18]
lea r12, [rdx - 1]
cmp r12, 0x13
jae 0x5e070e
mov r12, qword [0x008bf6c8]
cmp r12, rdx
jbe 0x5e0703
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r8
mov r12, qword [0x008bf6c0]
movzx edx, byte [r12 + rdx]
mov qword [rsp], rdx
lea rsi, [0x006b15f1]
mov r8d, 8
xor r9d, r9d
xor r10d, r10d
mov r11, r10
call fcn.005df640
movups xmmword [rsp + 0x58], xmm15
lea rdx, [0x005e5480]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx + 0x18]
mov qword [rsp + 0x60], rdx
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
lea rax, [rsp + 0x58]
call fcn.005a2720
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rbx
mov rdx, qword [rsp + 0xa0]
mov rdx, qword [rdx + 0x30]
xor ecx, ecx
mov rdi, rcx
mov rax, qword [rsp + 0xa8]
xor ebx, ebx
call rdx
mov rdx, qword [rsp + 0x50]
mov r12, qword [rdx + 0x38]
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x68]
call r12
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0x30]
mov rax, qword [rsp + 0x68]
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
add rsp, 0x70
pop rbp
ret
mov rax, rdx
mov rcx, r12
call fcn.00466980
lea rax, [0x0065b7a0]
lea rbx, [0x007279b0]
nop dword [rax]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.005e05e0
Function at 0x5e0a20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e0b11
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
nop dword [rax]
cmp cx, 0x18
ja 0x5e0a84
cmp cx, 0x17
jne 0x5e0a65
nop
mov rdx, qword [0x008bd930]
mov ecx, 1
mov rsi, rdx
lea rdx, [0x0072aad0]
jmp 0x5e0ac8
cmp cx, 0x18
jne 0x5e0ac2
nop
mov rdx, qword [0x008bd938]
mov ecx, 1
mov rsi, rdx
lea rdx, [0x0072ab10]
jmp 0x5e0ac8
cmp cx, 0x19
jne 0x5e0aa3
nop
mov rdx, qword [0x008bd940]
mov ecx, 1
mov rsi, rdx
lea rdx, [0x0072ab50]
jmp 0x5e0ac8
cmp cx, 0x1d
jne 0x5e0ac2
nop
mov rdx, qword [0x008bd948]
mov ecx, 1
mov rsi, rdx
lea rdx, [0x0072aa90]
jmp 0x5e0ac8
xor ecx, ecx
xor edx, edx
xor esi, esi
test cl, cl
je 0x5e0ae1
mov rdx, qword [rdx + 0x18]
mov rcx, rbx
mov rbx, rax
mov rax, rsi
call rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x26
lea rcx, [0x006be0b2]
mov qword [rax], rcx
lea rbx, [0x00728640]
mov rcx, rax
xor eax, eax
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x18], cx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, word [rsp + 0x18]
jmp fcn.005e0a20
Function at 0x5eadc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5eaeed
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
call fcn.005ebb00
nop dword [rax]
test rbx, rbx
je 0x5eaebf
test rdi, rdi
je 0x5eaeb5
cmp byte [rcx], 0x2f
jne 0x5eae87
lea rbx, [rdi - 1]
mov rdx, rbx
neg rdx
sar rdx, 0x3f
and edx, 1
lea rax, [rcx + rdx]
call fcn.005ebb00
test rbx, rbx
je 0x5eae57
test rdi, rdi
je 0x5eae4d
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x2c
lea rcx, [0x006c03c6]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x10
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
lea rax, [0x00673e00]
nop
call fcn.0040d680
mov qword [rax + 8], 0x20
lea rcx, [0x006bb9f0]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x10
pop rbp
ret
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x26
lea rcx, [0x006be2a0]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x10
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x13
lea rcx, [0x006b57cd]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005eadc0
Function at 0x5f8740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f88db
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5f8761
inc rcx
cmp rbx, rcx
jle 0x5f88d1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5f875e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.00577460
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x008bd958]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005f4a80
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x5f88c5
test rdx, rdx
je 0x5f88ba
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403d80
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5f8889
xor eax, eax
lea rbx, [0x006b05a2]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006b062d]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044f780
jmp 0x5f88b0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00725918]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044f6c0
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005f8740
Function at 0x5fae60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5fafd7
push rbp
mov rbp, rsp
sub rsp, 0x48
cmp byte [rax + 0x98], 0
jne 0x5fae86
cmp dword [rax + 0x30], 0
nop
ja 0x5faf81
mov qword [rsp + 0x58], rax
mov rbx, qword [rax + 0x58]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rax + 0x68]
mov eax, 5
nop dword [rax]
call fcn.005fb000
test rsi, rsi
jne 0x5faf75
mov rdx, qword [rsp + 0x58]
mov esi, dword [rdx + 0x38]
cmp rax, rsi
ja 0x5faf23
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
nop
mov dword [rdx + 0x34], eax
mov rax, rdx
call fcn.005fa120
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x60], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rdx + 0x68], rcx
cmp dword [0x00921500], 0
jne 0x5faf00
mov rcx, qword [rsp + 0x30]
jmp 0x5faf15
call fcn.004665c0
mov rcx, qword [rsp + 0x30]
mov qword [r11], rcx
mov rsi, qword [rdx + 0x58]
mov qword [r11 + 8], rsi
mov qword [rdx + 0x58], rcx
xor eax, eax
xor ebx, ebx
add rsp, 0x48
pop rbp
ret
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x23
lea rcx, [0x006bce60]
mov qword [rax], rcx
lea rcx, [0x00728640]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x0067b360]
lea rbx, [rsp + 0x38]
nop
call fcn.0040abe0
mov rbx, rax
lea rax, [0x00728fe0]
add rsp, 0x48
pop rbp
ret
mov rax, rsi
mov rbx, r8
add rsp, 0x48
pop rbp
ret
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x47
lea rcx, [0x006c495b]
mov qword [rax], rcx
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00728640]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x0067b360]
lea rbx, [rsp + 0x38]
call fcn.0040abe0
mov rbx, rax
lea rax, [0x00728fe0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.005fae60
Function at 0x6045e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x604854
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xd8], rbx
xor edx, edx
jmp 0x604656
mov rdx, qword [rsp + 0x50]
inc rdx
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xe8]
cmp rsi, rdx
jle 0x604789
mov qword [rsp + 0x50], rdx
mov rbx, qword [rcx]
movzx eax, byte [rdi + rdx]
mov rdx, rcx
call rbx
test al, al
jne 0x604626
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xe8]
movzx ecx, byte [rdx + rcx]
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
lea rsi, [0x0065bae0]
mov qword [rsp + 0x70], rsi
lea rdi, [0x0089c320]
lea rcx, [rdi + rcx*8]
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xd8]
call fcn.0040ae40
lea rcx, [0x0065b7a0]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
lea rcx, [0x006048a0]
mov qword [rsp + 0x90], rcx
lea rcx, [0x006c2e3a]
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], 0x37
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], 2
mov qword [rsp + 0xb8], 2
mov rax, qword [0x008cc108]
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0x90]
nop dword [rax]
call fcn.005e6f20
lea rax, [0x0065bae0]
xor ebx, ebx
mov rcx, qword [rsp + 0xf0]
call fcn.0044b7a0
xor ecx, ecx
mov rdx, qword [rsp + 0xf0]
xor ebx, ebx
jmp 0x6047a6
mov rax, rdi
mov rbx, rsi
add rsp, 0xc0
pop rbp
ret
mov rsi, qword [rsp + 0x48]
inc rsi
mov rdx, rcx
mov rcx, rsi
mov rsi, qword [rsp + 0xf0]
cmp rsi, rcx
jle 0x60483e
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rcx
mov rbx, qword [rsp + 0xe8]
movzx eax, byte [rbx + rcx]
mov byte [rsp + 0x47], al
mov rdx, qword [rsp + 0xe0]
mov rsi, qword [rdx]
call rsi
test al, al
je 0x60482a
mov rbx, qword [rsp + 0x58]
inc rbx
mov rcx, qword [rsp + 0x60]
cmp rcx, rbx
jb 0x604805
mov rax, qword [rsp + 0x68]
jmp 0x60481b
mov rax, qword [rsp + 0x68]
mov edi, 1
lea rsi, [0x0065bae0]
call fcn.0044b880
movzx esi, byte [rsp + 0x47]
mov byte [rbx + rax - 1], sil
jmp 0x604798
mov rcx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
jmp 0x604798
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044f9a0
add rsp, 0xc0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.006045e0
Function at 0x606ba0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x606cd7
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0x2c], ebx
test rcx, rcx
je 0x606c70
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
call fcn.0040ad60
lea rcx, [0x0065baa0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x2c]
call fcn.0040ad60
lea rcx, [0x0066c440]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x606c34
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x80], rcx
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x88], rdx
lea rax, [0x006bc665]
mov ebx, 0x22
lea rcx, [rsp + 0x60]
mov edi, 3
mov rsi, rdi
call fcn.004e0560
add rsp, 0x90
pop rbp
ret
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
nop dword [rax]
call fcn.0040ad60
lea rcx, [0x0065baa0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x2c]
call fcn.0040ad60
lea rcx, [0x0066c440]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x006ba9b7]
mov ebx, 0x1e
lea rcx, [rsp + 0x40]
mov edi, 2
mov rsi, rdi
call fcn.004e0560
add rsp, 0x90
pop rbp
ret
mov dword [rsp + 8], eax
mov dword [rsp + 0xc], ebx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
call fcn.004646a0
mov eax, dword [rsp + 8]
mov ebx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
jmp fcn.00606ba0
Function at 0x608e20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x608f46
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [rax], 0
je 0x608f2d
xor ecx, ecx
jmp 0x608e45
inc rcx
mov rax, rdi
mov rsi, qword [rax + 0x18]
mov rdx, rax
movabs rax, 0xaaaaaaaaaaaaaaab
mov rdi, rdx
imul rsi
add rsi, rdx
sar rsi, 2
cmp rcx, rsi
jge 0x608ef8
mov rdx, qword [rdi + 0x20]
lea rax, [rcx + rcx*2]
lea rsi, [rax + rax]
lea rsi, [rsi + 2]
nop dword [rax]
cmp rdx, rsi
jb 0x608f25
mov r8, rax
shl r8, 1
cmp rsi, r8
jb 0x608f15
mov r9, qword [rdi + 0x10]
mov r10, rdx
sub r10, r8
mov r11, r10
neg r10
sar r10, 0x3f
and r8, r10
lea r10, [rax + rax]
lea r10, [r10 + 6]
movzx r8d, word [r9 + r8]
nop dword [rax]
cmp rdx, r10
jb 0x608f0d
cmp r10, rsi
jb 0x608f02
lea r10, [r11 - 2]
neg r10
sar r10, 0x3f
and rsi, r10
rol r8w, 8
mov eax, dword [r9 + rsi]
cmp bx, r8w
jne 0x608e3f
bswap eax
mov ebx, 1
add rsp, 0x10
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
mov rax, rsi
mov rcx, r10
call fcn.00466a20
mov rcx, r10
call fcn.004669e0
mov rax, r8
mov rcx, rsi
nop dword [rax + rax]
call fcn.00466a20
mov rcx, rsi
call fcn.004669e0
lea rax, [0x0065b7a0]
lea rbx, [0x00727a60]
nop dword [rax + rax]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.004646a0
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
nop
jmp fcn.00608e20

Function at 0x608f80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6090c6
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp byte [rax], 0
je 0x6090b1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
xor ecx, ecx
jmp 0x608fbb
mov rcx, qword [rsp + 0x10]
inc rcx
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rax + 0x18]
mov rdx, rax
movabs rax, 0xaaaaaaaaaaaaaaab
mov rdi, rdx
imul rsi
add rsi, rdx
sar rsi, 2
nop dword [rax]
cmp rcx, rsi
jge 0x609081
mov rdx, qword [rdi + 0x20]
lea rax, [rcx + rcx*2]
lea rsi, [rax + rax]
lea rsi, [rsi + 2]
nop dword [rax]
cmp rdx, rsi
jb 0x6090a9
mov r8, rax
shl r8, 1
cmp rsi, r8
jb 0x60909e
mov r9, qword [rdi + 0x10]
mov r10, rdx
sub r10, r8
mov r11, r10
neg r10
sar r10, 0x3f
and r8, r10
lea r10, [rax + rax]
lea r10, [r10 + 6]
movzx eax, word [r9 + r8]
nop dword [rax]
cmp rdx, r10
jb 0x609096
cmp r10, rsi
jb 0x60908b
mov qword [rsp + 0x10], rcx
mov rcx, qword [rbx]
lea rdi, [r11 - 2]
neg rdi
sar rdi, 0x3f
and rsi, rdi
rol ax, 8
mov esi, dword [r9 + rsi]
bswap esi
mov rdx, rbx
mov ebx, esi
call rcx
test rax, rax
je 0x608fa9
add rsp, 0x18
pop rbp
nop
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x18
pop rbp
ret
mov rax, rsi
mov rcx, r10
call fcn.00466a20
mov rcx, r10
call fcn.004669e0
mov rax, r8
mov rcx, rsi
call fcn.00466a20
mov rcx, rsi
call fcn.004669e0
lea rax, [0x0065b7a0]
lea rbx, [0x00727a60]
nop
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00608f80
Function at 0x610360
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x118]
cmp r12, qword [r14 + 0x10]
jbe 0x61053a
push rbp
mov rbp, rsp
sub rsp, 0x190
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x1b8], rdi
mov qword [rsp + 0x1c8], r8
mov rdx, qword [rax]
test rdx, rdx
jne 0x610516
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x6104f8
call fcn.0060cca0
nop dword [rax + rax]
test rbx, rbx
jne 0x6104e5
mov qword [rsp + 0xb8], rax
call fcn.005be4e0
lea rdi, [rsp + 0xe0]
mov rsi, rsp
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466fa6
mov rbp, qword [rbp]
mov rbx, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xe8]
cmp rbx, 2
jne 0x610411
cmp word [rax], 0x3268
je 0x61048a
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
call fcn.0040ae40
lea rcx, [0x0065b7a0]
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rcx
lea rcx, [0x00727a90]
mov qword [rsp + 0xd8], rcx
lea rax, [0x006bfd1d]
mov ebx, 0x2b
lea rcx, [rsp + 0xc0]
mov edi, 2
mov rsi, rdi
call fcn.004dd6a0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
add rsp, 0x190
pop rbp
ret
cmp byte [rsp + 0xf8], 0
je 0x6104b0
lea rax, [0x0072bb18]
mov rbx, qword [rsp + 0xb8]
xor ecx, ecx
xor edi, edi
add rsp, 0x190
pop rbp
ret
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x2c
lea rcx, [0x006c01b6]
mov qword [rax], rcx
xor ebx, ebx
lea rcx, [0x00728640]
mov rdi, rax
xor eax, eax
add rsp, 0x190
pop rbp
ret
xor eax, eax
mov rdi, rcx
mov rcx, rbx
xor ebx, ebx
add rsp, 0x190
pop rbp
ret
mov r11, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
mov rsi, r10
call r11
add rsp, 0x190
pop rbp
ret
mov r11, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
mov r9, r10
call r11
add rsp, 0x190
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.00610360
Function at 0x6114a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6115ec
push rbp
mov rbp, rsp
sub rsp, 0x60
movq qword [rsp + 0x58], xmm15
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x37], 0
mov rdx, qword [rax]
cmp qword [rdx + 0x48], 0
jne 0x6114d9
movabs rdx, 0x37e11d600
jmp 0x6114dd
mov rdx, qword [rdx + 0x48]
lea rax, [0x0072a600]
lea rbx, [0x009210a0]
mov rcx, rdx
call fcn.004ecae0
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x37], 1
nop
cmp byte [0x009210c3], 0
je 0x61153b
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx]
lea rbx, [0x006bd963]
mov ecx, 0x25
xor edi, edi
xor esi, esi
mov r8, rsi
call fcn.0061cde0
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x70]
call fcn.0061c4e0
test rax, rax
je 0x6115a2
movups xmmword [rsp + 0x48], xmm15
je 0x61155c
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
cmp byte [0x009210c3], 0
je 0x611595
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx]
lea rbx, [0x006bf2e9]
mov ecx, 0x29
lea rdi, [rsp + 0x48]
mov esi, 1
mov r8, rsi
call fcn.0061cde0
mov rax, qword [rsp + 0x70]
call fcn.00612380
nop
jmp 0x6115cc
nop
cmp byte [0x009210c3], 0
je 0x6115cc
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx]
lea rbx, [0x006bd988]
mov ecx, 0x25
xor edi, edi
xor esi, esi
mov r8, rsi
call fcn.0061cde0
mov byte [rsp + 0x37], 0
mov rdx, qword [rsp + 0x58]
mov rax, qword [rdx]
call rax
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.006114a0