joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d3360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d347f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
jmp 0x5d337d
mov rax, rbx
mov ecx, dword [rax + 0x340]
bt ecx, 0
jb 0x5d3467
mov edx, ecx
or ecx, 1
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx + 0x340], ecx
sete cl
test cl, cl
je 0x5d337a
test edx, edx
jne 0x5d3450
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jne 0x5d33bb
xor eax, eax
xor ecx, ecx
jmp 0x5d3413
mov qword [rsp + 0x38], rbx
mov rax, rbx
call fcn.005d34a0
test rax, rax
je 0x5d3407
movups xmmword [rsp + 0x40], xmm15
je 0x5d33d9
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x006de147]
mov ebx, 0x4c
lea rcx, [rsp + 0x40]
mov edi, 1
mov rsi, rdi
nop dword [rax]
call fcn.004c8440
jmp 0x5d340b
xor eax, eax
xor ebx, ebx
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov rdx, qword [rbx]
mov rbx, qword [rbx + 8]
mov rdx, qword [rdx + 0x18]
mov rax, rbx
call rdx
test rax, rax
je 0x5d343c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov rcx, qword [rcx + 0x18]
call rcx
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [0x008cae60]
mov rbx, qword [0x008cae68]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.005d3360
Function at 0x5d6780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d686f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
movzx edx, word [rbx + 0x18]
movzx r8d, word [rbx + 0x98]
test r8w, r8w
cmovne dx, r8w
mov word [rsp + 0x2c], dx
mov word [rsp + 0x2e], 0
mov word [rsp + 0x2e], dx
mov r8, qword [rax + 0x48]
mov ebx, 1
lea rcx, [rsp + 0x2e]
mov edi, 1
mov rsi, rdi
mov rax, r8
nop dword [rax]
call fcn.005ca6e0
test bl, bl
je 0x5d6812
mov rcx, qword [rsp + 0x50]
mov word [rcx + 0x40], ax
mov byte [rcx + 0x42], 1
mov word [rcx + 0x188], ax
mov word [rcx + 0x218], ax
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x50]
mov ebx, 0x46
nop dword [rax]
call fcn.005cfee0
movups xmmword [rsp + 0x30], xmm15
movzx eax, word [rsp + 0x2c]
call fcn.0040ae40
lea rcx, [0x00679600]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x006db8d0]
mov ebx, 0x34
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
nop
call fcn.004c8440
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005d6780

Function at 0x5d6ea0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d6f92
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x50]
mov rcx, qword [rcx + 0x58]
movzx edx, word [rdx + 0x50]
xor ebx, ebx
jmp 0x5d6ed3
inc rbx
cmp rbx, rcx
jge 0x5d6ef9
movzx r8d, word [rsi + rbx*2]
nop dword [rax]
cmp r8w, dx
jne 0x5d6ed0
nop
mov rcx, qword [0x008cb100]
mov rdx, qword [0x008cb108]
xor ebx, ebx
jmp 0x5d6f72
xor ecx, ecx
cmp dword [0x0092b0b0], 0
jne 0x5d6f0a
mov qword [rax + 0x28], rcx
jmp 0x5d6f13
lea rdi, [rax + 0x28]
call fcn.00465a00
test rcx, rcx
je 0x5d6f30
mov rdx, qword [rax]
movzx ecx, word [rcx]
mov word [rdx + 0x5a], cx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rax]
mov ebx, 0x28
call fcn.005cfee0
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x2e
lea rcx, [0x006da08f]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00742c00]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
cmp rbx, rdx
jge 0x5d6f88
mov rsi, qword [rcx + rbx*8]
nop dword [rax + rax]
cmp word [rsi], r8w
jne 0x5d6f6f
jmp 0x5d6f8a
xor esi, esi
mov rcx, rsi
jmp 0x5d6efb
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.005d6ea0
Function at 0x5dc080
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5dc351
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xb0], rax
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
mov rbx, qword [rax + 0x80]
mov rdx, qword [rax + 0x88]
mov qword [rsp + 0x78], rdx
lea rax, [0x0068c620]
call fcn.0040b120
mov rbx, rax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x60]
call fcn.005d10c0
test rcx, rcx
jne 0x5dc229
lea rdx, [0x00689080]
cmp rax, rdx
jne 0x5dc102
mov rcx, rbx
nop
jmp 0x5dc10a
mov rcx, rbx
mov ebx, 0
mov qword [rsp + 0x58], rbx
jne 0x5dc197
mov rdx, qword [rsp + 0xb0]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x140]
mov rdx, qword [rdx + 0x138]
mov r8, qword [rbx + 0x20]
mov r9, qword [rbx + 0x18]
test r8, r8
je 0x5dc18e
nop dword [rax]
test rsi, rsi
je 0x5dc15b
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x30], r8
xor eax, eax
jmp 0x5dc2c6
nop
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x31
lea rcx, [0x006daf21]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x58]
mov rcx, rax
lea rax, [0x00742c00]
jmp 0x5dc240
xor eax, eax
xor ecx, ecx
jmp 0x5dc240
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rcx
mov rax, qword [rsp + 0x60]
mov ebx, 0xa
call fcn.005cfee0
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x88], rcx
lea rcx, [0x00689080]
mov qword [rsp + 0x90], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x98], rcx
lea rax, [0x006ddf8a]
mov ebx, 0x49
lea rcx, [rsp + 0x80]
mov edi, 2
mov rsi, rdi
call fcn.004c8440
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
test rax, rax
jne 0x5dc28b
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov rdi, qword [rsp + 0x60]
mov qword [rdi + 0x168], rdx
cmp dword [0x0092b0b0], 0
jne 0x5dc26b
mov qword [rdi + 0x160], rcx
jmp 0x5dc277
add rdi, 0x160
call fcn.00465a00
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov ebx, 0x6e
nop
call fcn.005cfee0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
add rdx, 0x10
inc rax
cmp rax, rsi
jge 0x5dc31e
mov rcx, qword [rdx + 8]
mov rdi, qword [rdx]
cmp rcx, r8
jne 0x5dc2bf
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rdx
mov rax, rdi
mov rbx, r9
call fcn.00402d80
test al, al
jne 0x5dc310
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x50]
jmp 0x5dc2bf
mov rbx, qword [rsp + 0x58]
xor eax, eax
xor ecx, ecx
jmp 0x5dc240
nop
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x2f
lea rcx, [0x006da57e]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x58]
mov rcx, rax
lea rax, [0x00742c00]
jmp 0x5dc240
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.005dc080
Function at 0x5e3840
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5e3a99
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0xa0], rbx
mov rdx, qword [rax + 0x1e0]
mov rsi, qword [rax + 0x1d8]
nop dword [rax]
cmp rcx, rdx
jne 0x5e388a
xor r8d, r8d
jmp 0x5e38c5
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x2f
lea rcx, [0x006da520]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00742c00]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
inc r8
cmp r8, rdx
jge 0x5e3915
lea r9, [r8 + r8*2]
mov r10, qword [rbx + r9*8 + 8]
mov r9, qword [rsi + r9*8 + 8]
cmp r9, r10
je 0x5e38c2
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x2f
lea rcx, [0x006da520]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00742c00]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rax + 0x1e0], rcx
mov qword [rax + 0x1e8], rdi
cmp dword [0x0092b0b0], 0
jne 0x5e3935
mov qword [rax + 0x1d8], rbx
jmp 0x5e3945
lea rdi, [rax + 0x1d8]
nop dword [rax]
call fcn.00465a40
cmp qword [rax], 0
je 0x5e3a61
mov qword [rsp + 0x98], rax
call fcn.005e3780
nop dword [rax]
test rdi, rdi
jne 0x5e3a75
mov rsi, qword [rsp + 0x98]
mov rdx, qword [rsi + 0x10]
mov r8, qword [rsi]
nop dword [rax + rax]
cmp rbx, rdx
ja 0x5e3a90
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x30]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466070
mov rbp, qword [rbp]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x58], 1
movups xmmword [rsp + 0x20], xmm15
lea rdx, [0x005e3ae0]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x30]
mov ebx, 2
xor ecx, ecx
lea rdi, [rsp + 0x20]
call fcn.0058aaa0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x5e3a02
xor ecx, ecx
jmp 0x5e3a16
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x68]
cmp rax, rcx
ja 0x5e3a8b
sub rcx, rax
xor edx, edx
test rdx, rdx
jne 0x5e3a29
mov rdx, qword [rsp + 0x98]
cmp qword [rdx + 8], rcx
je 0x5e3a61
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x2d
lea rcx, [0x006d9997]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00742c00]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
call fcn.00465e60
mov rcx, rbx
call fcn.00465e20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005e3840
Function at 0x5eae00
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5eb01c
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
jne 0x5eafec
movups xmmword [rsp + 0x48], xmm15
lea rdi, [rsp + 0x50]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466070
mov rbp, qword [rbp]
nop
cmp qword [rsp + 0x78], 0
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0x18
jne 0x5eb008
mov qword [rsp + 0xb0], rax
cmp byte [rsp + 0x70], 0
je 0x5eaeca
mov rdx, qword [rsp + 0x60]
inc rdx
cmp qword [rsp + 0x68], rdx
jge 0x5eaeca
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x36
lea rcx, [0x006dbc8b]
mov qword [rax], rcx
lea rcx, [0x00742c00]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
jmp 0x5eaf30
mov rbx, qword [rsp + 0x60]
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x58]
nop dword [rax]
cmp rcx, rdx
jae 0x5eaf18
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 1
lea rsi, [0x006796c0]
nop dword [rax]
call fcn.0044a920
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rsp + 0x2f]
mov byte [r8 + rbx], sil
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], r8
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x005eb040]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x38]
lea rax, [rsp + 0x48]
call fcn.0058aaa0
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
test rdx, rdx
je 0x5eaf76
xor r8d, r8d
xor r9d, r9d
xor ecx, ecx
jmp 0x5eafad
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
mov rax, qword [rsp + 0x80]
cmp rax, rcx
ja 0x5eb003
sub r8, rax
sub rcx, rax
mov r9, r8
neg r8
sar r8, 0x3f
and rax, r8
lea r8, [rdx + rax]
xor edx, edx
xor esi, esi
mov rdi, qword [rsp + 0xb0]
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r9
cmp dword [0x0092b0b0], 0
jne 0x5eafcb
mov qword [rdi], r8
jmp 0x5eafd0
call fcn.00465a80
mov rax, r8
mov rbx, rcx
mov rcx, r9
mov rdi, rdx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, rdx
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
call fcn.00465e60
lea rax, [0x00679500]
lea rbx, [0x00741db0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.005eae00
Function at 0x5f4e60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f4f5c
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x98], r10
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
test r9, r9
jne 0x5f4ec3
mov rcx, qword [rax + 0x18]
mov rax, rcx
call fcn.00539b80
mov r9, rax
mov r10, rbx
mov rdx, qword [r9 + 0x30]
mov rax, r10
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x18]
lea r8, [rsi - 1]
cmp r8, 0x13
jae 0x5f4f48
mov r12, qword [0x008cb068]
mov r13, qword [0x008cb060]
cmp r12, rsi
jbe 0x5f4f3d
movzx r12d, byte [r13 + rsi]
mov qword [rsp], r12
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9, rax
mov r10, rbx
mov r11, rcx
mov rax, rdx
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.005f4300
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rsi
mov rcx, r12
call fcn.00465dc0
lea rax, [0x00679500]
lea rbx, [0x00741da0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.005f4e60
Function at 0x5f4fc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f50d1
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x80], rsi
test rbx, rbx
jne 0x5f5086
mov rdx, qword [rax + 0x18]
lea rdi, [rdx - 1]
nop word [rax + rax]
nop
cmp rdi, 0x13
jae 0x5f50bd
mov rcx, qword [0x008cb068]
mov rdi, qword [0x008cb060]
nop dword [rax + rax]
cmp rcx, rdx
jbe 0x5f50b5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x90], r9
movzx ecx, byte [rdi + rdx]
mov qword [rsp + 0x38], rcx
lea rax, [0x006796c0]
mov rbx, rcx
call fcn.0044a840
mov rsi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
mov rdi, rcx
mov rbx, rax
mov rax, qword [rsp + 0x60]
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x005f9160]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x40]
call fcn.005c6de0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rdx
call fcn.00465dc0
lea rax, [0x00679500]
lea rbx, [0x00741da0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.005f4fc0

Function at 0x5f5140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f51ce
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x68], rbx
mov rdx, qword [rax + 0x18]
lea r12, [rdx - 1]
cmp r12, 0x13
jae 0x5f51ba
mov r12, qword [0x008cb068]
mov r13, qword [0x008cb060]
cmp r12, rdx
jbe 0x5f51af
movzx edx, byte [r13 + rdx]
mov qword [rsp], rdx
lea rsi, [0x006cb482]
mov r8d, 0xb
xor r9d, r9d
xor r10d, r10d
mov r11, r10
nop
call fcn.005f4300
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rdx
mov rcx, r12
call fcn.00465dc0
lea rax, [0x00679500]
lea rbx, [0x00741da0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.005f5140
Function at 0x5f5320
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f547d
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r8
mov rdx, qword [rax + 0x18]
lea r12, [rdx - 1]
nop dword [rax + rax]
cmp r12, 0x13
jae 0x5f5469
mov r12, qword [0x008cb068]
mov r13, qword [0x008cb060]
nop dword [rax + rax]
cmp r12, rdx
jbe 0x5f545e
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r8
movzx edx, byte [r13 + rdx]
mov qword [rsp], rdx
lea rsi, [0x006ca49e]
mov r8d, 8
xor r9d, r9d
xor r10d, r10d
mov r11, r10
call fcn.005f4300
movups xmmword [rsp + 0x58], xmm15
lea rdx, [0x005f9160]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx + 0x18]
mov qword [rsp + 0x60], rdx
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
lea rax, [rsp + 0x58]
call fcn.005b86c0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rbx
mov rdx, qword [rsp + 0xa0]
mov rdx, qword [rdx + 0x30]
xor ecx, ecx
mov rdi, rcx
mov rax, qword [rsp + 0xa8]
xor ebx, ebx
call rdx
mov rdx, qword [rsp + 0x50]
mov r12, qword [rdx + 0x38]
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x68]
call r12
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0x30]
mov rax, qword [rsp + 0x68]
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, rdx
mov rcx, r12
call fcn.00465dc0
lea rax, [0x00679500]
lea rbx, [0x00741da0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax + rax]
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.005f5320
Function at 0x5f57a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f589b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
cmp cx, 0x18
ja 0x5f5806
cmp cx, 0x17
jne 0x5f57e7
nop
mov rdx, qword [0x008ca4a8]
lea rcx, [0x00744e18]
mov rsi, rdx
mov edx, 1
jmp 0x5f584a
cmp cx, 0x18
jne 0x5f5844
nop
mov rdx, qword [0x008ca4b0]
lea rcx, [0x00744e58]
mov rsi, rdx
mov edx, 1
jmp 0x5f584a
cmp cx, 0x19
jne 0x5f5825
nop
mov rdx, qword [0x008ca4b8]
lea rcx, [0x00744e98]
mov rsi, rdx
mov edx, 1
jmp 0x5f584a
cmp cx, 0x1d
jne 0x5f5844
nop
mov rdx, qword [0x008ca4c0]
lea rcx, [0x00744ed8]
mov rsi, rdx
mov edx, 1
jmp 0x5f584a
xor ecx, ecx
xor edx, edx
xor esi, esi
test dl, dl
je 0x5f5867
mov rdx, qword [rcx + 0x18]
mov rcx, rbx
mov rbx, rax
mov rax, rsi
call rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x26
lea rcx, [0x006d769e]
mov qword [rax], rcx
lea rbx, [0x00742c00]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x18], cx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, word [rsp + 0x18]
nop
jmp fcn.005f57a0

Function at 0x5f6f40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f7097
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movzx edx, word [rsp + 0xe0]
cmp dx, 0x303
jae 0x5f6f6b
cmp al, 0xe4
jne 0x5f6fa7
cmp qword [rsp + 0xc8], 0
je 0x5f7083
cmp al, 0xe4
je 0x5f6f85
cmp dx, 0x303
jmp 0x5f6fac
mov rax, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
cmp dx, 0x303
jae 0x5f7022
cmp al, 0xe3
jne 0x5f6fd9
mov rdx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rdx + 0x30]
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rax, qword [rsp + 0x88]
mov qword [rsp], rax
lea rdi, [rsp + 8]
lea rsi, [rsp + 0x90]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004663cc
mov rbp, qword [rbp]
call fcn.005f6c40
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rax, rbx
call fcn.00539b80
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov rcx, qword [rax + 0x38]
mov rdx, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rax, rbx
mov rbx, rdx
mov r9, rcx
mov rcx, rsi
call r9
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + 0x30]
mov rax, qword [rsp + 0x70]
xor ebx, ebx
xor edi, edi
mov rdx, rcx
mov rcx, rdi
call rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x00679500]
lea rbx, [0x00741d50]
call fcn.00436420
nop
mov byte [rsp + 0x70], al
mov qword [rsp + 0x78], rbx
call fcn.00463740
movzx eax, byte [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp fcn.005f6f40
Function at 0x5ff7e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5ff8b5
movdqa xmm0, xmmword [0x00742110]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5ff821
movdqa xmm0, xmmword [0x00742120]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5ff937
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5ff90b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00741940]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00742600]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret