joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51e5c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51e6be
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
lea rdx, [rbx + 0x10]
mov qword [rsp + 0x30], rdx
call fcn.004b4c00
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
call rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x18]
mov rbx, qword [rbx + 0x20]
mov r8, rbx
mov rbx, rsi
mov rcx, rdi
mov rdi, r8
mov r10, rdx
mov rdx, qword [rsp + 0x30]
call r10
test rbx, rbx
jne 0x51e6ab
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x50]
lea r8, [rdx + 0x18]
mov r9, qword [rdx + 0x18]
mov r10, qword [rsp + 0x58]
mov rcx, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x18]
mov rsi, qword [r10 + 0x20]
mov rbx, rax
mov rdx, r8
call r9
test rbx, rbx
je 0x51e68e
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x38
pop rbp
ret
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx + 0x20]
mov rbx, qword [rdx + 0x20]
mov rax, qword [rsp + 0x28]
mov rdx, rcx
call rbx
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0051e5c0
Function at 0x51e8c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ea3f
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
nop
call fcn.004b4c00
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x80]
cmp rbx, rcx
jne 0x51ea2b
mov rbx, qword [rax + 8]
mov rax, rcx
mov rcx, qword [rsp + 0x48]
call fcn.00404940
test al, al
je 0x51ea2b
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov rbx, rsi
mov r10, rcx
mov rcx, rdi
mov rdi, r8
call r10
test rbx, rbx
jne 0x51ea18
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx + 8]
mov rbx, qword [rdx + 8]
mov rdx, rcx
nop
call rbx
cmp rbx, 1
je 0x51ea05
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rax, [0x006881a0]
nop
call fcn.0040d680
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
mov qword [rax], rdx
cmp dword [0x00921500], 0
je 0x51e9c8
nop dword [rax]
call fcn.004665a0
mov qword [r11], rcx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
cmp dword [0x00921500], 0
jne 0x51e9ee
mov rcx, qword [rsp + 0x30]
jmp 0x51e9fb
call fcn.004665a0
mov rcx, qword [rsp + 0x30]
mov qword [r11], rcx
mov qword [rax + 0x10], rcx
add rsp, 0x38
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00728180]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728170]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728160]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0051e8c0
Function at 0x51ea80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ec0a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x68], rcx
mov rdx, qword [rax + 0x20]
nop dword [rax + rax]
cmp rdi, rdx
jne 0x51eaad
xor r8d, r8d
xor r9d, r9d
jmp 0x51eae8
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x25
lea rcx, [0x006bdcb6]
mov qword [rax], rcx
lea rbx, [0x00728640]
mov rcx, rax
xor eax, eax
add rsp, 0x48
pop rbp
ret
movzx r10d, byte [rcx + r8]
inc r8
or r9d, r10d
cmp rdi, r8
jg 0x51eadd
test r9b, r9b
je 0x51ebf4
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
mov rbx, rdi
mov rdi, r9
mov rax, rcx
mov rcx, rsi
mov rsi, rdx
call fcn.0051d720
test al, al
je 0x51ebf4
mov rdi, qword [rsp + 0x70]
test rdi, rdi
ja 0x51eb45
lea rax, [0x009210a0]
xor ebx, ebx
xor ecx, ecx
jmp 0x51eb62
lea rax, [0x009210a0]
mov rbx, rdi
xor ecx, ecx
lea rsi, [0x0065bae0]
call fcn.0044b880
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call fcn.00467360
lea rax, [0x00695960]
call fcn.0040d680
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx + 0x78]
mov qword [rax], rdx
cmp dword [0x00921500], 0
jne 0x51eba6
mov rdx, qword [rsp + 0x58]
jmp 0x51ebb3
call fcn.004665a0
mov rdx, qword [rsp + 0x58]
mov qword [r11], rdx
mov qword [rax + 8], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x18], rdx
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x20], rdx
cmp dword [0x00921500], 0
jne 0x51ebd9
mov rdx, qword [rsp + 0x40]
jmp 0x51ebe6
call fcn.004665a0
mov rdx, qword [rsp + 0x40]
mov qword [r11], rdx
mov qword [rax + 0x10], rdx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rbx, qword [0x008be890]
mov rcx, qword [0x008be898]
xor eax, eax
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0051ea80
Function at 0x520400
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x520506
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov rcx, qword [rax + 0x10]
shl rcx, 3
mov qword [rsp + 0x18], rcx
mov rbx, rcx
lea rax, [0x0065bae0]
call fcn.0044b7a0
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov rdi, qword [rsp + 0x18]
mov rcx, rdi
xor ebx, ebx
jmp 0x52044f
inc rbx
cmp rbx, rdx
jge 0x520460
mov r8, qword [rsi + rbx*8]
xor r9d, r9d
jmp 0x5204c0
test rdi, rdi
jge 0x52046c
xor edi, edi
jmp 0x52046c
inc rdi
cmp rdi, rcx
jge 0x520483
jae 0x5204a9
movzx edx, byte [rax + rdi]
test dl, dl
je 0x520469
nop dword [rax + rax]
cmp rdi, rcx
ja 0x5204a1
sub rcx, rdi
mov rbx, rcx
neg rcx
sar rcx, 0x3f
and rdi, rcx
add rax, rdi
mov rcx, rbx
add rsp, 0x20
pop rbp
ret
mov rax, rdi
call fcn.00466a20
mov rax, rdi
call fcn.00466960
inc r9
shr r8, 8
mov rdi, r10
nop dword [rax + rax]
cmp r9, 8
jge 0x52044c
lea r10, [rdi - 1]
test r10, r10
jl 0x5204e0
cmp rcx, r10
jbe 0x5204f8
mov byte [rdi + rax - 1], r8b
jmp 0x5204b1
test r8b, r8b
je 0x5204b1
lea rax, [0x0065b7a0]
lea rbx, [0x00728270]
call fcn.00436ac0
mov rax, r10
nop dword [rax + rax]
call fcn.00466960
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.00520400

Function at 0x520520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x520618
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
test rcx, rcx
je 0x52056f
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov rax, rbx
mov rbx, rcx
call fcn.00467060
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
mov rsi, qword [rax + 0x10]
mov rax, rcx
xor r8d, r8d
jmp 0x520582
inc r8
cmp r8, rsi
jge 0x520590
mov r9, qword [rdx + r8*8]
xor r10d, r10d
jmp 0x5205d9
test rcx, rcx
jge 0x5205a0
xor ecx, ecx
jmp 0x5205a0
inc rcx
nop dword [rax]
cmp rax, rcx
jle 0x5205af
jbe 0x5205c1
movzx edx, byte [rbx + rcx]
test dl, dl
je 0x520599
mov rcx, rdi
mov rdx, rax
mov rax, rbx
mov rbx, rdx
add rsp, 0x10
pop rbp
ret
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.00466960
inc r10
shr r9, 8
mov rcx, r11
cmp r10, 8
jge 0x52057f
lea r11, [rcx - 1]
test r11, r11
jl 0x5205f4
cmp rax, r11
jbe 0x52060c
mov byte [rcx + rbx - 1], r9b
jmp 0x5205cf
test r9b, r9b
je 0x5205cf
lea rax, [0x0065b7a0]
lea rbx, [0x00728270]
call fcn.00436ac0
mov rcx, rax
mov rax, r11
call fcn.00466960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00520520
Function at 0x523d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x523f49
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], r10
test rsi, rsi
je 0x523eb9
test r9, r9
je 0x523eb9
mov qword [rsp + 0x98], rsi
lea rbx, [rsi + 1]
mov qword [rsp + 0x58], rbx
cmp rcx, rbx
jl 0x523dd6
jae 0x523e37
jmp 0x523f3d
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rcx, [rsi + 5]
mov qword [rsp + 0x50], rcx
lea rax, [0x0065c3a0]
nop
call fcn.0044b7a0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
nop word [rax + rax]
cmp rsi, rcx
ja 0x523f32
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.0052f740
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
nop
cmp rax, rcx
jae 0x523f2d
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x60]
mov qword [rdi + rax*8], rsi
jmp 0x523f00
test r10, r10
jne 0x523ec2
xor edx, edx
jmp 0x523ef1
nop
test rcx, rcx
jne 0x523ee9
lea rax, [0x0065c3a0]
mov ebx, 1
mov rcx, rbx
call fcn.0044b7a0
mov r10, qword [rsp + 0xb0]
mov ecx, 1
mov qword [rax], r10
mov edx, 1
mov rbx, rdx
add rsp, 0x68
pop rbp
ret
dec rcx
nop dword [rax]
test rcx, rcx
jle 0x523f0f
mov rsi, qword [rdi + rcx*8 - 8]
test rsi, rsi
je 0x523efa
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
ja 0x523f28
mov rax, rdi
mov rbx, rcx
mov rcx, rdx
add rsp, 0x68
pop rbp
ret
call fcn.004669e0
call fcn.00466960
mov rdx, rcx
mov rcx, rsi
call fcn.004669e0
mov rdx, rcx
mov rcx, rbx
call fcn.004669e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
nop
jmp fcn.00523d80
Function at 0x5247c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x524906
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x5248f6
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.0052f3e0
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x5248db
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x5248f1
cmp rsi, rcx
ja 0x5248e9
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x5248e1
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.0052f520
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.00466a20
mov rax, rsi
call fcn.00466a20
call fcn.004669e0
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.004669e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005247c0
Function at 0x524960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x524aa6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x524a96
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.0052f480
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x524a7b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x524a91
cmp rsi, rcx
ja 0x524a89
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x524a81
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.0052f5c0
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.00466a20
mov rax, rsi
call fcn.00466a20
call fcn.004669e0
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.004669e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00524960
Function at 0x52a360
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52a512
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x52a3a5
jae 0x52a41e
nop
jmp 0x52a506
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x52a3e9
lea rax, [0x0065c3a0]
mov ebx, 1
mov rcx, rbx
call fcn.0044b7a0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x52a41e
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x0065c3a0]
nop
call fcn.0044b7a0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x52a433
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x52a465
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x52a426
nop dword [rax + rax]
jmp 0x52a4fb
test rsi, rsi
jle 0x52a472
xor r8d, r8d
xor r9d, r9d
jmp 0x52a4c5
jmp 0x52a477
dec rbx
test rbx, rbx
jle 0x52a486
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x52a474
cmp rbx, rcx
ja 0x52a491
add rsp, 0x28
pop rbp
ret
mov rdx, rcx
mov rcx, rbx
call fcn.004669e0
movzx r11d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r11, cl
lea r12, [rcx + 8]
cmp rcx, 0x40
sbb r13, r13
and r11, r13
or r9, r11
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x52a4d5
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x52a49c
jmp 0x52a4f0
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x52a4e5
mov qword [rax + rbx*8 - 8], r9
jmp 0x52a472
mov rax, rsi
mov rcx, rbx
call fcn.00466960
mov rax, r10
mov rcx, rdx
call fcn.00466960
mov rax, r9
mov rcx, rbx
call fcn.00466960
mov rdx, rcx
mov rcx, rbx
call fcn.004669e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0052a360
Function at 0x52fea0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52ff38
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
cmp qword [rcx + 0x10], 0
jne 0x52fec7
xor edx, edx
jmp 0x52feda
cmp byte [rcx], 0
je 0x52fed5
mov rdx, 0xffffffffffffffff
jmp 0x52feda
mov edx, 1
test rdx, rdx
jne 0x52ff0b
cmp qword [rdi + 0x10], 0
jne 0x52feea
xor edx, edx
jmp 0x52ff00
cmp byte [rdi], 0
je 0x52fef8
mov rdx, 0xffffffffffffffff
jmp 0x52ff00
mov edx, 1
nop dword [rax]
test rdx, rdx
jne 0x52ff0b
add rsp, 0x18
pop rbp
ret
mov rdx, qword [rax + 0x28]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call rdx
test al, al
je 0x52ff24
add rsp, 0x18
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727ff0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0052fea0
Function at 0x52ffc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5301df
push rbp
mov rbp, rsp
sub rsp, 0x48
lea rax, [0x006807a0]
call fcn.0040d680
lea rbx, [0x006c454b]
mov ecx, 0x44
mov edi, 0xa
call fcn.00520280
test bl, bl
je 0x5301cb
mov qword [rsp + 0x40], rax
nop
lea rax, [0x006807a0]
call fcn.0040d680
lea rbx, [0x006c458f]
mov ecx, 0x44
mov edi, 0xa
nop
call fcn.00520280
test bl, bl
je 0x5301b8
mov qword [rsp + 0x38], rax
nop
lea rax, [0x006807a0]
call fcn.0040d680
lea rbx, [0x006c3145]
mov ecx, 0x38
mov edi, 0x10
call fcn.00520280
test bl, bl
je 0x5301a5
mov qword [rsp + 0x30], rax
nop
lea rax, [0x006807a0]
call fcn.0040d680
lea rbx, [0x006c317d]
mov ecx, 0x38
mov edi, 0x10
call fcn.00520280
test bl, bl
je 0x530190
mov qword [rsp + 0x28], rax
nop
lea rax, [0x006807a0]
call fcn.0040d680
lea rbx, [0x006c31b5]
mov ecx, 0x38
mov edi, 0x10
call fcn.00520280
test bl, bl
je 0x53017d
mov qword [rsp + 0x20], rax
lea rax, [0x0069aae0]
call fcn.0040d680
mov qword [rax + 0x38], 5
lea rcx, [0x006b0c1a]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0xe0
cmp dword [0x00921500], 0
jne 0x53010d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x53013e
call fcn.00466620
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rdx, qword [rsp + 0x38]
mov qword [r11 + 8], rdx
mov rbx, qword [rsp + 0x30]
mov qword [r11 + 0x10], rbx
mov rsi, qword [rsp + 0x28]
mov qword [r11 + 0x18], rsi
mov rdi, qword [rsp + 0x20]
mov qword [r11 + 0x20], rdi
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rcx, qword [0x008bd908]
test byte [rcx], al
cmp dword [0x00921500], 0
je 0x530173
call fcn.004665c0
mov qword [r11], rax
mov rdx, qword [rcx + 8]
mov qword [r11 + 8], rdx
mov qword [rcx + 8], rax
add rsp, 0x48
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00728000]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728000]
nop
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728000]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728000]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728000]
call fcn.00436ac0
nop
nop
call fcn.004646a0
jmp fcn.0052ffc0
Function at 0x530200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53041f
push rbp
mov rbp, rsp
sub rsp, 0x48
lea rax, [0x006807a0]
call fcn.0040d680
lea rbx, [0x006c4db8]
mov ecx, 0x4e
mov edi, 0xa
call fcn.00520280
test bl, bl
je 0x53040b
mov qword [rsp + 0x40], rax
nop
lea rax, [0x006807a0]
call fcn.0040d680
lea rbx, [0x006c4e06]
mov ecx, 0x4e
mov edi, 0xa
nop
call fcn.00520280
test bl, bl
je 0x5303f8
mov qword [rsp + 0x38], rax
nop
lea rax, [0x006807a0]
call fcn.0040d680
lea rbx, [0x006c3e9f]
mov ecx, 0x40
mov edi, 0x10
call fcn.00520280
test bl, bl
je 0x5303e5
mov qword [rsp + 0x30], rax
nop
lea rax, [0x006807a0]
call fcn.0040d680
lea rbx, [0x006c3edf]
mov ecx, 0x40
mov edi, 0x10
call fcn.00520280
test bl, bl
je 0x5303d0
mov qword [rsp + 0x28], rax
nop
lea rax, [0x006807a0]
call fcn.0040d680
lea rbx, [0x006c3f1f]
mov ecx, 0x40
mov edi, 0x10
call fcn.00520280
test bl, bl
je 0x5303bd
mov qword [rsp + 0x20], rax
lea rax, [0x0069aae0]
call fcn.0040d680
mov qword [rax + 0x38], 5
lea rcx, [0x006b0c1f]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x100
cmp dword [0x00921500], 0
jne 0x53034d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x53037e
call fcn.00466620
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rdx, qword [rsp + 0x38]
mov qword [r11 + 8], rdx
mov rbx, qword [rsp + 0x30]
mov qword [r11 + 0x10], rbx
mov rsi, qword [rsp + 0x28]
mov qword [r11 + 0x18], rsi
mov rdi, qword [rsp + 0x20]
mov qword [r11 + 0x20], rdi
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rcx, qword [0x008bd910]
test byte [rcx], al
cmp dword [0x00921500], 0
je 0x5303b3
call fcn.004665c0
mov qword [r11], rax
mov rdx, qword [rcx + 8]
mov qword [r11 + 8], rdx
mov qword [rcx + 8], rax
add rsp, 0x48
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00728000]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728000]
nop
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728000]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728000]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00728000]
call fcn.00436ac0
nop
nop
call fcn.004646a0
jmp fcn.00530200