joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f9f40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xc0]
cmp r12, qword [r14 + 0x10]
jbe 0x4fa182
push rbp
mov rbp, rsp
sub rsp, 0x138
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00460494
mov rbp, qword [rbp]
cmp byte [rax + 0x38], 0
je 0x4f9fa1
mov rdx, qword [rax + 0x40]
mov qword [rax + 0x28], rdx
movzx edx, byte [rax + 0x24]
cmp bl, dl
jbe 0x4f9fb9
mov rdx, qword [0x0089a780]
mov r8, qword [0x0089a788]
jmp 0x4fa036
jae 0x4f9fcb
mov rdx, qword [0x0089a790]
mov r8, qword [0x0089a798]
jmp 0x4fa036
mov byte [rax + 0x38], 0
cmp bl, 3
ja 0x4f9feb
cmp bl, 2
jne 0x4f9fe0
movzx edx, word [rax + 0x1c]
jmp 0x4fa004
cmp bl, 3
jne 0x4fa002
movzx edx, word [rax + 0x1e]
jmp 0x4fa004
cmp bl, 4
jne 0x4f9ff6
movzx edx, word [rax + 0x20]
jmp 0x4fa004
cmp bl, 5
jne 0x4fa002
movzx edx, word [rax + 0x22]
nop
jmp 0x4fa004
xor edx, edx
movzx edx, dx
cmp qword [rax + 0x30], rdx
jne 0x4fa031
mov qword [rax + 0x30], 0
movzx r9d, byte [rax + 0x24]
inc r9d
mov byte [rax + 0x24], r9b
mov rdx, qword [0x0089a790]
mov r8, qword [0x0089a798]
jmp 0x4fa036
xor edx, edx
xor r8d, r8d
test rdx, rdx
jne 0x4fa141
mov qword [rsp + 0x258], rax
movups xmmword [rsp + 0x2c], xmm15
lea rdi, [rsp + 0x38]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00460494
mov rbp, qword [rbp]
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 0x28]
lea rax, [rsp + 0x2c]
call fcn.004fbb00
test rbx, rbx
je 0x4fa0c4
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00460494
mov rbp, qword [rbp]
mov rax, rbx
mov rbx, rcx
add rsp, 0x138
pop rbp
ret
mov rcx, qword [rsp + 0x258]
mov byte [rcx + 0x38], 1
mov rdx, qword [rcx + 0x28]
mov qword [rcx + 0x40], rdx
movzx edx, word [rsp + 0x12c]
mov word [rcx + 0x48], dx
movzx edx, word [rsp + 0x134]
mov word [rcx + 0x4a], dx
mov qword [rcx + 0x28], rax
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsp + 0x148], xmm0
lea rdi, [rsp + 0x154]
lea rsi, [rsp + 0x38]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607a0
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
add rsp, 0x138
pop rbp
nop
ret
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00460494
mov rbp, qword [rbp]
mov rax, rdx
mov rbx, r8
add rsp, 0x138
pop rbp
ret
mov qword [rsp + 0x118], rax
mov byte [rsp + 0x120], bl
call fcn.0045df00
mov rax, qword [rsp + 0x118]
movzx ebx, byte [rsp + 0x120]
jmp fcn.004f9f40
Function at 0x4fa1c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa3b2
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x58], bl
cmp byte [rax + 0x38], 0
je 0x4fa21d
nop dword [rax]
cmp byte [rax + 0x24], bl
jne 0x4fa21d
movzx ecx, word [rax + 0x4a]
add rcx, qword [rax + 0x28]
cmp qword [rax + 8], rcx
jge 0x4fa207
mov rax, qword [0x0089a800]
mov rbx, qword [0x0089a808]
add rsp, 0x40
pop rbp
ret
mov qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
movzx edx, byte [rax + 0x24]
cmp bl, dl
jbe 0x4fa238
mov rdx, qword [0x0089a780]
mov rsi, qword [0x0089a788]
jmp 0x4fa2b5
jae 0x4fa24a
mov rdx, qword [0x0089a790]
mov rsi, qword [0x0089a798]
jmp 0x4fa2b5
mov byte [rax + 0x38], 0
cmp bl, 3
ja 0x4fa26b
cmp bl, 2
jne 0x4fa260
movzx edx, word [rax + 0x1c]
jmp 0x4fa284
cmp bl, 3
jne 0x4fa282
movzx edx, word [rax + 0x1e]
jmp 0x4fa284
cmp bl, 4
jne 0x4fa276
movzx edx, word [rax + 0x20]
jmp 0x4fa284
cmp bl, 5
jne 0x4fa282
movzx edx, word [rax + 0x22]
nop
jmp 0x4fa284
xor edx, edx
movzx edx, dx
cmp qword [rax + 0x30], rdx
jne 0x4fa2b1
mov qword [rax + 0x30], 0
movzx r8d, byte [rax + 0x24]
inc r8d
mov byte [rax + 0x24], r8b
mov rdx, qword [0x0089a790]
mov rsi, qword [0x0089a798]
jmp 0x4fa2b5
xor edx, edx
xor esi, esi
test rdx, rdx
jne 0x4fa3a6
mov qword [rsp + 0x50], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rdi, qword [rax + 0x28]
mov rax, rdx
call fcn.004fbf80
mov rdx, qword [rsp + 0x50]
mov qword [rdx + 0x28], rax
test rbx, rbx
je 0x4fa398
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
lea rax, [0x006935e0]
nop dword [rax]
call fcn.0040d480
mov qword [rsp + 0x38], rax
mov rbx, qword [0x008a6838]
lea rcx, [rsp + 0x58]
lea rax, [0x0067db40]
nop dword [rax]
call fcn.0040e360
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
xor eax, eax
lea rbx, [0x006c5cbf]
mov ecx, 0xa
call fcn.0044abe0
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 8], rbx
cmp dword [0x0092d940], 0
jne 0x4fa358
mov rdx, qword [rsp + 0x30]
jmp 0x4fa378
call fcn.0045fe80
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov rdx, qword [rsp + 0x30]
mov qword [r11 + 0x10], rdx
mov rsi, qword [rcx + 0x18]
mov qword [r11 + 0x18], rsi
mov qword [rcx], rax
mov rsi, qword [rsp + 0x28]
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rdx
lea rax, [0x00742640]
mov rbx, rcx
add rsp, 0x40
pop rbp
ret
inc qword [rdx + 0x30]
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
mov rax, rdx
mov rbx, rsi
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax + rax]
call fcn.0045df00
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004fa1c0
Function at 0x4fab40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x2a8]
cmp r12, qword [r14 + 0x10]
jbe 0x4fac7e
push rbp
mov rbp, rsp
sub rsp, 0x320
lea rdi, [rsp + 0x330]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00460494
mov rbp, qword [rbp]
cmp byte [rax + 0x38], 0
nop dword [rax]
je 0x4fac67
cmp word [rax + 0x48], 5
jne 0x4fac67
mov qword [rsp + 0x430], rax
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax]
mov rdi, qword [rax + 0x28]
mov rax, rdx
call fcn.004fcf80
lea rdi, [rsp + 0x220]
mov rsi, rsp
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607a0
mov rbp, qword [rbp]
lea rdi, [rsp + 0x120]
lea rsi, [rsp + 0x220]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607a0
mov rbp, qword [rbp]
test rax, rax
je 0x4fac1f
lea rdi, [rsp + 0x330]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00460494
mov rbp, qword [rbp]
add rsp, 0x320
pop rbp
ret
mov rcx, qword [rsp + 0x430]
movzx edx, word [rcx + 0x4a]
add qword [rcx + 0x28], rdx
mov byte [rcx + 0x38], 0
inc qword [rcx + 0x30]
lea rdi, [rsp + 0x330]
lea rsi, [rsp + 0x120]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607a0
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
add rsp, 0x320
pop rbp
ret
mov rax, qword [0x0089a780]
mov rbx, qword [0x0089a788]
add rsp, 0x320
pop rbp
ret
mov qword [rsp + 0x108], rax
call fcn.0045df00
mov rax, qword [rsp + 0x108]
jmp fcn.004fab40

Function at 0x4faca0
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rsp + 0x30], 0
cmp byte [rax + 0x38], 0
je 0x4fad9e
cmp word [rax + 0x48], 1
nop
jne 0x4fad9e
mov rcx, qword [rax + 0x28]
lea rsi, [rcx + 4]
mov rdx, qword [rax + 0x10]
mov rdi, qword [rax]
cmp qword [rax + 8], rsi
mov dword [rsp + 0x14], 0
mov dword [rsp + 0x1c], 0
jge 0x4fad00
mov rcx, qword [0x0089a7a0]
mov rdx, qword [0x0089a7a8]
jmp 0x4fad38
cmp rdx, rsi
jb 0x4fadbd
cmp rcx, rsi
ja 0x4fadb2
mov rsi, rcx
sub rcx, rdx
sar rcx, 0x3f
and rsi, rcx
lea rcx, [rdi + rsi]
lea rdx, [rsp + 0x1c]
cmp rdx, rcx
je 0x4fad34
mov ecx, dword [rdi + rsi]
mov dword [rsp + 0x1c], ecx
xor ecx, ecx
xor edx, edx
test rcx, rcx
je 0x4fad47
mov dword [rsp + 0x14], 0
jmp 0x4fad5b
mov dword [rsp + 0x14], 0
mov esi, dword [rsp + 0x1c]
mov dword [rsp + 0x14], esi
xor ecx, ecx
xor edx, edx
mov esi, dword [rsp + 0x14]
mov dword [rsp + 0x18], esi
test rcx, rcx
je 0x4fad7c
mov dword [rsp + 0x30], 0
mov rax, rcx
mov rbx, rdx
add rsp, 0x20
pop rbp
ret
movzx ecx, word [rax + 0x4a]
add qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
mov ecx, dword [rsp + 0x18]
mov dword [rsp + 0x30], ecx
xor eax, eax
xor ebx, ebx
add rsp, 0x20
pop rbp
ret
mov rax, qword [0x0089a780]
mov rbx, qword [0x0089a788]
add rsp, 0x20
pop rbp
ret
mov rax, rcx
mov rcx, rsi
call fcn.004602a0
mov rcx, rsi
call fcn.00460260
nop
int3
Function at 0x4fade0
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
movups xmmword [rsp + 0x50], xmm15
cmp byte [rax + 0x38], 0
je 0x4faedf
cmp word [rax + 0x48], 0x1c
nop dword [rax]
jne 0x4faedf
mov rcx, qword [rax + 0x28]
lea rsi, [rcx + 0x10]
mov rdx, qword [rax + 0x10]
mov rdi, qword [rax]
cmp qword [rax + 8], rsi
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
jge 0x4fae40
mov rcx, qword [0x0089a7a0]
mov rdx, qword [0x0089a7a8]
jmp 0x4fae79
cmp rdx, rsi
jb 0x4faefe
cmp rcx, rsi
ja 0x4faef3
mov rsi, rcx
sub rcx, rdx
sar rcx, 0x3f
and rsi, rcx
lea rcx, [rdi + rsi]
lea rdx, [rsp + 0x20]
cmp rdx, rcx
je 0x4fae75
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x20], xmm0
xor ecx, ecx
xor edx, edx
test rcx, rcx
je 0x4fae86
movups xmmword [rsp + 0x10], xmm15
jmp 0x4fae9a
movups xmmword [rsp + 0x10], xmm15
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x10], xmm0
xor ecx, ecx
xor edx, edx
movups xmm0, xmmword [rsp + 0x10]
movups xmmword [rsp + 0x30], xmm0
test rcx, rcx
je 0x4faebb
movups xmmword [rsp + 0x50], xmm15
mov rax, rcx
mov rbx, rdx
add rsp, 0x40
pop rbp
ret
movzx ecx, word [rax + 0x4a]
add qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x50], xmm0
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
mov rax, qword [0x0089a780]
mov rbx, qword [0x0089a788]
add rsp, 0x40
pop rbp
ret
mov rax, rcx
mov rcx, rsi
call fcn.004602a0
mov rcx, rsi
call fcn.00460260
nop
int3
Function at 0x4fb180
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fb2ea
push rbp
mov rbp, rsp
sub rsp, 0x30
movzx edx, byte [rax + 0x18]
cmp dl, 2
jb 0x4fb2d6
nop
ja 0x4fb2c2
mov qword [rsp + 0x148], rax
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 0x30]
mov r8, qword [rax + 0x28]
lea rax, [rsp + 0x40]
call fcn.004fcde0
test rdi, rdi
jne 0x4fb2b6
mov rdx, qword [rsp + 0x148]
movzx esi, byte [rdx + 0x18]
cmp sil, 3
ja 0x4fb220
cmp sil, 2
jne 0x4fb202
lea rsi, [rdx + 0x1e]
mov rdi, qword [0x0089a850]
mov r8, qword [0x0089a858]
nop
jmp 0x4fb261
cmp sil, 3
jne 0x4fb25a
lea rsi, [rdx + 0x20]
mov rdi, qword [0x0089a860]
mov r8, qword [0x0089a868]
jmp 0x4fb261
cmp sil, 4
jne 0x4fb240
lea rsi, [rdx + 0x22]
mov rdi, qword [0x0089a870]
mov r8, qword [0x0089a878]
jmp 0x4fb261
cmp sil, 5
jne 0x4fb25a
lea rsi, [rdx + 0x24]
mov rdi, qword [0x0089a880]
mov r8, qword [0x0089a888]
jmp 0x4fb261
xor esi, esi
xor edi, edi
xor r8d, r8d
movzx r9d, word [rsi]
cmp r9w, 0xffff
je 0x4fb278
inc r9d
mov word [rsi], r9w
xor edi, edi
xor r8d, r8d
test rdi, rdi
jne 0x4fb2aa
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rcx
cmp dword [0x0092d940], 0
je 0x4fb29d
call fcn.0045fe40
mov qword [r11], rax
mov rcx, qword [rdx]
mov qword [r11 + 8], rcx
mov qword [rdx], rax
xor eax, eax
xor ebx, ebx
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov rbx, r8
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov rbx, rsi
add rsp, 0x30
pop rbp
ret
mov rax, qword [0x0089a790]
mov rbx, qword [0x0089a798]
add rsp, 0x30
pop rbp
ret
mov rax, qword [0x0089a780]
mov rbx, qword [0x0089a788]
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x110], rax
call fcn.0045df00
mov rax, qword [rsp + 0x110]
nop
jmp fcn.004fb180
Function at 0x4fb820
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fb8ae
push rbp
mov rbp, rsp
sub rsp, 0x20
cmp byte [rax + 0x18], 0
je 0x4fb88d
mov byte [rax + 0x18], 6
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x28]
cmp rdx, rcx
jb 0x4fb8a8
mov qword [rsp + 0x30], rax
lea rsi, [rax + 0x1a]
mov r8, qword [rax]
sub rdx, rcx
mov rdi, rdx
neg rdx
sar rdx, 0x3f
and rcx, rdx
lea rbx, [r8 + rcx]
xor ecx, ecx
mov rax, rsi
call fcn.004f9540
mov rdx, qword [rsp + 0x30]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
xor edi, edi
xor esi, esi
add rsp, 0x20
pop rbp
ret
mov rdi, qword [0x0089a780]
mov rsi, qword [0x0089a788]
xor eax, eax
xor ebx, ebx
mov rcx, rbx
add rsp, 0x20
pop rbp
ret
call fcn.00460260
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.004fb820
Function at 0x501280
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5013ce
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x38], xmm15
mov qword [rsp + 0x20], 0
mov rax, qword [0x00899598]
call fcn.004f1100
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x005013e0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x501392
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x5013c8
mov qword [rsp + 0x30], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x5013bd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x48]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.004602a0
call fcn.00460220
nop
call fcn.0045df00
jmp fcn.00501280
Function at 0x506980
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x218]
cmp r12, qword [r14 + 0x10]
jbe 0x506ba7
push rbp
mov rbp, rsp
sub rsp, 0x290
mov qword [rsp + 0x2b0], rax
test byte [rax], al
lea rdi, [rsp + 0x240]
mov rsi, rax
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046083a
mov rbp, qword [rbp]
mov rdi, rsp
lea rsi, [rsp + 0x240]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046083a
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x2a0]
mov rdx, qword [rsp + 0x2a6]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x56], rdx
call fcn.00506d60
cmp ax, 3
je 0x506b90
mov word [rsp + 0x122], ax
nop
mov rax, qword [rsp + 0x2b0]
mov ebx, 3
call fcn.004f9f40
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x124], xmm0
lea rdi, [rsp + 0x130]
lea rsi, [rsp + 0xc]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607a0
mov rbp, qword [rbp]
test rax, rax
je 0x506adc
nop dword [rax + rax]
cmp qword [0x0089a790], rax
je 0x506a90
mov ecx, 1
jmp 0x506ac1
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], rbx
mov rcx, qword [0x0089a798]
call fcn.00405280
xor eax, 1
mov rbx, qword [rsp + 0x238]
mov ecx, eax
mov rax, qword [rsp + 0x230]
test cl, cl
je 0x506adc
mov rax, qword [0x0089a070]
mov rbx, qword [0x0089a078]
add rsp, 0x290
pop rbp
ret
movzx edx, word [rsp + 0x122]
test dx, dx
jne 0x506b4d
cmp byte [rsp + 0x2a6], 0
je 0x506af8
test dx, dx
jmp 0x506b4d
cmp byte [rsp + 0x2a9], 0
je 0x506b07
test dx, dx
jmp 0x506b4d
cmp qword [0x0089a790], rax
je 0x506b14
xor eax, eax
jmp 0x506b2d
mov rcx, qword [0x0089a798]
nop dword [rax + rax]
call fcn.00405280
movzx edx, word [rsp + 0x122]
test al, al
jne 0x506b36
test dx, dx
jmp 0x506b4d
mov rax, qword [0x0089a060]
mov rbx, qword [0x0089a068]
add rsp, 0x290
pop rbp
ret
je 0x506b83
cmp dx, 2
jne 0x506b6c
mov rax, qword [0x0089a0c0]
mov rbx, qword [0x0089a0c8]
add rsp, 0x290
pop rbp
ret
mov rax, qword [0x0089a090]
mov rbx, qword [0x0089a098]
add rsp, 0x290
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x290
pop rbp
ret
mov rax, qword [0x0089a100]
mov rbx, qword [0x0089a108]
add rsp, 0x290
pop rbp
ret
mov qword [rsp + 0x18], rax
call fcn.0045df00
mov rax, qword [rsp + 0x18]
jmp fcn.00506980
Function at 0x506bc0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x2c8]
cmp r12, qword [r14 + 0x10]
jbe 0x506d24
push rbp
mov rbp, rsp
sub rsp, 0x340
mov qword [rsp + 0x350], rax
mov word [rsp + 0x358], bx
jmp 0x506bf7
mov rax, qword [rsp + 0x350]
nop
mov ebx, 3
nop dword [rax]
call fcn.004f9f40
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x22c], xmm0
lea rdi, [rsp + 0x238]
lea rsi, [rsp + 0xc]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607a0
mov rbp, qword [rbp]
movups xmm0, xmmword [rsp + 0x22c]
movups xmmword [rsp + 0x120], xmm0
lea rdi, [rsp + 0x12c]
lea rsi, [rsp + 0x238]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607a0
mov rbp, qword [rbp]
cmp qword [0x0089a790], rax
jne 0x506ca0
mov qword [rsp + 0x338], rax
mov rcx, qword [0x0089a798]
call fcn.00405280
test al, al
jne 0x506d0d
mov rax, qword [rsp + 0x338]
nop dword [rax]
test rax, rax
jne 0x506cf6
movzx ecx, word [rsp + 0x358]
cmp word [rsp + 0x220], cx
je 0x506ce9
mov rax, qword [rsp + 0x350]
mov ebx, 3
call fcn.004fa1c0
test rax, rax
je 0x506bef
mov rax, qword [0x0089a070]
mov rbx, qword [0x0089a078]
add rsp, 0x340
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x340
pop rbp
ret
mov rax, qword [0x0089a070]
mov rbx, qword [0x0089a078]
add rsp, 0x340
pop rbp
ret
mov rax, qword [0x0089a100]
mov rbx, qword [0x0089a108]
add rsp, 0x340
pop rbp
ret
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.0045df00
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
nop dword [rax]
jmp fcn.00506bc0

Function at 0x506d60
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x2d0]
cmp r12, qword [r14 + 0x10]
jbe 0x506ee2
push rbp
mov rbp, rsp
sub rsp, 0x348
nop
lea rax, [rsp + 0x358]
mov ebx, 3
call fcn.004fa1c0
cmp qword [0x0089a790], rax
jne 0x506db9
mov qword [rsp + 0x340], rax
mov rcx, qword [0x0089a798]
call fcn.00405280
test al, al
jne 0x506dbe
mov rax, qword [rsp + 0x340]
test rax, rax
je 0x506d7e
nop
lea rax, [rsp + 0x358]
mov ebx, 4
call fcn.004fa1c0
cmp qword [0x0089a790], rax
jne 0x506dfa
mov qword [rsp + 0x338], rax
mov rcx, qword [0x0089a798]
call fcn.00405280
test al, al
jne 0x506e15
mov rax, qword [rsp + 0x338]
test rax, rax
je 0x506dbf
nop
jmp 0x506e15
nop
lea rax, [rsp + 0x358]
mov ebx, 5
call fcn.004fa1c0
nop
lea rax, [rsp + 0x358]
mov ebx, 5
call fcn.004f9f40
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x22c], xmm0
lea rdi, [rsp + 0x238]
lea rsi, [rsp + 0xc]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607a0
mov rbp, qword [rbp]
movups xmm0, xmmword [rsp + 0x22c]
movups xmmword [rsp + 0x120], xmm0
lea rdi, [rsp + 0x12c]
lea rsi, [rsp + 0x238]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607a0
mov rbp, qword [rbp]
test rax, rax
jne 0x506ed1
cmp word [rsp + 0x220], 0x29
jne 0x506e02
mov ecx, dword [rsp + 0x224]
movzx edx, word [rsp + 0x3b4]
test ecx, 0xff0000
jne 0x506ec6
shr ecx, 0x18
shl ecx, 4
or edx, ecx
mov eax, edx
add rsp, 0x348
pop rbp
ret
movzx eax, word [rsp + 0x3b4]
add rsp, 0x348
pop rbp
ret
call fcn.0045df00
jmp fcn.00506d60
Function at 0x51de80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51df70
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rax, qword [0x00899590]
cmp qword [rax + 8], 1
nop
jle 0x51def9
movzx ecx, byte [rax + 1]
mov byte [rsp + 0x17], cl
movzx eax, byte [rax]
mov byte [rsp + 0x16], al
call fcn.00435720
lea rax, [0x006cf344]
mov ebx, 0x21
call fcn.00435b00
movzx eax, byte [rsp + 0x17]
call fcn.00435960
lea rax, [0x006c5b43]
mov ebx, 0xa
nop dword [rax]
call fcn.00435b00
movzx eax, byte [rsp + 0x16]
call fcn.00435960
call fcn.00435920
call fcn.00435780
mov rax, qword [0x00899590]
cmp byte [rax], 0
jne 0x51df4c
cmp byte [rax + 1], 0
jne 0x51df11
cmp byte [rax + 0x10], 0
je 0x51df2e
call fcn.00435720
lea rax, [0x006d1a9a]
mov ebx, 0x27
call fcn.00435b00
call fcn.00435780
jmp 0x51df6a
call fcn.00435720
lea rax, [0x006d5330]
mov ebx, 0x32
nop
call fcn.00435b00
call fcn.00435780
jmp 0x51df6a
call fcn.00435720
lea rax, [0x006d6f4a]
mov ebx, 0x3d
nop dword [rax]
call fcn.00435b00
call fcn.00435780
add rsp, 0x18
pop rbp
ret
call fcn.0045df00
jmp fcn.0051de80
Function at 0x523c60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x523d90
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
call fcn.00524a00
nop dword [rax]
test rbx, rbx
je 0x523d61
test rdi, rdi
je 0x523d56
cmp byte [rcx], 0x2f
jne 0x523d27
lea rbx, [rdi - 1]
mov rdx, rbx
neg rdx
sar rdx, 0x3f
and edx, 1
lea rax, [rcx + rdx]
call fcn.00524a00
test rbx, rbx
je 0x523cf8
test rdi, rdi
je 0x523cee
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x2c
lea rcx, [0x006d367d]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x10
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x20
lea rcx, [0x006ceac9]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x10
pop rbp
ret
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x26
lea rcx, [0x006d1349]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x10
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
nop
ret
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x13
lea rcx, [0x006c89cd]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00523c60