joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56ef40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56f0cc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
call fcn.0053c3e0
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rbx, qword [rax + 8]
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rdx + 0x80]
cmp rsi, rcx
jne 0x56f0b8
mov rax, rcx
mov rcx, qword [rsp + 0x48]
call fcn.00403fe0
test al, al
je 0x56f0b8
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov rbx, rsi
mov r10, rcx
mov rcx, rdi
mov rdi, r8
call r10
test rbx, rbx
jne 0x56f0a5
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx + 8]
mov rbx, qword [rdx + 8]
mov rdx, rcx
call rbx
cmp rbx, 1
je 0x56f08f
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rax, [0x006a0320]
call fcn.0040d960
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rax], rcx
cmp dword [0x0092b0b0], 0
jne 0x56f048
mov qword [rax + 8], rdx
jmp 0x56f051
lea rdi, [rax + 8]
call fcn.00465a20
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
cmp dword [0x0092b0b0], 0
jne 0x56f077
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
jmp 0x56f085
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465a00
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00679500]
lea rbx, [0x00741ba0]
nop dword [rax]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741b90]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741b80]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0056ef40
Function at 0x56f100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56f2a3
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], rcx
mov rdx, qword [rax + 0x20]
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
cmp rdi, rdx
jne 0x56f136
xor r10d, r10d
xor r11d, r11d
jmp 0x56f178
lea rax, [0x00690f40]
nop dword [rax]
call fcn.0040d960
mov qword [rax + 8], 0x25
lea rcx, [0x006d6c82]
mov qword [rax], rcx
lea rbx, [0x00742c00]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r12d, byte [rcx + r10]
inc r10
or r11d, r12d
cmp rdi, r10
jg 0x56f16d
nop dword [rax]
test r11b, r11b
je 0x56f289
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
mov rdi, r9
mov rsi, rdx
call fcn.0056dd00
test al, al
je 0x56f289
mov rdi, qword [rsp + 0x70]
nop
test rdi, rdi
ja 0x56f1d2
lea rax, [0x0092ae58]
xor ecx, ecx
xor ebx, ebx
jmp 0x56f1ef
lea rax, [0x0092ae58]
mov rbx, rdi
xor ecx, ecx
lea rsi, [0x006796c0]
call fcn.0044a920
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call fcn.00466740
lea rax, [0x006aeb00]
call fcn.0040d960
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx + 0x78]
mov qword [rax], rdx
cmp dword [0x0092b0b0], 0
jne 0x56f237
mov rdx, qword [rsp + 0x58]
mov qword [rax + 8], rdx
jmp 0x56f245
lea rdi, [rax + 8]
mov rdx, qword [rsp + 0x58]
call fcn.00465a20
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x18], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x20], rdx
cmp dword [0x0092b0b0], 0
nop
jne 0x56f26d
mov rdx, qword [rsp + 0x40]
mov qword [rax + 0x10], rdx
jmp 0x56f27b
lea rdi, [rax + 0x10]
mov rdx, qword [rsp + 0x40]
call fcn.00465a20
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbx, qword [0x008d53b0]
mov rcx, qword [0x008d53b8]
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop dword [rax]
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.0056f100
Function at 0x56ff60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x570006
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
cmp qword [rcx + 0x10], 0
jne 0x56ff8d
xor edx, edx
jmp 0x56ffa0
cmp byte [rcx], 0
je 0x56ff9b
mov rdx, 0xffffffffffffffff
jmp 0x56ffa0
mov edx, 1
test rdx, rdx
jne 0x56ffd2
cmp qword [rdi + 0x10], 0
jne 0x56ffb0
xor edx, edx
jmp 0x56ffc3
cmp byte [rdi], 0
je 0x56ffbe
mov rdx, 0xffffffffffffffff
jmp 0x56ffc3
mov edx, 1
test rdx, rdx
jne 0x56ffd2
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rax + 0x28]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
nop
call rdx
test al, al
je 0x56fff0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00679500]
lea rbx, [0x00741c30]
nop
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0056ff60
Function at 0x570080
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5702bf
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x00698ee0]
nop
call fcn.0040d960
lea rbx, [0x006dd878]
mov ecx, 0x44
mov edi, 0xa
call fcn.00528500
nop dword [rax + rax]
test bl, bl
je 0x5702ab
mov qword [rsp + 0x40], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006dd834]
mov ecx, 0x44
mov edi, 0xa
call fcn.00528500
test bl, bl
je 0x570298
mov qword [rsp + 0x38], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006dc2b9]
mov ecx, 0x38
mov edi, 0x10
call fcn.00528500
nop
test bl, bl
je 0x570285
mov qword [rsp + 0x30], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006dc2f1]
mov ecx, 0x38
mov edi, 0x10
call fcn.00528500
test bl, bl
je 0x570271
mov qword [rsp + 0x28], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006dc329]
mov ecx, 0x38
mov edi, 0x10
call fcn.00528500
nop
test bl, bl
je 0x57025e
mov qword [rsp + 0x20], rax
lea rax, [0x006b4c00]
call fcn.0040d960
mov qword [rax + 0x38], 5
lea rcx, [0x006c995f]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0xe0
cmp dword [0x0092b0b0], 0
jne 0x5701eb
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
jmp 0x570233
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465a00
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00465a20
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465a00
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465a00
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00465a00
mov rdi, qword [0x008ca4c8]
test byte [rdi], al
cmp dword [0x0092b0b0], 0
jne 0x57024b
mov qword [rdi + 8], rax
jmp 0x570254
add rdi, 8
call fcn.00465900
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
nop
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
nop
nop
call fcn.00463740
jmp fcn.00570080
Function at 0x5702e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57051f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x00698ee0]
nop
call fcn.0040d960
lea rbx, [0x006de2c7]
mov ecx, 0x4e
mov edi, 0xa
call fcn.00528500
nop dword [rax + rax]
test bl, bl
je 0x57050b
mov qword [rsp + 0x40], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006de279]
mov ecx, 0x4e
mov edi, 0xa
call fcn.00528500
test bl, bl
je 0x5704f8
mov qword [rsp + 0x38], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006dd2e4]
mov ecx, 0x40
mov edi, 0x10
call fcn.00528500
nop
test bl, bl
je 0x5704e5
mov qword [rsp + 0x30], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006dd324]
mov ecx, 0x40
mov edi, 0x10
call fcn.00528500
test bl, bl
je 0x5704d1
mov qword [rsp + 0x28], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006dd2a4]
mov ecx, 0x40
mov edi, 0x10
call fcn.00528500
nop
test bl, bl
je 0x5704be
mov qword [rsp + 0x20], rax
lea rax, [0x006b4c00]
call fcn.0040d960
mov qword [rax + 0x38], 5
lea rcx, [0x006c9964]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x100
cmp dword [0x0092b0b0], 0
jne 0x57044b
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
jmp 0x570493
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465a00
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00465a20
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465a00
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465a00
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00465a00
mov rdi, qword [0x008ca4d0]
test byte [rdi], al
cmp dword [0x0092b0b0], 0
jne 0x5704ab
mov qword [rdi + 8], rax
jmp 0x5704b4
add rdi, 8
call fcn.00465900
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
nop
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
nop
nop
call fcn.00463740
jmp fcn.005702e0
Function at 0x570540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57077f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x00698ee0]
nop
call fcn.0040d960
lea rbx, [0x006deea5]
mov ecx, 0x74
mov edi, 0xa
call fcn.00528500
nop dword [rax + rax]
test bl, bl
je 0x57076b
mov qword [rsp + 0x40], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006dee31]
mov ecx, 0x74
mov edi, 0xa
call fcn.00528500
test bl, bl
je 0x570758
mov qword [rsp + 0x38], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006deb5f]
mov ecx, 0x60
mov edi, 0x10
call fcn.00528500
nop
test bl, bl
je 0x570745
mov qword [rsp + 0x30], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006deaff]
mov ecx, 0x60
mov edi, 0x10
call fcn.00528500
test bl, bl
je 0x570731
mov qword [rsp + 0x28], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006dea9f]
mov ecx, 0x60
mov edi, 0x10
call fcn.00528500
nop
test bl, bl
je 0x57071e
mov qword [rsp + 0x20], rax
lea rax, [0x006b4c00]
call fcn.0040d960
mov qword [rax + 0x38], 5
lea rcx, [0x006c9969]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x180
cmp dword [0x0092b0b0], 0
jne 0x5706ab
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
jmp 0x5706f3
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465a00
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00465a20
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465a00
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465a00
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00465a00
mov rdi, qword [0x008ca4d8]
test byte [rdi], al
cmp dword [0x0092b0b0], 0
jne 0x57070b
mov qword [rdi + 8], rax
jmp 0x570714
add rdi, 8
call fcn.00465900
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
nop
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
nop
nop
call fcn.00463740
jmp fcn.00570540
Function at 0x5707a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5709df
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x00698ee0]
nop
call fcn.0040d960
lea rbx, [0x006df0a5]
mov ecx, 0x9d
mov edi, 0xa
call fcn.00528500
nop dword [rax + rax]
test bl, bl
je 0x5709cb
mov qword [rsp + 0x40], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006df142]
mov ecx, 0x9d
mov edi, 0xa
call fcn.00528500
test bl, bl
je 0x5709b8
mov qword [rsp + 0x38], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006def9d]
mov ecx, 0x84
mov edi, 0x10
call fcn.00528500
nop
test bl, bl
je 0x5709a5
mov qword [rsp + 0x30], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006def19]
mov ecx, 0x84
mov edi, 0x10
call fcn.00528500
test bl, bl
je 0x570991
mov qword [rsp + 0x28], rax
lea rax, [0x00698ee0]
call fcn.0040d960
lea rbx, [0x006df021]
mov ecx, 0x84
mov edi, 0x10
call fcn.00528500
nop
test bl, bl
je 0x57097e
mov qword [rsp + 0x20], rax
lea rax, [0x006b4c00]
call fcn.0040d960
mov qword [rax + 0x38], 5
lea rcx, [0x006c996e]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x209
cmp dword [0x0092b0b0], 0
jne 0x57090b
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
jmp 0x570953
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465a00
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00465a20
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00465a00
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465a00
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00465a00
mov rdi, qword [0x008ca4e0]
test byte [rdi], al
cmp dword [0x0092b0b0], 0
jne 0x57096b
mov qword [rdi + 8], rax
jmp 0x570974
add rdi, 8
call fcn.00465900
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
nop
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c40]
call fcn.00436420
nop
nop
call fcn.00463740
jmp fcn.005707a0
Function at 0x573480
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57352e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov rdx, qword [rbx + 0x50]
mov rbx, rdx
call fcn.005736c0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx]
mov r9, qword [r8]
mov rdx, r8
call r9
mov rdx, qword [rsp + 0x58]
lea r8, [rdx + 0x28]
mov r9, qword [rdx + 0x28]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rdx, r8
call r9
test rbx, rbx
jne 0x57351a
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rdx + 0x50]
mov rcx, rax
mov rax, qword [rsp + 0x50]
call fcn.005739a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00679500]
lea rbx, [0x00741c00]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00573480

Function at 0x573580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x573660
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x78], r9
mov rdx, qword [rbx + 0x48]
mov rbx, rdx
call fcn.00573be0
nop dword [rax]
test rbx, rbx
jne 0x57364c
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x48]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
call fcn.005736c0
mov rdx, qword [rsp + 0x50]
lea r8, [rdx + 0x20]
mov r9, qword [rdx + 0x20]
mov rdi, rbx
mov rsi, rcx
mov rbx, qword [rsp + 0x28]
mov rcx, rax
mov rax, rbx
mov rdx, r8
call r9
test rbx, rbx
jne 0x573639
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x48]
mov rcx, rax
mov rax, qword [rsp + 0x30]
call fcn.005739a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00679500]
lea rbx, [0x00741c00]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c10]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00573580
Function at 0x573880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x573949
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov rdx, qword [rbx + 0x38]
mov rbx, rdx
call fcn.00573be0
test rbx, rbx
jne 0x573935
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rdx + 0x38]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
call fcn.00573be0
nop
test rbx, rbx
jne 0x573922
mov rdx, qword [rsp + 0x58]
lea rsi, [rdx + 0x10]
mov rdi, qword [rdx + 0x10]
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rax, rbx
mov rdx, rsi
call rdi
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsi + 0x38]
mov rcx, rax
mov rax, qword [rsp + 0x28]
call fcn.005739a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00679500]
lea rbx, [0x00741c20]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741c20]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00573880

Function at 0x575300
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x575446
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rdx, qword [rbx]
mov rdx, qword [rdx + 8]
mov rsi, rdx
shl rdx, 6
sub rdx, rsi
sub rdx, qword [rbx + 8]
lea rsi, [rdx + 7]
sar rsi, 0x3f
shr rsi, 0x3d
lea rcx, [rsi + rdx]
lea rcx, [rcx + 7]
sar rcx, 3
mov qword [rsp + 0x18], rcx
mov rbx, rcx
lea rax, [0x006796c0]
call fcn.0044a840
mov rcx, qword [rsp + 0x18]
lea rdx, [rcx - 1]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsi]
mov rsi, qword [rsi + 8]
xor ebx, ebx
xor r8d, r8d
jmp 0x575384
mov byte [rax + rdx], r9b
inc rbx
mov r8, r10
cmp rbx, rsi
jge 0x57539f
mov r9, qword [rdi + rbx*8]
mov r10d, 0x3f
jmp 0x5753b8
cmp rdx, rcx
jb 0x57537a
jmp 0x575428
mov rbx, rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, r13
mov r10, r8
mov r9, r15
xor r8d, r8d
cmp r10, 8
jl 0x575395
nop
cmp rdx, rcx
jae 0x57543a
movzx r11d, byte [rax + rdx]
test r8, r8
jl 0x575435
cmp r8, 0x20
sbb r12d, r12d
mov r13, rcx
mov rcx, r8
mov r15, r9
shl r9d, cl
and r9d, r12d
or r11d, r9d
mov byte [rax + rdx], r11b
lea r9, [rcx - 8]
neg r9
test r9, r9
jl 0x575430
cmp r9, 0x40
sbb r11, r11
mov rcx, r9
shr r15, cl
and r15, r11
lea r8, [r10 + r8]
lea r8, [r8 - 8]
dec rdx
test rdx, rdx
jge 0x5753ac
mov rbx, r13
mov rcx, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rdx
call fcn.00465da0
call fcn.00435080
call fcn.00435080
mov rax, rdx
nop dword [rax]
call fcn.00465da0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00575300
Function at 0x575a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x575c5a
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov ecx, 0x21
lea rax, [0x006795c0]
call fcn.0044a840
mov qword [rsp + 0x38], rax
lea rax, [0x006908c0]
nop dword [rax]
call fcn.0040d960
mov qword [rax + 0x10], 0x21
cmp dword [0x0092b0b0], 0
jne 0x575ae2
mov rsi, qword [rsp + 0x38]
mov qword [rax], rsi
nop
jmp 0x575aef
mov rdi, rax
mov rsi, qword [rsp + 0x38]
call fcn.00465a60
mov rcx, qword [rsp + 0x50]
mov rsi, qword [rcx]
mov rbx, qword [rsi + 8]
mov rsi, qword [rax + 8]
mov rdi, qword [rax]
cmp rsi, rbx
jg 0x575c46
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x18], rbx
cmp rbx, 0x21
jg 0x575b6f
lea r8, [rsi - 0x21]
mov r9, rsi
shl rsi, 3
sar r8, 0x3f
and rsi, r8
add rsi, rdi
mov rdi, rbx
sub rbx, r9
test rbx, rbx
je 0x575b56
shl rbx, 3
mov rax, rsi
call fcn.00466440
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x18]
mov rdx, qword [rax + 0x10]
nop word [rax + rax]
cmp rdx, rdi
jb 0x575c3e
mov qword [rax + 8], rdi
jmp 0x575bde
lea rax, [0x006795c0]
mov rcx, rbx
call fcn.0044a840
mov rdi, qword [rsp + 0x30]
mov rdx, qword [rdi + 8]
mov rcx, qword [rsp + 0x18]
cmp rdx, rcx
mov rsi, rcx
cmovl rcx, rdx
mov rbx, qword [rdi]
cmp rax, rbx
je 0x575bbb
mov qword [rsp + 0x38], rax
shl rcx, 3
call fcn.00466740
mov rax, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x30]
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
cmp dword [0x0092b0b0], 0
jne 0x575bd1
mov qword [rdi], rax
jmp 0x575bd6
call fcn.00465900
mov rax, rdi
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rax + 8]
mov rsi, qword [rax]
lea rdi, [rdx - 1]
cmp rdx, rdi
jbe 0x575c33
mov qword [rsp + 0x28], rdx
mov qword [rsi + rdx*8 - 8], 1
jmp 0x575c21
mov qword [rsp + 0x20], rdi
xor ebx, ebx
call fcn.00575e60
mov rdi, qword [rsp + 0x20]
inc rdi
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
shl rdx, 1
cmp rdi, rdx
jl 0x575bfe
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rdi
mov rcx, rdx
call fcn.00465da0
mov rcx, rdi
call fcn.00465e20
lea rax, [0x00679500]
lea rbx, [0x00741d00]
call fcn.00436420
nop
mov qword [rsp + 8], rax
nop
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.00575a80