joyce8/EMBER2024-capa huggingface dataset:
Function at 0x523420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52364c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov rax, rbx
mov rbx, rcx
call fcn.0047bba0
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
cmp rax, 0x16
jne 0x523638
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
call fcn.00482740
nop dword [rax]
call fcn.0047f620
call fcn.004802a0
lea rcx, [rax - 2]
cmp rcx, 4
jbe 0x52359e
lea rcx, [rax - 7]
nop dword [rax]
cmp rcx, 4
jbe 0x523522
cmp rax, 0x19
jne 0x523625
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
call fcn.0047bba0
mov rcx, qword [rax + 0x48]
mov rax, rbx
call rcx
mov rcx, qword [0x007e0328]
cmp qword [0x007e0320], rax
jne 0x523625
nop dword [rax]
call fcn.00403f40
test al, al
je 0x523625
mov rax, qword [rsp + 0x38]
lea rbx, [0x00641f00]
nop dword [rax]
cmp rax, rbx
jne 0x523615
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
call fcn.005236e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x20]
call fcn.00523940
test al, al
je 0x523564
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
call fcn.00482740
call fcn.0047f620
mov rdi, qword [rsp + 0x20]
call fcn.00480f60
nop dword [rax]
test al, al
je 0x523570
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
call fcn.00482740
nop
call fcn.0047f620
mov rdi, qword [rsp + 0x20]
call fcn.00481560
mov eax, 1
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x28]
call fcn.00523820
test al, al
je 0x5235dc
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
call fcn.00482740
call fcn.0047f620
mov rdi, qword [rsp + 0x28]
call fcn.00480e40
test al, al
je 0x5235e8
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
call fcn.00482740
call fcn.0047f620
mov rdi, qword [rsp + 0x28]
call fcn.00481420
mov eax, 1
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [0x00604be0]
nop dword [rax]
call fcn.0040a4c0
lea rax, [0x005fe120]
lea rbx, [0x00685240]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00685230]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00523420
Function at 0x525280
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5253d5
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x58], rbx
cmp qword [rax], 0
jne 0x5253b7
cmp qword [rax + 0x30], 0
jne 0x5253c1
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rbx
mov rdx, qword [rax + 0x18]
add rdx, rcx
cmp rcx, rdx
jle 0x5252f7
lea rax, [0x0064db0b]
mov ebx, 0x1b
call fcn.00468600
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov qword [rcx + 8], rbx
mov rax, rcx
mov rcx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
cmp byte [rax + 0x28], 0
je 0x525331
mov rdx, qword [rax + 0x18]
add rdx, rcx
cmp qword [rax + 0x20], rdx
jge 0x525331
lea rax, [0x00656dea]
mov ebx, 0x36
call fcn.00468600
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov qword [rcx + 8], rbx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdx, qword [rax + 0x18]
lea rsi, [rcx + rdx]
mov qword [rsp + 0x30], rsi
mov rdi, qword [rax + 0x20]
mov r8, qword [rax + 0x10]
cmp rdi, rsi
jae 0x52537a
mov qword [rsp + 0x28], rdx
lea rax, [0x005fe2e0]
mov rbx, r8
mov rcx, rdx
nop dword [rax]
call fcn.00448f20
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov r8, rax
mov rdi, rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], r8
lea rax, [r8 + rdx]
call fcn.00461f80
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov qword [rsi + 0x18], rdx
mov rdx, qword [rsp + 0x28]
mov qword [rsi + 0x20], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rsi + 0x10], rdx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x005fe120]
lea rbx, [0x00685260]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00525280
Function at 0x527360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5274b6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
nop dword [rax]
cmp rcx, 0x20
jne 0x5274a2
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov ebx, 8
mov rcx, rdi
call fcn.004d37a0
movabs rdx, 0x7ffffffffffff
and rax, rdx
mov rsi, qword [rsp + 0x28]
mov qword [rsi], rax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi - 6]
mov r8, qword [rsp + 0x30]
lea rax, [r8 + 6]
mov ebx, 8
call fcn.004d37a0
shr rax, 3
movabs rdx, 0x7ffffffffffff
and rax, rdx
mov rsi, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi - 0xc]
mov r8, qword [rsp + 0x30]
lea rax, [r8 + 0xc]
mov ebx, 8
call fcn.004d37a0
shr rax, 6
movabs rdx, 0x7ffffffffffff
and rax, rdx
mov rsi, qword [rsp + 0x28]
mov qword [rsi + 0x10], rax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi - 0x13]
mov r8, qword [rsp + 0x30]
lea rax, [r8 + 0x13]
mov ebx, 8
call fcn.004d37a0
shr rax, 1
movabs rdx, 0x7ffffffffffff
and rax, rdx
mov rsi, qword [rsp + 0x28]
mov qword [rsi + 0x18], rax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi - 0x18]
mov rdi, qword [rsp + 0x30]
lea rax, [rdi + 0x18]
mov ebx, 8
call fcn.004d37a0
shr rax, 0xc
movabs rdx, 0x7ffffffffffff
and rax, rdx
mov rdx, qword [rsp + 0x28]
mov qword [rdx + 0x20], rax
mov rax, rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x005fe120]
lea rbx, [0x006852b0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00527360
Function at 0x527560
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x5276df
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa8], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x58], xmm0
lea rax, [rsp + 0x40]
call fcn.00526bc0
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x80], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x88], rcx
xor eax, eax
jmp 0x527615
mov rsi, qword [rsp + 0x20]
lea rax, [rsi + 1]
cmp rax, 5
jge 0x527685
mov qword [rsp + 0x20], rax
imul rcx, rax, 0x33
mov rdx, rcx
sar rcx, 0x3f
shr rcx, 0x3d
lea rsi, [rcx + rdx]
sar rsi, 3
mov qword [rsp + 0x30], rsi
shl rsi, 3
sub rdx, rsi
cmp rdx, 0x40
sbb rdi, rdi
mov rsi, qword [rsp + rax*8 + 0x68]
mov rcx, rdx
shl rsi, cl
and rdi, rsi
mov ebx, 8
mov rcx, rbx
lea rax, [rsp + 0x28]
call fcn.004d37c0
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x30]
xor eax, eax
jmp 0x5276c0
mov rax, qword [rsp + 0xa8]
test byte [rax], al
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
test byte [rdx], al
movzx r10d, byte [rdx + r9]
or r10d, r8d
mov byte [rdx + r9], r10b
inc rax
nop dword [rax + rax]
cmp rax, 8
jge 0x52760c
movzx r8d, byte [rsp + rax + 0x38]
lea r9, [rsi + rax]
cmp r9, 0x20
jl 0x5276a7
jmp 0x52760c
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00527560
Function at 0x528560
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x528636
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x88], rax
xor ecx, ecx
jmp 0x5285a5
mov rdx, qword [rsp + 0x18]
lea rcx, [rdx + 1]
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
cmp rbx, rcx
jle 0x528618
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + rcx*8]
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
test byte [rdx], al
lea rbx, [rsp + 0x48]
mov rax, rdx
mov ecx, 0x28
call fcn.00402c80
nop
test al, al
je 0x52858c
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
mov rdx, qword [rsp + 0x70]
lea rax, [rdx + 0x28]
lea rbx, [rsp + 0x20]
mov ecx, 0x28
call fcn.00402c80
test al, al
je 0x52858c
jmp 0x528622
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x005fe120]
lea rbx, [0x006847c0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00528560
Function at 0x528960
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x528bdd
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
mov qword [rsp + 0x148], rbx
cmp rcx, 0x20
jne 0x528bb3
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
movups xmmword [rsp + 0xe8], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x100], xmm15
lea rax, [rsp + 0xe8]
call fcn.00527360
mov qword [rsp + 0x118], rax
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xc8], xmm15
movups xmmword [rsp + 0xd8], xmm15
mov rbx, rax
lea rax, [rsp + 0xc0]
call fcn.00527a20
mov qword [rsp + 0x110], rax
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
mov rcx, qword [0x007dde08]
mov rbx, rax
lea rax, [rsp + 0x98]
nop dword [rax + rax]
call fcn.00526d60
mov qword [rsp + 0x128], rax
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
mov rcx, qword [0x007dddf8]
mov rbx, qword [rsp + 0x110]
lea rax, [rsp + 0x70]
call fcn.005279a0
mov rcx, qword [0x007dde08]
mov rbx, rax
call fcn.00526cc0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rbx, qword [rsp + 0x128]
mov rcx, rax
lea rax, [rsp + 0x48]
call fcn.00527e40
test rbx, rbx
jne 0x528adf
lea rax, [0x00651ec9]
mov ebx, 0x24
call fcn.00468600
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
mov qword [rsp + 0x120], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
mov rbx, rax
lea rax, [rsp + 0x20]
call fcn.00526e20
mov rcx, qword [rsp + 0x148]
movzx ecx, byte [rcx + 0x1f]
shr cl, 7
movzx edi, cl
mov rbx, rax
mov rcx, qword [rsp + 0x120]
mov rax, rcx
call fcn.005277c0
mov qword [rsp + 0x120], rax
mov rcx, qword [rsp + 0x140]
test byte [rcx], al
mov rbx, rax
mov rax, rcx
call fcn.00527340
mov rcx, qword [rsp + 0x140]
lea rax, [rcx + 0x28]
mov rbx, qword [rsp + 0x118]
nop dword [rax]
call fcn.00527340
mov rcx, qword [rsp + 0x140]
lea rax, [rcx + 0x50]
call fcn.00526ba0
mov rcx, qword [rsp + 0x140]
lea rax, [rcx + 0x78]
mov rbx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x118]
call fcn.005279a0
mov rax, qword [rsp + 0x140]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
lea rax, [0x006542de]
mov ebx, 0x2b
nop
call fcn.00468600
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00528960
Function at 0x529e60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x529ef1
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
nop dword [rax]
cmp rcx, 0x40
jne 0x529edd
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [rsp + 0x18]
cmp rbx, rdx
je 0x529ec4
mov rax, rdx
mov ecx, 0x40
call fcn.00461f80
mov rax, qword [rsp + 0x68]
lea rdx, [rsp + 0x18]
test byte [rax], al
mov rbx, rdx
call fcn.0052a0e0
mov rax, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x005fe120]
lea rbx, [0x006847d0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.00529e60
Function at 0x52b280
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xd0]
cmp r12, qword [r14 + 0x10]
jbe 0x52b4bd
sub rsp, 0x150
mov qword [rsp + 0x148], rbp
lea rbp, [rsp + 0x148]
lea rdi, [rsp + 0x158]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004618b4
mov rbp, qword [rbp]
cmp byte [rax + 0x1f], 0x7f
ja 0x52b4a9
nop dword [rax]
cmp rbx, 2
jb 0x52b496
cmp rbx, 8
ja 0x52b483
mov qword [rsp + 0x258], rax
mov qword [rsp + 0x260], rbx
lea rdi, [rsp + 0x48]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004618b4
mov rbp, qword [rbp]
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
xor ecx, ecx
jmp 0x52b380
mov qword [rsp + 0x18], rcx
shl rcx, 3
lea rbx, [rcx - 0x20]
mov rsi, rbx
sar rbx, 0x3f
and rcx, rbx
lea rdi, [rax + rcx]
neg rsi
mov rbx, rsi
mov rcx, rbx
mov rax, rdi
call fcn.004d37a0
mov rdx, qword [rsp + 0x18]
mov qword [rsp + rdx*8 + 0x20], rax
lea rcx, [rdx + 1]
mov rax, qword [rsp + 0x258]
mov rbx, qword [rsp + 0x260]
nop dword [rax]
cmp rcx, 4
jl 0x52b332
mov rcx, rbx
mov eax, 1
shl rax, cl
lea rdx, [rax - 1]
xor esi, esi
xor edi, edi
jmp 0x52b3a4
mov rax, r10
mov rcx, rbx
mov rsi, r8
cmp rsi, 0x100
jae 0x52b44a
mov r8, rsi
shr rsi, 6
mov r9, r8
and r8d, 0x3f
lea r10, [rcx - 0x40]
neg r10
cmp r10, r8
jbe 0x52b3d8
mov r8, qword [rsp + rsi*8 + 0x20]
mov rcx, r9
shr r8, cl
jmp 0x52b405
lea r10, [r8 - 0x40]
neg r10
cmp r10, 0x40
sbb r8, r8
mov r10, qword [rsp + rsi*8 + 0x20]
mov rcx, r9
shr r10, cl
mov r11, qword [rsp + rsi*8 + 0x28]
neg rcx
shl r11, cl
and r8, r11
or r8, r10
mov rcx, r9
and r8, rdx
add r8, rdi
bt r8d, 0
jb 0x52b41b
lea r8, [rcx + 1]
mov r10, rax
jmp 0x52b39b
mov r10, rax
shr rax, 1
cmp rax, r8
jbe 0x52b42d
mov byte [rsp + rcx + 0x48], r8b
jmp 0x52b43b
mov r11, r8
sub r8d, r10d
mov byte [rsp + rcx + 0x48], r8b
cmp rax, r11
setbe al
movzx edi, al
lea r8, [rcx + rbx]
jmp 0x52b39b
lea rdi, [rsp + 0x158]
lea rsi, [rsp + 0x48]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00461bc0
mov rbp, qword [rbp]
mov rbp, qword [rsp + 0x148]
add rsp, 0x150
ret
lea rax, [0x005fe120]
lea rbx, [0x00684800]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x006847f0]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x006847e0]
call fcn.00436780
nop
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rbx
call fcn.0045f280
mov rax, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
jmp fcn.0052b280
Function at 0x52cae0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52cbda
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop dword [rax + rax]
test rax, rax
je 0x52cbc1
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
call fcn.004d3280
mov rcx, qword [rsp + 0x38]
nop dword [rax]
cmp rax, rcx
jne 0x52cb96
mov qword [rsp + 0x18], rax
mov rbx, qword [0x007dde90]
lea rax, [0x00608d40]
mov rcx, qword [rsp + 0x30]
nop dword [rax]
call fcn.004118e0
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
test bl, bl
je 0x52cb6b
mov rax, qword [rsp + 0x18]
mov rbx, rdx
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006524e4]
mov ebx, 0x25
call fcn.00468600
xor ecx, ecx
mov rdi, rcx
mov rsi, rax
mov r8, rbx
mov rax, rcx
xor ebx, ebx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0065355f]
mov ebx, 0x28
call fcn.00468600
xor ecx, ecx
mov rdi, rcx
mov rsi, rax
mov r8, rbx
mov rax, rcx
xor ebx, ebx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rbx
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
xor esi, esi
mov r8, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0052cae0
Function at 0x52f320
Capabilities:
Authenticate hmac
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52f53e
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
lea rax, [0x0062d1c0]
call fcn.0040d1e0
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx]
call rcx
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rbx
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rdx]
call rbx
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rbx
mov byte [rsp + 0x27], 1
mov rax, rcx
lea rbx, [rsp + 0x27]
call fcn.0052f580
cmp byte [rsp + 0x27], 0
je 0x52f52a
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x40]
mov rax, qword [rcx + 0x48]
mov rdx, qword [rdx + 0x18]
call rdx
mov qword [rsp + 0x28], rax
mov rbx, rax
mov rcx, rbx
lea rax, [0x005fe2e0]
call fcn.00448e60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rcx
mov qword [rdx + 0x28], rcx
mov qword [rdx + 0x18], rax
lea rax, [0x005fe2e0]
mov rbx, rcx
call fcn.00448e60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 8], rcx
mov qword [rdx + 0x10], rcx
mov qword [rdx], rax
mov rbx, qword [rsp + 0x68]
cmp rcx, rbx
jl 0x52f41d
mov rax, qword [rsp + 0x60]
jmp 0x52f457
mov rsi, qword [rdx + 0x30]
mov rax, qword [rdx + 0x38]
mov rsi, qword [rsi + 0x38]
mov rcx, rbx
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
call rsi
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rdx + 0x38]
mov rsi, qword [rsi + 0x30]
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdx + 0x20]
cmp rbx, rcx
cmovl rcx, rbx
mov rsi, qword [rdx + 0x18]
cmp rax, rsi
je 0x52f494
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rax
mov rbx, rax
mov rax, rsi
nop dword [rax + rax]
call fcn.00461f80
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdx + 8]
cmp rbx, rcx
cmovl rcx, rbx
mov rsi, qword [rdx]
cmp rax, rsi
je 0x52f4b7
mov rbx, rax
mov rax, rsi
call fcn.00461f80
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rdx + 0x20]
xor eax, eax
jmp 0x52f4d3
mov r8, qword [rdx + 0x18]
movzx r9d, byte [rax + r8]
xor r9d, 0x36
mov byte [r8 + rax], r9b
inc rax
cmp rax, rsi
jl 0x52f4bf
mov rsi, qword [rdx + 8]
xor eax, eax
nop
jmp 0x52f4f5
mov r8, qword [rdx]
movzx r9d, byte [rax + r8]
xor r9d, 0x5c
mov byte [r8 + rax], r9b
inc rax
cmp rax, rsi
jl 0x52f4e2
mov rsi, qword [rdx + 0x40]
mov rax, qword [rdx + 0x48]
mov rsi, qword [rsi + 0x38]
mov rbx, qword [rdx + 0x18]
mov rcx, qword [rdx + 0x20]
mov rdi, qword [rdx + 0x28]
call rsi
lea rax, [0x00687528]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x005fe120]
lea rbx, [0x00684840]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0052f320
Function at 0x534460
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x534652
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x68], rcx
mov rdx, qword [rax + 0x60]
test rdx, rdx
jle 0x53457a
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x20]
cmp rbx, rdx
je 0x5344f0
mov rax, rdx
mov rcx, rsi
call fcn.00461f80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x60]
add rdx, rsi
mov qword [rax + 0x60], rdx
nop dword [rax + rax]
cmp rdx, 0x40
jne 0x53455f
mov qword [rsp], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00534c20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x534580
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x534603
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00534c20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
mov rcx, qword [rsp + 0x30]
mov rbx, rcx
sub rcx, rdx
sar rax, 0x3f
and rax, rbx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x534641
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x20]
cmp rbx, rdi
je 0x53463d
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00461f80
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.00534460