joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ecba0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ecd4b
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5ecbc7
inc rcx
cmp rbx, rcx
jle 0x5ecd3d
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5ecbc4
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.00561780
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x00892a90]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005e8c60
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5ecd2d
test rdx, rdx
je 0x5ecd1e
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5ecce9
xor eax, eax
lea rbx, [0x006a41e2]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006a4288]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044e8e0
jmp 0x5ecd10
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x007169c0]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044e800
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005ecba0
Function at 0x5ef7a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ef91d
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
cmp byte [rax + 0x98], 0
nop
jne 0x5ef7cc
cmp dword [rax + 0x30], 0
ja 0x5ef8c3
mov qword [rsp + 0x58], rax
mov rbx, qword [rax + 0x58]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rax + 0x68]
mov eax, 5
call fcn.005ef940
test rsi, rsi
jne 0x5ef8b3
mov rdx, qword [rsp + 0x58]
mov esi, dword [rdx + 0x38]
cmp rax, rsi
ja 0x5ef85f
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
nop
mov dword [rdx + 0x34], eax
mov rax, rdx
call fcn.005ee980
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov qword [rdi + 0x60], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rdi + 0x68], rcx
cmp dword [0x008f2cf0], 0
jne 0x5ef843
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x58], rcx
jmp 0x5ef851
add rdi, 0x58
mov rcx, qword [rsp + 0x30]
call fcn.004655a0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x23
lea rcx, [0x006b04b3]
mov qword [rax], rcx
lea rcx, [0x007191c0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00673580]
lea rbx, [rsp + 0x38]
call fcn.0040ad40
mov rbx, rax
lea rax, [0x00719ea0]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
mov rbx, r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x47
lea rcx, [0x006b7d32]
mov qword [rax], rcx
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x007191c0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00673580]
lea rbx, [rsp + 0x38]
call fcn.0040ad40
mov rbx, rax
lea rax, [0x00719ea0]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.005ef7a0
Function at 0x5f27a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f2891
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, qword [rbx]
mov rsi, qword [rbx + 8]
nop
cmp rsi, 5
jne 0x5f27e0
cmp dword [rdx], 0x70747468
jne 0x5f27e0
cmp byte [rdx + 4], 0x73
jne 0x5f27e0
mov rdx, qword [rax + 0x38]
jmp 0x5f2833
cmp rsi, 4
jne 0x5f2831
cmp dword [rdx], 0x70747468
jne 0x5f2831
mov rdx, qword [rax + 0x40]
test rdx, rdx
je 0x5f2833
cmp byte [rax + 0x30], 0
je 0x5f2833
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x52
lea rcx, [0x006b8575]
mov qword [rax], rcx
lea rbx, [0x007191c0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor edx, edx
test rdx, rdx
je 0x5f2881
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x18], rdx
mov rax, rbx
call fcn.005f3440
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x30]
call fcn.005f2a80
test al, al
je 0x5f2871
mov rax, qword [rsp + 0x18]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005f27a0
Function at 0x5f9540
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x5f976d
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
xor edx, edx
jmp 0x5f95c2
mov rdx, qword [rsp + 0x50]
inc rdx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xb8]
cmp rsi, rdx
jle 0x5f9693
mov qword [rsp + 0x50], rdx
mov rbx, qword [rcx]
movzx eax, byte [rdi + rdx]
mov rdx, rcx
call rbx
nop dword [rax]
test al, al
jne 0x5f9592
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xb8]
movzx ecx, byte [rdx + rcx]
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
lea rsi, [0x006578a0]
mov qword [rsp + 0x70], rsi
lea rdi, [0x00873ec0]
lea rcx, [rdi + rcx*8]
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, [0x006b62d9]
mov ebx, 0x37
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
call fcn.005d0ba0
lea rax, [0x006578a0]
xor ebx, ebx
mov rcx, qword [rsp + 0xc0]
nop dword [rax + rax]
call fcn.0044a840
xor ecx, ecx
mov rdx, qword [rsp + 0xc0]
xor ebx, ebx
jmp 0x5f96b7
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov rsi, qword [rsp + 0x48]
inc rsi
mov rdx, rcx
mov rcx, rsi
mov rsi, qword [rsp + 0xc0]
nop
cmp rsi, rcx
jle 0x5f9750
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rdx
mov rbx, qword [rsp + 0xb8]
movzx eax, byte [rbx + rcx]
mov byte [rsp + 0x47], al
mov rdx, qword [rsp + 0xb0]
mov rsi, qword [rdx]
call rsi
test al, al
je 0x5f973c
mov rbx, qword [rsp + 0x58]
inc rbx
mov rcx, qword [rsp + 0x60]
cmp rcx, rbx
jb 0x5f9717
mov rax, qword [rsp + 0x68]
jmp 0x5f972d
mov rax, qword [rsp + 0x68]
mov edi, 1
lea rsi, [0x006578a0]
call fcn.0044a920
movzx esi, byte [rsp + 0x47]
mov byte [rbx + rax - 1], sil
jmp 0x5f96a9
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
jmp 0x5f96a9
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044eb00
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.005f9540
Function at 0x5fbac0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x5fbc16
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0x2c], ebx
nop word [rax + rax]
test rcx, rcx
je 0x5fbbac
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
call fcn.0040aec0
lea rcx, [0x00657820]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x2c]
call fcn.0040aec0
lea rcx, [0x006653c0]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x30]
nop dword [rax]
test rcx, rcx
je 0x5fbb69
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x80], rcx
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x88], rdx
lea rax, [0x006b0198]
mov ebx, 0x22
lea rcx, [rsp + 0x60]
mov edi, 3
mov rsi, rdi
call fcn.004f8500
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
call fcn.0040aec0
lea rcx, [0x00657820]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x2c]
call fcn.0040aec0
lea rcx, [0x006653c0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x006ae4f3]
mov ebx, 0x1e
lea rcx, [rsp + 0x40]
mov edi, 2
mov rsi, rdi
call fcn.004f8500
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov dword [rsp + 8], eax
mov dword [rsp + 0xc], ebx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
call fcn.004632e0
mov eax, dword [rsp + 8]
mov ebx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
nop
jmp fcn.005fbac0
Function at 0x5fc760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5fc983
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
cmp qword [rax + 0xb8], 0
jne 0x5fc822
lea rax, [0x0067c360]
call fcn.0040d960
cmp dword [0x008f2cf0], 0
nop
jne 0x5fc7b0
mov rdx, qword [rsp + 0x50]
mov qword [rdx + 0xc0], rax
jmp 0x5fc7c5
mov rdi, qword [rsp + 0x50]
lea rdx, [rdi + 0xc0]
mov rdi, rdx
nop
call fcn.004654a0
xor ebx, ebx
lea rcx, [0x00719080]
mov rdi, rax
xor eax, eax
call fcn.005fc9a0
cmp dword [0x008f2cf0], 0
nop
jne 0x5fc7f0
mov rdx, qword [rsp + 0x50]
mov qword [rdx + 0xb8], rax
jmp 0x5fc80a
mov rdi, qword [rsp + 0x50]
lea rdx, [rdi + 0xb8]
mov rcx, rdi
mov rdi, rdx
call fcn.004654a0
mov rdx, rcx
mov byte [rax + 0xb4], 0
mov rsi, qword [rdx + 0xb8]
mov byte [rsi + 0xa1], 1
mov rax, rdx
mov rdx, qword [rax + 0xc0]
mov rbx, qword [rax + 0x88]
mov rcx, qword [rax + 0x90]
mov rdi, qword [rax + 0x98]
mov rax, rdx
call fcn.00476da0
mov rdx, qword [rsp + 0x50]
mov rax, qword [rdx + 0xb8]
call fcn.005fcbe0
test rcx, rcx
je 0x5fc8c2
lea rax, [0x006589e0]
call fcn.0040d960
lea rcx, [0x0069af40]
mov qword [rax], rcx
cmp dword [0x008f2cf0], 0
jne 0x5fc886
mov r8, qword [rsp + 0x50]
mov qword [rax + 8], r8
jmp 0x5fc894
lea rdi, [rax + 8]
mov r8, qword [rsp + 0x50]
call fcn.00465620
mov rdx, qword [r8 + 0xd0]
mov r8, qword [rdx]
mov ebx, 0x35
mov rcx, rax
mov edi, 1
mov rsi, rdi
lea rax, [0x006b5c19]
call r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00601600
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
lea rax, [0x00659280]
call fcn.0040d960
mov qword [rsp + 0x30], rax
lea rcx, [0x0069af40]
mov qword [rax], rcx
cmp dword [0x008f2cf0], 0
jne 0x5fc902
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
nop
jmp 0x5fc910
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x50]
call fcn.004655a0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.0040afc0
lea rcx, [0x006576e0]
mov rdi, qword [rsp + 0x30]
mov qword [rdi + 0x10], rcx
cmp dword [0x008f2cf0], 0
jne 0x5fc93e
mov qword [rdi + 0x18], rax
jmp 0x5fc950
lea r8, [rdi + 0x18]
mov rcx, rdi
mov rdi, r8
call fcn.004654a0
mov rdi, rcx
mov r8, qword [rsp + 0x50]
mov rdx, qword [r8 + 0xd0]
mov r8, qword [rdx]
lea rax, [0x006ac591]
mov ebx, 0x1a
mov rcx, rdi
mov edi, 2
mov rsi, rdi
call r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.005fc760
Function at 0x5fde60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5fdf8c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [rax], 0
nop dword [rax + rax]
je 0x5fdf78
xor ecx, ecx
jmp 0x5fde90
inc rcx
mov rax, r8
mov rdx, qword [rax + 0x20]
mov rsi, qword [rax + 0x10]
mov rdi, qword [rax + 0x18]
mov r8, rax
movabs rax, 0xaaaaaaaaaaaaaaab
mov r9, rdx
imul rdi
add rdi, rdx
sar rdi, 2
cmp rcx, rdi
jge 0x5fdf44
lea rax, [rcx + rcx*2]
lea rdi, [rax + rax]
lea rdi, [rdi + 2]
cmp r9, rdi
jb 0x5fdf6d
mov r10, rax
shl rax, 1
nop word [rax + rax]
cmp rdi, rax
jb 0x5fdf65
mov rdx, r9
sub r9, rax
mov r11, r9
neg r9
sar r9, 0x3f
and rax, r9
lea r9, [r10 + r10]
lea r9, [r9 + 6]
movzx r10d, word [rsi + rax]
cmp rdx, r9
jb 0x5fdf5d
cmp r9, rdi
jb 0x5fdf52
lea r9, [r11 - 2]
neg r9
sar r9, 0x3f
and rdi, r9
rol r10w, 8
mov eax, dword [rsi + rdi]
cmp bx, r10w
jne 0x5fde8a
bswap eax
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdi
mov rcx, r9
call fcn.00465a00
mov rcx, r9
call fcn.004659c0
mov rcx, rdi
call fcn.00465a00
mov rcx, rdi
mov rdx, r9
call fcn.004659c0
lea rax, [0x006576e0]
lea rbx, [0x00718830]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.004632e0
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
jmp fcn.005fde60

Function at 0x5fdfc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5fe106
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp byte [rax], 0
nop dword [rax + rax]
je 0x5fe0f2
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
xor ecx, ecx
jmp 0x5fe006
mov rcx, qword [rsp + 0x10]
inc rcx
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rax + 0x20]
mov rsi, qword [rax + 0x10]
mov rdi, qword [rax + 0x18]
movabs rax, 0xaaaaaaaaaaaaaaab
mov r9, rdx
imul rdi
add rdi, rdx
sar rdi, 2
cmp rcx, rdi
jge 0x5fe0be
lea rax, [rcx + rcx*2]
lea rdi, [rax + rax]
lea rdi, [rdi + 2]
nop
cmp r9, rdi
jb 0x5fe0e7
mov r10, rax
shl rax, 1
cmp rdi, rax
jb 0x5fe0df
mov rdx, r9
sub r9, rax
mov r11, r9
neg r9
sar r9, 0x3f
and rax, r9
lea r9, [r10 + r10]
lea r9, [r9 + 6]
movzx eax, word [rsi + rax]
cmp rdx, r9
jb 0x5fe0d7
nop dword [rax]
cmp r9, rdi
jb 0x5fe0cc
mov qword [rsp + 0x10], rcx
mov rcx, qword [rbx]
lea r8, [r11 - 2]
neg r8
sar r8, 0x3f
and rdi, r8
rol ax, 8
mov esi, dword [rsi + rdi]
bswap esi
mov rdx, rbx
mov ebx, esi
call rcx
test rax, rax
je 0x5fdff4
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rdi
mov rcx, r9
call fcn.00465a00
mov rcx, r9
call fcn.004659c0
mov rcx, rdi
call fcn.00465a00
mov rcx, rdi
mov rdx, r9
call fcn.004659c0
lea rax, [0x006576e0]
lea rbx, [0x00718830]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.005fdfc0
Function at 0x6055a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x118]
cmp r12, qword [r14 + 0x10]
jbe 0x6057c7
sub rsp, 0x198
mov qword [rsp + 0x190], rbp
lea rbp, [rsp + 0x190]
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x1b8], rdi
mov qword [rsp + 0x1c8], r8
mov rdx, qword [rax]
test rdx, rdx
jne 0x60579c
mov rdx, qword [rax + 8]
nop dword [rax]
test rdx, rdx
jne 0x605777
call fcn.00601ce0
test rbx, rbx
jne 0x60575d
mov qword [rsp + 0xb8], rax
nop
call fcn.005aa000
lea rdi, [rsp + 0xe0]
mov rsi, rsp
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465f26
mov rbp, qword [rbp]
mov rax, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xf0]
cmp rbx, 2
jne 0x605674
cmp word [rax], 0x3268
je 0x6056f4
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
call fcn.0040afc0
lea rcx, [0x006576e0]
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rcx
lea rcx, [0x00718750]
mov qword [rsp + 0xd8], rcx
lea rax, [0x006b31c2]
mov ebx, 0x2b
lea rcx, [rsp + 0xc0]
mov edi, 2
mov rsi, rdi
call fcn.004f54c0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
cmp byte [rsp + 0xf8], 0
je 0x605721
lea rax, [0x0071c278]
mov rbx, qword [rsp + 0xb8]
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x2c
lea rcx, [0x006b367f]
mov qword [rax], rcx
xor ebx, ebx
lea rcx, [0x007191c0]
mov rdi, rax
xor eax, eax
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
xor eax, eax
mov rdi, rcx
mov rcx, rbx
xor ebx, ebx
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
mov r11, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
mov rsi, r10
call r11
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
mov r11, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
mov r9, r10
call r11
mov rbp, qword [rsp + 0x190]
add rsp, 0x198
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
nop dword [rax]
jmp fcn.006055a0
Function at 0x606620
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60676f
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov r13, 0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x2f], 0
mov rdx, qword [rax]
cmp qword [rdx + 0x48], 0
jne 0x606664
movabs rdx, 0x37e11d600
jmp 0x606668
mov rdx, qword [rdx + 0x48]
mov rbx, qword [0x0089c338]
lea rax, [0x0071b0c8]
mov rcx, rdx
call fcn.00548520
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x2f], 1
nop
nop
cmp byte [0x008f2850], 0
je 0x6066c0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
nop
lea rax, [0x006b1346]
mov ebx, 0x25
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.005d0ba0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x68]
call fcn.00611a00
test rax, rax
je 0x606722
movups xmmword [rsp + 0x40], xmm15
je 0x6066e1
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
nop
cmp byte [0x008f2850], 0
je 0x606714
nop
lea rax, [0x006b2945]
mov ebx, 0x29
lea rcx, [rsp + 0x40]
mov edi, 1
mov rsi, rdi
call fcn.005d0ba0
mov rax, qword [rsp + 0x68]
call fcn.00607580
nop
jmp 0x606746
nop
nop
cmp byte [0x008f2850], 0
je 0x606746
nop
lea rax, [0x006b1321]
mov ebx, 0x25
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.005d0ba0
mov byte [rsp + 0x2f], 0
mov rdx, qword [rsp + 0x50]
mov rax, qword [rdx]
call rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
nop
jmp fcn.00606620
Function at 0x6068e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x606b0d
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov r13, 0
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov byte [rsp + 0x1b], 0
mov rcx, rax
xor eax, eax
mov edx, 1
lock cmpxchg dword [rcx + 0x58], edx
sete dl
lea rax, [rcx + 0x58]
test dl, dl
jne 0x606963
mov qword [rsp + 0x28], rax
call fcn.0046e200
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
movups xmmword [rsp + 0x30], xmm15
lea rdx, [0x00606b40]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0xa0], rdx
mov byte [rsp + 0x1b], 1
mov rdx, qword [rcx + 0x90]
cmp dword [0x008f2cf0], 0
jne 0x6069a5
mov qword [rcx + 0x90], rbx
jmp 0x6069b1
lea rdi, [rcx + 0x90]
call fcn.004655e0
cmp qword [rcx + 0xa0], 0
jne 0x606a23
cmp byte [rbx], 0
nop
je 0x606ae4
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x20]
xor eax, eax
mov rbx, rdx
call fcn.0044eb00
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 0xa0], rbx
cmp dword [0x008f2cf0], 0
jne 0x6069fe
mov qword [rdi + 0x98], rax
jmp 0x606a13
lea rdx, [rdi + 0x98]
mov rcx, rdi
mov rdi, rdx
call fcn.004654a0
mov rdi, rcx
mov rcx, rdi
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0xc0]
test rdx, rdx
je 0x606a39
mov edx, dword [rdx + 0x10]
test edx, edx
je 0x606a39
mov rsi, qword [rcx + 0x90]
mov dword [rsi + 0x10], edx
mov edx, dword [rbx + 0xc]
mov dword [rsp + 0x1c], edx
mov rbx, qword [rcx + 0xa8]
lea rdi, [rsp + 0x40]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465c0b
mov rbp, qword [rbp]
lea rax, [0x00664100]
lea rcx, [rsp + 0x40]
nop
call fcn.0040f920
jmp 0x606a91
lea rax, [rsp + 0x40]
call fcn.0040fba0
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x606ac2
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx]
mov edx, dword [rsp + 0x1c]
cmp dword [rsi], edx
jbe 0x606a87
mov rbx, qword [0x0089d8b0]
mov rcx, qword [0x0089d8b8]
call fcn.00603f20
nop
jmp 0x606a87
mov byte [rsp + 0x1b], 0
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rdx]
call rax
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006576e0]
lea rbx, [0x00718830]
call fcn.00436420
nop
call fcn.004358c0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.006068e0
Function at 0x607200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60736f
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov rcx, rax
xor eax, eax
mov edx, 1
lock cmpxchg dword [rcx + 0x58], edx
sete dl
lea rax, [rcx + 0x58]
test dl, dl
jne 0x60724f
mov qword [rsp + 0x30], rax
nop dword [rax]
call fcn.0046e200
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx + 0xa8]
test rdx, rdx
je 0x607262
mov rdx, qword [rdx]
nop
jmp 0x607264
xor edx, edx
test rdx, rdx
jg 0x607273
cmp qword [rcx + 0xb0], 0
jle 0x607293
nop
mov ebx, 0xffffffff
lock xadd dword [rcx + 0x58], ebx
dec ebx
test ebx, ebx
je 0x607289
call fcn.0046e500
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rcx + 0x8a], 1
mov edx, dword [rcx + 0xb8]
nop
mov ebx, 0xffffffff
lock xadd dword [rcx + 0x58], ebx
dec ebx
test ebx, ebx
je 0x6072c3
mov dword [rsp + 0x2c], edx
call fcn.0046e500
mov rcx, qword [rsp + 0x78]
mov edx, dword [rsp + 0x2c]
cmp byte [0x008f2850], 0
je 0x60735a
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
lea rbx, [0x0069cbe0]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
movzx ebx, byte [rcx + 0x2c]
lea rsi, [0x00655960]
mov qword [rsp + 0x48], rsi
lea rsi, [0x00873ec0]
lea rbx, [rsi + rbx*8]
mov qword [rsp + 0x50], rbx
lea eax, [rdx - 2]
call fcn.0040aec0
lea rcx, [0x00657820]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
nop
cmp byte [0x008f2850], 0
je 0x607355
nop
lea rax, [0x006b7b91]
mov ebx, 0x45
lea rcx, [rsp + 0x38]
mov edi, 3
mov rsi, rdi
call fcn.005d0ba0
mov rcx, qword [rsp + 0x78]
mov rax, rcx
nop dword [rax]
call fcn.00607020
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
nop
jmp fcn.00607200