joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e49c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e4b26
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x4e4b09
lea rax, [0x006445e0]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp + 0x20], rax
cmp dword [0x00811460], 0
jne 0x4e4aea
mov qword [rax], 0
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm0
movups xmmword [rax + 0x28], xmm0
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
cmp dword [0x00811460], 0
jne 0x4e4ad6
mov rdx, qword [rsp + 0x40]
mov qword [rax + 8], rdx
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
lea rcx, [0x006a57c8]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.004e4b40
lea rax, [0x00627e20]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.0040e560
mov rax, qword [rsp + 8]
lea rcx, [0x004e65e0]
mov qword [rax], rcx
cmp dword [0x00811460], 0
jne 0x4e4ac6
mov rcx, qword [rsp + 0x20]
mov qword [rax + 8], rcx
lea rdx, [0x006a74b8]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x20]
call fcn.0046ca20
jmp 0x4e4aa6
lea rdi, [rax + 8]
mov rdx, qword [rsp + 0x40]
nop
call fcn.0046ca40
jmp 0x4e4a51
lea rcx, [0x006445e0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004155e0
mov rax, qword [rsp + 0x20]
jmp 0x4e4a33
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1120]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004e49c0
Function at 0x4e5500
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x10]
cmp rax, qword [rcx + 0x10]
jbe 0x4e57c0
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov rcx, qword [rsp + 0xa8]
nop
test rcx, rcx
je 0x4e579f
xor eax, eax
mov rdx, qword [rsp + 0x98]
mov ebx, 1
lock cmpxchg dword [rdx + 0x10], ebx
sete bl
lea rsi, [rdx + 0x10]
mov qword [rsp + 0x20], rsi
test bl, bl
je 0x4e577a
cmp qword [rdx + 0x28], 0
jne 0x4e574a
mov rax, qword [rsp + 0xa8]
mov qword [rdx + 0x28], rax
cmp dword [0x00811460], 0
jne 0x4e5732
mov rax, qword [rsp + 0xb0]
mov qword [rdx + 0x30], rax
mov rbx, qword [rdx + 0x18]
test rbx, rbx
jne 0x4e5718
mov rbx, qword [0x007cb670]
cmp dword [0x00811460], 0
nop dword [rax]
jne 0x4e570a
mov qword [rdx + 0x18], rbx
mov rax, qword [rdx + 0x20]
lea rdi, [rsp + 0x28]
xorps xmm0, xmm0
lea rdi, [rdi - 0x20]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046d051
mov rbp, qword [rbp]
lea rcx, [0x0061c8a0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x10], rax
call fcn.004108c0
jmp 0x4e5652
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov rcx, qword [rcx + 0x20]
mov qword [rsp], rax
mov byte [rsp + 8], 0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x10], rax
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x18], rdx
call rcx
lea rax, [rsp + 0x28]
mov qword [rsp], rax
call fcn.00410b80
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x4e5614
cmp dword [0x00811460], 0
jne 0x4e56ef
mov rax, qword [rsp + 0x98]
mov qword [rax + 0x20], 0
nop
mov ecx, 0xffffffff
lock xadd dword [rax + 0x10], ecx
dec ecx
test ecx, ecx
jne 0x4e56ce
movzx ecx, byte [rsp + 0xa0]
test cl, cl
jne 0x4e56a6
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
lea rcx, [0x006a57c8]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.004e4f60
jmp 0x4e5696
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov dword [rsp + 8], ecx
nop dword [rax + rax]
call fcn.004848c0
mov rax, qword [rsp + 0x98]
jmp 0x4e568a
mov rax, qword [rsp + 0x98]
lea rdi, [rax + 0x20]
xor ecx, ecx
nop dword [rax]
call fcn.0046ca20
jmp 0x4e5679
lea rdi, [rdx + 0x18]
call fcn.0046ca60
jmp 0x4e55ca
mov qword [rsp], rbx
nop dword [rax]
call fcn.00406360
mov rdx, qword [rsp + 0x98]
jmp 0x4e55ca
lea rdi, [rdx + 0x30]
mov rax, qword [rsp + 0xb0]
nop
call fcn.0046c920
jmp 0x4e55a1
nop
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jne 0x4e576b
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp], rsi
mov dword [rsp + 8], eax
call fcn.004848c0
jmp 0x4e575b
mov qword [rsp], rsi
nop
call fcn.00484580
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x20]
jmp 0x4e5571
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1130]
mov qword [rsp + 8], rax
call fcn.00438920
nop
nop dword [rax]
call fcn.0046abe0
jmp fcn.004e5500
Function at 0x4e5f20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e6092
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x38]
test byte [rax], al
mov qword [rsp], rax
mov byte [rsp + 8], 0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rcx
call fcn.004e5500
movzx eax, byte [rsp + 0x40]
test al, al
jne 0x4e6045
xor eax, eax
mov rcx, qword [rsp + 0x38]
mov edx, 1
lock cmpxchg dword [rcx + 0x10], edx
sete dl
lea rbx, [rcx + 0x10]
mov qword [rsp + 0x20], rbx
nop dword [rax + rax]
test dl, dl
je 0x4e602c
mov rax, qword [rcx + 0x38]
test rax, rax
je 0x4e6027
nop
cmp qword [rax + 0x20], 0
je 0x4e6075
add rax, 8
mov qword [rsp], rax
call fcn.00469a60
cmp dword [0x00811460], 0
jne 0x4e6010
mov rax, qword [rsp + 0x38]
mov qword [rax + 0x38], 0
nop
mov ecx, 0xffffffff
lock xadd dword [rax + 0x10], ecx
lea eax, [rcx - 1]
test eax, eax
jne 0x4e5ffc
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rcx, qword [rsp + 0x20]
mov qword [rsp], rcx
mov dword [rsp + 8], eax
call fcn.004848c0
jmp 0x4e5ff2
mov rax, qword [rsp + 0x38]
lea rdi, [rax + 0x38]
xor ecx, ecx
nop dword [rax + rax]
call fcn.0046ca20
jmp 0x4e5fe0
mov rax, rcx
jmp 0x4e5fe0
mov qword [rsp], rbx
call fcn.00484580
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x4e5fa8
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
lea rcx, [0x006a57f0]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.004e4f60
jmp 0x4e5f7e
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1590]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004e5f20
Function at 0x4e60a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4e6246
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x4e6225
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
test rax, rax
je 0x4e6205
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x10]
nop dword [rax]
test rcx, rcx
je 0x4e61da
lea rdx, [0x006a91a8]
mov rax, qword [rdx + 0x20]
mov qword [rsp], rcx
call rax
cmp byte [rsp + 8], 0
nop
je 0x4e61e5
lea rax, [0x00641140]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
cmp dword [0x00811460], 0
jne 0x4e61c7
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
cmp dword [0x00811460], 0
jne 0x4e61b6
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x20], rcx
cmp dword [0x00811460], 0
jne 0x4e61a6
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x28], rcx
lea rcx, [0x006a7560]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x58]
call fcn.0046ca20
jmp 0x4e618b
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x48]
nop
call fcn.0046ca20
jmp 0x4e6170
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x38]
call fcn.0046ca20
jmp 0x4e6155
xor edx, edx
xor ecx, ecx
nop
jmp 0x4e6110
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1150]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1140]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1120]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004e60a0
Function at 0x4f57e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4f5986
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x3f], xmm0
movups xmmword [rsp + 0x48], xmm0
mov rax, qword [rsp + 0x70]
cmp rax, 0x19
mov ecx, 0x19
cmovl rcx, rax
mov qword [rsp + 0x30], rcx
lea rbx, [rsp + 0x3f]
mov rsi, qword [rsp + 0x68]
cmp rbx, rsi
jne 0x4f594b
nop
cmp rcx, 0x19
ja 0x4f597a
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x19
nop dword [rax]
call fcn.004f9cc0
mov rax, qword [0x007cc388]
lea rcx, [0x0061d1a0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
call fcn.00414100
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp byte [rsp + 0x28], 0
je 0x4f58b3
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x30]
cmp rcx, rdx
je 0x4f5931
lea rax, [0x0062e060]
mov qword [rsp], rax
nop
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x1d
lea rcx, [0x0066287e]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x00811460], 0
jne 0x4f5921
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x78], 0
lea rcx, [0x006a4900]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x68]
call fcn.0046ca20
jmp 0x4f58f7
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
call fcn.0046d6c0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
lea rbx, [rsp + 0x3f]
mov rsi, qword [rsp + 0x68]
xorps xmm0, xmm0
jmp 0x4f5840
mov edx, 0x19
nop
call fcn.0046ce00
nop
call fcn.0046abe0
jmp fcn.004f57e0
Function at 0x5136c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x513980
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x27], 0
mov rcx, qword [rsp + 0x78]
nop word [rax + rax]
test rcx, rcx
je 0x513950
xor eax, eax
lea rdx, [0x007cdde0]
mov ebx, 1
lock cmpxchg dword [rdx], ebx
sete dl
nop
test dl, dl
je 0x513936
lea rax, fcn.00484860
mov qword [rsp + 0x60], rax
lea rax, [0x007cdde0]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x27], 1
mov rax, qword [0x007cdde8]
lea rdx, [0x0061c840]
mov qword [rsp], rdx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
call fcn.004128e0
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x513886
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00513dc0]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x88]
test rax, rax
jne 0x5137e3
xor eax, eax
nop
jmp 0x5137c0
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp], rax
lea rdx, [rsp + 0x48]
call rcx
mov rax, qword [rsp + 0x28]
inc rax
nop
cmp rax, 0x41
jl 0x5137a2
mov byte [rsp + 0x27], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.00484860
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x80]
xor edx, edx
jmp 0x513806
mov rbx, qword [rsp + 0x40]
add rbx, 0x10
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x40], rcx
mov rbx, qword [rcx]
mov rsi, qword [rcx + 8]
test rbx, rbx
je 0x51387d
cmp dword [rbx + 0x10], 0xf037dad7
jne 0x513874
lea rdi, [0x006a5ef8]
cmp rbx, rdi
jne 0x51386b
mov rbx, qword [rsi]
cmp rbx, 0x41
jb 0x513841
mov rbx, 0xffffffffffffffff
mov rax, qword [rsp + 0x48]
mov qword [rsp], rbx
lea rdx, [rsp + 0x48]
call rax
mov rax, qword [rsp + 0x30]
inc rax
mov rcx, qword [rsp + 0x88]
cmp rax, rcx
jl 0x5137ef
jmp 0x5137c6
mov rbx, 0xffffffffffffffff
jmp 0x513841
lea rdi, [0x006a5ef8]
jmp 0x51386b
lea rdi, [0x006a5ef8]
jmp 0x51386b
cmp qword [0x007cdde8], 0
je 0x513905
lea rax, [0x00626f20]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp + 0x38], rax
mov rcx, qword [0x007cdde8]
lea rdx, [0x0061c840]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x10], rcx
call fcn.00412fe0
mov rdi, qword [rsp + 0x18]
test byte [rdi], al
cmp dword [0x00811460], 0
jne 0x5138f2
mov rax, qword [rsp + 0x38]
mov qword [rdi], rax
jmp 0x513777
mov rax, qword [rsp + 0x38]
call fcn.0046c920
nop dword [rax]
jmp 0x513777
call fcn.0040f1c0
mov rax, qword [rsp]
cmp dword [0x00811460], 0
jne 0x513925
mov qword [0x007cdde8], rax
nop
jmp 0x513890
lea rdi, [0x007cdde8]
call fcn.0046c920
jmp 0x513890
lea rax, [0x007cdde0]
mov qword [rsp], rax
call fcn.00484580
mov rcx, qword [rsp + 0x78]
jmp 0x513728
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a15e0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.00437960
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
call fcn.0046abe0
jmp fcn.005136c0
Function at 0x514320
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x51442e
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
lea rbx, [rax - 1]
cmp rbx, 0x13
jae 0x514399
mov rcx, qword [0x007cd3a8]
mov rbx, qword [0x007cd3a0]
cmp rax, rcx
jae 0x514428
mov rdx, qword [rbx + rax*8]
test rdx, rdx
je 0x514399
mov rax, qword [rdx]
call rax
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.0047fda0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], 0
lea rdx, [0x00663b39]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x21
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
lea rax, [0x0065cc0f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0xf
call fcn.00451ee0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
call fcn.0046cde0
nop
call fcn.0046abe0
jmp fcn.00514320
Function at 0x529bc0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x529cb1
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
mov rax, rbx
xor ecx, ecx
jmp 0x529c3a
inc r9
shr r8, 8
mov rbx, r10
cmp r9, 8
jge 0x529c37
lea r10, [rbx - 1]
test r10, r10
jl 0x529c30
nop dword [rax]
cmp rax, r10
jbe 0x529ca5
mov byte [rbx + rsi - 1], r8b
jmp 0x529c03
test r8b, r8b
je 0x529c03
jmp 0x529c86
inc rcx
cmp rdx, rcx
jle 0x529c48
mov r8, qword [rdi + rcx*8]
xor r9d, r9d
jmp 0x529c0d
test rbx, rbx
jge 0x529c73
xor ecx, ecx
jmp 0x529c54
inc rcx
cmp rax, rcx
jle 0x529c64
jbe 0x529c78
movzx edx, byte [rsi + rcx]
nop
test dl, dl
je 0x529c51
mov qword [rsp + 0x50], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
jmp 0x529c54
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.0046cdc0
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1520]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
mov rcx, rax
mov rax, r10
call fcn.0046cdc0
nop
call fcn.0046abe0
jmp fcn.00529bc0
Function at 0x529cc0
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x529ec0
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
lea rbx, [rcx + 7]
sar rbx, 0x3f
shr rbx, 0x3d
lea rbx, [rbx + rcx]
lea rbx, [rbx + 7]
sar rbx, 3
mov rdx, qword [rsp + 0x50]
cmp rbx, rdx
jg 0x529e0a
ja 0x529eb5
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov r8, rcx
xor r9d, r9d
jmp 0x529d40
bswap rdi
mov qword [rax + r9*8], rdi
inc r9
mov rdi, r10
mov rcx, r11
cmp rcx, 8
jl 0x529d6d
mov r10, rdi
sub rdi, rcx
add rdi, 8
neg rdi
sar rdi, 0x3f
lea r11, [rcx - 8]
and rdi, r11
nop
mov rdi, qword [rsi + rdi]
cmp rbx, r9
ja 0x529d30
jmp 0x529eaa
test rcx, rcx
jle 0x529dce
xor edi, edi
xor r9d, r9d
jmp 0x529da0
cmp rdi, 0x40
sbb r11, r11
lea r12, [rdi + 8]
movzx r13d, byte [rcx + rsi - 1]
mov rcx, rdi
shl r13, cl
and r13, r11
or r9, r13
mov rcx, r10
mov rdi, r12
nop dword [rax]
test rcx, rcx
jle 0x529db3
lea r10, [rcx - 1]
cmp r8, r10
ja 0x529d79
jmp 0x529e9f
lea rsi, [rbx - 1]
nop word [rax + rax]
cmp rbx, rsi
jbe 0x529e94
mov qword [rax + rbx*8 - 8], r9
jmp 0x529dd3
dec rbx
test rbx, rbx
jle 0x529de5
mov rsi, qword [rax + rbx*8 - 8]
nop dword [rax]
test rsi, rsi
je 0x529dd0
cmp rdx, rbx
jb 0x529e8c
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp rbx, 1
jne 0x529e4b
lea rax, [0x00613940]
mov qword [rsp], rax
mov qword [rsp + 8], 1
mov qword [rsp + 0x10], 1
call fcn.0044dcc0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x60]
mov ebx, 1
mov edx, 1
jmp 0x529d1e
mov qword [rsp + 0x20], rbx
lea rax, [0x00613940]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
lea rax, [rbx + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x10], rax
call fcn.0044dcc0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x529d1e
mov rcx, rbx
call fcn.0046ce40
mov rax, rsi
mov rcx, rbx
call fcn.0046cdc0
mov rax, r10
mov rcx, r8
call fcn.0046cdc0
mov rax, r9
mov rcx, rbx
call fcn.0046cdc0
mov rcx, rbx
call fcn.0046ce40
nop
nop
call fcn.0046abe0
jmp fcn.00529cc0
Function at 0x530f80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5310af
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
cmp rax, 0x40
jne 0x531092
mov rcx, qword [rsp + 0x30]
xor edx, edx
nop
jmp 0x530fc5
inc rdx
cmp rax, rdx
jle 0x530fe5
movzx ebx, byte [rcx + rdx]
cmp bl, 0xa
je 0x531076
cmp bl, 0xd
jne 0x530fc2
nop dword [rax]
jmp 0x531076
lea rax, [0x00643280]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
mov dword [rax + 0x140], 0x3d
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
je 0x53102a
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
call fcn.0046d6c0
mov rax, qword [rsp + 0x18]
xor ecx, ecx
jmp 0x531040
mov byte [rax + rcx + 0x40], 0xff
inc rcx
nop dword [rax + rax]
cmp rcx, 0x100
jl 0x531033
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
xor ebx, ebx
jmp 0x531062
movzx esi, byte [rdx + rbx]
mov byte [rax + rsi + 0x40], bl
inc rbx
cmp rcx, rbx
jg 0x531057
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a12d0]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a12c0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00530f80
Function at 0x532be0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x532e7a
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword [rsp + 0x88]
cmp rax, 0x24
jg 0x532e0e
nop word [rax + rax]
cmp rax, 0x20
je 0x532da9
cmp rax, 0x22
jne 0x532c81
mov rcx, qword [rsp + 0x78]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x18], rax
call fcn.00533220
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
cmp rax, 0x24
je 0x532d55
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp], rax
nop dword [rax]
call fcn.0040b580
mov rax, qword [rsp + 8]
lea rcx, [0x00613700]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x10], rax
call fcn.0040b6a0
mov rax, qword [rsp + 0x18]
lea rcx, [0x00611940]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
lea rax, [0x00666a8d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
lea rax, [rsp + 0x48]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 2
call fcn.004d6e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x78]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x18], rax
nop dword [rax]
call fcn.00532ea0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x78]
test byte [rcx], al
mov qword [rsp], rcx
mov qword [rsp + 8], 0x10
mov qword [rsp + 0x10], 0x10
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
call fcn.00519ca0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
cmp rax, 0x26
je 0x532c30
cmp rax, 0x29
jne 0x532e6f
mov rcx, qword [rsp + 0x78]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x18], rax
call fcn.005333a0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
cmp rax, 0x2d
je 0x532e1e
jmp 0x532c8b
call fcn.0046abe0
nop
jmp fcn.00532be0
Function at 0x533220
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x533380
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jbe 0x533373
mov rdx, qword [rsp + 0x60]
cmp byte [rdx], 0x7b
nop
je 0x5332f2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x10], rax
call fcn.0040b6a0
mov rax, qword [rsp + 0x18]
lea rcx, [0x00611940]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00666067]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
lea rax, [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 1
mov qword [rsp + 0x20], 1
call fcn.004d6e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx ebx, byte [rcx + rdx - 1]
nop word [rax + rax]
cmp bl, 0x7d
jne 0x533266
lea rbx, [rcx - 1]
cmp rbx, 1
jb 0x533366
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
lea rax, [rdx + 1]
mov qword [rsp + 8], rax
lea rax, [rcx - 2]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x70]
dec rax
mov qword [rsp + 0x18], rax
nop dword [rax + rax]
call fcn.00533560
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, 1
mov rcx, rbx
call fcn.0046ce80
xor eax, eax
call fcn.0046cdc0
nop
nop dword [rax + rax]
call fcn.0046abe0
jmp fcn.00533220