joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59fda0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x59fe99
sub esp, 0x14
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
xor edx, edx
jmp 0x59fdc4
inc edx
cmp eax, edx
jle 0x59fe67
movzx ebx, byte [ecx + edx]
lea ebp, [ebx - 0x61]
xchg ebp, eax
cmp al, 0x19
xchg ebp, eax
jbe 0x59fdc3
lea ebp, [ebx - 0x41]
xchg ebp, eax
cmp al, 0x19
xchg ebp, eax
jbe 0x59fdc3
lea ebp, [ebx - 0x30]
xchg ebp, eax
cmp al, 9
xchg ebp, eax
jbe 0x59fdc3
lea ebp, [ebx - 0x27]
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jbe 0x59fdc3
lea ebp, [ebx - 0x2b]
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jbe 0x59fdc3
cmp bl, 0x20
je 0x59fdc3
cmp bl, 0x3a
je 0x59fdc3
cmp bl, 0x3d
je 0x59fdc3
cmp bl, 0x3f
je 0x59fdc3
cmp bl, 0x2a
je 0x59fdc3
lea eax, [0x74b755]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x2a
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.00409d40
mov eax, dword [esp + 8]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea ecx, [0x7b145c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
add esp, 0x14
ret
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x7b2070]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
add esp, 0x14
ret
call fcn.00467a60
jmp fcn.0059fda0
Function at 0x5a0320
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a04a6
sub esp, 0x3c
nop
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.004695de
mov byte [esp + 0x14], 0
call fcn.0048b7f0
mov eax, dword [esp + 0x18]
cmp eax, 0x270f
ja 0x5a0366
nop
mov dword [esp + 0x30], 0
xor ecx, ecx
jmp 0x5a03c4
lea eax, [0x74ab8f]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0x28
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00409d40
mov eax, dword [esp + 8]
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
lea ecx, [0x7b145c]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], eax
add esp, 0x3c
ret
lea ebx, [eax + 0x30]
mov byte [esp + ebp + 0x30], bl
inc ecx
mov eax, edx
cmp ecx, 4
jge 0x5a03fc
mov dword [esp + 0x2c], eax
lea edx, [ecx - 3]
neg edx
mov ebx, 0xcccccccd
mov ebp, edx
imul ebx
mov ebx, dword [esp + 0x2c]
add edx, ebx
sar edx, 3
mov eax, ebx
sar ebx, 0x1f
sub edx, ebx
lea ebx, [edx + edx*4]
shl ebx, 1
sub eax, ebx
cmp ebp, 4
jb 0x5a03ba
jmp 0x5a0499
mov eax, dword [esp + 0x44]
lea ecx, [eax + 4]
mov edx, dword [esp + 0x48]
cmp edx, ecx
jb 0x5a0411
mov ebx, dword [esp + 0x40]
jmp 0x5a0449
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 4
lea eax, [0x6f4820]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x44]
mov ebp, dword [esp + 0x30]
mov dword [ebx + eax], ebp
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
lea edi, [esp + 0xc]
lea esi, [esp + 0x4c]
call fcn.004695de
call fcn.005a04b0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
add esp, 0x3c
ret
mov eax, ebp
mov ecx, 4
call fcn.00468ed0
nop
call fcn.00467a60
jmp fcn.005a0320
Function at 0x5a4db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a4f53
sub esp, 0x34
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.005a58a0
movzx eax, byte [esp + 0xc]
test al, al
je 0x5a4e3f
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x5a4e3f
mov edx, dword [esp + 0x28]
cmp eax, 1
je 0x5a4e32
movzx ebx, byte [edx]
test bl, bl
jne 0x5a4e24
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x5a4e3f
cmp bl, 0xff
jne 0x5a4e32
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x5a4e3f
cmp eax, 8
jg 0x5a4e48
mov ebx, dword [esp + 0x3c]
xor ecx, ecx
jmp 0x5a4e73
mov byte [esp + 0x40], 0
add esp, 0x34
ret
jg 0x5a4e3f
mov byte [esp + 0x40], 1
add esp, 0x34
ret
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
movzx esi, byte [edx + ecx]
or esi, ebp
mov dword [ebx], esi
inc ecx
cmp ecx, eax
jl 0x5a4e53
mov dword [esp + 0x14], eax
mov edx, dword [ebx]
mov dword [esp + 0x24], edx
mov ebp, dword [ebx + 4]
shl eax, 3
lea ecx, [eax - 0x20]
mov byte [esp + 0x13], cl
mov edi, edx
shr edx, cl
mov dword [esp + 0x20], edx
add eax, 0xffffffc0
neg eax
mov byte [esp + 0x12], al
mov ecx, eax
shl ebp, cl
shl edi, cl
movzx esi, byte [esp + 0x13]
xchg esi, ebx
neg ebx
xchg esi, ebx
mov ecx, esi
mov edx, dword [esp + 0x24]
shl edx, cl
mov dword [esp + 0x24], edx
shr al, 5
movzx eax, al
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x12]
cmp al, 0x20
sbb edx, edx
sbb ecx, ecx
and edi, edx
mov dword [ebx], edi
and ebp, edx
not ecx
or ecx, eax
mov byte [esp + 0x12], cl
mov ecx, eax
shr edi, cl
and edi, edx
mov dword [esp + 0x18], edi
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb eax, eax
sbb ecx, ecx
mov edx, dword [esp + 0x24]
and edx, eax
not ecx
or ecx, esi
mov eax, dword [esp + 0x1c]
cmp eax, 1
sbb eax, eax
xor eax, 0xffffffff
movzx esi, byte [esp + 0x13]
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb edi, edi
mov esi, dword [esp + 0x20]
and esi, edi
or esi, ebp
or esi, edx
mov dword [ebx + 4], esi
mov edx, esi
sar esi, cl
and eax, esi
movzx ecx, byte [esp + 0x13]
mov ebp, edx
shl edx, cl
and edx, edi
mov esi, dword [esp + 0x18]
or esi, edx
or eax, esi
mov dword [ebx], eax
movzx ecx, byte [esp + 0x12]
sar ebp, cl
mov dword [ebx + 4], ebp
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x5a4e48
call fcn.00467a60
jmp fcn.005a4db0
Function at 0x5a6180
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a62fb
sub esp, 0x28
mov byte [esp + 0x23], 0
movzx eax, byte [esp + 0x30]
mov byte [esp + 0x23], al
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
test ecx, ecx
jne 0x5a62de
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x5a62e2
mov ecx, dword [eax + 0xc]
inc ecx
test ecx, ecx
jg 0x5a620f
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1b
lea ecx, [0x7440d8]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
mov ebx, dword [0x995310]
test ebx, ebx
je 0x5a620a
call fcn.00468e70
mov dword [edi], eax
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov dword [edx + 4], eax
mov eax, edx
movzx ecx, byte [eax + 0x14]
test cl, cl
je 0x5a6269
mov ecx, dword [eax + 0xc]
inc ecx
cmp dword [eax + 0x10], ecx
jge 0x5a6269
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x36
lea ecx, [0x74f236]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
mov ecx, dword [0x995310]
test ecx, ecx
je 0x5a6264
call fcn.00468e70
mov dword [edi], eax
mov ecx, dword [edx + 4]
mov dword [edi + 4], ecx
mov dword [edx + 4], eax
jmp 0x5a62de
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
lea ebx, [edx + 1]
mov ebp, dword [eax + 8]
cmp ecx, ebx
jae 0x5a62b3
mov dword [esp + 0x24], edx
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 1
lea eax, [0x6f4820]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
movzx esi, byte [esp + 0x23]
xchg esi, eax
mov byte [ebp + edx], al
xchg esi, eax
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
mov ecx, dword [0x995310]
test ecx, ecx
je 0x5a62db
call fcn.00468e70
mov dword [edi], ebp
mov ecx, dword [eax + 8]
mov dword [edi + 4], ecx
mov dword [eax + 8], ebp
add esp, 0x28
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b06f0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005a6180
Function at 0x5a6310
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a6496
sub esp, 0x28
mov word [esp + 0x22], 0
movzx eax, word [esp + 0x30]
rol ax, 8
mov word [esp + 0x22], ax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
test ecx, ecx
jne 0x5a6479
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x5a647d
mov ecx, dword [eax + 0xc]
add ecx, 2
cmp ecx, 2
jge 0x5a63a9
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1b
lea ecx, [0x7440d8]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
mov ebx, dword [0x995310]
test ebx, ebx
je 0x5a63a4
call fcn.00468e70
mov dword [edi], eax
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov dword [edx + 4], eax
mov eax, edx
movzx ecx, byte [eax + 0x14]
test cl, cl
je 0x5a6405
mov ecx, dword [eax + 0xc]
add ecx, 2
cmp dword [eax + 0x10], ecx
jge 0x5a6405
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x36
lea ecx, [0x74f236]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
mov ecx, dword [0x995310]
test ecx, ecx
je 0x5a6400
call fcn.00468e70
mov dword [edi], eax
mov ecx, dword [edx + 4]
mov dword [edi + 4], ecx
mov dword [edx + 4], eax
jmp 0x5a6479
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
lea ebx, [edx + 2]
mov ebp, dword [eax + 8]
cmp ecx, ebx
jae 0x5a644f
mov dword [esp + 0x24], edx
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 2
lea eax, [0x6f4820]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
movzx esi, word [esp + 0x22]
mov word [ebp + edx], si
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
mov ecx, dword [0x995310]
test ecx, ecx
je 0x5a6476
call fcn.00468e70
mov dword [edi], ebp
mov ecx, dword [eax + 8]
mov dword [edi + 4], ecx
mov dword [eax + 8], ebp
add esp, 0x28
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b06f0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005a6310
Function at 0x5a64a0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a6621
sub esp, 0x28
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x30]
bswap eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
test ecx, ecx
jne 0x5a6604
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x5a6608
mov ecx, dword [eax + 0xc]
add ecx, 4
cmp ecx, 4
jge 0x5a6536
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1b
lea ecx, [0x7440d8]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
mov ebx, dword [0x995310]
test ebx, ebx
je 0x5a6531
call fcn.00468e70
mov dword [edi], eax
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov dword [edx + 4], eax
mov eax, edx
movzx ecx, byte [eax + 0x14]
test cl, cl
je 0x5a6592
mov ecx, dword [eax + 0xc]
add ecx, 4
cmp dword [eax + 0x10], ecx
jge 0x5a6592
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x36
lea ecx, [0x74f236]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
mov ecx, dword [0x995310]
test ecx, ecx
je 0x5a658d
call fcn.00468e70
mov dword [edi], eax
mov ecx, dword [edx + 4]
mov dword [edi + 4], ecx
mov dword [edx + 4], eax
jmp 0x5a6604
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
lea ebx, [edx + 4]
mov ebp, dword [eax + 8]
cmp ecx, ebx
jae 0x5a65dc
mov dword [esp + 0x20], edx
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 4
lea eax, [0x6f4820]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [ebp + edx], esi
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
mov ecx, dword [0x995310]
test ecx, ecx
je 0x5a6601
call fcn.00468e70
mov dword [edi], ebp
mov ecx, dword [eax + 8]
mov dword [edi + 4], ecx
mov dword [eax + 8], ebp
add esp, 0x28
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b06f0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005a64a0
Function at 0x5a6630
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a67d4
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
test ecx, ecx
jne 0x5a67b7
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x5a67bb
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x38]
add ecx, edx
cmp edx, ecx
jle 0x5a66ba
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1b
lea ecx, [0x7440d8]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov edx, dword [esp + 0x30]
mov dword [edx], ecx
mov ebx, dword [0x995310]
test ebx, ebx
je 0x5a66b1
call fcn.00468e70
mov dword [edi], eax
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov dword [edx + 4], eax
mov eax, edx
mov edx, dword [esp + 0x38]
movzx ecx, byte [eax + 0x14]
test cl, cl
je 0x5a6718
mov ecx, dword [eax + 0xc]
add ecx, edx
cmp dword [eax + 0x10], ecx
jge 0x5a6718
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x36
lea ecx, [0x74f236]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov edx, dword [esp + 0x30]
mov dword [edx], ecx
mov ecx, dword [0x995310]
test ecx, ecx
je 0x5a6710
call fcn.00468e70
mov dword [edi], eax
mov ecx, dword [edx + 4]
mov dword [edi + 4], ecx
mov dword [edx + 4], eax
jmp 0x5a67b7
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0xc]
lea ebp, [edx + ebx]
mov esi, dword [eax + 8]
cmp ecx, ebp
jae 0x5a675e
mov dword [esp + 0x24], ebx
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
lea eax, [0x6f4820]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], ecx
lea eax, [esi + ebx]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.004697f0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 0x10], eax
mov eax, dword [0x995310]
test eax, eax
jne 0x5a67a3
mov eax, dword [esp + 0x28]
jmp 0x5a67b4
call fcn.00468e70
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov edx, dword [ecx + 8]
mov dword [edi + 4], edx
mov dword [ecx + 8], eax
add esp, 0x2c
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b06f0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005a6630
Function at 0x5ab320
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ab4fc
sub esp, 0x38
mov ebx, dword [esp + 0x40]
mov ebp, dword [ebx + 0xc]
mov esi, dword [ebp]
mov esi, dword [esi + 4]
shl esi, 5
sub esi, dword [ebp + 4]
lea ebp, [esi + 7]
sar ebp, 0x1f
shr ebp, 0x1d
lea ecx, [ebp + esi + 7]
sar ecx, 3
mov ebp, dword [esp + 0x4c]
cmp ebp, ecx
jl 0x5ab42b
mov edx, dword [esp + 0x50]
cmp edx, ecx
jb 0x5ab4f6
mov ebp, ecx
shl ebp, 3
sub ebp, esi
test ebp, ebp
jle 0x5ab425
mov dword [esp + 0x30], ebp
mov edx, dword [esp + 0x48]
test edx, edx
jne 0x5ab398
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x5ab418
test ecx, ecx
ja 0x5ab3a6
lea eax, [esp + 0x23]
xor esi, esi
xor edi, edi
jmp 0x5ab3e8
mov dword [esp + 0x2c], ecx
lea eax, [esp + 0x23]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
lea eax, [0x6f4820]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov esi, edx
mov edi, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.004697f0
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x28], edx
mov dword [esp + 0x34], ecx
lea esi, [eax - 1]
jmp 0x5ab485
mov eax, dword [esp + 0x48]
jmp 0x5ab476
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x48]
mov edx, dword [ebx + 0xc]
mov ebx, dword [esp + 0x44]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.00593640
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x5ab45e
add esp, 0x38
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0808]
mov dword [esp + 4], eax
call fcn.00438b10
mov ebp, ecx
mov ecx, eax
mov eax, edx
jmp 0x5ab433
dec esi
mov ecx, ebx
mov ebx, dword [esp + 0x40]
test esi, esi
jl 0x5ab4e0
cmp esi, eax
jae 0x5ab4ed
movzx edi, byte [ecx + esi]
mov ecx, ebp
xchg edi, eax
shr al, cl
xchg edi, eax
cmp ecx, 8
sbb ebx, ebx
and edi, ebx
mov ebx, dword [esp + 0x34]
xchg edi, eax
mov byte [ebx + esi], al
xchg edi, eax
test esi, esi
jle 0x5ab47e
lea edx, [ecx - 8]
neg edx
movzx ecx, byte [esi + ebx - 1]
test edx, edx
jl 0x5ab4e8
mov byte [esp + 0x23], cl
mov ecx, edx
movzx ebp, byte [esp + 0x23]
shl ebp, cl
cmp ecx, 0x20
sbb edx, edx
and edx, ebp
or edi, edx
xchg edi, eax
mov byte [ebx + esi], al
xchg edi, eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov ebp, ecx
jmp 0x5ab47e
mov ecx, eax
mov eax, dword [esp + 0x34]
jmp 0x5ab476
call fcn.00437970
mov ecx, eax
mov eax, esi
call fcn.00468ed0
call fcn.00468f10
nop
call fcn.00467a60
jmp fcn.005ab320
Function at 0x5acd10
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0xac]
cmp eax, dword [ecx + 8]
jbe 0x5acf6b
sub esp, 0x12c
mov dword [esp + 0x128], 0
mov ecx, dword [esp + 0x130]
mov dword [esp + 0x128], ecx
xor eax, eax
jmp 0x5acd5a
mov ecx, dword [esp + 0x130]
mov eax, 1
test eax, eax
jg 0x5acdfe
mov ecx, dword [esp + 0x128]
mov dword [esp + 0x120], ecx
lea edi, [esp + 0xf4]
xor eax, eax
call fcn.004690f6
mov ecx, dword [esp + 0x120]
test byte [ecx], al
mov dword [esp], ecx
lea edx, [esp + 0xf4]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x28
call fcn.004034e0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x5acd4e
mov ecx, dword [esp + 0x120]
add ecx, 0x28
mov dword [esp + 0x124], ecx
lea edi, [esp + 0xcc]
xor eax, eax
call fcn.004690f6
mov ecx, dword [esp + 0x124]
mov dword [esp], ecx
lea ecx, [esp + 0xcc]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x28
call fcn.004034e0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x5acd4e
jmp 0x5acf52
lea edi, [esp + 0x54]
xor eax, eax
call fcn.004690f6
lea edi, [esp + 0xa4]
call fcn.004690f6
lea edi, [esp + 0x7c]
call fcn.004690f6
mov ecx, dword [esp + 0x130]
test byte [ecx], al
lea edx, [esp + 0x54]
mov dword [esp], edx
lea ebx, [ecx + 0x50]
mov dword [esp + 4], ebx
call fcn.00589820
mov ecx, dword [esp + 0x130]
lea edx, [ecx + 0x28]
mov dword [esp + 0x11c], edx
nop
nop
lea ebx, [esp + 0xa4]
mov dword [esp], ebx
mov dword [esp + 4], ecx
lea ecx, [esp + 0x54]
mov dword [esp + 8], ecx
call fcn.0058afc0
nop
lea ecx, [esp + 0x7c]
mov dword [esp], ecx
mov edx, dword [esp + 0x11c]
mov dword [esp + 4], edx
lea edx, [esp + 0x54]
mov dword [esp + 8], edx
call fcn.0058afc0
mov ecx, dword [esp + 0x134]
test byte [ecx], al
nop
lea edi, [esp + 0x34]
xor eax, eax
call fcn.004690f8
lea ecx, [esp + 0x7c]
mov dword [esp], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.00589f60
mov ecx, dword [esp + 0xc]
cmp ecx, 0x20
jl 0x5acebf
mov ecx, 0x20
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0x134]
cmp ebx, edx
je 0x5acede
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.004697f0
lea edi, [esp + 0x14]
xor eax, eax
call fcn.004690f8
lea ecx, [esp + 0xa4]
mov dword [esp], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 4], ecx
call fcn.00589f60
mov ecx, dword [esp + 0xc]
test ecx, ecx
jbe 0x5acf49
mov eax, dword [esp + 0x134]
movzx ecx, byte [eax + 0x1f]
mov edx, dword [esp + 8]
movzx edx, byte [edx]
and edx, 1
shl edx, 7
or ecx, edx
mov byte [eax + 0x1f], cl
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], 0x20
mov dword [esp + 0x140], 0x20
add esp, 0x12c
ret
xor eax, eax
mov ecx, eax
call fcn.00468ed0
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b09d0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005acd10
Function at 0x5ad770
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x138]
cmp eax, dword [ecx + 8]
jbe 0x5ad914
sub esp, 0x1b8
mov dword [esp + 0x1b0], 0
mov dword [esp + 0x1b4], 0
mov ecx, dword [esp + 0x1c0]
mov dword [esp + 0x1b0], ecx
mov edx, dword [esp + 0x1c4]
mov dword [esp + 0x1b4], edx
xor eax, eax
jmp 0x5ad7dc
mov ebx, dword [esp + 0x10]
lea eax, [ebx + 1]
mov ecx, dword [esp + 0x1c0]
mov edx, dword [esp + 0x1c4]
cmp eax, 2
jge 0x5ad879
mov dword [esp + 0x10], eax
mov ecx, dword [esp + eax*4 + 0x1b0]
mov dword [esp + 0x1a8], ecx
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.004690f6
mov ecx, dword [esp + 0x1a8]
test byte [ecx], al
mov dword [esp], ecx
lea ebx, [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x28
call fcn.004034e0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x5ad7c7
mov ecx, dword [esp + 0x1a8]
add ecx, 0x28
mov dword [esp + 0x1ac], ecx
lea edi, [esp + 0x14]
xor eax, eax
call fcn.004690f6
mov ecx, dword [esp + 0x1ac]
mov dword [esp], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x28
call fcn.004034e0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x5ad7c7
jmp 0x5ad8fb
lea edi, [esp + 0x104]
xor eax, eax
call fcn.004690d8
lea ecx, [esp + 0x104]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.005ad5b0
mov ecx, dword [esp + 8]
mov dword [esp + 0x1a4], ecx
lea edi, [esp + 0x64]
xor eax, eax
call fcn.004690d8
lea ecx, [esp + 0x64]
mov dword [esp], ecx
mov ecx, dword [esp + 0x1c0]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1a4]
mov dword [esp + 8], ecx
call fcn.005ad920
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x1bc]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.005ad420
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c8], ecx
add esp, 0x1b8
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b09d0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.005ad770