joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d19a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xc0]
cmp r12, qword [r14 + 0x10]
jbe 0x5d1c81
push rbp
mov rbp, rsp
sub rsp, 0x138
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x158], rcx
mov qword [rsp + 0x150], rbx
mov rdx, qword [rax]
mov qword [rsp + 0x90], rdx
mov rax, rdx
mov ebx, 1
call fcn.005c4700
test rax, rax
jne 0x5d1b88
mov rax, qword [rsp + 0x90]
xor ebx, ebx
xor ecx, ecx
call fcn.005c91e0
test rcx, rcx
jne 0x5d1b79
lea rdx, [0x00681780]
cmp rax, rdx
jne 0x5d1a22
mov rcx, rbx
nop
jmp 0x5d1a2a
mov rcx, rbx
mov ebx, 0
mov qword [rsp + 0x98], rbx
jne 0x5d1adb
mov rsi, qword [rsp + 0x148]
mov rdx, qword [rsi + 0x30]
lea r8, [rsi + 0x38]
mov qword [rsp + 0xb0], rdx
lea rdi, [rsp + 0xb8]
mov rax, rsi
mov rsi, r8
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046082c
mov rbp, qword [rbp]
mov rdx, qword [rsp + 0xb0]
mov r8, qword [rax + 0x98]
mov rbx, qword [rax + 0xa0]
mov rcx, qword [rax + 0xa8]
mov qword [rsp], rdx
lea rdi, [rsp + 8]
lea rsi, [rsp + 0xb8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046082c
mov rbp, qword [rbp]
mov rax, r8
call fcn.005f1840
mov rdx, qword [rsp + 0x98]
cmp qword [rdx + 0x20], rbx
jne 0x5d1b91
mov rsi, qword [rdx + 0x18]
xor ecx, ecx
xor edi, edi
jmp 0x5d1bea
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x90]
mov ebx, 0xa
call fcn.005c7da0
nop
movups xmmword [rsp + 0x118], xmm15
movups xmmword [rsp + 0x128], xmm15
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x118], rcx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x120], rcx
lea rcx, [0x00681780]
mov qword [rsp + 0x128], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x130], rcx
lea rax, [0x006d8187]
mov ebx, 0x49
lea rcx, [rsp + 0x118]
mov edi, 2
mov rsi, rdi
call fcn.004bfac0
add rsp, 0x138
pop rbp
ret
mov rax, rcx
mov rbx, rdi
add rsp, 0x138
pop rbp
ret
add rsp, 0x138
pop rbp
ret
mov rax, qword [rsp + 0x90]
mov ebx, 0x28
nop
call fcn.005c7da0
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x2c
lea rcx, [0x006d36a9]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x138
pop rbp
ret
movzx r8d, byte [rcx + rax]
movzx r9d, byte [rsi + rcx]
xor r8d, r9d
inc rcx
or edi, r8d
cmp rbx, rcx
jg 0x5d1bd7
movzx esi, dil
dec esi
shr esi, 0x1f
nop
cmp rsi, 1
jne 0x5d1b91
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0xa0], rax
mov rdi, qword [rsp + 0x148]
add rdi, 0x30
lea rax, [0x00742de8]
mov rbx, rdx
lea rcx, [0x00742140]
call fcn.005eca00
test rax, rax
jne 0x5d1c77
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x158]
cmp rdx, rcx
cmovl rcx, rdx
mov rbx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x150]
nop dword [rax]
cmp rbx, rax
je 0x5d1c6a
call fcn.00460ba0
xor eax, eax
xor ebx, ebx
add rsp, 0x138
pop rbp
ret
add rsp, 0x138
pop rbp
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005d19a0
Function at 0x5d1cc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d1e41
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdx, qword [rax + 0x18]
cmp byte [rdx + 0x54], 0
nop word [rax + rax]
je 0x5d1e36
mov rdx, qword [rax + 0x20]
mov rsi, qword [rax]
cmp byte [rdx + 0xc8], 0
je 0x5d1dfa
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], rsi
lea rcx, [rax + 0x30]
lea rbx, [0x00742140]
mov rax, rsi
call fcn.005c91e0
nop word [rax + rax]
test rcx, rcx
jne 0x5d1dee
lea rcx, [0x00681980]
cmp rax, rcx
jne 0x5d1d84
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
mov rsi, qword [rbx + 0x18]
mov rdi, qword [rsp + 0x70]
mov qword [rdi + 0xc0], rcx
mov qword [rdi + 0xc8], rdx
cmp dword [0x0092d940], 0
je 0x5d1d73
nop dword [rax]
call fcn.0045fe40
mov qword [r11], rsi
mov rcx, qword [rdi + 0xb8]
mov qword [r11 + 8], rcx
mov qword [rdi + 0xb8], rsi
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
mov ebx, 0xa
call fcn.005c7da0
nop
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x48], rcx
lea rcx, [0x00681980]
mov qword [rsp + 0x50], rcx
lea rax, [0x006d8187]
mov ebx, 0x49
lea rcx, [rsp + 0x40]
mov edi, 2
mov rsi, rdi
call fcn.004bfac0
add rsp, 0x60
pop rbp
ret
mov rax, rcx
mov rbx, rdi
add rsp, 0x60
pop rbp
ret
mov rax, rsi
mov ebx, 0x2f
call fcn.005c7da0
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x2b
lea rcx, [0x006d31be]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x60
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
nop
ret
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.005d1cc0
Function at 0x5ddaa0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5ddcc6
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0xa0], rbx
mov rdx, qword [rax + 0x1e8]
cmp rcx, rdx
jne 0x5ddada
mov rsi, qword [rax + 0x1e0]
xor r8d, r8d
jmp 0x5ddb0f
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x2f
lea rcx, [0x006d461d]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x88
pop rbp
ret
inc r8
cmp r8, rdx
jge 0x5ddb59
lea r9, [r8 + r8*2]
mov r10, qword [rbx + r9*8 + 8]
mov r9, qword [rsi + r9*8 + 8]
cmp r9, r10
je 0x5ddb0c
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x2f
lea rcx, [0x006d461d]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x88
pop rbp
ret
mov qword [rax + 0x1e8], rcx
mov qword [rax + 0x1f0], rdi
cmp dword [0x0092d940], 0
je 0x5ddb83
call fcn.0045fe40
mov qword [r11], rbx
mov rcx, qword [rax + 0x1e0]
mov qword [r11 + 8], rcx
mov qword [rax + 0x1e0], rbx
cmp qword [rax], 0
je 0x5ddc9b
mov qword [rsp + 0x98], rax
nop dword [rax]
call fcn.005dda00
test rdi, rdi
jne 0x5ddca8
mov rsi, qword [rsp + 0x98]
mov rdx, qword [rsi + 0x10]
nop word [rax + rax]
cmp rbx, rdx
ja 0x5ddcbc
mov r8, qword [rsi]
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x30]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004604d0
mov rbp, qword [rbp]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x40], r8
mov byte [rsp + 0x58], 1
movups xmmword [rsp + 0x20], xmm15
lea rdx, [0x005ddd00]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x30]
mov ebx, 2
xor ecx, ecx
lea rdi, [rsp + 0x20]
call fcn.00581de0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x5ddc42
xor ecx, ecx
jmp 0x5ddc56
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x68]
cmp rax, rcx
ja 0x5ddcb7
sub rcx, rax
xor edx, edx
test rdx, rdx
jne 0x5ddc69
mov rdx, qword [rsp + 0x98]
cmp qword [rdx + 8], rcx
je 0x5ddc9b
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x2d
lea rcx, [0x006d3b82]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00741740]
add rsp, 0x88
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x88
pop rbp
ret
mov rax, rdi
mov rbx, rsi
add rsp, 0x88
pop rbp
ret
call fcn.004602a0
mov rcx, rbx
nop
call fcn.00460260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005ddaa0
Function at 0x5e56e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5e5908
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov rdx, qword [rax]
nop dword [rax]
test rdx, rdx
jne 0x5e58d7
movups xmmword [rsp + 0x38], xmm15
lea rdi, [rsp + 0x40]
lea rdi, [rdi - 0x30]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004604d0
mov rbp, qword [rbp]
nop
cmp qword [rsp + 0x68], 0
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0x18
jne 0x5e58f4
mov qword [rsp + 0xb0], rax
cmp byte [rsp + 0x60], 0
je 0x5e57a2
mov rdx, qword [rsp + 0x50]
inc rdx
cmp qword [rsp + 0x58], rdx
jge 0x5e57a2
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x36
lea rcx, [0x006d5ff0]
mov qword [rax], rcx
lea rcx, [0x00741740]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
jmp 0x5e5801
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
lea rdx, [rbx + 1]
mov r8, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x5e57e9
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 1
lea rsi, [0x0066d1c0]
call fcn.00447aa0
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rsp + 0x2f]
mov byte [r8 + rbx], sil
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], r8
movups xmmword [rsp + 0x90], xmm15
lea rdx, [0x005e5920]
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x90]
lea rax, [rsp + 0x38]
call fcn.00581de0
mov rdx, qword [rsp + 0x38]
nop
test rdx, rdx
je 0x5e5854
mov r8, qword [rsp + 0x40]
xor ecx, ecx
xor r11d, r11d
xor r9d, r9d
jmp 0x5e588e
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x70]
nop
cmp rax, rcx
ja 0x5e58ef
mov r9, qword [rsp + 0x48]
mov r10, qword [rsp + 0x58]
sub r10, rax
mov r11, r10
neg r10
sar r10, 0x3f
and r10, rax
sub rcx, rax
add r9, r10
xor edx, edx
xor r8d, r8d
mov r10, qword [rsp + 0xb0]
mov qword [r10 + 8], rcx
mov qword [r10 + 0x10], r11
cmp dword [0x0092d940], 0
je 0x5e58bc
mov rax, r11
call fcn.0045fe40
mov qword [r11], r9
mov r12, qword [r10]
mov qword [r11 + 8], r12
mov r11, rax
mov qword [r10], r9
mov rax, r9
mov rbx, rcx
mov rcx, r11
mov rdi, rdx
mov rsi, r8
add rsp, 0xa0
pop rbp
ret
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rax, rdx
xor edi, edi
xor esi, esi
add rsp, 0xa0
pop rbp
ret
call fcn.004602a0
lea rax, [0x0066d140]
lea rbx, [0x00740ac0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.005e56e0
Function at 0x601580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60171b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x6015a1
inc rcx
cmp rbx, rcx
jle 0x601711
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x60159e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.00510600
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rdi
mov rdx, qword [0x00899610]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005fd920
mov rdx, qword [rsp + 0x48]
test rdx, rdx
mov rdx, qword [rsp + 0x58]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x68]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x601705
test rdx, rdx
je 0x6016fa
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x6016c9
xor eax, eax
lea rbx, [0x0073fbc8]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006c4a23]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x58]
call fcn.0044ad40
jmp 0x6016f0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0073e628]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x58]
call fcn.0044ac80
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00601580
Function at 0x605880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x605a47
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov rcx, qword [rax]
mov rax, rcx
nop dword [rax]
call fcn.00605e80
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 0x10], rdi
cmp dword [0x0092d940], 0
je 0x6058c7
call fcn.0045fe40
mov qword [r11], rsi
mov r9, qword [rdx + 0x18]
mov qword [r11 + 8], r9
mov qword [rdx + 0x18], rsi
test rdi, rdi
jne 0x6058e3
mov r9, qword [rdx + 0x28]
lea r9, [r9 + rbx]
lea r9, [r9 + 2]
mov qword [rdx + 0x28], r9
nop
jmp 0x6058ec
add rsp, 0x30
pop rbp
ret
dec rbx
test rbx, rbx
je 0x605912
movzx r9d, byte [rbx + rax - 1]
cmp r9b, 0x20
je 0x6058e9
nop dword [rax]
cmp r9b, 9
je 0x6058e9
cmp r9b, 0xa
je 0x6058e9
cmp r9b, 0xd
je 0x6058e9
mov rdi, qword [0x0089c6b0]
mov rsi, qword [0x0089c6b8]
mov r8, qword [0x0089c6c0]
nop
call fcn.00471540
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 0x10], 0
cmp dword [0x0092d940], 0
je 0x60594f
mov rsi, qword [rdx + 0x18]
call fcn.0045fe20
mov qword [r11], rsi
mov qword [rdx + 0x18], 0
call fcn.006061a0
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rbx
cmp dword [0x0092d940], 0
je 0x605982
call fcn.0045fe40
mov qword [r11], rcx
mov rsi, qword [rdx + 0x18]
mov qword [r11 + 8], rsi
mov qword [rdx + 0x18], rcx
test rbx, rbx
jne 0x605a41
mov rcx, qword [rdx + 0x28]
shl rax, 1
sub rcx, rax
add rcx, 0xfffffffffffffff0
test rcx, rcx
mov ebx, 0
cmovl rcx, rbx
mov qword [rdx + 0x28], rcx
cmp rcx, 0x4000
jle 0x605a04
nop
lea rax, [0x006870a0]
nop
call fcn.0040d480
mov qword [rax + 8], 0x2b
lea rcx, [0x006d33ed]
mov qword [rax], rcx
lea rcx, [0x00741740]
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 0x10], rcx
cmp dword [0x0092d940], 0
je 0x605a00
call fcn.0045fe40
mov qword [r11], rax
mov rcx, qword [rdx + 0x18]
mov qword [r11 + 8], rcx
mov qword [rdx + 0x18], rax
cmp qword [rdx + 8], 0
jne 0x605a3a
mov rax, qword [0x00899850]
mov rcx, qword [0x00899858]
mov qword [rdx + 0x10], rax
cmp dword [0x0092d940], 0
je 0x605a36
call fcn.0045fe40
mov qword [r11], rcx
mov rax, qword [rdx + 0x18]
mov qword [r11 + 8], rax
mov qword [rdx + 0x18], rcx
add rsp, 0x30
pop rbp
nop
ret
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.00605880
Function at 0x607720
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x60788b
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x90], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.00596560
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
call fcn.006078a0
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x90]
mov rsi, qword [rdx + 0x28]
mov rdi, qword [rdx + 0x30]
nop
mov rax, rsi
mov rbx, rdi
call fcn.00596560
mov rdx, qword [rsp + 0x50]
test rdx, rdx
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
cmovne rdx, rsi
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
cmovne rsi, r8
mov qword [rsp + 0x70], rsi
test rdi, rdi
jne 0x6077f0
mov rbx, qword [0x008a6740]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0067ba40]
call fcn.004121a0
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp], rsi
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x60785d
xor eax, eax
lea rbx, [0x0073fbc8]
mov ecx, 1
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x58]
lea r8, [0x006c4a23]
mov r9d, 2
mov r10, qword [rsp + 0x78]
mov r11, qword [rsp + 0x60]
call fcn.0044ad40
jmp 0x607885
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
lea rdi, [0x0073e628]
mov esi, 1
mov r8, qword [rsp + 0x78]
mov r9, qword [rsp + 0x60]
nop
call fcn.0044ac80
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.00607720
Function at 0x60f540
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x60f7b4
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xd0], rax
xor edx, edx
jmp 0x60f5b6
mov rdx, qword [rsp + 0x60]
inc rdx
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xe8]
cmp rsi, rdx
jle 0x60f6e9
mov qword [rsp + 0x60], rdx
mov rbx, qword [rcx]
movzx eax, byte [rdi + rdx]
mov rdx, rcx
call rbx
test al, al
jne 0x60f586
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0xe8]
movzx ecx, byte [rdx + rcx]
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
lea rsi, [0x0066d1c0]
mov qword [rsp + 0x70], rsi
lea rdi, [0x00879000]
lea rcx, [rdi + rcx*8]
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xd8]
call fcn.0040a940
lea rcx, [0x0066d140]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
lea rcx, [0x0060f800]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0xa0], 0x37
lea rcx, [0x006d620d]
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xb0], 2
mov qword [rsp + 0xb8], 2
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xa8], rcx
mov rax, qword [0x008a6600]
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0x90]
nop dword [rax]
call fcn.005f5160
lea rax, [0x0066d1c0]
xor ebx, ebx
mov rcx, qword [rsp + 0xf0]
call fcn.004479c0
xor ecx, ecx
mov rdx, qword [rsp + 0xf0]
xor ebx, ebx
jmp 0x60f706
mov rax, rdi
mov rbx, rsi
add rsp, 0xc0
pop rbp
ret
mov rsi, qword [rsp + 0x58]
inc rsi
mov rdx, rcx
mov rcx, rsi
mov rsi, qword [rsp + 0xf0]
cmp rsi, rcx
jle 0x60f79e
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rdx
mov rbx, qword [rsp + 0xe8]
movzx eax, byte [rcx + rbx]
mov byte [rsp + 0x47], al
mov rdx, qword [rsp + 0xe0]
mov rsi, qword [rdx]
call rsi
test al, al
je 0x60f78a
mov rbx, qword [rsp + 0x48]
inc rbx
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
jb 0x60f765
mov rax, qword [rsp + 0x68]
jmp 0x60f77b
mov rax, qword [rsp + 0x68]
mov edi, 1
lea rsi, [0x0066d1c0]
call fcn.00447aa0
movzx esi, byte [rsp + 0x47]
mov byte [rbx + rax - 1], sil
jmp 0x60f6f8
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x68]
jmp 0x60f6f8
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044af60
add rsp, 0xc0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0060f540
Function at 0x613c60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x613cff
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp byte [rax], 0
je 0x613ceb
mov qword [rsp + 0x28], rax
mov word [rsp + 0x30], bx
xor ecx, ecx
jmp 0x613c97
mov rdx, qword [rsp + 0x10]
inc rdx
mov rax, qword [rsp + 0x28]
mov ebx, ecx
mov rcx, rdx
mov rdx, qword [rax + 0x18]
mov rsi, rax
movabs rax, 0xaaaaaaaaaaaaaaab
mov rdi, rdx
imul rdx
add rdx, rdi
sar rdx, 2
cmp rcx, rdx
jge 0x613ce1
mov qword [rsp + 0x10], rcx
mov rax, rsi
mov rbx, rcx
call fcn.00613d20
movzx ecx, word [rsp + 0x30]
cmp ax, cx
jne 0x613c85
mov eax, ebx
mov ebx, 1
add rsp, 0x18
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x18
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740220]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.0045df00
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
jmp fcn.00613c60

Function at 0x613dc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x613e5d
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp byte [rax], 0
je 0x613e49
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
xor ecx, ecx
jmp 0x613df7
mov rcx, qword [rsp + 0x10]
inc rcx
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rax + 0x18]
mov rsi, rax
movabs rax, 0xaaaaaaaaaaaaaaab
mov rdi, rdx
imul rdx
add rdx, rdi
sar rdx, 2
cmp rcx, rdx
jge 0x613e3f
mov qword [rsp + 0x10], rcx
mov rax, rsi
mov rbx, rcx
call fcn.00613d20
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rdx]
call rcx
test rax, rax
je 0x613de5
add rsp, 0x18
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x18
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740220]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00613dc0
Function at 0x61b280
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x118]
cmp r12, qword [r14 + 0x10]
jbe 0x61b45b
push rbp
mov rbp, rsp
sub rsp, 0x190
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x1b8], rdi
mov qword [rsp + 0x1c8], r8
mov rdx, qword [rax]
test rdx, rdx
jne 0x61b437
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x61b419
call fcn.00628800
nop dword [rax + rax]
test rbx, rbx
jne 0x61b406
mov qword [rsp + 0xb8], rax
call fcn.005cc660
lea rdi, [rsp + 0xc0]
mov rsi, rsp
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607e6
mov rbp, qword [rbp]
mov rbx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xc8]
cmp rbx, 2
jne 0x61b331
cmp word [rax], 0x3268
je 0x61b3aa
movups xmmword [rsp + 0x170], xmm15
movups xmmword [rsp + 0x180], xmm15
call fcn.0040a940
lea rcx, [0x0066d140]
mov qword [rsp + 0x170], rcx
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x180], rcx
lea rcx, [0x00740270]
mov qword [rsp + 0x188], rcx
lea rax, [0x006d2fe5]
mov ebx, 0x2b
lea rcx, [rsp + 0x170]
mov edi, 2
mov rsi, rdi
call fcn.004bfac0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
add rsp, 0x190
pop rbp
ret
cmp byte [rsp + 0xd8], 0
je 0x61b3d0
lea rax, [0x00744cd8]
mov rbx, qword [rsp + 0xb8]
xor ecx, ecx
xor edi, edi
add rsp, 0x190
pop rbp
ret
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x2c
lea rcx, [0x006d34f1]
mov qword [rax], rcx
xor ebx, ebx
lea rcx, [0x00741740]
mov rdi, rax
xor eax, eax
add rsp, 0x190
pop rbp
ret
xor eax, eax
mov rdi, rcx
mov rcx, rbx
xor ebx, ebx
add rsp, 0x190
pop rbp
ret
mov r11, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
mov rsi, r10
call r11
add rsp, 0x190
pop rbp
ret
mov r11, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
mov r9, r10
call r11
add rsp, 0x190
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.0061b280