joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5442e0
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x54455c
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
movzx ecx, byte [rbx + 0x1f]
mov qword [rsp + 0x98], rcx
movzx edx, byte [rbx + 0x1e]
mov qword [rsp + 0x90], rdx
movzx esi, byte [rbx + 0x1d]
mov qword [rsp + 0x88], rsi
movzx edi, byte [rbx + 0x1c]
mov qword [rsp + 0x80], rdi
movzx r8d, byte [rbx + 0x1b]
mov qword [rsp + 0x78], r8
movzx r9d, byte [rbx + 0x1a]
mov qword [rsp + 0x70], r9
movzx r10d, byte [rbx + 0x19]
mov qword [rsp + 0x68], r10
movzx r11d, byte [rbx + 0x18]
mov qword [rsp + 0x60], r11
movzx r12d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r12
movzx r13d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r13
movzx r15d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r15
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r10d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r10
movzx r9d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r9
movzx r8d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r8
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r8d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r8
movzx r9d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r9
movzx r10d, byte [rbx + 9]
mov qword [rsp + 8], r10
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r15d, byte [rbx + 7]
shl r15, 0x38
movzx r13d, byte [rbx + 6]
shl r13, 0x30
movzx r12d, byte [rbx + 5]
shl r12, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r10d, byte [rbx + 3]
shl r10, 0x18
movzx r9d, byte [rbx + 2]
shl r9, 0x10
movzx r8d, byte [rbx + 1]
shl r8, 8
movzx ebx, byte [rbx]
add rbx, r8
add rbx, r9
add rbx, r10
add rbx, r11
add rbx, r12
add rbx, r13
add rbx, r15
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x98]
shl rcx, 0x38
mov rdx, qword [rsp + 0x90]
shl rdx, 0x30
mov rbx, qword [rsp + 0x88]
shl rbx, 0x28
mov rsi, qword [rsp + 0x80]
shl rsi, 0x20
mov rdi, qword [rsp + 0x78]
shl rdi, 0x18
mov r8, qword [rsp + 0x70]
shl r8, 0x10
mov r9, qword [rsp + 0x68]
shl r9, 8
mov r10, qword [rsp + 0x60]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005442e0
Function at 0x547020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x547200
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [0x006bde60]
call fcn.0040daa0
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x54708b
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x5471b9
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x5471e0
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x54707d
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x54707d
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x54707d
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x54707d
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [r8 + rax]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
nop word [rax + rax]
cmp rdx, rax
jle 0x547148
cmp r9, r10
jle 0x547148
ja 0x5471c3
mov rax, r10
mov rcx, r9
call fcn.00465ec0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.00547020
Function at 0x5482e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54851c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.004d5e20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x54842a
nop
cmp rdx, 0x40
ja 0x54850e
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x548399
mov rax, rdx
mov rcx, rsi
nop
call fcn.00466860
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x548401
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00548a60
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x548503
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x548437
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x5484b7
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.00548a60
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x5484f2
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x5484ee
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.00466860
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00465f80
mov rax, rdx
mov ecx, 0x40
call fcn.00465f80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005482e0
Function at 0x55bb20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55bc7b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x009ae720]
call fcn.0050ff00
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x0055bca0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x55bc3b
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x55bc75
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x55bc6a
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.00465f80
call fcn.00465f00
nop
nop dword [rax + rax]
call fcn.00463860
jmp fcn.0055bb20
Function at 0x577fa0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x578201
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x5781e5
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x577fed
xor ebx, ebx
xor ecx, ecx
jmp 0x578000
mov rax, rdx
call fcn.00568a40
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x578118
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00483580
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007eeac8]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e900
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5780db
xor eax, eax
lea rbx, [0x007eed20]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00719896]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e9e0
jmp 0x578108
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x007eeb98]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e900
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.00483580
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5781a8
xor eax, eax
lea rbx, [0x007eed20]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00719896]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e9e0
jmp 0x5781d5
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007eeb98]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e900
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x00719d84]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00577fa0
Function at 0x579780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x579894
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [0x009a2d60]
cmp qword [rax + 0x18], 1
jle 0x5797fb
movzx ecx, byte [rax + 2]
mov byte [rsp + 0x17], cl
movzx eax, byte [rax + 1]
mov byte [rsp + 0x16], al
call fcn.00438660
lea rax, [0x007277af]
mov ebx, 0x21
call fcn.00438f60
movzx eax, byte [rsp + 0x17]
call fcn.00438900
lea rax, [0x0071afdf]
mov ebx, 0xa
call fcn.00438f60
movzx eax, byte [rsp + 0x16]
call fcn.00438900
call fcn.004388c0
call fcn.004386e0
mov rax, qword [0x009a2d60]
cmp byte [rax + 1], 0
je 0x57984c
cmp byte [0x00a049ef], 0
je 0x57982e
call fcn.00438660
lea rax, [0x00730c98]
mov ebx, 0x44
call fcn.00438f60
call fcn.004386e0
jmp 0x57988a
call fcn.00438660
lea rax, [0x0073011f]
mov ebx, 0x3d
nop
call fcn.00438f60
call fcn.004386e0
jmp 0x57988a
cmp byte [rax], 0
je 0x57986e
call fcn.00438660
lea rax, [0x0072a583]
mov ebx, 0x27
call fcn.00438f60
call fcn.004386e0
jmp 0x57988a
call fcn.00438660
lea rax, [0x0072e31b]
mov ebx, 0x32
nop
call fcn.00438f60
call fcn.004386e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00463860
jmp fcn.00579780

Function at 0x57cbc0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x57cbd8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x57cbd8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x57cbe0
xor eax, eax
ret
cmp rbx, 3
je 0x57cbec
cmp rbx, 4
jne 0x57cc19
cmp al, 0x2c
ja 0x57cc06
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x57cc16
cmp al, 0x24
je 0x57cc16
nop dword [rax]
cmp al, 0x26
jae 0x57cc16
jmp 0x57cc19
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x57cc16
cmp al, 0x5b
je 0x57cc16
cmp al, 0x5d
jne 0x57cc19
xor eax, eax
ret
cmp al, 0x2f
ja 0x57cc52
nop dword [rax]
cmp al, 0x26
ja 0x57cc31
cmp al, 0x24
je 0x57cc71
cmp al, 0x26
je 0x57cc71
jmp 0x57cceb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x57cc71
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x57cce8
cmp al, 0x2f
je 0x57cc71
jmp 0x57cceb
cmp al, 0x3d
ja 0x57cc69
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x57cc71
nop
cmp al, 0x3d
je 0x57cc71
jmp 0x57cceb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x57cce0
cmp rbx, 2
jg 0x57cca7
cmp rbx, 1
je 0x57cca1
nop dword [rax]
cmp rbx, 2
jne 0x57cceb
cmp al, 0x2f
je 0x57cc92
cmp al, 0x3b
je 0x57cc92
cmp al, 0x2c
jne 0x57cc99
mov ecx, 1
jmp 0x57cc9e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x57ccca
cmp al, 0x40
je 0x57ccb9
cmp al, 0x2f
je 0x57ccb9
cmp al, 0x3f
jne 0x57ccc2
mov ecx, 1
nop
jmp 0x57ccc7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x57ccd9
cmp rbx, 7
jne 0x57cceb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x57cce8
cmp al, 0x7e
jne 0x57cceb
xor eax, eax
ret
cmp rbx, 7
jne 0x57cd01
cmp al, 0x21
je 0x57ccfd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x57cd01
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x580160
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x5803c6
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x88], rax
xor edx, edx
xor esi, esi
jmp 0x5801b4
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
mov rdx, rcx
mov rsi, rdi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x5803b0
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x80], rsi
mov rax, rbx
mov rbx, rcx
lea rcx, [0x007eead8]
mov edi, 1
nop dword [rax]
call fcn.0050fbc0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x50], rdi
lea rcx, [0x007eeba0]
mov edi, 1
call fcn.0050f500
test rax, rax
jge 0x58038a
mov rbx, qword [rsp + 0x48]
test rbx, rbx
jne 0x58022f
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x80]
jmp 0x58019c
mov rax, qword [rsp + 0x68]
lea rcx, [0x007eebb0]
mov edi, 1
call fcn.0050fbc0
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x40], rdi
nop
mov ecx, 6
call fcn.0057cd20
test rcx, rcx
je 0x58027c
mov r8, qword [rsp + 0x58]
test r8, r8
cmovne rcx, r8
mov r8, qword [rsp + 0x80]
cmovne rdi, r8
jmp 0x58019c
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
nop
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x40]
mov ecx, 6
call fcn.0057cd20
nop dword [rax + rax]
test rcx, rcx
je 0x5802c5
mov r8, qword [rsp + 0x58]
test r8, r8
cmovne rcx, r8
mov r8, qword [rsp + 0x80]
cmovne rdi, r8
nop dword [rax]
jmp 0x58019c
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rbx
lea rax, [0x006fa9e0]
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x48]
call fcn.00413320
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rbx, qword [rax + 8]
inc rbx
nop dword [rax + rax]
cmp rcx, rbx
jae 0x580340
mov qword [rsp + 0x70], rax
mov rax, rdx
mov edi, 1
lea rsi, [0x006bb4c0]
call fcn.0044aa20
mov rdi, qword [rsp + 0x70]
mov qword [rdi + 0x10], rcx
cmp dword [0x00a04ed0], 0
jne 0x580335
mov qword [rdi], rax
jmp 0x58033a
call fcn.00465a20
mov rdx, rax
mov rax, rdi
mov qword [rax + 8], rbx
lea rsi, [rbx - 1]
shl rsi, 4
mov r8, qword [rsp + 0x40]
mov qword [rdx + rsi + 8], r8
lea rdi, [rdx + rsi]
cmp dword [0x00a04ed0], 0
jne 0x58036e
mov r8, qword [rsp + 0x60]
mov qword [rdx + rsi], r8
jmp 0x580378
mov rdx, qword [rsp + 0x60]
call fcn.00465b40
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x80]
jmp 0x58019c
lea rax, [0x00728f5e]
mov ebx, 0x24
xor ecx, ecx
xor edi, edi
mov rsi, rdi
nop dword [rax]
call fcn.004c2160
mov rcx, rax
mov rdi, rbx
jmp 0x58019c
mov rax, rdx
mov rbx, rsi
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00580160
Function at 0x583880
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x583a97
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x5839ae
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x583a89
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x583922
mov rax, rdx
mov rcx, rsi
call fcn.00466860
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x58398a
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00583d20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x583a81
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x5839b4
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x583a31
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00583d20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x583a6f
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x583a6b
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00466860
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.00465f80
mov rax, rdx
mov ecx, 0x40
call fcn.00465f80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00583880
Function at 0x58b340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58b46f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
mov rbx, rax
mov ecx, 0x30
call fcn.0053bf20
nop
test al, al
jne 0x58b3b6
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x27
lea rcx, [0x0072a952]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007f1c00]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp qword [rsp + 0x58], 0
nop dword [rax]
je 0x58b461
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x30], xmm15
mov byte [rsp + 0x27], 0
lea rax, [rsp + 0x50]
lea rbx, [rsp + 0x28]
lea rcx, [rsp + 0x27]
mov edi, 1
call fcn.0053c720
test al, al
je 0x58b42f
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx]
movzx r8d, byte [rsp + 0x27]
xor r8d, 0xffffff80
movzx eax, r8b
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
call rsi
nop
test rax, rax
je 0x58b3b6
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006d8800]
call fcn.0040daa0
mov qword [rax + 8], 0x26
lea rcx, [0x0072a25a]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007f1c00]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0058b340