joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5765c0
Capabilities:
Access peb ldr_data
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x576806
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x88], rax
mov rsi, qword [rdi]
nop
mov rsi, qword [rsi + 8]
mov qword [rsp + 0x70], rsi
mov r8, qword [rax + 8]
mov r9, qword [rax]
cmp qword [rax + 0x10], rsi
jl 0x57665e
test r8, r8
je 0x57664b
shl r8, 3
mov rax, r9
mov rbx, r8
call fcn.00466440
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xa0]
mov rdx, qword [rax + 0x10]
cmp rdx, rsi
jb 0x5767fa
mov qword [rax + 8], rsi
jmp 0x5766b3
lea rax, [0x006795c0]
mov rbx, rsi
mov rcx, rbx
call fcn.0044a840
mov rdx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
cmp dword [0x0092b0b0], 0
jne 0x576693
mov qword [rdi], rax
jmp 0x576698
call fcn.00465900
mov rax, rdi
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
mov rdx, qword [rdi]
mov rsi, qword [rbx + 8]
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
mov r10, qword [rdx + 8]
mov r11, qword [rdx]
mov rdx, qword [rdx + 0x10]
cmp r10, rsi
jne 0x5767e7
mov r12, qword [rcx + 8]
mov r13, qword [rcx]
mov rcx, qword [rcx + 0x10]
cmp r10, r12
jne 0x5767e7
mov rbx, qword [rax]
mov r15, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov rdi, qword [rdi + 0x10]
mov qword [rsp], rbx
mov qword [rsp + 8], r15
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdi
call fcn.00577900
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rdx + 8]
mov rsi, qword [rdx]
mov rdi, qword [rcx + 0x10]
mov r8, qword [rcx]
cmp rdi, rbx
jb 0x5767dc
xor edi, edi
xor r9d, r9d
nop
jmp 0x5767a0
lea r10, [rdi + 1]
mov r11, qword [rsi + rdi*8]
sub r11, qword [r8 + rdi*8]
sub r11, r9
shr r11, 0x3f
mov rdi, r10
mov r9, r11
nop dword [rax + rax]
cmp rdi, rbx
jl 0x576782
mov rsi, rax
sub rax, r9
sbb rbx, rbx
sub r9, rsi
sbb rsi, rsi
nop
neg rbx
neg rsi
or rbx, rsi
xor rbx, 1
mov rax, rdx
call fcn.00575a00
mov rax, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rcx, rbx
mov rdx, rdi
call fcn.00465e20
lea rax, [0x00679500]
lea rbx, [0x00741c60]
call fcn.00436420
mov rcx, rsi
nop dword [rax]
call fcn.00465e20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005765c0
Function at 0x577b60
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x577be5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x577d46
cmp rcx, 0xe
jne 0x577c60
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x577d46
cmp rcx, 0xf
jne 0x577cd7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x577d46
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x57e2e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57e3cc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3d
lea rsi, [rdi + rdx]
and rsi, 0xfffffffffffffff8
sub rdx, rsi
lea rsi, [rdx - 8]
neg rsi
nop word [rax + rax]
cmp rsi, 8
je 0x57e37b
test rbx, rbx
je 0x57e37b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x006796c0]
mov rcx, rbx
call fcn.0044a840
mov rcx, qword [rsp + 0x20]
cmp rcx, 8
sbb edx, edx
mov rsi, qword [rsp + 0x30]
movzx edi, byte [rsi]
shr dil, cl
and edi, edx
mov byte [rax], dil
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
mov r8d, 1
jmp 0x57e3ba
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp rdi, 0x20
sbb r9d, r9d
movzx r10d, byte [r8 + rsi - 1]
mov r11, rcx
mov rcx, rdi
shl r10d, cl
and r10d, r9d
mov byte [rax + r8], r10b
movzx r9d, byte [rsi + r8]
mov rcx, r11
shr r9b, cl
and r9d, edx
or r10d, r9d
mov byte [rax + r8], r10b
inc r8
cmp rbx, r8
jg 0x57e385
mov rcx, rbx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0057e2e0
Function at 0x57e960
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x57eb71
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
mov qword [rsp + 0xa8], rax
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044eb00
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
mov rcx, rax
mov rdi, rbx
lea rax, [0x006cc53b]
mov ebx, 0xf
call fcn.004b0360
nop dword [rax]
test rdi, rdi
jne 0x57e9d3
mov edx, 0xf
lea r8, [0x006cc53b]
jmp 0x57ea00
lea rax, [0x006cd0bc]
mov ebx, 0x11
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x48]
call fcn.004b0360
mov edx, 0x11
lea r8, [0x006cd0bc]
nop word [rax + rax]
test rdi, rdi
jne 0x57eb61
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], rcx
mov rdi, r8
mov rsi, rdx
call fcn.004ad4e0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rbx
mov rdx, qword [rsp + 0x48]
nop dword [rax]
cmp rbx, rdx
jne 0x57ea5f
mov rcx, rbx
mov rbx, qword [rsp + 0x68]
call fcn.00402d80
test al, al
jne 0x57eaf8
mov rdx, qword [rsp + 0x48]
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
mov rax, qword [rsp + 0x68]
mov rbx, rdx
call fcn.0040afc0
lea rcx, [0x00679500]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x40]
call fcn.0040afc0
lea rcx, [0x00679500]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
lea rax, [0x006dece6]
mov ebx, 0x6a
lea rcx, [rsp + 0x78]
mov edi, 2
mov rsi, rdi
call fcn.004c8440
mov rcx, qword [rsp + 0x58]
mov rdi, rax
mov rsi, rbx
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
xor edi, edi
call fcn.004b54a0
cmp rax, 0x802
jge 0x57eb27
mov rbx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
jmp 0x57eb47
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
mov rdi, 0xffffffffffffff9c
xor esi, esi
mov r8, rsi
call fcn.004b5360
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0057e960
Function at 0x57eba0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x57ed0f
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044eb00
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbx
mov rcx, rax
mov rdi, rbx
lea rax, [0x006cddb6]
mov ebx, 0x13
call fcn.004b0360
nop dword [rax]
test rdi, rdi
jne 0x57ecff
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rcx
lea rdi, [0x006cddb6]
mov esi, 0x13
call fcn.004ad4e0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rsp + 0x30]
cmp rbx, rdx
jne 0x57ec69
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
call fcn.00402d80
test al, al
je 0x57ec64
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x68]
jmp 0x57ecda
mov rdx, qword [rsp + 0x30]
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
mov rax, qword [rsp + 0x58]
mov rbx, rdx
call fcn.0040afc0
lea rcx, [0x00679500]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
call fcn.0040afc0
lea rcx, [0x00679500]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, [0x006dece6]
mov ebx, 0x6a
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
call fcn.004c8440
mov rcx, qword [rsp + 0x60]
mov rdi, rax
mov rsi, rbx
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0057eba0

Function at 0x57ed40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57ee1c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
xor ecx, ecx
nop
jmp 0x57ed65
inc rcx
cmp rbx, rcx
jle 0x57ee01
movzx edx, byte [rax + rcx]
lea esi, [rdx - 0x61]
cmp sil, 0x19
jbe 0x57ed62
lea esi, [rdx - 0x41]
nop
cmp sil, 0x19
jbe 0x57ed62
lea esi, [rdx - 0x30]
cmp sil, 9
jbe 0x57ed62
lea esi, [rdx - 0x27]
cmp sil, 2
jbe 0x57ed62
lea esi, [rdx - 0x2b]
nop dword [rax + rax]
cmp sil, 4
jbe 0x57ed62
cmp dl, 0x20
je 0x57ed62
cmp dl, 0x3a
je 0x57ed62
cmp dl, 0x3d
je 0x57ed62
cmp dl, 0x3f
je 0x57ed62
cmp dl, 0x2a
je 0x57ed62
nop
cmp dl, 0x26
je 0x57ed62
lea rcx, [0x006d8979]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0x2a
mov rax, qword [rsp + 0x18]
mov ebx, 0x2a
call fcn.0040afc0
xor ebx, ebx
lea rcx, [0x007433c0]
mov rdi, rax
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044eb00
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.0057ed40
Function at 0x58a760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58a8e6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov dword [rsp + 0x2c], 0
bswap ebx
mov dword [rsp + 0x2c], ebx
cmp qword [rax], 0
jne 0x58a8c5
cmp qword [rax + 0x30], 0
jne 0x58a8cf
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x18]
add rdx, 4
cmp rdx, 4
jge 0x58a7ff
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x1b
lea rcx, [0x006d20ac]
mov qword [rax], rcx
lea rcx, [0x00742c00]
mov rdi, qword [rsp + 0x48]
mov qword [rdi], rcx
cmp dword [0x0092b0b0], 0
jne 0x58a7ea
mov qword [rdi + 8], rax
jmp 0x58a7fc
lea rdx, [rdi + 8]
mov rbx, rdi
mov rdi, rdx
call fcn.00465900
mov rdi, rbx
mov rax, rdi
cmp byte [rax + 0x28], 0
je 0x58a85a
mov rdx, qword [rax + 0x18]
add rdx, 4
cmp qword [rax + 0x20], rdx
jge 0x58a85a
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x36
lea rcx, [0x006dbc8b]
mov qword [rax], rcx
lea rcx, [0x00742c00]
mov rdi, qword [rsp + 0x48]
mov qword [rdi], rcx
cmp dword [0x0092b0b0], 0
jne 0x58a84f
mov qword [rdi + 8], rax
jmp 0x58a8c5
add rdi, 8
call fcn.00465900
jmp 0x58a8c5
mov rbx, qword [rax + 0x18]
lea rdx, [rbx + 4]
mov rcx, qword [rax + 0x20]
mov r8, qword [rax + 0x10]
cmp rcx, rdx
jae 0x58a89b
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 4
lea rsi, [0x006796c0]
call fcn.0044a920
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov esi, dword [rsp + 0x2c]
mov dword [r8 + rbx], esi
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rcx
cmp dword [0x0092b0b0], 0
jne 0x58a8ba
mov qword [rax + 0x10], r8
jmp 0x58a8c5
lea rdi, [rax + 0x10]
nop
call fcn.00465a80
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00679500]
lea rbx, [0x00741db0]
nop dword [rax]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463740
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.0058a760
Function at 0x58d7c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58d89c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov rdx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rdx + 0x30]
call rdx
mov rcx, qword [rax + 0x30]
cmp qword [rax + 0x38], 5
nop
jne 0x58d85a
cmp dword [rcx], 0x35322d50
jne 0x58d85a
cmp byte [rcx + 4], 0x36
jne 0x58d85a
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x38]
nop
call fcn.00575300
call fcn.005600a0
test rdi, rdi
jne 0x58d85a
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x18]
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x30]
call fcn.00575480
test rbx, rbx
jne 0x58d888
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + 0x20]
mov rdi, qword [rdx + 0x28]
mov rsi, qword [rdx + 0x30]
mov r8, qword [rdx + 0x18]
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
call fcn.00576a00
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00679500]
lea rbx, [0x00741bd0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0058d7c0
Function at 0x58d8e0
Capabilities:
Encode data using base64
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58dabc
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x80], rdi
mov r9, qword [rbx + 0x18]
mov r10, qword [r9]
mov r10, qword [r10 + 8]
mov r11, r10
shl r10, 6
sub r10, r11
sub r10, qword [r9 + 8]
lea r9, [r10 + 7]
sar r9, 0x3f
shr r9, 0x3d
lea r9, [r9 + r10]
lea r9, [r9 + 7]
sar r9, 3
cmp rsi, r9
jl 0x58da09
nop word [rax + rax]
cmp r8, r9
jb 0x58dab0
mov rdx, r9
shl r9, 3
sub r9, r10
test r9, r9
jle 0x58da47
nop dword [rax]
test rdi, rdi
jne 0x58d970
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x58da03
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x50], rcx
nop
test rdx, rdx
ja 0x58d991
lea rax, [rsp + 0x28]
xor esi, esi
xor r8d, r8d
jmp 0x58d9ca
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x40], rdx
lea rax, [rsp + 0x28]
mov rbx, rdx
xor ecx, ecx
mov rdi, rbx
lea rsi, [0x006796c0]
call fcn.0044a920
mov rdx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x80]
mov rsi, rcx
mov r8, rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x48], rax
mov rbx, rdi
mov rcx, rdx
nop
call fcn.00466740
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x70]
mov r9, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
lea r8, [rdx - 1]
jmp 0x58da52
mov rdx, qword [rbx + 0x18]
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
mov rdi, r8
mov rsi, rdx
nop dword [rax]
call fcn.005755c0
test rbx, rbx
jne 0x58da34
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x00679500]
lea rbx, [0x00741be0]
call fcn.00436420
mov rsi, rdx
jmp 0x58da09
dec r8
mov rcx, rdi
test r8, r8
jl 0x58daa3
cmp r9, 8
sbb r10d, r10d
movzx r11d, byte [rax + r8]
mov rdi, rcx
mov rcx, r9
shr r11b, cl
and r10d, r11d
mov byte [rax + r8], r10b
test r8, r8
jle 0x58da4c
movzx r11d, byte [r8 + rax - 1]
lea r12, [rcx - 8]
neg r12
test r12, r12
jl 0x58daab
cmp r12, 0x20
sbb r13d, r13d
mov rcx, r12
shl r11d, cl
and r11d, r13d
or r10d, r11d
mov byte [rax + r8], r10b
jmp 0x58da4c
mov r8, rsi
mov rdi, rax
jmp 0x58da47
call fcn.00435080
mov rcx, r9
mov rdx, r8
call fcn.00465e20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.0058d8e0
Function at 0x58e300
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x58e58f
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x128], rax
xor ecx, ecx
jmp 0x58e366
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
mov ecx, 1
cmp rcx, 1
jge 0x58e3f9
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x120], rax
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x100], xmm15
movups xmmword [rsp + 0x110], xmm15
test byte [rax], al
lea rbx, [rsp + 0xf8]
mov ecx, 0x28
call fcn.00402d80
test al, al
je 0x58e351
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xd8], xmm15
movups xmmword [rsp + 0xe8], xmm15
mov rax, qword [rsp + 0x120]
add rax, 0x28
lea rbx, [rsp + 0xd0]
mov ecx, 0x28
call fcn.00402d80
test al, al
je 0x58e351
jmp 0x58e57b
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
test byte [rax], al
lea rbx, [rax + 0x50]
lea rax, [rsp + 0x58]
call fcn.0056bb60
lea rcx, [rsp + 0xa8]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x140]
mov qword [rsp + 8], rdx
lea rsi, [rsp + 0x58]
mov qword [rsp + 0x10], rsi
call fcn.0056d620
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x80]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x140]
add rdx, 0x28
mov qword [rsp + 8], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x10], rdx
call fcn.0056d620
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x148]
test byte [rcx], al
nop
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rax, [rsp + 0x80]
lea rbx, [rsp + 0x38]
call fcn.0056c4c0
cmp rbx, 0x20
mov ecx, 0x20
cmovl rcx, rbx
mov rdx, qword [rsp + 0x148]
cmp rax, rdx
je 0x58e517
mov rbx, rax
mov rax, rdx
call fcn.00466740
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rax, [rsp + 0xa8]
lea rbx, [rsp + 0x18]
call fcn.0056c4c0
test rbx, rbx
jbe 0x58e571
mov rdx, qword [rsp + 0x148]
movzx esi, byte [rdx + 0x1f]
movzx edi, byte [rax]
and edi, 1
shl rdi, 7
or esi, edi
mov byte [rdx + 0x1f], sil
mov rax, rdx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
xor eax, eax
mov rcx, rax
call fcn.00465da0
lea rax, [0x00679500]
lea rbx, [0x00741c90]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0058e300
Function at 0x58ef80
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x158]
cmp r12, qword [r14 + 0x10]
jbe 0x58f11c
sub rsp, 0x1d8
mov qword [rsp + 0x1d0], rbp
lea rbp, [rsp + 0x1d0]
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f0], rcx
movups xmmword [rsp + 0x1c0], xmm15
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], rcx
xor edx, edx
jmp 0x58f000
mov rdx, qword [rsp + 0x18]
inc rdx
mov rax, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x1e8]
nop
cmp rdx, 2
jge 0x58f07e
mov qword [rsp + 0x18], rdx
mov rax, qword [rsp + rdx*8 + 0x1c0]
mov qword [rsp + 0x1b0], rax
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
test byte [rax], al
lea rbx, [rsp + 0x48]
mov ecx, 0x28
call fcn.00402d80
nop
test al, al
je 0x58efde
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
mov rax, qword [rsp + 0x1b0]
add rax, 0x28
lea rbx, [rsp + 0x20]
mov ecx, 0x28
call fcn.00402d80
test al, al
je 0x58efde
jmp 0x58f108
lea rdi, [rsp + 0x110]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466054
mov rbp, qword [rbp]
lea rax, [rsp + 0x110]
mov rbx, rcx
call fcn.0058ed00
lea rdi, [rsp + 0x70]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466054
mov rbp, qword [rbp]
mov rbx, qword [rsp + 0x1e8]
mov rcx, rax
lea rax, [rsp + 0x70]
call fcn.0058f160
mov rbx, rax
mov rax, qword [rsp + 0x1b8]
call fcn.0058ea80
mov rbp, qword [rsp + 0x1d0]
add rsp, 0x1d8
ret
lea rax, [0x00679500]
lea rbx, [0x00741c90]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.0058ef80