joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59c540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59c698
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x98], r8
mov rax, rsi
mov rbx, r8
lea rcx, [0x00725c00]
mov edi, 1
call fcn.00489300
nop word [rax + rax]
test rax, rax
jl 0x59c673
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
call fcn.0059bd40
nop
test sil, sil
je 0x59c618
mov rdx, qword [rsp + 0x30]
cmp rbx, rdx
je 0x59c5d3
xor eax, eax
jmp 0x59c60e
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov rbx, rax
mov rcx, rdx
mov rax, qword [rsp + 0x48]
call fcn.00403880
test al, al
jne 0x59c5f5
xor eax, eax
jmp 0x59c60e
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
call fcn.00489080
xor ebx, ebx
xor ecx, ecx
add rsp, 0x60
pop rbp
ret
movups xmmword [rsp + 0x50], xmm15
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
call fcn.0040ae40
lea rcx, [0x0065b7a0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x006c1697]
mov ebx, 0x30
lea rcx, [rsp + 0x50]
mov edi, 1
mov rsi, rdi
nop dword [rax]
call fcn.004dd6a0
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x60
pop rbp
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
call fcn.0059c920
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0059c540
Function at 0x59c6e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59c8f7
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rdx, qword [rax + 0x30]
nop
test rdx, rdx
je 0x59c8aa
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x28], rdx
mov rsi, qword [rax + 0x28]
mov qword [rsp + 0x50], rsi
mov rbx, rdx
lea rcx, [0x00725918]
mov edi, 1
mov rax, rsi
nop
call fcn.00489300
test rax, rax
jge 0x59c74e
xor eax, eax
jmp 0x59c774
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
lea rax, [rsi + rdx]
lea rax, [rax - 1]
lea rbx, [0x00725a68]
mov ecx, 1
call fcn.00403880
xor eax, 1
test al, al
jne 0x59c784
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x50]
jmp 0x59c79f
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx + 0x28]
mov rbx, qword [rcx + 0x30]
call fcn.00577460
test rsi, rsi
jne 0x59c89c
nop
test rbx, rbx
je 0x59c7ad
cmp byte [rax], 0x5b
sete dl
jmp 0x59c7af
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
test dl, dl
je 0x59c7f3
nop dword [rax]
test rbx, rbx
jne 0x59c7c9
xor ecx, ecx
jmp 0x59c7f5
lea rdx, [rbx + rax]
lea rdx, [rdx - 1]
mov ecx, 1
mov rax, rdx
lea rbx, [0x00725a68]
call fcn.00403880
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x50]
jmp 0x59c7f5
xor ecx, ecx
test cl, cl
jne 0x59c825
call fcn.00575f20
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x30], xmm0
test al, al
je 0x59c81c
lea rax, [rsp + 0x30]
jmp 0x59c820
xor eax, eax
nop
test rax, rax
je 0x59c877
mov rax, qword [rsp + 0x78]
call fcn.005898e0
movups xmmword [rsp + 0x58], xmm15
call fcn.0040ae40
lea rcx, [0x0065b7a0]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
lea rax, [0x006c2c16]
mov ebx, 0x36
lea rcx, [rsp + 0x58]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x68
pop rbp
ret
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
call fcn.0059c920
add rsp, 0x68
pop rbp
ret
xor eax, eax
mov rbx, rsi
mov rcx, r8
add rsp, 0x68
pop rbp
ret
call fcn.005898e0
movups xmmword [rsp + 0x58], xmm15
call fcn.0040ae40
lea rcx, [0x0065b7a0]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
lea rax, [0x006c3c67]
mov ebx, 0x3e
lea rcx, [rsp + 0x58]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0059c6e0
Function at 0x59c920
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59cb32
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
test rdi, rdi
je 0x59cabb
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
call fcn.0059c260
test dil, dil
je 0x59ca63
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x98]
movzx edx, byte [rcx]
mov byte [rsp + 0x2f], dl
cmp dl, 0x2e
jne 0x59c9b4
mov rdi, qword [rsp + 0xa0]
dec rdi
mov rsi, rdi
neg rsi
sar rsi, 0x3f
and esi, 1
add rcx, rsi
jmp 0x59c9bc
mov rdi, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rax, rcx
mov rbx, rdi
call fcn.0059c260
test dil, dil
je 0x59ca11
mov rdx, qword [rsp + 0x38]
nop dword [rax + rax]
cmp rdx, rbx
jl 0x59ca05
movzx esi, byte [rsp + 0x2f]
cmp sil, 0x2e
jne 0x59c9f5
cmp rdx, rbx
je 0x59ca05
mov qword [rsp + 0x40], rbx
xor ecx, ecx
nop dword [rax]
jmp 0x59cae0
xor eax, eax
xor ebx, ebx
xor ecx, ecx
add rsp, 0x78
pop rbp
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
call fcn.0040ae40
lea rcx, [0x0065b7a0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006c02be]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x78
pop rbp
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
call fcn.0040ae40
lea rcx, [0x0065b7a0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x006c02be]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x78
pop rbp
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
add rsp, 0x78
pop rbp
ret
mov rax, qword [rsp + 0x58]
add rax, 0x10
mov rcx, qword [rsp + 0x30]
inc rcx
mov rbx, qword [rsp + 0x40]
cmp rbx, rcx
jle 0x59cb23
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x58], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
shl rcx, 4
mov r8, qword [rsp + 0x50]
mov r9, qword [r8 + rcx]
mov rdi, qword [r8 + rcx + 8]
mov rcx, r9
mov rax, rdx
call fcn.00489080
test al, al
jne 0x59caca
xor eax, eax
xor ebx, ebx
xor ecx, ecx
add rsp, 0x78
pop rbp
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.0059c920
Function at 0x5a0dc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a0e51
push rbp
mov rbp, rsp
sub rsp, 0x48
cmp rax, 3
je 0x5a0dde
cmp rax, 9
jne 0x5a0dec
mov ecx, 0x2f
lea rdx, [0x006c130b]
jmp 0x5a0df0
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
movups xmmword [rsp + 0x38], xmm15
call fcn.0040adc0
lea rcx, [0x0066c920]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x006c2608]
mov ebx, 0x34
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004e0560
mov rcx, rbx
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rbx, rax
xor eax, eax
call fcn.0044f620
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.005a0dc0

Function at 0x5a0ea0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a0f77
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [rbx + 0xb0], 3
jne 0x5a0ec5
cmp byte [rbx + 0x360], 0
je 0x5a0ed7
cmp byte [rbx + 0x360], 0
je 0x5a0eeb
cmp byte [rbx + 0x361], 0
jne 0x5a0eeb
lea rax, [0x00729200]
lea rbx, [0x009210a0]
add rsp, 0x50
pop rbp
ret
mov rdx, qword [rbx + 0x2e0]
test rdx, rdx
je 0x5a0f11
bt edx, 5
jb 0x5a0f11
lea rax, [0x00729200]
lea rbx, [0x009210a0]
add rsp, 0x50
pop rbp
ret
cmp qword [rbx + 0x98], 0
jne 0x5a0f2f
mov rax, qword [0x008be840]
mov rbx, qword [0x008be848]
add rsp, 0x50
pop rbp
ret
mov rdx, qword [rax + 0x90]
mov r12, qword [rax + 0x18]
mov rcx, qword [rax + 0x20]
mov rdi, qword [rax + 0x28]
mov rsi, qword [rax + 0x78]
mov r8, qword [rax + 0x80]
mov r9, qword [rax + 0x88]
mov r10, qword [rbx + 0xa0]
mov r11, qword [rbx + 0xa8]
mov byte [rsp], 0
mov rax, rdx
mov rbx, r12
call fcn.005a1080
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005a0ea0
Function at 0x5a1640
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a16e4
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
xor ecx, ecx
nop
jmp 0x5a1665
mov rcx, rsi
cmp rbx, rcx
jle 0x5a16da
movzx edx, byte [rax + rcx]
cmp edx, 0x80
jge 0x5a167c
lea rsi, [rcx + 1]
jmp 0x5a1694
nop dword [rax]
call fcn.0045d600
mov edx, eax
mov rsi, rbx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
cmp edx, 0x7f
jle 0x5a1662
movups xmmword [rsp + 0x28], xmm15
nop
call fcn.0040ae40
lea rcx, [0x0065b7a0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006bf89a]
mov ebx, 0x2a
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
add rsp, 0x38
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax]
jmp fcn.005a1640
Function at 0x5a5640
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a58b3
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
mov rsi, qword [rax + 0x48]
test rsi, rsi
jle 0x5a577e
cmp rsi, 0x10
ja 0x5a58a5
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rdx, [rsi - 0x10]
mov r8, rdx
neg rdx
sar r8, 0x3f
and r8, rsi
lea rsi, [r8 + rax]
lea rsi, [rsi + 0x38]
cmp rcx, rdx
cmovl rdx, rcx
mov qword [rsp + 0x28], rdx
cmp rbx, rsi
je 0x5a56d0
mov rax, rsi
mov rcx, rdx
call fcn.00467360
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rax + 0x48]
add rsi, rdx
nop word [rax + rax]
cmp rsi, 0x10
jl 0x5a576d
cmp rcx, rdx
jb 0x5a5899
mov qword [rax + 0x48], 0
mov qword [rsp], rax
lea rcx, [rax + 0x38]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x10
mov qword [rsp + 0x18], 0x10
call fcn.005a5a40
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x28]
sub rdi, rax
mov rcx, rdi
neg rcx
sar rcx, 0x3f
and rcx, rax
mov rdx, qword [rsp + 0x68]
sub rdx, rax
mov rax, qword [rsp + 0x60]
add rax, rcx
mov rcx, rdx
mov rbx, rax
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
jmp 0x5a5781
mov qword [rax + 0x48], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rdx, rcx
mov rsi, rcx
and esi, 0xf
mov r8, rcx
sub r8, rsi
test r8, r8
jle 0x5a5818
cmp rdi, r8
jb 0x5a588e
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x20], r8
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.005a5a40
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
cmp rcx, rax
jb 0x5a5889
mov rdx, qword [rsp + 0x38]
mov rsi, rax
sub rax, rdx
sar rax, 0x3f
and rax, rsi
sub rcx, rsi
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x5a586f
mov rsi, qword [rax + 0x48]
cmp rsi, 0x10
ja 0x5a587c
lea rdi, [rsi - 0x10]
mov r8, rdi
neg rdi
sar r8, 0x3f
and r8, rsi
lea rsi, [r8 + rax]
lea rsi, [rsi + 0x38]
cmp rcx, rdi
cmovl rdi, rcx
cmp rbx, rsi
je 0x5a586b
mov qword [rsp + 0x38], rdi
mov rax, rsi
mov rcx, rdi
call fcn.00467360
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x38]
add qword [rax + 0x48], rdi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
mov ecx, 0x10
call fcn.00466a20
call fcn.00466a20
mov rcx, r8
mov rdx, rdi
call fcn.004669e0
mov rax, rdx
nop dword [rax]
call fcn.00466a20
mov rax, rsi
mov ecx, 0x10
call fcn.00466a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005a5640
Function at 0x5a5a40
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x5a5b07
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x5a5a6c
test r15, r15
je 0x5a5b4a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x5a5b1c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x5a5a7b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x5a6520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a65c6
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x48], rbx
nop
cmp byte [rax + 0x50], 0
jne 0x5a65af
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rcx
call fcn.005a5640
mov rcx, qword [rsp + 0x50]
and ecx, 0xf
test rcx, rcx
je 0x5a6587
movups xmmword [rsp + 0x20], xmm15
add rcx, 0xfffffffffffffff0
neg rcx
cmp rcx, 0x10
ja 0x5a65a5
mov rax, qword [rsp + 0x40]
cmp byte [rax + 0x50], 0
jne 0x5a658d
lea rbx, [rsp + 0x20]
mov edi, 0x10
call fcn.005a5640
add rsp, 0x30
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00728120]
nop dword [rax + rax]
call fcn.00436ac0
mov edx, 0x10
call fcn.004669a0
lea rax, [0x0065b7a0]
lea rbx, [0x00728120]
nop dword [rax]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005a6520

Function at 0x5a6600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a6650
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x20], 0
nop
mov qword [rsp + 0x20], rbx
nop
cmp byte [rax + 0x50], 0
jne 0x5a663c
lea rbx, [rsp + 0x20]
mov ecx, 8
mov rdi, rcx
call fcn.005a5640
add rsp, 0x28
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00728120]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005a6600
Function at 0x5a7000
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5a70a7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5a714a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5a70a7
cmp r9, 0
je 0x5a7203
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5a7160
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5b1a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b1c55
push rbp
mov rbp, rsp
sub rsp, 0x38
cmp ax, 0x501
ja 0x5b1acb
cmp ax, 0x203
ja 0x5b1ab1
nop
cmp ax, 0x201
je 0x5b1aea
cmp ax, 0x203
je 0x5b1af7
jmp 0x5b1c06
cmp ax, 0x401
je 0x5b1aea
cmp ax, 0x403
je 0x5b1af7
nop dword [rax]
cmp ax, 0x501
je 0x5b1aea
jmp 0x5b1c06
cmp ax, 0x601
ja 0x5b1af1
cmp ax, 0x503
je 0x5b1af7
nop word [rax + rax]
cmp ax, 0x601
jne 0x5b1c06
mov ecx, 0xffffffe1
jmp 0x5b1b20
cmp ax, 0x603
jne 0x5b1afe
mov ecx, 0xffffffe3
jmp 0x5b1b20
lea edx, [rax - 0x804]
cmp dx, 2
ja 0x5b1b11
mov ecx, 0xffffffe2
jmp 0x5b1b20
cmp ax, 0x807
jne 0x5b1c06
mov ecx, 0xffffffe4
cmp ax, 0x503
ja 0x5b1b60
cmp ax, 0x401
ja 0x5b1b48
cmp ax, 0x201
je 0x5b1b38
cmp ax, 0x203
jne 0x5b1b40
mov edx, 3
jmp 0x5b1bad
cmp ax, 0x401
je 0x5b1b78
jmp 0x5b1bbc
cmp ax, 0x403
je 0x5b1b78
cmp ax, 0x501
je 0x5b1b86
cmp ax, 0x503
je 0x5b1b86
jmp 0x5b1bbc
cmp ax, 0x804
ja 0x5b1b80
cmp ax, 0x601
je 0x5b1b93
cmp ax, 0x603
je 0x5b1b93
cmp ax, 0x804
jne 0x5b1bbc
mov edx, 5
jmp 0x5b1bad
cmp ax, 0x805
jne 0x5b1b8d
mov edx, 6
jmp 0x5b1bad
cmp ax, 0x806
jne 0x5b1ba0
mov edx, 7
jmp 0x5b1bad
cmp ax, 0x807
jne 0x5b1bbc
mov rdx, qword [0x009212d8]
mov eax, ecx
mov rbx, rdx
xor ecx, ecx
xor edi, edi
add rsp, 0x38
pop rbp
ret
movups xmmword [rsp + 0x28], xmm15
call fcn.0040ace0
lea rcx, [0x00664420]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006bcbea]
mov ebx, 0x23
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
movups xmmword [rsp + 0x28], xmm15
call fcn.0040ace0
lea rcx, [0x00664420]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006bcbea]
mov ebx, 0x23
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
nop dword [rax + rax]
call fcn.004dd6a0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
mov word [rsp + 8], ax
call fcn.004646a0
movzx eax, word [rsp + 8]
jmp fcn.005b1a80
Function at 0x5b1c80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b1d82
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
nop dword [rax]
test rax, rax
je 0x5b1d44
mov edx, dword [rax + 0x10]
cmp edx, 0x4bcec15d
jne 0x5b1ce0
lea rdx, [0x00670d00]
nop dword [rax + rax]
cmp rax, rdx
jne 0x5b1d44
mov eax, 0xffffffe1
mov ebx, 8
xor ecx, ecx
xor edi, edi
add rsp, 0x38
pop rbp
ret
cmp edx, 0x8c7bd38d
jne 0x5b1d08
lea rdx, [0x00692cc0]
cmp rax, rdx
jne 0x5b1d44
mov eax, 0xffffffe3
mov ebx, 3
xor ecx, ecx
xor edi, edi
add rsp, 0x38
pop rbp
ret
cmp edx, 0xc0d9e4a4
jne 0x5b1d44
lea rdx, [0x00668960]
cmp rax, rdx
jne 0x5b1d44
lea rax, [0x006c3297]
mov ebx, 0x39
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.004dd6a0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
lea rax, [0x006bafac]
mov ebx, 0x1f
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax + rax]
jmp fcn.005b1c80
Function at 0x5b22e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b23cb
push rbp
mov rbp, rsp
sub rsp, 0x20
mov word [rsp + 0x30], ax
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
call fcn.005b1dc0
test rbx, rbx
je 0x5b2353
mov rdx, qword [rsp + 0x48]
test rdx, rdx
jne 0x5b234a
movzx esi, word [rsp + 0x30]
nop
cmp si, 0x303
jne 0x5b2343
mov dword [rsp + 0x14], 0
mov dword [rsp + 0x14], 0x2030201
mov edx, 2
lea rcx, [rsp + 0x14]
jmp 0x5b234f
mov rcx, qword [rsp + 0x40]
jmp 0x5b234f
mov rcx, qword [rsp + 0x40]
xor esi, esi
jmp 0x5b236e
mov rax, qword [rsp + 0x18]
call fcn.005b2420
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x20
pop rbp
ret
inc rsi
cmp rsi, rdx
jge 0x5b237c
movzx edi, word [rcx + rsi*2]
xor r8d, r8d
jmp 0x5b23af
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x47
lea rcx, [0x006c4886]
mov qword [rax], rcx
lea rbx, [0x00728640]
mov rcx, rax
xor eax, eax
add rsp, 0x20
pop rbp
ret
inc r8
cmp rbx, r8
jle 0x5b236b
movzx r9d, word [rax + r8*2]
cmp r9w, di
jne 0x5b23ac
mov eax, edi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x20
pop rbp
ret
mov word [rsp + 8], ax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004646a0
movzx eax, word [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.005b22e0