joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad380
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad526
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop
cmp byte [0x008cc890], 0
je 0x4ad3da
lea rdx, [0x0065bb60]
mov qword [0x008cc898], rdx
cmp dword [0x00921500], 0
je 0x4ad3d3
nop dword [rax]
call fcn.004665c0
mov qword [r11], rbx
mov rdx, qword [0x008cc8a0]
mov qword [r11 + 8], rdx
mov qword [0x008cc8a0], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x18], rcx
nop
cmp rcx, 0x15
ja 0x4ad448
cmp rcx, 0x12
je 0x4ad486
cmp rcx, 0x13
jne 0x4ad440
bt edx, 9
jb 0x4ad432
nop
cmp qword [rax], 8
jne 0x4ad50e
cmp qword [rax + 8], 0
je 0x4ad50e
bt edx, 7
jae 0x4ad421
mov rbx, qword [rbx]
test rbx, rbx
je 0x4ad429
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
lea rax, [0x004b1c80]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x15
je 0x4ad486
jmp 0x4ad4c5
cmp rcx, 0x16
jne 0x4ad478
cmp qword [rax + 8], 0
jne 0x4ad486
mov rax, qword [rbx]
mov qword [rsp + 0x10], rax
nop dword [rax]
call fcn.004603e0
test al, al
je 0x4ad4fb
mov rax, qword [rsp + 0x10]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x17
je 0x4ad4a5
nop
cmp rcx, 0x1a
jne 0x4ad4c5
cmp qword [rax], 8
jne 0x4ad4ae
cmp qword [rax + 8], 0
je 0x4ad4ae
bt edx, 7
jae 0x4ad49c
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
mov rax, qword [rbx]
add rsp, 0x20
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727ba0]
nop dword [rax]
call fcn.00436ac0
lea rax, [0x0067f1c0]
call fcn.0040d680
mov qword [rax + 8], 0x15
lea rcx, [0x006b6421]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00668240]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727dd0]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727ba0]
nop dword [rax]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004ad380
Function at 0x4ad800
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad962
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x28], rax
test rcx, 0x60
jne 0x4ad844
bt ecx, 8
jb 0x4ad86f
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.004aa7e0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
and ecx, 0x1f
nop
cmp rcx, 0x17
jne 0x4ad8ff
test byte [rax], al
nop
call fcn.004a7720
test rax, rax
je 0x4ad893
lea rcx, [0x0072d308]
jmp 0x4ad897
xor ecx, ecx
xor eax, eax
mov rcx, qword [rcx + 0x98]
nop
call rcx
cmp rax, 8
jne 0x4ad8ec
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x70]
mov qword [rcx + 0x10], rax
cmp dword [0x00921500], 0
jne 0x4ad8cf
mov rax, qword [rsp + 0x60]
jmp 0x4ad8e3
call fcn.004665c0
mov rax, qword [rsp + 0x60]
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
add rsp, 0x38
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727de0]
call fcn.00436ac0
mov qword [rsp + 0x18], rcx
call fcn.004aa4a0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rax
lea rax, [0x0067f1c0]
call fcn.0040d680
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x00921500], 0
jne 0x4ad951
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00668240]
call fcn.00436ac0
call fcn.004665a0
mov rcx, qword [rsp + 0x20]
mov qword [r11], rcx
nop
jmp 0x4ad931
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004ad800
Function at 0x4ad9c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4adb3c
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x28], rbx
test rcx, 0x60
jne 0x4ada04
bt ecx, 8
jb 0x4ada2f
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.004aa7e0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
and ecx, 0x1f
nop
cmp rcx, 0x17
jne 0x4adad7
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
ja 0x4ada62
cmp rcx, 0x11
jne 0x4ada56
mov rcx, qword [rax + 0x30]
jmp 0x4ada8e
cmp rcx, 0x12
jne 0x4ada8c
mov rcx, qword [rax + 0x30]
jmp 0x4ada8e
cmp rcx, 0x15
jne 0x4ada6e
mov rcx, qword [rax + 0x38]
jmp 0x4ada8e
cmp rcx, 0x16
jne 0x4ada80
mov rcx, qword [rax + 0x30]
jmp 0x4ada8e
cmp rcx, 0x17
jne 0x4ada8c
mov rcx, qword [rax + 0x30]
jmp 0x4ada8e
xor ecx, ecx
movzx ecx, byte [rcx + 0x17]
and ecx, 0x1f
cmp rcx, 5
jne 0x4adac4
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], r8
cmp dword [0x00921500], 0
je 0x4adabb
call fcn.004665c0
mov qword [r11], rdi
mov rax, qword [rbx]
mov qword [r11 + 8], rax
mov qword [rbx], rdi
add rsp, 0x38
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727df0]
call fcn.00436ac0
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.004aa4a0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rax
lea rax, [0x0067f1c0]
call fcn.0040d680
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x00921500], 0
jne 0x4adb2d
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00668240]
call fcn.00436ac0
call fcn.004665a0
mov rcx, qword [rsp + 0x20]
mov qword [r11], rcx
jmp 0x4adb0d
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.004ad9c0
Function at 0x4adf20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae16c
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x18], rcx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
jne 0x4adf70
bt edx, 8
nop dword [rax + rax]
jae 0x4ae158
mov rcx, qword [rax + 0x40]
mov rax, qword [rax + 0x38]
jmp 0x4adf84
cmp rcx, 0x17
jne 0x4ae075
mov r8, qword [rbx]
mov rcx, qword [rbx + 0x10]
mov rbx, r8
test rdi, rdi
jl 0x4ae145
cmp rsi, rdi
jl 0x4ae145
cmp rsi, rcx
jg 0x4ae145
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x10], rcx
lea rax, [0x00658de0]
call fcn.0040d680
mov qword [rax], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x10]
sub rcx, rdx
mov qword [rax + 0x10], rcx
nop
test rcx, rcx
jle 0x4ae01a
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsi + 0x30]
mov rdi, qword [rdi]
imul rdx, rdi
mov rdi, qword [rsp + 0x28]
add rdx, rdi
cmp dword [0x00921500], 0
je 0x4ae015
call fcn.004665c0
mov qword [r11], rdx
mov rdi, qword [rax]
mov qword [r11 + 8], rdi
mov qword [rax], rdx
jmp 0x4ae046
cmp dword [0x00921500], 0
jne 0x4ae02a
mov rdx, qword [rsp + 0x28]
jmp 0x4ae03e
call fcn.004665c0
mov rdx, qword [rsp + 0x28]
mov qword [r11], rdx
mov rsi, qword [rax]
mov qword [r11 + 8], rsi
mov qword [rax], rdx
mov rsi, qword [rsp + 0x20]
test byte [rsi], al
mov rdx, qword [rsp + 0x18]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
or rcx, 0x97
mov rbx, rax
mov rax, rsi
add rsp, 0x40
pop rbp
ret
cmp rcx, 0x18
jne 0x4ae105
nop
test rdi, rdi
jl 0x4ae0f0
cmp rsi, rdi
jl 0x4ae0f0
cmp qword [rbx + 8], rsi
jl 0x4ae0f0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x00680700]
call fcn.0040d680
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x38]
cmp qword [rdx + 8], rcx
jle 0x4ae0dd
mov rdx, qword [rdx]
mov rsi, qword [rsp + 0x70]
sub rsi, rcx
nop
mov qword [rax + 8], rsi
add rdx, rcx
cmp dword [0x00921500], 0
je 0x4ae0da
call fcn.004665a0
mov qword [r11], rdx
mov qword [rax], rdx
mov rbx, rax
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x30]
add rsp, 0x40
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727e10]
nop
call fcn.00436ac0
mov qword [rsp + 0x18], rcx
lea rax, [0x0067f1c0]
call fcn.0040d680
mov qword [rax + 8], 0x13
lea rcx, [0x006b5605]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00668240]
nop dword [rax + rax]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727e20]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727e00]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004adf20
Function at 0x4ae300
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae414
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop dword [rax]
test rcx, rcx
je 0x4ae3de
bt ecx, 9
jae 0x4ae3a8
movzx edx, byte [rax + 0x17]
and edx, 0x1f
sar rcx, 0xa
nop word [rax + rax]
cmp rdx, 0x14
jne 0x4ae36a
cmp qword [rax + 0x40], rcx
jbe 0x4ae3cb
mov rdx, qword [rax + 0x38]
mov ebx, dword [rdx + rcx*8 + 4]
nop
call fcn.00461dc0
mov rbx, rax
lea rax, [0x0072d308]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.00402160
mov rcx, qword [rsp + 0x10]
nop
cmp rbx, rcx
jbe 0x4ae3b8
shl rcx, 4
mov ebx, dword [rax + rcx + 4]
nop
mov rax, qword [rsp + 0x18]
call fcn.00461dc0
mov rbx, rax
lea rax, [0x0072d308]
add rsp, 0x20
pop rbp
ret
mov rbx, rax
lea rax, [0x0072d308]
add rsp, 0x20
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727cc0]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727cc0]
call fcn.00436ac0
lea rax, [0x0067f1c0]
call fcn.0040d680
mov qword [rax + 8], 0x12
lea rcx, [0x006b4cec]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00668240]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004ae300

Function at 0x4ae440
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae5a6
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
nop
cmp rcx, 0x15
ja 0x4ae4cc
cmp rcx, 0x12
je 0x4ae50c
cmp rcx, 0x13
jne 0x4ae4c4
bt edx, 9
jb 0x4ae4b6
nop
cmp qword [rax], 8
jne 0x4ae590
cmp qword [rax + 8], 0
je 0x4ae590
bt edx, 7
nop
jae 0x4ae4a5
mov rbx, qword [rbx]
test rbx, rbx
je 0x4ae4ad
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
lea rax, [0x004b1c80]
nop
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x15
je 0x4ae50c
jmp 0x4ae547
cmp rcx, 0x16
jne 0x4ae500
cmp qword [rax + 8], 0
jne 0x4ae50c
mov qword [rsp + 0x18], rbx
mov rax, qword [rbx]
call fcn.004603e0
test al, al
je 0x4ae57d
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x17
je 0x4ae52b
cmp rcx, 0x1a
jne 0x4ae547
cmp qword [rax], 8
jne 0x4ae534
cmp qword [rax + 8], 0
je 0x4ae534
bt edx, 7
jae 0x4ae522
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
mov rax, qword [rbx]
add rsp, 0x20
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727ba0]
call fcn.00436ac0
lea rax, [0x0067f1c0]
call fcn.0040d680
mov qword [rax + 8], 0x1b
lea rcx, [0x006b9477]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00668240]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727e30]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727ba0]
nop
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004ae440
Function at 0x4aec20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aed92
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x98]
mov rax, rbx
call rdx
cmp rax, 0x17
jne 0x4aed7e
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jl 0x4aed6b
mov rdx, qword [rsp + 0x48]
test rdx, rdx
jl 0x4aed58
nop dword [rax + rax]
cmp rcx, rdx
jg 0x4aed45
lea rax, [0x006886e0]
call fcn.0040d680
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x38]
call rdx
lea rcx, [0x0072d308]
cmp rax, rcx
jne 0x4aed2d
test byte [rbx], al
mov rax, rbx
mov rbx, qword [rsp + 0x48]
call fcn.00460080
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rbx + 0x10], rcx
cmp dword [0x00921500], 0
je 0x4aecf4
call fcn.004665c0
mov qword [r11], rax
mov rdx, qword [rbx]
mov qword [r11 + 8], rdx
mov qword [rbx], rax
mov rax, qword [rsp + 0x30]
lea rdx, [0x0072d308]
cmp rax, rdx
jne 0x4aed1a
mov rax, qword [rsp + 0x38]
test byte [rax], al
mov ecx, 0x97
add rsp, 0x20
pop rbp
ret
mov rbx, qword [0x0072d310]
lea rcx, [0x0069f7a0]
call fcn.0040ab20
mov rbx, qword [0x0072d310]
lea rcx, [0x0069f7a0]
nop dword [rax + rax]
call fcn.0040ab20
lea rax, [0x0065b7a0]
lea rbx, [0x00727e70]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727e60]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727e50]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727e40]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.004aec20
Function at 0x4af280
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af3ad
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x98], rdi
bt ecx, 9
jae 0x4af2e2
mov rdi, rbx
mov rsi, rcx
mov ebx, 7
mov rcx, rax
lea rax, [0x006b122e]
call fcn.004a6e00
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov rdx, qword [rdi + 0x100]
mov rax, rsi
call rdx
mov rbx, qword [rsp + 0x60]
call fcn.004af660
test rax, rax
je 0x4af33a
mov r8, qword [rax]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rdx, rax
mov rax, qword [rsp + 0x60]
call r8
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
nop
call fcn.004a73c0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx + 0xf8]
mov rax, qword [rsp + 0xa0]
call rcx
mov ecx, 0x25
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006ba396]
mov r9d, 0x1d
mov r10, rax
mov r11, rbx
xor eax, eax
lea rbx, [0x006bdab0]
call fcn.0044f780
call fcn.0040ae40
mov rbx, rax
lea rax, [0x0065b7a0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004af280

Function at 0x4b2740
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b27f9
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x48], rcx
mov rdx, qword [rax + 0x18]
mov rax, rbx
call rdx
mov rcx, qword [rsp + 0x50]
cmp rax, rcx
jne 0x4b27e5
lea rax, [0x0066dc00]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.0040b0a0
test rax, rax
je 0x4b27b7
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
call rdx
add rsp, 0x28
pop rbp
ret
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
call fcn.004b2540
mov rbx, rax
lea rax, [0x00729608]
add rsp, 0x28
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x007276f0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004b2740
Function at 0x4b2bc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2c79
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x48], rcx
mov rdx, qword [rax + 0x18]
mov rax, rbx
call rdx
mov rcx, qword [rsp + 0x50]
cmp rax, rcx
jne 0x4b2c65
lea rax, [0x0066db80]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.0040b0a0
test rax, rax
je 0x4b2c37
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
call rdx
add rsp, 0x28
pop rbp
ret
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
call fcn.004b2540
mov rbx, rax
lea rax, [0x007295e0]
add rsp, 0x28
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727730]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004b2bc0
Function at 0x4b71c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4b71ff
jb 0x4b7214
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x4b7280
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4b72bf
jb 0x4b72d4
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4b7340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4b7414
jb 0x4b7473
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004b7160
aeskeygenassist xmm1, xmm0, 1
call fcn.004b7180
aeskeygenassist xmm1, xmm2, 2
call fcn.004b7160
aeskeygenassist xmm1, xmm0, 2
call fcn.004b7180
aeskeygenassist xmm1, xmm2, 4
call fcn.004b7160
aeskeygenassist xmm1, xmm0, 4
call fcn.004b7180
aeskeygenassist xmm1, xmm2, 8
call fcn.004b7160
aeskeygenassist xmm1, xmm0, 8
call fcn.004b7180
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004b7160
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004b7180
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004b7160
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004b7180
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004b7160
jmp 0x4b74e1
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004b70c0
aeskeygenassist xmm1, xmm2, 2
call fcn.004b7120
aeskeygenassist xmm1, xmm2, 4
call fcn.004b70c0
aeskeygenassist xmm1, xmm2, 8
call fcn.004b7120
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004b70c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004b7120
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004b70c0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004b7120
jmp 0x4b74e1
aeskeygenassist xmm1, xmm0, 1
call fcn.004b7080
aeskeygenassist xmm1, xmm0, 2
call fcn.004b7080
aeskeygenassist xmm1, xmm0, 4
call fcn.004b7080
aeskeygenassist xmm1, xmm0, 8
call fcn.004b7080
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004b7080
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004b7080
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004b7080
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004b7080
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004b7080
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004b7080
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4b74ee
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret