joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467e40
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x006dc924]
mov ebx, 0x32
call fcn.00436b60
nop
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x461300

Function at 0x4a6440
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a663b
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
nop dword [rax + rax]
cmp rdi, 8
ja 0x4a6627
test sil, sil
je 0x4a6479
cmp rcx, 8
jne 0x4a6614
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x00943330], rdx
jl 0x4a64b5
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
mov qword [rsp + 0x98], rcx
xor edx, edx
jmp 0x4a6505
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rax + 8], r8
lea r8, [r8 + r8*2]
shl r8, 4
lea r12, [r8 + r11]
lea r12, [r12 - 0x30]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r12], xmm0
lea r8, [r8 + r11]
lea r8, [r8 - 0x20]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r8 + 0x10], xmm0
inc qword [rax + 0x38]
inc rdx
mov rcx, r9
cmp rdi, rdx
jle 0x4a6605
cmp rdx, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rdx
mov r10d, 1
shl r10d, cl
and r10d, r8d
test sil, r10b
mov r8d, 2
mov r10d, 3
cmovne r8, r10
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
mov qword [rsp + 0x48], r8
imul rcx, r9
lea r8, [rbx + rcx]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov r8, qword [rax + 0x38]
mov qword [rsp + 0x68], r8
mov r8, qword [rax + 8]
inc r8
mov r11, qword [rax]
mov rcx, qword [rax + 0x10]
nop word [rax + rax]
cmp rcx, r8
jae 0x4a64c1
mov qword [rsp + 0x40], rdx
mov rax, r11
mov rbx, r8
mov edi, 1
lea rsi, [0x006b4a00]
call fcn.0044a8e0
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 0x10], rcx
cmp dword [0x01328750], 0
jne 0x4a65c0
mov qword [rdi], rax
jmp 0x4a65c5
call fcn.00465580
mov rdx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x98]
mov r10d, 3
mov r8, rbx
mov r11, rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
nop
jmp 0x4a64c1
mov eax, 1
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x00679360]
lea rbx, [0x007578c0]
call fcn.004363c0
lea rax, [0x00679360]
lea rbx, [0x007576e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp fcn.004a6440
Function at 0x4a8d40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x200]
cmp r12, qword [r14 + 0x10]
jbe 0x4a8ff9
sub rsp, 0x280
mov qword [rsp + 0x278], rbp
lea rbp, [rsp + 0x278]
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x298], rcx
mov qword [rsp + 0x2a0], rdi
bt esi, 9
jae 0x4a8fe5
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf8], rcx
nop
movzx edx, byte [rcx + 0x17]
mov byte [rsp + 0xcf], dl
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
call fcn.004b0c40
mov rdx, qword [rsp + 0xe0]
and edx, 0x1e0
movzx edi, byte [rsp + 0xcf]
and edi, 0x1f
or rdi, rdx
mov rdx, qword [0x0075ccb0]
lea r8, [0x0075cca8]
nop word [rax + rax]
cmp rax, r8
jne 0x4a8fd6
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe8], rbx
nop
lea rcx, [0x004b2140]
mov qword [rsp + 0xd0], rcx
movups xmmword [rsp + 0x1c0], xmm15
lea rdi, [rsp + 0x1c8]
lea rdi, [rdi - 0x10]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465ccf
mov rbp, qword [rbp]
mov rax, rbx
xor ebx, ebx
call fcn.004ac2a0
mov rcx, qword [rsp]
mov qword [rsp + 0x1c0], rcx
lea rdi, [rsp + 0x1c8]
lea rsi, [rsp + 8]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466006
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x1c0]
mov qword [rsp + 0x108], rcx
lea rdi, [rsp + 0x110]
lea rsi, [rsp + 0x1c8]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466006
mov rbp, qword [rbp]
lea rax, [0x006a3720]
call fcn.0040d900
mov rcx, qword [rsp + 0xd0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1b0]
cmp dword [0x01328750], 0
jne 0x4a8f02
mov qword [rax + 8], rcx
nop
jmp 0x4a8f0b
lea rdi, [rax + 8]
call fcn.00465680
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0x198]
mov qword [rax + 0x10], rdx
movzx edx, word [rsp + 0x1b8]
mov word [rax + 0x18], dx
mov r8, qword [rsp + 0xe0]
sar r8, 0xa
mov qword [rax + 0x20], r8
mov rsi, qword [rsp + 0xd8]
mov qword [rax + 0x38], rsi
cmp dword [0x01328750], 0
jne 0x4a8f6a
mov rcx, qword [rsp + 0xf8]
mov qword [rax + 0x28], rcx
mov rdi, qword [rsp + 0x100]
mov qword [rax + 0x30], rdi
jmp 0x4a8f8f
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0xf8]
call fcn.00465680
lea rdi, [rax + 0x30]
mov r9, qword [rsp + 0x100]
call fcn.00465720
mov rdi, r9
mov rax, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x290]
nop
call fcn.004ad920
mov rax, qword [rsp + 0xe8]
test byte [rax], al
mov rcx, qword [rsp + 0xe0]
and ecx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0x278]
add rsp, 0x280
ret
mov rbx, rdx
lea rcx, [0x006bc060]
call fcn.0040ac00
lea rax, [0x00679360]
lea rbx, [0x00757840]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004a8d40
Function at 0x4a9da0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9e07
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x12
jne 0x4a9dd4
mov rax, qword [rax + 0x38]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004a99c0
mov ecx, 0x22
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006d7550]
call fcn.0044e740
call fcn.0040af60
mov rbx, rax
lea rax, [0x00679360]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
call fcn.004633c0
mov rax, qword [rsp + 8]
jmp fcn.004a9da0
Function at 0x4aefa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af12c
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
jne 0x4af020
cmp qword [rax + 0x40], rdi
jbe 0x4af118
mov rax, qword [rax + 0x30]
test rdx, 0x60
mov ecx, 0
mov esi, 0x20
cmovne rcx, rsi
mov rsi, qword [rax]
imul rdi, rsi
nop
and edx, 0x180
or rcx, rdx
movzx edx, byte [rax + 0x17]
and edx, 0x1f
or rcx, rdx
nop
add rbx, rdi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
jne 0x4af073
cmp qword [rbx + 8], rdi
jbe 0x4af105
mov rax, qword [rax + 0x30]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
mov rdx, qword [rax]
movzx esi, byte [rax + 0x17]
and esi, 0x1f
or rcx, rsi
or rcx, 0x180
nop
nop
imul rdi, rdx
add rdi, qword [rbx]
mov rbx, rdi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x18
jne 0x4af0c7
cmp qword [rbx + 8], rdi
jbe 0x4af0b4
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
mov rdx, qword [rbx]
or rcx, 0x88
mov rax, qword [0x012d2100]
nop
lea rbx, [rdx + rdi]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00679360]
lea rbx, [0x00757950]
call fcn.004363c0
mov qword [rsp + 0x10], rcx
lea rax, [0x0069a6e0]
call fcn.0040d900
mov qword [rax + 8], 0x13
lea rcx, [0x006d045d]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006831c0]
nop dword [rax]
call fcn.004363c0
lea rax, [0x00679360]
lea rbx, [0x00757310]
call fcn.004363c0
lea rax, [0x00679360]
lea rbx, [0x00757940]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004aefa0
Function at 0x4af160
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af26f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
test rcx, rcx
je 0x4af238
test dil, dil
je 0x4af19d
test rcx, 0x60
jne 0x4af225
bt ecx, 9
jae 0x4af1bd
mov rdi, rbx
mov rsi, rcx
mov ebx, 9
mov rcx, rax
lea rax, [0x006cc6c0]
call fcn.004a8d40
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x14
jne 0x4af213
mov qword [rsp + 0x28], rbx
mov rcx, rdx
call fcn.004afe80
test rax, rax
je 0x4af1fd
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
mov rbx, qword [rcx + 8]
test rdx, rdx
je 0x4af1f0
mov rdx, qword [rdx + 8]
mov rax, rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, rdx
call fcn.004acf60
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00679360]
lea rbx, [0x00757960]
call fcn.004363c0
lea rax, [0x0069a6e0]
nop
call fcn.0040d900
mov qword [rax + 8], 0x17
lea rcx, [0x006d230e]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006831c0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp fcn.004af160
Function at 0x4af360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af4f9
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x4af3ef
cmp rcx, 0x11
je 0x4af3e1
nop dword [rax]
cmp rcx, 0x12
jne 0x4af499
nop
cmp qword [rax], 8
jne 0x4af4e5
nop
cmp qword [rax + 8], 0
nop dword [rax + rax]
je 0x4af4e5
bt edx, 7
jae 0x4af3cf
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045e960
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x15
jne 0x4af42f
nop
cmp qword [rax], 8
nop word [rax + rax]
jne 0x4af4cf
nop
cmp qword [rax + 8], 0
je 0x4af4cf
bt edx, 7
jae 0x4af41b
mov rbx, qword [rbx]
mov rax, rbx
nop
call fcn.0045ed60
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x16
je 0x4af449
cmp rcx, 0x18
jne 0x4af499
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
call fcn.004a9e20
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
nop
cmp rax, 0x11
jne 0x4af486
mov rax, qword [rsp + 0x18]
call fcn.004a9e20
mov rcx, qword [rax + 0xa0]
mov rax, rbx
call rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00679360]
lea rbx, [0x00757700]
call fcn.004363c0
lea rax, [0x0069a6e0]
call fcn.0040d900
mov qword [rax + 8], 0x11
lea rcx, [0x006cf499]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006831c0]
call fcn.004363c0
lea rax, [0x00679360]
lea rbx, [0x00757340]
nop dword [rax]
call fcn.004363c0
lea rax, [0x00679360]
lea rbx, [0x00757340]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004af360
Function at 0x4af540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af787
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], r8
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x15
jne 0x4af725
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov r10, qword [rax + 0x30]
nop dword [rax]
cmp qword [0x012d20f8], r10
je 0x4af5c0
mov rcx, r8
and r8d, 0x1f
cmp r8, 0x18
jne 0x4af60a
mov r8, rcx
nop dword [rax]
cmp qword [rsp + 0x88], r10
jne 0x4af60d
mov r11, qword [rax + 0x38]
cmp qword [r11], 0x80
ja 0x4af60d
mov rcx, qword [rsi]
mov rdi, qword [rsi + 8]
nop
cmp qword [rax], 8
jne 0x4af712
nop
cmp qword [rax + 8], 0
je 0x4af712
bt edx, 7
jae 0x4af5fe
mov rbx, qword [rbx]
nop
call fcn.0045ec00
jmp 0x4af697
mov r8, rcx
mov rax, rdi
mov rbx, rsi
mov rcx, r8
lea rdi, [0x006d1a55]
mov esi, 0x16
mov r8, r10
xor r9d, r9d
call fcn.004b18a0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
bt ecx, 7
jb 0x4af653
lea rbx, [rsp + 0x90]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 8
nop dword [rax]
jne 0x4af6ff
nop
cmp qword [rax + 8], 0
je 0x4af6ff
mov rdx, qword [rsp + 0x40]
bt edx, 7
jae 0x4af687
mov rsi, qword [rsp + 0x58]
mov rsi, qword [rsi]
jmp 0x4af68c
mov rsi, qword [rsp + 0x58]
mov rcx, rbx
mov rbx, rsi
call fcn.0045eba0
test rax, rax
je 0x4af6ef
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0x38]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x40]
or rsi, rdi
test rsi, 0x60
mov ebx, 0
mov esi, 0x20
cmovne rbx, rsi
movzx esi, byte [rdx + 0x17]
and esi, 0x1f
or rbx, rsi
nop
mov rcx, rax
mov rax, rdx
nop dword [rax + rax]
call fcn.004afdc0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x00679360]
lea rbx, [0x00757340]
call fcn.004363c0
lea rax, [0x00679360]
lea rbx, [0x00757340]
call fcn.004363c0
mov qword [rsp + 0x40], rcx
call fcn.004ad160
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x0069a6e0]
call fcn.0040d900
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x01328750], 0
jne 0x4af777
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006831c0]
call fcn.004363c0
mov rdi, rax
mov rcx, qword [rsp + 0x48]
nop
call fcn.00465680
jmp 0x4af75f
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004af540
Function at 0x4af7e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x50]
cmp r12, qword [r14 + 0x10]
jbe 0x4afa3d
sub rsp, 0xd0
mov qword [rsp + 0xc8], rbp
lea rbp, [rsp + 0xc8]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rbx
mov rdx, rcx
and ecx, 0x1f
nop dword [rax]
cmp rcx, 0x15
jne 0x4af9dc
mov rsi, qword [rax + 0x30]
test rdx, 0x60
mov r8d, 0
mov r9d, 0x20
cmovne r8, r9
movzx r9d, byte [rsi + 0x17]
and r9d, 0x1f
or r8, r9
nop
nop
cmp qword [rax], 8
jne 0x4af9c9
nop
cmp qword [rax + 8], 0
je 0x4af9c9
bt edx, 7
jae 0x4af872
mov rbx, qword [rbx]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x28], r8
nop dword [rax]
test rbx, rbx
jne 0x4af889
xor ecx, ecx
jmp 0x4af8a8
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x60], rax
mov rax, rbx
call fcn.0045ed60
mov rbx, qword [rsp + 0x40]
mov rcx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rdi, [rsp + 0x68]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465ceb
mov rbp, qword [rbp]
lea rcx, [rsp + 0x68]
call fcn.0045ec80
lea rax, [0x006cac20]
mov rbx, qword [rsp + 0x18]
mov rcx, rbx
call fcn.0044a800
mov qword [rsp + 0x58], rax
xor ecx, ecx
jmp 0x4af912
lea rax, [rsp + 0x68]
nop
call fcn.0045ece0
mov rcx, qword [rsp + 0x20]
inc rcx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x18]
nop word [rax + rax]
cmp rcx, rdx
jge 0x4af9ac
mov qword [rsp + 0x20], rcx
lea rax, [rsp + 0x68]
call fcn.0045ed20
test rax, rax
je 0x4af99a
mov rbx, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x48]
call fcn.004afdc0
mov rdx, qword [rsp + 0x20]
lea rsi, [rdx + rdx*2]
mov rdi, qword [rsp + 0x58]
mov qword [rdi + rsi*8 + 0x10], rcx
lea r8, [rdi + rsi*8]
lea r8, [r8 + 8]
lea r9, [rdi + rsi*8]
cmp dword [0x01328750], 0
jne 0x4af985
mov qword [rdi + rsi*8], rax
mov qword [rdi + rsi*8 + 8], rbx
jmp 0x4af8fa
mov rdi, r9
call fcn.00465580
mov rdi, r8
call fcn.004656c0
jmp 0x4af8fa
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
cmp rcx, rdx
mov rax, qword [rsp + 0x58]
ja 0x4af9c4
mov rbx, rcx
mov rcx, rdx
mov rbp, qword [rsp + 0xc8]
add rsp, 0xd0
ret
call fcn.00465aa0
lea rax, [0x00679360]
lea rbx, [0x00757340]
call fcn.004363c0
mov qword [rsp + 0x38], rcx
call fcn.004ad160
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rbx
lea rax, [0x0069a6e0]
call fcn.0040d900
mov rcx, qword [rsp + 0x30]
mov qword [rax + 8], rcx
cmp dword [0x01328750], 0
jne 0x4afa2e
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006831c0]
call fcn.004363c0
mov rdi, rax
mov rcx, qword [rsp + 0x50]
call fcn.00465680
jmp 0x4afa16
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004af7e0
Function at 0x4b0c40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0d6f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
test rcx, rcx
je 0x4b0d38
bt ecx, 9
jae 0x4b0cf9
sar rcx, 0xa
movzx edx, byte [rax + 0x17]
and edx, 0x1f
cmp rdx, 0x14
jne 0x4b0cb1
mov rdx, qword [rax + 0x38]
cmp qword [rax + 0x40], rcx
jbe 0x4b0d25
mov ebx, dword [rdx + rcx*8 + 4]
call fcn.00460920
mov rbx, rax
lea rax, [0x0075cca8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x10], rcx
nop dword [rax + rax]
call fcn.004a9ac0
mov rcx, qword [rsp + 0x10]
cmp rbx, rcx
jbe 0x4b0d0d
shl rcx, 4
mov ebx, dword [rax + rcx + 4]
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.00460920
mov rbx, rax
lea rax, [0x0075cca8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, rax
lea rax, [0x0075cca8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00679360]
lea rbx, [0x007578d0]
nop dword [rax + rax]
call fcn.004363c0
lea rax, [0x00679360]
lea rbx, [0x007578d0]
call fcn.004363c0
lea rax, [0x0069a6e0]
nop
call fcn.0040d900
mov qword [rax + 8], 0x12
lea rcx, [0x006cfb3f]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006831c0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b0c40
Function at 0x4b0da0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0f2f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x15
ja 0x4b0e45
cmp rcx, 0x12
je 0x4b0e8c
nop dword [rax]
cmp rcx, 0x13
jne 0x4b0e36
bt edx, 9
jb 0x4b0e24
nop
cmp qword [rax], 8
jne 0x4b0f1b
nop
cmp qword [rax + 8], 0
nop dword [rax]
je 0x4b0f1b
bt edx, 7
jae 0x4b0e0f
mov rbx, qword [rbx]
test rbx, rbx
je 0x4b0e17
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
lea rax, [0x004b2140]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x15
je 0x4b0e8c
nop dword [rax]
jmp 0x4b0ed2
cmp rcx, 0x16
jne 0x4b0e80
cmp qword [rax + 8], 0
jne 0x4b0e8c
mov qword [rsp + 0x18], rbx
mov rax, qword [rbx]
call fcn.0045ef60
nop
test al, al
je 0x4b0f08
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x17
je 0x4b0eb2
cmp rcx, 0x1a
jne 0x4b0ed2
nop
cmp qword [rax], 8
jne 0x4b0ebf
nop
cmp qword [rax + 8], 0
je 0x4b0ebf
bt edx, 7
nop
jae 0x4b0ea5
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rbx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00679360]
lea rbx, [0x00757340]
call fcn.004363c0
lea rax, [0x0069a6e0]
call fcn.0040d900
mov qword [rax + 8], 0x1b
lea rcx, [0x006d40f1]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006831c0]
call fcn.004363c0
lea rax, [0x00679360]
lea rbx, [0x007577c0]
call fcn.004363c0
lea rax, [0x00679360]
lea rbx, [0x00757340]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b0da0
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.2.13
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.140009990
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140001c50
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.140013fcc
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140001c10
jmp 0x14000126c
mov ecx, 0x2000
call fcn.140013fcc
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140001c10
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi]
mov eax, 0x2000
cmp r12, rax
mov rbx, r12
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000e958
cmp rax, rbx
jne 0x14000125e
mov rcx, qword [rdi]
call fcn.14000e6cc
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140007de0
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.14000f064
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.14000e6cc
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000aec0
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140001c50
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.140009670
mov rcx, r13
call fcn.140013fb8
mov rcx, rbp
call fcn.140013fb8
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret