joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61c440
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x61c58c
push rbp
mov rbp, rsp
sub rsp, 0x60
movq qword [rsp + 0x58], xmm15
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x37], 0
mov rdx, qword [rax]
cmp qword [rdx + 0x48], 0
jne 0x61c479
movabs rdx, 0x37e11d600
jmp 0x61c47d
mov rdx, qword [rdx + 0x48]
lea rax, [0x00743830]
lea rbx, [0x0092d4c0]
mov rcx, rdx
call fcn.004f7c40
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x37], 1
nop
cmp byte [0x0092d4c9], 0
je 0x61c4db
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx]
lea rbx, [0x006d0b99]
mov ecx, 0x25
xor edi, edi
xor esi, esi
mov r8, rsi
call fcn.00627de0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x70]
call fcn.006274e0
test rax, rax
je 0x61c542
movups xmmword [rsp + 0x48], xmm15
je 0x61c4fc
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
cmp byte [0x0092d4c9], 0
je 0x61c535
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx]
lea rbx, [0x006d2500]
mov ecx, 0x29
lea rdi, [rsp + 0x48]
mov esi, 1
mov r8, rsi
call fcn.00627de0
mov rax, qword [rsp + 0x70]
call fcn.0061d300
nop
jmp 0x61c56c
nop
cmp byte [0x0092d4c9], 0
je 0x61c56c
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx]
lea rbx, [0x006d0bbe]
mov ecx, 0x25
xor edi, edi
xor esi, esi
mov r8, rsi
call fcn.00627de0
mov byte [rsp + 0x37], 0
mov rdx, qword [rsp + 0x58]
mov rax, qword [rdx]
call rax
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.0061c440
Function at 0x61c6e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x61c904
push rbp
mov rbp, rsp
sub rsp, 0xa8
movq qword [rsp + 0xa0], xmm15
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov byte [rsp + 0x1b], 0
lea rdx, [rax + 0x50]
mov rcx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rcx + 0x50], esi
sete sil
test sil, sil
jne 0x61c75a
mov qword [rsp + 0x20], rdx
mov rax, rdx
nop dword [rax]
call fcn.0046b320
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0xc0]
movups xmmword [rsp + 0x30], xmm15
lea rsi, [0x0061c940]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0xa0], rdx
mov byte [rsp + 0x1b], 1
mov rdx, qword [rcx + 0x80]
cmp dword [0x0092d940], 0
je 0x61c7a6
call fcn.0045fe40
mov qword [r11], rbx
mov rsi, qword [rcx + 0x80]
mov qword [r11 + 8], rsi
mov qword [rcx + 0x80], rbx
cmp qword [rcx + 0x90], 0
jne 0x61c820
cmp byte [rbx], 0
nop word [rax + rax]
je 0x61c8e2
mov qword [rsp + 0x28], rdx
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x18]
xor eax, eax
mov rbx, rdx
call fcn.0044af60
mov rdx, qword [rsp + 0xb8]
mov qword [rdx + 0x90], rbx
cmp dword [0x0092d940], 0
je 0x61c808
call fcn.0045fe40
mov qword [r11], rax
mov rsi, qword [rdx + 0x88]
mov qword [r11 + 8], rsi
mov qword [rdx + 0x88], rax
mov rcx, rdx
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0xc0]
nop
test rdx, rdx
je 0x61c836
mov edx, dword [rdx + 0x10]
test edx, edx
je 0x61c836
mov rsi, qword [rcx + 0x80]
mov dword [rsi + 0x10], edx
mov rdx, qword [rcx + 0x98]
mov esi, dword [rbx + 0xc]
mov dword [rsp + 0x1c], esi
lea rdi, [rsp + 0x40]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004604cb
mov rbp, qword [rbp]
lea rax, [0x0067c160]
mov rbx, rdx
lea rcx, [rsp + 0x40]
call fcn.0040f2e0
jmp 0x61c893
lea rax, [rsp + 0x40]
call fcn.0040f500
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x61c8c7
mov edx, dword [rsp + 0x1c]
cmp dword [rsi], edx
jbe 0x61c889
mov rbx, qword [0x008999f0]
mov rcx, qword [0x008999f8]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx]
nop dword [rax + rax]
call fcn.00619c80
jmp 0x61c889
mov byte [rsp + 0x1b], 0
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rdx]
call rax
add rsp, 0xa8
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740220]
call fcn.004337c0
nop
call fcn.00433720
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax]
jmp fcn.0061c6e0
Function at 0x61d660
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x61d8f4
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x38]
lea rbx, [0x006c51bc]
mov ecx, 7
mov rax, rdx
call fcn.00520820
test rbx, rbx
jne 0x61d79e
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x006b12c0]
lea rcx, [0x006c7aa8]
mov edi, 0x11
call fcn.004121a0
mov rbx, qword [rax + 8]
nop dword [rax]
test rbx, rbx
je 0x61d73d
mov rdx, qword [rax]
cmp rbx, 1
jg 0x61d6f6
mov rsi, qword [rdx + 8]
test rsi, rsi
je 0x61d73d
cmp rsi, 7
jne 0x61d6f6
mov rsi, qword [rdx]
cmp dword [rsi], 0x6e756863
jne 0x61d6f6
cmp word [rsi + 4], 0x656b
jne 0x61d6f6
cmp byte [rsi + 6], 0x64
je 0x61d73d
mov rcx, qword [rax + 0x10]
movups xmmword [rsp + 0x28], xmm15
mov rax, rdx
call fcn.0040a9e0
lea rdx, [0x0066b960]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x006d5653]
mov ebx, 0x33
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004bfac0
add rsp, 0x38
pop rbp
ret
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x006b12c0]
lea rcx, [0x006c5963]
mov edi, 0xa
call fcn.004121a0
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x61d80d
mov rdx, qword [rax]
cmp rbx, 1
jg 0x61d817
mov rsi, qword [rdx + 8]
nop dword [rax]
test rsi, rsi
je 0x61d80d
mov rdi, qword [rdx]
nop
cmp rsi, 5
jne 0x61d899
xor ecx, ecx
jmp 0x61d861
movups xmmword [rsp + 0x28], xmm15
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x006b12c0]
lea rcx, [0x006c51bc]
mov edi, 7
call fcn.004121a0
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.0040a9e0
lea rdx, [0x0066b960]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x006d2529]
mov ebx, 0x29
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004bfac0
add rsp, 0x38
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
mov rcx, qword [rax + 0x10]
movups xmmword [rsp + 0x28], xmm15
mov rax, rdx
call fcn.0040a9e0
lea rdx, [0x0066b960]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x006d351d]
mov ebx, 0x2c
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004bfac0
add rsp, 0x38
pop rbp
ret
inc rcx
cmp rcx, 5
jge 0x61d80d
movzx r8d, byte [rcx + rdi]
lea r9d, [r8 - 0x41]
cmp r9b, 0x19
ja 0x61d87a
add r8d, 0x20
lea r9, [0x006c4e0a]
movzx r9d, byte [r9 + rcx]
lea r10d, [r9 - 0x41]
cmp r10b, 0x19
ja 0x61d894
add r9d, 0x20
cmp r8b, r9b
je 0x61d85e
nop
nop word [rax + rax]
cmp rsi, 0xa
jne 0x61d817
xor ecx, ecx
jmp 0x61d8b1
inc rcx
cmp rcx, 0xa
jge 0x61d80d
movzx esi, byte [rcx + rdi]
lea r8d, [rsi - 0x41]
cmp r8b, 0x19
ja 0x61d8cc
add esi, 0x20
lea r8, [0x006c596d]
movzx r8d, byte [r8 + rcx]
lea r9d, [r8 - 0x41]
nop dword [rax]
cmp r9b, 0x19
ja 0x61d8ea
add r8d, 0x20
cmp sil, r8b
je 0x61d8ae
jmp 0x61d817
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.0061d660
Function at 0x6222a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x6224f3
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rbx
mov qword [rax + 0x148], 0
mov qword [rax + 0x158], 0
mov byte [rax + 0x160], 0
lea rdi, [rsp + 0x60]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004604cb
mov rbp, qword [rbp]
lea rcx, [rsp + 0x60]
lea rax, [0x006b12c0]
nop
call fcn.0040f2e0
xor eax, eax
jmp 0x622340
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
call fcn.0040f500
mov rcx, qword [rsp + 0x38]
mov rax, rcx
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x62235f
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rcx]
mov rcx, qword [rcx + 8]
mov rdx, qword [rdx + 8]
jmp 0x6224e9
mov rdx, qword [rsp + 0xd0]
cmp qword [rdx + 0x100], rax
jb 0x6223ae
lea rdi, [rsp + 0x60]
lea rdi, [rdi - 0x20]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004604cb
mov rbp, qword [rbp]
lea rax, [0x006b12c0]
mov rbx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x60]
call fcn.0040f2e0
jmp 0x6223d6
mov rdi, qword [0x00899a60]
mov rsi, qword [0x00899a68]
xor eax, eax
xor ebx, ebx
mov rcx, rbx
add rsp, 0xc0
pop rbp
ret
lea rax, [rsp + 0x60]
call fcn.0040f500
mov rdx, qword [rsp + 0x60]
nop dword [rax + rax]
test rdx, rdx
je 0x622425
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
mov qword [rsp + 0x48], rdx
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rcx
call fcn.00617f00
test cl, cl
je 0x6223cc
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
nop
jmp 0x6224c4
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rdx + 0x148]
mov rax, qword [rdx + 0x158]
nop dword [rax + rax]
cmp rax, rcx
ja 0x62247c
mov r8, qword [rdx + 0x140]
mov rdx, qword [rdx + 0x150]
sub rdx, rax
sub rcx, rax
mov r9, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, r8
mov rbx, rcx
mov rcx, r9
xor edi, edi
xor esi, esi
add rsp, 0xc0
pop rbp
ret
nop dword [rax]
call fcn.004602a0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x58], rdx
mov rdi, qword [rdx]
mov rsi, qword [rdx + 8]
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0xd0]
call fcn.00622520
mov rdx, qword [rsp + 0x58]
add rdx, 0x10
mov rcx, qword [rsp + 0x40]
dec rcx
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x30]
test rcx, rcx
jg 0x622485
jmp 0x6223cc
mov rsi, rbx
mov rdi, qword [rbx + 8]
lea rdi, [rdx + rdi]
lea rdi, [rdi + 0x20]
mov edi, edi
lea rbx, [rsi + 0x10]
dec rcx
add rax, rdi
test rcx, rcx
jg 0x6224ce
jmp 0x622329
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.006222a0
Function at 0x622520
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x62266e
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa8], rdi
cmp byte [0x0092d4c9], 0
je 0x622659
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa8], rdi
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, rbx
mov rbx, rcx
call fcn.0040a940
lea rcx, [0x0066d140]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb0]
call fcn.0040a940
lea rcx, [0x0066d140]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
lea rcx, [0x006226c0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], 0x28
lea rcx, [0x006d1e94]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x78], 2
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x68], rcx
mov rax, qword [0x008a6600]
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0x50]
call fcn.005f5160
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa8]
mov rax, qword [rax + 0x168]
xor r8d, r8d
call fcn.00601a20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00622520
Function at 0x623fa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6241fd
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rbx]
mov ecx, dword [rcx + 8]
mov ebx, ecx
call fcn.006266e0
test rax, rax
je 0x6241f3
mov qword [rsp + 0x18], rax
cmp byte [rax + 0x15e], 0
nop
jne 0x624161
cmp byte [rax + 0x15a], 0
jne 0x624016
mov rsi, qword [rax + 0x20]
test rsi, rsi
je 0x62400f
mov rdx, qword [rsi + 0x18]
nop
nop dword [rax]
test rdx, rdx
je 0x62400f
mov rax, qword [rdx]
call rax
mov rax, qword [rsp + 0x18]
mov byte [rax + 0x15a], 1
cmp byte [rax + 0x15b], 0
nop dword [rax]
jne 0x624148
mov byte [rax + 0x15b], 1
mov rbx, rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
call fcn.00624220
nop
test rbx, rbx
je 0x6240ba
lea rdx, [0x00741b40]
cmp rbx, rdx
jne 0x62405d
mov rax, rbx
mov rbx, rcx
add rsp, 0x38
pop rbp
ret
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx]
mov edx, dword [rdx + 8]
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x24], 1
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
lea rax, [0x006aa6e0]
lea rbx, [rsp + 0x20]
call fcn.0040a6e0
mov rcx, qword [rsp + 0x18]
mov byte [rcx + 0x15f], 1
lea rbx, [0x00741b60]
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.00619b20
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
test rax, rax
je 0x62413e
lea rcx, [rax + 0x78]
cmp dword [0x0092d940], 0
jne 0x6240d3
mov rdx, qword [rsp + 0x18]
jmp 0x6240fa
call fcn.0045fe80
mov qword [r11], rcx
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rdx + 0x168]
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rax
mov rbx, qword [rdx + 0x100]
mov qword [r11 + 0x18], rbx
mov qword [rdx + 0x168], rcx
mov qword [rdx + 0x100], rax
mov rax, qword [rdx + 0xf8]
call fcn.00406a80
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
movzx ecx, byte [rcx + 2]
test cl, 1
je 0x624134
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x18]
call fcn.00626500
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
mov rbx, rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
call fcn.00624f60
add rsp, 0x38
pop rbp
nop
ret
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x28
lea rcx, [0x006d1ebc]
mov qword [rax], rcx
movups xmmword [rsp + 0x20], xmm15
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov ecx, dword [rcx + 8]
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x24], 1
lea rcx, [0x00741740]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x006aa6e0]
lea rbx, [rsp + 0x20]
call fcn.0040a6e0
mov rcx, qword [rsp + 0x18]
mov byte [rcx + 0x15f], 1
lea rbx, [0x00741b60]
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.00619b20
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00623fa0
Function at 0x625920
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x625b96
push rbp
mov rbp, rsp
sub rsp, 0xa8
mov qword [rsp + 0x70], rax
lea rdx, [rax + 0x30]
mov qword [rsp + 0x50], rdx
mov rcx, qword [0x00899a40]
mov rdi, qword [0x00899a48]
lea rbx, [rax + 0x98]
mov r8, qword [rax]
mov qword [rsp + 0x48], r8
xor esi, esi
mov rax, rdx
call fcn.00618bc0
mov rbx, qword [0x00899a40]
mov rcx, qword [0x00899a48]
mov rax, qword [rsp + 0x70]
call fcn.00619b20
mov rax, qword [rsp + 0x50]
call fcn.00618440
test rax, rax
jle 0x625ace
mov rdx, qword [rsp + 0x48]
lea rsi, [rdx + 0x50]
mov rcx, rax
xor eax, eax
mov edi, 1
lock cmpxchg dword [rdx + 0x50], edi
sete r8b
test r8b, r8b
jne 0x6259e1
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x60], rsi
mov rax, rsi
call fcn.0046b320
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
mov edi, 1
movsxd r8, dword [rdx + 0x74]
add r8, rcx
movsxd r9, dword [rdx + 0x70]
add r9, r8
cmp r9, 0x7fffffff
jg 0x625b82
mov dword [rdx + 0x74], r8d
cmp r8d, 0x1000
jge 0x625a14
cmp dword [rdx + 0x70], r8d
jle 0x625a14
xor r8d, r8d
jmp 0x625a1f
add dword [rdx + 0x70], r8d
mov dword [rdx + 0x74], 0
mov dword [rsp + 0x3c], r8d
nop
mov ebx, 0xffffffff
lock xadd dword [rdx + 0x50], ebx
dec ebx
test ebx, ebx
je 0x625a4c
mov rax, rsi
call fcn.0046b600
mov rdx, qword [rsp + 0x48]
mov edi, 1
mov r8d, dword [rsp + 0x3c]
lea rsi, [rdx + 0x118]
mov qword [rsp + 0x58], rsi
xor eax, eax
lock cmpxchg dword [rdx + 0x118], edi
sete dil
test dil, dil
jne 0x625a82
mov rax, rsi
call fcn.0046b320
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x3c]
test r8d, r8d
jle 0x625a9d
mov rax, qword [rdx + 0x128]
xor ebx, ebx
mov ecx, r8d
call fcn.00614b60
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx + 0x120]
call fcn.00479160
nop
mov ebx, 0xffffffff
mov rcx, qword [rsp + 0x48]
lock xadd dword [rcx + 0x118], ebx
dec ebx
nop
test ebx, ebx
je 0x625ace
mov rax, qword [rsp + 0x58]
call fcn.0046b600
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rdx + 0x20]
mov rbx, qword [rcx + 0xe8]
mov qword [rsp + 0x68], rbx
call rdx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x78], rcx
lea rax, [rsp + 0x78]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
mov esi, 3
mov r8d, 1
call fcn.004445c0
test rax, rax
je 0x625b6b
cmp rax, 1
jne 0x625b5e
xor eax, eax
xor ebx, ebx
add rsp, 0xa8
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0xa8
pop rbp
ret
mov rax, qword [0x00899a00]
mov rbx, qword [0x00899a08]
add rsp, 0xa8
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740200]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
nop dword [rax + rax]
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.00625920
Function at 0x626880
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x626a3f
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x98], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx]
test byte [rax], al
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x00647060]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
mov edx, dword [rax + 0x68]
test edx, edx
jne 0x6268ef
mov qword [rsp + 0x40], rax
lea rcx, [rax + 0x68]
lea rbx, [rsp + 0x60]
mov rax, rcx
nop dword [rax + rax]
call fcn.0046b720
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rax + 0x78]
mov rdx, qword [rdx + 0x20]
mov rax, qword [rax + 0x80]
mov rbx, rcx
call rdx
mov rbx, qword [rsp + 0x98]
cmp dword [rbx + 0x10], 0
je 0x626a2b
movups xmmword [rsp + 0x50], xmm15
mov eax, dword [rbx + 0x10]
nop
call fcn.0040a860
lea rcx, [0x0067df60]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
cmp byte [0x0092d4c9], 0
je 0x626965
mov rdx, qword [rsp + 0x38]
mov rax, qword [rdx]
lea rbx, [0x006d2552]
mov ecx, 0x29
lea rdi, [rsp + 0x50]
mov esi, 1
mov r8, rsi
call fcn.00627de0
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x58]
test rdx, rdx
je 0x626a23
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x98]
mov ecx, dword [rdx + 0x10]
mov dword [rsp + 0x34], ecx
mov rbx, qword [0x008a63f0]
lea rax, [0x0067c460]
nop dword [rax]
call fcn.00410480
test bl, bl
je 0x6269b2
mov rdx, qword [rax]
mov r8, qword [rax + 8]
jmp 0x6269fa
movups xmmword [rsp + 0x70], xmm15
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.0040a860
lea rcx, [0x0066d2c0]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, [0x006c6ade]
mov ebx, 0xe
lea rcx, [rsp + 0x70]
mov edi, 1
mov rsi, rdi
call fcn.004c2a60
mov r8, rbx
mov rdx, rax
xor eax, eax
lea rbx, [0x006c6204]
mov ecx, 0xc
mov rdi, rdx
mov rsi, r8
call fcn.0044abe0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx]
call r8
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x38]
call fcn.0061c6e0
xor eax, eax
xor ebx, ebx
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00626880
Function at 0x636420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63660f
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov rsi, qword [rax + 0x40]
nop dword [rax + rax]
test rsi, rsi
je 0x636471
lea rdi, [0x00742768]
cmp rsi, rdi
je 0x636455
xor ecx, ecx
jmp 0x636476
mov rbx, qword [rax + 0x48]
lea rcx, [0x0092d4c0]
mov rax, rsi
call fcn.00405280
mov ecx, eax
mov rax, qword [rsp + 0x40]
jmp 0x636476
mov ecx, 1
test cl, cl
jne 0x6365ee
mov rsi, qword [rax + 0x40]
lea rdi, [0x00742790]
cmp rsi, rdi
jne 0x6365f8
mov r8, qword [rax + 0x48]
cmp byte [r8 + 0x10], 0
jne 0x6364a8
cmp byte [r8 + 0x11], 0
je 0x6365ee
cmp byte [r8 + 0x11], 0
jne 0x6364ca
nop
test rsi, rsi
je 0x6364ca
mov rcx, qword [rsi + 0x18]
mov rax, r8
call rcx
mov rax, qword [rsp + 0x40]
lea rdi, [0x00742790]
mov rdx, qword [rax + 0x50]
test rdx, rdx
je 0x6365d8
mov rax, qword [rdx]
call rax
nop dword [rax]
test rcx, rcx
jne 0x6365ca
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], rax
lea rax, [0x006bd040]
call fcn.0040d480
mov qword [rsp + 0x28], rax
cmp dword [0x0092d940], 0
je 0x63652a
mov rbx, rax
mov rcx, qword [rsp + 0x40]
lea rax, [0x006bd040]
nop dword [rax]
call fcn.00413600
mov rax, qword [rsp + 0x28]
mov rdi, rax
mov rsi, qword [rsp + 0x40]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00460784
mov rbp, qword [rbp]
lea rax, [0x00697780]
call fcn.0040d480
mov byte [rax + 0x10], 0
mov byte [rax + 0x11], 0
mov rcx, qword [rsp + 0x18]
mov qword [rax], rcx
cmp dword [0x0092d940], 0
jne 0x636584
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp 0x6365aa
call fcn.0045fe80
mov rdx, qword [rsp + 0x20]
mov qword [r11], rdx
mov rsi, qword [rax + 8]
mov qword [r11 + 8], rsi
mov qword [r11 + 0x10], rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsi + 0x48]
mov qword [r11 + 0x18], rdi
mov qword [rax + 8], rdx
lea rdx, [0x00742790]
mov qword [rsi + 0x40], rdx
mov qword [rsi + 0x48], rax
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x30
pop rbp
ret
xor eax, eax
mov rbx, rcx
mov rcx, rdi
add rsp, 0x30
pop rbp
ret
mov rbx, qword [0x00899ac0]
mov rcx, qword [0x00899ac8]
xor eax, eax
add rsp, 0x30
pop rbp
ret
xor ebx, ebx
xor ecx, ecx
add rsp, 0x30
pop rbp
ret
mov rbx, qword [0x00742798]
mov rax, rsi
lea rcx, [0x00684ce0]
call fcn.0040a5a0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
nop
jmp fcn.00636420
Function at 0x638ea0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x638fbf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], r8
mov rdx, qword [rax + 0x80]
test rdx, rdx
jne 0x638f5a
mov rdx, qword [rax + 0x88]
test rdx, rdx
je 0x638f48
mov r10, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
call r10
test rax, rax
jne 0x638f42
nop
test rcx, rcx
jne 0x638f42
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rbx
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x31
lea rcx, [0x006d4c10]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x48]
lea rcx, [0x00741740]
mov rdi, rax
mov rax, qword [rsp + 0x38]
add rsp, 0x58
pop rbp
ret
lea rax, [0x008a7600]
call fcn.00502b60
add rsp, 0x58
pop rbp
ret
mov r10, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
call r10
test rax, rax
jne 0x638fb9
test rcx, rcx
jne 0x638fb9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbx
nop
lea rax, [0x006870a0]
call fcn.0040d480
mov qword [rax + 8], 0x38
lea rcx, [0x006d65b9]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x50]
lea rcx, [0x00741740]
mov rdi, rax
mov rax, qword [rsp + 0x40]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00638ea0