joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462040
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
cmp rcx, 4
jge 0x4620d0
lea rdx, [rsp + 0x38]
cmp rbx, rdx
je 0x4620c4
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
shl rcx, 3
mov rax, rdx
call fcn.00466460
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov edx, 4
lea rbx, [rsp + 0x38]
jmp 0x4620dd
cmp rcx, 0x2a
jg 0x46219f
mov rdx, rcx
mov rsi, qword [r14 + 0x30]
nop
inc dword [rsi + 0x23c]
mov rsi, qword [r14 + 0x30]
nop
mov rdi, r14
mov qword [rsi + 0x130], rdi
mov rsi, qword [r14 + 0x30]
mov qword [r14 + 0xe8], rsi
lea rsi, fcn.00442660
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x1f], 1
mov rsi, qword [r14 + 0x30]
mov qword [rsi + 0x2c0], rax
mov qword [rsi + 0x2c8], rcx
test rdx, rdx
jbe 0x462195
mov qword [rsp + 0x58], rsi
mov qword [rsi + 0x2d0], rbx
lea rbx, [rsi + 0x2c0]
mov rax, qword [0x008c3630]
call fcn.004045e0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x2d8]
mov rsi, qword [rcx + 0x2e0]
mov rcx, qword [rcx + 0x2e8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
call fcn.00442660
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
mov rcx, rax
call fcn.00465aa0
lea rax, [0x00667a40]
lea rbx, [0x0072e1e0]
call fcn.00436260
nop
call fcn.00435700
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
Function at 0x4654e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40354f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409ea0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403520
cmp byte [0x00918601], 0
je 0x4654f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x462540
jmp 0x403520

Function at 0x465500
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00918b80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00918601], 0
je 0x465535
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00918f00]
aesenc xmm0, xmmword [0x00918f10]
aesenc xmm0, xmmword [0x00918f20]
movq rax, xmm0
ret
jmp 0x40a0a0

Function at 0x465540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00918b80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00918601], 0
je 0x465576
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00918f00]
aesenc xmm0, xmmword [0x00918f10]
aesenc xmm0, xmmword [0x00918f20]
movq rax, xmm0
ret
jmp 0x40a100

Function at 0x466fa0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00918e80]
mov qword [rsp + 8], rdx
lea r8d, [0x00918624]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00465420
add rsp, 0x30
ret

Function at 0x4674e0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46750c
call fcn.00465420
shl rcx, 3
add rcx, 0x1480
mov qword [0x00918820], rcx
ret
Function at 0x467a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x432074
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
cmp dword [0x00918a90], 0
nop
jne 0x431f32
lea rdx, [0x00466f20]
mov qword [0x008c3630], rdx
jmp 0x431f45
lea rdi, [0x008c3630]
lea rdx, [0x00466f20]
call fcn.00465720
xor eax, eax
jmp 0x431f60
lea r8, [0x00918e80]
mov byte [r8 + rax], sil
inc dword [0x00918624]
mov rax, rdi
nop dword [rax]
cmp rax, 0x36
jge 0x431fb0
lea rdx, [0x006cac0f]
movzx esi, byte [rdx + rax]
cmp esi, 0x80
jge 0x431f7f
lea rdi, [rax + 1]
jmp 0x431fa5
mov qword [rsp + 0x20], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
call fcn.0045d100
lea rdx, [0x006cac0f]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x20]
cmp rax, 0x64
jb 0x431f49
jmp 0x432069
call fcn.00431120
call fcn.00449980
call fcn.00449a20
nop
call fcn.00431ba0
xor eax, eax
call fcn.00431ae0
mov dword [0x00918670], eax
call fcn.00431c60
call fcn.004319c0
mov dword [0x00918650], eax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [sym.imp.kernel32.dll_GetSystemInfo]
lea rcx, [rsp + 0x28]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433a60
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x2c]
mov qword [0x009187a8], rax
mov rax, qword [sym.imp.kernel32.dll_SetProcessPriorityBoost]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 1
call fcn.00433ae0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov ecx, 0x64
call fcn.00465aa0
nop
call fcn.00463440
jmp 0x431f00
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x431f00
Function at 0x467ec0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x006c9cb1]
mov ebx, 0x32
call fcn.00436a00
nop
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x461440

Function at 0x46b3c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b4b9
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x46b4a5
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
test rcx, rcx
je 0x46b407
lea rdx, [0x00918608]
nop
cmp rcx, rdx
je 0x46b3f0
jmp 0x46b437
call fcn.004603c0
mov rax, qword [rsp + 0x28]
xor ebx, ebx
lea rcx, [0x00918608]
call fcn.0045e900
nop
test al, al
jne 0x46b456
call fcn.004603e0
mov rax, qword [rsp + 0x28]
lea rdx, [0x00918608]
jmp 0x46b3f0
cmp qword [rsp + 0x30], rcx
jne 0x46b48f
add rax, 8
mov rbx, qword [rsp + 0x38]
call fcn.0045e840
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 8]
mov rbx, qword [rsp + 0x38]
mov rax, rcx
call fcn.0045e840
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
call fcn.0045e840
nop dword [rax + rax]
call fcn.004603e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00667a40]
lea rbx, [0x0072e3e0]
nop dword [rax]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072e3d0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.0046b3c0

Function at 0x46dfe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e0b4
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test rax, rax
je 0x46e054
nop dword [rax]
test rax, 0x60
jne 0x46e012
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0046df80
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x006c7e44]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x006b9b99]
call fcn.0044e5e0
nop dword [rax]
call fcn.0040b080
mov rbx, rax
lea rax, [0x00667a40]
call fcn.00436260
call fcn.0046df80
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x006878e0]
call fcn.0040da20
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00918a90], 0
nop
jne 0x46e0a5
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00670f80]
nop dword [rax]
call fcn.00436260
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465700
jmp 0x46e08a
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0046dfe0
Function at 0x46e0e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e207
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
nop dword [rax + rax]
test rax, rax
je 0x46e1a5
test rax, 0x60
jne 0x46e165
bt eax, 8
jae 0x46e121
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0046df80
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x006c056e]
mov r9d, 0x1a
xor eax, eax
lea rbx, [0x006b9b99]
call fcn.0044e5e0
call fcn.0040b080
mov rbx, rax
lea rax, [0x00667a40]
nop dword [rax + rax]
call fcn.00436260
call fcn.0046df80
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x006c7e44]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x006b9b99]
call fcn.0044e5e0
call fcn.0040b080
mov rbx, rax
lea rax, [0x00667a40]
nop
call fcn.00436260
call fcn.0046df80
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x006878e0]
nop dword [rax + rax]
call fcn.0040da20
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00918a90], 0
jne 0x46e1f6
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00670f80]
call fcn.00436260
mov rdi, rax
mov rcx, qword [rsp + 0x40]
nop
call fcn.00465700
jmp 0x46e1df
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0046e0e0

Function at 0x46e500
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e646
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x46e588
cmp rcx, 0x11
je 0x46e57a
nop dword [rax]
cmp rcx, 0x12
jne 0x46e5e8
cmp qword [rax], 8
jne 0x46e631
cmp qword [rax + 8], 0
je 0x46e631
bt edx, 7
jae 0x46e568
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045e980
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x15
jne 0x46e5c0
cmp qword [rax], 8
jne 0x46e61e
cmp qword [rax + 8], 0
je 0x46e61e
bt edx, 7
jae 0x46e5a8
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045ee80
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
je 0x46e5da
cmp rcx, 0x18
jne 0x46e5e8
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006878e0]
call fcn.0040da20
mov qword [rax + 8], 0x11
lea rcx, [0x006bc640]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00670f80]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
nop
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046e500
Function at 0x472340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472426
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, rbx
shl rbx, 0x20
mov rsi, rbx
lock xadd qword [rax], rbx
add rsi, rbx
mov rdi, rsi
shr rsi, 0x20
test esi, esi
jl 0x47240e
test edi, edi
je 0x472391
nop dword [rax]
test rdx, rdx
jle 0x47238d
cmp edx, esi
je 0x4723fb
test esi, esi
jmp 0x472393
test esi, esi
jmp 0x472393
test esi, esi
jg 0x4723b1
test edi, edi
je 0x4723b1
mov rdx, qword [rax]
nop dword [rax]
cmp rdx, rdi
jne 0x4723e8
mov qword [rsp + 0x30], rax
xor edx, edx
xchg qword [rax], rdx
jmp 0x4723da
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edi
lea rdx, [rax + 8]
xor ebx, ebx
xor ecx, ecx
mov rax, rdx
call fcn.00460d20
mov edi, dword [rsp + 0x1c]
dec edi
mov rax, qword [rsp + 0x30]
test edi, edi
jne 0x4723bb
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667a40]
lea rbx, [0x0072e3b0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072e3b0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072e3a0]
nop dword [rax]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00472340

Function at 0x4724c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472540
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
jmp 0x4724d9
mov rax, rbx
mov rcx, qword [rax]
mov rdx, rcx
shr rcx, 0x20
test ecx, ecx
je 0x472522
lea rcx, [rdx + 1]
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x4724d6
mov qword [rsp + 0x10], rbx
lea rax, [rbx + 8]
call fcn.00460c60
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
test rcx, rcx
jne 0x47252c
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00667a40]
lea rbx, [0x0072e3c0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004724c0

Function at 0x473f60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473fb2
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
call fcn.00473c40
nop
test rdi, rdi
jne 0x473f9e
test rbx, rbx
jbe 0x473f94
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
mov rcx, rax
call fcn.00465aa0
lea rax, [0x00667a40]
lea rbx, [0x0072e3f0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00473f60
Function at 0x47e620
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e7b8
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], r8
mov qword [rsp + 0xa0], r10
cmp r10, 0x19
je 0x47e721
nop
cmp r10, 0x23
jne 0x47e770
mov rax, r9
lea rbx, [0x006c4941]
mov ecx, 0x23
call fcn.00402de0
nop
test al, al
jne 0x47e6e5
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xa0]
nop dword [rax + rax]
jmp 0x47e770
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
mov r9d, 1
call fcn.004846c0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, r9
lea rbx, [0x006bfd85]
mov ecx, 0x19
call fcn.00402de0
test al, al
jne 0x47e77f
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xa0]
call fcn.0047e820
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
xor r9d, r9d
call fcn.004846c0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.0047e620
Function at 0x481340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x481449
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x40], rax
cmp rbx, 0x19
je 0x481376
xor edx, edx
jmp 0x4813a0
lea rbx, [0x006bfd85]
mov ecx, 0x19
call fcn.00402de0
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
je 0x4813ab
mov edx, 1
jmp 0x4813e0
cmp rbx, 0x23
je 0x4813b5
xor edx, edx
jmp 0x4813e0
lea rbx, [0x006c4941]
mov ecx, 0x23
call fcn.00402de0
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
je 0x48141e
mov rdx, qword [0x008b5208]
lea rax, [0x00730380]
mov rbx, rcx
mov rcx, rdi
mov rdi, rdx
nop dword [rax + rax]
call fcn.0048b680
test dil, dil
jne 0x48143b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov r8, qword [0x008b5208]
mov rsi, qword [0x008b5210]
call fcn.00481480
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00481340

Function at 0x484ba0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484be6
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x484bcf
add rax, 8
nop
call fcn.004623a0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00667a40]
lea rbx, [0x0072d720]
nop dword [rax]
call fcn.00436260
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00484ba0

Function at 0x484ce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484d3a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x484d26
mov qword [rsp + 0x20], rax
mov rax, rbx
call fcn.00484b20
mov rcx, qword [rsp + 0x20]
add rcx, 8
mov rbx, rax
mov rax, rcx
call fcn.004623e0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00667a40]
lea rbx, [0x0072e420]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00484ce0
Function at 0x4935e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4936dc
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
jmp 0x4935fd
mov rax, rbx
mov rcx, qword [rax]
bt ecx, 0
jb 0x493644
mov rdx, rcx
or rcx, 1
add rcx, 8
test rcx, 0x7ffff8
je 0x4936c8
movabs rsi, 0x80000000007fffff
and rcx, rsi
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x4935fa
mov qword [rsp + 0x18], rbx
jmp 0x49366f
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 8]
call fcn.00460ea0
mov rdx, qword [rsp + 0x10]
add rdx, 0xffffffffff800000
mov rbx, qword [rsp + 0x18]
movabs rcx, 0x7ffff800000
test rdx, rcx
jne 0x493650
nop
jmp 0x4936aa
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 0xc]
call fcn.00460ea0
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xfffff80000000000
add rcx, rdx
mov rbx, qword [rsp + 0x18]
mov rdx, rcx
movabs rcx, 0x7ffff80000000000
test rdx, rcx
jne 0x493682
mov eax, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667a40]
lea rbx, [0x0072db90]
call fcn.00436260
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004935e0

Function at 0x493700
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49382f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test bl, bl
je 0x493738
test byte [rax], al
lea rcx, [rax + 8]
mov edx, 2
mov ebx, 0x800000
movabs rsi, 0x7ffff800000
jmp 0x493757
test byte [rax], al
lea rcx, [rax + 0xc]
mov edx, 4
movabs rbx, 0x80000000000
movabs rsi, 0x7ffff80000000000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdx
jmp 0x493775
mov rax, r9
mov rdi, qword [rax]
bt edi, 0
jb 0x4937fc
nop
test rdi, rdx
jne 0x49379d
mov r8, rdi
or rdi, rdx
add rdi, 8
test rdi, 0x7ffff8
jne 0x4937af
jmp 0x49381b
lea r8, [rbx + rdi]
test rsi, r8
je 0x493808
mov r9, r8
mov r8, rdi
mov rdi, r9
mov r9, rax
mov rax, r8
lock cmpxchg qword [r9], rdi
sete dil
nop
test dil, dil
je 0x493772
test r8, rdx
je 0x4937ed
mov rax, rcx
call fcn.00460cc0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov r9, qword [rsp + 0x40]
jmp 0x493772
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00667a40]
lea rbx, [0x0072db90]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072db90]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00463440
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00493700