joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478370
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4783d5
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00478160
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4783bc
mov edx, dword [esp + 0xc]
test edx, edx
jbe 0x4783b3
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
xor eax, eax
mov ecx, eax
call fcn.00468ed0
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b014c]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.00478370

Function at 0x479b60
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x479cdf
sub esp, 0x2c
mov dword [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ecx
call fcn.0047c950
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
lea ebp, [0x7b0b54]
cmp eax, ebp
jne 0x479bf8
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
lea eax, [0x7aff28]
mov dword [esp + 8], eax
call fcn.00404290
movzx eax, byte [esp + 0xc]
test al, al
jne 0x479c4b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
test ecx, ecx
je 0x479c10
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], ebx
add esp, 0x2c
ret
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x42
lea ecx, [0x750f4c]
mov dword [eax], ecx
mov dword [esp + 0x34], 0
lea ecx, [0x7b0bb8]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x2c
ret
mov eax, dword [esp + 0x18]
lea ecx, [0x6f4820]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.0044e560
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x479cd5
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ecx
call fcn.0047c950
mov eax, dword [esp + 0x10]
test eax, eax
je 0x479cb9
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x2c
ret
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
add esp, 0x2c
ret
xor eax, eax
mov ecx, eax
call fcn.00468ed0
nop
call fcn.00467a60
jmp fcn.00479b60
Function at 0x486470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4865fb
sub esp, 0x50
lea edi, [esp + 0x64]
xor eax, eax
call fcn.004690fb
mov ecx, dword [esp + 0x58]
cmp ecx, 0x19
je 0x48649f
xor edx, edx
jmp 0x4864ca
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x742cb0]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x19
call fcn.004034e0
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x4864d5
mov edx, 1
jmp 0x486509
cmp ecx, 0x23
je 0x4864de
xor edx, edx
jmp 0x486509
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x748104]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x23
call fcn.004034e0
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x486563
lea edi, [esp + 0x3c]
call fcn.004690fb
mov ecx, dword [0x966a04]
lea edx, [0x7b0e80]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call fcn.00491220
movzx ecx, byte [esp + 0x24]
mov byte [esp + 0x37], cl
lea edi, [esp + 0x3c]
lea esi, [esp + 0x10]
call fcn.004695de
movzx ecx, byte [esp + 0x37]
test cl, cl
jne 0x4865da
xor eax, eax
mov ecx, dword [esp + 0x58]
lea edi, [esp + 0x3c]
call fcn.004690fb
mov ecx, dword [0x966a00]
mov edx, dword [0x966a04]
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.00486610
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
lea edi, [esp + 0x3c]
lea esi, [esp + 0x18]
call fcn.004695de
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.004695de
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x50
ret
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.004695de
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x50
ret
call fcn.00467a60
jmp fcn.00486470
Function at 0x489a90
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x489adf
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x489ac6
add eax, 4
mov dword [esp], eax
call fcn.004672b0
movzx eax, byte [esp + 4]
mov byte [esp + 0x10], al
add esp, 8
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b020c]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.00489a90

Function at 0x489be0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x489c57
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x489c3e
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00489a00
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
add edx, 4
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.004672f0
movzx eax, byte [esp + 0xc]
mov byte [esp + 0x20], al
add esp, 0x10
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b035c]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.00489be0
Function at 0x490240
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49042a
sub esp, 0x48
mov eax, dword [0x966a00]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 0xa]
movzx ebx, word [ecx + 0xc]
movzx ebp, word [ecx + 2]
movzx esi, word [ecx + 8]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], ebp
mov dword [esp + 8], 1
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.0048c4e0
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.004695de
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.004695de
call fcn.0048a280
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x93a80
call fcn.00460760
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x490317
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x490331
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x4903a8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x49037e
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x49037a
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x490373
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x490380
mov ebx, 0x1d
jmp 0x49039e
mov ebp, eax
jmp 0x490380
mov ebp, eax
cmp ebp, 0xd
jae 0x49041d
lea eax, [ebp - 1]
lea edx, [0x939b60]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x490413
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x4903a8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x4903da
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x4903e2
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], eax
add esp, 0x48
ret
mov ecx, 0xd
call fcn.00468ed0
mov eax, ebp
mov ecx, 0xd
call fcn.00468ed0
nop
call fcn.00467a60
jmp fcn.00490240
Function at 0x493500
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4935f5
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
mov dword [esp], eax
mov byte [esp + 4], 0
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], ecx
call fcn.00492c10
movzx eax, byte [esp + 0x24]
test al, al
je 0x493576
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp], ecx
mov dword [esp + 4], edx
lea ecx, [0x7b16a4]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.004921c0
mov eax, dword [esp + 0x20]
lea ecx, [eax + 8]
mov dword [esp + 0x18], ecx
mov dword [esp], ecx
call fcn.00472830
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x4935cc
mov edx, dword [ecx + 0x18]
nop
test edx, edx
je 0x4935dc
lea eax, [ecx + 4]
mov dword [esp], eax
call fcn.004672b0
mov eax, dword [0x995310]
test eax, eax
jne 0x4935b7
mov eax, dword [esp + 0x20]
jmp 0x4935c5
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
call fcn.00468e60
mov dword [edi], ecx
mov dword [eax + 0x2c], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00472bb0
add esp, 0x1c
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b020c]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.00493500
Function at 0x49ab90
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49ac26
sub esp, 0x18
mov eax, dword [esp + 0x1c]
test byte [eax], al
mov dword [esp], eax
call fcn.0046d750
mov eax, dword [esp + 4]
test eax, 1
jne 0x49ac04
mov ecx, eax
add eax, 8
test eax, 0x7ffff8
sete dl
and edx, 1
test dl, dl
jne 0x49ac0d
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0x1c]
mov dword [esp], ebx
add ecx, 8
adc edx, 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
call fcn.0046d6e0
movzx eax, byte [esp + 0x14]
test al, al
je 0x49aba7
mov byte [esp + 0x20], 1
add esp, 0x18
ret
mov byte [esp + 0x20], 0
add esp, 0x18
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0490]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.0049ab90

Function at 0x49ac30
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49ad5c
sub esp, 0x28
mov eax, dword [esp + 0x2c]
test byte [eax], al
mov dword [esp], eax
call fcn.0046d750
mov eax, dword [esp + 4]
test eax, 1
jne 0x49acc1
mov ecx, eax
or eax, 1
mov edx, eax
add eax, 8
test eax, 0x7ffff8
sete bl
and ebx, 1
test bl, bl
jne 0x49ad43
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
add edx, 8
adc ecx, 0
and ecx, 0x80000000
mov dword [esp + 0x10], ecx
and eax, 0x7fffff
mov dword [esp + 0xc], eax
call fcn.0046d6e0
movzx eax, byte [esp + 0x14]
test al, al
je 0x49ac47
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
jmp 0x49acf1
mov byte [esp + 0x30], 0
add esp, 0x28
ret
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x2c]
lea ecx, [eax + 8]
mov dword [esp], ecx
call fcn.00465b50
mov eax, dword [esp + 0x18]
add eax, 0xff800000
mov ecx, dword [esp + 0x20]
adc ecx, 0xffffffff
test eax, 0xff800000
setne dl
test ecx, 0x7ff
setne bl
or ebx, edx
test bl, bl
jne 0x49acca
jmp 0x49ad32
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x2c]
lea ecx, [eax + 0xc]
mov dword [esp], ecx
call fcn.00465b50
mov eax, dword [esp + 0x18]
add eax, 0
mov ecx, dword [esp + 0x1c]
adc ecx, 0xfffff800
test ecx, 0x7ffff800
jne 0x49ad0a
mov byte [esp + 0x30], 1
add esp, 0x28
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0490]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.0049ac30
Function at 0x49ae10
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49af90
sub esp, 0x34
movzx eax, byte [esp + 0x3c]
test al, al
je 0x49ae51
mov eax, dword [esp + 0x38]
test byte [eax], al
lea ecx, [eax + 8]
mov edx, 2
xor ebx, ebx
mov ebp, 0x800000
mov esi, 0xff800000
mov edi, 0x7ff
jmp 0x49ae6d
mov eax, dword [esp + 0x38]
test byte [eax], al
lea ecx, [eax + 0xc]
mov edx, 4
mov ebx, 0x800
xor ebp, ebp
xor esi, esi
mov edi, 0x7ffff800
mov dword [esp + 0x2c], edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], ebp
jmp 0x49ae8b
mov eax, dword [esp + 0x38]
test byte [eax], al
mov dword [esp], eax
call fcn.0046d750
mov eax, dword [esp + 4]
test eax, 1
jne 0x49af56
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
test edx, eax
sete bl
and ebx, 1
mov byte [esp + 0x1b], bl
test bl, bl
je 0x49aee4
or eax, edx
mov ebp, eax
add eax, 8
test eax, 0x7ffff8
xchg esi, ebx
sete bl
xchg esi, ebx
and esi, 1
xchg esi, eax
test al, al
xchg esi, eax
jne 0x49af77
add ebp, 8
adc ecx, 0
jmp 0x49af12
mov ebp, dword [esp + 0x1c]
add eax, ebp
mov esi, dword [esp + 0x20]
adc ecx, esi
mov edi, dword [esp + 0x24]
test eax, edi
xchg edi, ebx
sete bl
xchg edi, ebx
mov esi, dword [esp + 0x28]
test esi, ecx
xchg esi, ebx
sete bl
xchg esi, ebx
and esi, edi
xchg esi, eax
test al, al
xchg esi, eax
jne 0x49af5f
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
call fcn.0046d6e0
movzx eax, byte [esp + 0x14]
test al, al
je 0x49ae87
movzx eax, byte [esp + 0x1b]
test al, al
jne 0x49af4d
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.004659d0
jmp 0x49ae87
mov byte [esp + 0x40], 1
add esp, 0x34
ret
mov byte [esp + 0x40], 0
add esp, 0x34
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0490]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0490]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.0049ae10
Function at 0x4a0570
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a076c
sub esp, 0x24
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4a06f3
mov ecx, dword [esp + 0x34]
cmp dword [0x967010], ecx
je 0x4a05a3
xor edx, edx
jmp 0x4a05cc
mov eax, dword [0x967014]
mov dword [esp], ecx
mov edx, dword [esp + 0x38]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.00404290
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x34]
mov edx, eax
mov eax, dword [esp + 0x34]
test dl, dl
jne 0x4a06f3
cmp dword [0x967238], ecx
jne 0x4a0611
mov eax, dword [0x96723c]
mov dword [esp], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00404290
movzx eax, byte [esp + 0xc]
test al, al
je 0x4a060d
mov eax, dword [0x96ea80]
mov ecx, dword [0x96ea84]
jmp 0x4a0655
mov eax, dword [esp + 0x34]
movzx ecx, byte [0x994f17]
test cl, cl
je 0x4a0651
mov ecx, dword [0x967238]
mov edx, dword [0x96723c]
mov dword [esp], eax
mov ebx, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call fcn.00470ba0
movzx eax, byte [esp + 0x10]
test al, al
jne 0x4a0703
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
lea edx, [0x712460]
mov dword [esp], edx
call fcn.0040c500
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x4a0686
mov ecx, dword [esp + 0x2c]
jmp 0x4a0691
call fcn.00468e60
mov ecx, dword [esp + 0x2c]
mov dword [edi], ecx
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x138]
mov ecx, dword [ecx + 0x134]
mov dword [eax + 0xc], edx
mov edx, dword [0x995310]
test edx, edx
je 0x4a06b9
call fcn.00468e60
mov dword [edi], ecx
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x10], ecx
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x4a06d3
mov ecx, dword [esp + 0x20]
jmp 0x4a06de
call fcn.00468e60
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [eax + 0x14], ecx
lea ecx, [0x7b0c08]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x24
ret
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x40], eax
add esp, 0x24
ret
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x74d17a]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x2f
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.00452120
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004a0570
Function at 0x4a19b0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a1a0d
sub esp, 8
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4a19dc
call fcn.00499270
movzx eax, byte [esp]
test al, al
jne 0x4a19f4
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00464e50
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.004651f0
add esp, 8
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b022c]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004a19b0
Function at 0x4ab240
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ab338
sub esp, 0x20
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4ab300
lea ecx, [eax + 0x15c]
cmp ecx, 0x2b7
ja 0x4ab31f
shl ecx, 4
lea edx, [0x953c60]
mov ebx, dword [edx + ecx + 8]
mov ecx, dword [edx + ecx + 0xc]
test eax, eax
jge 0x4ab290
add ebx, 1
adc ecx, 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
call fcn.00494c10
mov eax, dword [esp + 0x10]
shl eax, 7
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, edx
shr edx, 0x19
or edx, eax
mov eax, ecx
shl ecx, 7
shl ebx, 7
shr eax, 0x19
or eax, ebx
mov ebx, dword [esp + 0x2c]
imul ebx, ebx, 0x1a935
sar ebx, 0xf
mov ebp, dword [esp + 0x28]
lea ebx, [ebx + ebp - 6]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
test ecx, ecx
sete cl
test eax, eax
sete al
and eax, ecx
mov byte [esp + 0x38], al
add esp, 0x20
ret
mov eax, dword [esp + 0x24]
shl eax, 6
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffffa
mov dword [esp + 0x34], eax
mov byte [esp + 0x38], 1
add esp, 0x20
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0344]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004ab240
Function at 0x4ab350
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ab528
sub esp, 0x44
mov eax, dword [esp + 0x54]
test eax, eax
je 0x4ab4de
lea ecx, [eax + 0x15c]
cmp ecx, 0x2b7
ja 0x4ab50f
shl ecx, 4
lea edx, [0x953c60]
lea esi, [edx + ecx]
lea edi, [esp + 0x34]
call fcn.004695e8
test eax, eax
jge 0x4ab3b4
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
add ecx, 1
mov dword [esp + 0x34], ecx
adc edx, 0
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
imul eax, eax, 0x1a935
sar eax, 0xf
mov ebx, dword [esp + 0x50]
lea eax, [eax + ebx - 8]
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x48]
mov dword [esp], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
call fcn.00494c10
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x28], ebp
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x2c], esi
mov edi, dword [esp + 0x4c]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x48]
mov dword [esp], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call fcn.00494c10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ebx, edx
and edx, ecx
mov ebp, dword [esp + 0x18]
mov esi, ebx
or ebx, ecx
nop
mov edi, dword [esp + 0x20]
add edi, ebp
adc ecx, esi
mov ebp, edi
shl edi, 9
mov esi, ecx
shl ecx, 9
shr ebp, 0x17
or ebp, ecx
mov ecx, esi
xchg esi, ebx
not ebx
xchg esi, ebx
and esi, ebx
or esi, edx
shr esi, 0x1f
mov edx, esi
add esi, eax
test edi, edi
sete bl
test ebp, ebp
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebx, ebp
test bl, bl
je 0x4ab4a4
mov ebx, dword [esp + 0x2c]
test ebx, ebx
sete bl
mov ebp, dword [esp + 0x28]
test ebp, ebp
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, ebx
add edx, eax
jmp 0x4ab4ab
add edx, eax
mov ebp, 0
mov eax, dword [esp + 0x14]
adc eax, 0
shl eax, 9
mov edx, esi
shl esi, 9
shr edx, 0x17
or edx, eax
mov dword [esp + 0x5c], edx
shr ecx, 0x17
or ecx, esi
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x60], eax
xchg ebp, eax
mov byte [esp + 0x64], al
xchg ebp, eax
add esp, 0x44
ret
mov eax, dword [esp + 0x4c]
shl eax, 8
mov ecx, dword [esp + 0x48]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
or edx, eax
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x50]
add eax, 0xfffffff8
mov dword [esp + 0x60], eax
mov byte [esp + 0x64], 1
add esp, 0x44
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b034c]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004ab350