joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e1f20
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x4e1f6d
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x4e2000
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x4e2045
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x4e4c80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4d36
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
nop dword [rax]
cmp rcx, 0x20
je 0x4e4cda
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x2e
lea rcx, [0x006b3f0f]
mov qword [rax], rcx
lea rbx, [0x007191c0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rdx, qword [rbx]
movabs rsi, 0x7ffffffffffff
and rdx, rsi
mov qword [rax], rdx
mov rdx, qword [rbx + 6]
shr rdx, 3
and rdx, rsi
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0xc]
shr rdx, 6
and rdx, rsi
mov qword [rax + 0x10], rdx
mov rdx, qword [rbx + 0x13]
shr rdx, 1
and rdx, rsi
mov qword [rax + 0x18], rdx
mov rdx, qword [rbx + 0x18]
shr rdx, 0xc
and rdx, rsi
mov qword [rax + 0x20], rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004e4c80

Function at 0x4e4d80
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4ec6
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
nop
call fcn.004e41c0
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x4e4e20
inc rax
mov rcx, rbx
nop dword [rax + rax]
cmp rax, 5
jge 0x4e4e63
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
mov rdi, rdx
and rdx, 0xfffffffffffffff8
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x40]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
xor ecx, ecx
jmp 0x4e4e8c
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rbx + rdi]
or r8d, edx
mov byte [rbx + rdi], r8b
inc rcx
mov rdi, rsi
cmp rcx, 8
jge 0x4e4e15
movzx edx, byte [rsp + rcx + 0x10]
mov rsi, rdi
sar rdi, 3
add rdi, rcx
cmp rdi, 0x20
jge 0x4e4e15
test byte [rbx], al
cmp rdi, 0x20
jb 0x4e4e7a
mov rax, rdi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.00465940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004e4d80
Function at 0x4e63c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e645e
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rsi, qword [rax + 8]
mov rcx, qword [rbx + 8]
cmp qword [rbx], rdx
jne 0x4e6404
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, rdx
mov rbx, rsi
call fcn.00403fe0
nop dword [rax]
test al, al
jne 0x4e643d
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x3b
lea rcx, [0x006b6acd]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x007191c0]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbx, qword [rsp + 0x28]
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
mov rdx, qword [rdx + 0x30]
mov rcx, qword [rsp + 0x30]
call rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004e63c0

Function at 0x4e65c0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4e6746
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc8], rdi
cmp rsi, rbx
jne 0x4e672e
nop
cmp rbx, 0x48
jg 0x4e671b
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
xor ecx, ecx
jmp 0x4e6669
movzx r9d, byte [rax + rbx - 1]
mov byte [rsp + rcx + 0x58], r9b
mov byte [rsp + rcx + 0x10], sil
inc rcx
mov rbx, r8
mov rsi, rdx
cmp rbx, rcx
jle 0x4e669f
mov rdx, rsi
sub rsi, rcx
lea r8, [rsi - 1]
nop dword [rax + rax]
cmp rdx, r8
jbe 0x4e6710
mov r8, rbx
sub rbx, rcx
lea r9, [rbx - 1]
movzx esi, byte [rdi + rsi - 1]
cmp r8, r9
ja 0x4e6650
jmp 0x4e6705
xor eax, eax
xor ecx, ecx
jmp 0x4e66c0
mov rbx, qword [rsp + rdx + 0x58]
mov rdx, qword [rsp + rdx + 0x10]
neg ecx
sbb rbx, rdx
sbb rcx, rcx
add rax, 8
neg rcx
nop
cmp rax, 0x48
jge 0x4e66df
lea rdx, [rax - 0x48]
mov rbx, rdx
sar rdx, 0x3f
and rdx, rax
neg rbx
cmp rbx, 7
ja 0x4e66a5
jmp 0x4e66f6
cmp rcx, 1
sete al
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov eax, 7
mov rcx, rbx
nop
call fcn.00465940
mov rax, r9
mov rcx, r8
call fcn.00465940
mov rax, r8
mov rcx, rdx
call fcn.00465940
lea rax, [0x006576e0]
lea rbx, [0x00718350]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718390]
nop dword [rax]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004e65c0
Function at 0x4e7800
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e798c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
call fcn.00490ee0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rbx, qword [rax + 8]
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rdx + 0x80]
cmp rsi, rcx
jne 0x4e7978
mov rax, rcx
mov rcx, qword [rsp + 0x48]
call fcn.00403fe0
test al, al
je 0x4e7978
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov rbx, rsi
mov r10, rcx
mov rcx, rdi
mov rdi, r8
call r10
test rbx, rbx
jne 0x4e7965
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx + 8]
mov rbx, qword [rdx + 8]
mov rdx, rcx
call rbx
cmp rbx, 1
je 0x4e794f
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rax, [0x0067c660]
call fcn.0040d960
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rax], rcx
cmp dword [0x008f2cf0], 0
jne 0x4e7908
mov qword [rax + 8], rdx
jmp 0x4e7911
lea rdi, [rax + 8]
call fcn.004655c0
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
cmp dword [0x008f2cf0], 0
jne 0x4e7937
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
jmp 0x4e7945
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.004655a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006576e0]
lea rbx, [0x00718380]
nop dword [rax]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718370]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718360]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004e7800
Function at 0x4e79c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e7b63
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], rcx
mov rdx, qword [rax + 0x20]
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
cmp rdi, rdx
jne 0x4e79f6
xor r10d, r10d
xor r11d, r11d
jmp 0x4e7a38
lea rax, [0x0066df60]
nop dword [rax]
call fcn.0040d960
mov qword [rax + 8], 0x25
lea rcx, [0x006b121e]
mov qword [rax], rcx
lea rbx, [0x007191c0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r12d, byte [rcx + r10]
inc r10
or r11d, r12d
cmp rdi, r10
jg 0x4e7a2d
nop dword [rax]
test r11b, r11b
je 0x4e7b49
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
mov rdi, r9
mov rsi, rdx
call fcn.004e65c0
test al, al
je 0x4e7b49
mov rdi, qword [rsp + 0x70]
nop
test rdi, rdi
ja 0x4e7a92
lea rax, [0x008f2a98]
xor ecx, ecx
xor ebx, ebx
jmp 0x4e7aaf
lea rax, [0x008f2a98]
mov rbx, rdi
xor ecx, ecx
lea rsi, [0x006578a0]
call fcn.0044a920
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call fcn.004662e0
lea rax, [0x0068a520]
call fcn.0040d960
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx + 0x78]
mov qword [rax], rdx
cmp dword [0x008f2cf0], 0
jne 0x4e7af7
mov rdx, qword [rsp + 0x58]
mov qword [rax + 8], rdx
jmp 0x4e7b05
lea rdi, [rax + 8]
mov rdx, qword [rsp + 0x58]
call fcn.004655c0
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x18], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x20], rdx
cmp dword [0x008f2cf0], 0
nop
jne 0x4e7b2d
mov rdx, qword [rsp + 0x40]
mov qword [rax + 0x10], rdx
jmp 0x4e7b3b
lea rdi, [rax + 0x10]
mov rdx, qword [rsp + 0x40]
call fcn.004655c0
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbx, qword [0x0089d0f0]
mov rcx, qword [0x0089d0f8]
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop dword [rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.004e79c0
Function at 0x4ec060
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ec15c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
jmp 0x4ec07d
mov rax, rbx
mov rcx, qword [rax]
bt ecx, 0
jb 0x4ec0c4
mov rdx, rcx
or rcx, 1
add rcx, 8
test rcx, 0x7ffff8
je 0x4ec148
movabs rsi, 0x80000000007fffff
and rcx, rsi
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x4ec07a
mov qword [rsp + 0x18], rbx
jmp 0x4ec0ef
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 8]
call fcn.00460c80
mov rdx, qword [rsp + 0x10]
add rdx, 0xffffffffff800000
mov rbx, qword [rsp + 0x18]
movabs rcx, 0x7ffff800000
test rdx, rcx
jne 0x4ec0d0
nop
jmp 0x4ec12a
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 0xc]
call fcn.00460c80
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xfffff80000000000
add rcx, rdx
mov rbx, qword [rsp + 0x18]
mov rdx, rcx
movabs rcx, 0x7ffff80000000000
test rdx, rcx
jne 0x4ec102
mov eax, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006576e0]
lea rbx, [0x00718630]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.004ec060

Function at 0x4ec180
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ec2af
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test bl, bl
je 0x4ec1b8
test byte [rax], al
lea rcx, [rax + 8]
mov edx, 2
mov ebx, 0x800000
movabs rsi, 0x7ffff800000
jmp 0x4ec1d7
test byte [rax], al
lea rcx, [rax + 0xc]
mov edx, 4
movabs rbx, 0x80000000000
movabs rsi, 0x7ffff80000000000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdx
jmp 0x4ec1f5
mov rax, r9
mov rdi, qword [rax]
bt edi, 0
jb 0x4ec27c
nop
test rdi, rdx
jne 0x4ec21d
mov r8, rdi
or rdi, rdx
add rdi, 8
test rdi, 0x7ffff8
jne 0x4ec22f
jmp 0x4ec29b
lea r8, [rbx + rdi]
test rsi, r8
je 0x4ec288
mov r9, r8
mov r8, rdi
mov rdi, r9
mov r9, rax
mov rax, r8
lock cmpxchg qword [r9], rdi
sete dil
nop
test dil, dil
je 0x4ec1f2
test r8, rdx
je 0x4ec26d
mov rax, rcx
call fcn.00460aa0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov r9, qword [rsp + 0x40]
jmp 0x4ec1f2
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006576e0]
lea rbx, [0x00718630]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718630]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.004632e0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004ec180
Function at 0x4ec9a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ecbd9
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x90], rdi
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov r8, qword [rsp + 0x48]
bt r8, 0x3f
jae 0x4eca0d
mov r8, qword [rsp + 0x48]
shl r8, 1
shr r8, 0x1f
movabs r9, 0xdd7b17f80
add r8, r9
jmp 0x4eca12
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x78], rax
nop dword [rax]
test r8, r8
jne 0x4eca3a
mov r8, qword [rsp + 0x48]
and r8d, 0x3fffffff
test r8d, r8d
jne 0x4eca3a
xor ecx, ecx
jmp 0x4eca63
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call fcn.004c8300
test rax, rax
mov rdx, 0xffffffffffffffff
cmove rax, rdx
mov rsi, qword [rsp + 0x20]
mov rcx, rax
mov rax, qword [rsp + 0x78]
test byte [rax], al
jmp 0x4eca6a
mov rax, rdx
mov rdi, qword [rax]
bt edi, 0
jb 0x4ecaab
lea r8, [rdi + 8]
nop word [rax + rax]
test r8, 0x7ffff8
je 0x4ecba8
mov rdx, rax
mov rax, rdi
lock cmpxchg qword [rdx], r8
sete r8b
nop dword [rax]
test r8b, r8b
je 0x4eca67
bt edi, 0
jmp 0x4ecaae
mov rdx, rax
jae 0x4ecad9
cmp byte [rdx + 0x21f], 0
je 0x4ecac9
mov rdi, qword [0x0089d360]
mov r8, qword [0x0089d368]
jmp 0x4ecae0
lea rdi, [0x00719980]
lea r8, [0x008f2a98]
jmp 0x4ecae0
xor edi, edi
xor r8d, r8d
nop
test rdi, rdi
jne 0x4ecb8e
movups xmmword [rsp + 0x38], xmm15
lea rdi, [0x004ecc20]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x1f], 1
mov rax, qword [rdx + 0x1b8]
test rax, rax
jne 0x4ecb56
mov rax, qword [0x0089d370]
mov rcx, qword [0x0089d378]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbx, rcx
mov rcx, rsi
nop dword [rax]
call fcn.0045f560
movups xmmword [rsp + 0x28], xmm15
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx]
call rsi
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], r8
mov rax, rdi
mov rbx, r8
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x006576e0]
lea rbx, [0x00718630]
call fcn.00436420
nop
nop dword [rax]
call fcn.004358c0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004ec9a0
Function at 0x4ef3e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef539
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov r13, 0
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x23], 0
movups xmmword [rsp + 0x28], xmm15
test byte [rax], al
jmp 0x4ef416
mov rax, rsi
mov rdx, qword [rax]
bt edx, 0
jb 0x4ef44b
lea r8, [rdx + 8]
test r8, 0x7ffff8
je 0x4ef50a
mov rsi, rax
mov rax, rdx
lock cmpxchg qword [rsi], r8
sete r8b
nop
test r8b, r8b
je 0x4ef413
bt edx, 0
jmp 0x4ef44e
mov rsi, rax
jae 0x4ef479
cmp byte [rsi + 0x21f], 0
je 0x4ef469
mov rdx, qword [0x0089d360]
mov r8, qword [0x0089d368]
jmp 0x4ef480
lea rdx, [0x00719980]
lea r8, [0x008f2a98]
jmp 0x4ef480
xor edx, edx
xor r8d, r8d
nop
test rdx, rdx
je 0x4ef49f
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
mov rax, rdx
mov rbx, r8
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x004ef580]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x23], 1
mov rax, qword [rsi + 0x10]
mov dword [rsp + 0x24], edi
lea rdi, [rsp + 0x24]
mov esi, 4
call fcn.004b7f40
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x23], 0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx]
call r8
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x006576e0]
lea rbx, [0x00718630]
call fcn.00436420
nop
nop
call fcn.004358c0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004ef3e0
Function at 0x4ef5e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef729
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov r13, 0
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x4f], 0
movups xmmword [rsp + 0x50], xmm15
test byte [rax], al
jmp 0x4ef616
mov rax, r13
mov rdx, qword [rax]
bt edx, 0
jb 0x4ef64b
lea r12, [rdx + 8]
test r12, 0x7ffff8
je 0x4ef6fc
mov r13, rax
mov rax, rdx
lock cmpxchg qword [r13], r12
sete r12b
test r12b, r12b
je 0x4ef613
bt edx, 0
jmp 0x4ef64e
mov r13, rax
jae 0x4ef67a
cmp byte [r13 + 0x21f], 0
je 0x4ef66a
mov rdx, qword [0x0089d360]
mov r12, qword [0x0089d368]
jmp 0x4ef680
lea rdx, [0x00719980]
lea r12, [0x008f2a98]
jmp 0x4ef680
xor edx, edx
xor r12d, r12d
nop
test rdx, rdx
je 0x4ef69f
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r12
mov rax, rdx
mov rbx, r12
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x004ef7a0]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r13
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x4f], 1
mov rax, qword [r13 + 0x10]
call fcn.004b70c0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x4f], 0
mov rdx, qword [rsp + 0x70]
mov r12, qword [rdx]
call r12
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006576e0]
lea rbx, [0x00718630]
call fcn.00436420
nop
call fcn.004358c0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.004632e0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004ef5e0