joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a040
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], r14
mov edx, dword [0x0092ac84]
test edx, edx
je 0x44a080
mov qword [rsp + 0x60], rax
mov eax, 2
call fcn.00432a00
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
nop
mov ecx, 1
lea rdx, [0x0092ac84]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x40]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x38], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x30], rsi
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbx + 0xf8]
mov qword [rsp + 0x20], rdi
call fcn.00438500
lea rax, [0x006caba8]
mov ebx, 0xa
call fcn.00438e00
mov rax, qword [rsp + 0x38]
call fcn.00438c60
call fcn.00438720
mov rax, qword [rsp + 0x30]
call fcn.00438c60
nop
call fcn.00438720
mov rax, qword [rsp + 0x28]
call fcn.00438c60
call fcn.00438720
mov rax, qword [rsp + 0x20]
call fcn.00438c60
nop
call fcn.00438760
call fcn.00438580
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
call fcn.00438500
lea rax, [0x006c956d]
mov ebx, 3
call fcn.00438e00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe8], 0
nop
je 0x44a1d7
mov rdx, qword [rsp + 0x70]
cmp qword [rcx], rdx
jne 0x44a1d2
cmp qword [rcx + 0x90], 0
je 0x44a1cd
cmp byte [0x0092ac1c], 0
je 0x44a1c0
nop
call fcn.00438500
lea rax, [0x006d9f7b]
mov ebx, 0x2e
call fcn.00438e00
call fcn.00438580
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x90]
jmp 0x44a1dc
mov rcx, rdx
jmp 0x44a1dc
mov rcx, rdx
jmp 0x44a1dc
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x48], rcx
call fcn.00438500
call fcn.00438760
call fcn.00438580
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 2
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov qword [rax + 0x98], rdi
mov eax, dword [0x00899280]
mov rdx, qword [r14 + 0x30]
mov ebx, dword [rdx + 0xc4]
movzx edx, byte [rdx + 0xf9]
test dl, dl
jne 0x44a241
shr eax, 2
cmp ebx, 2
mov esi, 2
cmovae eax, esi
mov edx, eax
test edx, edx
jle 0x44a279
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
mov rdi, rcx
xor ecx, ecx
nop dword [rax]
call fcn.004596a0
mov rax, qword [rsp + 0x48]
call fcn.0045a620
mov rax, qword [rsp + 0x68]
call fcn.00407900
mov eax, 2
nop
call fcn.00432a00
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x44e3e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x44e506
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
lea rdi, [rsp + 0x20]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046602b
mov rbp, qword [rbp]
lea rcx, [0x006aa820]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + 0x17]
test dl, 0x40
jne 0x44e4f0
lea rdx, [0x0092b090]
lea rax, [0x008a3220]
jmp 0x44e472
mov rax, qword [rax + 0x230]
test rax, rax
je 0x44e494
nop word [rax + rax]
cmp qword [rax + 0x140], rdx
ja 0x44e46b
cmp qword [rax + 0x110], rdx
jbe 0x44e46b
jmp 0x44e496
xor eax, eax
test rax, rax
je 0x44e4df
mov rdx, qword [rcx]
lea rbx, [rdx + 7]
and rbx, 0xfffffffffffffff8
neg ebx
mov rsi, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rax + 0x138]
mov dword [0x0092b090], ebx
mov dword [0x0092b094], edx
mov dword [0x0092b098], esi
mov dword [0x0092b09c], ecx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
lea rax, [0x006d8ec4]
mov ebx, 0x2b
call fcn.00436bc0
lea rax, [0x006dcdce]
mov ebx, 0x3d
nop dword [rax]
call fcn.00436bc0
nop
call fcn.00463740
jmp fcn.0044e3e0
Function at 0x452700
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x452a69
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
movzx edx, byte [rbx + 0x17]
and edx, 0x1f
dec rdx
cmp rdx, 0x19
ja 0x452a26
mov qword [rsp + 0xb8], rax
lea rsi, [0x00746b40]
jmp qword [rsi + rdx*8]
mov rax, rbx
call fcn.0045afe0
mov ecx, 0x16
mov rdi, rax
mov rsi, rbx
lea r8, [0x006dbf49]
mov r9d, 0x37
xor eax, eax
lea rbx, [0x006cf8f4]
call fcn.0044e800
call fcn.0040afc0
mov rbx, rax
lea rax, [0x00679500]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00452700

Function at 0x452e40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x452f79
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
cmp qword [rax + 8], 0
nop dword [rax]
jle 0x452f67
cmp qword [rax + 0x10], 0
jl 0x452f56
mov ecx, dword [rax + 0x40]
test ecx, ecx
jne 0x452f45
mov qword [rsp + 0x48], rax
nop
mov ecx, 1
xchg dword [rax + 0x40], ecx
mov qword [rsp + 0x28], r14
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x10], rdx
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
mov qword [rsp + 0x30], rcx
test byte [rcx], al
lea rbx, [rcx + 0x2278]
mov qword [rsp + 0x20], rbx
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi + 0x30]
mov qword [rsp + 0x18], rsi
nop
mov rax, rbx
call fcn.0040b7a0
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00453c80
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
call fcn.00452fa0
nop
nop
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.0040b9c0
mov rax, qword [rsp + 0x10]
call fcn.0043f5e0
nop
mov rcx, qword [rsp + 0x18]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x452f3b
cmp byte [r14 + 0xb1], 0
je 0x452f3b
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006d722a]
mov ebx, 0x26
call fcn.00436bc0
lea rax, [0x006d542f]
mov ebx, 0x21
call fcn.00436bc0
lea rax, [0x006d2550]
mov ebx, 0x1b
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
nop
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.00452e40
Function at 0x452fa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453110
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov edx, dword [0x0092ac74]
test edx, edx
jne 0x452fdb
call fcn.004300c0
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
cmp qword [rbx], 0
nop
jne 0x4530fe
nop
mov rdx, rax
mov qword [rbx], rax
test byte [rdx], al
mov rax, qword [rdx + 0x2280]
mov rdi, qword [rdx + 0x2288]
mov rcx, qword [rdx + 0x2290]
lea r8, [rdi + 1]
cmp rcx, r8
jae 0x453069
mov qword [rsp + 0x40], rdi
mov rbx, r8
mov edi, 1
lea rsi, [0x00673900]
call fcn.0044a920
mov rdi, qword [rsp + 0x58]
mov qword [rdi + 0x2290], rcx
cmp dword [0x0092b0b0], 0
jne 0x453044
mov qword [rdi + 0x2280], rax
jmp 0x453059
lea rdx, [rdi + 0x2280]
mov rcx, rdi
mov rdi, rdx
call fcn.00465900
mov rdi, rcx
mov rdx, rdi
mov rdi, qword [rsp + 0x40]
mov r8, rbx
mov rbx, qword [rsp + 0x60]
mov qword [rdx + 0x2288], r8
lea rsi, [rax + r8*8]
lea rsi, [rsi - 8]
cmp dword [0x0092b0b0], 0
nop
jne 0x453089
mov qword [rax + r8*8 - 8], rbx
jmp 0x453097
mov rax, rdi
mov rdi, rsi
call fcn.00465a40
mov rdi, rax
mov rax, qword [rdx + 0x2280]
mov rbx, qword [rdx + 0x2288]
mov rcx, qword [rdx + 0x2290]
call fcn.00454da0
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x2280]
cmp qword [rdx + 0x2288], 0
jbe 0x4530f4
mov rax, qword [rsp + 0x60]
cmp qword [rsi], rax
jne 0x4530dc
mov rax, qword [rax + 8]
xchg qword [rdx + 0x1200], rax
nop
mov eax, 1
lock xadd dword [rdx + 0x2298], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
mov rcx, rax
call fcn.00465da0
lea rax, [0x006d583f]
mov ebx, 0x22
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00452fa0
Function at 0x459f00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459fb9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045a000]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00463600
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00459f00
Function at 0x45b180
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b3e6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x45b1a9
mov dword [rsp + 0x60], ebx
lea rcx, [0x008a3220]
jmp 0x45b1c0
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x230]
nop dword [rax]
test rcx, rcx
je 0x45b1f7
mov rdx, qword [rcx + 0x128]
cmp rax, rdx
jb 0x45b1b5
mov rsi, qword [rcx + 0x130]
cmp rax, rsi
jae 0x45b1b5
movsxd rcx, ebx
lea rax, [rdx + rcx]
cmp rsi, rax
jb 0x45b356
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rax
nop
nop
nop
lea rax, [0x008d66a0]
call fcn.0040b7a0
mov rbx, qword [0x008d66b0]
lea rax, [0x00685800]
mov ecx, dword [rsp + 0x60]
nop dword [rax]
call fcn.00410bc0
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
nop
nop
nop
lea rax, [0x008d66a0]
nop dword [rax + rax]
call fcn.0040b9c0
movzx ecx, byte [rsp + 0x1f]
test cl, cl
jne 0x45b2b6
call fcn.00438500
lea rax, [0x006cd52f]
mov ebx, 0x11
nop
call fcn.00438e00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438c60
lea rax, [0x006c9a9e]
mov ebx, 6
nop dword [rax]
call fcn.00438e00
mov rax, qword [rsp + 0x20]
call fcn.00438c60
lea rax, [0x006cca47]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00438e00
call fcn.00438580
lea rax, [0x008a3220]
jmp 0x45b340
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x40], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x28], rdx
call fcn.00438500
lea rax, [0x006ca046]
mov ebx, 7
call fcn.00438e00
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00438c60
lea rax, [0x006ca16e]
mov ebx, 8
call fcn.00438e00
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x230]
nop dword [rax + rax]
test rax, rax
jne 0x45b2c5
lea rax, [0x006d9ec3]
mov ebx, 0x2e
call fcn.00436bc0
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
call fcn.00438500
lea rax, [0x006cd52f]
mov ebx, 0x11
call fcn.00438e00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
nop dword [rax]
call fcn.00438c60
lea rax, [0x006cc005]
mov ebx, 0xe
call fcn.00438e00
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.00438c60
lea rax, [0x006c943b]
mov ebx, 3
call fcn.00438e00
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
lea rax, [0x006d52e5]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463740
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.0045b180
Function at 0x45b420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b6ab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x45b44e
nop dword [rax]
cmp ebx, 0xffffffff
je 0x45b44e
lea rcx, [0x008a3220]
jmp 0x45b461
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x230]
test rcx, rcx
je 0x45b47a
cmp qword [rcx + 0x128], rax
ja 0x45b45a
cmp qword [rcx + 0x130], rax
jbe 0x45b45a
jmp 0x45b47c
xor ecx, ecx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x45b4e8
mov qword [rsp + 0x40], rcx
mov rdx, qword [rcx + 0x220]
lea rax, [0x00686040]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
nop
call fcn.00410a20
mov rax, qword [rax]
test rax, rax
jne 0x45b4de
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x128]
mov ebx, dword [rsp + 0x60]
movsxd rsi, ebx
lea rax, [rdx + rsi]
mov rcx, qword [rcx + 0x130]
cmp rcx, rax
jb 0x45b625
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x18], rax
nop
nop
nop
lea rax, [0x008d66a0]
call fcn.0040b7a0
mov rbx, qword [0x008d66b0]
lea rax, [0x00685800]
mov ecx, dword [rsp + 0x60]
call fcn.00410a20
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x008d66a0]
call fcn.0040b9c0
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x45b593
call fcn.00438500
lea rax, [0x006cd573]
mov ebx, 0x11
call fcn.00438e00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438c60
lea rax, [0x006c9a9e]
mov ebx, 6
call fcn.00438e00
mov rax, qword [rsp + 0x18]
call fcn.00438c60
lea rax, [0x006cca47]
mov ebx, 0x10
nop dword [rax]
call fcn.00438e00
call fcn.00438580
lea rax, [0x008a3220]
jmp 0x45b60b
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x20], rdx
call fcn.00438500
lea rax, [0x006ca046]
mov ebx, 7
call fcn.00438e00
mov rax, qword [rsp + 0x28]
call fcn.00438c60
lea rax, [0x006ca16e]
mov ebx, 8
call fcn.00438e00
mov rax, qword [rsp + 0x20]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x230]
test rax, rax
jne 0x45b59d
lea rax, [0x006d9f4d]
mov ebx, 0x2e
nop dword [rax]
call fcn.00436bc0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.00438500
lea rax, [0x006cd573]
mov ebx, 0x11
call fcn.00438e00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438c60
lea rax, [0x006cc005]
mov ebx, 0xe
nop dword [rax]
call fcn.00438e00
mov rax, qword [rsp + 0x28]
call fcn.00438c60
lea rax, [0x006c943b]
mov ebx, 3
nop dword [rax + rax]
call fcn.00438e00
mov rax, qword [rsp + 0x20]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
lea rax, [0x006d5327]
mov ebx, 0x21
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463740
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0045b420
Function at 0x45b6e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b8bb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp ebx, 0xffffffff
je 0x45b706
lea rcx, [0x008a3220]
jmp 0x45b720
lea rax, [0x0040b4e0]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x230]
nop
test rcx, rcx
je 0x45b739
cmp qword [rcx + 0x128], rax
ja 0x45b717
cmp qword [rcx + 0x130], rax
jbe 0x45b717
jmp 0x45b740
xor ecx, ecx
nop dword [rax + rax]
test rcx, rcx
jne 0x45b811
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x58], ebx
nop
nop
nop
lea rax, [0x008d66a0]
nop dword [rax]
call fcn.0040b7a0
mov rbx, qword [0x008d66b0]
lea rax, [0x00685800]
mov ecx, dword [rsp + 0x58]
call fcn.00410a20
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x008d66a0]
call fcn.0040b9c0
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x45b807
nop dword [rax]
call fcn.00438500
lea rax, [0x006cd562]
mov ebx, 0x11
call fcn.00438e00
mov eax, dword [rsp + 0x58]
movsxd rax, eax
nop dword [rax]
call fcn.00438c60
lea rax, [0x006c9a9e]
mov ebx, 6
call fcn.00438e00
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00438c60
lea rax, [0x006cca47]
mov ebx, 0x10
call fcn.00438e00
call fcn.00438580
lea rax, [0x008a3220]
jmp 0x45b8a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rcx
call fcn.00451040
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x20], rdx
call fcn.00438500
lea rax, [0x006ca046]
mov ebx, 7
call fcn.00438e00
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438c60
lea rax, [0x006ca16e]
mov ebx, 8
call fcn.00438e00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x230]
nop dword [rax + rax]
test rax, rax
jne 0x45b823
lea rax, [0x006d9f1f]
mov ebx, 0x2e
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463740
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0045b6e0
Function at 0x45eb20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ed1b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax + 0x30]
cmp qword [rdx + 0x18], 0
je 0x45ed09
mov rsi, qword [rdx]
cmp rsi, 0x80
jbe 0x45eb79
mov edi, dword [rax + 0x54]
bt edi, 0
nop word [rax + rax]
jae 0x45ecf8
cmp byte [rax + 0x50], 8
jne 0x45ecf8
cmp rsi, 0x80
ja 0x45eb90
mov edi, dword [rax + 0x54]
bt edi, 0
jb 0x45ecf8
cmp byte [rax + 0x50], sil
jne 0x45ecf8
mov rdi, qword [rax + 0x38]
mov r8, qword [rdi]
nop word [rax + rax]
cmp r8, 0x80
jbe 0x45ebcf
mov r9d, dword [rax + 0x54]
bt r9d, 1
jae 0x45ece7
cmp byte [rax + 0x51], 8
nop dword [rax]
jne 0x45ece7
cmp r8, 0x80
ja 0x45ebea
mov r9d, dword [rax + 0x54]
bt r9d, 1
jb 0x45ece7
nop
cmp byte [rax + 0x51], r8b
jne 0x45ece7
movzx edx, byte [rdx + 0x15]
cmp dl, 8
ja 0x45ecd6
movzx edi, byte [rdi + 0x15]
nop dword [rax + rax]
cmp dil, 8
ja 0x45ecc5
test rdx, rdx
je 0x45ecc0
mov rcx, rax
mov rax, rsi
mov r9d, edx
xor edx, edx
div r9
test rdx, rdx
jne 0x45ecac
test rdi, rdi
je 0x45eca7
mov rax, r8
xor edx, edx
div rdi
test rdx, rdx
jne 0x45ec96
mov eax, 8
xor edx, edx
div r9
test rdx, rdx
jne 0x45ec85
mov eax, 8
xor edx, edx
div rdi
test rdx, rdx
jne 0x45ec6f
mov rax, rcx
xor ecx, ecx
nop
call fcn.0040e520
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d325b]
mov ebx, 0x1d
nop dword [rax + rax]
call fcn.00436bc0
lea rax, [0x006d2ba1]
mov ebx, 0x1c
call fcn.00436bc0
lea rax, [0x006d73a6]
mov ebx, 0x26
call fcn.00436bc0
call fcn.004350e0
lea rax, [0x006d668d]
mov ebx, 0x24
call fcn.00436bc0
nop dword [rax]
call fcn.004350e0
lea rax, [0x006cd9f5]
mov ebx, 0x12
call fcn.00436bc0
lea rax, [0x006cd3fd]
mov ebx, 0x11
call fcn.00436bc0
lea rax, [0x006cc81a]
mov ebx, 0xf
call fcn.00436bc0
lea rax, [0x006cc33f]
mov ebx, 0xe
call fcn.00436bc0
lea rax, [0x006dad99]
mov ebx, 0x31
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0045eb20
Function at 0x45f4e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f677
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
lea rax, [0x0092b0a0]
call fcn.004308c0
mov qword [rsp + 0x18], rax
test byte [rax], al
lea rcx, [rax + 0x28]
mov qword [rsp + 0x20], rcx
nop
mov rax, rcx
nop dword [rax]
call fcn.0040b7a0
nop
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x20]
test rdx, rdx
je 0x45f53e
cmp rdx, 1
jne 0x45f665
nop
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x45f552
cmp rdx, 1
jne 0x45f652
mov rdx, qword [rsp + 0x38]
mov qword [rcx + 8], rdx
mov byte [rcx + 0x30], 0
nop
nop
mov ebx, dword [rcx + 0x10]
jmp 0x45f56a
nop
mov ebx, dword [rcx + 0x10]
bt ebx, 1
jae 0x45f582
mov eax, ebx
xor ebx, 2
lock cmpxchg dword [rcx + 0x10], ebx
sete bl
xor ebx, 1
jmp 0x45f584
xor ebx, ebx
test bl, bl
jne 0x45f566
inc qword [rcx + 0x38]
nop
xor ebx, ebx
xchg qword [rcx + 0x18], rbx
mov qword [rcx + 0x88], 0
inc qword [rcx + 0x90]
nop
xor ebx, ebx
xchg qword [rcx + 0x20], rbx
mov qword [rcx + 0xe0], 0
mov qword [rcx + 0xe8], rcx
nop
movzx ebx, byte [rcx + 0x30]
nop
mov rsi, qword [rcx + 0x88]
mov edi, dword [rcx + 0x10]
mov r8d, ebx
or ebx, 4
test rsi, rsi
cmovl r8d, ebx
jmp 0x45f5e1
nop
mov edi, dword [rcx + 0x10]
mov eax, edi
and edi, 2
or edi, r8d
lock cmpxchg dword [rcx + 0x10], edi
sete bl
test bl, bl
je 0x45f5dd
nop
nop
mov rax, qword [rsp + 0x20]
nop dword [rax]
call fcn.0040b9c0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x18]
call fcn.00430a80
test eax, eax
je 0x45f641
mov dword [rsp + 0x14], eax
lea rax, [0x0092b0a0]
mov rbx, qword [rsp + 0x18]
call fcn.00430140
mov ecx, dword [rsp + 0x14]
movsxd rbx, ecx
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov rax, qword [rsp + 0x18]
xor ebx, ebx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006d762c]
mov ebx, 0x26
nop
call fcn.00436bc0
lea rax, [0x006d7b25]
mov ebx, 0x27
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.0045f4e0

Function at 0x45f6a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f72b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [rax + 0x30], 0
je 0x45f719
nop
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x45f6ce
cmp rcx, 1
jne 0x45f708
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x45f6de
cmp rcx, 1
jne 0x45f6f7
mov rbx, rax
lea rax, [0x0092b0a0]
call fcn.00430140
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006d8760]
mov ebx, 0x29
call fcn.00436bc0
lea rax, [0x006d8bef]
mov ebx, 0x2a
call fcn.00436bc0
lea rax, [0x006d6145]
mov ebx, 0x23
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.0045f6a0