joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49145b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x18], rcx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
jne 0x491251
bt edx, 8
jae 0x491447
mov rcx, qword [rax + 0x40]
mov rax, qword [rax + 0x38]
jmp 0x491265
cmp rcx, 0x17
jne 0x491360
mov r8, qword [rbx]
mov rcx, qword [rbx + 0x10]
mov rbx, r8
test rdi, rdi
jl 0x491434
cmp rsi, rdi
jl 0x491434
nop word [rax + rax]
cmp rsi, rcx
jg 0x491434
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x10], rcx
lea rax, [0x006b87a0]
nop
call fcn.0040daa0
mov qword [rax], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x10]
sub rcx, rdx
mov qword [rax + 0x10], rcx
test rcx, rcx
jle 0x4912fe
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsi + 0x30]
mov r8, qword [r8]
imul rdx, r8
mov r8, qword [rsp + 0x28]
add rdx, r8
cmp dword [0x00a04ed0], 0
jne 0x4912f4
mov qword [rax], rdx
jmp 0x491323
mov rdi, rax
call fcn.00465b40
jmp 0x491323
cmp dword [0x00a04ed0], 0
jne 0x491311
mov rdx, qword [rsp + 0x28]
mov qword [rax], rdx
jmp 0x49131e
mov rdi, rax
mov rdx, qword [rsp + 0x28]
call fcn.00465b40
mov rsi, qword [rsp + 0x20]
test byte [rsi], al
mov rdx, qword [rsp + 0x18]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
or rcx, 0x97
mov rbx, rax
mov rax, rsi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp rcx, 0x18
jne 0x4913f9
test rdi, rdi
jl 0x4913e6
cmp rsi, rdi
jl 0x4913e6
cmp qword [rbx + 8], rsi
jl 0x4913e6
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x006e3580]
call fcn.0040daa0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x38]
nop word [rax + rax]
cmp qword [rdx + 8], rcx
jle 0x4913cf
mov rdx, qword [rdx]
mov rsi, qword [rsp + 0x70]
sub rsi, rcx
nop
mov qword [rax + 8], rsi
add rdx, rcx
cmp dword [0x00a04ed0], 0
jne 0x4913c7
mov qword [rax], rdx
jmp 0x4913cf
mov rdi, rax
call fcn.00465b40
mov rbx, rax
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0ff0]
call fcn.00436580
mov qword [rsp + 0x18], rcx
lea rax, [0x006e4520]
call fcn.0040daa0
mov qword [rax + 8], 0x13
lea rcx, [0x0071fcf5]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006c9120]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1000]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0fe0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00491200
Function at 0x491600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49172f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
test rcx, rcx
je 0x4916f8
bt ecx, 9
jae 0x4916b9
sar rcx, 0xa
movzx edx, byte [rax + 0x17]
and edx, 0x1f
cmp rdx, 0x14
jne 0x491671
mov rdx, qword [rax + 0x38]
cmp qword [rax + 0x40], rcx
jbe 0x4916e5
mov ebx, dword [rdx + rcx*8 + 4]
call fcn.00460e40
mov rbx, rax
lea rax, [0x007f7248]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x10], rcx
nop dword [rax + rax]
call fcn.00487a80
mov rcx, qword [rsp + 0x10]
cmp rbx, rcx
jbe 0x4916cd
shl rcx, 4
mov ebx, dword [rax + rcx + 4]
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.00460e40
mov rbx, rax
lea rax, [0x007f7248]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, rax
lea rax, [0x007f7248]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f1260]
nop dword [rax + rax]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1260]
call fcn.00436580
lea rax, [0x006e4520]
nop
call fcn.0040daa0
mov qword [rax + 8], 0x12
lea rcx, [0x0071f13f]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006c9120]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00491600
Function at 0x491760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4918ec
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x15
ja 0x491805
cmp rcx, 0x12
je 0x49184c
nop dword [rax]
cmp rcx, 0x13
jne 0x4917f6
bt edx, 9
jb 0x4917e4
nop
cmp qword [rax], 8
jne 0x4918d8
cmp qword [rax + 8], 0
nop dword [rax]
je 0x4918d8
bt edx, 7
jae 0x4917cf
mov rbx, qword [rbx]
test rbx, rbx
je 0x4917d7
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
lea rax, [0x004951a0]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x15
je 0x49184c
nop dword [rax]
jmp 0x49188f
cmp rcx, 0x16
jne 0x491840
cmp qword [rax + 8], 0
jne 0x49184c
mov qword [rsp + 0x18], rbx
mov rax, qword [rbx]
call fcn.0045f380
nop
test al, al
je 0x4918c5
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x17
je 0x49186f
cmp rcx, 0x1a
jne 0x49188f
cmp qword [rax], 8
jne 0x49187c
cmp qword [rax + 8], 0
je 0x49187c
bt edx, 7
jae 0x491862
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rbx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f1010]
call fcn.00436580
lea rax, [0x006e4520]
call fcn.0040daa0
mov qword [rax + 8], 0x1b
lea rcx, [0x007246ec]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006c9120]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1020]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1010]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00491760
Function at 0x491ec0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492046
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x98]
mov rax, rbx
call rdx
nop dword [rax + rax]
cmp rax, 0x17
jne 0x49202d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jl 0x49201a
mov rdx, qword [rsp + 0x48]
nop dword [rax]
test rdx, rdx
jl 0x492007
cmp rcx, rdx
jg 0x491ff4
lea rax, [0x006ecf00]
call fcn.0040daa0
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x38]
call rdx
mov rcx, qword [0x007f7250]
lea rdx, [0x007f7248]
cmp rax, rdx
jne 0x491fe5
mov rax, rbx
mov rbx, qword [rsp + 0x48]
call fcn.0045eae0
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rbx + 0x10], rcx
cmp dword [0x00a04ed0], 0
jne 0x491f98
mov qword [rbx], rax
jmp 0x491fa5
mov rdi, rbx
nop dword [rax + rax]
call fcn.00465a20
mov rdx, qword [0x007f7250]
mov rax, qword [rsp + 0x30]
lea rsi, [0x007f7248]
cmp rax, rsi
jne 0x491fd1
mov rax, qword [rsp + 0x38]
mov ecx, 0x97
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, rdx
lea rcx, [0x00708720]
nop dword [rax + rax]
call fcn.0040ada0
mov rbx, rcx
lea rcx, [0x00708720]
call fcn.0040ada0
lea rax, [0x006bb4c0]
lea rbx, [0x007f1060]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1050]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1040]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1030]
nop dword [rax + rax]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00491ec0

Function at 0x492080
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49211c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 0x98]
mov rax, rbx
call rdx
cmp rax, 0x15
jne 0x492108
mov rbx, qword [0x007f7250]
mov rax, qword [rsp + 0x30]
lea rdx, [0x007f7248]
cmp rax, rdx
jne 0x4920fc
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.0045eb20
mov rbx, rax
mov ecx, 0x15
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rcx, [0x00708720]
call fcn.0040ada0
lea rax, [0x006bb4c0]
lea rbx, [0x007f1070]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.00492080
Function at 0x492260
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49230c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
test rax, rax
je 0x4922f8
mov rdx, qword [0x007f7250]
lea rsi, [0x007f7248]
cmp rax, rsi
jne 0x4922e9
mov qword [rsp + 0x38], rbx
mov rax, rbx
call fcn.00488b20
movzx ecx, byte [rax + 0x17]
test cl, 0x20
je 0x4922d6
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
call fcn.0045ea20
mov rbx, rax
mov ecx, 0x16
mov rax, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f10a0]
call fcn.00436580
mov rbx, rdx
lea rcx, [0x00708720]
call fcn.0040ada0
lea rax, [0x006bb4c0]
lea rbx, [0x007f1090]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00492260

Function at 0x492640
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49277a
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rsi
bt ecx, 9
jae 0x4926a8
mov rdi, rbx
mov rsi, rcx
mov ebx, 7
mov rcx, rax
lea rax, [0x0071a37a]
call fcn.00486c60
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov rdx, qword [rdi + 0x100]
mov rax, rsi
call rdx
mov rbx, qword [rsp + 0x60]
call fcn.00492a60
test rax, rax
je 0x492704
mov r8, qword [rax]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rdx, rax
mov rax, qword [rsp + 0x60]
call r8
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, qword [rsp + 0x60]
call fcn.004878e0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx + 0xf8]
mov rax, qword [rsp + 0xa0]
call rcx
mov ecx, 0x25
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x007251ac]
mov r9d, 0x1d
mov r10, rax
mov r11, rbx
xor eax, eax
lea rbx, [0x007298a2]
nop dword [rax]
call fcn.0044e9e0
call fcn.0040b100
mov rbx, rax
lea rax, [0x006bb4c0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00492640
Function at 0x49b7a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b7f2
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
call fcn.0049b480
nop
test rdi, rdi
jne 0x49b7de
test rbx, rbx
jbe 0x49b7d4
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
mov rcx, rax
call fcn.00465ec0
lea rax, [0x006bb4c0]
lea rbx, [0x007f1610]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049b7a0

Function at 0x4a9080
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9218
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], r8
mov qword [rsp + 0xa0], r10
cmp r10, 0x19
je 0x4a9181
nop
cmp r10, 0x23
jne 0x4a91d0
mov rax, r9
lea rbx, [0x007285b5]
mov ecx, 0x23
call fcn.00402d80
nop
test al, al
jne 0x4a9145
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xa0]
nop dword [rax + rax]
jmp 0x4a91d0
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
mov r9d, 1
call fcn.004af120
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, r9
lea rbx, [0x00722c58]
mov ecx, 0x19
call fcn.00402d80
test al, al
jne 0x4a91df
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xa0]
call fcn.004a9280
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
xor r9d, r9d
call fcn.004af120
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.004a9080
Function at 0x4abda0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4abea9
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x40], rax
cmp rbx, 0x19
je 0x4abdd6
xor edx, edx
jmp 0x4abe00
lea rbx, [0x00722c58]
mov ecx, 0x19
call fcn.00402d80
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
je 0x4abe0b
mov edx, 1
jmp 0x4abe40
cmp rbx, 0x23
je 0x4abe15
xor edx, edx
jmp 0x4abe40
lea rbx, [0x007285b5]
mov ecx, 0x23
call fcn.00402d80
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
je 0x4abe7e
mov rdx, qword [0x009a2de8]
lea rax, [0x007f3960]
mov rbx, rcx
mov rcx, rdi
mov rdi, rdx
nop dword [rax + rax]
call fcn.004b74c0
test dil, dil
jne 0x4abe9b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov r8, qword [0x009a2de8]
mov rsi, qword [0x009a2df0]
call fcn.004abee0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax]
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004abda0

Function at 0x4af8e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af926
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x4af90f
add rax, 8
nop
call fcn.004627c0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0e80]
nop dword [rax]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.004af8e0

Function at 0x4afa20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4afa7a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x4afa66
mov qword [rsp + 0x20], rax
mov rax, rbx
call fcn.004af860
mov rcx, qword [rsp + 0x20]
add rcx, 8
mov rbx, rax
mov rax, rcx
call fcn.00462800
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f1670]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004afa20
Function at 0x4ba760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba85c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
jmp 0x4ba77d
mov rax, rbx
mov rcx, qword [rax]
bt ecx, 0
jb 0x4ba7c4
mov rdx, rcx
or rcx, 1
add rcx, 8
test rcx, 0x7ffff8
je 0x4ba848
movabs rsi, 0x80000000007fffff
and rcx, rsi
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x4ba77a
mov qword [rsp + 0x18], rbx
jmp 0x4ba7ef
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 8]
call fcn.00461280
mov rdx, qword [rsp + 0x10]
add rdx, 0xffffffffff800000
mov rbx, qword [rsp + 0x18]
movabs rcx, 0x7ffff800000
test rdx, rcx
jne 0x4ba7d0
nop
jmp 0x4ba82a
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 0xc]
call fcn.00461280
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xfffff80000000000
add rcx, rdx
mov rbx, qword [rsp + 0x18]
mov rdx, rcx
movabs rcx, 0x7ffff80000000000
test rdx, rcx
jne 0x4ba802
mov eax, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0c40]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.004ba760

Function at 0x4ba880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba9af
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test bl, bl
je 0x4ba8b8
test byte [rax], al
lea rcx, [rax + 8]
mov edx, 2
mov ebx, 0x800000
movabs rsi, 0x7ffff800000
jmp 0x4ba8d7
test byte [rax], al
lea rcx, [rax + 0xc]
mov edx, 4
movabs rbx, 0x80000000000
movabs rsi, 0x7ffff80000000000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdx
jmp 0x4ba8f5
mov rax, r9
mov rdi, qword [rax]
bt edi, 0
jb 0x4ba97c
nop
test rdi, rdx
jne 0x4ba91d
mov r8, rdi
or rdi, rdx
add rdi, 8
test rdi, 0x7ffff8
jne 0x4ba92f
jmp 0x4ba99b
lea r8, [rbx + rdi]
test rsi, r8
je 0x4ba988
mov r9, r8
mov r8, rdi
mov rdi, r9
mov r9, rax
mov rax, r8
lock cmpxchg qword [r9], rdi
sete dil
nop
test dil, dil
je 0x4ba8f2
test r8, rdx
je 0x4ba96d
mov rax, rcx
call fcn.004610a0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov r9, qword [rsp + 0x40]
jmp 0x4ba8f2
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0c40]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0c40]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00463860
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004ba880
Function at 0x4bb0a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bb2d9
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x90], rdi
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov r8, qword [rsp + 0x48]
bt r8, 0x3f
jae 0x4bb10d
mov r8, qword [rsp + 0x48]
shl r8, 1
shr r8, 0x1f
movabs r9, 0xdd7b17f80
add r8, r9
jmp 0x4bb112
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x78], rax
nop dword [rax]
test r8, r8
jne 0x4bb13a
mov r8, qword [rsp + 0x48]
and r8d, 0x3fffffff
test r8d, r8d
jne 0x4bb13a
xor ecx, ecx
jmp 0x4bb163
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call fcn.004b0dc0
test rax, rax
mov rdx, 0xffffffffffffffff
cmove rax, rdx
mov rsi, qword [rsp + 0x20]
mov rcx, rax
mov rax, qword [rsp + 0x78]
test byte [rax], al
jmp 0x4bb16a
mov rax, rdx
mov rdi, qword [rax]
bt edi, 0
jb 0x4bb1ab
lea r8, [rdi + 8]
nop word [rax + rax]
test r8, 0x7ffff8
je 0x4bb2a8
mov rdx, rax
mov rax, rdi
lock cmpxchg qword [rdx], r8
sete r8b
nop dword [rax]
test r8b, r8b
je 0x4bb167
bt edi, 0
jmp 0x4bb1ae
mov rdx, rax
jae 0x4bb1d9
cmp byte [rdx + 0x21f], 0
je 0x4bb1c9
mov rdi, qword [0x009af3d0]
mov r8, qword [0x009af3d8]
jmp 0x4bb1e0
lea rdi, [0x007f2460]
lea r8, [0x00a04c58]
jmp 0x4bb1e0
xor edi, edi
xor r8d, r8d
nop
test rdi, rdi
jne 0x4bb28e
movups xmmword [rsp + 0x38], xmm15
lea rdi, [0x004bb320]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x1f], 1
mov rax, qword [rdx + 0x1b8]
test rax, rax
jne 0x4bb256
mov rax, qword [0x009af3e0]
mov rcx, qword [0x009af3e8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbx, rcx
mov rcx, rsi
nop dword [rax]
call fcn.0045fa00
movups xmmword [rsp + 0x28], xmm15
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx]
call rsi
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], r8
mov rax, rdi
mov rbx, r8
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0c40]
call fcn.00436580
nop
nop dword [rax]
call fcn.00435a20
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004bb0a0