joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b900
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ba80
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
lea rax, [0x00838350]
call fcn.004314a0
mov qword [rsp + 0x18], rax
test byte [rax], al
lea rcx, [rax + 0x28]
mov qword [rsp + 0x30], rcx
mov rax, rcx
nop dword [rax]
call fcn.0040b060
mov rcx, qword [rsp + 0x18]
lea rax, [rcx + 0x20]
mov qword [rsp + 0x28], rax
call fcn.00401d20
test rax, rax
je 0x45b96a
nop dword [rax]
cmp rax, 1
jne 0x45ba6e
mov rcx, qword [rsp + 0x18]
lea rax, [rcx + 0x18]
mov qword [rsp + 0x20], rax
call fcn.00401d20
nop dword [rax]
test rax, rax
je 0x45b98f
cmp rax, 1
jne 0x45ba5d
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x18]
mov qword [rax + 8], rcx
mov byte [rax + 0x30], 0
xor ebx, ebx
call fcn.00430b00
mov rcx, qword [rsp + 0x18]
inc qword [rcx + 0x38]
mov rax, qword [rsp + 0x20]
xor ebx, ebx
call fcn.00401d40
mov rcx, qword [rsp + 0x18]
mov qword [rcx + 0x88], 0
inc qword [rcx + 0x90]
mov rax, qword [rsp + 0x28]
xor ebx, ebx
nop dword [rax + rax]
call fcn.00401d40
mov rax, qword [rsp + 0x18]
mov qword [rax + 0xe0], 0
mov qword [rax + 0xe8], rax
nop dword [rax]
call fcn.00430a40
mov rax, qword [rsp + 0x30]
call fcn.0040b280
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x18]
call fcn.004316c0
nop
test eax, eax
je 0x45ba4c
mov dword [rsp + 0x14], eax
lea rax, [0x00838350]
mov rbx, qword [rsp + 0x18]
call fcn.00430c20
mov ecx, dword [rsp + 0x14]
movsxd rbx, ecx
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, qword [rsp + 0x18]
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00652bec]
mov ebx, 0x26
call fcn.00436d80
lea rax, [0x006530e5]
mov ebx, 0x27
call fcn.00436d80
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0045b900

Function at 0x45baa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45bb5c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [rax + 0x30], 0
nop dword [rax]
je 0x45bb4a
mov qword [rsp + 0x20], rax
lea rcx, [rax + 0x20]
mov rax, rcx
call fcn.00401d20
test rax, rax
je 0x45bae6
nop dword [rax]
cmp rax, 1
jne 0x45bb39
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + 0x18]
call fcn.00401d20
test rax, rax
je 0x45baff
cmp rax, 1
jne 0x45bb28
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 8]
call fcn.00431780
lea rax, [0x00838350]
mov rbx, qword [rsp + 0x20]
call fcn.00430c20
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00653c7e]
mov ebx, 0x29
call fcn.00436d80
lea rax, [0x0065410b]
mov ebx, 0x2a
call fcn.00436d80
lea rax, [0x00651a59]
mov ebx, 0x23
call fcn.00436d80
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0045baa0
Function at 0x45c140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c266
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
test byte [rax], al
lea rcx, [rax + 0x28]
mov qword [rsp + 0x20], rcx
mov rax, rcx
call fcn.0040b060
mov rax, qword [rsp + 0x38]
cmp byte [rax + 0x30], 0
jne 0x45c24f
mov byte [rax + 0x30], 1
inc qword [rax + 0x38]
inc qword [rax + 0x90]
call fcn.00430a40
mov rax, qword [rsp + 0x38]
mov ebx, 0x72
xor ecx, ecx
nop
call fcn.00431080
mov qword [rsp + 0x18], rax
mov ebx, 0x77
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call fcn.00431080
mov qword [rsp + 0x10], rax
mov rcx, qword [rsp + 0x38]
cmp qword [rcx + 0x58], 0
je 0x45c1e7
lea rax, [rcx + 0x40]
call fcn.00451380
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x58], 0
mov rax, qword [rsp + 0x10]
cmp qword [rcx + 0xb0], 0
je 0x45c20d
lea rax, [rcx + 0x98]
call fcn.00451380
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0xb0], 0
mov rax, qword [rsp + 0x20]
call fcn.0040b280
mov rax, qword [rsp + 0x18]
nop dword [rax]
test rax, rax
je 0x45c22f
mov ebx, 3
call fcn.00430ec0
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x45c245
mov ebx, 3
nop
call fcn.00430ec0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00652109]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00436d80
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0045c140
Function at 0x45c320
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x30]
nop dword [rax]
cmp qword [r14 + 0x70], rcx
jb 0x45c565
mov qword [rsp + 0x18], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
call fcn.00445fe0
mov qword [rsp + 0x10], rax
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov qword [rdx + 0xb0], 0
call fcn.004402a0
test al, al
jne 0x45c3b3
mov rcx, qword [rsp + 0x18]
mov qword [rcx + 0xd0], 0
cmp byte [0x007ea170], 0
je 0x45c4be
mov rax, qword [rsp + 0x10]
jmp 0x45c521
cmp byte [0x007ea170], 0
jne 0x45c3c3
mov rcx, qword [rsp + 0x18]
jmp 0x45c437
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa0]
call fcn.00445fe0
mov rcx, qword [rsp + 0x10]
nop dword [rax]
cmp rax, rcx
jne 0x45c40e
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa0]
call fcn.00445fe0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov edx, dword [rdx + 0x26c]
cmp dword [rax + 0x14], edx
je 0x45c437
lea rax, fcn.00454500
mov qword [rsp], rax
call fcn.0045f140
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa0]
call fcn.00445fe0
inc dword [rax + 0x14]
mov rax, qword [rsp + 0x18]
mov ebx, 3
mov ecx, 2
call fcn.0043ac40
mov rax, qword [rsp + 0x18]
mov qword [rax + 0x70], 0
mov rcx, qword [rax + 0x30]
dec dword [rcx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x45c488
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x45c496
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x007e2bd8], 0
je 0x45c4b4
call fcn.00443a80
test al, al
jne 0x45c4b4
call fcn.004394e0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x006750b8]
call fcn.0045f0c0
mov rcx, qword [rsp + 0x18]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa0]
call fcn.00445fe0
inc dword [rax + 0x14]
mov rcx, qword [rsp + 0x18]
mov byte [rcx + 0xb7], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00434ce0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov rax, rcx
mov rcx, qword [rsp + 0x18]
test rax, rax
je 0x45c535
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rax + 0x14]
cmp dword [rdx + 0x26c], ebx
je 0x45c50a
call fcn.00461340
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov qword [rcx + 0xd0], rax
nop
jmp 0x45c4be
lea rax, [0x00654c97]
mov ebx, 0x2d
call fcn.00436d80
nop
int3
Function at 0x45d1c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d24b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp rax, 0x20
jne 0x45d1e8
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 0x20], rax
call fcn.00438460
lea rax, [0x0065200d]
mov ebx, 0x24
nop
call fcn.00438d00
mov rax, qword [rsp + 0x20]
call fcn.00438a40
lea rax, [0x006456f4]
mov ebx, 9
nop dword [rax + rax]
call fcn.00438d00
mov eax, 0x20
call fcn.00438a40
call fcn.004386a0
call fcn.004384e0
lea rax, [0x006497be]
mov ebx, 0x13
call fcn.00436d80
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0045d1c0
Function at 0x45df20
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov r13, 0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x1f], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
nop
cmp rcx, 4
jge 0x45dfb3
lea rdx, [rsp + 0x38]
cmp rbx, rdx
je 0x45dfac
shl rcx, 3
mov rax, rdx
call fcn.00461f80
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x90]
lea rbx, [rsp + 0x38]
jmp 0x45dfbd
cmp rcx, 0x2a
jg 0x45e074
mov qword [rsp + 0x60], rbx
call fcn.00441440
lea rax, fcn.004414c0
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x1f], 1
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x2c0], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rax + 0x2c8], rcx
mov rax, qword [rsp + 0x60]
call fcn.0044dba0
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0x2d0], rax
lea rbx, [rcx + 0x2c0]
mov rax, qword [0x007df150]
call fcn.004042e0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x2d8]
mov rdx, qword [rax + 0x2e0]
mov rax, qword [rax + 0x2e8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x1f], 0
call fcn.004414c0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rax, [0x005fe120]
lea rbx, [0x00684f10]
call fcn.00436780
nop
call fcn.00435de0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x4613a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40338f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.004094a0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403360
cmp byte [0x00837f84], 0
je 0x4613b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45e380
jmp 0x403360

Function at 0x4613c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40990f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.00409a00
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x008383e0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.004099e0
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
nop dword [rax]
call fcn.004099e0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4098a0
cmp byte [0x00837f84], 0
je 0x4613f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x008386e0]
aesenc xmm0, xmmword [0x008386f0]
aesenc xmm0, xmmword [0x00838700]
movq rax, xmm0
ret
jmp 0x4098a0

Function at 0x461400
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4099af
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.00409a40
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x008383e0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.004099e0
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
nop dword [rax]
call fcn.004099e0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x409940
cmp byte [0x00837f84], 0
je 0x461436
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x008386e0]
aesenc xmm0, xmmword [0x008386f0]
aesenc xmm0, xmmword [0x00838700]
movq rax, xmm0
ret
jmp 0x409940

Function at 0x462a40
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.KERNEL32.DLL_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00838660]
mov qword [rsp + 8], rdx
lea r8d, [0x00837fa8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.KERNEL32.DLL_WriteFile]
call rax
call fcn.004612e0
add rsp, 0x30
ret
Function at 0x4633c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43a386
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
lea rax, [0x007e2b78]
mov ebx, 9
call fcn.0040b9c0
lea rax, [0x007e2c90]
mov ebx, 1
call fcn.0040b9c0
lea rax, [0x007e2c28]
mov ebx, 0x22
call fcn.0040b9c0
lea rax, [0x007e2c18]
mov ebx, 0x23
call fcn.0040b9c0
lea rax, [0x008380b0]
mov ebx, 0xa
call fcn.0040b9c0
lea rax, [0x00838140]
mov ebx, 0x2b
call fcn.0040b9c0
lea rax, [0x00838078]
mov ebx, 0xb
call fcn.0040b9c0
lea rax, [0x00838080]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.0040b9c0
lea rax, [0x007e09e0]
mov ebx, 0xf
call fcn.0040b9c0
lea rax, [0x008380e0]
mov ebx, 0x12
call fcn.0040b9c0
lea rax, [0x007fa228]
mov ebx, 0x11
call fcn.0040b9c0
lea rax, [0x007fa1f0]
mov ebx, 0x14
call fcn.0040b9c0
lea rax, [0x007ea160]
mov ebx, 0x19
call fcn.0040b9c0
lea rax, [0x007e4320]
mov ebx, 6
call fcn.0040b9c0
lea rax, [0x007ea1d0]
mov ebx, 0x1a
call fcn.0040b9c0
lea rax, [0x0083ec30]
mov ebx, 0x3e8
call fcn.0040b9c0
mov qword [rsp + 0x28], r14
mov dword [0x007e2b98], 0x2710
nop dword [rax]
call fcn.0040bb00
call fcn.0044e720
call fcn.004493c0
call fcn.0040bb80
call fcn.0043a040
call fcn.004040a0
nop
call fcn.0043a7a0
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + 0x30]
mov rbx, 0xffffffffffffffff
call fcn.0043a620
call fcn.0044e580
nop
call fcn.00459d60
call fcn.0040a3e0
call fcn.0044c560
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
test byte [rdx], al
lea rax, [rdx + 0x58]
nop
call fcn.004341a0
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
test byte [rcx], al
call fcn.004455a0
call fcn.004332a0
call fcn.00445ba0
nop
call fcn.0041a5a0
lea rax, [0x007e2b78]
call fcn.0040b060
call fcn.00452f40
mov qword [0x007e2b68], rax
mov ecx, dword [0x00837fd4]
mov dword [rsp + 0x14], ecx
lea rax, [0x00645c4e]
mov ebx, 0xa
call fcn.00407980
call fcn.0044d820
nop dword [rax]
test bl, bl
je 0x43a2a8
test eax, eax
jg 0x43a2ac
mov eax, dword [rsp + 0x14]
call fcn.00441a60
test rax, rax
jne 0x43a371
lea rax, [0x007e2b78]
call fcn.0040b280
call fcn.0040bb20
cmp dword [0x00838600], 1
jle 0x43a2fe
mov byte [0x00838365], 1
mov byte [0x00838360], 1
mov rcx, qword [0x007e0880]
mov qword [rsp + 0x30], rcx
mov rdx, qword [0x007e0888]
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x43a36a
cmp qword [0x007d4ab8], 0
jne 0x43a321
mov qword [0x007d4ab8], 7
lea rax, [0x00645195]
mov qword [str.go1.18.1], rax
cmp qword [0x007d4b08], 1
jne 0x43a333
movups xmmword [0x007d4b00], xmm15
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x18], rax
mov rdx, qword [rcx + rax*8]
test byte [rdx], al
add rdx, 0x1260
mov rax, rdx
call fcn.00430580
mov rcx, qword [rsp + 0x18]
lea rax, [rcx + 1]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
cmp rax, rdx
jl 0x43a33d
jmp 0x43a2fe
lea rax, [0x006546bb]
mov ebx, 0x2b
nop dword [rax]
call fcn.00436d80
nop
call fcn.0045f280
jmp 0x43a0a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x43a0a0
Function at 0x463620
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x00656210]
mov ebx, 0x32
call fcn.00436d80
nop
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x45d2a0

Function at 0x466ba0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x466c8e
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x466c7a
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
test rcx, rcx
je 0x466be7
lea rdx, [0x00837f8b]
nop
cmp rcx, rdx
je 0x466bd0
jmp 0x466c17
call fcn.0045c5c0
mov rax, qword [rsp + 0x28]
xor ebx, ebx
lea rcx, [0x00837f8b]
call fcn.0045b1a0
nop
test al, al
jne 0x466c36
call fcn.0045c5e0
mov rax, qword [rsp + 0x28]
lea rdx, [0x00837f8b]
jmp 0x466bd0
cmp qword [rsp + 0x30], rcx
jne 0x466c67
add rax, 8
mov rbx, qword [rsp + 0x38]
call fcn.0045b140
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + 8]
mov rbx, qword [rsp + 0x38]
call fcn.0045b140
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
call fcn.0045b140
call fcn.0045c5e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x005fe120]
lea rbx, [0x00685130]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00685120]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00466ba0

Function at 0x467ee0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467f57
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
cmp qword [rax], 8
jne 0x467f43
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rbx
call fcn.004679c0
test al, al
je 0x467f43
mov rcx, qword [rsp + 0x10]
bt ecx, 7
jae 0x467f34
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00684d40]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00467ee0
Function at 0x46d760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d9b0
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
nop dword [rax + rax]
test rdi, rdi
jl 0x46d99c
cmp rdi, 9
jg 0x46d989
test ebx, ebx
jne 0x46d7a6
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
mov edx, ebx
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
bsr rdx, rdx
nop
cmp rdx, 0x19
jge 0x46d7e7
lea rsi, [rdx - 0x19]
neg rsi
cmp rsi, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rsi
shl ebx, cl
and ebx, r8d
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x19]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x2c], ebx
lea rax, [rcx + 0x18]
call fcn.0046e2c0
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov qword [rsp + 0x48], rcx
lea rbx, [rcx - 1]
cmp rbx, 0x1b
jg 0x46d819
test rbx, rbx
setge sil
jmp 0x46d81b
xor esi, esi
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x26], sil
mov eax, dword [rsp + 0x2c]
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
call fcn.0046e760
test rbx, rbx
jge 0x46d976
mov rdx, qword [rsp + 0x48]
lea r8, [rdx + 9]
cmp r8, 0xa
jae 0x46d89f
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x40], rbx
mov byte [rsp + 0x27], cl
mov ecx, dword [rsp + 0x2c]
mov eax, ecx
mov rbx, qword [rsp + 0x30]
neg rbx
call fcn.0046e9a0
test al, al
je 0x46d88c
mov eax, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov esi, 1
mov ecx, 1
jmp 0x46d8a4
mov eax, dword [rsp + 0x28]
movzx ecx, byte [rsp + 0x27]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0x26]
neg rbx
cmp rbx, 0x20
sbb r8d, r8d
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9d, cl
and r9d, r8d
dec r9d
mov r10d, eax
shr eax, cl
and eax, r8d
and r9d, r10d
test sil, sil
je 0x46d916
dec rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r10d, 1
shl r10d, cl
and r10d, r8d
cmp r10d, r9d
jb 0x46d905
jne 0x46d90c
test dil, dil
je 0x46d905
cmp r10d, r9d
jne 0x46d90c
test dil, dil
je 0x46d90c
mov ebx, eax
and eax, 1
jmp 0x46d910
mov ecx, 1
jmp 0x46d933
mov ebx, eax
xor eax, eax
mov ecx, eax
mov eax, ebx
jmp 0x46d933
dec rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r10d, r9d
shr r9d, cl
and r9d, r8d
cmp r9d, 1
sete cl
mov r9d, r10d
test r9d, r9d
je 0x46d93a
xor edi, edi
xor edi, 1
mov ebx, eax
mov rsi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x60]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.0046dca0
mov rdx, qword [rsp + 0x60]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x48]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x005fe120]
lea rbx, [0x00685040]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00685030]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00685020]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.0046d760
Function at 0x46da00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46dc59
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
nop dword [rax + rax]
cmp rdi, 0x12
jg 0x46dc45
test rbx, rbx
jne 0x46da3e
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x80], rdi
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
nop
cmp rsi, 0x37
jge 0x46da88
lea rsi, [rdx - 0x36]
neg rsi
cmp rsi, 0x40
sbb r8, r8
mov r9, rcx
mov rcx, rsi
shl rbx, cl
and rbx, r8
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x36]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x50], rbx
lea rax, [rcx + 0x36]
call fcn.0046e2c0
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov qword [rsp + 0x48], rcx
lea rbx, [rcx - 1]
cmp rbx, 0x37
jg 0x46dabe
test rbx, rbx
setge sil
jmp 0x46dac0
xor esi, esi
mov qword [rsp + 0x28], rbx
mov byte [rsp + 0x26], sil
mov rax, qword [rsp + 0x50]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
call fcn.0046e860
nop dword [rax]
test rbx, rbx
jge 0x46dc2e
mov rdx, qword [rsp + 0x48]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x46db4b
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov byte [rsp + 0x27], cl
mov rbx, qword [rsp + 0x28]
neg rbx
mov rax, qword [rsp + 0x50]
call fcn.0046e9a0
test al, al
je 0x46db37
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov esi, 1
mov ecx, 1
jmp 0x46db50
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x27]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0x26]
neg rbx
cmp rbx, 0x40
sbb r8, r8
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9, cl
and r9, r8
dec r9
mov r10, rax
shr rax, cl
and rax, r8
and r9, r10
test sil, sil
je 0x46dbca
dec rcx
cmp rcx, 0x40
sbb r8, r8
mov r10d, 1
shl r10, cl
and r10, r8
cmp r10, r9
jb 0x46dbb7
jne 0x46dbbe
nop dword [rax]
test dil, dil
je 0x46dbb7
cmp r10, r9
jne 0x46dbbe
test dil, dil
je 0x46dbbe
mov rbx, rax
and eax, 1
jmp 0x46dbc3
mov ecx, 1
jmp 0x46dbe7
mov rbx, rax
xor eax, eax
mov ecx, eax
mov rax, rbx
jmp 0x46dbe7
dec rcx
cmp rcx, 0x40
sbb r8, r8
mov r10, r9
shr r9, cl
and r9, r8
cmp r9, 1
sete cl
mov r9, r10
test r9, r9
je 0x46dbee
xor edi, edi
xor edi, 1
mov rbx, rax
mov rsi, qword [rsp + 0x80]
mov rax, qword [rsp + 0x68]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.0046dca0
mov rdx, qword [rsp + 0x68]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x48]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x005fe120]
lea rbx, [0x00685060]
nop dword [rax]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00685050]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0046da00