joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c6c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c7f3
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x18], rcx
call fcn.00445ee0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.0043bf60
mov qword [rsp + 0x20], rax
test byte [rax], al
lea rcx, [rax + 0xa8]
mov rbx, qword [rsp + 0x28]
mov rax, rcx
nop dword [rax + rax]
call fcn.00446000
mov rax, r14
test rax, rax
je 0x43c7c4
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x43c7c4
cmp dword [rcx + 0x238], 0
jne 0x43c750
cmp byte [rcx + 0xe8], 0
je 0x43c7c4
lea rax, [0x008384a0]
call fcn.0040b060
cmp dword [0x008384c0], 0
je 0x43c7e1
mov rcx, qword [0x008384a8]
mov rbx, qword [rsp + 0x20]
mov qword [rbx + 0x128], rcx
lea rax, [0x008384a8]
nop
call fcn.00446040
cmp byte [0x008384b0], 0
je 0x43c7a5
mov byte [0x008384b0], 0
lea rax, [0x008384b8]
nop dword [rax]
call fcn.0040b3e0
lea rax, [0x008384a0]
call fcn.0040b280
mov rax, qword [r14 + 0x30]
call fcn.00445f00
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, qword [rsp + 0x20]
call fcn.0043c820
mov rax, qword [r14 + 0x30]
call fcn.00445f00
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00654063]
mov ebx, 0x2a
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043c6c0

Function at 0x43d0e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43d238
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0x130]
test rax, rax
je 0x43d226
mov qword [rsp + 0x18], r14
call fcn.00445f60
mov rax, qword [rax + 0xe8]
nop dword [rax]
call fcn.00446020
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
cmp rax, rdx
jne 0x43d226
cmp qword [rdx + 0xa0], 0
nop
je 0x43d14c
call fcn.004421a0
call fcn.0043ce00
mov eax, 1
call fcn.00442360
call fcn.0043b980
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0x130]
call fcn.00445f60
call fcn.0043a980
mov ecx, eax
btr eax, 0xc
nop dword [rax + rax]
cmp eax, 1
jne 0x43d1bd
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.00445fe0
call fcn.00441fe0
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x14], ecx
call fcn.00438460
lea rax, [0x0065460f]
mov ebx, 0x2b
call fcn.00438d00
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.00438a40
lea rax, [0x00651cd1]
mov ebx, 0x24
call fcn.00438d00
call fcn.004384e0
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x130]
call fcn.00445f60
call fcn.0043a3a0
lea rax, [0x0064ced1]
mov ebx, 0x19
call fcn.00436d80
lea rax, [0x00650df5]
mov ebx, 0x21
call fcn.00436d80
nop
call fcn.0045f280
nop dword [rax]
jmp fcn.0043d0e0
Function at 0x43f440
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x43f5a6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
cmp byte [0x007ea170], 0
je 0x43f477
mov eax, 0x14
xor ebx, ebx
call fcn.00454780
mov rax, qword [rsp + 0x40]
call fcn.0043a980
btr eax, 0xc
cmp eax, 2
jne 0x43f587
mov rax, qword [rsp + 0x40]
mov byte [rax + 0xb0], 0x19
cmp byte [rax + 0xb4], 0
je 0x43f4db
mov rcx, qword [rax + 0x40]
mov rax, rcx
call fcn.0044f400
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x18], rbx
call fcn.0044f340
nop dword [rax]
test al, al
je 0x43f576
mov rax, qword [rsp + 0x20]
movzx edx, byte [rax + 0x25]
test dl, 2
jne 0x43f514
mov rax, qword [rsp + 0x40]
mov ebx, 2
mov ecx, 0x1009
call fcn.0043af40
call fcn.0043ee60
mov rax, qword [rsp + 0x40]
mov ebx, 0x1009
mov ecx, 9
nop
call fcn.0043a9a0
call fcn.0043eaa0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbx, qword [rsp + 0x18]
call fcn.0044fb80
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x10], rbx
call fcn.00438460
lea rax, [0x006526c5]
mov ebx, 0x25
call fcn.00438d00
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x10]
call fcn.00438d00
lea rax, [0x00648c89]
mov ebx, 0x12
call fcn.00438d00
nop
call fcn.004384e0
lea rax, [0x00647d55]
mov ebx, 0xf
call fcn.00436d80
lea rax, [0x0064aaab]
mov ebx, 0x15
call fcn.00436d80
mov rax, qword [rsp + 0x40]
call fcn.0043a3a0
lea rax, [0x0064698d]
mov ebx, 0xc
nop dword [rax]
call fcn.00436d80
nop
mov qword [rsp + 8], rax
call fcn.00463620
mov rax, qword [rsp + 8]
jmp fcn.0043f440
Function at 0x443fc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444071
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [0x007e2b78]
call fcn.0040bae0
mov rax, qword [rsp + 0x30]
call fcn.00444160
test al, al
je 0x44405f
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00443f20
mov rax, qword [0x007e08e0]
mov rbx, qword [0x007e08e8]
mov rcx, qword [0x007e08f0]
mov rdx, qword [rsp + 0x30]
mov edi, dword [rdx]
call fcn.00443e60
mov rcx, qword [0x007e2bb0]
mov rbx, qword [rsp + 0x30]
mov qword [rbx + 8], rcx
lea rax, [0x007e2bb0]
nop dword [rax]
call fcn.00446000
mov ecx, 1
lea rdx, [0x007e2bb8]
lock xadd dword [rdx], ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00651a13]
mov ebx, 0x23
call fcn.00436d80
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.00443fc0
Function at 0x448640
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x48], r14
cmp dword [0x00837fe8], 0
je 0x44867d
mov eax, 2
call fcn.00433480
mov rbx, qword [rsp + 0x58]
mov dword [0x00837fe8], 1
mov rcx, qword [rsp + 0x48]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov rax, rbx
call fcn.004073a0
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx]
mov qword [rsp + 0x38], rdx
mov rbx, qword [rcx + 0x20]
mov qword [rsp + 0x30], rbx
mov rcx, qword [rcx + 0x28]
mov qword [rsp + 0x28], rcx
call fcn.00438460
lea rax, [0x00645c3a]
mov ebx, 0xa
nop
call fcn.00438d00
mov rax, qword [rsp + 0x38]
call fcn.00438b80
call fcn.00438660
mov rax, qword [rsp + 0x30]
call fcn.00438b80
nop
call fcn.00438660
mov rax, qword [rsp + 0x28]
call fcn.00438b80
call fcn.00438660
mov rax, qword [rsp + 0x40]
call fcn.00438b80
nop
call fcn.004386a0
call fcn.004384e0
mov rax, qword [rsp + 0x58]
call fcn.004073a0
mov qword [rsp + 0x40], rax
call fcn.00438460
lea rax, [0x006445b9]
mov ebx, 3
call fcn.00438d00
mov rax, qword [rsp + 0x40]
call fcn.00438b80
call fcn.004386a0
nop
call fcn.004384e0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx + 0x30]
cmp byte [rdx + 0xe8], 0
je 0x4487c5
mov rax, qword [rsp + 0x80]
nop
cmp qword [rdx], rax
jne 0x4487cd
cmp qword [rdx + 0x90], 0
je 0x4487cd
cmp byte [0x00837f7f], 0
je 0x4487b8
call fcn.00438460
lea rax, [0x006553b4]
mov ebx, 0x2e
call fcn.00438d00
call fcn.004384e0
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0x90]
jmp 0x4487cd
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
call fcn.00438460
call fcn.004386a0
nop dword [rax]
call fcn.004384e0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 1
mov rax, qword [rax + 0x30]
test byte [rax], al
add rax, 0x98
mov rbx, qword [rsp + 0x50]
call fcn.00445f80
call fcn.00445500
test eax, eax
jle 0x448875
mov byte [rsp + 0x27], cl
mov rax, qword [rsp + 0x58]
call fcn.004073a0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x58]
call fcn.004073c0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
nop
call fcn.004073e0
mov rbx, qword [rsp + 0x30]
mov rcx, rax
mov rdi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x40]
call fcn.004573e0
mov rax, qword [rsp + 0x50]
call fcn.004583c0
mov rax, qword [rsp + 0x58]
call fcn.00407440
movzx ecx, byte [rsp + 0x27]
test cl, cl
je 0x44887e
call fcn.00448ae0
mov eax, 2
call fcn.00433480
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x448a00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x448a82
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
xor eax, eax
jmp 0x448a2c
lea r8, [0x00838660]
mov byte [r8 + rax], sil
inc dword [0x00837fa8]
mov rax, rdi
cmp rax, 0x36
jge 0x448a78
lea rdx, [0x00656f9a]
movzx esi, byte [rdx + rax]
nop dword [rax]
cmp esi, 0x80
jge 0x448a4e
lea rdi, [rax + 1]
jmp 0x448a18
mov qword [rsp + 0x18], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
nop
call fcn.0045ada0
lea rdx, [0x00656f9a]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x18]
jmp 0x448a18
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0045f280
jmp fcn.00448a00
Function at 0x44c560
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xc8]
cmp r12, qword [r14 + 0x10]
jbe 0x44c6a6
sub rsp, 0x148
mov qword [rsp + 0x140], rbp
lea rbp, [rsp + 0x140]
lea rdi, [rsp + 0x30]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004618ab
mov rbp, qword [rbp]
lea rcx, [0x006290a0]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rax, [rsp + 0x20]
call fcn.00445f40
mov rcx, qword [rax]
movzx edx, byte [rcx + 0x17]
nop word [rax + rax]
test dl, 0x40
jne 0x44c693
lea rdx, [0x00838340]
lea rax, [0x007ac980]
jmp 0x44c600
mov rax, qword [rax + 0x220]
test rax, rax
je 0x44c619
cmp qword [rax + 0x130], rdx
ja 0x44c5f9
cmp qword [rax + 0x100], rdx
jbe 0x44c5f9
jmp 0x44c620
xor eax, eax
nop dword [rax + rax]
test rax, rax
je 0x44c682
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rcx]
mov ebx, 8
call fcn.0044dbc0
neg eax
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx]
mov rsi, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
mov rdi, qword [rsp + 0x10]
sub rcx, qword [rdi + 0x128]
mov dword [0x00838340], eax
mov dword [0x00838344], edx
mov dword [0x00838348], esi
mov dword [0x0083834c], ecx
mov rbp, qword [rsp + 0x140]
add rsp, 0x148
ret
lea rax, [0x00654436]
mov ebx, 0x2b
call fcn.00436d80
lea rax, [0x00657c7c]
mov ebx, 0x3d
nop
call fcn.00436d80
nop
call fcn.0045f280
jmp fcn.0044c560
Function at 0x450a40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x450bc4
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movzx edx, byte [rbx + 0x17]
and edx, 0x1f
nop
cmp dl, 0xb
jbe 0x450ac0
cmp dl, 0x11
jbe 0x450a9a
cmp dl, 0x16
je 0x450ada
cmp dl, 0x19
jne 0x450a93
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x70], rbx
mov rdx, qword [rbx + 0x40]
mov qword [rsp + 0x40], rdx
xor esi, esi
jmp 0x450b65
cmp dl, 0x1a
je 0x450ada
jmp 0x450b06
cmp dl, 0xc
je 0x450ada
nop
cmp dl, 0x11
jne 0x450b06
cmp qword [rbx + 0x40], 1
jne 0x450b06
mov rbx, qword [rbx + 0x30]
call fcn.00450a40
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
cmp dl, 6
ja 0x450ad5
lea esi, [rdx - 1]
cmp sil, 4
jbe 0x450ada
cmp dl, 6
je 0x450af4
jmp 0x450b06
cmp dl, 0xa
ja 0x450aef
mov rbx, qword [rbx]
nop dword [rax]
call fcn.00450c00
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
cmp dl, 0xb
jne 0x450b06
mov rbx, qword [rbx]
call fcn.00450c00
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, rbx
call fcn.00458d40
mov ecx, 0x16
mov rdi, rax
mov rsi, rbx
lea r8, [0x006570a8]
mov r9d, 0x37
xor eax, eax
lea rbx, [0x0064b0c2]
call fcn.0044ca60
call fcn.0040a840
mov rbx, rax
lea rax, [0x005fe120]
call fcn.00436780
mov rdi, qword [rsp + 0x38]
lea rsi, [rdi + 1]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
cmp rsi, rdx
jge 0x450bb5
mov qword [rsp + 0x38], rsi
lea rax, [rsi + rsi*2]
shl rax, 3
add rax, qword [rbx + 0x38]
mov qword [rsp + 0x48], rax
call fcn.004598e0
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rcx + 8]
mov rcx, qword [rsp + 0x78]
lea rdx, [rcx + rax]
mov rax, qword [rsp + 0x50]
mov rcx, rdx
nop
call fcn.00450a40
test al, al
jne 0x450b48
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, 1
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00450a40
Function at 0x451100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x451208
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
cmp qword [rax + 8], 0
nop dword [rax]
jle 0x4511f6
cmp qword [rax + 0x10], 0
jl 0x4511e5
cmp dword [rax + 0x40], 0
jne 0x4511cf
mov qword [rsp + 0x40], rax
mov dword [rax + 0x40], 1
mov rcx, qword [rax + 8]
mov qword [rsp + 0x10], rcx
call fcn.00445ee0
mov qword [rsp + 0x20], rax
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
mov rax, rcx
call fcn.00445fe0
mov qword [rsp + 0x18], rax
test byte [rax], al
lea rcx, [rax + 0x2278]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.0040b060
mov rax, qword [rsp + 0x18]
call fcn.00451ba0
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x40]
nop dword [rax]
call fcn.00451220
mov rax, qword [rsp + 0x28]
call fcn.0040b280
mov rax, qword [rsp + 0x10]
call fcn.0043e6c0
mov rax, qword [rsp + 0x20]
nop
call fcn.00445f00
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0065291a]
mov ebx, 0x26
nop dword [rax + rax]
call fcn.00436d80
lea rax, [0x00650e58]
mov ebx, 0x21
call fcn.00436d80
lea rax, [0x0064df79]
mov ebx, 0x1b
call fcn.00436d80
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.00451100

Function at 0x451220
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x451359
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
cmp dword [0x00837fd8], 0
jne 0x45125a
call fcn.00430b80
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
cmp qword [rbx], 0
nop
jne 0x451347
mov rcx, rax
mov rax, rbx
mov rbx, rcx
call fcn.00446000
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
mov rdi, qword [rcx + 0x2288]
mov rbx, qword [rcx + 0x2280]
mov rdx, qword [rcx + 0x2290]
lea rsi, [rdi + 1]
cmp rdx, rsi
jb 0x45129e
mov rax, rdi
jmp 0x4512d6
mov qword [rsp + 0x40], rdi
lea rax, [0x005f9140]
mov rcx, rdi
mov rdi, rdx
call fcn.00448f20
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x2290], rcx
mov qword [rdx + 0x2280], rax
mov rcx, rdx
mov rdi, rbx
mov rbx, rax
mov rax, qword [rsp + 0x40]
lea rdx, [rdi + 1]
mov qword [rcx + 0x2288], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rbx + rdi*8], rdx
mov rsi, qword [rcx + 0x2280]
mov rbx, qword [rcx + 0x2288]
mov r8, qword [rcx + 0x2290]
mov rdi, rax
mov rax, rsi
mov rcx, r8
call fcn.00452cc0
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x2280]
mov r8, qword [rsp + 0x60]
nop
cmp qword [rsi], r8
jne 0x451330
mov rax, qword [r8 + 8]
xchg qword [rdx + 0x1208], rax
mov eax, 1
lock xadd dword [rdx + 0x2298], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x006512ce]
mov ebx, 0x22
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00451220
Function at 0x457c40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x457cfb
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00457d40]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045f140
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00457c40
Function at 0x458f80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4591c6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x458fa9
mov dword [rsp + 0x60], ebx
lea rcx, [0x007ac980]
jmp 0x458fc0
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x220]
nop dword [rax]
test rcx, rcx
je 0x458ff7
mov rdx, qword [rcx + 0x118]
cmp rax, rdx
jb 0x458fb5
mov rsi, qword [rcx + 0x120]
cmp rax, rsi
jae 0x458fb5
movsxd rcx, ebx
lea rax, [rdx + rcx]
cmp rsi, rax
jb 0x459136
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.00458f00
mov rbx, qword [0x007e09f0]
lea rax, [0x00608f20]
mov ecx, dword [rsp + 0x60]
call fcn.00410860
mov byte [rsp + 0x1f], bl
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
call fcn.00458f40
movzx eax, byte [rsp + 0x1f]
test al, al
jne 0x459096
call fcn.00438460
lea rax, [0x00648b11]
mov ebx, 0x11
call fcn.00438d00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438b80
lea rax, [0x00644aff]
mov ebx, 6
call fcn.00438d00
mov rax, qword [rsp + 0x20]
call fcn.00438b80
lea rax, [0x00647e83]
mov ebx, 0x10
nop
call fcn.00438d00
call fcn.004384e0
lea rax, [0x007ac980]
jmp 0x459120
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x40], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x28], rdx
call fcn.00438460
lea rax, [0x00645092]
mov ebx, 7
call fcn.00438d00
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00438b80
lea rax, [0x006451cf]
mov ebx, 8
call fcn.00438d00
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438b80
call fcn.004386a0
call fcn.004384e0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
nop dword [rax + rax]
test rax, rax
jne 0x4590a5
lea rax, [0x006552fc]
mov ebx, 0x2e
call fcn.00436d80
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
call fcn.00438460
lea rax, [0x00648b11]
mov ebx, 0x11
call fcn.00438d00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
nop dword [rax]
call fcn.00438b80
lea rax, [0x0064728e]
mov ebx, 0xe
call fcn.00438d00
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.00438b80
lea rax, [0x0064448a]
mov ebx, 3
call fcn.00438d00
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438b80
call fcn.004386a0
call fcn.004384e0
lea rax, [0x00650d50]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.00458f80
Function at 0x459240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4594c6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x45926e
nop dword [rax]
cmp ebx, 0xffffffff
je 0x45926e
lea rcx, [0x007ac980]
jmp 0x459281
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x220]
test rcx, rcx
je 0x45929a
cmp qword [rcx + 0x118], rax
ja 0x45927a
cmp qword [rcx + 0x120], rax
jbe 0x45927a
jmp 0x45929c
xor ecx, ecx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x459308
mov qword [rsp + 0x40], rcx
mov rdx, qword [rcx + 0x210]
lea rax, [0x00609580]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
nop
call fcn.00410600
mov rax, qword [rax]
test rax, rax
jne 0x4592fe
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x118]
mov ebx, dword [rsp + 0x60]
movsxd rsi, ebx
lea rax, [rdx + rsi]
mov rcx, qword [rcx + 0x120]
cmp rcx, rax
jb 0x45943b
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x18], rax
call fcn.00458f00
mov rbx, qword [0x007e09f0]
lea rax, [0x00608f20]
mov ecx, dword [rsp + 0x60]
call fcn.00410600
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
call fcn.00458f40
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
test rax, rax
jne 0x4593a7
call fcn.00438460
lea rax, [0x00648b55]
mov ebx, 0x11
call fcn.00438d00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438b80
lea rax, [0x00644aff]
mov ebx, 6
call fcn.00438d00
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.00438b80
lea rax, [0x00647e83]
mov ebx, 0x10
call fcn.00438d00
call fcn.004384e0
lea rax, [0x007ac980]
jmp 0x459425
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x20], rdx
call fcn.00438460
lea rax, [0x00645092]
mov ebx, 7
nop
call fcn.00438d00
mov rax, qword [rsp + 0x28]
call fcn.00438b80
lea rax, [0x006451cf]
mov ebx, 8
nop dword [rax + rax]
call fcn.00438d00
mov rax, qword [rsp + 0x20]
call fcn.00438b80
call fcn.004386a0
call fcn.004384e0
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x220]
test rax, rax
jne 0x4593b1
lea rax, [0x00655386]
mov ebx, 0x2e
call fcn.00436d80
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.00438460
lea rax, [0x00648b55]
mov ebx, 0x11
call fcn.00438d00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438b80
lea rax, [0x0064728e]
mov ebx, 0xe
call fcn.00438d00
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.00438b80
lea rax, [0x0064448a]
mov ebx, 3
call fcn.00438d00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438b80
call fcn.004386a0
call fcn.004384e0
lea rax, [0x00650d92]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.00459240
Function at 0x459540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4596fb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp ebx, 0xffffffff
je 0x459566
lea rcx, [0x007ac980]
jmp 0x459580
lea rax, [0x0040ad20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x220]
nop
test rcx, rcx
je 0x459599
cmp qword [rcx + 0x118], rax
ja 0x459577
cmp qword [rcx + 0x120], rax
jbe 0x459577
jmp 0x4595a0
xor ecx, ecx
nop dword [rax + rax]
test rcx, rcx
jne 0x459651
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x58], ebx
call fcn.00458f00
mov rbx, qword [0x007e09f0]
lea rax, [0x00608f20]
mov ecx, dword [rsp + 0x58]
call fcn.00410600
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
call fcn.00458f40
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x459647
call fcn.00438460
lea rax, [0x00648b44]
mov ebx, 0x11
call fcn.00438d00
mov eax, dword [rsp + 0x58]
movsxd rax, eax
call fcn.00438b80
lea rax, [0x00644aff]
mov ebx, 6
call fcn.00438d00
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.00438b80
lea rax, [0x00647e83]
mov ebx, 0x10
call fcn.00438d00
call fcn.004384e0
lea rax, [0x007ac980]
jmp 0x4596e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rcx
call fcn.0044eec0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x20], rdx
call fcn.00438460
lea rax, [0x00645092]
mov ebx, 7
call fcn.00438d00
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438b80
lea rax, [0x006451cf]
mov ebx, 8
call fcn.00438d00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438b80
call fcn.004386a0
call fcn.004384e0
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x220]
nop dword [rax + rax]
test rax, rax
jne 0x459663
lea rax, [0x00655358]
mov ebx, 0x2e
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.00459540