joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f760
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x43f8a6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x10], rcx
call fcn.0043ef20
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
setne byte [rax + 0x118]
nop
mov qword [rax + 0xa8], rcx
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
test rcx, rcx
je 0x43f7fc
mov rcx, qword [rcx + 0x30]
nop
test rcx, rcx
je 0x43f7fc
mov qword [rsp + 0x20], rax
cmp dword [rcx + 0x240], 0
jne 0x43f80f
cmp byte [rcx + 0xe8], 0
jne 0x43f80f
mov qword [rsp], rax
call fcn.0043f8c0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
nop
nop
lea rax, [0x008115c0]
mov qword [rsp], rax
nop dword [rax]
call fcn.0040bfe0
cmp dword [0x008115e0], 0
je 0x43f888
mov rax, qword [0x008115c8]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x130], rax
nop
mov qword [0x008115c8], rcx
cmp byte [0x008115d0], 0
jne 0x43f86f
nop
nop
lea rax, [0x008115c0]
mov qword [rsp], rax
nop
call fcn.0040c240
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov byte [0x008115d0], 0
lea rax, [0x008115d8]
mov qword [rsp], rax
call fcn.0040c340
jmp 0x43f852
lea rax, [0x006665e2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
nop dword [rax]
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0043f760

Function at 0x43fb20
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov ecx, dword [rcx + 0x288]
test ecx, ecx
je 0x43fbe5
mov qword [rsp + 0x18], rax
mov rcx, qword [rax + 0x30]
test byte [rcx], al
add rcx, 0x280
nop
mov qword [rsp], rcx
call fcn.0040bfe0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0x290]
mov qword [rsp + 0x10], rdx
test rdx, rdx
je 0x43fbb8
cmp dword [0x00811120], 0
jne 0x43fbf4
mov rax, qword [rdx]
mov byte [rsp], 0
call rax
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x30]
mov qword [rcx + 0x290], 0
mov rcx, qword [rax + 0x30]
xor ebx, ebx
xchg dword [rcx + 0x288], ebx
mov rax, qword [rax + 0x30]
test byte [rax], al
add rax, 0x280
nop
mov qword [rsp], rax
call fcn.0040c240
mov rax, qword [rsp + 0x10]
test rax, rax
setne byte [rsp + 0x30]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov byte [rsp + 0x30], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667e05]
mov qword [rsp], rax
mov qword [rsp + 8], 0x33
call fcn.00439220
nop
int3
Function at 0x440620
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4408e6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0x138]
test rdx, rdx
je 0x4408c9
mov rdx, qword [rdx + 0xd8]
cmp rcx, rdx
jne 0x4408c9
mov qword [rsp + 0x30], rax
cmp qword [rcx + 0xa0], 0
jne 0x4406ef
mov dword [rsp], 1
call fcn.00446620
call fcn.0043e780
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x138]
mov ecx, dword [rcx + 0x90]
mov edx, ecx
btr ecx, 0xc
cmp ecx, 1
jne 0x4406fb
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0xa8]
mov qword [rsp], rcx
call fcn.00446280
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rax + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00446460
call fcn.00440240
jmp 0x44068b
mov dword [rsp + 0x1c], edx
nop
call fcn.0043aa00
lea rax, [0x006669b6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0043b480
mov eax, dword [rsp + 0x1c]
mov eax, eax
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x006649dc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0043b480
call fcn.0043aaa0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x138]
mov qword [rsp + 0x38], rax
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rax + 0x90]
mov dword [rsp + 0x14], edx
mov rbx, qword [rax + 0x98]
mov qword [rsp + 0x20], rbx
call fcn.0043aa00
lea rax, [0x0065d50b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0043b480
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0043b3c0
lea rax, [0x0065ab68]
mov qword [rsp], rax
mov qword [rsp + 8], 7
call fcn.0043b480
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0043b220
lea rax, [0x0065e028]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.0043b480
mov eax, dword [rsp + 0x14]
mov eax, eax
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.0043aa00
lea rax, [0x0065d4db]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0043b480
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0043b3c0
lea rax, [0x0065ab68]
mov qword [rsp], rax
mov qword [rsp + 8], 7
call fcn.0043b480
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0043b220
lea rax, [0x0065e015]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.0043b480
mov eax, dword [rsp + 0x18]
mov eax, eax
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x00660ef1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.00439220
lea rax, [0x00663e93]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
nop dword [rax]
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00440620
Function at 0x442040
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4420e6
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
cmp byte [rax + 0xe4], 0
je 0x4420cc
mov byte [rax + 0xe4], 0
mov eax, 0xffffffff
lea rcx, [0x007cdb5c]
lock xadd dword [rcx], eax
dec eax
nop
test eax, eax
jl 0x4420b3
call fcn.00440580
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00663b7b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
lea rax, [0x006631bc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00442040
Function at 0x444de0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x444f4f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
cmp ecx, 6
jne 0x444f35
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
mov rbx, rcx
sub rcx, rdx
cmp rcx, 0x2000
jne 0x444f0f
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0xe00]
mov qword [rax + 0xa0], rdx
nop
mov qword [rcx + 0xe00], rax
mov eax, dword [rcx + 0xe08]
inc eax
mov dword [rcx + 0xe08], eax
nop
cmp eax, 0x40
jl 0x444f05
nop
lea rax, [0x007cdb98]
mov qword [rsp], rax
call fcn.0040bfe0
mov rax, qword [rsp + 0x20]
nop
jmp 0x444e88
inc dword [0x007cdbb0]
mov ecx, dword [rax + 0xe08]
cmp ecx, 0x20
jl 0x444eee
dec ecx
mov dword [rax + 0xe08], ecx
nop
mov rcx, qword [rax + 0xe00]
test rcx, rcx
je 0x444eb6
mov rdx, qword [rcx + 0xa0]
mov qword [rax + 0xe00], rdx
cmp qword [rcx], 0
jne 0x444ed5
nop
mov rdx, qword [0x007cdba8]
mov qword [rcx + 0xa0], rdx
nop
mov qword [0x007cdba8], rcx
jmp 0x444e82
nop
mov rdx, qword [0x007cdba0]
mov qword [rcx + 0xa0], rdx
nop
mov qword [0x007cdba0], rcx
jmp 0x444e82
nop
nop
lea rax, [0x007cdb98]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.0040c240
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
call fcn.0044f100
xorps xmm0, xmm0
mov rax, qword [rsp + 0x28]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
jmp 0x444e36
lea rax, [0x006624a4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00444de0

Function at 0x4451c0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov eax, dword [0x008115e0]
test eax, eax
je 0x445238
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
inc dword [rcx + 0x240]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax + 0x240]
nop dword [rax]
test ecx, ecx
je 0x44523f
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
nop
mov rdx, rax
mov qword [rcx + 0x138], rax
mov rax, qword [rdx + 0x30]
mov qword [rdx + 0xd8], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.0043fa00
jmp 0x4451d8
dec ecx
mov dword [rax + 0x240], ecx
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1850]
mov qword [rsp + 8], rax
nop
call fcn.00438920
nop
int3
Function at 0x4484c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4485cf
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0x5f0]
mov edx, dword [rax + 0x5f4]
mov rbx, qword [rax + 0xdf8]
mov esi, dword [rax + 0x5f4]
cmp edx, esi
jne 0x4484ed
cmp ecx, edx
jne 0x4485b5
test rbx, rbx
jne 0x4485b5
mov qword [rsp], rax
nop
call fcn.004483c0
mov rax, qword [0x007cd648]
mov rcx, qword [0x007cd640]
mov rdx, qword [rsp + 0x20]
mov ebx, dword [rdx]
mov esi, ebx
sar ebx, 0x1f
shr ebx, 0x1b
add ebx, esi
sar ebx, 5
mov edi, ebx
shl ebx, 5
sub esi, ebx
test esi, esi
jl 0x4485b0
cmp esi, 0x20
sbb ebx, ebx
mov r8, rcx
mov ecx, esi
mov r9d, 1
shl r9d, cl
and r9d, ebx
movsxd rbx, edi
cmp rax, rbx
jbe 0x4485a5
lea rax, [r8 + rbx*4]
lock or dword [rax], r9d
mov rax, qword [0x007cdb50]
mov qword [rdx + 8], rax
nop
mov qword [0x007cdb50], rdx
mov eax, 1
lea rcx, [0x007cdb58]
lock xadd dword [rcx], eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov rax, rbx
call fcn.0046cdc0
call fcn.00436da0
lea rax, [0x00664765]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.004484c0
Function at 0x448820
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x3b8]
nop dword [rax + rax]
cmp rax, qword [rcx + 0x10]
jbe 0x448a26
sub rsp, 0x438
mov qword [rsp + 0x430], rbp
lea rbp, [rsp + 0x430]
mov qword [rsp + 0x28], 0
lea rdi, [rsp + 0x30]
xorps xmm0, xmm0
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046cf40
mov rbp, qword [rbp]
mov edx, dword [rsp + 0x454]
mov eax, dword [rsp + 0x450]
sub edx, eax
shr edx, 1
cmp edx, 0x80
jne 0x448a09
mov rbx, qword [rsp + 0x440]
xor ecx, ecx
jmp 0x4488d5
test byte [rbx], al
lea esi, [rcx + rax]
movzx esi, sil
mov rsi, qword [rbx + rsi*8 + 0x5f8]
mov qword [rsp + rcx*8 + 0x28], rsi
inc ecx
cmp ecx, edx
jb 0x4488bd
lea esi, [rdx + rax]
lock cmpxchg dword [rbx + 0x5f0], esi
sete bl
test bl, bl
je 0x4489e7
mov rbx, qword [rsp + 0x448]
mov qword [rsp + rdx*8 + 0x28], rbx
xor eax, eax
nop
jmp 0x44890e
mov rsi, qword [rsp + rax*8 + 0x28]
mov qword [rbx + 0xa0], rsi
cmp edx, eax
jbe 0x44892d
mov rbx, qword [rsp + rax*8 + 0x28]
test byte [rbx], al
inc eax
nop dword [rax + rax]
cmp rax, 0x81
jb 0x448902
jmp 0x4489ff
mov dword [rsp + 0x14], edx
movups xmmword [rsp + 0x18], xmm0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + rdx*8 + 0x28]
mov qword [rsp + 0x20], rax
nop
nop
lea rax, [0x007cdb18]
mov qword [rsp], rax
call fcn.0040bfe0
nop
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
test rax, rax
jne 0x4489b4
mov eax, dword [0x007cdb70]
mov ecx, dword [rsp + 0x14]
lea eax, [rax + rcx]
lea eax, [rax + 1]
mov dword [0x007cdb70], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
nop
nop
lea rax, [0x007cdb18]
mov qword [rsp], rax
call fcn.0040c240
mov byte [rsp + 0x458], 1
mov rbp, qword [rsp + 0x430]
add rsp, 0x438
ret
mov rdx, rax
mov qword [rax + 0xa0], 0
mov rax, qword [0x007cdb68]
test rax, rax
je 0x4489de
mov qword [rax + 0xa0], rcx
mov qword [0x007cdb68], rdx
jmp 0x44896c
mov qword [0x007cdb60], rcx
jmp 0x4489d5
mov byte [rsp + 0x458], 0
mov rbp, qword [rsp + 0x430]
add rsp, 0x438
ret
mov ecx, 0x81
call fcn.0046cdc0
lea rax, [0x00662cd2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
nop dword [rax]
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00448820
Function at 0x44d880
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44d931
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
xor eax, eax
jmp 0x44d8c0
lea rdi, [0x00811740]
mov byte [rdi + rax], bl
inc dword [0x008110f8]
mov rax, rsi
nop
cmp rax, 0x36
jge 0x44d91c
lea rdx, [0x00668502]
movzx ebx, byte [rdx + rax]
cmp ebx, 0x80
jge 0x44d8e8
lea rsi, [rax + 1]
nop dword [rax]
cmp rax, 0x64
jb 0x44d8ac
jmp 0x44d926
mov qword [rsp + 0x28], rax
mov qword [rsp], rdx
mov qword [rsp + 8], 0x36
mov qword [rsp + 0x10], rax
nop
call fcn.00460d00
mov ebx, dword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
lea rdx, [0x00668502]
jmp 0x44d8e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov ecx, 0x64
call fcn.0046cdc0
nop
call fcn.0046abe0
jmp fcn.0044d880

Function at 0x44e860
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44ea00
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop
mov rdx, qword [rsp + 0x30]
movabs rbx, 0x800000000000
lea rax, [rbx + rdx]
mov rbx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x44e9f2
lea rsi, [0x007f2f78]
mov rsi, qword [rsi + rax*8]
shr rbx, 0x16
and rbx, 0xfffff
mov rbx, qword [rsi + rbx*8]
mov rdi, rdx
shr rdx, 0xd
and rdx, 0x1ff
mov rdx, qword [rbx + rdx*8 + 0x20000]
test byte [rsi], al
test byte [rbx], al
mov bl, byte [rdx + 0x63]
cmp bl, 2
jne 0x44e9d9
mov qword [rsp + 0x18], rdx
mov rbx, qword [rdx + 0x28]
test rbx, rbx
je 0x44e989
mov rbx, rdi
mov rsi, qword [rdx + 0x28]
mov qword [rdi], rsi
mov qword [rdx + 0x28], rbx
movzx ebx, word [rdx + 0x60]
lea esi, [rbx - 1]
mov word [rdx + 0x60], si
cmp dword [0x00811120], 0
nop
jne 0x44e97f
cmp bx, 1
jne 0x44e97f
movzx eax, byte [rsp + 0x38]
cmp rax, 2
jae 0x44e9c5
shl rax, 6
lea rcx, [0x00811840]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
call fcn.00429d40
mov rax, qword [rsp + 0x18]
mov qword [rax + 0x28], 0
lea rcx, [0x007e2de0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], 1
call fcn.004298a0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
movzx eax, byte [rsp + 0x38]
cmp rax, 2
jae 0x44e9cf
shl rax, 6
lea rbx, [0x00811840]
lea rax, [rbx + rax]
lea rax, [rax + 8]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
call fcn.00429ee0
mov rdx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x30]
nop
jmp 0x44e8ff
mov ecx, 2
call fcn.0046cdc0
mov ecx, 2
call fcn.0046cdc0
lea rax, [0x00663b9c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
mov ecx, 0x40
call fcn.0046cde0
nop
nop dword [rax]
call fcn.0046abe0
jmp fcn.0044e860
Function at 0x44f4a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44f689
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx]
mov rbx, qword [rcx + 8]
mov rsi, qword [rcx + 0x10]
mov rdi, qword [rsp + 0x58]
movsxd r8, dword [rdi]
mov r9, qword [rsp + 0x50]
mov r10, r9
mov rcx, qword [rcx + 0x118]
mov r11, qword [rsp + 0x68]
xor eax, eax
jmp 0x44f572
mov rdi, qword [rsp + 0x58]
mov rax, qword [r10 + r14*8]
test r11, r11
je 0x44f520
lea rdi, [rax - 1]
cmp rdi, 0xfff
jae 0x44f520
cmp dword [0x00811700], 0
jne 0x44f592
nop dword [rax]
cmp rdx, rax
ja 0x44f545
cmp rbx, rax
jbe 0x44f545
cmp rcx, r9
jbe 0x44f563
mov rdi, rax
add rdi, rsi
lock cmpxchg qword [r15], rdi
sete dil
nop
test dil, dil
je 0x44f4f8
mov rdi, qword [rsp + 0x58]
test r13b, r13b
je 0x44f56d
bsf r14d, r13d
lea r15d, [r13 - 1]
and r13d, r15d
add r14, r12
lea r15, [r10 + r14*8]
jmp 0x44f4fd
lea rdi, [rax + rsi]
mov qword [r10 + r14*8], rdi
jmp 0x44f545
lea rax, [r12 + 8]
cmp r8, rax
jbe 0x44f588
mov r12, rax
shr rax, 3
add rax, qword [rdi + 8]
movzx r13d, byte [rax]
jmp 0x44f54a
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x20], rax
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xf9], 2
mov qword [rsp], r11
mov rax, qword [rsp + 0x70]
mov qword [rsp + 8], rax
call fcn.004550e0
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x28], rcx
nop
call fcn.0043aa00
lea rax, [0x00662d0e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0043b480
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
call fcn.0043b480
lea rax, [0x0065a4f7]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0043b480
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0043b3c0
lea rax, [0x0065a2e6]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0043b480
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
nop
call fcn.0043b2a0
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x00662c1e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0044f4a0
Function at 0x451b60
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x10]
cmp rax, qword [rcx + 0x10]
jbe 0x451e53
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov rcx, qword [rsp + 0xa8]
nop
test rcx, rcx
jle 0x451e0a
mov rdx, qword [rsp + 0xa0]
mov rax, rdx
xor ebx, ebx
xor esi, esi
xor edi, edi
xor r8d, r8d
jmp 0x451bc3
add rdx, 0x10
mov r9, qword [rdx + 8]
test r9, r9
jne 0x451df3
inc rbx
cmp rcx, rbx
jg 0x451bbf
nop dword [rax + rax]
test rsi, rsi
je 0x451dd8
cmp rsi, 1
jne 0x451dc9
mov rdx, qword [rsp + 0x98]
nop dword [rax + rax]
test rdx, rdx
je 0x451d6c
mov ebx, 1
test bl, bl
jne 0x451d36
mov qword [rsp], rdx
mov qword [rsp + 8], r8
nop
call fcn.00452160
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0xa8]
test rdi, rdi
jle 0x451cad
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x60], rbx
mov r8, qword [rsp + 0xa0]
xor r9d, r9d
jmp 0x451c6f
add r8, 0x10
mov rcx, r11
mov rax, rdx
mov rdx, r12
mov r10, qword [r8 + 8]
cmp rcx, r10
mov r11, rcx
cmovg rcx, r10
mov r12, qword [r8]
cmp rax, r12
jne 0x451ccd
cmp r11, r10
jb 0x451e1e
inc r9
sub rdx, r10
sub r11, r10
mov r12, rdx
neg rdx
sar rdx, 0x3f
and r10, rdx
lea rdx, [rax + r10]
cmp rdi, r9
jg 0x451c62
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rsi
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x38], r10
mov qword [rsp], rax
mov qword [rsp + 8], r12
mov qword [rsp + 0x10], rcx
call fcn.0046d6c0
mov r11, qword [rsp + 0x50]
mov r10, qword [rsp + 0x38]
cmp r11, r10
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x58]
jmp 0x451c88
cmp rcx, rdi
jbe 0x451e29
shl rdi, 4
mov rcx, qword [rax + rdi]
mov rax, qword [rax + rdi + 8]
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
cmp rcx, rdi
jbe 0x451e31
mov rbx, rdi
shl rdi, 4
mov rsi, qword [rax + rdi]
mov rdi, qword [rax + rdi + 8]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov rsi, qword [rsp + 0x78]
mov rdi, qword gs:[0x28]
mov rdi, qword [rdi]
mov r9, qword [rdi + 8]
cmp qword [rdi], rsi
ja 0x451dc5
cmp rsi, r9
setb sil
xor esi, 1
mov rdi, rbx
mov ebx, esi
nop
jmp 0x451c0e
xor esi, esi
jmp 0x451db7
mov rdx, qword [rsp + 0x98]
xor ebx, ebx
jmp 0x451c0e
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rdi, [r8 + r9]
cmp rdi, r8
jl 0x451e39
inc rsi
mov r8, rdi
mov rdi, rbx
jmp 0x451bd0
mov rax, qword [rsp + 0xa0]
xor esi, esi
xor edi, edi
xor r8d, r8d
jmp 0x451be0
mov rax, r10
mov rcx, r11
call fcn.0046ce80
mov rax, rdi
call fcn.0046cdc0
mov rax, rdi
call fcn.0046cdc0
lea rax, [0x0066280a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00451b60
Function at 0x4548a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x454a8b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
lea rax, [0x007ab560]
jmp 0x4548e0
mov rax, qword [rax + 0x210]
nop dword [rax]
test rax, rax
je 0x454a31
cmp qword [rax + 0xa0], rdx
ja 0x4548d6
cmp qword [rax + 0xa8], rdx
jbe 0x4548d6
nop dword [rax + rax]
test rax, rax
je 0x454a1f
mov rbx, qword [rax + 0xa0]
mov rsi, rdx
sub rdx, rbx
mov rbx, rdx
shr rdx, 0xc
lea rdx, [rdx + rdx*4]
shl rdx, 2
add rdx, qword [rax + 0x98]
and rbx, 0xfff
shr rbx, 8
mov edi, dword [rdx]
nop dword [rax]
cmp rbx, 0x10
jae 0x454a7d
movzx edx, byte [rdx + rbx + 4]
add edx, edi
mov rcx, qword [rax + 0x88]
mov rbx, qword [rax + 0x80]
nop
cmp edx, ecx
jb 0x454968
lea rdx, [rcx - 1]
mov edi, edx
cmp rdi, rcx
jae 0x454a75
shl rdi, 4
mov rdi, qword [rbx + rdi]
nop dword [rax + rax]
cmp rdi, rsi
ja 0x454989
jmp 0x454a05
dec edx
mov edi, edx
cmp rcx, rdi
jbe 0x454a6d
shl rdi, 4
mov rdi, qword [rbx + rdi]
nop dword [rax]
cmp rdi, rsi
jbe 0x4549a9
test edx, edx
ja 0x454987
test edx, edx
je 0x454a54
mov edx, edx
cmp rcx, rdx
jbe 0x454a45
shl rdx, 4
mov rdx, qword [rbx + rdx + 8]
cmp rdx, 0xffffffffffffffff
je 0x4549f0
mov rcx, qword [rax + 0x70]
mov rbx, qword [rax + 0x68]
cmp rcx, rdx
jbe 0x454a38
lea rcx, [rbx + rdx]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov edx, r8d
lea edi, [rdx + 1]
cmp rcx, rdi
jbe 0x454a4d
mov r8d, edi
shl rdi, 4
mov rdi, qword [rdi + rbx]
cmp rdi, rsi
jbe 0x454a02
jmp 0x4549b1
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
jmp 0x454900
mov rax, rdx
nop dword [rax + rax]
call fcn.0046cde0
mov rax, rdx
call fcn.0046cdc0
mov eax, edi
call fcn.0046cdc0
lea rax, [0x0066464d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.00439220
mov rax, rdi
call fcn.0046cdc0
mov rax, rdi
call fcn.0046cdc0
mov rax, rbx
mov ecx, 0x10
call fcn.0046cde0
nop
call fcn.0046abe0
jmp fcn.004548a0