joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460000
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46022d
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
test byte [rax], al
lea rcx, [rax + 0x28]
mov qword [rsp + 0x28], rcx
nop
mov rax, rcx
call fcn.0040b7a0
mov rcx, qword [rsp + 0x40]
cmp byte [rcx + 0x30], 0
nop word [rax + rax]
jne 0x46021b
mov byte [rcx + 0x30], 1
inc qword [rcx + 0x38]
inc qword [rcx + 0x90]
nop
movzx edx, byte [rcx + 0x30]
nop
mov rbx, qword [rcx + 0x88]
mov rsi, qword [rcx + 0xe0]
mov edi, dword [rcx + 0x10]
mov r8d, edx
or edx, 4
test rbx, rbx
cmovl r8d, edx
mov edx, r8d
or r8d, 8
test rsi, rsi
cmovl edx, r8d
jmp 0x46008d
nop
mov edi, dword [rcx + 0x10]
mov eax, edi
and edi, 2
or edi, edx
lock cmpxchg dword [rcx + 0x10], edi
sete bl
nop dword [rax]
test bl, bl
je 0x460089
nop
mov rax, qword [rcx + 0x18]
cmp rax, 1
je 0x4600dd
test rax, rax
je 0x4600d7
mov qword [rsp + 0x10], rax
xor edx, edx
lock cmpxchg qword [rcx + 0x18], rdx
sete bl
test bl, bl
je 0x4600a4
mov rbx, qword [rsp + 0x10]
cmp rbx, 2
cmove rbx, rdx
jmp 0x4600e1
xor edx, edx
xor ebx, ebx
jmp 0x4600e1
xor edx, edx
xor ebx, ebx
nop
mov rax, qword [rcx + 0x20]
cmp rax, 1
je 0x460118
test rax, rax
je 0x460114
mov qword [rsp + 0x10], rax
lock cmpxchg qword [rcx + 0x20], rdx
sete sil
test sil, sil
je 0x4600e1
mov rsi, qword [rsp + 0x10]
cmp rsi, 2
cmove rsi, rdx
jmp 0x46011a
xor esi, esi
jmp 0x46011a
xor esi, esi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], rsi
cmp qword [rcx + 0x58], 0
je 0x460172
lea rax, [rcx + 0x40]
call fcn.00453140
cmp dword [0x0092b0b0], 0
jne 0x46014c
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x58], 0
jmp 0x460165
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 0x58]
mov rax, rdi
mov rdi, rcx
xor edx, edx
nop dword [rax]
call fcn.00465a20
mov rcx, rax
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
cmp qword [rcx + 0xb0], 0
je 0x4601b6
lea rax, [rcx + 0x98]
call fcn.00453140
cmp dword [0x0092b0b0], 0
jne 0x4601a3
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0xb0], 0
jmp 0x4601b6
mov rdi, qword [rsp + 0x40]
add rdi, 0xb0
xor ecx, ecx
call fcn.00465a00
nop
nop
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.0040b9c0
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x4601eb
nop
nop
mov ecx, 0xffffffff
lea rdx, [0x0092ac78]
lock xadd dword [rdx], ecx
mov ebx, 4
call fcn.00439820
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x460211
nop
nop
mov ecx, 0xffffffff
lea rdx, [0x0092ac78]
lock xadd dword [rdx], ecx
mov ebx, 4
call fcn.00439820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006d68a9]
mov ebx, 0x24
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00460000
Function at 0x460380
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x40]
nop dword [rax]
cmp qword [r14 + 0x70], rcx
jb 0x4605ec
mov qword [rsp + 0x10], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rax
mov qword [rcx + 0xb0], 0
call fcn.004413c0
test al, al
jne 0x460405
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], 0
cmp byte [0x008dcdf0], 0
je 0x46052f
mov rax, qword [rsp + 0x18]
jmp 0x4605a9
cmp byte [0x008cfb84], 0
je 0x46044a
movups xmmword [rsp + 0x20], xmm15
lea rax, [0x00441380]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00463600
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp byte [0x008dcdf0], 0
je 0x4604a2
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x18]
cmp rsi, rdi
jne 0x460478
mov edx, dword [rdx + 0x26c]
cmp dword [rsi + 0x14], edx
je 0x4604a7
lea rax, fcn.00456880
mov qword [rsp], rax
call fcn.00463600
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
nop
jmp 0x4604a7
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
nop
call fcn.0043b080
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rdx, qword [rax + 0x30]
dec dword [rdx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x4604ef
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x4604fd
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x008d76e0], 0
je 0x460525
mov ebx, 1
call fcn.0045aa80
test al, al
jne 0x460525
nop dword [rax + rax]
call fcn.00439640
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x006fab78]
call fcn.00463580
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006fadf8]
mov qword [rsp], rax
nop dword [rax]
call fcn.00463600
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, rcx
mov rcx, qword [rsp + 0x10]
test rax, rax
je 0x4605bd
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rax + 0x14]
cmp dword [rdx + 0x26c], ebx
je 0x460571
nop dword [rax]
call fcn.00465780
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], rax
jmp 0x46052f
lea rax, [0x006d977b]
mov ebx, 0x2d
call fcn.00436bc0
nop
int3
Function at 0x461580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46160b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp rax, 0x20
jne 0x4615a8
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 0x20], rax
call fcn.00438500
lea rax, [0x006d67ad]
mov ebx, 0x24
nop
call fcn.00438e00
mov rax, qword [rsp + 0x20]
call fcn.00438b00
lea rax, [0x006ca673]
mov ebx, 9
nop dword [rax + rax]
call fcn.00438e00
mov eax, 0x20
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006ce159]
mov ebx, 0x13
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.00461580
Function at 0x462340
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
cmp rcx, 4
jge 0x4623d0
lea rdx, [rsp + 0x38]
cmp rbx, rdx
je 0x4623c4
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
shl rcx, 3
mov rax, rdx
call fcn.00466740
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov edx, 4
lea rbx, [rsp + 0x38]
jmp 0x4623dd
cmp rcx, 0x2a
jg 0x46249f
mov rdx, rcx
mov rsi, qword [r14 + 0x30]
nop
inc dword [rsi + 0x23c]
mov rsi, qword [r14 + 0x30]
nop
mov rdi, r14
mov qword [rsi + 0x130], rdi
mov rsi, qword [r14 + 0x30]
mov qword [r14 + 0xe8], rsi
lea rsi, fcn.00442880
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x1f], 1
mov rsi, qword [r14 + 0x30]
mov qword [rsi + 0x2c0], rax
mov qword [rsi + 0x2c8], rcx
test rdx, rdx
jbe 0x462495
mov qword [rsp + 0x58], rsi
mov qword [rsi + 0x2d0], rbx
lea rbx, [rsi + 0x2c0]
mov rax, qword [0x008d4c10]
call fcn.00404520
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x2d8]
mov rsi, qword [rcx + 0x2e0]
mov rcx, qword [rcx + 0x2e8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
call fcn.00442880
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
mov rcx, rax
call fcn.00465da0
lea rax, [0x00679500]
lea rbx, [0x00742500]
call fcn.00436420
nop
call fcn.004358c0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
Function at 0x4657e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40348f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409de0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403460
cmp byte [0x0092ac21], 0
je 0x4657f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x462840
jmp 0x403460

Function at 0x465800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0092b180]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0092ac21], 0
je 0x465835
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0092b500]
aesenc xmm0, xmmword [0x0092b510]
aesenc xmm0, xmmword [0x0092b520]
movq rax, xmm0
ret
jmp 0x409fe0

Function at 0x465840
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0092b180]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0092ac21], 0
je 0x465876
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0092b500]
aesenc xmm0, xmmword [0x0092b510]
aesenc xmm0, xmmword [0x0092b520]
movq rax, xmm0
ret
jmp 0x40a040

Function at 0x467280
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0092b480]
mov qword [rsp + 8], rdx
lea r8d, [0x0092ac44]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00465720
add rsp, 0x30
ret

Function at 0x4677c0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4677f0
mov rcx, 0x28
jmp 0x4677fb
shl rcx, 3
add rcx, 0x1480
mov qword [0x0092ae40], rcx
ret
Function at 0x467d80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4322d4
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
cmp dword [0x0092b0b0], 0
nop
jne 0x432192
lea rdx, [0x00467200]
mov qword [0x008d4c10], rdx
jmp 0x4321a5
lea rdi, [0x008d4c10]
lea rdx, [0x00467200]
call fcn.00465a20
xor eax, eax
jmp 0x4321c0
lea r8, [0x0092b480]
mov byte [r8 + rax], sil
inc dword [0x0092ac44]
mov rax, rdi
nop dword [rax]
cmp rax, 0x36
jge 0x432210
lea rdx, [0x006dbe3b]
movzx esi, byte [rdx + rax]
cmp esi, 0x80
jge 0x4321df
lea rdi, [rax + 1]
jmp 0x432205
mov qword [rsp + 0x20], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
call fcn.0045d080
lea rdx, [0x006dbe3b]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x20]
cmp rax, 0x64
jb 0x4321a9
jmp 0x4322c9
call fcn.00431380
call fcn.00449ba0
call fcn.00449c40
nop
call fcn.00431e00
xor eax, eax
call fcn.00431d40
mov dword [0x0092ac90], eax
call fcn.00431ec0
call fcn.00431c20
mov dword [0x0092ac70], eax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [sym.imp.kernel32.dll_GetSystemInfo]
lea rcx, [rsp + 0x28]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433cc0
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x2c]
mov qword [0x0092adc8], rax
mov rax, qword [sym.imp.kernel32.dll_SetProcessPriorityBoost]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 1
call fcn.00433d40
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov ecx, 0x64
call fcn.00465da0
nop
call fcn.00463740
jmp 0x432160
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x432160
Function at 0x4681c0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x006dafe5]
mov ebx, 0x32
call fcn.00436bc0
nop
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x461680

Function at 0x46b600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b6f9
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x46b6e5
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
test rcx, rcx
je 0x46b647
lea rdx, [0x0092ac28]
nop
cmp rcx, rdx
je 0x46b630
jmp 0x46b677
call fcn.00460640
mov rax, qword [rsp + 0x28]
xor ebx, ebx
lea rcx, [0x0092ac28]
call fcn.0045e880
nop
test al, al
jne 0x46b696
call fcn.00460660
mov rax, qword [rsp + 0x28]
lea rdx, [0x0092ac28]
jmp 0x46b630
cmp qword [rsp + 0x30], rcx
jne 0x46b6cf
add rax, 8
mov rbx, qword [rsp + 0x38]
call fcn.0045e7c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 8]
mov rbx, qword [rsp + 0x38]
mov rax, rcx
call fcn.0045e7c0
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
call fcn.0045e7c0
nop dword [rax + rax]
call fcn.00460660
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00679500]
lea rbx, [0x00742700]
nop dword [rax]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x007426f0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.0046b600
Function at 0x46ca40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46cb86
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x46cac8
cmp rcx, 0x11
je 0x46caba
nop dword [rax]
cmp rcx, 0x12
jne 0x46cb28
cmp qword [rax], 8
jne 0x46cb71
cmp qword [rax + 8], 0
je 0x46cb71
bt edx, 7
jae 0x46caa8
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045e900
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x15
jne 0x46cb00
cmp qword [rax], 8
jne 0x46cb5e
cmp qword [rax + 8], 0
je 0x46cb5e
bt edx, 7
jae 0x46cae8
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045f100
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
je 0x46cb1a
cmp rcx, 0x18
jne 0x46cb28
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006989e0]
call fcn.0040d960
mov qword [rax + 8], 0x11
lea rcx, [0x006cd4c9]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00682980]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00742240]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00742240]
nop
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046ca40

Function at 0x46fe40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ff26
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, rbx
shl rbx, 0x20
mov rsi, rbx
lock xadd qword [rax], rbx
add rsi, rbx
mov rdi, rsi
shr rsi, 0x20
test esi, esi
jl 0x46ff0e
test edi, edi
je 0x46fe91
nop dword [rax]
test rdx, rdx
jle 0x46fe8d
cmp edx, esi
je 0x46fefb
test esi, esi
jmp 0x46fe93
test esi, esi
jmp 0x46fe93
test esi, esi
jg 0x46feb1
test edi, edi
je 0x46feb1
mov rdx, qword [rax]
nop dword [rax]
cmp rdx, rdi
jne 0x46fee8
mov qword [rsp + 0x30], rax
xor edx, edx
xchg qword [rax], rdx
jmp 0x46feda
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edi
lea rdx, [rax + 8]
xor ebx, ebx
xor ecx, ecx
mov rax, rdx
call fcn.00460f60
mov edi, dword [rsp + 0x1c]
dec edi
mov rax, qword [rsp + 0x30]
test edi, edi
jne 0x46febb
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00679500]
lea rbx, [0x007426d0]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x007426d0]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x007426c0]
nop dword [rax]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0046fe40
Function at 0x46ffc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470040
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
jmp 0x46ffd9
mov rax, rbx
mov rcx, qword [rax]
mov rdx, rcx
shr rcx, 0x20
test ecx, ecx
je 0x470022
lea rcx, [rdx + 1]
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x46ffd6
mov qword [rsp + 0x10], rbx
lea rax, [rbx + 8]
call fcn.00460ea0
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
test rcx, rcx
jne 0x47002c
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00679500]
lea rbx, [0x007426e0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.0046ffc0
Function at 0x47f9a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47fc12
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rdi, rdi
jl 0x47fbfe
cmp rdi, 9
jg 0x47fbeb
test ebx, ebx
jne 0x47f9e6
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov edx, ebx
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
bsr rdx, rdx
cmp rdx, 0x19
jge 0x47fa1b
lea rsi, [rdx - 0x19]
neg rsi
cmp rsi, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rsi
shl ebx, cl
and ebx, r8d
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x19]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x48], rax
imul rdx, rcx, 0x13441
add rdx, 0x1ce618
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x30], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x1b
jg 0x47fa52
test rdx, rdx
setge r8b
jmp 0x47fa55
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x23], r8b
mov dword [rsp + 0x24], ebx
mov eax, ebx
mov rbx, rcx
mov rcx, rdx
call fcn.00480c20
test rbx, rbx
jge 0x47fbd8
mov rdx, qword [rsp + 0x30]
lea r8, [rdx + 9]
cmp r8, 0xa
jae 0x47faa8
mov r8d, dword [rsp + 0x24]
mov r8d, r8d
test r8, r8
je 0x47fb8b
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x47fba5
movzx esi, byte [rsp + 0x23]
mov r8, rbx
neg rbx
cmp rbx, 0x20
sbb r9d, r9d
mov edi, ecx
mov rcx, rbx
mov r10d, 1
shl r10d, cl
and r10d, r9d
dec r10d
mov r11d, eax
shr eax, cl
and eax, r9d
and r10d, r11d
test sil, sil
je 0x47fb27
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r9d, 1
shl r9d, cl
and r9d, r8d
cmp r9d, r10d
jb 0x47fb16
jne 0x47fb1d
nop
test dil, dil
je 0x47fb16
cmp r9d, r10d
jne 0x47fb1d
test dil, dil
je 0x47fb1d
mov ebx, eax
and eax, 1
jmp 0x47fb21
mov ecx, 1
jmp 0x47fb48
mov ebx, eax
xor eax, eax
mov ecx, eax
mov eax, ebx
jmp 0x47fb48
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r9d, r10d
shr r10d, cl
and r10d, r8d
cmp r10d, 1
sete cl
mov r10d, r9d
test r10d, r10d
je 0x47fb4f
xor edi, edi
xor edi, 1
mov ebx, eax
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.0047ff00
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x30]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov esi, 1
mov ecx, 1
jmp 0x47faad
inc rsi
mov eax, edi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x47fb8b
mov edi, eax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x47fb9a
mov eax, edi
mov rdx, r10
movzx esi, byte [rsp + 0x23]
jmp 0x47faad
lea rax, [0x00679500]
lea rbx, [0x00742640]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00742630]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00742620]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0047f9a0
Function at 0x47fc60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47fec6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
nop dword [rax + rax]
cmp rdi, 0x12
jg 0x47feb2
test rbx, rbx
jne 0x47fc9e
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
cmp rsi, 0x37
jge 0x47fcd9
lea rsi, [rdx - 0x36]
neg rsi
cmp rsi, 0x40
sbb r8, r8
mov r9, rcx
mov rcx, rsi
shl rbx, cl
and rbx, r8
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x36]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
imul rdx, rcx, 0x13441
add rdx, 0x4105b6
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x38], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x37
jg 0x47fd10
test rdx, rdx
setge r8b
jmp 0x47fd13
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x27], r8b
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.00480d00
test rbx, rbx
jge 0x47fe9f
mov rdx, qword [rsp + 0x38]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x47fd65
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x47fe4f
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x47fe6a
movzx esi, byte [rsp + 0x27]
mov r8, rbx
neg rbx
cmp rbx, 0x40
sbb r9, r9
mov edi, ecx
mov rcx, rbx
mov r10d, 1
shl r10, cl
and r10, r9
dec r10
mov r11, rax
shr rax, cl
and rax, r9
and r10, r11
test sil, sil
je 0x47fdea
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x40
sbb r8, r8
mov r9d, 1
shl r9, cl
and r9, r8
cmp r9, r10
jb 0x47fdd7
jne 0x47fdde
nop dword [rax]
test dil, dil
je 0x47fdd7
cmp r9, r10
jne 0x47fdde
test dil, dil
je 0x47fdde
mov rbx, rax
and eax, 1
jmp 0x47fde3
mov ecx, 1
jmp 0x47fe0b
mov rbx, rax
xor eax, eax
mov ecx, eax
mov rax, rbx
jmp 0x47fe0b
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x40
sbb r8, r8
mov r9, r10
shr r10, cl
and r10, r8
cmp r10, 1
sete cl
mov r10, r9
test r10, r10
je 0x47fe12
xor edi, edi
xor edi, 1
mov rbx, rax
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x50]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.0047ff00
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x38]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov esi, 1
mov ecx, 1
jmp 0x47fd6a
inc rsi
mov rax, rdi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x47fe4f
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x47fe5e
mov rax, rdi
mov rdx, r10
movzx esi, byte [rsp + 0x27]
jmp 0x47fd6a
lea rax, [0x00679500]
lea rbx, [0x00742660]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00742650]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0047fc60