joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ab00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49ace6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x98]
mov rdx, qword [rsp + 0x38]
mov qword [rsp], rdx
call rcx
cmp qword [rsp + 8], 0x17
jne 0x49acc8
mov rax, qword [rsp + 0x40]
test rax, rax
jl 0x49acac
mov rcx, qword [rsp + 0x48]
nop
test rcx, rcx
jl 0x49ac90
cmp rax, rcx
jg 0x49ac74
lea rax, [0x00636560]
mov qword [rsp], rax
nop dword [rax]
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x48]
mov rdx, qword [rsp + 0x38]
mov qword [rsp], rdx
call rcx
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
lea rdx, [0x006a9ea0]
cmp rax, rdx
jne 0x49ac53
mov qword [rsp], rcx
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.00465980
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x18]
mov qword [rdi + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rdi + 0x10], rcx
cmp dword [0x00811460], 0
jne 0x49ac2b
mov qword [rdi], rax
lea rax, [0x006a9ea0]
mov rcx, qword [rsp + 0x30]
cmp rax, rcx
jne 0x49ac32
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 0x97
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0046c920
jmp 0x49abf8
mov qword [rsp], rcx
lea rax, [0x00654ca0]
mov qword [rsp + 8], rax
lea rax, [0x0064d320]
mov qword [rsp + 0x10], rax
call fcn.0040b380
mov qword [rsp], rax
lea rax, [0x00654ca0]
mov qword [rsp + 8], rax
lea rax, [0x0064d320]
mov qword [rsp + 0x10], rax
call fcn.0040b380
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1630]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1620]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1610]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1600]
mov qword [rsp + 8], rax
nop
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.0049ab00

Function at 0x4a8b80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a8c06
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.004a8960
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
cmp qword [rsp + 0x28], 0
jne 0x4a8be9
test rcx, rcx
jbe 0x4a8be2
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
call fcn.0046cdc0
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1a60]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004a8b80
Function at 0x4c1a20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4c1aa0
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x4c1a83
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.004c1800
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp], rax
call fcn.00469ac0
movzx eax, byte [rsp + 0x10]
mov byte [rsp + 0x38], al
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1a70]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004c1a20
Function at 0x4c3460
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4c36f8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x4c36e6
mov rcx, rax
nop dword [rax]
cmp qword [0x007c3718], rax
jne 0x4c35c5
mov eax, 0xffffffff
mov word [rsp + 0x36], ax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x40], rcx
bt rcx, 0x3f
jae 0x4c35b6
shl rcx, 1
shr rcx, 0x1f
movabs rbx, 0xdd7b17f80
add rcx, rbx
mov qword [rsp + 0x38], rcx
nop
lea rax, [0x00614a60]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov byte [rax], 1
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
sar rcx, 0x38
mov byte [rax + 1], cl
mov rcx, rdx
sar rdx, 0x30
mov byte [rax + 2], dl
mov rdx, rcx
sar rcx, 0x28
mov byte [rax + 3], cl
mov rcx, rdx
sar rdx, 0x20
mov byte [rax + 4], dl
mov rdx, rcx
sar rcx, 0x18
mov byte [rax + 5], cl
mov rcx, rdx
sar rdx, 0x10
mov byte [rax + 6], dl
mov rdx, rcx
sar rcx, 8
mov byte [rax + 7], cl
mov byte [rax + 8], dl
mov rcx, qword [rsp + 0x40]
and rcx, 0x3fffffff
mov rdx, rcx
sar ecx, 0x18
mov byte [rax + 9], cl
mov rcx, rdx
sar edx, 0x10
mov byte [rax + 0xa], dl
mov rdx, rcx
sar ecx, 8
mov byte [rax + 0xb], cl
mov byte [rax + 0xc], dl
movzx ecx, word [rsp + 0x36]
mov edx, ecx
sar cx, 8
mov byte [rax + 0xd], cl
mov byte [rax + 0xe], dl
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x80], 0xf
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rdx, qword [rsp + 0x60]
mov rcx, rdx
nop
jmp 0x4c34e0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
nop dword [rax]
call fcn.004c33c0
mov rax, qword [rsp + 0x28]
mov rcx, rax
movabs rax, 0x8888888888888889
imul rcx
lea rax, [rcx + rdx]
sar rax, 5
mov rdx, rcx
sar rcx, 0x3f
sub rax, rcx
imul rcx, rax, 0x3c
cmp rdx, rcx
jne 0x4c368d
cmp rax, 0xffffffffffff8000
jge 0x4c3676
lea rax, [0x00625ba0]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x2a
lea rcx, [0x00666510]
mov qword [rax], rcx
mov qword [rsp + 0x70], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
lea rcx, [0x006a4760]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp rax, 0xffffffffffffffff
je 0x4c361d
nop dword [rax]
cmp rax, 0x7fff
jg 0x4c361d
jmp 0x4c34b2
lea rax, [0x00625ba0]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x35
lea rcx, [0x00668174]
mov qword [rax], rcx
mov qword [rsp + 0x70], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
lea rcx, [0x006a4760]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rdx, qword [0x007c3718]
mov rcx, rax
mov rax, rdx
jmp 0x4c34a0
call fcn.0046abe0
nop dword [rax]
jmp fcn.004c3460
Function at 0x4cb240
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4cb360
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
bt edx, 0
jb 0x4cb334
mov rax, rdx
or rdx, 1
add rdx, 8
test rdx, 0x7ffff8
je 0x4cb343
mov qword [rsp + 0x18], rax
movabs rbx, 0x80000000007fffff
and rdx, rbx
lock cmpxchg qword [rcx], rdx
sete dl
test dl, dl
je 0x4cb26d
mov rax, qword [rsp + 0x18]
jmp 0x4cb2d9
mov qword [rsp + 0x10], rax
lea rax, [rcx + 8]
mov qword [rsp], rax
call fcn.00467e40
mov rax, qword [rsp + 0x10]
add rax, 0xffffffffff800000
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x7ffff800000
test rax, rdx
jne 0x4cb2b7
jmp 0x4cb313
mov qword [rsp + 0x10], rax
lea rax, [rcx + 0xc]
mov qword [rsp], rax
call fcn.00467e40
mov rax, qword [rsp + 0x10]
movabs rcx, 0xfffff80000000000
add rax, rcx
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x7ffff80000000000
nop dword [rax]
test rax, rdx
jne 0x4cb2ea
mov byte [rsp + 0x38], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov byte [rsp + 0x38], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1400]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004cb240

Function at 0x4cb380
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4cb4e6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movzx ecx, byte [rsp + 0x48]
test cl, cl
je 0x4cb481
mov rcx, qword [rsp + 0x40]
test byte [rcx], al
lea rdx, [rcx + 8]
mov eax, 2
mov ebx, 0x800000
movabs rsi, 0x7ffff800000
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rax
jmp 0x4cb3ed
mov rax, r9
mov rdi, qword [rcx]
bt edi, 0
jb 0x4cb472
test rdi, rax
jne 0x4cb45e
mov r8, rdi
or rdi, rax
add rdi, 8
test rdi, 0x7ffff8
je 0x4cb4c6
mov r9, rax
mov rax, r8
lock cmpxchg qword [rcx], rdi
sete dil
test dil, dil
je 0x4cb3ea
test r8, r9
je 0x4cb44f
mov qword [rsp], rdx
call fcn.00467d20
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
jmp 0x4cb3ea
mov byte [rsp + 0x50], 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea r8, [rbx + rdi]
test rsi, r8
je 0x4cb4aa
mov r9, r8
mov r8, rdi
mov rdi, r9
jmp 0x4cb412
mov byte [rsp + 0x50], 0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x40]
test byte [rcx], al
lea rdx, [rcx + 0xc]
mov eax, 4
movabs rbx, 0x80000000000
movabs rsi, 0x7ffff80000000000
jmp 0x4cb3d4
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1400]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1400]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004cb380
Function at 0x4cba80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4cbbf4
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
test rax, rax
je 0x4cbb5f
mov qword [rsp], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.00466420
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x18], rax
cmp rax, 1
jg 0x4cbb33
nop dword [rax]
test rax, rax
jne 0x4cbb00
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rax, 1
jne 0x4cbba1
movzx eax, byte [rsp + 0x40]
test al, al
je 0x4cbb23
mov rax, qword [0x007cce70]
mov rcx, qword [0x007cce78]
jmp 0x4cbae9
mov rax, qword [0x007cce80]
mov rcx, qword [0x007cce88]
jmp 0x4cbae9
cmp rax, 2
jne 0x4cbb49
mov rax, qword [0x007c3f00]
mov rcx, qword [0x007c3f08]
jmp 0x4cbae9
cmp rax, 3
jne 0x4cbba1
mov rax, qword [0x007ccea0]
mov rcx, qword [0x007ccea8]
jmp 0x4cbae9
lea rax, [0x00625ba0]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x21
lea rcx, [0x00663f59]
mov qword [rax], rcx
lea rcx, [0x006a4760]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043aa00
lea rax, [0x0065cb9d]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0043b480
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0043b220
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a13f0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004cba80
Function at 0x4cbd00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4cbf60
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x27], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x30], rdx
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rbx
bt rcx, 0x3f
jae 0x4cbf25
mov rsi, qword [rsp + 0x28]
shl rsi, 1
shr rsi, 0x1f
movabs rdi, 0xdd7b17f80
add rsi, rdi
test rsi, rsi
jne 0x4cbeef
mov rsi, qword [rsp + 0x28]
and rsi, 0x3fffffff
test esi, esi
jne 0x4cbeef
xor eax, eax
mov rcx, qword [rsp + 0x60]
test byte [rcx], al
jmp 0x4cbdad
mov rax, rsi
mov rdx, qword [rcx]
bt edx, 0
jb 0x4cbee5
lea rbx, [rdx + 8]
nop
test rbx, 0x7ffff8
je 0x4cbf2f
mov rsi, rax
mov rax, rdx
lock cmpxchg qword [rcx], rbx
sete dl
test dl, dl
je 0x4cbdaa
mov eax, 1
test al, al
je 0x4cbeb3
xor eax, eax
xor edx, edx
test rax, rax
jne 0x4cbe99
lea rax, fcn.004cb640
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov byte [rsp + 0x27], 1
mov rax, qword [rcx + 0x1b8]
test rax, rax
jne 0x4cbe56
mov rax, qword [0x007cce90]
mov rcx, qword [0x007cce98]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rcx
mov byte [rsp + 0x27], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.004cb640
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x10], rax
call fcn.004665e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov byte [rsp + 0x27], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.004cb640
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rdx
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
cmp byte [rcx + 0x21f], 0
je 0x4cbecf
mov rax, qword [0x007cce70]
mov rdx, qword [0x007cce78]
jmp 0x4cbdf0
mov rax, qword [0x007cce80]
mov rdx, qword [0x007cce88]
nop dword [rax]
jmp 0x4cbdf0
mov rsi, rax
xor eax, eax
jmp 0x4cbde4
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.004c2dc0
mov rax, qword [rsp + 0x18]
test rax, rax
mov rcx, 0xffffffffffffffff
cmove rax, rcx
xorps xmm0, xmm0
nop dword [rax + rax]
jmp 0x4cbda1
mov rsi, qword [rsp + 0x30]
jmp 0x4cbd82
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1400]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.00437960
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.0046abe0
jmp fcn.004cbd00
Function at 0x4cbf80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4cc0e1
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x27], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov rcx, qword [rsp + 0x48]
test byte [rcx], al
mov rdx, qword [rcx]
bt edx, 0
jb 0x4cc0ae
lea rbx, [rdx + 8]
nop word [rax + rax]
nop
test rbx, 0x7ffff8
je 0x4cc0b5
mov rax, rdx
lock cmpxchg qword [rcx], rbx
sete dl
test dl, dl
je 0x4cbfc4
mov eax, 1
test al, al
je 0x4cc07f
xor eax, eax
xor edx, edx
test rax, rax
je 0x4cc022
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, fcn.004cb640
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x27], 1
mov rax, qword [rcx + 0x10]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov dword [rsp + 8], eax
call fcn.004afd00
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x27], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.004cb640
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp byte [rcx + 0x21f], 0
je 0x4cc09b
mov rax, qword [0x007cce70]
mov rdx, qword [0x007cce78]
jmp 0x4cc009
mov rax, qword [0x007cce80]
mov rdx, qword [0x007cce88]
jmp 0x4cc009
xor eax, eax
jmp 0x4cc001
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1400]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.00437960
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.0046abe0
jmp fcn.004cbf80
Function at 0x4cc100
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4cc255
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x1f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsp + 0x40]
test byte [rcx], al
mov rbx, qword [rcx]
bt ebx, 0
jb 0x4cc21e
lea rsi, [rbx + 8]
nop word [rax + rax]
nop
test rsi, 0x7ffff8
je 0x4cc225
mov rax, rbx
lock cmpxchg qword [rcx], rsi
sete bl
test bl, bl
je 0x4cc144
mov eax, 1
test al, al
je 0x4cc1ef
xor eax, eax
xor edx, edx
test rax, rax
je 0x4cc1a2
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, fcn.004cb640
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov byte [rsp + 0x1f], 1
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx]
mov rcx, qword [rcx + 0x10]
mov qword [rsp], rcx
call rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x1f], 0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.004cb640
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp byte [rcx + 0x21f], 0
je 0x4cc20e
mov rax, qword [0x007cce70]
mov rbx, qword [0x007cce78]
mov rdx, rbx
jmp 0x4cc189
mov rax, qword [0x007cce80]
mov rbx, qword [0x007cce88]
jmp 0x4cc206
xor eax, eax
jmp 0x4cc181
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1400]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.00437960
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.0046abe0
jmp fcn.004cc100
Function at 0x4cf680
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4cf7f5
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x27], 0
mov dword [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov rcx, qword [rsp + 0x48]
test byte [rcx], al
mov rdx, qword [rcx]
bt edx, 0
jb 0x4cf7be
lea rbx, [rdx + 8]
nop dword [rax]
test rbx, 0x7ffff8
je 0x4cf7c5
mov rax, rdx
lock cmpxchg qword [rcx], rbx
sete dl
test dl, dl
je 0x4cf6cc
mov eax, 1
test al, al
je 0x4cf78f
xor eax, eax
xor edx, edx
test rax, rax
je 0x4cf72e
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, fcn.004cb640
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x27], 1
mov rax, qword [rcx + 0x10]
mov qword [rsp], rax
call fcn.004acb40
mov eax, dword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov byte [rsp + 0x27], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.004cb640
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp byte [rcx + 0x21f], 0
je 0x4cf7ab
mov rax, qword [0x007cce70]
mov rdx, qword [0x007cce78]
jmp 0x4cf70d
mov rax, qword [0x007cce80]
mov rdx, qword [0x007cce88]
jmp 0x4cf70d
xor eax, eax
jmp 0x4cf701
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1400]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.00437960
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.0046abe0
jmp fcn.004cf680
Function at 0x4cffe0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4d0180
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x33], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
mov rdx, qword [rcx]
bt edx, 0
jb 0x4d0148
lea rbx, [rdx + 8]
nop word [rax + rax]
nop
test rbx, 0x7ffff8
je 0x4d014f
mov rax, rdx
lock cmpxchg qword [rcx], rbx
sete dl
test dl, dl
je 0x4d0024
mov eax, 1
test al, al
je 0x4d0119
xor eax, eax
xor edx, edx
test rax, rax
je 0x4d0089
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, fcn.004cb640
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov byte [rsp + 0x33], 1
mov rax, qword [rcx + 0x10]
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x34], ecx
mov qword [rsp], rax
mov rax, qword [rsp + 0x60]
mov dword [rsp + 8], eax
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0xc], eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 4
nop dword [rax]
call fcn.004afba0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov byte [rsp + 0x33], 0
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.004cb640
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp byte [rcx + 0x21f], 0
je 0x4d0135
mov rax, qword [0x007cce70]
mov rdx, qword [0x007cce78]
jmp 0x4d006d
mov rax, qword [0x007cce80]
mov rdx, qword [0x007cce88]
jmp 0x4d006d
xor eax, eax
jmp 0x4d0061
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1400]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.00437960
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0046abe0
jmp fcn.004cffe0
Function at 0x4d01a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4d036f
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x5f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
mov rcx, qword [rsp + 0x80]
test byte [rcx], al
mov rdx, qword [rcx]
bt edx, 0
jb 0x4d0338
lea rbx, [rdx + 8]
nop dword [rax + rax]
test rbx, 0x7ffff8
je 0x4d033f
mov rax, rdx
lock cmpxchg qword [rcx], rbx
sete dl
test dl, dl
je 0x4d01ea
mov eax, 1
test al, al
je 0x4d0308
xor eax, eax
xor edx, edx
test rax, rax
je 0x4d024c
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rdx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rax, fcn.004cb640
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x5f], 1
mov rax, qword [rcx + 0x10]
mov qword [rsp], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 8], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x10], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x18], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
call fcn.004ae8a0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rcx
mov byte [rsp + 0x5f], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
call fcn.004cb640
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
cmp byte [rcx + 0x21f], 0
je 0x4d0325
mov rax, qword [0x007cce70]
mov rdx, qword [0x007cce78]
nop
jmp 0x4d022d
mov rax, qword [0x007cce80]
mov rdx, qword [0x007cce88]
jmp 0x4d022d
xor eax, eax
jmp 0x4d0221
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1400]
mov qword [rsp + 8], rax
call fcn.00438920
nop
nop dword [rax]
call fcn.00437960
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
call fcn.0046abe0
jmp fcn.004d01a0
Function at 0x4d4c00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4d4c75
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x4d4c41
mov qword [rsp], rax
call fcn.00467400
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.004c8d00
cmp byte [rsp], 0
jne 0x4d4c58
call fcn.00466fe0
mov rax, qword [rsp + 0x20]
jmp 0x4d4c2e
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a15b0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004d4c00