joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476960
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476bb9
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
nop dword [rax + rax]
cmp rdi, 0x12
jg 0x476ba5
test rbx, rbx
jne 0x47699e
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
cmp rsi, 0x37
jge 0x4769d9
lea rsi, [rdx - 0x36]
neg rsi
cmp rsi, 0x40
sbb r8, r8
mov r9, rcx
mov rcx, rsi
shl rbx, cl
and rbx, r8
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x36]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
imul rdx, rcx, 0x13441
add rdx, 0x4105b6
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x38], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x37
jg 0x476a10
test rdx, rdx
setge r8b
jmp 0x476a13
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x27], r8b
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.004779e0
test rbx, rbx
jge 0x476b92
mov rdx, qword [rsp + 0x38]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x476a65
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x476b47
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x476b62
movzx esi, byte [rsp + 0x27]
neg rbx
cmp rbx, 0x40
sbb r8, r8
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9, cl
and r9, r8
dec r9
mov r10, rax
shr rax, cl
and rax, r8
and r9, r10
test sil, sil
je 0x476ae6
dec rcx
cmp rcx, 0x40
sbb r8, r8
mov r10d, 1
shl r10, cl
and r10, r8
cmp r10, r9
jb 0x476ad3
jne 0x476ada
test dil, dil
je 0x476ad3
nop dword [rax + rax]
cmp r10, r9
jne 0x476ada
test dil, dil
je 0x476ada
mov rbx, rax
and rax, 1
jmp 0x476adf
mov ecx, 1
jmp 0x476b03
mov rbx, rax
xor eax, eax
mov ecx, eax
mov rax, rbx
jmp 0x476b03
dec rcx
cmp rcx, 0x40
sbb r8, r8
mov r10, r9
shr r9, cl
and r9, r8
cmp r9, 1
sete cl
mov r9, r10
test r9, r9
je 0x476b0a
xor edi, edi
xor edi, 1
mov rbx, rax
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x50]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.00476c00
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x38]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov esi, 1
mov ecx, 1
jmp 0x476a6a
inc rsi
mov rax, rdi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x476b47
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x476b56
mov rax, rdi
mov rdx, r10
jmp 0x476a65
lea rax, [0x009e4c00]
lea rbx, [0x00db5910]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5900]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00476960
Function at 0x477900
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4779b2
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
test rcx, rcx
je 0x477988
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x47799e
shl rdx, 4
lea rsi, [0x0094ed00]
mov rdx, qword [rsi + rdx + 8]
lea rsi, [rdx + 1]
test rcx, rcx
cmovl rdx, rsi
mov eax, eax
mul rdx
mov rsi, rax
shl rax, 7
test rax, rax
sete dil
imul r8, rcx, 0x1a935
sar r8, 0xf
lea rbx, [r8 + rbx]
lea rbx, [rbx - 6]
shl rdx, 7
shr rsi, 0x39
or rdx, rsi
mov rax, rdx
mov ecx, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
shl eax, 6
add rbx, 0xfffffffffffffffa
mov ecx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db5920]
call fcn.004373c0
nop
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov eax, dword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00477900

Function at 0x4779e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477ad5
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop dword [rax + rax]
test rcx, rcx
je 0x477aaa
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x477ac1
shl rdx, 4
lea rsi, [0x0094ed00]
add rdx, rsi
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x10], xmm0
test rcx, rcx
jge 0x477a3d
inc qword [rsp + 0x10]
mov rdx, qword [rsp + 0x10]
mov rsi, rax
mov rax, rdx
mul rsi
mov rdi, qword [rsp + 0x18]
mov r8, rax
mov rax, rdi
mov rdi, rdx
mul rsi
add rax, rdi
sbb rsi, rsi
imul rdi, rcx, 0x1a935
sar rdi, 0xf
lea rbx, [rdi + rbx]
lea rbx, [rbx - 8]
sub rdx, rsi
mov rsi, rax
shl rax, 9
nop
test rax, rax
jne 0x477a8e
test r8, r8
sete dil
jmp 0x477a90
xor edi, edi
shl rdx, 9
shr rsi, 0x37
or rdx, rsi
mov rax, rdx
mov ecx, edi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
shl rax, 8
add rbx, 0xfffffffffffffff8
mov ecx, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db5930]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004779e0
Function at 0x477b00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477bc6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
cmp rax, 0x64
jae 0x477b86
nop
cmp rbx, 0xa
jne 0x477b86
cmp rax, 0xa
jge 0x477b4a
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x477bc0
lea rcx, [0x00ad379d]
add rcx, rax
mov eax, 1
jmp 0x477b76
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x477bb3
mov rdx, rax
shl rax, 1
cmp rcx, rax
jb 0x477bae
lea rsi, [0x00ae1f95]
lea rcx, [rsi + rdx*2]
mov eax, 2
mov rbx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor r8d, r8d
mov r9d, r8d
xor eax, eax
mov rbx, rcx
call fcn.00478040
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00465c20
mov edx, 0xc8
call fcn.00465ba0
nop dword [rax]
call fcn.00465c20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00477b00

Function at 0x477c00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477ccb
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
cmp rax, 0x64
jae 0x477c86
nop
cmp rbx, 0xa
jne 0x477c86
cmp rax, 0xa
jge 0x477c4a
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x477cc5
lea rcx, [0x00ad379d]
add rcx, rax
mov eax, 1
jmp 0x477c76
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x477cba
mov rdx, rax
shl rax, 1
cmp rcx, rax
jb 0x477cb5
lea rsi, [0x00ae1f95]
lea rcx, [rsi + rdx*2]
mov eax, 2
mov rbx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
test rax, rax
setl r8b
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor r9d, r9d
xor eax, eax
mov rbx, rcx
nop dword [rax]
call fcn.00478040
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00465c20
mov edx, 0xc8
nop
call fcn.00465ba0
call fcn.00465c20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00477c00
Function at 0x47c400
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47c68a
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov edx, dword [rax]
xor ecx, ecx
xor ebx, ebx
xor esi, esi
xor edi, edi
jmp 0x47c42c
mov rax, r8
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x1e], sil
mov byte [rsp + 0x1d], bl
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x20], edx
mov r8d, edx
and edx, 5
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x47c457
xor r9d, r9d
jmp 0x47c484
mov rax, rcx
call fcn.00460060
mov rcx, qword [rsp + 0x38]
mov edx, dword [rsp + 0x2c]
movzx ebx, byte [rsp + 0x1d]
movzx esi, byte [rsp + 0x1e]
mov rdi, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x20]
mov r9d, eax
mov rax, qword [rsp + 0x50]
test r9b, r9b
jne 0x47c5c0
mov r9d, r8d
or r8d, 1
test r9d, 4
mov r10d, r9d
cmove r9d, r8d
lea r8d, [r9 + 8]
test edx, edx
cmovne r9d, r8d
test bl, bl
je 0x47c4c0
bt r10d, 0
jae 0x47c4c0
or r9d, 4
nop dword [rax + rax]
test sil, sil
je 0x47c510
bt r9d, 1
jb 0x47c50c
mov dword [rsp + 0x24], r9d
lea rax, [0x00acf25f]
mov ebx, 0x1e
nop dword [rax]
call fcn.0045fd00
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rsp + 0x2c]
movzx ebx, byte [rsp + 0x1d]
movzx esi, byte [rsp + 0x1e]
mov rdi, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x24]
mov r10d, dword [rsp + 0x20]
and r9d, 0xfffffffd
mov r8, rax
mov eax, r10d
lock cmpxchg dword [r8], r9d
sete r9b
nop
test r9b, r9b
jne 0x47c52d
mov edx, dword [r8]
jmp 0x47c429
test edx, edx
je 0x47c680
test rdi, rdi
jne 0x47c54f
call fcn.00460f00
mov rcx, qword [rsp + 0x30]
test rcx, rcx
mov r8, qword [rsp + 0x50]
mov rdi, rax
mov qword [rsp + 0x30], rdi
setne bl
lea rax, [r8 + 4]
mov ecx, 1
call fcn.00460960
movzx edx, byte [rsp + 0x1d]
test dl, dl
je 0x47c57a
mov rcx, qword [rsp + 0x30]
mov eax, 1
jmp 0x47c590
call fcn.00460f00
mov rcx, qword [rsp + 0x30]
sub rax, rcx
cmp rax, 0xf4240
setg al
mov rdx, qword [rsp + 0x50]
mov esi, dword [rdx]
bt esi, 2
nop dword [rax + rax]
jb 0x47c62c
mov r8, rdx
mov edx, esi
xor ecx, ecx
mov ebx, eax
mov esi, 1
mov rdi, qword [rsp + 0x30]
jmp 0x47c429
test sil, sil
jne 0x47c5fa
bt r8d, 1
jb 0x47c5fa
mov edx, r8d
sar r8d, 3
test r8d, r8d
je 0x47c5fa
mov r8d, edx
or edx, 2
mov r9, rax
mov eax, r8d
lock cmpxchg dword [r9], edx
sete dl
test dl, dl
je 0x47c5f7
mov esi, 1
jmp 0x47c5fa
mov rax, r9
mov byte [rsp + 0x1e], sil
nop
call fcn.004600e0
mov rax, qword [rsp + 0x38]
lea rcx, [rax + 1]
mov rax, qword [rsp + 0x50]
mov edx, dword [rax]
mov r8, rax
movzx ebx, byte [rsp + 0x1d]
movzx esi, byte [rsp + 0x1e]
mov rdi, qword [rsp + 0x30]
jmp 0x47c429
mov byte [rsp + 0x1f], al
mov dword [rsp + 0x28], esi
test esi, 3
jne 0x47c645
mov ecx, esi
sar esi, 3
test esi, esi
jne 0x47c664
lea rax, [0x00acf25f]
mov ebx, 0x1e
call fcn.0045fd00
movzx eax, byte [rsp + 0x1f]
mov ecx, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
test al, al
je 0x47c677
sar ecx, 3
cmp ecx, 1
je 0x47c677
mov eax, 0xfffffff9
jmp 0x47c67c
mov eax, 0xfffffff5
lock xadd dword [rdx], eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0047c400
Function at 0x47c700
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47c7c2
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
lea edx, [rbx + 1]
bt edx, 0
nop
jb 0x47c745
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
lea rax, [0x00acf27d]
mov ebx, 0x1e
call fcn.0045fd00
mov rax, qword [rsp + 0x28]
mov ebx, dword [rsp + 0x30]
bt ebx, 2
jae 0x47c774
test byte [rax], al
add rax, 4
mov ebx, 1
mov ecx, 1
nop dword [rax + rax]
call fcn.00460900
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov ebx, dword [rcx]
mov rax, rcx
mov edx, ebx
sar ebx, 3
test ebx, ebx
je 0x47c7b8
nop dword [rax]
test edx, 7
jne 0x47c7b8
lea esi, [rdx - 8]
or esi, 2
mov rcx, rax
mov eax, edx
lock cmpxchg dword [rcx], esi
sete dl
test dl, dl
je 0x47c76f
lea rax, [rcx + 4]
xor ebx, ebx
mov ecx, 1
call fcn.00460900
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0047c700

Function at 0x47dd40
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47de46
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
test byte [rax], al
mov rdx, rax
nop dword [rax]
test rax, 7
jne 0x47dd6e
lea rax, [rdx + 8]
jmp 0x47dd7b
lea rax, [rdx + 4]
mov rcx, rdx
mov rdx, rax
mov rax, rcx
mov rsi, rbx
shl rbx, 0x20
mov rdi, rbx
lock xadd qword [rdx], rbx
add rdi, rbx
mov r8, rdi
shr rdi, 0x20
test edi, edi
jl 0x47de2d
nop dword [rax]
test r8d, r8d
je 0x47ddb6
test rsi, rsi
jle 0x47ddb2
cmp esi, edi
je 0x47de1a
test edi, edi
jmp 0x47ddb8
test edi, edi
jmp 0x47ddb8
test edi, edi
jg 0x47ddd3
test r8d, r8d
je 0x47ddd3
nop
cmp qword [rdx], r8
jne 0x47de07
mov qword [rsp + 0x20], rax
mov qword [rdx], 0
jmp 0x47ddf8
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov dword [rsp + 0x1c], r8d
xor ebx, ebx
xor ecx, ecx
call fcn.00460900
mov edx, dword [rsp + 0x1c]
lea r8d, [rdx - 1]
mov rax, qword [rsp + 0x20]
test r8d, r8d
jne 0x47dddd
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db59a0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db59a0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5990]
nop dword [rax + rax]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0047dd40
Function at 0x47dee0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47df86
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test byte [rax], al
mov rcx, rax
nop dword [rax]
test rax, 7
jne 0x47df0e
lea rax, [rcx + 8]
jmp 0x47df20
lea rax, [rcx + 4]
mov rdx, rcx
mov rcx, rax
mov rax, rdx
jmp 0x47df20
mov rax, rsi
mov rdx, qword [rcx]
mov rbx, rdx
shr rdx, 0x20
test edx, edx
je 0x47df66
lea rdx, [rbx + 1]
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rcx], rdx
sete dl
test dl, dl
je 0x47df1d
mov qword [rsp + 0x10], rcx
mov rax, rsi
call fcn.00460840
mov rcx, qword [rsp + 0x10]
cmp qword [rcx], 0
jne 0x47df70
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db59b0]
nop
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0047dee0
Function at 0x483420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48361b
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
nop dword [rax + rax]
cmp rdi, 8
ja 0x483607
test sil, sil
je 0x483459
cmp rcx, 8
jne 0x4835f4
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x0092c380], rdx
jl 0x483495
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
mov qword [rsp + 0x98], rcx
xor edx, edx
jmp 0x4834e4
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea r8, [rcx + 1]
mov qword [rax + 8], r8
lea r8, [rcx + rcx*2]
shl r8, 4
lea r12, [r11 + r8]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r12], xmm0
lea r8, [r11 + r8]
lea r8, [r8 + 0x10]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r8 + 0x10], xmm0
inc qword [rax + 0x38]
inc rdx
mov rcx, r9
cmp rdi, rdx
jle 0x4835e5
lea r8, [rsp + 0x48]
movups xmmword [r8], xmm15
lea r8, [rsp + 0x58]
movups xmmword [r8], xmm15
lea r8, [rsp + 0x68]
movups xmmword [r8], xmm15
cmp rdx, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rdx
mov r10d, 1
shl r10d, cl
and r10d, r8d
test sil, r10b
mov r8d, 2
mov r10d, 3
cmovne r8, r10
mov qword [rsp + 0x48], r8
imul rcx, r9
lea r8, [rbx + rcx]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov r8, qword [rax + 0x38]
mov qword [rsp + 0x68], r8
mov rcx, qword [rax + 8]
lea r8, [rcx + 1]
mov r11, qword [rax]
mov r12, qword [rax + 0x10]
cmp r12, r8
jae 0x4834a1
mov qword [rsp + 0x40], rdx
lea rax, [0x00a8e0c0]
mov rbx, r11
mov rdi, r12
mov rsi, r8
call fcn.0044b060
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 0x10], rcx
cmp dword [0x011546d0], 0
jne 0x4835a2
mov qword [rdi], rax
nop
jmp 0x4835a7
call fcn.004656c0
mov rdx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x98]
mov r10d, 3
mov rcx, rbx
mov r11, rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
jmp 0x4834a1
mov eax, 1
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db5600]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5260]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp fcn.00483420
Function at 0x485560
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x200]
cmp r12, qword [r14 + 0x10]
jbe 0x48581e
sub rsp, 0x280
mov qword [rsp + 0x278], rbp
lea rbp, [rsp + 0x278]
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x298], rcx
mov qword [rsp + 0x2a0], rdi
bt esi, 9
jae 0x48580a
mov qword [rsp + 0x288], rax
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0xf8], rcx
movzx edx, byte [rcx + 0x17]
mov byte [rsp + 0xcf], dl
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
call fcn.004974a0
mov rdx, qword [rsp + 0xe0]
and rdx, 0x1e0
movzx edi, byte [rsp + 0xcf]
and edi, 0x1f
or rdi, rdx
lea rdx, [0x00dd54b0]
cmp rax, rdx
jne 0x4857f7
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xf0], rbx
lea rcx, [0x00c27f28]
test byte [rcx], al
mov rcx, qword [0x00c27f28]
mov qword [rsp + 0xd8], rcx
mov qword [rsp + 0x1c0], 0
lea rdi, [rsp + 0x1c8]
lea rdi, [rdi - 0x10]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465e2f
mov rbp, qword [rbp]
mov rax, rbx
xor ebx, ebx
call fcn.0048d080
mov rcx, qword [rsp]
mov qword [rsp + 0x1c0], rcx
lea rdi, [rsp + 0x1c8]
lea rsi, [rsp + 8]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466166
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x1c0]
mov qword [rsp + 0x108], rcx
lea rdi, [rsp + 0x110]
lea rsi, [rsp + 0x1c8]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466166
mov rbp, qword [rbp]
lea rax, [0x00a672e0]
call fcn.0040e6a0
mov rcx, qword [rsp + 0xd8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1b0]
cmp dword [0x011546d0], 0
jne 0x485722
mov qword [rax + 8], rcx
nop
jmp 0x48572b
lea rdi, [rax + 8]
call fcn.004657c0
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0x198]
mov qword [rax + 0x10], rdx
movzx edx, word [rsp + 0x1b8]
mov word [rax + 0x18], dx
mov r8, qword [rsp + 0xe0]
sar r8, 0xa
mov qword [rax + 0x20], r8
mov rsi, qword [rsp + 0xd0]
mov qword [rax + 0x38], rsi
cmp dword [0x011546d0], 0
jne 0x48578a
mov rcx, qword [rsp + 0xf8]
mov qword [rax + 0x28], rcx
mov rdi, qword [rsp + 0x100]
mov qword [rax + 0x30], rdi
jmp 0x4857af
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0xf8]
call fcn.004657c0
lea rdi, [rax + 0x30]
mov r9, qword [rsp + 0x100]
call fcn.00465860
mov rdi, r9
mov rax, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x290]
nop
call fcn.004912a0
mov rax, qword [rsp + 0xf0]
test byte [rax], al
mov rcx, qword [rsp + 0xe0]
and rcx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0x278]
add rsp, 0x280
ret
lea rbx, [0x00aaeb40]
lea rcx, [0x00a9e6e0]
call fcn.0040b940
lea rax, [0x009e4c00]
lea rbx, [0x00db5360]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00485560
Function at 0x486f20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486f87
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x12
jne 0x486f54
mov rax, qword [rax + 0x38]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004861e0
mov ecx, 0x22
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00ad2863]
call fcn.0044eaa0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00486f20

Function at 0x486fa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487015
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x13
jne 0x486fdc
movzx ecx, word [rax + 0x32]
test cx, 0x8000
setne al
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
nop dword [rax]
call fcn.004861e0
mov ecx, 0x25
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00ad4cf1]
call fcn.0044eaa0
nop
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00486fa0

Function at 0x487040
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487175
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop
cmp rcx, 0x12
ja 0x4870c0
cmp rcx, 0x11
jne 0x48708f
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x48707e
lea rax, [0x00dd54b0]
jmp 0x487082
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x12
jne 0x48713f
mov rcx, qword [rax + 0x30]
nop dword [rax]
test rcx, rcx
je 0x4870ae
lea rax, [0x00dd54b0]
jmp 0x4870b2
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x15
jne 0x4870e9
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x4870d8
lea rax, [0x00dd54b0]
jmp 0x4870dc
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x16
jne 0x487113
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x487102
lea rax, [0x00dd54b0]
nop
jmp 0x487106
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x17
jne 0x48713f
mov rcx, qword [rax + 0x30]
nop dword [rax]
test rcx, rcx
je 0x48712e
lea rax, [0x00dd54b0]
jmp 0x487132
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
nop
call fcn.004861e0
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00acf0d9]
call fcn.0044eaa0
nop
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00487040