joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461160
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x461327
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
test byte [rax], al
lea rcx, [rax + 0x30]
mov qword [rsp + 0x28], rcx
nop
mov rax, rcx
call fcn.0040b580
mov rax, qword [rsp + 0x40]
cmp byte [rax + 0x38], 0
jne 0x461315
mov byte [rax + 0x38], 1
inc qword [rax + 0x40]
inc qword [rax + 0x98]
call fcn.00430ac0
mov rax, qword [rsp + 0x40]
jmp 0x4611b8
mov rax, rdx
nop
mov rcx, qword [rax + 0x20]
nop dword [rax]
cmp rcx, 1
je 0x4611f8
test rcx, rcx
je 0x4611ef
mov rdx, rax
mov rax, rcx
xor ebx, ebx
lock cmpxchg qword [rdx + 0x20], rbx
sete sil
nop dword [rax]
test sil, sil
je 0x4611b5
cmp rcx, 2
cmove rcx, rbx
jmp 0x4611ff
mov rdx, rax
xor ebx, ebx
xor ecx, ecx
jmp 0x4611ff
mov rdx, rax
xor ebx, ebx
xor ecx, ecx
nop
mov rax, qword [rdx + 0x28]
cmp rax, 1
je 0x461238
test rax, rax
je 0x461234
mov qword [rsp + 0x10], rax
lock cmpxchg qword [rdx + 0x28], rbx
sete sil
nop
test sil, sil
je 0x4611ff
mov rsi, qword [rsp + 0x10]
cmp rsi, 2
cmove rsi, rbx
jmp 0x46123a
xor esi, esi
jmp 0x46123a
xor esi, esi
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x18], rsi
cmp qword [rdx + 0x60], 0
je 0x46128a
lea rax, [rdx + 0x48]
call fcn.00453e80
cmp dword [0x00921500], 0
jne 0x461264
mov rax, qword [rsp + 0x40]
jmp 0x461275
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x60]
call fcn.004665a0
mov qword [r11], rcx
mov qword [rax + 0x60], 0
mov rcx, qword [rsp + 0x20]
mov rdx, rax
mov rsi, qword [rsp + 0x18]
cmp qword [rdx + 0xb8], 0
je 0x4612d4
lea rax, [rdx + 0xa0]
nop dword [rax + rax]
call fcn.00453e80
cmp dword [0x00921500], 0
jne 0x4612b5
mov rcx, qword [rsp + 0x40]
jmp 0x4612c9
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0xb8]
call fcn.004665a0
mov qword [r11], rdx
mov qword [rcx + 0xb8], 0
nop
nop
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.0040b7a0
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x4612f9
mov ebx, 3
call fcn.00430e00
mov rax, qword [rsp + 0x18]
nop
test rax, rax
je 0x46130f
mov ebx, 3
call fcn.00430e00
add rsp, 0x30
pop rbp
ret
lea rax, [0x006bd16f]
mov ebx, 0x24
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.00461160
Function at 0x461420
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x40]
nop word [rax + rax]
cmp qword [r14 + 0x70], rcx
jb 0x461693
mov qword [rsp + 0x10], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rax
mov qword [rcx + 0xb0], 0
call fcn.00441da0
test al, al
jne 0x46149a
cmp byte [0x008d3208], 0
je 0x4615ce
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp 0x461641
cmp byte [0x008c6ce4], 0
je 0x4614df
movups xmmword [rsp + 0x20], xmm15
lea rax, [0x00441d60]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00464560
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp byte [0x008d3208], 0
je 0x46153e
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x18]
nop dword [rax]
cmp rsi, rdi
jne 0x461510
mov edx, dword [rdx + 0x268]
cmp dword [rsi + 0x14], edx
je 0x461543
lea rax, fcn.004575e0
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.00464560
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
jmp 0x461543
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
nop dword [rax + rax]
call fcn.0043bae0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rdx, qword [rax + 0x30]
dec dword [rdx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x46158f
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x46159d
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x008cdb00], 0
je 0x4615c8
mov ebx, 1
call fcn.0045b320
test al, al
jne 0x4615c8
nop
lea rax, [0x006e0be0]
call fcn.004644e0
add rsp, 0x30
pop rbp
ret
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x006e0b28]
call fcn.004644e0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
add rsp, 0x30
pop rbp
ret
nop
lea rax, [0x006e0ea0]
mov qword [rsp], rax
nop dword [rax]
call fcn.00464560
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
test rcx, rcx
je 0x461655
mov edx, dword [rcx + 0x14]
mov rbx, qword [rax + 0x30]
cmp dword [rbx + 0x268], edx
je 0x461611
call fcn.00466420
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, rax
sar rax, 0x3f
shr rax, 0x3a
add rax, rcx
sar rax, 6
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x170], rax
jmp 0x4615ce
lea rax, [0x006c0500]
mov ebx, 0x2d
nop
call fcn.00437240
nop
int3
Function at 0x462620
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4626a6
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp rax, 0x20
jne 0x46263e
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 0x20], rax
call fcn.00438be0
lea rax, [0x006bd28f]
mov ebx, 0x24
call fcn.00439460
mov rax, qword [rsp + 0x20]
nop
call fcn.004391a0
lea rax, [0x006b1a35]
mov ebx, 9
call fcn.00439460
mov eax, 0x20
nop dword [rax + rax]
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006b5216]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.00462620
Function at 0x463340
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
movq qword [rsp + 0x60], xmm15
mov byte [rsp + 0x1f], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
cmp rcx, 4
jge 0x4633cb
lea rdx, [rsp + 0x38]
cmp rbx, rdx
je 0x4633bf
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
mov rsi, rcx
shl rsi, 3
mov rax, rdx
mov rcx, rsi
call fcn.00467360
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov edx, 4
lea rbx, [rsp + 0x38]
jmp 0x4633d8
cmp rcx, 0x2a
jg 0x463499
mov rdx, rcx
mov rsi, qword [r14 + 0x30]
nop
inc dword [rsi + 0x23c]
mov rsi, qword [r14 + 0x30]
mov rdi, r14
nop
mov qword [rsi + 0x130], rdi
mov rsi, qword [r14 + 0x30]
mov qword [r14 + 0xd0], rsi
lea rsi, fcn.00443140
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x1f], 1
mov rsi, qword [r14 + 0x30]
mov qword [rsi + 0x2c8], rax
mov qword [rsi + 0x2d0], rcx
test rdx, rdx
jbe 0x46348f
mov qword [rsp + 0x58], rsi
lea rcx, [rsi + 0x2c8]
mov qword [rsi + 0x2d8], rbx
mov rax, qword [0x008cbde0]
mov rbx, rcx
call fcn.00404e00
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x2e0]
mov rsi, qword [rcx + 0x2e8]
mov rcx, qword [rcx + 0x2f0]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
call fcn.00443140
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
add rsp, 0x68
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.00466960
lea rax, [0x0065b7a0]
lea rbx, [0x007278d0]
call fcn.00436ac0
nop
call fcn.00435fa0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
add rsp, 0x68
pop rbp
ret
Function at 0x466480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403ee3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409ba0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403ec0
cmp byte [0x009210ac], 0
je 0x466495
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x4636e0
jmp 0x403ec0

Function at 0x4664a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00921620]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x009210ac], 0
je 0x4664d5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00921940]
aesenc xmm0, xmmword [0x00921950]
aesenc xmm0, xmmword [0x00921960]
movq rax, xmm0
ret
jmp 0x409dc0

Function at 0x4664e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00921620]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x009210ac], 0
je 0x466516
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00921940]
aesenc xmm0, xmmword [0x00921950]
aesenc xmm0, xmmword [0x00921960]
movq rax, xmm0
ret
jmp 0x409e20

Function at 0x466b00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43573d
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov ecx, 0x3e
mov rax, qword [rsp + 0x38]
lea rbx, [0x006c3af3]
call fcn.00434d80
movups xmmword [rsp + 0x18], xmm15
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], 0
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x18], rdx
mov byte [rsp + 0x28], 1
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov byte [rsp + 0x29], 8
lea rax, [0x006965a0]
lea rbx, [rsp + 0x18]
call fcn.0040ac60
mov rbx, rax
lea rax, [0x006965a0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4356c0
mov rax, rdx
jmp 0x4356c0

Function at 0x468280
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4682b4
mov rcx, 0x28
jmp 0x4682bf
shl rcx, 3
add rcx, 0x1480
mov qword [0x00921328], rcx
pop rbp
ret
Function at 0x46b140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43abcb
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], r14
mov dword [0x008cdab8], 0x2710
lea rax, [0x008938e0]
jmp 0x43a9a0
mov qword [rsp + 0x20], rax
call fcn.00451560
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x248]
test rax, rax
jne 0x43a98a
xor eax, eax
jmp 0x43a9c6
mov rcx, rax
shl rcx, 6
lea rdx, [0x009219c0]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 8]
inc rax
movups xmmword [rcx], xmm15
cmp rax, 2
jl 0x43a9a9
xor eax, eax
jmp 0x43a9e8
mov rcx, rax
shl rcx, 4
lea rdx, [0x00922588]
add rcx, rdx
inc rax
movups xmmword [rcx], xmm15
cmp rax, 0x23
jl 0x43a9d0
call fcn.0040be40
nop
xor eax, eax
xor ebx, ebx
call fcn.00401020
movzx eax, byte [0x00921b2a]
mov byte [0x009210af], al
movzx eax, byte [0x00921b2f]
mov byte [0x009210b0], al
movzx eax, byte [0x00921b27]
mov byte [0x009210b1], al
call fcn.00404a00
nop
lea rax, [0x00921260]
mov ebx, 8
mov rcx, rbx
call fcn.00432f00
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rcx
call fcn.0043ace0
call fcn.00451340
nop dword [rax + rax]
call fcn.0045c240
call fcn.0040a980
call fcn.0044f2c0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
test byte [rax], al
call fcn.00432fa0
nop
call fcn.00447600
call fcn.00419a20
cmp byte [0x008bcfa0], 0
je 0x43aa9e
mov qword [0x0088c520], 0
nop
nop
lea rax, [0x008cda98]
call fcn.0040b580
nop
call fcn.00468220
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp]
nop
lea rdx, [0x008cda88]
xchg qword [rdx], rcx
mov ecx, dword [0x00921120]
mov dword [rsp + 0x1c], ecx
lea rax, [0x006b1d4c]
mov ebx, 0xa
call fcn.00407ca0
call fcn.004503e0
movsxd rcx, eax
cmp rax, rcx
sete cl
mov edx, 0
cmove edx, eax
and ecx, ebx
test cl, cl
je 0x43ab0e
test edx, edx
jg 0x43ab12
mov edx, dword [rsp + 0x1c]
mov eax, edx
call fcn.00443840
nop dword [rax]
test rax, rax
jne 0x43abb9
nop
nop
lea rax, [0x008cda98]
call fcn.0040b7a0
cmp qword [0x008bdbd8], 0
nop
jne 0x43ab76
mov qword [0x008bdbd8], 7
cmp dword [0x00921500], 0
je 0x43ab68
mov rax, qword [str.go1.21.1]
nop dword [rax]
call fcn.004665a0
mov qword [r11], rax
lea rax, [0x006b1052]
mov qword [str.go1.21.1], rax
cmp qword [0x008bdc98], 1
nop
jne 0x43abb3
mov qword [0x008bdc98], 0
cmp dword [0x00921500], 0
je 0x43aba8
mov rax, qword [0x008bdc90]
nop dword [rax]
call fcn.004665a0
mov qword [r11], rax
mov qword [0x008bdc90], 0
add rsp, 0x30
pop rbp
ret
lea rax, [0x006bfb6f]
mov ebx, 0x2b
call fcn.00437240
nop
call fcn.004646a0
jmp 0x43a960
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x43a960
Function at 0x46c060
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c149
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
nop dword [rax]
test rbx, rbx
je 0x46c135
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
test rcx, rcx
je 0x46c0a7
lea rdx, [0x009210c7]
nop dword [rax]
cmp rcx, rdx
je 0x46c08e
jmp 0x46c0d7
call fcn.00461700
mov rax, qword [rsp + 0x28]
xor ebx, ebx
lea rcx, [0x009210c7]
call fcn.0045fd60
nop
test al, al
jne 0x46c0f2
call fcn.00461720
mov rax, qword [rsp + 0x28]
lea rdx, [0x009210c7]
jmp 0x46c08e
cmp qword [rsp + 0x30], rcx
jne 0x46c122
add rax, 8
mov rbx, qword [rsp + 0x38]
call fcn.0045fce0
add rsp, 0x18
pop rbp
ret
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 8]
mov rbx, qword [rsp + 0x38]
mov rax, rcx
call fcn.0045fce0
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
call fcn.0045fce0
call fcn.00461720
add rsp, 0x18
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727b30]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727b20]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046c060

Function at 0x471320
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4713b2
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
nop dword [rax]
test rbx, rbx
je 0x47139e
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x30], rbx
mov rdx, qword [rbx + 0x38]
mov rax, rcx
call rdx
nop dword [rax]
cmp rax, 0x14
jne 0x47138b
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x60]
mov rax, qword [rsp + 0x38]
call rcx
mov rbx, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.004714a0
add rsp, 0x18
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727b80]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727b70]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00471320

Function at 0x4713e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47144e
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
test rbx, rbx
je 0x47143a
mov qword [rsp + 0x18], rax
mov rdx, qword [rbx + 0x60]
mov rax, rcx
call rdx
mov qword [rsp + 0x10], rax
mov rbx, qword [rsp + 0x18]
call fcn.00471a80
test al, al
je 0x471425
mov eax, 1
jmp 0x471434
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
call fcn.004714a0
add rsp, 0x20
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727b90]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004713e0
Function at 0x4726a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472765
push rbp
mov rbp, rsp
sub rsp, 0x48
test rax, rax
je 0x472705
test rax, 0x60
jne 0x4726c5
add rsp, 0x48
pop rbp
ret
call fcn.00472640
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x006c023a]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x006b1b43]
call fcn.0044f6c0
call fcn.0040ae40
mov rbx, rax
lea rax, [0x0065b7a0]
nop
call fcn.00436ac0
call fcn.00472640
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
lea rax, [0x0067f080]
nop dword [rax + rax]
call fcn.0040d680
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00921500], 0
jne 0x472756
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00667fa0]
call fcn.00436ac0
call fcn.004665a0
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
jmp 0x472737
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.004726a0

Function at 0x472780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472894
push rbp
mov rbp, rsp
sub rsp, 0x48
test rax, rax
je 0x472834
nop dword [rax + rax]
test rax, 0x60
jne 0x4727f4
bt eax, 8
jae 0x4727b4
add rsp, 0x48
pop rbp
ret
call fcn.00472640
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x006b8c05]
mov r9d, 0x1a
xor eax, eax
lea rbx, [0x006b1b43]
call fcn.0044f6c0
nop
call fcn.0040ae40
mov rbx, rax
lea rax, [0x0065b7a0]
call fcn.00436ac0
call fcn.00472640
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x006c023a]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x006b1b43]
call fcn.0044f6c0
nop
call fcn.0040ae40
mov rbx, rax
lea rax, [0x0065b7a0]
call fcn.00436ac0
call fcn.00472640
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
lea rax, [0x0067f080]
call fcn.0040d680
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00921500], 0
nop
jne 0x472885
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00667fa0]
nop dword [rax]
call fcn.00436ac0
call fcn.004665a0
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
jmp 0x472862
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.00472780
Function at 0x472b80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472c9e
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
nop
cmp rcx, 0x12
ja 0x472bf5
cmp rcx, 0x11
je 0x472beb
cmp rcx, 0x12
jne 0x472c41
cmp qword [rax], 8
jne 0x472c8a
cmp qword [rax + 8], 0
je 0x472c8a
bt edx, 7
jae 0x472bdc
mov rbx, qword [rbx]
mov rax, rbx
nop
call fcn.0045fde0
add rsp, 0x18
pop rbp
ret
mov rax, qword [rax + 0x40]
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x15
jne 0x472c21
cmp qword [rax], 8
nop
jne 0x472c77
cmp qword [rax + 8], 0
je 0x472c77
bt edx, 7
jae 0x472c12
mov rbx, qword [rbx]
mov rax, rbx
call fcn.00460260
add rsp, 0x18
pop rbp
nop
ret
cmp rcx, 0x17
je 0x472c37
cmp rcx, 0x18
jne 0x472c41
mov rax, qword [rbx + 8]
add rsp, 0x18
pop rbp
ret
mov rax, qword [rbx + 8]
add rsp, 0x18
pop rbp
ret
lea rax, [0x0067f080]
call fcn.0040d680
mov qword [rax + 8], 0x11
lea rcx, [0x006b4750]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00667fa0]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727ba0]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727ba0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00472b80
Function at 0x478ba0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x478e0e
push rbp
mov rbp, rsp
sub rsp, 0x38
test rdi, rdi
jl 0x478dfa
nop dword [rax + rax]
cmp rdi, 9
jg 0x478de7
test ebx, ebx
jne 0x478bd9
movups xmmword [rax + 0x18], xmm15
add rsp, 0x38
pop rbp
ret
mov edx, ebx
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
bsr rdx, rdx
cmp rdx, 0x19
jge 0x478c0e
lea rsi, [rdx - 0x19]
neg rsi
mov r8, rcx
mov rcx, rsi
shl ebx, cl
lea rdx, [rdx + r8]
lea rdx, [rdx - 0x19]
cmp rcx, 0x20
sbb esi, esi
and ebx, esi
jmp 0x478c11
mov rdx, rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x48], rax
imul rsi, rdx, 0x13441
add rsi, 0x1ce618
sar rsi, 0x12
mov rcx, rdi
sub rcx, rsi
mov qword [rsp + 0x30], rcx
lea rsi, [rcx - 1]
nop dword [rax]
cmp rsi, 0x1b
jg 0x478c4f
test rsi, rsi
setge r8b
jmp 0x478c52
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x23], r8b
mov dword [rsp + 0x24], ebx
mov eax, ebx
mov rbx, rdx
mov rcx, rsi
call fcn.00479da0
test rbx, rbx
jge 0x478dd4
mov rdx, qword [rsp + 0x30]
lea r8, [rdx + 9]
nop
cmp r8, 0xa
jae 0x478ca6
mov r8d, dword [rsp + 0x24]
mov r8d, r8d
test r8, r8
je 0x478d85
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x478da0
movzx esi, byte [rsp + 0x23]
mov r8, rbx
neg rbx
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9d, cl
mov r10d, eax
shr eax, cl
cmp rcx, 0x20
sbb ebx, ebx
and r9d, ebx
dec r9d
and ebx, eax
and r9d, r10d
test sil, sil
je 0x478d27
lea rcx, [r8 + 1]
neg rcx
mov r8d, 1
shl r8d, cl
cmp rcx, 0x20
sbb r10d, r10d
and r8d, r10d
cmp r8d, r9d
jb 0x478d18
jne 0x478d22
nop dword [rax + rax]
test dil, dil
je 0x478d18
cmp r8d, r9d
jne 0x478d22
test dil, dil
je 0x478d22
mov r8d, ebx
and r8d, 1
jmp 0x478d49
mov r8d, 1
nop
jmp 0x478d49
xor r8d, r8d
jmp 0x478d49
lea rcx, [r8 + 1]
neg rcx
mov r10d, r9d
shr r9d, cl
cmp rcx, 0x20
sbb r11d, r11d
and r9d, r11d
cmp r9d, 1
sete r8b
mov r9d, r10d
test r9d, r9d
je 0x478d50
xor edi, edi
xor edi, 1
mov rax, qword [rsp + 0x48]
mov ecx, edi
mov edi, r8d
mov rsi, qword [rsp + 0x60]
call fcn.004790e0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x30]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
add rsp, 0x38
pop rbp
ret
mov esi, 1
mov ecx, 1
jmp 0x478cab
inc rsi
mov eax, edi
mov r8, rdx
mov rdx, r10
nop
cmp rsi, r9
jge 0x478d85
mov edi, eax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
nop
cmp r8, r11
je 0x478d94
mov eax, edi
mov rdx, r10
movzx esi, byte [rsp + 0x23]
jmp 0x478cab
lea rax, [0x0065b7a0]
lea rbx, [0x007275f0]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x007275e0]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x007275d0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00478ba0