joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x502dda
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.004690fb
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
xor ebx, ebx
jmp 0x502c5f
inc ebx
cmp edx, ebx
jle 0x502d7e
movzx ebp, byte [ecx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x502d22
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x502cd3
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x502c5e
lea edi, [esp + 0x28]
call fcn.004690fb
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.005035a0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.004695de
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.004695de
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x28]
call fcn.004690fb
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00503190
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.004695de
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.004695de
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.004690fa
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x7403da]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x14
lea edi, [esp + 0x60]
call fcn.004690fb
lea ecx, [0x71a160]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.00409b00
mov ecx, dword [esp + 8]
lea edx, [0x7b0fd4]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.004690fa
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x73f2e6]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x12
lea edi, [esp + 0x60]
call fcn.004690fb
lea ecx, [0x71a160]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.00409b00
mov ecx, dword [esp + 8]
lea edx, [0x7b0fd4]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call fcn.00467a60
jmp fcn.00502c30
Function at 0x507050
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0xb0]
cmp eax, dword [ecx + 8]
jbe 0x507241
sub esp, 0x130
lea edi, [esp + 0x13c]
xor eax, eax
call fcn.004690bd
mov ecx, dword [esp + 0x134]
movzx edx, byte [ecx + 0x24]
test dl, dl
jne 0x507215
movzx edx, byte [ecx + 0x18]
movzx ebx, byte [esp + 0x138]
cmp bl, dl
jbe 0x5070b0
mov edx, dword [0x9672b0]
mov ebx, dword [0x9672b4]
jmp 0x507122
jae 0x5070c0
mov edx, dword [0x9672b8]
mov ebx, dword [0x9672bc]
jmp 0x507122
mov byte [ecx + 0x24], 0
cmp bl, 3
ja 0x5070df
cmp bl, 2
jne 0x5070d4
movzx edx, word [ecx + 0x10]
jmp 0x5070f7
cmp bl, 3
jne 0x5070f5
movzx edx, word [ecx + 0x12]
jmp 0x5070f7
cmp bl, 4
jne 0x5070ea
movzx edx, word [ecx + 0x14]
jmp 0x5070f7
cmp bl, 5
jne 0x5070f5
movzx edx, word [ecx + 0x16]
jmp 0x5070f7
xor edx, edx
movzx edx, dx
cmp dword [ecx + 0x20], edx
jne 0x50711e
mov dword [ecx + 0x20], 0
movzx ebp, byte [ecx + 0x18]
inc ebp
xchg ebp, eax
mov byte [ecx + 0x18], al
xchg ebp, eax
mov edx, dword [0x9672b8]
mov ebx, dword [0x9672bc]
jmp 0x507122
xor edx, edx
xor ebx, ebx
test edx, edx
jne 0x5071f4
lea edi, [esp + 0x20]
call fcn.004690bd
mov ecx, dword [esp + 0x134]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov ebp, dword [ecx]
mov esi, dword [ecx + 0x1c]
lea ecx, [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], esi
call fcn.00508ac0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x5071a2
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x12c], ecx
mov edx, dword [esp + 0x1c]
lea edi, [esp + 0x13c]
xor eax, eax
call fcn.004690bd
mov ecx, dword [esp + 0x12c]
mov dword [esp + 0x248], ecx
mov dword [esp + 0x24c], edx
add esp, 0x130
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x134]
mov byte [ecx + 0x24], 1
lea edi, [ecx + 0x28]
lea esi, [esp + 0x20]
call fcn.00469372
mov ecx, dword [esp + 0x134]
mov dword [ecx + 0x1c], eax
lea edi, [esp + 0x13c]
lea esi, [esp + 0x20]
call fcn.00469372
mov dword [esp + 0x248], 0
mov dword [esp + 0x24c], 0
add esp, 0x130
ret
lea edi, [esp + 0x13c]
call fcn.004690bd
mov dword [esp + 0x248], edx
mov dword [esp + 0x24c], ebx
add esp, 0x130
ret
lea esi, [ecx + 0x28]
lea edi, [esp + 0x13c]
call fcn.00469372
mov dword [esp + 0x248], 0
mov dword [esp + 0x24c], 0
add esp, 0x130
ret
call fcn.00467a60
jmp fcn.00507050
Function at 0x507f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50813c
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.004690f7
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x507fb8
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x507fe1
lea eax, [0x6f4820]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.0044e560
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.004690f7
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
movzx ecx, word [esp + 0x70]
shl ecx, 0xb
movzx edx, word [esp + 0x78]
movzx ebx, byte [esp + 0x75]
or edx, ecx
test bl, bl
je 0x508024
or edx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x508033
or edx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x508042
or edx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x508051
or edx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x508060
or edx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x50806c
or edx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x508078
or edx, 0x10
movzx eax, word [esp + 0x6c]
mov word [esp + 0x46], ax
mov word [esp + 0x48], dx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x38]
cmp eax, edx
jae 0x5080e8
mov dword [esp + 0x24], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
lea eax, [0x6f4820]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x24], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x20], eax
add ecx, ebx
mov dword [esp], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xc
call fcn.004697f0
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.004695b6
add esp, 0x5c
ret
call fcn.00467a60
jmp fcn.00507f80
Function at 0x508150
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5082fe
sub esp, 0x30
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + 0xc]
cmp cl, 2
jb 0x5082e0
ja 0x5082c2
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov ebx, dword [eax]
mov ebp, dword [eax + 0x20]
mov esi, dword [eax + 0x1c]
lea edi, [esp + 0x38]
mov dword [esp], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
call fcn.00509b60
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
test eax, eax
jne 0x5082a8
mov eax, dword [esp + 0x34]
movzx ebp, byte [eax + 0xc]
xchg ebp, eax
cmp al, 3
xchg ebp, eax
ja 0x508203
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jne 0x5081eb
lea ebp, [eax + 0x12]
mov esi, dword [0x967318]
mov edi, dword [0x96731c]
jmp 0x508239
xchg ebp, eax
cmp al, 3
xchg ebp, eax
jne 0x508233
lea ebp, [eax + 0x14]
mov esi, dword [0x967320]
mov edi, dword [0x967324]
jmp 0x508239
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jne 0x50821b
lea ebp, [eax + 0x16]
mov esi, dword [0x967328]
mov edi, dword [0x96732c]
jmp 0x508239
xchg ebp, eax
cmp al, 5
xchg ebp, eax
jne 0x508233
lea ebp, [eax + 0x18]
mov esi, dword [0x967330]
mov edi, dword [0x967334]
jmp 0x508239
xor ebp, ebp
xor esi, esi
xor edi, edi
mov dword [esp + 0x2c], ecx
movzx ecx, word [ebp]
cmp cx, 0xffff
je 0x508250
inc ecx
mov word [ebp], cx
xor esi, esi
xor edi, edi
test esi, esi
jne 0x508296
mov dword [eax + 4], ebx
mov dword [eax + 8], edx
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x50826a
mov ecx, dword [esp + 0x2c]
jmp 0x50827a
call fcn.00468e70
mov ecx, dword [esp + 0x2c]
mov dword [edi], ecx
mov edx, dword [eax]
mov dword [edi + 4], edx
mov dword [eax], ecx
mov dword [esp + 0x13c], 0
mov dword [esp + 0x140], 0
add esp, 0x30
ret
mov dword [esp + 0x13c], esi
mov dword [esp + 0x140], edi
add esp, 0x30
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
add esp, 0x30
ret
mov eax, dword [0x9672b8]
mov ecx, dword [0x9672bc]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
add esp, 0x30
ret
mov eax, dword [0x9672b0]
mov ecx, dword [0x9672b4]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
add esp, 0x30
ret
call fcn.00467a60
jmp fcn.00508150
Function at 0x508780
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x508841
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ebx, byte [eax + 0xc]
test bl, bl
je 0x50880b
mov byte [eax + 0xc], 6
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0x1c]
cmp edx, ecx
jb 0x50883b
lea ebx, [eax + 0xe]
mov ebp, dword [eax]
mov dword [esp], ebx
sub edx, ecx
mov ebx, edx
neg edx
sar edx, 0x1f
and ecx, edx
add ecx, ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], ebx
call fcn.00506700
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x1c
ret
mov eax, dword [0x9672b0]
mov ecx, dword [0x9672b4]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x1c
ret
call fcn.00468f10
nop
call fcn.00467a60
jmp fcn.00508780
Function at 0x512ba0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x1b0]
cmp eax, dword [ecx + 8]
jbe 0x512d96
sub esp, 0x230
cmp word [esp + 0x244], 3
je 0x512d75
nop
mov eax, dword [esp + 0x234]
mov dword [esp], eax
mov byte [esp + 4], 3
call fcn.00507050
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x114]
mov dword [esp + 0x22c], ecx
mov edx, dword [esp + 0x118]
lea edi, [esp + 0x11c]
lea esi, [esp + 8]
call fcn.00469372
test eax, eax
je 0x512c85
mov eax, dword [esp + 0x22c]
cmp dword [0x9672b8], eax
je 0x512c2b
mov ecx, 1
jmp 0x512c60
mov dword [esp + 0x228], edx
mov ecx, dword [0x9672bc]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00404290
movzx eax, byte [esp + 0xc]
xor eax, 1
mov edx, dword [esp + 0x228]
mov ecx, eax
mov eax, dword [esp + 0x22c]
test cl, cl
je 0x512c8c
mov eax, dword [0x9670a8]
mov ecx, dword [0x9670ac]
mov dword [esp + 0x248], eax
mov dword [esp + 0x24c], ecx
add esp, 0x230
ret
mov eax, dword [esp + 0x22c]
movzx ecx, word [esp + 0x244]
test cx, cx
jne 0x512cfd
movzx ecx, byte [esp + 0x23e]
test cl, cl
jne 0x512cfd
movzx ecx, byte [esp + 0x241]
test cl, cl
jne 0x512cfd
cmp dword [0x9672b8], eax
je 0x512cbd
xor eax, eax
jmp 0x512cd8
mov ecx, dword [0x9672bc]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00404290
movzx eax, byte [esp + 0xc]
test al, al
je 0x512cfd
mov eax, dword [0x9670a0]
mov ecx, dword [0x9670a4]
mov dword [esp + 0x248], eax
mov dword [esp + 0x24c], ecx
add esp, 0x230
ret
movzx eax, word [esp + 0x244]
test ax, ax
je 0x512d58
cmp ax, 3
je 0x512d58
cmp ax, 2
jne 0x512d37
mov eax, dword [0x9670d0]
mov ecx, dword [0x9670d4]
mov dword [esp + 0x248], eax
mov dword [esp + 0x24c], ecx
add esp, 0x230
ret
mov eax, dword [0x9670b8]
mov ecx, dword [0x9670bc]
mov dword [esp + 0x248], eax
mov dword [esp + 0x24c], ecx
add esp, 0x230
ret
mov dword [esp + 0x248], 0
mov dword [esp + 0x24c], 0
add esp, 0x230
ret
mov eax, dword [0x9670f8]
mov ecx, dword [0x9670fc]
mov dword [esp + 0x248], eax
mov dword [esp + 0x24c], ecx
add esp, 0x230
ret
call fcn.00467a60
jmp fcn.00512ba0
Function at 0x512da0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x2bc]
cmp eax, dword [ecx + 8]
jbe 0x512f0a
sub esp, 0x33c
mov eax, dword [esp + 0x340]
mov dword [esp], eax
mov byte [esp + 4], 3
call fcn.00507050
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x118]
mov dword [esp + 0x338], ecx
mov edx, dword [esp + 0x114]
lea edi, [esp + 0x22c]
lea esi, [esp + 8]
call fcn.00469372
lea edi, [esp + 0x120]
lea esi, [esp + 0x22c]
call fcn.00469372
cmp dword [0x9672b8], eax
jne 0x512e54
mov dword [esp + 0x11c], edx
mov ecx, dword [0x9672bc]
mov dword [esp], eax
mov eax, dword [esp + 0x338]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00404290
movzx eax, byte [esp + 0xc]
test al, al
jne 0x512ee9
mov edx, dword [esp + 0x11c]
test edx, edx
jne 0x512ec8
movzx eax, word [esp + 0x344]
cmp word [esp + 0x220], ax
je 0x512eab
mov eax, dword [esp + 0x340]
mov dword [esp], eax
mov byte [esp + 4], 3
call fcn.00507250
mov eax, dword [esp + 8]
test eax, eax
je 0x512dc1
mov eax, dword [0x9670a8]
mov ecx, dword [0x9670ac]
mov dword [esp + 0x348], eax
mov dword [esp + 0x34c], ecx
add esp, 0x33c
ret
mov dword [esp + 0x348], 0
mov dword [esp + 0x34c], 0
add esp, 0x33c
ret
mov eax, dword [0x9670a8]
mov ecx, dword [0x9670ac]
mov dword [esp + 0x348], eax
mov dword [esp + 0x34c], ecx
add esp, 0x33c
ret
mov eax, dword [0x9670f8]
mov ecx, dword [0x9670fc]
mov dword [esp + 0x348], eax
mov dword [esp + 0x34c], ecx
add esp, 0x33c
ret
call fcn.00467a60
jmp fcn.00512da0
Function at 0x51d870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51d9e1
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x51d907
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x51d8a6
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x51d913
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x51d8d1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x51d913
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x51d913
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.0051d660
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.005247a0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.00467a60
jmp fcn.0051d870
Function at 0x52a330
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52a43c
sub esp, 0xc
mov eax, dword [0x9669d4]
cmp dword [eax + 4], 1
jle 0x52a3b7
movzx ecx, byte [eax + 1]
mov byte [esp + 0xb], cl
movzx eax, byte [eax]
mov byte [esp + 0xa], al
call fcn.0043af60
lea eax, [0x74716f]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.0043b7e0
movzx eax, byte [esp + 0xb]
mov byte [esp], al
call fcn.0043b1b0
lea eax, [0x73bf6c]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.0043b7e0
movzx eax, byte [esp + 0xa]
mov byte [esp], al
call fcn.0043b1b0
call fcn.0043b170
call fcn.0043afc0
mov eax, dword [0x9669d4]
movzx ecx, byte [eax]
test cl, cl
jne 0x52a418
movzx ecx, byte [eax + 1]
test cl, cl
jne 0x52a3d4
movzx eax, byte [eax + 8]
test al, al
je 0x52a3f6
call fcn.0043af60
lea eax, [0x749fa7]
mov dword [esp], eax
mov dword [esp + 4], 0x27
call fcn.0043b7e0
call fcn.0043afc0
jmp 0x52a438
call fcn.0043af60
lea eax, [0x74e0c1]
mov dword [esp], eax
mov dword [esp + 4], 0x32
call fcn.0043b7e0
call fcn.0043afc0
jmp 0x52a438
call fcn.0043af60
lea eax, [0x7504ae]
mov dword [esp], eax
mov dword [esp + 4], 0x3d
call fcn.0043b7e0
call fcn.0043afc0
add esp, 0xc
ret
call fcn.00467a60
jmp fcn.0052a330
Function at 0x57c620
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x57c796
sub esp, 0x84
movzx ecx, byte [esp + 0x90]
cmp cl, 0x10
jae 0x57c77d
lea edi, [esp + 0x58]
xor eax, eax
call fcn.004690f8
lea edi, [esp + 0x38]
call fcn.004690f8
nop
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x44], 0xffffffff
lea edi, [esp + 0x18]
call fcn.004690f8
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
lea esi, [esp + 0x58]
mov dword [esp + 0x78], esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x7c], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x8c]
mov edi, dword [ecx]
call fcn.004695c0
mov ecx, dword [esp + 0x8c]
mov edi, dword [ecx + 4]
mov esi, dword [esp + 0x7c]
call fcn.004695c0
mov ecx, dword [esp + 0x8c]
mov edi, dword [ecx + 8]
mov esi, dword [esp + 0x80]
call fcn.004695c0
mov ecx, dword [esp + 0x88]
movzx edx, byte [esp + 0x90]
mov ebx, dword [esp + 0x8c]
mov eax, 1
jmp 0x57c751
xchg esi, eax
mov byte [esp + 0x17], al
xchg esi, eax
test byte [ecx], al
mov edx, dword [ecx + ebp*4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
movzx eax, al
dec eax
shr eax, 0x1f
mov dword [esp + 0xc], eax
call fcn.0057c530
movzx eax, byte [esp + 0x17]
inc eax
mov ecx, dword [esp + 0x88]
movzx edx, byte [esp + 0x90]
mov ebx, dword [esp + 0x8c]
cmp al, 0x10
jae 0x57c76a
lea ebp, [eax - 1]
xchg ebp, eax
movzx eax, al
xchg ebp, eax
nop
mov esi, eax
xor eax, edx
cmp ebp, 0xf
jb 0x57c70f
jmp 0x57c771
add esp, 0x84
ret
mov eax, ebp
mov ecx, 0xf
call fcn.00468ed0
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b09b0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.0057c620
Function at 0x57f9f0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x57fb7e
sub esp, 0x84
movzx ecx, byte [esp + 0x90]
cmp cl, 0x10
jae 0x57fb65
lea edi, [esp + 0x58]
xor eax, eax
call fcn.004690f8
lea edi, [esp + 0x38]
call fcn.004690f8
nop
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x50], 0xfffffffe
mov dword [esp + 0x54], 0
lea edi, [esp + 0x18]
call fcn.004690f8
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
lea esi, [esp + 0x58]
mov dword [esp + 0x78], esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x7c], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x8c]
mov edi, dword [ecx]
call fcn.004695c0
mov ecx, dword [esp + 0x8c]
mov edi, dword [ecx + 4]
mov esi, dword [esp + 0x7c]
call fcn.004695c0
mov ecx, dword [esp + 0x8c]
mov edi, dword [ecx + 8]
mov esi, dword [esp + 0x80]
call fcn.004695c0
mov ecx, dword [esp + 0x88]
movzx edx, byte [esp + 0x90]
mov ebx, dword [esp + 0x8c]
mov eax, 1
jmp 0x57fb39
xchg esi, eax
mov byte [esp + 0x17], al
xchg esi, eax
test byte [ecx], al
mov edx, dword [ecx + ebp*4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
movzx eax, al
dec eax
shr eax, 0x1f
mov dword [esp + 0xc], eax
call fcn.0057f900
movzx eax, byte [esp + 0x17]
inc eax
mov ecx, dword [esp + 0x88]
movzx edx, byte [esp + 0x90]
mov ebx, dword [esp + 0x8c]
cmp al, 0x10
jae 0x57fb52
lea ebp, [eax - 1]
xchg ebp, eax
movzx eax, al
xchg ebp, eax
nop
mov esi, eax
xor eax, edx
cmp ebp, 0xf
jb 0x57faf7
jmp 0x57fb59
add esp, 0x84
ret
mov eax, ebp
mov ecx, 0xf
call fcn.00468ed0
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b09b8]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.0057f9f0
Function at 0x582e30
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x34]
cmp eax, dword [ecx + 8]
jbe 0x582ff5
sub esp, 0xb4
movzx ecx, byte [esp + 0xc0]
cmp cl, 0x10
jae 0x582fdc
lea edi, [esp + 0x78]
xor eax, eax
call fcn.004690f4
lea edi, [esp + 0x48]
call fcn.004690f4
nop
mov dword [esp + 0x48], 1
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0x58], 1
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
lea edi, [esp + 0x18]
call fcn.004690f4
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xb0], 0
lea esi, [esp + 0x78]
mov dword [esp + 0xa8], esi
lea ecx, [esp + 0x48]
mov dword [esp + 0xac], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0xb0], ecx
mov ecx, dword [esp + 0xbc]
mov edi, dword [ecx]
call fcn.00469598
mov ecx, dword [esp + 0xbc]
mov edi, dword [ecx + 4]
mov esi, dword [esp + 0xac]
call fcn.00469598
mov ecx, dword [esp + 0xbc]
mov edi, dword [ecx + 8]
mov esi, dword [esp + 0xb0]
call fcn.00469598
mov ecx, dword [esp + 0xb8]
movzx edx, byte [esp + 0xc0]
mov ebx, dword [esp + 0xbc]
mov eax, 1
jmp 0x582fb0
xchg esi, eax
mov byte [esp + 0x17], al
xchg esi, eax
test byte [ecx], al
mov edx, dword [ecx + ebp*4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
movzx eax, al
dec eax
shr eax, 0x1f
mov dword [esp + 0xc], eax
call fcn.00582d40
movzx eax, byte [esp + 0x17]
inc eax
mov ecx, dword [esp + 0xb8]
movzx edx, byte [esp + 0xc0]
mov ebx, dword [esp + 0xbc]
cmp al, 0x10
jae 0x582fc9
lea ebp, [eax - 1]
xchg ebp, eax
movzx eax, al
xchg ebp, eax
nop
mov esi, eax
xor eax, edx
cmp ebp, 0xf
jb 0x582f6e
jmp 0x582fd0
add esp, 0xb4
ret
mov eax, ebp
mov ecx, 0xf
call fcn.00468ed0
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b09c0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.00582e30