joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f2a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f37d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [0x00982590]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.00432ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x00982860], rax
test rax, rax
je 0x42f314
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.004633e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436fa0
lea rax, [0x0076bae6]
mov ebx, 0x2f
call fcn.004378a0
mov rax, qword [rsp + 0x30]
call fcn.004375a0
lea rax, [0x00756f11]
mov ebx, 3
call fcn.004378a0
call fcn.00437020
lea rax, [0x00762e05]
mov ebx, 0x1b
call fcn.00435800
nop
nop dword [rax]
call fcn.0045f860
jmp fcn.0042f2a0

Function at 0x42f460
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f54d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor eax, eax
lea rcx, [0x00a7c744]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
je 0x42f4d8
mov rax, qword [0x00982860]
mov rcx, qword [0x00982500]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.00432ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
je 0x42f4e2
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.004633e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436fa0
lea rax, [0x0076e525]
mov ebx, 0x3c
call fcn.004378a0
mov rax, qword [rsp + 0x30]
nop
call fcn.004375a0
lea rax, [0x00756f11]
mov ebx, 3
call fcn.004378a0
call fcn.00437020
lea rax, [0x0076ccdb]
mov ebx, 0x33
call fcn.00435800
nop
call fcn.0045f860
jmp fcn.0042f460
Function at 0x42f900
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f987
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov edx, dword [rbx + 0x28]
nop dword [rax + rax]
cmp edx, 0x72
je 0x42f92a
cmp edx, 0x77
jne 0x42f945
mov dword [rbx + 0x2c], ecx
mov dword [rbx + 0x30], edi
mov rbx, qword [rbx + 0x20]
mov ecx, edx
call fcn.0042eae0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edx
call fcn.00436fa0
lea rax, [0x0076e4e9]
mov ebx, 0x3c
call fcn.004378a0
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.004376a0
call fcn.00437200
call fcn.00437020
lea rax, [0x007603e2]
mov ebx, 0x17
call fcn.00435800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.0045f860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.0042f900
Function at 0x42fa80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42fc6f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
cmp qword [0x00a7c920], 0
jne 0x42fb1f
mov rax, qword [0x00982530]
lea rcx, [0x00a7d500]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x104
call fcn.004329c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x42fc5d
cmp rax, 0x104
ja 0x42fc5d
lea rbx, [0x00a7d500]
mov byte [rbx + rax], 0x5c
lea r8, [rax + 1]
mov qword [0x00a7c920], r8
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
cmp byte [0x00a7c6a5], 0
je 0x42fb7b
test rbx, rbx
jbe 0x42fc53
mov rcx, qword [0x00a24e60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x800
call fcn.00432a40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [0x00a7c920]
cmp rcx, 0x105
ja 0x42fc49
lea rsi, [rcx + rbx]
mov qword [rsp + 0x28], rsi
nop dword [rax + rax]
cmp rsi, 0x105
ja 0x42fbb2
lea rdx, [0x00a7d500]
jmp 0x42fbe1
mov qword [rsp + 0x30], rcx
lea rax, [0x006f8ca0]
lea rbx, [0x00a7d500]
mov edi, 0x105
call fcn.00448d60
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
mov rdx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rdx
lea rsi, [rdx + rcx]
mov rcx, rbx
mov rbx, rax
mov rax, rsi
call fcn.004628a0
mov rcx, qword [rsp + 0x28]
nop dword [rax]
test rcx, rcx
jbe 0x42fc42
mov rax, qword [0x00982508]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00432940
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
call fcn.00461f40
mov edx, 0x105
call fcn.00461fa0
xor eax, eax
mov rcx, rbx
call fcn.00461f40
lea rax, [0x0076769b]
mov ebx, 0x24
call fcn.00435800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.0045f860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0042fa80
Function at 0x430860
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430afd
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x00a24e98]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.00432a40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x43096e
nop
jne 0x4308f6
cmp dword [rsp + 0x4c], 0
jne 0x4308f6
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x43096e
mov rax, qword [0x00a24e90]
nop dword [rax]
call fcn.004328e0
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x00a7db6a]
mov ebx, 0x20
mov ecx, 0x21
call fcn.00431120
mov rcx, qword [0x00a7c920]
nop word [rax + rax]
cmp rcx, 0x105
ja 0x430af2
mov qword [rsp + 0x58], rcx
lea rax, [0x00a7d980]
lea rbx, [0x00a7d500]
call fcn.004628a0
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x430980
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rdx + rbx + 1], dil
inc rax
cmp rax, 0x20
jge 0x4309ee
lea rdx, [rcx + rax*2]
lea rbx, [0x00a7d980]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x0075ab3d]
movzx esi, byte [rdi + rsi]
cmp rdx, 0x20b
jae 0x430ae5
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
nop word [rax + rax]
cmp rsi, 0x20b
jb 0x430978
jmp 0x430ad5
lea rdx, [rcx + 0x40]
jmp 0x430a02
lea rbx, [0x00a7d980]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x430a19
cmp rdx, 0x20b
jb 0x4309f4
jmp 0x430ac8
mov rax, qword [0x00982598]
lea rcx, [0x00a7d980]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.00432c40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.004633e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x430ab7
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.00436fa0
lea rax, [0x0077048a]
mov ebx, 0x5f
call fcn.004378a0
call fcn.00437020
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [0x00a7c695], 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.00461f40
mov rax, rsi
mov ecx, 0x20b
nop dword [rax]
call fcn.00461f40
mov rax, rdx
mov ecx, 0x20b
call fcn.00461f40
mov edx, 0x105
call fcn.00461fa0
nop
nop dword [rax]
call fcn.0045f860
jmp fcn.00430860
Function at 0x430e40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4310f9
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.0042f9c0
cmp dword [0x00a7cac0], 0
jne 0x430ebc
mov qword [0x00a24e58], rax
jmp 0x430ec8
lea rdi, [0x00a24e58]
call fcn.00461aa0
test rax, rax
je 0x4310e7
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.0042f9c0
cmp dword [0x00a7cac0], 0
jne 0x430f27
mov qword [0x00a24e78], rax
jmp 0x430f33
lea rdi, [0x00a24e78]
call fcn.00461aa0
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.0042f9c0
cmp dword [0x00a7cac0], 0
jne 0x430f9b
mov qword [0x00a24e80], rax
jmp 0x430fa7
lea rdi, [0x00a24e80]
call fcn.00461aa0
cmp qword [0x00a24e78], 0
je 0x4310d6
test rax, rax
je 0x4310d6
mov qword [rsp + 0x20], 0
mov rax, qword [0x00a24e80]
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop dword [rax]
call fcn.00432940
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x4310c5
cmp rax, 0x7fffffff
jg 0x4310b1
mov qword [rsp + 0x28], rax
mov rax, qword [0x00a24e78]
lea rcx, [0x00a7c8f8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00432940
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x431063
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x431082
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x43105d
sub rbx, rsi
bts edi, ecx
nop
jmp 0x43105d
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x00a7c8f0], rax
mov byte [0x00a7c6a6], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x0077021e]
mov ebx, 0x56
nop dword [rax]
call fcn.00435800
lea rax, [0x0076fe93]
mov ebx, 0x50
call fcn.00435800
lea rax, [0x0076281d]
mov ebx, 0x1b
call fcn.00435800
lea rax, [0x0076bd7d]
mov ebx, 0x30
call fcn.00435800
nop
mov qword [rsp + 8], rax
nop
call fcn.0045f860
mov rax, qword [rsp + 8]
jmp fcn.00430e40
Function at 0x432100
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rcx, qword [0x00982588]
lea rdx, [0x004635e0]
mov qword [rsp], rcx
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm15
call fcn.00432bc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x43218c
mov rcx, qword [0x009825a8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00432940
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov ecx, dword [0x00a7c710]
test ecx, ecx
jne 0x43223b
mov rax, qword [0x00a29230]
sub rax, qword [0x00a29240]
mov qword [rsp + 0x48], rax
call fcn.004633e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.00436fa0
lea rax, [0x0076b545]
mov ebx, 0x2e
nop
call fcn.004378a0
mov rax, qword [rsp + 0x48]
movsxd rax, eax
call fcn.004376a0
lea rax, [0x0075aacd]
mov ebx, 0x10
nop
call fcn.004378a0
mov rax, qword [rsp + 0x40]
call fcn.004375a0
lea rax, [0x00756e30]
mov ebx, 2
nop dword [rax + rax]
call fcn.004378a0
call fcn.00437020
lea rax, [0x0075bb75]
mov ebx, 0x11
call fcn.00435800
nop
nop
lea rax, [0x00a7c820]
call fcn.0040b340
nop
nop
lea rax, [0x00a7c820]
call fcn.0040b340
jmp 0x43219a
Function at 0x435d20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x435e7d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x10], r14
cmp qword [0x00a553e0], 0
jne 0x435d65
call fcn.00436fa0
lea rax, [0x0076b5a1]
mov ebx, 0x2e
call fcn.004378a0
nop dword [rax]
call fcn.00437020
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
nop
jge 0x435d8c
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x435e27
nop
cmp edx, 1
je 0x435df1
cmp edx, 2
jne 0x435dd9
mov dword [rcx + 0xdc], 3
call fcn.00436fa0
lea rax, [0x00760f33]
mov ebx, 0x18
call fcn.004378a0
call fcn.00437020
mov eax, 4
call fcn.00431420
mov eax, 5
nop
call fcn.00431420
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 2
nop dword [rax + rax]
call fcn.00436fa0
lea rax, [0x0075d04b]
mov ebx, 0x13
call fcn.004378a0
call fcn.00437020
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 1
mov ecx, 1
lea rdx, [0x00a7c74c]
lock xadd dword [rdx], ecx
lea rax, [0x00a7c8b0]
call fcn.0040b300
cmp dword [0x00a7cd90], 0
jg 0x435e5f
cmp dword [0x00a7cd8c], 0
jle 0x435e69
mov eax, 1
call fcn.00442f40
call fcn.00439620
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
nop dword [rax]
call fcn.0045f860
jmp fcn.00435d20
Function at 0x43a660
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43a826
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x60], al
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x00a7c73c]
test edx, edx
je 0x43a6b4
xor eax, eax
nop dword [rax]
call fcn.0042f560
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.0043dce0
nop
nop
lea rax, [0x00a29218]
nop dword [rax]
call fcn.0040b340
mov ecx, dword [0x00a7c734]
mov edx, dword [0x00a7c748]
test edx, edx
je 0x43a6e2
mov dword [0x00a7c748], 0
nop
jmp 0x43a6e4
mov edx, ecx
mov eax, edx
call fcn.00441620
mov qword [rsp + 0x40], rax
mov dword [0x00a292e0], 0
cmp dword [0x00a292f0], 0
je 0x43a719
mov dword [0x00a292f0], 0
lea rax, [0x00a292f8]
call fcn.0040b640
nop
nop
lea rax, [0x00a29218]
call fcn.0040b560
mov rcx, qword [rsp + 0x40]
jmp 0x43a733
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x43a78f
mov rdx, qword [rcx + 8]
mov rsi, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rsi, rsi
je 0x43a77c
nop
mov qword [rcx + 0x38], 0
cmp qword [rsi + 0xa8], 0
nop dword [rax + rax]
jne 0x43a814
nop
mov qword [rsi + 0xa8], rcx
lea rax, [rsi + 0x118]
call fcn.0040b640
jmp 0x43a72e
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
call fcn.0043b8e0
jmp 0x43a72e
nop
call fcn.00463840
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x43a7d4
nop
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.00453660
call fcn.0043c460
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43a805
cmp byte [r14 + 0xb1], 0
je 0x43a805
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x00768394]
mov ebx, 0x25
call fcn.00435800
nop
mov byte [rsp + 8], al
call fcn.0045f860
movzx eax, byte [rsp + 8]
jmp fcn.0043a660
Function at 0x43b8e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ba4c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043b0e0
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43ba01
mov rcx, qword [rdx + 0x30]
nop word [rax + rax]
test rcx, rcx
je 0x43ba01
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x238], 0
jne 0x43b966
cmp byte [rcx + 0xe8], 0
nop
je 0x43ba01
nop
nop
lea rax, [0x00a7cc00]
call fcn.0040b340
cmp dword [0x00a7cc20], 0
nop dword [rax + rax]
je 0x43ba3a
mov rcx, qword [0x00a7cc08]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x128], rcx
nop
mov qword [0x00a7cc08], rdx
cmp byte [0x00a7cc10], 0
je 0x43b9bd
mov byte [0x00a7cc10], 0
lea rax, [0x00a7cc18]
call fcn.0040b640
nop
nop
lea rax, [0x00a7cc00]
call fcn.0040b560
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43b9f7
cmp byte [r14 + 0xb1], 0
je 0x43b9f7
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043ba80
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43ba30
cmp byte [r14 + 0xb1], 0
je 0x43ba30
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0076a17b]
mov ebx, 0x2a
call fcn.00435800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.0045f860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043b8e0
Function at 0x43c4e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c71d
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x130]
test rdx, rdx
je 0x43c70b
mov rdx, qword [rdx + 0xe8]
cmp rdx, rcx
jne 0x43c70b
mov qword [rsp + 0x30], r14
cmp qword [rcx + 0xa0], 0
je 0x43c535
call fcn.00441fe0
call fcn.0043c180
mov eax, 1
call fcn.00442140
nop
call fcn.0043aa20
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x130]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43c594
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.00441e60
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov dword [rsp + 0x1c], ebx
call fcn.00436fa0
lea rax, [0x0076a7a6]
mov ebx, 0x2b
call fcn.004378a0
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.004375a0
lea rax, [0x00767557]
mov ebx, 0x24
call fcn.004378a0
call fcn.00437020
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x130]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
nop
call fcn.00436fa0
lea rax, [0x0075b2ed]
mov ebx, 0x10
call fcn.004378a0
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00437820
lea rax, [0x00757ad8]
mov ebx, 7
call fcn.004378a0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004376a0
lea rax, [0x0075c6a5]
mov ebx, 0x13
call fcn.004378a0
mov eax, dword [rsp + 0x18]
mov eax, eax
nop dword [rax]
call fcn.004375a0
call fcn.00437200
call fcn.00437020
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.00436fa0
lea rax, [0x0075b2bd]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.004378a0
mov rax, qword [rsp + 0x28]
call fcn.00437820
lea rax, [0x00757ad8]
mov ebx, 7
nop dword [rax + rax]
call fcn.004378a0
mov rax, qword [rsp + 0x20]
call fcn.004376a0
lea rax, [0x0075c692]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.004378a0
mov eax, dword [rsp + 0x14]
mov eax, eax
call fcn.004375a0
call fcn.00437200
call fcn.00437020
lea rax, [0x00761afd]
mov ebx, 0x19
call fcn.00435800
lea rax, [0x007662f9]
mov ebx, 0x21
call fcn.00435800
nop
nop dword [rax]
call fcn.0045f860
jmp fcn.0043c4e0
Function at 0x43eba0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x43ee0c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
cmp byte [0x00a2e890], 0
je 0x43ebd7
mov eax, 0x14
xor ebx, ebx
call fcn.00454a40
mov rax, qword [rsp + 0x48]
nop
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
jne 0x43ece5
mov byte [rax + 0xb0], 0x19
cmp byte [rax + 0xb4], 0
je 0x43ec1e
mov rcx, qword [rax + 0x40]
mov rax, rcx
call fcn.0044f360
test rax, rax
je 0x43eccf
movzx edx, byte [rax + 0x25]
test dl, 2
jne 0x43ec74
mov rax, qword [rsp + 0x48]
mov ebx, 2
mov ecx, 0x1009
call fcn.00439fa0
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop
nop
xor esi, esi
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
nop
xor esi, esi
mov qword [rdx + 0x90], rsi
mov rax, qword [rsp + 0x48]
mov ebx, 0x1009
mov ecx, 9
nop dword [rax]
call fcn.004396c0
call fcn.0043e000
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.0044fae0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.00436fa0
lea rax, [0x00768325]
mov ebx, 0x25
call fcn.004378a0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
call fcn.004378a0
lea rax, [0x0075bcfe]
mov ebx, 0x12
call fcn.004378a0
call fcn.00437020
lea rax, [0x0075a9fb]
mov ebx, 0xf
call fcn.00435800
lea rax, [0x0075e737]
mov ebx, 0x15
nop dword [rax + rax]
call fcn.00435800
nop
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00436fa0
lea rax, [0x0075b2ed]
mov ebx, 0x10
call fcn.004378a0
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.00437820
lea rax, [0x00757ad8]
mov ebx, 7
call fcn.004378a0
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.004376a0
lea rax, [0x0075c6a5]
mov ebx, 0x13
call fcn.004378a0
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.004375a0
call fcn.00437200
call fcn.00437020
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x10], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00436fa0
lea rax, [0x0075b2bd]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.004378a0
mov rax, qword [rsp + 0x28]
call fcn.00437820
lea rax, [0x00757ad8]
mov ebx, 7
nop dword [rax + rax]
call fcn.004378a0
mov rax, qword [rsp + 0x18]
call fcn.004376a0
lea rax, [0x0075c692]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.004378a0
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.004375a0
call fcn.00437200
call fcn.00437020
lea rax, [0x0075960a]
mov ebx, 0xc
call fcn.00435800
nop
mov qword [rsp + 8], rax
call fcn.00463f80
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.0043eba0