joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497fc0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4980f0
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, rax
and rax, 0x1f
cmp rax, 0x19
jne 0x4980a5
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x38]
mov rbx, qword [rsp + 0x40]
cmp qword [rax + 0x40], rbx
jbe 0x498084
lea rax, [rbx + rbx*2]
mov rbx, qword [rdx + rax*8 + 8]
mov rsi, qword [rdx + rax*8]
and rcx, 0x1a0
movzx edi, byte [rbx + 0x17]
and edi, 0x1f
or rcx, rdi
movzx esi, byte [rsi]
test sil, 1
je 0x498064
nop
nop
mov rax, qword [rdx + rax*8 + 0x10]
mov qword [rsp + 0x48], rbx
shr rax, 1
mov rdx, qword [rsp + 0x30]
add rax, rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rsi, rcx
or rcx, 0x40
or rsi, 0x20
mov rdi, qword [rdx + rax*8 + 0x10]
test rdi, 1
cmovne rsi, rcx
mov rcx, rsi
jmp 0x498039
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1740]
mov qword [rsp + 8], rax
nop dword [rax + rax]
call fcn.00438920
mov qword [rsp + 0x10], rax
lea rax, [0x0062e740]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x13
lea rcx, [0x0065e580]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
lea rcx, [0x0061b9a0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00497fc0
Function at 0x498100
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49830f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, rax
and rax, 0x1f
cmp rax, 0x11
jne 0x4981a4
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
cmp qword [rdx + 0x40], rax
jbe 0x4982f2
mov rdx, qword [rdx + 0x30]
mov rbx, qword [rdx]
nop
movzx esi, byte [rdx + 0x17]
mov qword [rsp + 0x48], rdx
imul rax, rbx
mov rdx, qword [rsp + 0x30]
add rax, rdx
mov qword [rsp + 0x50], rax
test rcx, 0x60
mov eax, 0
mov edx, 0x20
cmovne rax, rdx
and rcx, 0x180
or rcx, rax
and esi, 0x1f
or rsi, rcx
mov qword [rsp + 0x58], rsi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rax, 0x17
jne 0x498210
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
cmp qword [rdx + 8], rax
jbe 0x4982d6
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx + 0x30]
mov rsi, qword [rbx]
imul rax, rsi
add rax, qword [rdx]
movzx edx, byte [rbx + 0x17]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rax
test rcx, 0x60
mov eax, 0
mov ecx, 0x20
cmovne rax, rcx
and edx, 0x1f
or rdx, rax
or rdx, 0x180
mov qword [rsp + 0x58], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rax, 0x18
jne 0x49826c
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
cmp qword [rdx + 8], rax
jbe 0x4982ba
mov rdx, qword [rdx]
mov rbx, qword [0x007cc3d8]
nop
mov qword [rsp + 0x48], rbx
add rax, rdx
mov qword [rsp + 0x50], rax
test rcx, 0x60
mov eax, 0
mov ecx, 0x20
cmovne rax, rcx
or rax, 0x88
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rax
lea rax, [0x0062e740]
mov qword [rsp], rax
nop dword [rax]
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x13
lea rcx, [0x0065e5a6]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
lea rcx, [0x0061b9a0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1770]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1760]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1750]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00498100
Function at 0x498320
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4984ce
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x498489
movzx ecx, byte [rsp + 0x68]
test cl, cl
je 0x49836c
nop
test rax, 0x60
jne 0x49846d
bt eax, 9
jb 0x498427
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rbx, rax
and rax, 0x1f
cmp rax, 0x14
jne 0x4983f6
mov qword [rsp + 0x58], rcx
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
call fcn.00499240
cmp qword [rsp + 0x18], 0
je 0x4983d6
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
test rcx, rcx
je 0x4983c2
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
call fcn.00496a40
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [0x0065b34d]
mov qword [rsp], rcx
mov qword [rsp + 8], 9
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
call fcn.0048da00
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x498380
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1780]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x0062e740]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x17
lea rcx, [0x0066008c]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
lea rcx, [0x0061b9a0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00498320
Function at 0x498500
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4986d4
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, rax
and rax, 0x1f
mov qword [rsp + 0x10], rax
nop dword [rax]
cmp rax, 0x12
ja 0x4985c0
cmp rax, 0x11
je 0x4985a6
cmp rax, 0x12
jne 0x498656
mov rax, qword [rsp + 0x28]
cmp qword [rax], 8
jne 0x4986b7
cmp qword [rax + 8], 0
je 0x4986b7
bt ecx, 7
jae 0x49859f
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp], rax
call fcn.004657e0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x30]
jmp 0x498582
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rax, 0x15
jne 0x498618
mov rax, qword [rsp + 0x28]
cmp qword [rax], 8
jne 0x49869b
cmp qword [rax + 8], 0
nop word [rax + rax]
je 0x49869b
bt ecx, 7
jae 0x498611
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp], rax
call fcn.00465b80
mov rax, qword [rsp + 8]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x30]
jmp 0x4985f4
cmp rax, 0x17
je 0x49863e
nop
cmp rax, 0x18
jne 0x498656
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0062e740]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x11
lea rcx, [0x0065d8ed]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
lea rcx, [0x0061b9a0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a15f0]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a15f0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00498500
Function at 0x4986e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49894e
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword [rsp + 0x88]
and rax, 0x1f
cmp rax, 0x15
je 0x498773
mov qword [rsp + 0x58], rax
nop
call fcn.00496d60
mov rax, qword [rsp]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x50], rcx
lea rdx, [0x0062e740]
mov qword [rsp], rdx
call fcn.0040e560
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x50]
mov qword [rdi + 8], rax
cmp dword [0x00811460], 0
nop dword [rax]
jne 0x498909
mov rax, qword [rsp + 0x60]
mov qword [rdi], rax
jmp 0x498913
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rbx + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
lea rax, [0x0065f8d0]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0x16
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], 0
call fcn.0049af00
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdx
test rdx, 0x80
lea rax, [rsp + 0x98]
cmovne rax, rcx
mov rcx, qword [rsp + 0x78]
cmp qword [rcx], 8
jne 0x498931
cmp qword [rcx + 8], 0
je 0x498931
mov rdx, qword [rsp + 0x88]
bt edx, 7
jae 0x4988fc
mov rbx, qword [rsp + 0x80]
mov rbx, qword [rbx]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rax
call fcn.004659e0
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x4988db
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x38]
mov rdx, qword [rsp + 0xa0]
movzx ebx, byte [rcx + 0x17]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x88]
or rcx, rdx
test rcx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
and ebx, 0x1f
or rbx, rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rax
call fcn.00499160
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 0xa8], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbx, qword [rsp + 0x80]
jmp 0x49883b
mov rax, qword [rsp + 0x60]
call fcn.0046c920
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x10], rax
lea rax, [0x0061b9a0]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a15f0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004986e0
Function at 0x498c60
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x498d88
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x498d6b
mov qword [rsp], rcx
nop
call fcn.00465b40
cmp qword [rsp + 8], 0
je 0x498d4f
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x38], rdx
mov rax, qword [rax + 0x18]
movzx ebx, byte [rcx + 0x17]
mov byte [rsp + 0x37], bl
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.00465b40
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
test rcx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
movzx edx, byte [rsp + 0x37]
and edx, 0x1f
or rcx, rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.00499160
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a17b0]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a17a0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00498c60

Function at 0x498da0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x498ec8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x498eab
mov qword [rsp], rcx
nop
call fcn.00465b40
cmp qword [rsp + 8], 0
je 0x498e8f
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x38], rdx
mov rax, qword [rax + 0x18]
movzx ebx, byte [rcx + 0x17]
mov byte [rsp + 0x37], bl
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.00465b60
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
test rcx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
movzx edx, byte [rsp + 0x37]
and edx, 0x1f
or rcx, rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.00499160
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a17d0]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a17c0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00498da0
Function at 0x498ee0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x499006
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x498f9d
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov rbx, qword [rax + 0x10]
cmp qword [rcx], 8
jne 0x498fe8
cmp qword [rcx + 8], 0
je 0x498fe8
bt ebx, 7
nop
jae 0x498f45
mov rdx, qword [rdx]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
call fcn.00465a60
mov rax, qword [rsp + 0x10]
cmp dword [0x00811460], 0
nop
jne 0x498f8d
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x18], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp], rax
call fcn.00465b40
cmp qword [rsp + 8], 0
setne byte [rsp + 0x30]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
lea rdi, [rcx + 0x18]
call fcn.0046c920
jmp 0x498f6b
mov qword [rsp], rcx
call fcn.00465b40
cmp qword [rsp + 8], 0
je 0x498fcc
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
mov qword [rsp], rcx
nop dword [rax + rax]
call fcn.00465ae0
mov rcx, qword [rsp + 0x28]
jmp 0x498f6b
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a17e0]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a15f0]
mov qword [rsp + 8], rax
nop
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00498ee0
Function at 0x4993e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4995c7
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, rax
and rax, 0x1f
mov qword [rsp + 0x10], rax
nop dword [rax]
cmp rax, 0x15
ja 0x4994ed
cmp rax, 0x12
jne 0x49946e
mov rax, qword [rsp + 0x28]
cmp qword [rax], 8
jne 0x4995aa
cmp qword [rax + 8], 0
je 0x4995aa
bt ecx, 7
jae 0x499467
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x30]
jmp 0x499458
cmp rax, 0x13
jne 0x4994e1
bt ecx, 9
jb 0x4994c2
mov rax, qword [rsp + 0x28]
cmp qword [rax], 8
jne 0x49958e
cmp qword [rax + 8], 0
je 0x49958e
bt ecx, 7
jae 0x4994b9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
test rax, rax
je 0x4994aa
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x30]
nop
jmp 0x4994a2
lea rax, [0x0066ab40]
test byte [rax], al
mov rax, qword [0x0066ab40]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rax, 0x15
je 0x499430
jmp 0x499549
cmp rax, 0x16
jne 0x499520
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0
nop dword [rax]
jne 0x499430
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rax, 0x17
je 0x499532
cmp rax, 0x1a
je 0x499430
jmp 0x499549
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0062e740]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x15
lea rcx, [0x0065f288]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
lea rcx, [0x0061b9a0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a15f0]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a15f0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004993e0
Function at 0x499860
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4999e6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x50]
test rax, 0x60
je 0x499987
mov qword [rsp], rax
nop dword [rax]
call fcn.00497000
nop
mov rax, qword [rsp + 0x50]
and rax, 0x1f
cmp rax, 0x17
je 0x499913
mov qword [rsp + 0x20], rax
call fcn.00496d60
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x18], rcx
lea rdx, [0x0062e740]
mov qword [rsp], rdx
nop dword [rax]
call fcn.0040e560
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x18]
mov qword [rdi + 8], rax
cmp dword [0x00811460], 0
nop word [rax + rax]
jne 0x499996
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
jmp 0x4999a5
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
nop dword [rax]
call fcn.0048f620
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov rax, qword [rax + 0x98]
mov qword [rsp], rcx
call rax
cmp qword [rsp + 8], 8
jne 0x4999c5
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x48]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x68]
mov qword [rdi + 0x10], rax
cmp dword [0x00811460], 0
jne 0x49997a
mov rax, qword [rsp + 0x58]
mov qword [rdi], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x58]
nop
call fcn.0046c920
jmp 0x499970
bt eax, 8
jae 0x499899
jmp 0x4998a5
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.0046c920
mov rax, qword [rsp + 0x20]
mov qword [rdi + 0x10], rax
lea rax, [0x0061b9a0]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
nop
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a17f0]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00499860
Function at 0x499a00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x499b86
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x50]
test rax, 0x60
je 0x499b27
mov qword [rsp], rax
nop dword [rax]
call fcn.00497000
nop
mov rax, qword [rsp + 0x50]
and rax, 0x1f
cmp rax, 0x17
je 0x499ab3
mov qword [rsp + 0x20], rax
call fcn.00496d60
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x18], rcx
lea rdx, [0x0062e740]
mov qword [rsp], rdx
nop dword [rax]
call fcn.0040e560
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x18]
mov qword [rdi + 8], rax
cmp dword [0x00811460], 0
nop word [rax + rax]
jne 0x499b36
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
jmp 0x499b45
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
nop dword [rax]
call fcn.0048f620
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov rax, qword [rax + 0x98]
mov qword [rsp], rcx
call rax
cmp qword [rsp + 8], 5
jne 0x499b65
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x48]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x68]
mov qword [rdi + 0x10], rax
cmp dword [0x00811460], 0
jne 0x499b1a
mov rax, qword [rsp + 0x58]
mov qword [rdi], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x58]
nop
call fcn.0046c920
jmp 0x499b10
bt eax, 8
jae 0x499a39
jmp 0x499a45
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.0046c920
mov rax, qword [rsp + 0x20]
mov qword [rdi + 0x10], rax
lea rax, [0x0061b9a0]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
nop
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1800]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00499a00
Function at 0x49a360
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49a4f1
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x49a4ac
bt eax, 9
nop word [rax + rax]
jae 0x49a454
sar rax, 0xa
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rcx + 0x17]
and edx, 0x1f
cmp rdx, 0x14
jne 0x49a3fb
mov rdx, qword [rcx + 0x38]
cmp qword [rcx + 0x40], rax
jbe 0x49a490
mov eax, dword [rdx + rax*8 + 4]
mov qword [rsp], rcx
mov dword [rsp + 8], eax
call fcn.00467a00
mov rax, qword [rsp + 0x10]
lea rcx, [0x006a9ea0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x20], rax
mov qword [rsp], rcx
call fcn.0048e600
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x20]
cmp qword [rsp + 0x10], rcx
jbe 0x49a474
shl rcx, 4
mov eax, dword [rax + rcx + 4]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rcx
mov dword [rsp + 8], eax
call fcn.00467a00
mov rax, qword [rsp + 0x10]
lea rcx, [0x006a9ea0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006a9ea0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1720]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1720]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x0062e740]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x12
lea rcx, [0x0065deab]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
lea rcx, [0x0061b9a0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.0049a360