joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3210
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b33aa
sub esp, 0x3c
mov edx, dword [esp + 0x4c]
cmp edx, 8
ja 0x4b3391
movzx ebx, byte [esp + 0x50]
test bl, bl
je 0x4b324b
mov ebp, dword [esp + 0x48]
cmp ebp, 4
je 0x4b324f
jmp 0x4b3379
mov ebp, dword [esp + 0x48]
mov eax, ebp
mov ebp, dword [esp + 0x40]
mov ecx, dword [ebp + 0x1c]
add ecx, edx
cmp dword [0x995030], ecx
jl 0x4b326a
mov ecx, dword [esp + 0x44]
xor esi, esi
jmp 0x4b3298
mov byte [esp + 0x54], 0
add esp, 0x3c
ret
mov dword [ebp + 4], edi
lea esi, [edi + edi*2]
lea edi, [eax + esi*8 - 0x18]
lea esi, [esp + 0x24]
call fcn.004695d4
inc dword [ebp + 0x1c]
lea esi, [edx + 1]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
cmp edx, esi
jle 0x4b3370
mov edi, ecx
mov ecx, esi
mov edx, 1
shl edx, cl
cmp ecx, 0x20
sbb ebp, ebp
and edx, ebp
test bl, dl
je 0x4b32bd
mov edx, 3
jmp 0x4b32c2
mov edx, 2
mov ebp, edi
lea edi, [esp + 0x24]
xor eax, eax
call fcn.004690fa
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x48]
mov edx, esi
imul esi, ecx
lea eax, [ebp + esi]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov ebp, dword [esp + 0x40]
mov esi, dword [ebp + 0x1c]
mov dword [esp + 0x34], esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 4]
inc edi
mov eax, dword [ebp]
cmp esi, edi
jae 0x4b3273
mov dword [esp + 0x20], edx
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], 1
lea eax, [0x71ffc0]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x40]
mov dword [ebx + 8], eax
mov eax, dword [0x995310]
test eax, eax
je 0x4b3354
call fcn.00468e70
mov dword [edi], ecx
mov ebp, dword [ebx]
mov dword [edi + 4], ebp
mov dword [ebx], ecx
movzx ebx, byte [esp + 0x50]
mov ebp, dword [esp + 0x40]
mov edi, edx
mov eax, ecx
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x20]
jmp 0x4b3273
mov byte [esp + 0x54], 1
add esp, 0x3c
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b04b8]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b04a8]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004b3210
Function at 0x4b5560
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0xb4]
cmp eax, dword [ecx + 8]
jbe 0x4b574b
sub esp, 0x134
mov eax, dword [esp + 0x148]
test eax, 0x200
je 0x4b5732
mov ecx, eax
and eax, 0x1e0
mov edx, dword [esp + 0x140]
movzx ebx, byte [edx + 0xf]
and ebx, 0x1f
or ebx, eax
mov dword [esp + 0x70], ebx
mov dword [esp], edx
mov eax, dword [esp + 0x144]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.004bcb70
mov eax, dword [esp + 0xc]
lea ecx, [0x7b31a4]
cmp eax, ecx
jne 0x4b5716
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], ecx
lea edx, [0x4c00a0]
mov dword [esp + 0x6c], edx
nop
lea edi, [esp + 0xd8]
xor eax, eax
call fcn.004690e9
mov ecx, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.004b8600
lea edi, [esp + 0xd8]
lea esi, [esp + 0x10]
call fcn.0046952a
lea edi, [esp + 0x7c]
lea esi, [esp + 0xd8]
call fcn.0046952a
lea ecx, [0x712760]
mov dword [esp], ecx
call fcn.0040c500
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x6c]
mov dword [ecx], edx
mov edx, dword [0x995310]
mov ebx, dword [esp + 0xd0]
test edx, edx
je 0x4b565c
call fcn.00468e60
mov dword [edi], ebx
mov dword [ecx + 4], ebx
mov eax, dword [esp + 0xc4]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x148]
sar eax, 0xa
mov dword [ecx + 0x10], eax
mov ebx, dword [esp + 0x70]
mov dword [ecx + 0x1c], ebx
mov ebp, dword [0x995310]
test ebp, ebp
jne 0x4b5697
mov ebp, dword [esp + 0x140]
mov esi, dword [esp + 0x144]
jmp 0x4b56af
call fcn.00468e70
mov ebp, dword [esp + 0x140]
mov dword [edi], ebp
mov esi, dword [esp + 0x144]
mov dword [edi + 4], esi
mov dword [esp + 0x78], ecx
mov dword [ecx + 0x14], ebp
mov dword [ecx + 0x18], esi
mov edx, dword [esp + 0x138]
mov dword [esp], edx
mov edx, dword [esp + 0x13c]
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
call fcn.004b9bc0
mov eax, dword [esp + 0x74]
test byte [eax], al
mov dword [esp + 0x14c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x150], eax
mov eax, dword [esp + 0x148]
and eax, 0x60
or eax, 0x13
mov dword [esp + 0x154], eax
add esp, 0x134
ret
mov ecx, dword [0x7b31a8]
mov dword [esp], eax
mov dword [esp + 4], ecx
lea eax, [0x72e1a0]
mov dword [esp + 8], eax
call fcn.00409a60
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b04c8]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004b5560
Function at 0x4b5f70
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b606d
sub esp, 0x7c
lea edi, [esp + 0x8c]
xor eax, eax
call fcn.004690f3
mov ecx, dword [esp + 0x80]
movzx edx, byte [ecx + 0xf]
and edx, 0x1f
cmp edx, 0x19
jne 0x4b600c
lea edi, [esp + 0x48]
call fcn.004690f3
mov ecx, dword [esp + 0x80]
mov dword [esp], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 8], ecx
call fcn.004b6df0
movzx ecx, byte [esp + 0x40]
mov byte [esp + 0x47], cl
lea edi, [esp + 0x48]
lea esi, [esp + 0xc]
call fcn.0046958e
lea edi, [esp + 0x8c]
lea esi, [esp + 0x48]
call fcn.0046958e
movzx ecx, byte [esp + 0x47]
mov byte [esp + 0xc0], cl
add esp, 0x7c
ret
mov dword [esp], ecx
call fcn.004b5980
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x74a8bf]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x28
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.00452120
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004b5f70
Function at 0x4b9530
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b962b
sub esp, 0x2c
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4b95c8
test eax, 0x60
jne 0x4b955a
add esp, 0x2c
ret
call fcn.004b9350
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp], 0
lea edx, [0x73baac]
mov dword [esp + 4], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0x74c0a1]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x2c
call fcn.004521c0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
call fcn.004b9350
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
mov ecx, dword [esp]
mov dword [esp + 0x28], ecx
lea edx, [0x70a680]
mov dword [esp], edx
call fcn.0040c500
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x4b961e
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x6fc440]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
call fcn.00468e60
mov ecx, dword [esp + 0x28]
mov dword [edi], ecx
jmp 0x4b95ff
call fcn.00467a60
jmp fcn.004b9530
Function at 0x4b9640
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b97b4
sub esp, 0x2c
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4b9751
test eax, 0x60
jne 0x4b96e3
test eax, 0x100
je 0x4b9675
add esp, 0x2c
ret
call fcn.004b9350
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp], 0
lea edx, [0x73baac]
mov dword [esp + 4], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0x7436f6]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x1a
call fcn.004521c0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
call fcn.004b9350
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp], 0
lea edx, [0x73baac]
mov dword [esp + 4], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0x74c0a1]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x2c
call fcn.004521c0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
call fcn.004b9350
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
mov ecx, dword [esp]
mov dword [esp + 0x28], ecx
lea edx, [0x70a680]
mov dword [esp], edx
call fcn.0040c500
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x4b97a7
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x6fc440]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
call fcn.00468e60
mov ecx, dword [esp + 0x28]
mov dword [edi], ecx
jmp 0x4b9788
call fcn.00467a60
jmp fcn.004b9640

Function at 0x4b97c0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b9829
sub esp, 0xc
mov eax, dword [esp + 0x18]
test eax, 0x100
je 0x4b9810
and eax, 0x60
or eax, 0x16
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call fcn.004b7030
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
add esp, 0xc
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b04e0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004b97c0
Function at 0x4b98d0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b9a94
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
nop
cmp eax, 0x11
jne 0x4b9985
mov eax, dword [esp + 0x10]
movzx edx, byte [eax + 0xf]
and edx, 0x1f
cmp edx, 0x12
ja 0x4b991e
cmp edx, 0x11
jne 0x4b9914
mov edx, dword [eax + 0x20]
jmp 0x4b993e
cmp edx, 0x12
jne 0x4b993c
mov edx, dword [eax + 0x20]
jmp 0x4b993e
cmp edx, 0x15
jne 0x4b9928
mov edx, dword [eax + 0x24]
jmp 0x4b993e
cmp edx, 0x16
jne 0x4b9932
mov edx, dword [eax + 0x20]
jmp 0x4b993e
cmp edx, 0x17
jne 0x4b993c
mov edx, dword [eax + 0x20]
jmp 0x4b993e
xor edx, edx
movzx edx, byte [edx + 0xf]
and edx, 0x1f
cmp edx, 8
jne 0x4b9a7b
test ecx, 0x100
je 0x4b9a63
mov eax, dword [eax + 0x28]
test eax, eax
jl 0x4b9a5e
mov ecx, dword [esp + 0x14]
mov edx, ecx
neg ecx
cmp eax, ecx
ja 0x4b9a50
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
add esp, 0xc
ret
cmp eax, 0x17
jne 0x4b9a12
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x12
ja 0x4b99b2
cmp ecx, 0x11
jne 0x4b99a8
mov eax, dword [eax + 0x20]
jmp 0x4b99d2
cmp ecx, 0x12
jne 0x4b99d0
mov eax, dword [eax + 0x20]
jmp 0x4b99d2
cmp ecx, 0x15
jne 0x4b99bc
mov eax, dword [eax + 0x24]
jmp 0x4b99d2
cmp ecx, 0x16
jne 0x4b99c6
mov eax, dword [eax + 0x20]
jmp 0x4b99d2
cmp ecx, 0x17
jne 0x4b99d0
mov eax, dword [eax + 0x20]
jmp 0x4b99d2
xor eax, eax
movzx eax, byte [eax + 0xf]
and eax, 0x1f
cmp eax, 8
jne 0x4b99fa
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
add esp, 0xc
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b04e8]
mov dword [esp + 4], eax
call fcn.00438b10
mov dword [esp + 8], eax
lea eax, [0x70a680]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x73fb45]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x6fc440]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
test edx, edx
je 0x4b9a59
call fcn.0045ff90
call fcn.00460020
call fcn.0045ff90
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b04f8]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b04f0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004b98d0
Function at 0x4ba8b0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4baa52
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov ecx, eax
and eax, 0x1f
nop
cmp eax, 0x14
je 0x4ba970
cmp eax, 0x16
jne 0x4baa13
test ecx, 0x80
je 0x4ba923
mov eax, dword [esp + 0x18]
movzx edx, byte [eax + 0xf]
test dl, 0x20
jne 0x4ba91b
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp], ecx
call fcn.00463e60
movzx eax, byte [esp + 4]
test al, al
je 0x4ba9fb
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
jmp 0x4ba92b
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x4ba954
mov eax, dword [eax + 0x20]
and ecx, 0x60
movzx ebx, byte [eax + 0xf]
and ebx, 0x1f
or ecx, ebx
or ecx, 0x180
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
add esp, 0x14
ret
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
add esp, 0x14
ret
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004012e0
mov eax, dword [esp + 4]
test eax, eax
jne 0x4ba98f
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x4ba99f
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
test ecx, ecx
je 0x4ba99c
mov ecx, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4ba9ca
movzx ecx, byte [eax + 0xf]
nop
mov edx, ecx
and ecx, 0x1f
test dl, 0x20
jne 0x4ba9c4
or ecx, 0x80
mov edx, dword [esp + 0x10]
jmp 0x4ba9d0
xor ecx, ecx
xor eax, eax
xor edx, edx
test ecx, ecx
je 0x4ba9eb
mov ebx, dword [esp + 0x20]
test ebx, 0x60
je 0x4ba9e7
mov ebx, 0x20
jmp 0x4ba9e9
xor ebx, ebx
or ecx, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
add esp, 0x14
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0538]
mov dword [esp + 4], eax
call fcn.00438b10
mov dword [esp + 8], eax
lea eax, [0x70a680]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x12
lea ecx, [0x73f2b0]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x6fc440]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004ba8b0
Function at 0x4bb2d0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bb4e3
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
cmp eax, 0x12
ja 0x4bb356
cmp eax, 0x11
je 0x4bb347
cmp eax, 0x12
jne 0x4bb460
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4bb4ca
mov eax, dword [eax + 4]
test eax, eax
je 0x4bb4ca
test ecx, 0x80
je 0x4bb32f
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4bb333
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00463860
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x15
jne 0x4bb39b
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4bb4b2
mov eax, dword [eax + 4]
test eax, eax
je 0x4bb4b2
test ecx, 0x80
je 0x4bb383
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4bb387
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00463ca0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x16
jne 0x4bb44c
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x12
ja 0x4bb3c8
cmp ecx, 0x11
jne 0x4bb3be
mov edx, dword [eax + 0x20]
jmp 0x4bb3e8
cmp ecx, 0x12
jne 0x4bb3e6
mov edx, dword [eax + 0x20]
jmp 0x4bb3e8
cmp ecx, 0x15
jne 0x4bb3d2
mov edx, dword [eax + 0x24]
jmp 0x4bb3e8
cmp ecx, 0x16
jne 0x4bb3dc
mov edx, dword [eax + 0x20]
jmp 0x4bb3e8
cmp ecx, 0x17
jne 0x4bb3e6
mov edx, dword [eax + 0x20]
jmp 0x4bb3e8
xor edx, edx
movzx edx, byte [edx + 0xf]
and edx, 0x1f
cmp edx, 0x11
jne 0x4bb49a
cmp ecx, 0x12
ja 0x4bb411
cmp ecx, 0x11
jne 0x4bb407
mov eax, dword [eax + 0x20]
jmp 0x4bb431
cmp ecx, 0x12
jne 0x4bb42f
mov eax, dword [eax + 0x20]
jmp 0x4bb431
cmp ecx, 0x15
jne 0x4bb41b
mov eax, dword [eax + 0x24]
jmp 0x4bb431
cmp ecx, 0x16
jne 0x4bb425
mov eax, dword [eax + 0x20]
jmp 0x4bb431
cmp ecx, 0x17
jne 0x4bb42f
mov eax, dword [eax + 0x20]
jmp 0x4bb431
xor eax, eax
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x11
jne 0x4bb442
mov eax, dword [eax + 0x28]
jmp 0x4bb444
xor eax, eax
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x18
jne 0x4bb460
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x70a680]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x11
lea ecx, [0x73ebb9]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x6fc440]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0568]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0480]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0480]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004bb2d0
Function at 0x4bb990
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bba48
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4bba2f
lea ecx, [eax + 0xc]
mov dword [esp], ecx
call fcn.00463c40
mov eax, dword [esp + 4]
test eax, eax
je 0x4bba17
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 8]
test edx, 0x60
je 0x4bb9db
mov edx, 0x20
jmp 0x4bb9dd
xor edx, edx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x20]
movzx ebx, byte [ecx + 0xf]
and ebx, 0x1f
or edx, ebx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.004bbcc0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
add esp, 0x18
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0578]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0570]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004bb990

Function at 0x4bba60
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bbb18
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4bbaff
lea ecx, [eax + 0xc]
mov dword [esp], ecx
call fcn.00463c70
mov eax, dword [esp + 4]
test eax, eax
je 0x4bbae7
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 8]
test edx, 0x60
je 0x4bbaab
mov edx, 0x20
jmp 0x4bbaad
xor edx, edx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x24]
movzx ebx, byte [ecx + 0xf]
and ebx, 0x1f
or edx, ebx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.004bbcc0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
add esp, 0x18
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0588]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0580]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004bba60
Function at 0x4bbb30
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bbc13
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4bbbfa
mov edx, dword [eax + 0x14]
lea ebx, [eax + 0xc]
mov dword [esp + 0xc], ebx
test edx, edx
jne 0x4bbb91
mov edx, dword [eax]
cmp dword [edx], 4
jne 0x4bbbe2
mov ebp, dword [edx + 4]
test ebp, ebp
je 0x4bbbe2
mov eax, dword [eax + 4]
test ecx, 0x80
je 0x4bbb7f
mov eax, dword [eax]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
call fcn.00463bd0
jmp 0x4bbbad
mov dword [esp], ebx
call fcn.00463c40
mov eax, dword [esp + 4]
test eax, eax
je 0x4bbbca
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00463c10
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00463c40
mov eax, dword [esp + 4]
test eax, eax
setne al
mov byte [esp + 0x18], al
add esp, 0x10
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0598]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0480]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0590]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004bbb30
Function at 0x4bbe90
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bc05b
sub esp, 0x10
movzx eax, byte [0x96ed30]
nop
test al, al
je 0x4bbeeb
lea eax, [0x6f48a0]
mov dword [0x96ed34], eax
mov eax, dword [0x995310]
test eax, eax
jne 0x4bbecf
mov eax, dword [esp + 0x18]
jmp 0x4bbee3
call fcn.00468e70
mov eax, dword [esp + 0x18]
mov dword [edi], eax
mov ecx, dword [0x96ed38]
mov dword [edi + 4], ecx
mov dword [0x96ed38], eax
jmp 0x4bbeef
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, ecx
and ecx, 0x1f
mov dword [esp + 0xc], ecx
nop
cmp ecx, 0x15
ja 0x4bbf6b
cmp ecx, 0x12
jne 0x4bbf10
mov ecx, dword [esp + 0x14]
jmp 0x4bbfb0
cmp ecx, 0x13
jne 0x4bbf5c
test edx, 0x200
jne 0x4bbf4e
nop
mov ecx, dword [esp + 0x14]
cmp dword [ecx], 4
jne 0x4bc042
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x4bc042
test edx, 0x80
je 0x4bbf40
mov eax, dword [eax]
test eax, eax
je 0x4bbf46
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x4c00a0]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp ecx, 0x15
jne 0x4bbff0
mov ecx, dword [esp + 0x14]
jmp 0x4bbfb0
cmp ecx, 0x16
jne 0x4bbfa2
mov ecx, dword [esp + 0x14]
mov ebx, dword [ecx + 4]
test ebx, ebx
jne 0x4bbfb0
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.00463e60
movzx eax, byte [esp + 4]
test al, al
je 0x4bc02a
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp ecx, 0x17
je 0x4bbfce
cmp ecx, 0x1a
jne 0x4bbff0
mov ecx, dword [esp + 0x14]
cmp dword [ecx], 4
jne 0x4bbfd8
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x4bbfd8
test edx, 0x80
je 0x4bbfc6
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0480]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x70a680]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x15
lea ecx, [0x740b89]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x6fc440]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b05a0]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0480]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004bbe90