joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63b3e0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x63b57e
sub esp, 0x34
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov byte [esp + 4], 0xa
call fcn.0063b200
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0xc]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
cmp dword [0x967818], eax
jne 0x63b4e3
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x96781c]
mov edx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00404290
movzx eax, byte [esp + 0xc]
test al, al
je 0x63b4cb
mov eax, dword [esp + 0x20]
test eax, eax
je 0x63b49c
mov ecx, dword [esp + 0x30]
lea edx, [eax + ecx - 1]
cmp byte [edx], 0xd
jne 0x63b498
mov edx, dword [esp + 0x38]
mov ebx, dword [edx + 0x14]
test ebx, ebx
je 0x63b565
dec ebx
mov dword [edx + 0x14], ebx
lea ebp, [eax - 1]
jmp 0x63b4a2
mov ebp, eax
jmp 0x63b4a2
mov ecx, dword [esp + 0x30]
mov ebp, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebp
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], eax
mov byte [esp + 0x48], 1
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
add esp, 0x34
ret
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
test ebp, ebp
jne 0x63b50e
test ecx, ecx
je 0x63b4f1
xor ebp, ebp
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], edi
mov byte [esp + 0x48], 0
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], esi
add esp, 0x34
ret
lea eax, [ebp + ebx - 1]
cmp byte [eax], 0xa
jne 0x63b537
cmp ebp, 1
jle 0x63b52c
lea eax, [ebp + ebx - 2]
cmp byte [eax], 0xd
jne 0x63b52c
mov eax, 2
jmp 0x63b531
mov eax, 1
sub ebp, eax
cmp edi, ebp
jb 0x63b55c
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], edi
mov byte [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
add esp, 0x34
ret
mov ecx, ebp
mov edx, edi
call fcn.00468f10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b08c8]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.0063b3e0
Function at 0x644c20
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x644db9
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.00645b70
mov eax, dword [esp + 0xc]
test eax, eax
je 0x644d86
mov eax, dword [esp + 0x14]
test eax, eax
je 0x644d72
jle 0x644c94
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp], eax
lea ecx, [0x73a4b5]
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
call fcn.004034e0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x644cc7
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x749ca0]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov eax, dword [esp + 0x18]
dec eax
mov ecx, eax
neg eax
sar eax, 0x1f
and eax, 1
mov edx, dword [esp + 0x1c]
add eax, edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00645b70
mov eax, dword [esp + 0xc]
test eax, eax
je 0x644d3f
mov eax, dword [esp + 0x14]
test eax, eax
je 0x644d2b
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2c
lea ecx, [0x74c38d]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
add esp, 0x20
ret
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x20
lea ecx, [0x746d72]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
add esp, 0x20
ret
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x73fe3d]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
call fcn.00467a60
jmp fcn.00644c20
Function at 0x654260
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x654426
sub esp, 0x40
mov eax, dword [esp + 0x44]
movzx ecx, byte [eax + 0x54]
test cl, cl
jne 0x65428e
mov ecx, dword [eax + 0x1c]
test ecx, ecx
ja 0x6543bb
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x3c]
mov ebx, dword [eax + 0x34]
mov byte [esp], 5
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call fcn.00654430
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x6543a7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test ecx, ecx
sete cl
seta dl
mov ebx, dword [esp + 0x44]
cmp dword [ebx + 0x24], eax
xchg ebp, ebx
setb bl
xchg ebp, ebx
and ecx, ebp
or edx, ecx
test dl, dl
jne 0x65434c
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x30], edx
nop
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x34], ebp
mov dword [ebx + 0x20], eax
mov dword [esp], ebx
call fcn.00653410
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x44]
mov dword [ecx + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [ecx + 0x3c], eax
mov eax, dword [0x995310]
test eax, eax
jne 0x654324
mov eax, dword [esp + 0x34]
jmp 0x654335
call fcn.00468e70
mov eax, dword [esp + 0x34]
mov dword [edi], eax
mov edx, dword [ecx + 0x34]
mov dword [edi + 4], edx
mov dword [ecx + 0x34], eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
add esp, 0x40
ret
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x23
lea ecx, [0x7484b5]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
lea eax, [0x70c520]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.00409b00
mov eax, dword [esp + 8]
lea ecx, [0x7b1330]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
add esp, 0x40
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
add esp, 0x40
ret
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x47
lea ecx, [0x7518a5]
mov dword [eax], ecx
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
lea ecx, [0x7b0bb8]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
lea eax, [0x70c520]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.00409b00
mov eax, dword [esp + 8]
lea ecx, [0x7b1330]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
add esp, 0x40
ret
call fcn.00467a60
jmp fcn.00654260
Function at 0x662120
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66221a
sub esp, 0x10
mov ebx, dword [esp + 0x14]
movzx ebp, byte [ebx]
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x662201
movzx ebp, word [esp + 0x18]
xor eax, eax
jmp 0x662158
lea eax, [ecx + 1]
mov ebx, dword [esp + 0x14]
mov esi, dword [ebx + 0x10]
mov ecx, eax
mov eax, 0xaaaaaaab
imul esi
add esi, edx
sar esi, 2
cmp ecx, esi
jge 0x6621d0
mov edx, dword [ebx + 0x14]
lea eax, [ecx + ecx*2]
shl eax, 1
lea esi, [eax + 2]
cmp edx, esi
jb 0x6621fa
cmp eax, esi
ja 0x6621f3
mov dword [esp + 0xc], edx
mov edi, dword [ebx + 0xc]
sub edx, eax
mov dword [esp + 8], edx
neg edx
sar edx, 0x1f
and edx, eax
add eax, 6
movzx edx, word [edi + edx]
mov ebx, dword [esp + 0xc]
cmp ebx, eax
jb 0x6621ea
cmp eax, esi
jb 0x6621e1
mov ebx, dword [esp + 8]
add ebx, 0xfffffffe
neg ebx
sar ebx, 0x1f
and esi, ebx
rol dx, 8
mov ebx, dword [edi + esi]
cmp bp, dx
jne 0x662151
bswap ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 1
add esp, 0x10
ret
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
add esp, 0x10
ret
mov ecx, eax
mov eax, esi
call fcn.00468f30
mov ecx, eax
mov edx, ebx
call fcn.00468f10
mov ecx, esi
call fcn.00468f30
mov ecx, esi
call fcn.00468f10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0750]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.00662120
Function at 0x662230
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x662362
sub esp, 0x18
mov ebx, dword [esp + 0x1c]
movzx ebp, byte [ebx]
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x662349
mov edx, dword [esp + 0x20]
xor eax, eax
jmp 0x66226f
mov ebp, dword [esp + 0x14]
lea eax, [ebp + 1]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebp, dword [ebx + 0x10]
mov ecx, eax
mov eax, 0xaaaaaaab
mov esi, edx
imul ebp
add ebp, edx
sar ebp, 2
cmp ecx, ebp
jge 0x662315
mov edx, dword [ebx + 0x14]
lea eax, [ecx + ecx*2]
shl eax, 1
lea ebp, [eax + 2]
cmp edx, ebp
jb 0x662342
cmp eax, ebp
ja 0x66233b
mov dword [esp + 0x14], edx
mov edi, dword [ebx + 0xc]
sub edx, eax
mov dword [esp + 0x10], edx
neg edx
sar edx, 0x1f
and edx, eax
add eax, 6
movzx edx, word [edi + edx]
mov ebx, dword [esp + 0x14]
cmp ebx, eax
jb 0x662332
cmp eax, ebp
jb 0x662329
mov dword [esp + 0x14], ecx
mov eax, dword [esi]
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffffe
neg ecx
sar ecx, 0x1f
and ebp, ecx
rol dx, 8
mov ecx, dword [edi + ebp]
bswap ecx
mov word [esp], dx
mov dword [esp + 4], ecx
mov edx, esi
call eax
mov eax, dword [esp + 8]
test eax, eax
je 0x662260
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
add esp, 0x18
ret
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
add esp, 0x18
ret
mov ecx, eax
mov eax, ebp
call fcn.00468f30
mov ecx, eax
mov edx, ebx
call fcn.00468f10
mov ecx, ebp
call fcn.00468f30
mov ecx, ebp
call fcn.00468f10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0750]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.00662230
Function at 0x66a230
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66a3fe
sub esp, 0x34
mov eax, 0
mov dword [esp + 0x30], eax
mov byte [esp + 0x1f], 0
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x34]
mov ebx, dword [ecx + 0x38]
test ebx, ebx
sete bl
test edx, edx
sete dl
and ebx, edx
test bl, bl
je 0x66a27d
mov ecx, 3
mov edx, 0x7e11d600
jmp 0x66a283
mov edx, dword [ecx + 0x34]
mov ecx, dword [ecx + 0x38]
lea eax, [0x7b23f0]
mov dword [esp], eax
lea eax, [0x994f00]
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
call fcn.00493600
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov byte [esp + 0x1f], 1
movzx eax, byte [0x994f21]
nop
test al, al
je 0x66a30c
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
mov dword [esp], ecx
lea ecx, [0x74929a]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x25
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.00674e10
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.006745f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x66a3a0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
test eax, eax
je 0x66a347
mov eax, dword [eax + 4]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
movzx eax, byte [0x994f21]
test al, al
je 0x66a392
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
mov dword [esp], ecx
lea ecx, [0x74b1c8]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x29
lea ecx, [esp + 0x28]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 1
call fcn.00674e10
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.0066af00
jmp 0x66a3e4
movzx eax, byte [0x994f21]
nop
test al, al
je 0x66a3e4
mov eax, dword [esp + 0x38]
mov eax, dword [eax]
mov dword [esp], eax
lea eax, [0x7492bf]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x25
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.00674e10
mov byte [esp + 0x1f], 0
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
call eax
add esp, 0x34
ret
call fcn.00467a60
jmp fcn.0066a230
Function at 0x66fa10
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66fc41
sub esp, 0x60
mov ecx, dword [esp + 0x64]
mov dword [ecx + 0xdc], 0
mov dword [ecx + 0xe4], 0
mov byte [ecx + 0xe8], 0
lea edi, [esp + 0x30]
xor eax, eax
call fcn.004690f4
lea ecx, [0x72ce00]
mov dword [esp], ecx
mov edx, dword [esp + 0x68]
mov dword [esp + 4], edx
lea ebx, [esp + 0x30]
mov dword [esp + 8], ebx
call fcn.0040e110
xor eax, eax
xor ecx, ecx
jmp 0x66fa97
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0040e350
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x66fab2
mov ebx, dword [esp + 0x34]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
mov edx, dword [edx + 4]
xor esi, esi
jmp 0x66fc38
mov edx, dword [esp + 0x64]
mov ebx, dword [edx + 0xb0]
cmp ecx, ebx
sete cl
seta bl
cmp dword [edx + 0xac], eax
xchg ebp, ebx
setb bl
xchg ebp, ebx
and ecx, ebp
or ebx, ecx
test bl, bl
jne 0x66fb04
lea edi, [esp + 0x30]
xor eax, eax
call fcn.004690f4
lea ecx, [0x72ce00]
mov dword [esp], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 8], ecx
call fcn.0040e110
jmp 0x66fb40
mov eax, dword [0x9674f8]
mov ecx, dword [0x9674fc]
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
add esp, 0x60
ret
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0040e350
mov edx, dword [esp + 0x30]
test edx, edx
je 0x66fb8a
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov edx, dword [esp + 0x34]
mov ebx, dword [edx]
mov dword [esp + 0x28], ebx
mov edx, dword [edx + 4]
mov dword [esp + 0x14], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00666030
movzx eax, byte [esp + 0x10]
test al, al
je 0x66fb34
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x66fc1a
mov edx, dword [esp + 0x64]
mov ecx, dword [edx + 0xdc]
mov eax, dword [edx + 0xe4]
cmp eax, ecx
ja 0x66fbd9
mov ebx, dword [edx + 0xd8]
mov edx, dword [edx + 0xe0]
sub edx, eax
sub ecx, eax
mov ebp, edx
neg edx
sar edx, 0x1f
and eax, edx
add eax, ebx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], ebp
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x60
ret
call fcn.00468f30
mov dword [esp + 0x24], edx
mov ebx, dword [esp + 0x28]
lea ebp, [ebx + edx*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
mov edi, dword [esp + 0x64]
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
call fcn.0066fc50
mov eax, dword [esp + 0x24]
lea edx, [eax + 1]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
cmp edx, ebx
jl 0x66fbde
jmp 0x66fb34
lea edi, [ebp + esi*8]
mov edi, dword [edi + 4]
lea edi, [edx + edi + 0x20]
inc esi
add eax, edi
adc ecx, 0
cmp esi, ebx
jl 0x66fc27
jmp 0x66fa75
call fcn.00467a60
jmp fcn.0066fa10
Function at 0x66fc50
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66fd95
sub esp, 0x5c
movzx ecx, byte [0x994f21]
test cl, cl
je 0x66fd47
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov ecx, dword [esp + 0x68]
mov dword [esp + 4], ecx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov edx, dword [esp + 0x70]
mov dword [esp + 4], edx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.004690fa
lea eax, [0x66fda0]
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], 0x28
lea eax, [0x74aa4f]
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], 2
mov dword [esp + 0x58], 2
lea eax, [esp + 0x20]
mov dword [esp + 0x50], eax
mov eax, dword [0x96e848]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 2
lea eax, [esp + 0x44]
mov dword [esp + 0xc], eax
call fcn.004e25d0
lea edi, [esp + 0x30]
xor eax, eax
call fcn.004690fb
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x60]
mov ecx, dword [ecx + 0xec]
mov dword [esp], ecx
lea edi, [esp + 4]
lea esi, [esp + 0x30]
call fcn.004695de
call fcn.00651ce0
add esp, 0x5c
ret
call fcn.00467a60
jmp fcn.0066fc50
Function at 0x6755f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x675788
sub esp, 0x64
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x675617
mov eax, dword [eax + 0x7c]
jmp 0x675623
lea ecx, [0x7b23f0]
lea eax, [0x994f00]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], eax
lea eax, [0x6fa900]
mov dword [esp + 4], eax
lea eax, [0x994f00]
mov dword [esp + 8], eax
call ecx
lea eax, [0x706ec0]
cmp dword [esp + 0xc], eax
jne 0x675651
mov ecx, dword [esp + 0x10]
jmp 0x675653
xor ecx, ecx
test ecx, ecx
je 0x675784
mov edx, dword [ecx + 4]
test edx, edx
je 0x675784
mov dword [esp + 0x1c], ecx
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.004690fb
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
movzx edx, byte [esp + 0x70]
mov byte [esp + 0x44], dl
lea ebx, [ecx + 0x34]
mov dword [esp + 0x24], ebx
mov dword [esp], ebx
call fcn.00472830
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 0x64]
test edx, edx
je 0x6756ae
mov eax, dword [edx]
jmp 0x6756b0
xor eax, eax
test eax, eax
sete al
movzx edx, byte [esp + 0x70]
and edx, eax
mov byte [esp + 0x45], dl
test dl, dl
je 0x67575d
lea esi, [ecx + 0x7c]
mov dword [esp + 0x20], esi
lea edi, [esp + 0x28]
call fcn.004695de
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
test eax, 0x80000000
je 0x67570b
mov edx, ecx
shl ecx, 1
shl eax, 1
mov ebx, edx
shr edx, 0x1f
or eax, edx
mov edx, eax
shl eax, 1
shr ecx, 0x1f
or ecx, eax
shr edx, 0x1f
add ecx, 0xd7b17f80
adc edx, 0xd
jmp 0x675717
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ebx, ecx
mov ecx, eax
test ecx, ecx
sete al
test edx, edx
sete cl
and ecx, eax
test cl, cl
je 0x67572f
test ebx, 0x3fffffff
je 0x67575d
lea edi, [esp + 0x50]
mov esi, dword [esp + 0x20]
call fcn.004695de
lea edi, [esp]
lea esi, [esp + 0x50]
call fcn.004695de
call fcn.0048b550
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00472bb0
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx]
lea edi, [esp]
lea esi, [esp + 0x3c]
call fcn.004695de
call eax
add esp, 0x64
ret
add esp, 0x64
ret
call fcn.00467a60
jmp fcn.006755f0
Function at 0x682b30
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x682d45
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x682b86
lea ebx, [0x7b1c14]
cmp ecx, ebx
je 0x682b60
xor ecx, ecx
jmp 0x682b8b
mov edx, dword [eax + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], edx
lea ecx, [0x994f00]
mov dword [esp + 8], ecx
call fcn.00404290
movzx eax, byte [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x20]
jmp 0x682b8b
mov ecx, 1
test cl, cl
jne 0x682d10
mov ecx, dword [eax + 0x20]
lea ebx, [0x7b1c2c]
cmp ecx, ebx
jne 0x682d28
mov ebp, dword [eax + 0x24]
movzx esi, byte [ebp + 8]
xchg esi, eax
test al, al
xchg esi, eax
jne 0x682bbf
movzx esi, byte [ebp + 9]
xchg esi, eax
test al, al
xchg esi, eax
je 0x682d10
movzx esi, byte [ebp + 9]
xchg esi, eax
test al, al
xchg esi, eax
jne 0x682be0
nop
test ecx, ecx
je 0x682be0
mov eax, dword [ecx + 0x10]
mov dword [esp], ebp
call eax
mov eax, dword [esp + 0x20]
lea ebx, [0x7b1c2c]
mov edx, dword [eax + 0x28]
test edx, edx
je 0x682cf0
mov eax, dword [edx]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov ebx, dword [esp]
test eax, eax
jne 0x682cd4
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
lea eax, [0x72eb00]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [0x995310]
mov edi, dword [esp + 4]
mov dword [esp + 0x18], edi
test eax, eax
je 0x682c48
lea eax, [0x72eb00]
mov dword [esp], eax
mov dword [esp + 4], edi
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
call fcn.00411b70
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
call fcn.004694d0
lea eax, [0x7132e0]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov byte [eax + 8], 0
mov byte [eax + 9], 0
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x682c81
mov ecx, dword [esp + 0x10]
jmp 0x682c92
call fcn.00468e70
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov dword [eax + 4], ecx
lea ecx, [0x7b1c2c]
mov edx, dword [esp + 0x18]
mov dword [edx + 0x20], ecx
mov ecx, dword [0x995310]
test ecx, ecx
je 0x682cb9
call fcn.00468e70
mov dword [edi], eax
mov ecx, dword [edx + 0x24]
mov dword [edi + 4], ecx
mov dword [edx + 0x24], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
add esp, 0x1c
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x1c
ret
mov eax, dword [0x967528]
mov ecx, dword [0x96752c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add esp, 0x1c
ret
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
add esp, 0x1c
ret
mov eax, dword [0x7b1c30]
mov dword [esp], ecx
mov dword [esp + 4], eax
lea eax, [0x702f00]
mov dword [esp + 8], eax
call fcn.00409a60
nop
call fcn.00467a60
jmp fcn.00682b30