joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466320
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403e43
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409be0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403e20
cmp byte [0x0069660a], 0
je 0x466335
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x463560
jmp 0x403e20

Function at 0x466340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00696920]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0069660a], 0
je 0x466375
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00696c40]
aesenc xmm0, xmmword [0x00696c50]
aesenc xmm0, xmmword [0x00696c60]
movq rax, xmm0
ret
jmp 0x409e00

Function at 0x466380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00696920]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0069660a], 0
je 0x4663b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00696c40]
aesenc xmm0, xmmword [0x00696c50]
aesenc xmm0, xmmword [0x00696c60]
movq rax, xmm0
ret
jmp 0x409e60

Function at 0x468140
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x468174
mov rcx, 0x28
jmp 0x46817f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00696838], rcx
pop rbp
ret
Function at 0x46af40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43aacb
push rbp
mov rbp, rsp
sub rsp, 0x28
nop
mov qword [0x00696a70], 0xf
nop
mov qword [0x00696ab0], 0x10
mov qword [rsp + 0x20], r14
mov dword [0x00612bf8], 0x2710
lea rax, [0x006969a0]
call fcn.00448640
lea rax, [0x005fd3c0]
jmp 0x43a884
mov qword [rsp + 0x18], rax
call fcn.00451120
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx + 0x248]
test rax, rax
jne 0x43a86e
xor eax, eax
jmp 0x43a8aa
mov rcx, rax
shl rcx, 6
lea rdx, [0x00696cc0]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 8]
inc rax
movups xmmword [rcx], xmm15
cmp rax, 2
jl 0x43a88d
xor eax, eax
jmp 0x43a8cc
mov rcx, rax
shl rcx, 4
lea rdx, [0x00697628]
add rcx, rdx
inc rax
movups xmmword [rcx], xmm15
cmp rax, 0x23
jl 0x43a8b4
call fcn.0040c6a0
nop
xor eax, eax
xor ebx, ebx
nop dword [rax]
call fcn.00401aa0
movzx eax, byte [0x00696d8d]
mov byte [0x0069660d], al
movzx eax, byte [0x00696d92]
mov byte [0x0069660e], al
movzx eax, byte [0x00696d8a]
mov byte [0x0069660f], al
call fcn.00448140
call fcn.00404b60
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rcx
call fcn.0043abe0
call fcn.00450f00
call fcn.0045d3a0
call fcn.0040ab80
nop dword [rax]
call fcn.0044f500
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x30]
test byte [rax], al
call fcn.00433540
call fcn.00448ec0
call fcn.004195c0
mov eax, 0x4000
call fcn.0044c980
mov qword [0x00611fe0], rax
mov qword [0x00611fe8], rbx
add rax, 0x3e8
mov qword [0x00611ff0], rax
mov qword [0x00611ff8], rax
cmp byte [0x00601a40], 0
je 0x43a99f
mov qword [0x005fc378], 0
nop
nop
lea rax, [0x00612bd8]
call fcn.0040bd80
nop
call fcn.00468100
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp]
nop
lea rdx, [0x00612bc8]
xchg qword [rdx], rcx
mov ecx, dword [0x0069666c]
mov dword [rsp + 0x14], ecx
lea rax, [0x004dfd04]
mov ebx, 0xa
call fcn.00407fa0
call fcn.00450020
movsxd rcx, eax
cmp rax, rcx
sete cl
mov edx, 0
cmove edx, eax
and ecx, ebx
test cl, cl
je 0x43aa0f
test edx, edx
jg 0x43aa13
mov edx, dword [rsp + 0x14]
mov eax, edx
call fcn.00444820
nop word [rax + rax]
test rax, rax
jne 0x43aab9
nop
nop
lea rax, [0x00612bd8]
call fcn.0040bfe0
cmp qword [0x00601e08], 0
nop
jne 0x43aa76
mov qword [0x00601e08], 7
cmp dword [0x00696870], 0
je 0x43aa68
mov rax, qword [str.go1.22.0]
nop dword [rax]
call fcn.00466440
mov qword [r11], rax
lea rax, [0x004df58e]
mov qword [str.go1.22.0], rax
cmp qword [0x00601ec8], 1
nop
jne 0x43aab3
mov qword [0x00601ec8], 0
cmp dword [0x00696870], 0
je 0x43aaa8
mov rax, qword [0x00601ec0]
nop dword [rax]
call fcn.00466440
mov qword [r11], rax
mov qword [0x00601ec0], 0
add rsp, 0x28
pop rbp
ret
lea rax, [0x004e9419]
mov ebx, 0x2b
call fcn.00437040
nop
call fcn.00464520
jmp 0x43a820
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x43a820
Function at 0x4767e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476a4e
push rbp
mov rbp, rsp
sub rsp, 0x38
test rdi, rdi
jl 0x476a3a
nop dword [rax + rax]
cmp rdi, 9
jg 0x476a27
test ebx, ebx
jne 0x476819
movups xmmword [rax + 0x18], xmm15
add rsp, 0x38
pop rbp
ret
mov edx, ebx
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
bsr rdx, rdx
cmp rdx, 0x19
jge 0x47684e
lea rsi, [rdx - 0x19]
neg rsi
mov r8, rcx
mov rcx, rsi
shl ebx, cl
lea rdx, [rdx + r8]
lea rdx, [rdx - 0x19]
cmp rcx, 0x20
sbb esi, esi
and ebx, esi
jmp 0x476851
mov rdx, rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rdi
imul rsi, rdx, 0x13441
add rsi, 0x1ce618
sar rsi, 0x12
mov rcx, rdi
sub rcx, rsi
mov qword [rsp + 0x30], rcx
lea rsi, [rcx - 1]
nop dword [rax]
cmp rsi, 0x1b
jg 0x47688f
test rsi, rsi
setge r8b
jmp 0x476892
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x23], r8b
mov dword [rsp + 0x24], ebx
mov eax, ebx
mov rbx, rdx
mov rcx, rsi
call fcn.004779e0
test rbx, rbx
jge 0x476a14
mov rdx, qword [rsp + 0x30]
lea r8, [rdx + 9]
nop
cmp r8, 0xa
jae 0x4768e5
mov r8d, dword [rsp + 0x24]
mov r8d, r8d
test r8, r8
je 0x4769c3
mov r9, qword [rsp + 0x28]
neg r9
nop
jmp 0x4769e0
movzx esi, byte [rsp + 0x23]
mov r8, rbx
neg rbx
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9d, cl
mov r10d, eax
shr eax, cl
cmp rcx, 0x20
sbb ebx, ebx
and r9d, ebx
dec r9d
and ebx, eax
and r9d, r10d
test sil, sil
je 0x476962
lea rcx, [r8 + 1]
neg rcx
mov r8d, 1
shl r8d, cl
cmp rcx, 0x20
sbb r10d, r10d
and r8d, r10d
cmp r8d, r9d
jb 0x476953
jne 0x47695b
test dil, dil
je 0x476953
nop
cmp r8d, r9d
jne 0x47695b
test dil, dil
je 0x47695b
mov r8d, ebx
and r8d, 1
jmp 0x476984
mov r8d, 1
jmp 0x476984
xor r8d, r8d
nop
jmp 0x476984
lea rcx, [r8 + 1]
neg rcx
mov r10d, r9d
shr r9d, cl
cmp rcx, 0x20
sbb r11d, r11d
and r9d, r11d
cmp r9d, 1
sete r8b
mov r9d, r10d
test r9d, r9d
je 0x47698b
xor edi, edi
xor edi, 1
mov rax, qword [rsp + 0x48]
mov ecx, edi
mov edi, r8d
mov rsi, qword [rsp + 0x60]
nop dword [rax]
call fcn.00476d20
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x30]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
add rsp, 0x38
pop rbp
ret
mov esi, 1
mov ecx, 1
jmp 0x4768ea
dec r9
mov eax, esi
mov r8, rdx
mov rdx, rdi
nop dword [rax]
test r9, r9
jle 0x4769c3
mov esi, eax
movabs rax, 0xcccccccccccccccd
mov rdi, rdx
mul r8
shr rdx, 2
lea r10, [rdx + rdx*4]
nop
cmp r8, r10
je 0x4769d2
mov eax, esi
mov rdx, rdi
movzx esi, byte [rsp + 0x23]
jmp 0x4768ea
lea rax, [0x004c3600]
lea rbx, [0x005098e8]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x005098d8]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x005098c8]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464520
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004767e0
Function at 0x476a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476cdc
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp rdi, 0x12
jg 0x476cc8
nop dword [rax]
test rbx, rbx
jne 0x476ab0
movups xmmword [rax + 0x18], xmm15
add rsp, 0x40
pop rbp
ret
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
cmp rsi, 0x37
jge 0x476aed
lea rsi, [rdx - 0x36]
neg rsi
mov r8, rcx
mov rcx, rsi
shl rbx, cl
lea rdx, [rdx + r8]
lea rdx, [rdx - 0x36]
cmp rcx, 0x40
sbb rsi, rsi
and rbx, rsi
jmp 0x476af0
mov rdx, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rdi
imul rsi, rdx, 0x13441
add rsi, 0x4105b6
sar rsi, 0x12
mov rcx, rdi
sub rcx, rsi
mov qword [rsp + 0x38], rcx
lea rsi, [rcx - 1]
nop dword [rax + rax]
cmp rsi, 0x37
jg 0x476b2f
test rsi, rsi
setge r8b
jmp 0x476b32
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x27], r8b
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov rbx, rdx
mov rcx, rsi
call fcn.00477ac0
test rbx, rbx
jge 0x476cb5
mov rdx, qword [rsp + 0x38]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x476b85
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x476c65
mov r9, qword [rsp + 0x28]
neg r9
nop dword [rax]
jmp 0x476c80
movzx esi, byte [rsp + 0x27]
mov r8, rbx
neg rbx
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9, cl
mov r10, rax
shr rax, cl
cmp rcx, 0x40
sbb rbx, rbx
and r9, rbx
dec r9
and rbx, rax
and r9, r10
test sil, sil
je 0x476c07
lea rcx, [r8 + 1]
neg rcx
mov r8d, 1
shl r8, cl
cmp rcx, 0x40
sbb r10, r10
and r8, r10
cmp r8, r9
jb 0x476bf8
jne 0x476c02
nop dword [rax]
test dil, dil
je 0x476bf8
cmp r8, r9
jne 0x476c02
test dil, dil
je 0x476c02
mov r8, rbx
and r8d, 1
jmp 0x476c29
mov r8d, 1
nop
jmp 0x476c29
xor r8d, r8d
jmp 0x476c29
lea rcx, [r8 + 1]
neg rcx
mov r10, r9
shr r9, cl
cmp rcx, 0x40
sbb r11, r11
and r9, r11
cmp r9, 1
sete r8b
mov r9, r10
test r9, r9
je 0x476c30
xor edi, edi
xor edi, 1
mov rax, qword [rsp + 0x50]
mov ecx, edi
mov edi, r8d
mov rsi, qword [rsp + 0x68]
call fcn.00476d20
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x38]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
add rsp, 0x40
pop rbp
ret
mov esi, 1
mov ecx, 1
jmp 0x476b8a
dec r9
mov rax, rsi
mov r8, rdx
mov rdx, rdi
test r9, r9
jle 0x476c65
mov rsi, rax
movabs rax, 0xcccccccccccccccd
mov rdi, rdx
mul r8
shr rdx, 2
lea r10, [rdx + rdx*4]
cmp r8, r10
je 0x476c74
mov rax, rsi
mov rdx, rdi
movzx esi, byte [rsp + 0x27]
jmp 0x476b8a
lea rax, [0x004c3600]
lea rbx, [0x00509908]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x005098f8]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00476a80
Function at 0x4779e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477a86
push rbp
mov rbp, rsp
sub rsp, 0x10
test rcx, rcx
je 0x477a5d
lea rdx, [rcx + 0x15c]
nop
cmp rdx, 0x2b7
ja 0x477a6f
shl rdx, 4
lea rsi, [0x005feec0]
mov rdx, qword [rsi + rdx + 8]
lea rsi, [rdx + 1]
test rcx, rcx
cmovl rdx, rsi
mov eax, eax
mul rdx
shl rdx, 7
mov rsi, rax
shr rsi, 0x39
or rdx, rsi
shl rax, 7
imul rsi, rcx, 0x1a935
sar rsi, 0xf
lea rbx, [rsi + rbx]
lea rbx, [rbx - 6]
test rax, rax
sete cl
mov rax, rdx
add rsp, 0x10
pop rbp
ret
shl eax, 6
add rbx, 0xfffffffffffffffa
mov ecx, 1
add rsp, 0x10
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509918]
nop dword [rax]
call fcn.00436480
nop
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov eax, dword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004779e0

Function at 0x477ac0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477b9b
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
je 0x477b74
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x477b87
shl rdx, 4
lea rsi, [0x005feec0]
add rdx, rsi
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x10], xmm0
test rcx, rcx
jge 0x477b0f
inc qword [rsp + 0x10]
mov rdx, qword [rsp + 0x10]
mov rsi, rax
mov rax, rdx
mul rsi
mov rdi, qword [rsp + 0x18]
mov r8, rax
mov rax, rdi
mov rdi, rdx
mul rsi
imul rsi, rcx, 0x1a935
sar rsi, 0xf
lea rbx, [rsi + rbx]
lea rbx, [rbx - 8]
add rax, rdi
sbb rsi, rsi
mov rdi, rax
shl rdi, 9
sub rdx, rsi
test rdi, rdi
jne 0x477b5f
test r8, r8
sete sil
jmp 0x477b61
xor esi, esi
shl rdx, 9
shr rax, 0x37
or rax, rdx
mov ecx, esi
add rsp, 0x20
pop rbp
ret
shl rax, 8
add rbx, 0xfffffffffffffff8
mov ecx, 1
add rsp, 0x20
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509928]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.00477ac0
Function at 0x47a060
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a251
push rbp
mov rbp, rsp
sub rsp, 0x78
cmp rdi, 8
ja 0x47a23d
nop dword [rax]
test sil, sil
je 0x47a08f
cmp rcx, 8
jne 0x47a22a
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x005fc3e0], rdx
jl 0x47a0cb
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
xor edx, edx
jmp 0x47a120
xor eax, eax
add rsp, 0x78
pop rbp
ret
mov qword [rax + 8], r9
lea r9, [r9 + r9*2]
movups xmm0, xmmword [rsp + 0x48]
shl r9, 4
lea r12, [r9 + r10]
lea r12, [r12 - 0x20]
lea r9, [r9 + r10]
lea r9, [r9 - 0x30]
movups xmmword [r9], xmm0
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r12], xmm0
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r12 + 0x10], xmm0
inc qword [rax + 0x38]
inc rdx
mov rcx, r8
nop dword [rax + rax]
cmp rdi, rdx
jle 0x47a21f
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
mov r8, rcx
mov rcx, rdx
mov r9d, 1
shl r9d, cl
imul rcx, r8
lea r10, [rbx + rcx]
cmp rdx, 0x20
sbb r11d, r11d
and r9d, r11d
test sil, r9b
mov r9d, 2
mov r11d, 3
cmovne r9, r11
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x58], r8
mov r9, qword [rax + 0x38]
mov qword [rsp + 0x68], r9
mov rcx, qword [rax + 0x10]
mov r9, qword [rax + 8]
inc r9
mov r10, qword [rax]
cmp rcx, r9
jae 0x47a0d3
mov qword [rsp + 0x40], rdx
mov rax, r10
mov rbx, r9
mov edi, 1
lea rsi, [0x004d6b00]
call fcn.0044bb60
mov rdx, qword [rsp + 0x88]
mov qword [rdx + 0x10], rcx
cmp dword [0x00696870], 0
je 0x47a1de
call fcn.00466460
mov qword [r11], rax
mov r8, qword [rdx]
mov qword [r11 + 8], r8
mov qword [rdx], rax
mov rdx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x98]
mov r11d, 3
mov r9, rbx
mov r10, rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
jmp 0x47a0d3
mov eax, 1
add rsp, 0x78
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509c10]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509bf0]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp fcn.0047a060
Function at 0x47ace0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x1f8]
cmp r12, qword [r14 + 0x10]
jbe 0x47af86
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x298], rdi
bt esi, 9
jae 0x47af71
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0x1b0], rdi
mov qword [rsp + 0x1a8], rcx
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0x280], rax
mov rdx, rsi
and esi, 0x1e0
movzx r8d, byte [rcx + 0x17]
and r8d, 0x1f
or r8, rsi
mov qword [rsp + 0xd0], r8
mov rax, rcx
mov rbx, rdi
mov rcx, rdx
call fcn.0047f740
lea rdx, [0x0050b120]
nop dword [rax]
cmp rax, rdx
jne 0x47af5e
mov qword [rsp + 0xe0], rbx
lea rcx, [0x0047fc80]
mov qword [rsp + 0xc8], rcx
nop
movups xmmword [rsp + 0x1b8], xmm15
lea rdi, [rsp + 0x1c0]
lea rdi, [rdi - 0x10]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466a8f
mov rbp, qword [rbp]
mov rax, rbx
xor ebx, ebx
call fcn.0047b8c0
mov rcx, qword [rsp]
mov qword [rsp + 0x1b8], rcx
lea rdi, [rsp + 0x1c0]
lea rsi, [rsp + 8]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466dc6
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x1b8]
mov qword [rsp + 0xf0], rcx
lea rdi, [rsp + 0xf8]
lea rsi, [rsp + 0x1c0]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466dc6
mov rbp, qword [rbp]
lea rax, [0x004d2220]
call fcn.0040dfe0
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x198]
cmp dword [0x00696870], 0
je 0x47ae88
nop dword [rax + rax]
call fcn.00466440
mov qword [r11], rcx
mov qword [rax + 8], rcx
mov rdx, qword [rsp + 0x180]
mov qword [rax + 0x10], rdx
movzx edx, word [rsp + 0x1a0]
mov word [rax + 0x18], dx
mov r8, qword [rsp + 0xd8]
mov rdx, r8
sar rdx, 0xa
mov qword [rax + 0x20], rdx
mov rsi, qword [rsp + 0xd0]
mov qword [rax + 0x38], rsi
cmp dword [0x00696870], 0
jne 0x47aee0
mov rcx, qword [rsp + 0x1a8]
mov rdi, qword [rsp + 0x1b0]
jmp 0x47af0c
call fcn.004664a0
mov rcx, qword [rsp + 0x1a8]
mov qword [r11], rcx
mov r9, qword [rax + 0x28]
mov qword [r11 + 8], r9
mov rdi, qword [rsp + 0x1b0]
mov qword [r11 + 0x10], rdi
mov r9, qword [rax + 0x30]
mov qword [r11 + 0x18], r9
mov qword [rsp + 0xe8], rax
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rdi
mov rbx, qword [rsp + 0x288]
mov r8, rdx
mov rax, qword [rsp + 0x280]
call fcn.0047cda0
mov rax, qword [rsp + 0xe0]
test byte [rax], al
mov rcx, qword [rsp + 0xd8]
and ecx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xe8]
add rsp, 0x270
pop rbp
ret
mov rbx, qword [0x0050b128]
lea rcx, [0x004d87e0]
call fcn.0040ad20
lea rax, [0x004c3600]
lea rbx, [0x00509c50]
nop
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.0047ace0
Function at 0x47c9a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47cab4
push rbp
mov rbp, rsp
sub rsp, 0x48
test rax, rax
je 0x47ca54
nop dword [rax + rax]
test rax, 0x60
jne 0x47ca14
bt eax, 8
jae 0x47c9d4
add rsp, 0x48
pop rbp
ret
call fcn.0047c760
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x004e551e]
mov r9d, 0x1a
xor eax, eax
lea rbx, [0x004dfba3]
call fcn.0044f8e0
nop
call fcn.0040b0c0
mov rbx, rax
lea rax, [0x004c3600]
call fcn.00436480
call fcn.0047c760
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x004e9758]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x004dfba3]
call fcn.0044f8e0
nop
call fcn.0040b0c0
mov rbx, rax
lea rax, [0x004c3600]
call fcn.00436480
call fcn.0047c760
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
lea rax, [0x004cf400]
call fcn.0040dfe0
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00696870], 0
nop
jne 0x47caa5
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x004c8220]
nop dword [rax]
call fcn.00436480
call fcn.00466440
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
jmp 0x47ca82
mov qword [rsp + 8], rax
call fcn.00464520
mov rax, qword [rsp + 8]
jmp fcn.0047c9a0
Function at 0x47cba0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47cd66
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
nop
cmp rcx, 0x11
jne 0x47cc61
movzx esi, byte [rax + 0x17]
and esi, 0x1f
cmp rsi, 0x12
ja 0x47cbf8
nop word [rax + rax]
cmp rsi, 0x11
jne 0x47cbec
mov rsi, qword [rax + 0x30]
jmp 0x47cc1e
cmp rsi, 0x12
jne 0x47cc1c
mov rsi, qword [rax + 0x30]
jmp 0x47cc1e
cmp rsi, 0x15
jne 0x47cc04
mov rsi, qword [rax + 0x38]
jmp 0x47cc1e
cmp rsi, 0x16
jne 0x47cc10
mov rsi, qword [rax + 0x30]
jmp 0x47cc1e
cmp rsi, 0x17
jne 0x47cc1c
mov rsi, qword [rax + 0x30]
jmp 0x47cc1e
xor esi, esi
movzx esi, byte [rsi + 0x17]
and esi, 0x1f
cmp rsi, 8
jne 0x47cd50
bt edx, 8
jae 0x47cd3d
mov rcx, qword [rax + 0x40]
nop dword [rax]
test rcx, rcx
jl 0x47cd38
mov rax, rbx
neg rbx
cmp rcx, rbx
ja 0x47cd29
mov rbx, rcx
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x17
jne 0x47ccee
movzx edx, byte [rax + 0x17]
and edx, 0x1f
cmp rdx, 0x12
ja 0x47cc90
cmp rdx, 0x11
jne 0x47cc84
mov rdx, qword [rax + 0x30]
jmp 0x47ccba
cmp rdx, 0x12
jne 0x47ccb8
mov rdx, qword [rax + 0x30]
jmp 0x47ccba
cmp rdx, 0x15
jne 0x47cca0
mov rdx, qword [rax + 0x38]
jmp 0x47ccba
cmp rdx, 0x16
jne 0x47ccac
mov rdx, qword [rax + 0x30]
jmp 0x47ccba
cmp rdx, 0x17
jne 0x47ccb8
mov rdx, qword [rax + 0x30]
jmp 0x47ccba
xor edx, edx
movzx edx, byte [rdx + 0x17]
and edx, 0x1f
cmp rdx, 8
jne 0x47ccdb
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov rbx, rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509c90]
call fcn.00436480
mov qword [rsp + 0x10], rcx
lea rax, [0x004cf400]
call fcn.0040dfe0
mov qword [rax + 8], 0x13
lea rcx, [0x004e29b3]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004c8220]
call fcn.00436480
test rax, rax
je 0x47cd33
call fcn.0045e640
call fcn.0045e6e0
call fcn.0045e640
lea rax, [0x004c3600]
lea rbx, [0x00509cb0]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509ca0]
nop
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047cba0
Function at 0x47e100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e296
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and edx, 0x1f
nop
cmp rdx, 0x14
je 0x47e1a9
cmp rdx, 0x16
jne 0x47e25a
bt ecx, 7
jae 0x47e17a
movzx edx, byte [rax + 0x17]
test dl, 0x20
jne 0x47e177
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
call fcn.00461060
nop dword [rax]
test al, al
je 0x47e247
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x30]
mov rbx, qword [rbx]
test rbx, rbx
je 0x47e19d
mov rax, qword [rax + 0x30]
and ecx, 0x60
movzx edx, byte [rax + 0x17]
and edx, 0x1f
or rcx, rdx
or rcx, 0x180
add rsp, 0x38
pop rbp
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
add rsp, 0x38
pop rbp
ret
call fcn.004011e0
test rax, rax
jne 0x47e1c2
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
nop
jmp 0x47e1d7
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx]
test rsi, rsi
je 0x47e1d3
mov rsi, qword [rsi + 8]
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x18]
test rdx, rdx
je 0x47e20e
movzx esi, byte [rdx + 0x17]
mov edi, esi
and esi, 0x1f
mov r8, rsi
or rsi, 0x80
nop
mov r9, qword [rsp + 0x20]
test dil, 0x20
cmove r8, rsi
jmp 0x47e216
xor r8d, r8d
xor edx, edx
xor r9d, r9d
test r8, r8
je 0x47e238
mov rsi, qword [rsp + 0x10]
test rsi, 0x60
mov esi, 0
mov edi, 0x20
cmovne rsi, rdi
or r8, rsi
mov rax, rdx
mov rbx, r9
mov rcx, r8
add rsp, 0x38
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509d20]
call fcn.00436480
mov qword [rsp + 0x10], rdx
lea rax, [0x004cf400]
call fcn.0040dfe0
mov qword [rax + 8], 0x12
lea rcx, [0x004e231b]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004c8220]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047e100