joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485e40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x485f88
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x38]
test byte [rax], al
mov rcx, rax
test rax, 7
jne 0x485f22
lea rax, [rcx + 8]
mov rdx, qword [rsp + 0x40]
mov rbx, rdx
shl rdx, 0x20
mov rsi, rdx
lock xadd qword [rcx], rdx
add rdx, rsi
mov rsi, rdx
shr rdx, 0x20
test edx, edx
jl 0x485f6b
test esi, esi
je 0x485f1c
test rbx, rbx
jle 0x485f18
cmp ebx, edx
je 0x485f4f
test edx, edx
jg 0x485f0e
nop dword [rax]
test esi, esi
je 0x485f0e
cmp qword [rcx], rsi
jne 0x485f33
mov qword [rsp + 0x20], rax
mov qword [rcx], 0
jmp 0x485f00
mov dword [rsp + 0x1c], esi
mov qword [rsp], rax
mov byte [rsp + 8], 0
mov qword [rsp + 0x10], 0
call fcn.00467d80
mov eax, dword [rsp + 0x1c]
lea esi, [rax - 1]
mov rax, qword [rsp + 0x20]
nop
test esi, esi
jne 0x485ed7
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
test edx, edx
jmp 0x485ebb
test edx, edx
nop
jmp 0x485ebb
lea rdx, [rcx + 4]
mov rcx, rdx
mov rax, qword [rsp + 0x38]
jmp 0x485e82
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1a30]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1a30]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1a20]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00485e40
Function at 0x48da00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 8]
cmp rax, qword [rcx + 0x10]
jbe 0x48dc66
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov rax, qword [rsp + 0xb0]
bt eax, 9
jae 0x48dc46
mov rcx, qword [rsp + 0xa0]
movzx edx, byte [rcx + 0x17]
mov byte [rsp + 0x4f], dl
mov qword [rsp], rcx
mov rbx, qword [rsp + 0xa8]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rax
call fcn.0049a360
mov rax, qword [rsp + 0xb0]
and rax, 0x1e0
movzx edx, byte [rsp + 0x4f]
and edx, 0x1f
or rdx, rax
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
lea rsi, [0x006a9ea0]
nop dword [rax]
cmp rbx, rsi
jne 0x48dc25
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x78], rax
lea rcx, [0x0066ab40]
test byte [rcx], al
mov rcx, qword [0x0066ab40]
mov qword [rsp + 0x58], rcx
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.004958c0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x60], rcx
lea rdx, [0x00642640]
mov qword [rsp], rdx
call fcn.0040e560
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
cmp dword [0x00811460], 0
jne 0x48dc0d
mov rcx, qword [rsp + 0x68]
mov qword [rax + 8], rcx
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0xb0]
sar rcx, 0xa
mov qword [rax + 0x18], rcx
mov rbx, qword [rsp + 0x50]
mov qword [rax + 0x30], rbx
cmp dword [0x00811460], 0
jne 0x48dbe3
mov rsi, qword [rsp + 0xa0]
mov qword [rax + 0x20], rsi
mov rdi, qword [rsp + 0xa8]
mov qword [rax + 0x28], rdi
mov rax, qword [rsp + 0x90]
mov qword [rsp], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
call fcn.004975e0
mov rax, qword [rsp + 0x78]
test byte [rax], al
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xb0]
and rax, 0x60
or rax, 0x13
mov qword [rsp + 0xc8], rax
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
lea rdi, [rax + 0x20]
mov rsi, qword [rsp + 0xa0]
call fcn.0046ca80
lea rdi, [rax + 0x28]
mov r8, qword [rsp + 0xa8]
call fcn.0046caa0
mov rdi, r8
jmp 0x48db6d
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x68]
call fcn.0046ca20
nop dword [rax + rax]
jmp 0x48db21
mov qword [rsp], rbx
lea rax, [0x00654ca0]
mov qword [rsp + 8], rax
lea rax, [0x0064d320]
mov qword [rsp + 0x10], rax
call fcn.0040b380
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1700]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.0048da00
Function at 0x48f460
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x48f520
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
jne 0x48f4ad
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp], rax
call fcn.0048e380
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], 0
lea rdx, [0x00664266]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x22
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.00451e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.0048f460

Function at 0x48f540
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x48f606
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x48f591
movzx eax, word [rax + 0x32]
test ax, 0x8000
setne byte [rsp + 0x50]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp], rax
call fcn.0048e380
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], 0
lea rdx, [0x006652a9]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x25
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.00451e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.0048f540
Function at 0x48f620
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x48f7ce
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
ja 0x48f6c7
nop word [rax + rax]
cmp rcx, 0x11
jne 0x48f690
mov rax, qword [rax + 0x30]
test rax, rax
je 0x48f68a
lea rcx, [0x006a9ea0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor ecx, ecx
xor eax, eax
jmp 0x48f676
cmp rcx, 0x12
jne 0x48f757
mov rax, qword [rax + 0x30]
nop
test rax, rax
je 0x48f6c1
lea rcx, [0x006a9ea0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
xor ecx, ecx
xor eax, eax
jmp 0x48f6ac
cmp rcx, 0x15
jne 0x48f6f7
mov rax, qword [rax + 0x38]
test rax, rax
je 0x48f6f1
lea rcx, [0x006a9ea0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor ecx, ecx
xor eax, eax
jmp 0x48f6dd
cmp rcx, 0x16
jne 0x48f727
mov rax, qword [rax + 0x30]
test rax, rax
je 0x48f721
lea rcx, [0x006a9ea0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor ecx, ecx
xor eax, eax
jmp 0x48f70d
cmp rcx, 0x17
jne 0x48f757
mov rax, qword [rax + 0x30]
test rax, rax
je 0x48f751
lea rcx, [0x006a9ea0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor ecx, ecx
xor eax, eax
jmp 0x48f73d
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.0048e380
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], 0
lea rdx, [0x00662c78]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x1e
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.00451e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.0048f620
Function at 0x48ffe0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x490110
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
movzx edi, byte [rsi + 0x17]
and edi, 0x1f
cmp rdi, 0x13
jne 0x49009e
movzx edi, byte [rsi + 0x14]
test dil, 1
je 0x490082
mov eax, 0x48
movzx edx, word [rsi + 0x30]
test dx, dx
jne 0x49006f
xor eax, eax
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
nop
cmp rdx, rax
jae 0x490089
mov rax, qword [rcx + rdx*8]
test rax, rax
je 0x490069
lea rcx, [0x006a9ea0]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor ecx, ecx
xor eax, eax
jmp 0x490055
add rsi, rax
cmp rdx, 0x100000
ja 0x490094
mov eax, edx
mov rcx, rsi
jmp 0x49003a
mov eax, 0x38
jmp 0x49002d
mov rcx, rax
mov rax, rdx
call fcn.0046cdc0
mov ebx, 0x100000
call fcn.0046cec0
mov qword [rsp], rsi
call fcn.0048e380
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], 0
lea rdx, [0x00662657]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x1d
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.00451e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.0048ffe0

Function at 0x490120
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4901f9
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x15
jne 0x490187
mov rax, qword [rax + 0x30]
nop
test rax, rax
je 0x490181
lea rcx, [0x006a9ea0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
xor ecx, ecx
xor eax, eax
jmp 0x49016c
mov qword [rsp], rax
call fcn.0048e380
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], 0
lea rdx, [0x00662674]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x1d
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.00451e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
nop
jmp fcn.00490120
Function at 0x490220
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4902e0
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x11
jne 0x49026d
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp], rax
call fcn.0048e380
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], 0
lea rdx, [0x0066317e]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x1f
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.00451e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00490220

Function at 0x4903e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4904a0
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x49042d
movzx eax, word [rax + 0x30]
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp], rax
call fcn.0048e380
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], 0
lea rdx, [0x0066364e]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x20
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.00451e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004903e0

Function at 0x4904c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4905a8
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
movzx ebx, byte [rdx + 0x17]
and ebx, 0x1f
cmp rbx, 0x13
jne 0x490536
movzx ebx, word [rdx + 0x32]
and ebx, 0x7fff
test bx, bx
jne 0x49051a
xor eax, eax
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movzx eax, word [rdx + 0x30]
lea edx, [rbx + rax]
movzx ecx, dx
cmp rax, rcx
ja 0x490531
sub rcx, rax
mov rax, rcx
jmp 0x49050b
call fcn.0046cf20
mov qword [rsp], rdx
call fcn.0048e380
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], 0
lea rdx, [0x00663ca4]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x21
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.00451e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004904c0
Function at 0x4905c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49070e
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
movzx ebx, byte [rdx + 0x17]
and ebx, 0x1f
cmp rbx, 0x13
jne 0x490698
movzx ebx, byte [rdx + 0x14]
test bl, 1
je 0x49067f
mov eax, 0x48
movzx ebx, word [rdx + 0x32]
and ebx, 0x7fff
test bx, bx
jne 0x490653
xor eax, eax
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
cmp rdx, rax
jae 0x490686
mov rax, qword [rcx + rdx*8]
test rax, rax
je 0x49064d
lea rcx, [0x006a9ea0]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor ecx, ecx
xor eax, eax
jmp 0x490639
movzx esi, word [rdx + 0x30]
add ebx, esi
add rdx, rax
movzx ecx, bx
nop
cmp rsi, rcx
ja 0x490691
sub rcx, rsi
mov rax, rcx
neg rcx
shl rsi, 3
sar rcx, 0x3f
and rsi, rcx
lea rcx, [rdx + rsi]
jmp 0x49061f
mov eax, 0x38
jmp 0x49060c
mov rcx, rax
mov rax, rdx
call fcn.0046cdc0
mov eax, esi
call fcn.0046cf20
mov qword [rsp], rdx
nop dword [rax]
call fcn.0048e380
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], 0
lea rdx, [0x00662cb4]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x1e
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.00451e60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004905c0
Function at 0x490e80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x491086
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], 0
lea rdi, [rsp + 0x70]
xorps xmm0, xmm0
lea rdi, [rdi - 0x20]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046d051
mov rbp, qword [rbp]
mov rax, qword [rsp + 0x60]
nop dword [rax + rax]
test rax, rax
jl 0x491065
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x38]
cmp qword [rcx + 0x40], rax
jle 0x491065
lea rbx, [rax + rax*2]
mov rsi, qword [rdx + rbx*8 + 8]
test rsi, rsi
je 0x491057
lea rdi, [0x006a9ea0]
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
mov rsi, qword [rdx + rbx*8]
movups xmmword [rsp + 0x38], xmm0
test rsi, rsi
je 0x490f49
lea rdi, [rsi + 3]
mov qword [rsp + 0x38], rdi
movzx esi, word [rsi + 1]
rol si, 8
mov qword [rsp + 0x40], rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov rsi, qword [rdx + rbx*8 + 0x10]
bt esi, 0
setb byte [rsp + 0xc8]
mov rsi, qword [rdx + rbx*8]
movzx esi, byte [rsi]
test sil, 1
je 0x491016
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], rbx
mov rax, qword [rdx + rbx*8]
mov qword [rsp], rax
call fcn.0048dce0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
test rax, rax
je 0x490fb5
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + rax*8 + 0x10]
shr rax, 1
mov qword [rsp + 0xa8], rax
lea rax, [0x00614f40]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
mov qword [rsp + 0xc0], 1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x30]
movups xmmword [rsp + 0x28], xmm0
nop
test rcx, rcx
je 0x49103b
lea rsi, [rcx + 3]
mov qword [rsp + 0x28], rsi
movzx ecx, word [rcx + 1]
rol cx, 8
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rsi
jmp 0x490f7f
xor edi, edi
xor esi, esi
nop dword [rax + rax]
jmp 0x490f15
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1840]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00490e80

Function at 0x492580
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x4925a1
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rcx, rbx
jg 0x492592
mov dword [rsp + 0x28], edx
ret
Function at 0x496ea0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x496fd8
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x496ee4
test rax, 0x60
jne 0x496f54
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.00496e00
mov rax, qword [rsp]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x48], rcx
lea rdx, [0x0062e740]
mov qword [rsp], rdx
call fcn.0040e560
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x48]
mov qword [rdi + 8], rax
cmp dword [0x00811460], 0
jne 0x496f2d
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
jmp 0x496f37
mov rax, qword [rsp + 0x50]
call fcn.0046c920
mov qword [rdi + 0x10], 0
lea rax, [0x0061b9a0]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.00438920
call fcn.00496e00
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov qword [rsp], 0
lea rdx, [0x0065b518]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
lea rax, [0x00666ab8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x2c
nop
call fcn.00451ee0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.00496ea0
Function at 0x497000
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4971c8
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x497052
test rax, 0x60
jne 0x497146
bt eax, 8
jae 0x4970c5
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.00496e00
mov rax, qword [rsp]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x48], rcx
lea rdx, [0x0062e740]
mov qword [rsp], rdx
call fcn.0040e560
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x48]
mov qword [rdi + 8], rax
cmp dword [0x00811460], 0
jne 0x49709b
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
jmp 0x4970a5
mov rax, qword [rsp + 0x50]
call fcn.0046c920
mov qword [rdi + 0x10], 0
lea rax, [0x0061b9a0]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
nop dword [rax]
call fcn.00438920
call fcn.00496e00
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov qword [rsp], 0
lea rdx, [0x0065b518]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
lea rax, [0x00660fa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x1a
call fcn.00451ee0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
call fcn.00496e00
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov qword [rsp], 0
lea rdx, [0x0065b518]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
lea rax, [0x00666ab8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x2c
call fcn.00451ee0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040b600
mov rax, qword [rsp + 0x10]
lea rcx, [0x00613e40]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00497000

Function at 0x4971e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49726a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x30]
bt eax, 8
jae 0x49724d
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.00492180
mov rax, qword [rsp + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
and rax, 0x60
or rax, 0x16
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a16e0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.004971e0
Function at 0x497360
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x497486
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x50]
and rax, 0x1f
cmp rax, 0x17
je 0x4973e9
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.00496d60
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x18], rcx
lea rdx, [0x0062e740]
mov qword [rsp], rdx
call fcn.0040e560
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x18]
mov qword [rdi + 8], rax
cmp dword [0x00811460], 0
jne 0x49743f
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
jmp 0x497449
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0048f620
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov rax, qword [rax + 0x98]
mov qword [rsp], rcx
call rax
cmp qword [rsp + 8], 8
jne 0x497467
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x28]
call fcn.0046c920
mov rax, qword [rsp + 0x20]
mov qword [rdi + 0x10], rax
lea rax, [0x0061b9a0]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a16f0]
mov qword [rsp + 8], rax
nop
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00497360