joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4456d0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x445753
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov eax, dword [rsp + 0x28]
test eax, eax
jl 0x445738
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx]
cmp eax, edx
jge 0x445738
mov edx, dword [rcx + 4]
mov dword [rsp + 0x30], edx
add edx, 7
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
sar edx, 3
imul eax, edx
movsxd rax, eax
lea rax, [rcx + rax + 8]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006d8d2b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.004456d0

Function at 0x4459d0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x18], rax
lea rcx, [rax + 0x368]
test byte [rcx], al
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x368], rdx
test byte [rcx], al
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x370], rdx
lea rdx, [rsp + 0x40]
mov qword [rax + 0x378], rdx
mov rdx, qword [0x008965a0]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call fcn.00402510
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x388]
mov rdx, qword [rax + 0x390]
mov rax, qword [rax + 0x380]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x448e20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x20]
cmp rax, qword [rcx + 0x10]
jbe 0x449034
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
lea rdi, [rsp + 0x48]
xorps xmm0, xmm0
add rdi, 0xffffffffffffffd0
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454e35
mov rbp, qword [rbp]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x448f24
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x38], rcx
test rcx, rcx
jne 0x448f44
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp], rcx
mov rbx, qword [rsp + 0xb8]
mov qword [rsp + 8], rbx
mov rdx, qword [rsp + 0xb0]
mov rsi, qword [rdx]
call rsi
movzx eax, byte [rsp + 0x10]
test al, al
je 0x448f34
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x448e8f
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rdx, qword [rcx]
mov qword [rsp + 0x50], rdx
mov qword [rsp], rdx
call fcn.00444700
mov rax, qword [rsp + 8]
test rax, rax
je 0x448fc5
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x40]
mov edx, dword [rcx]
test edx, edx
jne 0x448fbf
xor edx, edx
mov qword [rsp + 0x80], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp], rdx
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], 1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
call fcn.0044ab10
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x40]
jmp 0x448ed7
lea rdx, [rcx + 0x30]
jmp 0x448f71
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
call fcn.0042b850
lea rax, [0x006d7d6f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042c220
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042c0a0
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006d0f35]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00448e20
Function at 0x44b2b0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0xe0]
cmp rax, qword [rcx + 0x10]
jbe 0x44b552
sub rsp, 0x160
mov qword [rsp + 0x158], rbp
lea rbp, [rsp + 0x158]
movzx eax, byte [0x008b4026]
test al, al
je 0x44b545
mov rax, qword [rsp + 0x180]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x44b334
mov edx, dword [rcx + 0xf8]
test edx, edx
jle 0x44b334
mov rdx, qword [rax + 0x78]
test rdx, rdx
je 0x44b334
mov rdx, qword [rcx + 0x100]
test rdx, rdx
je 0x44b334
mov rdx, qword [rdx]
test rdx, rdx
jne 0x44b4dc
mov qword [rsp], rax
call fcn.0042e450
mov eax, dword [rsp + 8]
and eax, 0xffffefff
cmp eax, 3
jne 0x44b4b7
mov rax, qword [rsp + 0x180]
mov rcx, qword [rax + 0x80]
mov rdx, qword [rax + 0x78]
mov rbx, qword [rsp + 0x188]
and rbx, 0xfffffffffffffffd
mov qword [rsp + 0x168], rcx
mov qword [rsp + 0x170], rdx
mov qword [rsp + 0x188], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov rsi, qword [rsp + 0x178]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0x64
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], rbx
call fcn.00449040
mov rax, qword [rsp + 0x50]
test rax, rax
jne 0x44b3f3
mov rcx, qword [rsp + 0x188]
test rcx, 1
je 0x44b43f
cmp rax, 0x64
je 0x44b41a
mov rax, qword [rsp + 0x180]
mov qword [rsp], rax
call fcn.0044af90
mov rbp, qword [rsp + 0x158]
add rsp, 0x160
ret
call fcn.0042b850
lea rax, [0x006d83b5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042c220
call fcn.0042b8f0
jmp 0x44b3f9
mov rax, qword [rsp + 0x168]
mov qword [rsp], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0x64
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
or rcx, 1
mov qword [rsp + 0x48], rcx
call fcn.00449040
mov rax, qword [rsp + 0x50]
jmp 0x44b3f3
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x188]
jmp 0x44b36e
mov edx, 1
xchg dword [rcx + 0xfc], edx
mov rcx, qword [rax + 0x30]
mov rsi, qword [rcx + 0x100]
test byte [rsi], al
lea rdi, [rsp + 0x58]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00455100
mov rbp, qword [rbp]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x100]
mov qword [rcx], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0xfc], edx
lea rcx, [rsp + 0x58]
mov qword [rsp], rcx
call fcn.0044bf70
mov rax, qword [rsp + 0x180]
jmp 0x44b334
mov rax, qword [rsp + 0x180]
jmp 0x44b334
call fcn.00452210
jmp fcn.0044b2b0
Function at 0x44b560
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44b660
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
lea rax, [rsp + 0x78]
mov rcx, rax
mov qword [rsp + 0x18], rcx
mov qword [rsp], rax
call fcn.00453bd0
mov rax, qword [rsp + 8]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454e3d
mov rbp, qword [rbp]
lea rdx, [0x00451a00]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x20]
mov qword [rsp], rax
call fcn.004520b0
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x98], rax
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
call fcn.00452210
jmp fcn.0044b560
Function at 0x45a7b0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45a92f
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
xor eax, eax
mov rcx, qword [rsp + 0x38]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete dl
test dl, dl
jne 0x45a925
xor eax, eax
xor edx, edx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x17], dl
mov ebx, dword [rcx]
mov dword [rsp + 0x18], ebx
mov esi, ebx
or ebx, 1
test esi, 1
jne 0x45a89e
mov dword [rsp + 0x1c], ebx
test dl, dl
je 0x45a82a
test ebx, 2
je 0x45a86c
and ebx, 0xfffffffd
mov rdi, rax
mov eax, esi
lock cmpxchg dword [rcx], ebx
sete bl
test bl, bl
jne 0x45a83f
mov rax, rdi
jmp 0x45a7f7
test esi, 1
je 0x45a862
lea rax, [rcx + 4]
mov qword [rsp], rax
call fcn.0043ca90
mov rcx, qword [rsp + 0x38]
xor edi, edi
mov edx, 1
jmp 0x45a83a
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rdi, [0x006d833d]
mov qword [rsp], rdi
mov qword [rsp + 8], 0x1e
call fcn.0042ae50
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x17]
mov ebx, dword [rsp + 0x1c]
mov esi, dword [rsp + 0x18]
jmp 0x45a827
mov qword [rsp], rax
call fcn.004380f0
movzx eax, byte [rsp + 8]
test al, al
jne 0x45a8cb
mov esi, dword [rsp + 0x18]
lea ebx, [rsi + 4]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x17]
jmp 0x45a817
movzx ecx, byte [rsp + 0x17]
test cl, cl
je 0x45a8f5
mov byte [rsp + 0x17], cl
call fcn.00438190
mov rax, qword [rsp + 0x20]
lea rdi, [rax + 1]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x17]
jmp 0x45a83a
mov eax, dword [rsp + 0x18]
test eax, 2
jne 0x45a8d4
mov edx, eax
sar eax, 2
test eax, eax
je 0x45a8d4
mov eax, edx
or edx, 2
mov rbx, qword [rsp + 0x38]
lock cmpxchg dword [rbx], edx
sete dl
test dl, dl
je 0x45a8d4
mov ecx, 1
jmp 0x45a8d4
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00452210
jmp fcn.0045a7b0

Function at 0x45a940
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45a9f6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, 0xffffffff
mov rdx, qword [rsp + 0x28]
lock xadd dword [rdx], ecx
lea ebx, [rcx - 1]
mov dword [rsp + 0x14], ebx
test ecx, 1
je 0x45a9d2
mov eax, ebx
sar ebx, 2
test ebx, ebx
je 0x45a9b1
test eax, 3
jne 0x45a9b1
lea ecx, [rax - 4]
or ecx, 2
lock cmpxchg dword [rdx], ecx
sete cl
test cl, cl
jne 0x45a9bb
mov ebx, dword [rdx]
mov eax, ebx
sar ebx, 2
test ebx, ebx
jne 0x45a98e
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [rdx + 4]
mov qword [rsp], rax
call fcn.0043ca40
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d835b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0042ae50
mov rdx, qword [rsp + 0x28]
mov ebx, dword [rsp + 0x14]
jmp 0x45a985
call fcn.00452210
jmp fcn.0045a940
Function at 0x45b770
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45b7fe
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x20]
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jge 0x45b7dc
cmp eax, 0xffffffff
jne 0x45b7f5
lea rax, [0x006d93b1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ae50
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x20]
lock xadd dword [rcx + 0x14], eax
dec eax
test eax, eax
je 0x45b7e6
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [rcx + 8]
mov qword [rsp], rax
call fcn.0043ca40
jmp 0x45b7dc
cmp eax, 0xbfffffff
jne 0x45b7c7
jmp 0x45b7ae
call fcn.00452210
jmp fcn.0045b770

Function at 0x45b890
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45b949
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov eax, 0x40000000
mov rcx, qword [rsp + 0x30]
lock xadd dword [rcx + 0x10], eax
add eax, 0x40000000
mov dword [rsp + 0x14], eax
cmp eax, 0x40000000
jge 0x45b925
xor edx, edx
mov qword [rsp + 0x18], rdx
movsxd rbx, eax
cmp rdx, rbx
jge 0x45b912
lea rbx, [rcx + 0xc]
mov qword [rsp], rbx
call fcn.0043ca40
mov rax, qword [rsp + 0x18]
lea rdx, [rax + 1]
mov eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x18], rdx
movsxd rbx, eax
cmp rdx, rbx
jl 0x45b8e6
mov qword [rsp], rcx
call fcn.0045a940
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x006d8d6b]
mov qword [rsp], rdx
mov qword [rsp + 8], 0x20
call fcn.0042ae50
mov eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x30]
jmp 0x45b8d7
call fcn.00452210
jmp fcn.0045b890
Function at 0x45b960
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45bb41
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x68]
test byte [rax], al
mov rcx, rax
test rcx, 7
jne 0x45bb32
mov rcx, rax
mov rdx, qword [rsp + 0x70]
mov rbx, rdx
shl rdx, 0x20
mov rsi, rdx
lock xadd qword [rax], rdx
add rdx, rsi
mov rsi, rdx
shr rdx, 0x20
test edx, edx
jl 0x45bae9
test esi, esi
je 0x45bae2
test rbx, rbx
jle 0x45badb
cmp edx, ebx
je 0x45ba92
test edx, edx
jg 0x45ba82
test esi, esi
je 0x45ba82
mov rdx, qword [rax]
cmp rsi, rdx
jne 0x45ba39
mov qword [rax], 0
mov dword [rsp + 0x24], esi
test esi, esi
je 0x45ba29
lea rax, [rcx + 0xc]
mov qword [rsp], rax
call fcn.0043ca40
mov eax, dword [rsp + 0x24]
lea esi, [rax - 1]
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x24], esi
test esi, esi
jne 0x45ba08
nop
call fcn.0042a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x006de29d]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x39
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
nop
call fcn.0042a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x006de29d]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x39
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
test edx, edx
jmp 0x45b9e3
test edx, edx
jmp 0x45b9e3
lea rax, [0x006d8d8b]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x20
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
lea rdx, [rax + 4]
mov rcx, rax
mov rax, rdx
jmp 0x45b9a2
call fcn.00452210
jmp fcn.0045b960
Function at 0x45bba0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45bc9a
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
test byte [rcx], al
mov rdx, rcx
test rdx, 7
jne 0x45bc8b
mov rax, rcx
mov qword [rsp + 0x20], rcx
mov rdx, qword [rcx]
mov rbx, rdx
shr rdx, 0x20
test edx, edx
je 0x45bc81
lea rdx, [rbx + 1]
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rcx], rdx
sete dl
test dl, dl
jne 0x45bc14
mov rax, rsi
jmp 0x45bbe7
lea rax, [rsi + 0xc]
mov qword [rsp], rax
call fcn.0043c9a0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
test rax, rax
jne 0x45bc38
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006de4e4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x3b
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rdx, [rcx + 4]
mov rax, rcx
mov rcx, rdx
jmp 0x45bbe2
call fcn.00452210
jmp fcn.0045bba0
Function at 0x461990
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x461a4b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 8], rax
call fcn.00461a60
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
test rbx, rbx
jne 0x461a02
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x006dca09]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x30
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.00461990
Function at 0x48fa50
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x48fb58
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
lea rbx, [rdx + 0x2e]
neg rbx
imul rbx, rbx, 0x1c
movabs rax, 0x2c0b02c0b02c0b03
mov rsi, rdx
imul rbx
sar rdx, 4
sar rbx, 0x3f
sub rdx, rbx
lea rbx, [rdx + 0x15c]
sar rbx, 0x3f
shr rbx, 0x3d
lea rdx, [rdx + rbx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x48faf7
lea rax, [rdx + rdx*2]
lea rbx, [0x007fda20]
mov rdi, qword [rbx + rax*8 + 8]
lea r8, [rsi + rdi + 0x40]
mov r9, rax
shl rax, 3
cmp r8, 0xffffffffffffffc4
jge 0x48fafe
lea rax, [rdx + 1]
mov rdx, rax
cmp rdx, 0x57
jb 0x48fac8
call fcn.004293e0
ud2
cmp r8, 0xffffffffffffffe0
jle 0x48fb0a
lea rax, [rdx - 1]
jmp 0x48faee
mov qword [rsp + 0x20], rdx
movzx eax, byte [rbx + rax + 0x10]
mov rbx, qword [rbx + r9*8]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov byte [rsp + 0x18], al
mov qword [rsp], rcx
call fcn.0048f9d0
mov rax, qword [rsp + 0x20]
mov rcx, rax
shl rax, 3
add rax, 0xfffffffffffffea4
neg rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00452210
jmp fcn.0048fa50
Function at 0x4900e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4902ad
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
shl rax, cl
cmp rcx, 0x40
sbb rdx, rdx
and rdx, rax
mov rax, qword [rsp + 0x58]
cmp rax, rdx
ja 0x490264
mov rcx, qword [rsp + 0x70]
mov rbx, rcx
shl rcx, 1
cmp rcx, rdx
ja 0x49021b
lea rcx, [rax + rbx]
shl rcx, 1
cmp rcx, rdx
jb 0x49020c
sub rax, rbx
shl rax, 1
cmp rax, rdx
jbe 0x4901fd
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x18]
dec rcx
test rcx, rcx
jl 0x490199
mov rdx, qword [rax + 8]
mov rbx, qword [rax]
cmp rcx, rdx
jae 0x4901f6
movzx edx, byte [rbx + rcx]
cmp dl, 0x39
jne 0x4901f1
mov rdx, qword [rax + 0x18]
dec rdx
mov qword [rax + 0x18], rdx
dec rcx
test rcx, rcx
jge 0x490171
jge 0x4901d3
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
test rdx, rdx
jbe 0x4901cc
mov byte [rcx], 0x31
mov qword [rax + 0x18], 1
mov rcx, qword [rax + 0x20]
inc rcx
mov qword [rax + 0x20], rcx
mov byte [rsp + 0x78], 1
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.004293e0
ud2
mov rdx, qword [rax + 8]
mov rax, qword [rax]
cmp rcx, rdx
jae 0x4901ea
movzx edx, byte [rax + rcx]
inc edx
mov byte [rax + rcx], dl
jmp 0x4901bd
call fcn.004293e0
ud2
test rcx, rcx
jmp 0x490199
call fcn.004293e0
ud2
mov byte [rsp + 0x78], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov byte [rsp + 0x78], 1
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006d7756]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1c
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
lea rax, [0x006dce69]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x31
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.004900e0
Function at 0x49aaa0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49ab32
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
jne 0x49aae9
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006d91a1]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x21
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.0049aaa0

Function at 0x49abf0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49ad6b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
ja 0x49acd7
cmp rcx, 0x11
jne 0x49ac5e
mov rax, qword [rax + 0x30]
test rax, rax
je 0x49ac58
lea rcx, [0x007ecc20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
xor ecx, ecx
jmp 0x49ac44
cmp rcx, 0x12
jne 0x49ac8e
mov rax, qword [rax + 0x30]
test rax, rax
je 0x49ac88
lea rcx, [0x007ecc20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor ecx, ecx
xor eax, eax
jmp 0x49ac74
lea rax, [0x006d7c6a]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1d
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
cmp rcx, 0x15
jne 0x49ad07
mov rax, qword [rax + 0x38]
test rax, rax
je 0x49ad01
lea rcx, [0x007ecc20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor ecx, ecx
xor eax, eax
jmp 0x49aced
cmp rcx, 0x16
jne 0x49ad37
mov rax, qword [rax + 0x30]
test rax, rax
je 0x49ad31
lea rcx, [0x007ecc20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
xor ecx, ecx
jmp 0x49ad1d
cmp rcx, 0x17
jne 0x49ac8e
mov rax, qword [rax + 0x30]
test rax, rax
je 0x49ad65
lea rcx, [0x007ecc20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
xor ecx, ecx
jmp 0x49ad51
call fcn.00452210
jmp fcn.0049abf0