joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6851c0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x68537b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
mov edx, dword [eax + 0x50]
test edx, edx
jne 0x6852df
mov edx, dword [eax + 0x54]
test edx, edx
je 0x68527d
mov eax, dword [edx]
mov ecx, dword [esp + 0x48]
mov dword [esp], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0xc], ecx
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x685269
test ebx, ebx
jne 0x685269
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], esi
nop
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov ebp, dword [esp + 4]
mov dword [ebp + 4], 0x31
lea eax, [0x74de0e]
mov dword [ebp], eax
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x2c]
lea ebx, [0x7b0bb8]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebp
add esp, 0x38
ret
lea eax, [0x96f360]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x18], eax
call fcn.0050ea90
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ebx
add esp, 0x38
ret
mov eax, dword [edx]
mov ecx, dword [esp + 0x40]
mov dword [esp], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], ecx
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
test eax, eax
jne 0x685367
test ebx, ebx
jne 0x685367
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ecx
nop
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov ebp, dword [esp + 4]
mov dword [ebp + 4], 0x38
lea eax, [0x74f9f3]
mov dword [ebp], eax
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
lea ebx, [0x7b0bb8]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebp
add esp, 0x38
ret
call fcn.00467a60
jmp fcn.006851c0
Function at 0x685390
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6854c3
sub esp, 0x1c
mov eax, 0
mov dword [esp + 0x18], eax
mov byte [esp + 0xb], 0
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x48]
mov dword [esp + 0xc], ecx
mov dword [esp], ecx
call fcn.00472830
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea eax, [0x6854d0]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x18], eax
mov byte [esp + 0xb], 1
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x50]
test ecx, ecx
jne 0x685410
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x685426
mov byte [esp + 0x30], 0
mov byte [esp + 0xb], 0
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
call eax
add esp, 0x1c
ret
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x685436
mov ecx, dword [esp + 0x24]
jmp 0x685447
call fcn.00468e70
mov ecx, dword [esp + 0x24]
mov dword [edi], ecx
mov edx, dword [eax + 0x50]
mov dword [edi + 4], edx
mov dword [eax + 0x50], ecx
mov edx, dword [esp + 0x28]
mov dword [eax + 0x54], edx
mov edx, dword [0x995310]
test edx, edx
jne 0x685461
mov edx, dword [esp + 0x2c]
jmp 0x685472
call fcn.00468e70
mov edx, dword [esp + 0x2c]
mov dword [edi], edx
mov ebx, dword [eax + 0x58]
mov dword [edi + 4], ebx
mov dword [eax + 0x58], edx
test ecx, ecx
jne 0x685480
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x6854a1
mov eax, dword [eax + 0x3c]
mov dword [esp], eax
call fcn.004059b0
mov byte [esp + 0x30], 1
mov byte [esp + 0xb], 0
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
call eax
add esp, 0x1c
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0790]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00438090
add esp, 0x1c
ret
call fcn.00467a60
jmp fcn.00685390
Function at 0x685720
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x685812
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov edx, dword [eax + 0x58]
test edx, edx
je 0x685787
mov eax, dword [edx]
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x14], ecx
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
jmp 0x6857bd
mov edx, dword [eax + 0x5c]
mov eax, dword [edx]
mov ecx, dword [esp + 0x40]
mov dword [esp], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xc], ecx
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
test eax, eax
jne 0x6857fe
test ebx, ebx
jne 0x6857fe
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
nop
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov ebp, dword [esp + 4]
mov dword [ebp + 4], 0x41
lea eax, [0x750d44]
mov dword [ebp], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
lea ebx, [0x7b0bb8]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebp
add esp, 0x30
ret
call fcn.00467a60
jmp fcn.00685720
Function at 0x68d340
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x68d478
sub esp, 0x40
mov eax, dword [esp + 0x48]
test eax, eax
je 0x68d45f
mov eax, dword [esp + 0x44]
mov byte [eax + 0x98], 1
mov ecx, dword [eax + 0x88]
test ecx, ecx
jne 0x68d43a
mov ecx, dword [esp + 0x48]
mov dword [eax + 0x88], ecx
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x68d396
mov ecx, dword [esp + 0x4c]
jmp 0x68d3aa
call fcn.00468e70
mov ecx, dword [esp + 0x4c]
mov dword [edi], ecx
mov edx, dword [eax + 0x8c]
mov dword [edi + 4], edx
mov dword [eax + 0x8c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
lea esi, [eax + 0xc]
lea edi, [esp + 0x24]
call fcn.004695ca
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
lea edi, [esp + 4]
lea esi, [esp + 0x24]
call fcn.004695ca
call fcn.006866f0
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
test ecx, ecx
jne 0x68d43a
mov ecx, dword [esp + 0x48]
cmp dword [0x967580], ecx
jne 0x68d419
mov eax, dword [0x967584]
mov dword [esp], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00404290
movzx eax, byte [esp + 0xc]
test al, al
jne 0x68d427
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x2c]
mov ecx, dword [ecx + 0x10]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x4c]
mov dword [esp], ecx
call fcn.004059b0
mov eax, dword [esp + 0x44]
mov ecx, dword [0x995310]
test ecx, ecx
je 0x68d451
mov ecx, dword [eax + 0x9c]
call fcn.00468e60
mov dword [edi], ecx
mov dword [eax + 0x9c], 0
add esp, 0x40
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b07a0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.0068d340
Function at 0x694660
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6947ce
sub esp, 0x10
mov eax, dword [esp + 0x18]
cmp eax, 2
jl 0x6946bb
lea ecx, [0x6f4660]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.0044e560
mov eax, dword [esp + 0xc]
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, 2
xor ebp, ebp
jmp 0x69474a
test eax, eax
jne 0x69470a
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x2d
lea ecx, [0x74c57b]
mov dword [eax], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea ecx, [0x7b0bb8]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
add esp, 0x10
ret
lea eax, [0x6f15c0]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
add esp, 0x10
ret
cmp edx, ebx
jle 0x694789
lea esi, [ebx - 1]
cmp edx, esi
jbe 0x6947c4
movzx esi, byte [ebx + ecx - 1]
cmp edx, ebp
jbe 0x6947bb
lea edi, [ecx + ebp]
xchg esi, eax
cmp byte [edi], al
xchg esi, eax
jne 0x694772
cmp edx, ebx
jbe 0x6947b2
inc ebp
mov dword [eax + ebx*4], ebp
inc ebx
jmp 0x69474a
test ebp, ebp
jle 0x69477b
mov ebp, dword [eax + ebp*4]
jmp 0x69474a
cmp edx, ebx
jbe 0x6947a9
mov dword [eax + ebx*4], 0
inc ebx
jmp 0x69474a
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
add esp, 0x10
ret
mov eax, ebx
mov ecx, edx
call fcn.00468ed0
mov eax, ebx
mov ecx, edx
call fcn.00468ed0
mov eax, ebp
mov ecx, edx
call fcn.00468ed0
mov eax, esi
mov ecx, edx
call fcn.00468ed0
nop
call fcn.00467a60
jmp fcn.00694660
Function at 0x6981c0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x69834e
sub esp, 0x4c
mov eax, dword [0x9679f0]
mov ecx, dword [0x9679f4]
mov edx, dword [0x9679f8]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.006980d0
mov eax, dword [0x967a00]
mov ecx, dword [0x967a04]
mov edx, dword [0x967a08]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x24], ebx
mov ebp, dword [esp + 0xc]
mov dword [esp + 0x30], ebp
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.006980d0
mov eax, dword [0x96e860]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
lea ebx, [0x6f7300]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
call fcn.004109f0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.006980d0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
lea edi, [esp + 0x34]
xor eax, eax
call fcn.004690fa
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
lea eax, [0x751bc5]
mov dword [esp], eax
mov dword [esp + 4], 0x4b
lea eax, [esp + 0x34]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.004c4b20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
add esp, 0x4c
ret
call fcn.00467a60
jmp fcn.006981c0
Function at 0x69e3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x69e5bc
sub esp, 0x70
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx + 4]
lea edi, [esp + 0x40]
xor eax, eax
call fcn.004690f4
lea ecx, [0x6f7300]
mov dword [esp], ecx
mov dword [esp + 4], edx
lea edx, [esp + 0x40]
mov dword [esp + 8], edx
call fcn.0040e110
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x69e415
mov dword [esi], eax
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.0040e350
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x40]
test ebx, ebx
je 0x69e55f
mov dword [esp + 0x34], ecx
mov dword [esp + 0x28], eax
mov eax, dword [ebx]
mov dword [esp + 0x38], eax
mov ecx, dword [ebx + 4]
mov dword [esp + 0x2c], ecx
inc edx
mov dword [esp + 0x30], edx
mov ebx, dword [esp + 0x74]
mov ebp, dword [ebx + 4]
lea esi, [0x6f7300]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
call fcn.004109f0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
lea eax, [0x73a4bb]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
call fcn.004cf320
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
mov edx, dword [esp + 0x38]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
lea edx, [0x73a4ba]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call fcn.004521c0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
cmp edx, ebx
jb 0x69e4e2
mov ebp, dword [esp + 0x34]
jmp 0x69e52a
mov dword [esp + 0x30], ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 1
lea eax, [0x6f44e0]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, edx
mov ebp, ecx
mov edx, eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
lea esi, [ebp + ebx*8 - 4]
mov dword [esi], ecx
mov ecx, dword [0x995310]
lea esi, [ebp + ebx*8 - 8]
test ecx, ecx
je 0x69e3fb
call fcn.00468e70
mov dword [edi], eax
mov ecx, dword [esi]
mov dword [edi + 4], ecx
jmp 0x69e3fb
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
lea eax, [0x73a4b9]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
call fcn.004cf320
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00452560
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], edx
add esp, 0x70
ret
call fcn.00467a60
jmp fcn.0069e3b0
Function at 0x69f450
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x69f4d8
lea edi, [esp + 8]
xor eax, eax
call fcn.004690ed
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
and edx, 0x3ffffff
mov dword [esp + 0x1c], edx
mov edx, dword [ecx + 3]
shr edx, 2
and edx, 0x3ffff03
mov dword [esp + 0x20], edx
mov edx, dword [ecx + 6]
shr edx, 4
and edx, 0x3ffc0ff
mov dword [esp + 0x24], edx
mov edx, dword [ecx + 9]
shr edx, 6
and edx, 0x3f03fff
mov dword [esp + 0x28], edx
mov edx, dword [ecx + 0xc]
shr edx, 8
and edx, 0xfffff
mov dword [esp + 0x2c], edx
mov edx, dword [ecx + 0x10]
mov dword [esp + 0x30], edx
mov edx, dword [ecx + 0x14]
mov dword [esp + 0x34], edx
mov edx, dword [ecx + 0x18]
mov dword [esp + 0x38], edx
mov ecx, dword [ecx + 0x1c]
mov dword [esp + 0x3c], ecx
ret
call fcn.00467a60
jmp fcn.0069f450
Function at 0x6ac8a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6acacc
sub esp, 0x70
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x78]
mov dword [esp], eax
lea ecx, [esp + 0x38]
mov dword [esp + 4], ecx
call fcn.00405ce0
movzx eax, byte [esp + 8]
test al, al
je 0x6aca2a
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x74]
test byte [eax], al
lea ecx, [eax + 0x28]
mov dword [esp + 0x24], ecx
mov dword [esp], ecx
call fcn.00472830
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, dword [eax + 0x14]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x30]
mov edx, dword [esp + 4]
mov ebx, dword [esp + 8]
lea ebp, [0x6f7a60]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.004109f0
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
call fcn.00472bb0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x6ac989
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
call fcn.004051e0
jmp 0x6ac8c7
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, dword [eax + 0x14]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409d40
mov eax, dword [esp + 8]
lea ecx, [0x6f44e0]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
lea eax, [0x74266d]
mov dword [esp], eax
mov dword [esp + 4], 0x18
lea edx, [esp + 0x30]
mov dword [esp + 8], edx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c4b20
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
mov edx, dword [edx + 0x1c]
mov ebx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 3
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
call edx
jmp 0x6ac8c7
mov eax, dword [esp + 0x74]
test byte [eax], al
lea ecx, [eax + 0x28]
mov dword [esp + 0x24], ecx
mov dword [esp], ecx
call fcn.00472830
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x20], ecx
lea edi, [esp + 0x40]
xor eax, eax
call fcn.004690f4
lea eax, [0x6f7a60]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
call fcn.0040e110
jmp 0x6aca8f
mov eax, dword [esp + 0x44]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.004059b0
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.0040e350
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x6aca75
mov eax, dword [0x995310]
test eax, eax
jne 0x6acaa7
mov eax, dword [esp + 0x74]
jmp 0x6acab5
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x30]
call fcn.00468e60
mov dword [edi], ecx
mov dword [eax + 0x30], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00472bb0
add esp, 0x70
ret
call fcn.00467a60
jmp fcn.006ac8a0
Function at 0x6ae810
Capabilities:
Reference http user-agent string
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6ae9c7
sub esp, 0x4c
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x5c]
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x58]
xor eax, eax
jmp 0x6ae840
inc eax
mov ebp, dword [esp + 0x58]
cmp edx, eax
jle 0x6ae86c
mov dword [esp + 0x24], eax
lea esi, [ebp + eax*8]
mov edi, dword [esi + 4]
mov dword [esp + 0x1c], edi
mov esi, dword [esi]
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
jmp 0x6ae95a
lea edi, [esp + 0x34]
xor eax, eax
call fcn.004690fa
mov ecx, dword [esp + 0x50]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
call fcn.00409d40
mov ecx, dword [esp + 8]
lea edx, [0x6f44e0]
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 8], ecx
call fcn.00409dc0
mov ecx, dword [esp + 0xc]
lea edx, [0x6ea2c0]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 8], ecx
call fcn.00409dc0
mov ecx, dword [esp + 0xc]
lea edx, [0x6ea2c0]
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
lea ecx, [0x751789]
mov dword [esp], ecx
mov dword [esp + 4], 0x47
lea ecx, [esp + 0x34]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.004c1f50
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x4c
ret
lea edx, [ebp + 1]
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x20]
cmp ebx, ebp
jle 0x6ae83b
lea edx, [ecx + ebp*8]
cmp dword [edx + 4], edi
jne 0x6ae94b
mov eax, dword [edx]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], edi
call fcn.004034e0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x6ae9a3
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x1c]
jmp 0x6ae94b
mov eax, dword [esp + 0x30]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x4c
ret
call fcn.00467a60
jmp fcn.006ae810
Function at 0x6affc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6b00a5
sub esp, 0x28
mov eax, 1
jmp 0x6affe0
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov byte [esp + 4], al
call fcn.006b0820
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
test ebx, ebx
jne 0x6b0042
test ecx, ecx
jbe 0x6b009b
movzx eax, byte [eax]
cmp al, 2
je 0x6affde
cmp al, 4
je 0x6affde
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x3c]
mov dword [esp], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
call fcn.004051e0
jmp 0x6affde
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x40], esi
mov ecx, dword [0x995310]
test ecx, ecx
je 0x6b0060
call fcn.00468e70
mov dword [edi], ebp
mov ecx, dword [eax + 0x44]
mov dword [edi + 4], ecx
mov dword [eax + 0x44], ebp
mov ecx, dword [eax + 0x3c]
mov dword [esp], ecx
call fcn.004059b0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x40]
mov edx, dword [eax + 0x44]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.006b01a0
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x78]
mov dword [esp], eax
call fcn.004059b0
add esp, 0x28
ret
xor eax, eax
mov ecx, eax
call fcn.00468ed0
nop
call fcn.00467a60
jmp fcn.006affc0