joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0469
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x40], rax
cmp rbx, 0x19
je 0x4b0396
xor edx, edx
jmp 0x4b03c0
lea rbx, [0x006d0ddc]
mov ecx, 0x19
call fcn.00402d80
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
je 0x4b03cb
mov edx, 1
jmp 0x4b0400
cmp rbx, 0x23
je 0x4b03d5
xor edx, edx
jmp 0x4b0400
lea rbx, [0x006d5d2b]
mov ecx, 0x23
call fcn.00402d80
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
je 0x4b043e
mov rdx, qword [0x008ca5c0]
lea rax, [0x00744760]
mov rbx, rcx
mov rcx, rdi
mov rdi, rdx
nop dword [rax + rax]
call fcn.004bb9a0
test dil, dil
jne 0x4b045b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov r8, qword [0x008ca5c0]
mov rsi, qword [0x008ca5c8]
call fcn.004b04a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax]
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004b0360

Function at 0x4b3ea0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3ee6
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x4b3ecf
add rax, 8
nop
call fcn.004626a0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00679500]
lea rbx, [0x007420b0]
nop dword [rax]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.004b3ea0

Function at 0x4b3fe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b403a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x4b4026
mov qword [rsp + 0x20], rax
mov rax, rbx
call fcn.004b3e20
mov rcx, qword [rsp + 0x20]
add rcx, 8
mov rbx, rax
mov rax, rcx
call fcn.004626e0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00679500]
lea rbx, [0x00742770]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b3fe0
Function at 0x4beec0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4befbc
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
jmp 0x4beedd
mov rax, rbx
mov rcx, qword [rax]
bt ecx, 0
jb 0x4bef24
mov rdx, rcx
or rcx, 1
add rcx, 8
test rcx, 0x7ffff8
je 0x4befa8
movabs rsi, 0x80000000007fffff
and rcx, rsi
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x4beeda
mov qword [rsp + 0x18], rbx
jmp 0x4bef4f
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 8]
call fcn.004610e0
mov rdx, qword [rsp + 0x10]
add rdx, 0xffffffffff800000
mov rbx, qword [rsp + 0x18]
movabs rcx, 0x7ffff800000
test rdx, rcx
jne 0x4bef30
nop
jmp 0x4bef8a
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 0xc]
call fcn.004610e0
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xfffff80000000000
add rcx, rdx
mov rbx, qword [rsp + 0x18]
mov rdx, rcx
movabs rcx, 0x7ffff80000000000
test rdx, rcx
jne 0x4bef62
mov eax, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00679500]
lea rbx, [0x00741e90]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.004beec0

Function at 0x4befe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf10f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test bl, bl
je 0x4bf018
test byte [rax], al
lea rcx, [rax + 8]
mov edx, 2
mov ebx, 0x800000
movabs rsi, 0x7ffff800000
jmp 0x4bf037
test byte [rax], al
lea rcx, [rax + 0xc]
mov edx, 4
movabs rbx, 0x80000000000
movabs rsi, 0x7ffff80000000000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdx
jmp 0x4bf055
mov rax, r9
mov rdi, qword [rax]
bt edi, 0
jb 0x4bf0dc
nop
test rdi, rdx
jne 0x4bf07d
mov r8, rdi
or rdi, rdx
add rdi, 8
test rdi, 0x7ffff8
jne 0x4bf08f
jmp 0x4bf0fb
lea r8, [rbx + rdi]
test rsi, r8
je 0x4bf0e8
mov r9, r8
mov r8, rdi
mov rdi, r9
mov r9, rax
mov rax, r8
lock cmpxchg qword [r9], rdi
sete dil
nop
test dil, dil
je 0x4bf052
test r8, rdx
je 0x4bf0cd
mov rax, rcx
call fcn.00460f00
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov r9, qword [rsp + 0x40]
jmp 0x4bf052
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00679500]
lea rbx, [0x00741e90]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741e90]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00463740
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004befe0
Function at 0x4bf800
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bfa39
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x90], rdi
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov r8, qword [rsp + 0x48]
bt r8, 0x3f
jae 0x4bf86d
mov r8, qword [rsp + 0x48]
shl r8, 1
shr r8, 0x1f
movabs r9, 0xdd7b17f80
add r8, r9
jmp 0x4bf872
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x78], rax
nop dword [rax]
test r8, r8
jne 0x4bf89a
mov r8, qword [rsp + 0x48]
and r8d, 0x3fffffff
test r8d, r8d
jne 0x4bf89a
xor ecx, ecx
jmp 0x4bf8c3
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call fcn.004b52a0
test rax, rax
mov rdx, 0xffffffffffffffff
cmove rax, rdx
mov rsi, qword [rsp + 0x20]
mov rcx, rax
mov rax, qword [rsp + 0x78]
test byte [rax], al
jmp 0x4bf8ca
mov rax, rdx
mov rdi, qword [rax]
bt edi, 0
jb 0x4bf90b
lea r8, [rdi + 8]
nop word [rax + rax]
test r8, 0x7ffff8
je 0x4bfa08
mov rdx, rax
mov rax, rdi
lock cmpxchg qword [rdx], r8
sete r8b
nop dword [rax]
test r8b, r8b
je 0x4bf8c7
bt edi, 0
jmp 0x4bf90e
mov rdx, rax
jae 0x4bf939
cmp byte [rdx + 0x21f], 0
je 0x4bf929
mov rdi, qword [0x008d5660]
mov r8, qword [0x008d5668]
jmp 0x4bf940
lea rdi, [0x00743400]
lea r8, [0x0092ae58]
jmp 0x4bf940
xor edi, edi
xor r8d, r8d
nop
test rdi, rdi
jne 0x4bf9ee
movups xmmword [rsp + 0x38], xmm15
lea rdi, [0x004bfa80]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x1f], 1
mov rax, qword [rdx + 0x1b8]
test rax, rax
jne 0x4bf9b6
mov rax, qword [0x008d5670]
mov rcx, qword [0x008d5678]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbx, rcx
mov rcx, rsi
nop dword [rax]
call fcn.0045f960
movups xmmword [rsp + 0x28], xmm15
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx]
call rsi
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], r8
mov rax, rdi
mov rbx, r8
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x00679500]
lea rbx, [0x00741e90]
call fcn.00436420
nop
nop dword [rax]
call fcn.004358c0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004bf800
Function at 0x4c2240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2399
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov r13, 0
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x23], 0
movups xmmword [rsp + 0x28], xmm15
test byte [rax], al
jmp 0x4c2276
mov rax, rsi
mov rdx, qword [rax]
bt edx, 0
jb 0x4c22ab
lea r8, [rdx + 8]
test r8, 0x7ffff8
je 0x4c236a
mov rsi, rax
mov rax, rdx
lock cmpxchg qword [rsi], r8
sete r8b
nop
test r8b, r8b
je 0x4c2273
bt edx, 0
jmp 0x4c22ae
mov rsi, rax
jae 0x4c22d9
cmp byte [rsi + 0x21f], 0
je 0x4c22c9
mov rdx, qword [0x008d5660]
mov r8, qword [0x008d5668]
jmp 0x4c22e0
lea rdx, [0x00743400]
lea r8, [0x0092ae58]
jmp 0x4c22e0
xor edx, edx
xor r8d, r8d
nop
test rdx, rdx
je 0x4c22ff
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
mov rax, rdx
mov rbx, r8
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x004c23e0]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x23], 1
mov rax, qword [rsi + 0x10]
mov dword [rsp + 0x24], edi
lea rdi, [rsp + 0x24]
mov esi, 4
call fcn.004a4c00
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x23], 0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx]
call r8
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x00679500]
lea rbx, [0x00741e90]
call fcn.00436420
nop
nop
call fcn.004358c0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004c2240
Function at 0x4c2440
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2589
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov r13, 0
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x4f], 0
movups xmmword [rsp + 0x50], xmm15
test byte [rax], al
jmp 0x4c2476
mov rax, r13
mov rdx, qword [rax]
bt edx, 0
jb 0x4c24ab
lea r12, [rdx + 8]
test r12, 0x7ffff8
je 0x4c255c
mov r13, rax
mov rax, rdx
lock cmpxchg qword [r13], r12
sete r12b
test r12b, r12b
je 0x4c2473
bt edx, 0
jmp 0x4c24ae
mov r13, rax
jae 0x4c24da
cmp byte [r13 + 0x21f], 0
je 0x4c24ca
mov rdx, qword [0x008d5660]
mov r12, qword [0x008d5668]
jmp 0x4c24e0
lea rdx, [0x00743400]
lea r12, [0x0092ae58]
jmp 0x4c24e0
xor edx, edx
xor r12d, r12d
nop
test rdx, rdx
je 0x4c24ff
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r12
mov rax, rdx
mov rbx, r12
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x004c2600]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r13
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x4f], 1
mov rax, qword [r13 + 0x10]
call fcn.004a3d80
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x4f], 0
mov rdx, qword [rsp + 0x70]
mov r12, qword [rdx]
call r12
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x00679500]
lea rbx, [0x00741e90]
call fcn.00436420
nop
call fcn.004358c0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00463740
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004c2440
Function at 0x4c5fe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c603b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x4c600e
nop
call fcn.004bcd00
test al, al
jne 0x4c6027
mov rax, qword [rsp + 0x20]
call fcn.00460300
mov rax, qword [rsp + 0x20]
call fcn.00460740
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00679500]
lea rbx, [0x00742100]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.004c5fe0

Function at 0x4d2800
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d290a
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, qword [rax]
nop dword [rax + rax]
test rdx, rdx
je 0x4d282f
cmp rax, rdx
je 0x4d2845
jmp 0x4d28f6
cmp dword [0x0092b0b0], 0
jne 0x4d283d
mov qword [rax], rax
jmp 0x4d2845
mov rdi, rax
call fcn.00465900
mov qword [rsp + 0x58], rax
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov qword [rsp + 0x40], r8
nop dword [rax + rax]
cmp ebx, 0x7f
ja 0x4d28a4
lea r9, [r8 + 1]
cmp rcx, r9
jae 0x4d289d
mov dword [rsp + 0x60], ebx
mov rax, rdx
mov rbx, r9
mov edi, 1
lea rsi, [0x006796c0]
call fcn.0044a920
mov r8, qword [rsp + 0x40]
mov r9, rbx
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x60]
mov byte [r9 + rdx - 1], bl
jmp 0x4d28c1
mov rax, rdx
mov edi, ebx
mov rbx, r8
call fcn.00472440
mov r8, qword [rsp + 0x40]
mov r9, rbx
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x10], r9
mov qword [rax + 0x18], rcx
sub r9, r8
cmp dword [0x0092b0b0], 0
jne 0x4d28db
mov qword [rax + 8], rdx
jmp 0x4d28e5
lea rdi, [rax + 8]
nop
call fcn.00465a20
mov rax, r9
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00679500]
lea rbx, [0x007420c0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463740
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.004d2800
Function at 0x4d9d60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d9eca
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rax
mov rdx, qword [rax + 0x20]
cmp rdx, 1
je 0x4d9e05
cmp rdx, 2
jne 0x4d9dca
test rdi, rdi
je 0x4d9db4
nop
call fcn.004dade0
test rax, rax
je 0x4d9db9
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.004d9940
mov rax, qword [rsp + 0x70]
nop
call fcn.004d9a20
jmp 0x4d9e95
cmp rdx, 6
jne 0x4d9eb6
test rdi, rdi
je 0x4d9def
call fcn.004da4e0
nop
test rax, rax
je 0x4d9df4
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.004d9940
mov rax, qword [rsp + 0x70]
call fcn.004d9a20
nop
jmp 0x4d9e95
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rcx
nop
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x40], rcx
nop
call fcn.004d9bc0
mov r9, qword [rsp + 0x48]
test r9, r9
je 0x4d9e95
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x10]
mov r11, qword [rax]
mov rcx, qword [rax + 0x18]
lea r12, [rcx - 1]
cmp rdx, r12
jb 0x4d9eae
mov r13, qword [rsp + 0x40]
lea r15, [r13 - 1]
cmp r12, r15
jb 0x4d9ea3
sub rcx, r13
sub rdx, r13
lea rdi, [rdx + 1]
mov rdx, rdi
neg rdi
sar rdi, 0x3f
and r15, rdi
lea rbx, [r11 + r15]
mov rdi, rdx
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
xor r10d, r10d
call fcn.004dcc00
test rax, rax
je 0x4d9e95
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, r15
mov rcx, r12
call fcn.00465e60
mov rcx, r12
call fcn.00465e20
lea rax, [0x00679500]
lea rbx, [0x00741e00]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004d9d60

Function at 0x4d9f00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d9f9d
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rax + 0x20]
nop dword [rax]
cmp rcx, 1
je 0x4d9f48
cmp rcx, 2
je 0x4d9f32
cmp rcx, 6
jne 0x4d9f89
mov qword [rsp + 0x20], rax
call fcn.004d9940
mov rax, qword [rsp + 0x20]
call fcn.004d9a20
jmp 0x4d9f67
call fcn.004df460
test rax, rax
je 0x4d9f7f
cmp dword [rax + 0x10], 0x778cdb8
jne 0x4d9f67
lea rcx, [0x00679500]
cmp rax, rcx
je 0x4d9f7f
lea rax, [0x00687780]
lea rbx, [0x0092ae58]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00679500]
lea rbx, [0x00741e00]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.004d9f00
Function at 0x4def80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4df027
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rax + 0x20]
nop dword [rax]
cmp rcx, 1
je 0x4df004
mov qword [rsp + 0x38], rax
cmp rcx, 2
je 0x4defe2
cmp rcx, 6
jne 0x4df013
call fcn.004df040
nop dword [rax]
call fcn.0040b060
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x38]
call fcn.004d9a20
lea rax, [0x00675f60]
mov rbx, qword [rsp + 0x20]
jmp 0x4df009
call fcn.004df200
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
call fcn.004d9a20
lea rax, [0x00686640]
mov rbx, qword [rsp + 0x18]
jmp 0x4df009
call fcn.004df460
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00679500]
lea rbx, [0x00741e00]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.004def80

Function at 0x4df040
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4df1d8
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x90], rax
xor ebx, ebx
mov rcx, rbx
lea rax, [0x00680900]
call fcn.0044a840
xor ecx, ecx
xor edx, edx
jmp 0x4df091
mov rax, rsi
mov rbx, rcx
mov rcx, rdx
mov rdx, rbx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov ebx, 9
mov rax, qword [rsp + 0x90]
call fcn.004d9ac0
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x20], 8
nop
je 0x4df19c
call fcn.004def80
mov rcx, qword [rsp + 0x40]
inc rcx
mov rdx, qword [rsp + 0x48]
cmp rdx, rcx
jb 0x4df0e4
mov rsi, qword [rsp + 0x60]
jmp 0x4df11d
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x60]
mov rbx, rcx
mov rcx, rdx
mov edi, 1
lea rsi, [0x00680900]
call fcn.0044a920
mov rsi, rax
mov rdx, rcx
mov rax, qword [rsp + 0x70]
mov rcx, rbx
mov rbx, qword [rsp + 0x78]
lea r8, [rcx - 1]
shl r8, 4
mov qword [rsi + r8], rax
lea rdi, [rsi + r8]
lea rdi, [rdi + 8]
cmp dword [0x0092b0b0], 0
jne 0x4df142
mov qword [rsi + r8 + 8], rbx
nop
jmp 0x4df147
call fcn.00465a40
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x20], 9
jne 0x4df186
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
mov ebx, 9
call fcn.004d9ac0
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rax + 0x20]
cmp rdi, 8
je 0x4df1ab
cmp rdi, 7
je 0x4df085
jmp 0x4df1c4
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
mov rax, rsi
mov rbx, rcx
mov rcx, rdx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
lea rax, [0x00679500]
lea rbx, [0x00741e00]
call fcn.00436420
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.004df040
Function at 0x4df200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4df432
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x68], rax
nop dword [rax]
call fcn.0040e4a0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov ebx, 9
call fcn.004d9ac0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x20]
cmp rcx, 5
je 0x4df3c2
cmp rcx, 1
jne 0x4df41e
nop
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rcx
call fcn.004d9bc0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x18]
lea rdi, [rsi - 1]
nop dword [rax]
cmp rdx, rdi
jb 0x4df416
mov rax, qword [rsp + 0x30]
lea r8, [rax - 1]
cmp rdi, r8
jb 0x4df40b
sub rdx, rax
lea rcx, [rdx + 1]
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
sub rsi, rax
lea rax, [rbx + r8]
nop
mov rbx, rsi
mov rcx, rdx
nop dword [rax]
call fcn.004df700
mov byte [rsp + 0x27], dil
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044eb00
movzx edx, byte [rsp + 0x27]
nop dword [rax]
test dl, dl
je 0x4df3f8
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x68]
cmp qword [rcx + 0x20], 9
jne 0x4df31a
mov rax, rcx
mov ebx, 9
call fcn.004d9ac0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x28]
cmp qword [rcx + 0x20], 3
nop
jne 0x4df3e5
mov rax, rcx
mov ebx, 9
call fcn.004d9ac0
mov rax, qword [rsp + 0x68]
call fcn.004def80
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
lea rax, [0x00686640]
mov rbx, qword [rsp + 0x40]
nop dword [rax]
call fcn.004131e0
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
cmp dword [0x0092b0b0], 0
jne 0x4df382
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
nop
jmp 0x4df390
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x48]
call fcn.00465a00
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x20], 9
jne 0x4df3ab
mov ebx, 9
call fcn.004d9ac0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x20]
cmp rcx, 5
je 0x4df3c2
cmp rcx, 4
je 0x4df22a
nop
jmp 0x4df3d1
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x00679500]
lea rbx, [0x00741e00]
nop
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741e00]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741e00]
call fcn.00436420
mov rax, r8
mov rcx, rdi
call fcn.00465e60
mov rcx, rdi
call fcn.00465e20
lea rax, [0x00679500]
lea rbx, [0x00741e00]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.004df200