joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485aa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485d0e
push rbp
mov rbp, rsp
sub rsp, 0x38
test rdi, rdi
jl 0x485cfa
nop dword [rax + rax]
cmp rdi, 9
jg 0x485ce7
test ebx, ebx
jne 0x485ad9
movups xmmword [rax + 0x18], xmm15
add rsp, 0x38
pop rbp
ret
mov edx, ebx
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
bsr rdx, rdx
cmp rdx, 0x19
jge 0x485b0e
lea rsi, [rdx - 0x19]
neg rsi
mov r8, rcx
mov rcx, rsi
shl ebx, cl
lea rdx, [rdx + r8]
lea rdx, [rdx - 0x19]
cmp rcx, 0x20
sbb esi, esi
and ebx, esi
jmp 0x485b11
mov rdx, rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rdi
imul rsi, rdx, 0x13441
add rsi, 0x1ce618
sar rsi, 0x12
mov rcx, rdi
sub rcx, rsi
mov qword [rsp + 0x30], rcx
lea rsi, [rcx - 1]
nop dword [rax]
cmp rsi, 0x1b
jg 0x485b4f
test rsi, rsi
setge r8b
jmp 0x485b52
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x23], r8b
mov dword [rsp + 0x24], ebx
mov eax, ebx
mov rbx, rdx
mov rcx, rsi
call fcn.00486cc0
test rbx, rbx
jge 0x485cd4
mov rdx, qword [rsp + 0x30]
lea r8, [rdx + 9]
nop
cmp r8, 0xa
jae 0x485ba5
mov r8d, dword [rsp + 0x24]
mov r8d, r8d
test r8, r8
je 0x485c83
mov r9, qword [rsp + 0x28]
neg r9
nop
jmp 0x485ca0
movzx esi, byte [rsp + 0x23]
mov r8, rbx
neg rbx
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9d, cl
mov r10d, eax
shr eax, cl
cmp rcx, 0x20
sbb ebx, ebx
and r9d, ebx
dec r9d
and ebx, eax
and r9d, r10d
test sil, sil
je 0x485c22
lea rcx, [r8 + 1]
neg rcx
mov r8d, 1
shl r8d, cl
cmp rcx, 0x20
sbb r10d, r10d
and r8d, r10d
cmp r8d, r9d
jb 0x485c13
jne 0x485c1b
test dil, dil
je 0x485c13
nop
cmp r8d, r9d
jne 0x485c1b
test dil, dil
je 0x485c1b
mov r8d, ebx
and r8d, 1
jmp 0x485c44
mov r8d, 1
jmp 0x485c44
xor r8d, r8d
nop
jmp 0x485c44
lea rcx, [r8 + 1]
neg rcx
mov r10d, r9d
shr r9d, cl
cmp rcx, 0x20
sbb r11d, r11d
and r9d, r11d
cmp r9d, 1
sete r8b
mov r9d, r10d
test r9d, r9d
je 0x485c4b
xor edi, edi
xor edi, 1
mov rax, qword [rsp + 0x48]
mov ecx, edi
mov edi, r8d
mov rsi, qword [rsp + 0x60]
nop dword [rax]
call fcn.00485fe0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x30]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
add rsp, 0x38
pop rbp
ret
mov esi, 1
mov ecx, 1
jmp 0x485baa
dec r9
mov eax, esi
mov r8, rdx
mov rdx, rdi
nop dword [rax]
test r9, r9
jle 0x485c83
mov esi, eax
movabs rax, 0xcccccccccccccccd
mov rdi, rdx
mul r8
shr rdx, 2
lea r10, [rdx + rdx*4]
nop
cmp r8, r10
je 0x485c92
mov eax, esi
mov rdx, rdi
movzx esi, byte [rsp + 0x23]
jmp 0x485baa
lea rax, [0x0066d140]
lea rbx, [0x007404d0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007404c0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007404b0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00485aa0
Function at 0x485d40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485f9c
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp rdi, 0x12
jg 0x485f88
nop dword [rax]
test rbx, rbx
jne 0x485d70
movups xmmword [rax + 0x18], xmm15
add rsp, 0x40
pop rbp
ret
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
cmp rsi, 0x37
jge 0x485dad
lea rsi, [rdx - 0x36]
neg rsi
mov r8, rcx
mov rcx, rsi
shl rbx, cl
lea rdx, [rdx + r8]
lea rdx, [rdx - 0x36]
cmp rcx, 0x40
sbb rsi, rsi
and rbx, rsi
jmp 0x485db0
mov rdx, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rdi
imul rsi, rdx, 0x13441
add rsi, 0x4105b6
sar rsi, 0x12
mov rcx, rdi
sub rcx, rsi
mov qword [rsp + 0x38], rcx
lea rsi, [rcx - 1]
nop dword [rax + rax]
cmp rsi, 0x37
jg 0x485def
test rsi, rsi
setge r8b
jmp 0x485df2
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x27], r8b
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov rbx, rdx
mov rcx, rsi
call fcn.00486da0
test rbx, rbx
jge 0x485f75
mov rdx, qword [rsp + 0x38]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x485e45
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x485f25
mov r9, qword [rsp + 0x28]
neg r9
nop dword [rax]
jmp 0x485f40
movzx esi, byte [rsp + 0x27]
mov r8, rbx
neg rbx
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9, cl
mov r10, rax
shr rax, cl
cmp rcx, 0x40
sbb rbx, rbx
and r9, rbx
dec r9
and rbx, rax
and r9, r10
test sil, sil
je 0x485ec7
lea rcx, [r8 + 1]
neg rcx
mov r8d, 1
shl r8, cl
cmp rcx, 0x40
sbb r10, r10
and r8, r10
cmp r8, r9
jb 0x485eb8
jne 0x485ec2
nop dword [rax]
test dil, dil
je 0x485eb8
cmp r8, r9
jne 0x485ec2
test dil, dil
je 0x485ec2
mov r8, rbx
and r8d, 1
jmp 0x485ee9
mov r8d, 1
nop
jmp 0x485ee9
xor r8d, r8d
jmp 0x485ee9
lea rcx, [r8 + 1]
neg rcx
mov r10, r9
shr r9, cl
cmp rcx, 0x40
sbb r11, r11
and r9, r11
cmp r9, 1
sete r8b
mov r9, r10
test r9, r9
je 0x485ef0
xor edi, edi
xor edi, 1
mov rax, qword [rsp + 0x50]
mov ecx, edi
mov edi, r8d
mov rsi, qword [rsp + 0x68]
call fcn.00485fe0
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x38]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
add rsp, 0x40
pop rbp
ret
mov esi, 1
mov ecx, 1
jmp 0x485e4a
dec r9
mov rax, rsi
mov r8, rdx
mov rdx, rdi
test r9, r9
jle 0x485f25
mov rsi, rax
movabs rax, 0xcccccccccccccccd
mov rdi, rdx
mul r8
shr rdx, 2
lea r10, [rdx + rdx*4]
cmp r8, r10
je 0x485f34
mov rax, rsi
mov rdx, rdi
movzx esi, byte [rsp + 0x27]
jmp 0x485e4a
lea rax, [0x0066d140]
lea rbx, [0x007404f0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007404e0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00485d40
Function at 0x486cc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486d66
push rbp
mov rbp, rsp
sub rsp, 0x10
test rcx, rcx
je 0x486d3e
lea rdx, [rcx + 0x15c]
nop
cmp rdx, 0x2b7
ja 0x486d50
shl rdx, 4
lea rsi, [0x008866a0]
mov rdx, qword [rsi + rdx + 8]
lea rsi, [rdx + 1]
test rcx, rcx
cmovl rdx, rsi
mov eax, eax
mul rdx
shl rdx, 7
mov rsi, rax
shr rsi, 0x39
or rdx, rsi
shl rax, 7
imul rsi, rcx, 0x1a935
sar rsi, 0xf
lea rbx, [rsi + rbx]
lea rbx, [rbx - 6]
nop
test rax, rax
sete cl
mov rax, rdx
add rsp, 0x10
pop rbp
ret
shl eax, 6
add rbx, 0xfffffffffffffffa
mov ecx, 1
add rsp, 0x10
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740500]
nop
call fcn.004337c0
nop
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov eax, dword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00486cc0

Function at 0x486da0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486e7e
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
je 0x486e57
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x486e6a
shl rdx, 4
lea rsi, [0x008866a0]
add rdx, rsi
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x10], xmm0
test rcx, rcx
jge 0x486def
inc qword [rsp + 0x10]
mov rdx, qword [rsp + 0x10]
mov rsi, rax
mov rax, rdx
mul rsi
mov rdi, qword [rsp + 0x18]
mov r8, rax
mov rax, rdi
mov rdi, rdx
mul rsi
imul rsi, rcx, 0x1a935
sar rsi, 0xf
lea rbx, [rsi + rbx]
lea rbx, [rbx - 8]
nop
add rax, rdi
sbb rsi, rsi
mov rdi, rax
shl rdi, 9
sub rdx, rsi
test rdi, rdi
jne 0x486e42
test r8, r8
sete sil
nop
jmp 0x486e44
xor esi, esi
shl rdx, 9
shr rax, 0x37
or rax, rdx
mov ecx, esi
add rsp, 0x20
pop rbp
ret
shl rax, 8
add rbx, 0xfffffffffffffff8
mov ecx, 1
add rsp, 0x20
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740510]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00486da0
Function at 0x48a580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a780
push rbp
mov rbp, rsp
sub rsp, 0x78
cmp rdi, 8
ja 0x48a76c
nop dword [rax]
test sil, sil
je 0x48a5af
cmp rcx, 8
jne 0x48a759
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x00871248], rdx
jl 0x48a5eb
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
xor edx, edx
jmp 0x48a640
xor eax, eax
add rsp, 0x78
pop rbp
ret
mov qword [rax + 8], r10
lea r10, [r10 + r10*2]
movups xmm0, xmmword [rsp + 0x40]
shl r10, 4
lea r13, [r10 + r12]
lea r13, [r13 - 0x20]
lea r10, [r10 + r12]
lea r10, [r10 - 0x30]
movups xmmword [r10], xmm0
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [r13], xmm0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [r13 + 0x10], xmm0
inc qword [rax + 0x38]
lea rdx, [rcx + 1]
mov rcx, r9
nop word [rax + rax]
cmp rdi, rdx
jle 0x48a74e
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov r8, rdx
imul rdx, rcx
mov r9, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rdx, rbx
cmp rcx, 0x20
sbb r11d, r11d
and r10d, r11d
test sil, r10b
mov r10d, 2
mov r11d, 3
cmovne r10, r11
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r9
mov rdx, qword [rax + 0x38]
mov qword [rsp + 0x60], rdx
mov rdx, qword [rax + 0x10]
mov r10, qword [rax + 8]
inc r10
mov r12, qword [rax]
nop word [rax + rax]
cmp rdx, r10
jae 0x48a5f3
mov qword [rsp + 0x70], rcx
mov rax, r12
mov rbx, r10
mov rcx, rdx
mov edi, 1
lea rsi, [0x006abae0]
call fcn.00447aa0
mov rdx, qword [rsp + 0x88]
mov qword [rdx + 0x10], rcx
cmp dword [0x0092d940], 0
je 0x48a70f
nop dword [rax]
call fcn.0045fe40
mov qword [r11], rax
mov r8, qword [rdx]
mov qword [r11 + 8], r8
mov qword [rdx], rax
mov rcx, qword [rsp + 0x70]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r8, rcx
mov r9, qword [rsp + 0x98]
mov r11d, 3
mov r10, rbx
mov r12, rax
mov rax, rdx
mov rbx, qword [rsp + 0x90]
jmp 0x48a5f3
mov eax, 1
add rsp, 0x78
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740700]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007406e0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp fcn.0048a580
Function at 0x48caa0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x1f8]
cmp r12, qword [r14 + 0x10]
jbe 0x48cd46
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x298], rdi
bt esi, 9
jae 0x48cd31
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x1a8], rdi
mov qword [rsp + 0xd8], rsi
mov rdx, rsi
and esi, 0x1e0
movzx r8d, byte [rcx + 0x17]
and r8d, 0x1f
or r8, rsi
mov qword [rsp + 0xd0], r8
nop
mov rax, rcx
mov rbx, rdi
mov rcx, rdx
call fcn.00494fe0
lea rdx, [0x007469a8]
nop word [rax + rax]
cmp rax, rdx
jne 0x48cd1e
mov qword [rsp + 0x1a0], rbx
lea rcx, [0x00498e60]
mov qword [rsp + 0xc8], rcx
nop
movups xmmword [rsp + 0x1b8], xmm15
lea rdi, [rsp + 0x1c0]
lea rdi, [rdi - 0x10]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004604af
mov rbp, qword [rbp]
mov rax, rbx
xor ebx, ebx
call fcn.0048f480
mov rcx, qword [rsp]
mov qword [rsp + 0x1b8], rcx
lea rdi, [rsp + 0x1c0]
lea rsi, [rsp + 8]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607e6
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x1b8]
mov qword [rsp + 0xe8], rcx
lea rdi, [rsp + 0xf0]
lea rsi, [rsp + 0x1c0]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004607e6
mov rbp, qword [rbp]
lea rax, [0x00698a40]
call fcn.0040d480
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x190]
cmp dword [0x0092d940], 0
je 0x48cc48
nop dword [rax + rax]
call fcn.0045fe20
mov qword [r11], rcx
mov qword [rax + 8], rcx
mov rdx, qword [rsp + 0x178]
mov qword [rax + 0x10], rdx
movzx edx, word [rsp + 0x198]
mov word [rax + 0x18], dx
mov r8, qword [rsp + 0xd8]
mov rdx, r8
sar rdx, 0xa
mov qword [rax + 0x20], rdx
mov rsi, qword [rsp + 0xd0]
mov qword [rax + 0x38], rsi
cmp dword [0x0092d940], 0
jne 0x48cca0
mov rcx, qword [rsp + 0x1b0]
mov rdi, qword [rsp + 0x1a8]
jmp 0x48cccc
call fcn.0045fe80
mov rcx, qword [rsp + 0x1b0]
mov qword [r11], rcx
mov r9, qword [rax + 0x28]
mov qword [r11 + 8], r9
mov rdi, qword [rsp + 0x1a8]
mov qword [r11 + 0x10], rdi
mov r9, qword [rax + 0x30]
mov qword [r11 + 0x18], r9
mov qword [rsp + 0xe0], rax
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rdi
mov rbx, qword [rsp + 0x288]
mov r8, rdx
mov rax, qword [rsp + 0x280]
call fcn.00490c00
mov rax, qword [rsp + 0x1a0]
test byte [rax], al
mov rcx, qword [rsp + 0xd8]
and ecx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xe0]
add rsp, 0x270
pop rbp
ret
mov rbx, qword [0x007469b0]
lea rcx, [0x006b30e0]
call fcn.0040a5a0
lea rax, [0x0066d140]
lea rbx, [0x00740730]
nop
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.0048caa0
Function at 0x48dd00
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48df3b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x48dd9a
mov qword [rsp + 0x88], rax
lea rbx, [0x006bc560]
mov rcx, rax
lea rax, [0x008a70c0]
call fcn.0046a0a0
test cl, cl
jne 0x48dd83
mov rax, qword [rsp + 0x88]
call fcn.0048d040
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x28]
lea rbx, [0x0073e3e8]
call fcn.0044abe0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
call fcn.0048f120
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x48ddc0
lea rdx, [0x006b56a0]
cmp rax, rdx
jne 0x48ddab
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
nop
nop dword [rax + rax]
call fcn.0045b5e0
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x00677720]
call fcn.0040a4e0
inc rdx
nop dword [rax]
cmp rbx, rdx
jle 0x48de04
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x48ddba
lea rax, [0x008a70c0]
lea rbx, [0x006bc560]
lea rdi, [0x006b56a0]
call fcn.0046a260
lea rdx, [0x006b56a0]
cmp rax, rdx
jne 0x48df2b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
lea rcx, [0x006673c0]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rcx
lea rax, [0x006872a0]
call fcn.0040d480
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x68]
test byte [rcx], al
cmp dword [0x0092d940], 0
je 0x48de5d
mov rbx, rax
lea rax, [0x006872a0]
call fcn.00413600
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
nop
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.00401420
nop
call fcn.0045b6e0
mov rsi, qword [rsp + 0x70]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x48dec6
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x48deb8
mov dword [rsi + 0x10], edx
cmp dword [0x0092d940], 0
je 0x48dee7
call fcn.0045fe40
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x008a70c0]
lea rbx, [0x006bc560]
lea rdi, [0x006b56a0]
call fcn.0046a260
lea rdx, [0x006b56a0]
cmp rax, rdx
jne 0x48df1c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x00677720]
call fcn.0040a4e0
mov rbx, rdx
lea rcx, [0x00677720]
call fcn.0040a4e0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.0048dd00
Function at 0x48df60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48dff9
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
nop dword [rax]
test rbx, rbx
je 0x48dfe5
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov rdx, qword [rbx + 0x98]
mov rax, rcx
nop
call rdx
cmp rax, 0x14
jne 0x48dfce
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x100]
mov rax, qword [rsp + 0x30]
call rcx
mov rbx, qword [rsp + 0x20]
test byte [rbx], al
nop
call fcn.0048e0e0
add rsp, 0x10
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740780]
nop dword [rax]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740770]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.0048df60
Function at 0x490560
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490625
push rbp
mov rbp, rsp
sub rsp, 0x48
test rax, rax
je 0x4905c5
test rax, 0x60
jne 0x490585
add rsp, 0x48
pop rbp
ret
call fcn.00490320
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x006d3625]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x006c5816]
call fcn.0044ac80
call fcn.0040a940
mov rbx, rax
lea rax, [0x0066d140]
nop
call fcn.004337c0
call fcn.00490320
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
lea rax, [0x006907a0]
nop dword [rax + rax]
call fcn.0040d480
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x0092d940], 0
jne 0x490616
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00679700]
call fcn.004337c0
call fcn.0045fe20
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
jmp 0x4905f7
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.00490560

Function at 0x490640
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490754
push rbp
mov rbp, rsp
sub rsp, 0x48
test rax, rax
je 0x4906f4
nop dword [rax + rax]
test rax, 0x60
jne 0x4906b4
bt eax, 8
jae 0x490674
add rsp, 0x48
pop rbp
ret
call fcn.00490320
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x006cbfc1]
mov r9d, 0x1a
xor eax, eax
lea rbx, [0x006c5816]
call fcn.0044ac80
nop
call fcn.0040a940
mov rbx, rax
lea rax, [0x0066d140]
call fcn.004337c0
call fcn.00490320
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x006d3625]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x006c5816]
call fcn.0044ac80
nop
call fcn.0040a940
mov rbx, rax
lea rax, [0x0066d140]
call fcn.004337c0
call fcn.00490320
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
lea rax, [0x006907a0]
call fcn.0040d480
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x0092d940], 0
nop
jne 0x490745
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00679700]
nop dword [rax]
call fcn.004337c0
call fcn.0045fe20
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
jmp 0x490722
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.00490640

Function at 0x490780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4907d9
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
bt ecx, 8
jae 0x4907c5
mov qword [rsp + 0x18], rbx
and ecx, 0x60
or rcx, 0x16
mov qword [rsp + 0x10], rcx
nop
call fcn.0048dd00
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
add rsp, 0x20
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x007407d0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00490780
Function at 0x4908c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490a86
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
nop
cmp rcx, 0x11
jne 0x490981
movzx esi, byte [rax + 0x17]
and esi, 0x1f
cmp rsi, 0x12
ja 0x490918
nop word [rax + rax]
cmp rsi, 0x11
jne 0x49090c
mov rsi, qword [rax + 0x30]
jmp 0x49093e
cmp rsi, 0x12
jne 0x49093c
mov rsi, qword [rax + 0x30]
jmp 0x49093e
cmp rsi, 0x15
jne 0x490924
mov rsi, qword [rax + 0x38]
jmp 0x49093e
cmp rsi, 0x16
jne 0x490930
mov rsi, qword [rax + 0x30]
jmp 0x49093e
cmp rsi, 0x17
jne 0x49093c
mov rsi, qword [rax + 0x30]
jmp 0x49093e
xor esi, esi
movzx esi, byte [rsi + 0x17]
and esi, 0x1f
cmp rsi, 8
jne 0x490a70
bt edx, 8
jae 0x490a5d
mov rcx, qword [rax + 0x40]
nop dword [rax]
test rcx, rcx
jl 0x490a58
mov rax, rbx
neg rbx
cmp rcx, rbx
ja 0x490a49
mov rbx, rcx
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x17
jne 0x490a0e
movzx edx, byte [rax + 0x17]
and edx, 0x1f
cmp rdx, 0x12
ja 0x4909b0
cmp rdx, 0x11
jne 0x4909a4
mov rdx, qword [rax + 0x30]
jmp 0x4909da
cmp rdx, 0x12
jne 0x4909d8
mov rdx, qword [rax + 0x30]
jmp 0x4909da
cmp rdx, 0x15
jne 0x4909c0
mov rdx, qword [rax + 0x38]
jmp 0x4909da
cmp rdx, 0x16
jne 0x4909cc
mov rdx, qword [rax + 0x30]
jmp 0x4909da
cmp rdx, 0x17
jne 0x4909d8
mov rdx, qword [rax + 0x30]
jmp 0x4909da
xor edx, edx
movzx edx, byte [rdx + 0x17]
and edx, 0x1f
cmp rdx, 8
jne 0x4909fb
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov rbx, rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x007407e0]
call fcn.004337c0
mov qword [rsp + 0x10], rcx
lea rax, [0x006907a0]
call fcn.0040d480
mov qword [rax + 8], 0x13
lea rcx, [0x006c8994]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00679700]
call fcn.004337c0
test rax, rax
je 0x490a53
call fcn.00456dc0
call fcn.00456e60
call fcn.00456dc0
lea rax, [0x0066d140]
lea rbx, [0x00740800]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007407f0]
nop
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004908c0