joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c5e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c726
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x46c668
cmp rcx, 0x11
je 0x46c65a
nop dword [rax]
cmp rcx, 0x12
jne 0x46c6c8
cmp qword [rax], 8
jne 0x46c711
cmp qword [rax + 8], 0
je 0x46c711
bt edx, 7
jae 0x46c648
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045e900
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x15
jne 0x46c6a0
cmp qword [rax], 8
jne 0x46c6fe
cmp qword [rax + 8], 0
je 0x46c6fe
bt edx, 7
jae 0x46c688
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045ed00
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
je 0x46c6ba
cmp rcx, 0x18
jne 0x46c6c8
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00674fa0]
call fcn.0040d960
mov qword [rax + 8], 0x11
lea rcx, [0x006a838c]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00660320]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718950]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718950]
nop
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046c5e0

Function at 0x46f9e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46fac6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, rbx
shl rbx, 0x20
mov rsi, rbx
lock xadd qword [rax], rbx
add rsi, rbx
mov rdi, rsi
shr rsi, 0x20
test esi, esi
jl 0x46faae
test edi, edi
je 0x46fa31
nop dword [rax]
test rdx, rdx
jle 0x46fa2d
cmp edx, esi
je 0x46fa9b
test esi, esi
jmp 0x46fa33
test esi, esi
jmp 0x46fa33
test esi, esi
jg 0x46fa51
test edi, edi
je 0x46fa51
mov rdx, qword [rax]
nop dword [rax]
cmp rdx, rdi
jne 0x46fa88
mov qword [rsp + 0x30], rax
xor edx, edx
xchg qword [rax], rdx
jmp 0x46fa7a
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edi
lea rdx, [rax + 8]
xor ebx, ebx
xor ecx, ecx
mov rax, rdx
call fcn.00460b00
mov edi, dword [rsp + 0x1c]
dec edi
mov rax, qword [rsp + 0x30]
test edi, edi
jne 0x46fa5b
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006576e0]
lea rbx, [0x00718d90]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718d90]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718d80]
nop dword [rax]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0046f9e0
Function at 0x47cb40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47cdb2
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rdi, rdi
jl 0x47cd9e
cmp rdi, 9
jg 0x47cd8b
test ebx, ebx
jne 0x47cb86
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov edx, ebx
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
bsr rdx, rdx
cmp rdx, 0x19
jge 0x47cbbb
lea rsi, [rdx - 0x19]
neg rsi
cmp rsi, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rsi
shl ebx, cl
and ebx, r8d
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x19]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x48], rax
imul rdx, rcx, 0x13441
add rdx, 0x1ce618
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x30], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x1b
jg 0x47cbf2
test rdx, rdx
setge r8b
jmp 0x47cbf5
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x23], r8b
mov dword [rsp + 0x24], ebx
mov eax, ebx
mov rbx, rcx
mov rcx, rdx
call fcn.0047ddc0
test rbx, rbx
jge 0x47cd78
mov rdx, qword [rsp + 0x30]
lea r8, [rdx + 9]
cmp r8, 0xa
jae 0x47cc48
mov r8d, dword [rsp + 0x24]
mov r8d, r8d
test r8, r8
je 0x47cd2b
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x47cd45
movzx esi, byte [rsp + 0x23]
mov r8, rbx
neg rbx
cmp rbx, 0x20
sbb r9d, r9d
mov edi, ecx
mov rcx, rbx
mov r10d, 1
shl r10d, cl
and r10d, r9d
dec r10d
mov r11d, eax
shr eax, cl
and eax, r9d
and r10d, r11d
test sil, sil
je 0x47ccc7
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r9d, 1
shl r9d, cl
and r9d, r8d
cmp r9d, r10d
jb 0x47ccb6
jne 0x47ccbd
nop
test dil, dil
je 0x47ccb6
cmp r9d, r10d
jne 0x47ccbd
test dil, dil
je 0x47ccbd
mov ebx, eax
and eax, 1
jmp 0x47ccc1
mov ecx, 1
jmp 0x47cce8
mov ebx, eax
xor eax, eax
mov ecx, eax
mov eax, ebx
jmp 0x47cce8
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r9d, r10d
shr r10d, cl
and r10d, r8d
cmp r10d, 1
sete cl
mov r10d, r9d
test r10d, r10d
je 0x47ccef
xor edi, edi
xor edi, 1
mov ebx, eax
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.0047d0a0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x30]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov esi, 1
mov ecx, 1
jmp 0x47cc4d
inc rsi
mov eax, edi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x47cd2b
mov edi, eax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x47cd3a
mov eax, edi
mov rdx, r10
movzx esi, byte [rsp + 0x23]
jmp 0x47cc4d
lea rax, [0x006576e0]
lea rbx, [0x00718d00]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718cf0]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718ce0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0047cb40
Function at 0x47ce00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d066
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
nop dword [rax + rax]
cmp rdi, 0x12
jg 0x47d052
test rbx, rbx
jne 0x47ce3e
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
cmp rsi, 0x37
jge 0x47ce79
lea rsi, [rdx - 0x36]
neg rsi
cmp rsi, 0x40
sbb r8, r8
mov r9, rcx
mov rcx, rsi
shl rbx, cl
and rbx, r8
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x36]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
imul rdx, rcx, 0x13441
add rdx, 0x4105b6
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x38], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x37
jg 0x47ceb0
test rdx, rdx
setge r8b
jmp 0x47ceb3
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x27], r8b
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.0047dea0
test rbx, rbx
jge 0x47d03f
mov rdx, qword [rsp + 0x38]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x47cf05
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x47cfef
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x47d00a
movzx esi, byte [rsp + 0x27]
mov r8, rbx
neg rbx
cmp rbx, 0x40
sbb r9, r9
mov edi, ecx
mov rcx, rbx
mov r10d, 1
shl r10, cl
and r10, r9
dec r10
mov r11, rax
shr rax, cl
and rax, r9
and r10, r11
test sil, sil
je 0x47cf8a
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x40
sbb r8, r8
mov r9d, 1
shl r9, cl
and r9, r8
cmp r9, r10
jb 0x47cf77
jne 0x47cf7e
nop dword [rax]
test dil, dil
je 0x47cf77
cmp r9, r10
jne 0x47cf7e
test dil, dil
je 0x47cf7e
mov rbx, rax
and eax, 1
jmp 0x47cf83
mov ecx, 1
jmp 0x47cfab
mov rbx, rax
xor eax, eax
mov ecx, eax
mov rax, rbx
jmp 0x47cfab
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x40
sbb r8, r8
mov r9, r10
shr r10, cl
and r10, r8
cmp r10, 1
sete cl
mov r10, r9
test r10, r10
je 0x47cfb2
xor edi, edi
xor edi, 1
mov rbx, rax
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x50]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.0047d0a0
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x38]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov esi, 1
mov ecx, 1
jmp 0x47cf0a
inc rsi
mov rax, rdi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x47cfef
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x47cffe
mov rax, rdi
mov rdx, r10
movzx esi, byte [rsp + 0x27]
jmp 0x47cf0a
lea rax, [0x006576e0]
lea rbx, [0x00718d20]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718d10]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0047ce00
Function at 0x47ddc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47de72
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
test rcx, rcx
je 0x47de48
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x47de5e
shl rdx, 4
lea rsi, [0x0087fec0]
mov rdx, qword [rsi + rdx + 8]
lea rsi, [rdx + 1]
test rcx, rcx
cmovl rdx, rsi
mov eax, eax
mul rdx
mov rsi, rax
shl rax, 7
test rax, rax
sete dil
imul r8, rcx, 0x1a935
sar r8, 0xf
lea rbx, [r8 + rbx]
lea rbx, [rbx - 6]
shl rdx, 7
shr rsi, 0x39
or rdx, rsi
mov rax, rdx
mov ecx, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
shl eax, 6
add rbx, 0xfffffffffffffffa
mov ecx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006576e0]
lea rbx, [0x00718d30]
call fcn.00436420
nop
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004632e0
mov eax, dword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047ddc0

Function at 0x47dea0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47df95
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop dword [rax + rax]
test rcx, rcx
je 0x47df6a
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x47df81
shl rdx, 4
lea rsi, [0x0087fec0]
add rdx, rsi
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x10], xmm0
test rcx, rcx
jge 0x47defd
inc qword [rsp + 0x10]
mov rdx, qword [rsp + 0x10]
mov rsi, rax
mov rax, rdx
mul rsi
mov rdi, qword [rsp + 0x18]
mov r8, rax
mov rax, rdi
mov rdi, rdx
mul rsi
add rax, rdi
sbb rsi, rsi
imul rdi, rcx, 0x1a935
sar rdi, 0xf
lea rbx, [rdi + rbx]
lea rbx, [rbx - 8]
sub rdx, rsi
mov rsi, rax
shl rax, 9
nop
test rax, rax
jne 0x47df4e
test r8, r8
sete dil
jmp 0x47df50
xor edi, edi
shl rdx, 9
shr rsi, 0x37
or rdx, rsi
mov rax, rdx
mov ecx, edi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
shl rax, 8
add rbx, 0xfffffffffffffff8
mov ecx, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006576e0]
lea rbx, [0x00718d40]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047dea0
Function at 0x47dfc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e08b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
cmp rax, 0x64
jae 0x47e046
nop
cmp rbx, 0xa
jne 0x47e046
cmp rax, 0xa
jge 0x47e00a
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x47e085
lea rcx, [0x006b09c5]
add rcx, rax
mov eax, 1
jmp 0x47e036
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x47e07a
mov rdx, rax
shl rax, 1
cmp rcx, rax
jb 0x47e075
lea rsi, [0x006b9182]
lea rcx, [rsi + rdx*2]
mov eax, 2
mov rbx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
test rax, rax
setl r8b
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor r9d, r9d
xor eax, eax
mov rbx, rcx
nop dword [rax]
call fcn.0047e0c0
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00465a00
mov edx, 0xc8
nop
call fcn.00465980
call fcn.00465a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047dfc0
Function at 0x480d60
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x480dcb
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x480d84
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x480da1
cmp rdx, 0
je 0x480ded
test rdx, 0xf
je 0x480d7d
test rdx, 7
jne 0x480da1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x480d7d
ret
Function at 0x481be0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x481ddb
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
nop dword [rax + rax]
cmp rdi, 8
ja 0x481dc7
test sil, sil
je 0x481c19
cmp rcx, 8
jne 0x481db4
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x008614e8], rdx
jl 0x481c55
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
mov qword [rsp + 0x98], rcx
xor edx, edx
jmp 0x481ca5
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rax + 8], r8
lea r8, [r8 + r8*2]
shl r8, 4
lea r12, [r8 + r11]
lea r12, [r12 - 0x30]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r12], xmm0
lea r8, [r8 + r11]
lea r8, [r8 - 0x20]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r8 + 0x10], xmm0
inc qword [rax + 0x38]
inc rdx
mov rcx, r9
cmp rdi, rdx
jle 0x481da5
cmp rdx, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rdx
mov r10d, 1
shl r10d, cl
and r10d, r8d
test sil, r10b
mov r8d, 2
mov r10d, 3
cmovne r8, r10
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
mov qword [rsp + 0x48], r8
imul rcx, r9
lea r8, [rbx + rcx]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov r8, qword [rax + 0x38]
mov qword [rsp + 0x68], r8
mov r8, qword [rax + 8]
inc r8
mov r11, qword [rax]
mov rcx, qword [rax + 0x10]
nop word [rax + rax]
cmp rcx, r8
jae 0x481c61
mov qword [rsp + 0x40], rdx
mov rax, r11
mov rbx, r8
mov edi, 1
lea rsi, [0x0068e760]
call fcn.0044a920
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 0x10], rcx
cmp dword [0x008f2cf0], 0
jne 0x481d60
mov qword [rdi], rax
jmp 0x481d65
call fcn.004654a0
mov rdx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x98]
mov r10d, 3
mov r8, rbx
mov r11, rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
nop
jmp 0x481c61
mov eax, 1
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006576e0]
lea rbx, [0x00718a80]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718870]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp fcn.00481be0
Function at 0x4844e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x200]
cmp r12, qword [r14 + 0x10]
jbe 0x484799
sub rsp, 0x280
mov qword [rsp + 0x278], rbp
lea rbp, [rsp + 0x278]
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x298], rcx
mov qword [rsp + 0x2a0], rdi
bt esi, 9
jae 0x484785
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf8], rcx
movzx edx, byte [rcx + 0x17]
mov byte [rsp + 0xcf], dl
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
call fcn.0048c2e0
mov rdx, qword [rsp + 0xe0]
and edx, 0x1e0
movzx edi, byte [rsp + 0xcf]
and edi, 0x1f
or rdi, rdx
mov rdx, qword [0x0071d9d0]
lea r8, [0x0071d9c8]
cmp rax, r8
jne 0x484776
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe8], rbx
nop
lea rcx, [0x0048d7e0]
mov qword [rsp + 0xd0], rcx
movups xmmword [rsp + 0x1c0], xmm15
lea rdi, [rsp + 0x1c8]
lea rdi, [rdi - 0x10]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465bef
mov rbp, qword [rbp]
mov rax, rbx
xor ebx, ebx
call fcn.00487940
mov rcx, qword [rsp]
mov qword [rsp + 0x1c0], rcx
lea rdi, [rsp + 0x1c8]
lea rsi, [rsp + 8]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465f26
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x1c0]
mov qword [rsp + 0x108], rcx
lea rdi, [rsp + 0x110]
lea rsi, [rsp + 0x1c8]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465f26
mov rbp, qword [rbp]
lea rax, [0x0067e460]
call fcn.0040d960
mov rcx, qword [rsp + 0xd0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1b0]
cmp dword [0x008f2cf0], 0
jne 0x4846a2
mov qword [rax + 8], rcx
nop
jmp 0x4846ab
lea rdi, [rax + 8]
call fcn.004655a0
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0x198]
mov qword [rax + 0x10], rdx
movzx edx, word [rsp + 0x1b8]
mov word [rax + 0x18], dx
mov r8, qword [rsp + 0xe0]
sar r8, 0xa
mov qword [rax + 0x20], r8
mov rsi, qword [rsp + 0xd8]
mov qword [rax + 0x38], rsi
cmp dword [0x008f2cf0], 0
jne 0x48470a
mov rcx, qword [rsp + 0xf8]
mov qword [rax + 0x28], rcx
mov rdi, qword [rsp + 0x100]
mov qword [rax + 0x30], rdi
jmp 0x48472f
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0xf8]
call fcn.004655a0
lea rdi, [rax + 0x30]
mov r9, qword [rsp + 0x100]
call fcn.00465640
mov rdi, r9
mov rax, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x290]
nop
call fcn.00488fc0
mov rax, qword [rsp + 0xe8]
test byte [rax], al
mov rcx, qword [rsp + 0xe0]
and ecx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0x278]
add rsp, 0x280
ret
mov rbx, rdx
lea rcx, [0x00695640]
call fcn.0040ac60
lea rax, [0x006576e0]
lea rbx, [0x007189e0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004844e0
Function at 0x485520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485587
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x12
jne 0x485554
mov rax, qword [rax + 0x38]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00485160
mov ecx, 0x22
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006b0066]
call fcn.0044e760
call fcn.0040afc0
mov rbx, rax
lea rax, [0x006576e0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.00485520

Function at 0x485700
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x68]
cmp r12, qword [r14 + 0x10]
jbe 0x48581a
sub rsp, 0xe8
mov qword [rsp + 0xe0], rbp
lea rbp, [rsp + 0xe0]
movups xmmword [rsp + 0xf0], xmm15
lea rdi, [rsp + 0xf8]
lea rdi, [rdi - 0x20]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465c0b
mov rbp, qword [rbp]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop word [rax + rax]
cmp rcx, 0x19
jne 0x4857e3
call fcn.004860c0
mov rcx, qword [rsp]
mov qword [rsp + 0x78], rcx
lea rdi, [rsp + 0x80]
lea rsi, [rsp + 8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465f6c
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0xf0], rcx
lea rdi, [rsp + 0xf8]
lea rsi, [rsp + 0x80]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465f6c
mov rbp, qword [rbp]
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
call fcn.00485160
mov ecx, 0x22
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006b00aa]
nop dword [rax]
call fcn.0044e760
call fcn.0040afc0
mov rbx, rax
lea rax, [0x006576e0]
call fcn.00436420
nop
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
call fcn.004632e0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp fcn.00485700

Function at 0x485a60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485ac7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x19
jne 0x485a94
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00485160
mov ecx, 0x25
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006b1424]
call fcn.0044e760
call fcn.0040afc0
mov rbx, rax
lea rax, [0x006576e0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
call fcn.004632e0
mov rax, qword [rsp + 8]
jmp fcn.00485a60
Function at 0x4860c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48623a
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465c0b
mov rbp, qword [rbp]
nop word [rax + rax]
test rbx, rbx
jl 0x486226
mov rcx, qword [rax + 0x38]
cmp qword [rax + 0x40], rbx
jle 0x486226
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
lea rdx, [rbx + rbx*2]
mov rsi, qword [rcx + rdx*8 + 8]
test rsi, rsi
je 0x48613e
lea rdi, [0x0071d9c8]
jmp 0x486142
xor edi, edi
xor esi, esi
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov rax, qword [rcx + rdx*8]
call fcn.004848a0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rdx + rcx*8]
movzx ebx, byte [rbx]
test bl, 8
setne byte [rsp + 0x90]
mov rbx, qword [rdx + rcx*8]
movzx ebx, byte [rbx]
test bl, 1
jne 0x4861b9
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x30]
nop dword [rax]
call fcn.004848a0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rax, qword [rdx + rcx*8]
nop dword [rax]
call fcn.00484980
test rbx, rbx
je 0x4861d4
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rdx + rcx*8 + 0x10]
mov qword [rsp + 0x70], rcx
lea rax, [0x00658980]
call fcn.0040d960
mov rcx, qword [rsp + 0xa0]
mov qword [rax], rcx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov qword [rsp + 0x88], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006576e0]
lea rbx, [0x00718a00]
call fcn.00436420
nop
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
call fcn.004632e0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp fcn.004860c0