joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465900
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40348f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409f20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403460
cmp byte [0x00a04a03], 0
je 0x465915
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x462960
jmp 0x403460

Function at 0x465920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00a05120]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00a04a03], 0
je 0x465955
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00a054a0]
aesenc xmm0, xmmword [0x00a054b0]
aesenc xmm0, xmmword [0x00a054c0]
movq rax, xmm0
ret
jmp 0x40a120

Function at 0x465960
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00a05120]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00a04a03], 0
je 0x465996
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00a054a0]
aesenc xmm0, xmmword [0x00a054b0]
aesenc xmm0, xmmword [0x00a054c0]
movq rax, xmm0
ret
jmp 0x40a180

Function at 0x4673a0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00a05420]
mov qword [rsp + 8], rdx
lea r8d, [0x00a04a24]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00465840
add rsp, 0x30
ret

Function at 0x4678e0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46790c
call fcn.00465840
shl rcx, 3
add rcx, 0x1480
mov qword [0x00a04c40], rcx
ret
Function at 0x467e80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x432434
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
cmp dword [0x00a04ed0], 0
nop
jne 0x4322f2
lea rdx, [0x00467320]
mov qword [0x009ae908], rdx
jmp 0x432305
lea rdi, [0x009ae908]
lea rdx, [0x00467320]
call fcn.00465b40
xor eax, eax
jmp 0x432320
lea r8, [0x00a05420]
mov byte [r8 + rax], sil
inc dword [0x00a04a24]
mov rax, rdi
nop dword [rax]
cmp rax, 0x36
jge 0x432370
lea rdx, [0x0072f11c]
movzx esi, byte [rdx + rax]
cmp esi, 0x80
jge 0x43233f
lea rdi, [rax + 1]
jmp 0x432365
mov qword [rsp + 0x20], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
call fcn.0045d080
lea rdx, [0x0072f11c]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x20]
cmp rax, 0x64
jb 0x432309
jmp 0x432429
call fcn.004314e0
call fcn.00449ca0
call fcn.00449d40
nop
call fcn.00431f60
xor eax, eax
call fcn.00431ea0
mov dword [0x00a04a70], eax
call fcn.00432020
call fcn.00431d80
mov dword [0x00a04a50], eax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [sym.imp.kernel32.dll_GetSystemInfo]
lea rcx, [rsp + 0x28]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433e20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x2c]
mov qword [0x00a04bc8], rax
mov rax, qword [sym.imp.kernel32.dll_SetProcessPriorityBoost]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 1
call fcn.00433ea0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov ecx, 0x64
call fcn.00465ec0
nop
call fcn.00463860
jmp 0x4322c0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x4322c0
Function at 0x4682c0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x0072e1bd]
mov ebx, 0x32
call fcn.00436d20
nop
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x461820

Function at 0x46b700
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b7f9
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x46b7e5
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
test rcx, rcx
je 0x46b747
lea rdx, [0x00a04a0a]
nop
cmp rcx, rdx
je 0x46b730
jmp 0x46b777
call fcn.004606e0
mov rax, qword [rsp + 0x28]
xor ebx, ebx
lea rcx, [0x00a04a0a]
call fcn.0045e880
nop
test al, al
jne 0x46b796
call fcn.00460700
mov rax, qword [rsp + 0x28]
lea rdx, [0x00a04a0a]
jmp 0x46b730
cmp qword [rsp + 0x30], rcx
jne 0x46b7cf
add rax, 8
mov rbx, qword [rsp + 0x38]
call fcn.0045e7c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 8]
mov rbx, qword [rsp + 0x38]
mov rax, rcx
call fcn.0045e7c0
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
call fcn.0045e7c0
nop dword [rax + rax]
call fcn.00460700
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f1600]
nop dword [rax]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f15f0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.0046b700
Function at 0x46cc40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46cd86
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x46ccc8
cmp rcx, 0x11
je 0x46ccba
nop dword [rax]
cmp rcx, 0x12
jne 0x46cd28
cmp qword [rax], 8
jne 0x46cd71
cmp qword [rax + 8], 0
je 0x46cd71
bt edx, 7
jae 0x46cca8
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045e900
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x15
jne 0x46cd00
cmp qword [rax], 8
jne 0x46cd5e
cmp qword [rax + 8], 0
je 0x46cd5e
bt edx, 7
jae 0x46cce8
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045f100
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
je 0x46cd1a
cmp rcx, 0x18
jne 0x46cd28
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006e33a0]
call fcn.0040daa0
mov qword [rax + 8], 0x11
lea rcx, [0x0071e85a]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006c7ec0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1010]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1010]
nop
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046cc40
Function at 0x477fa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x478212
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rdi, rdi
jl 0x4781fe
cmp rdi, 9
jg 0x4781eb
test ebx, ebx
jne 0x477fe6
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov edx, ebx
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
bsr rdx, rdx
cmp rdx, 0x19
jge 0x47801b
lea rsi, [rdx - 0x19]
neg rsi
cmp rsi, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rsi
shl ebx, cl
and ebx, r8d
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x19]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x48], rax
imul rdx, rcx, 0x13441
add rdx, 0x1ce618
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x30], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x1b
jg 0x478052
test rdx, rdx
setge r8b
jmp 0x478055
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x23], r8b
mov dword [rsp + 0x24], ebx
mov eax, ebx
mov rbx, rcx
mov rcx, rdx
call fcn.00479220
test rbx, rbx
jge 0x4781d8
mov rdx, qword [rsp + 0x30]
lea r8, [rdx + 9]
cmp r8, 0xa
jae 0x4780a8
mov r8d, dword [rsp + 0x24]
mov r8d, r8d
test r8, r8
je 0x47818b
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x4781a5
movzx esi, byte [rsp + 0x23]
mov r8, rbx
neg rbx
cmp rbx, 0x20
sbb r9d, r9d
mov edi, ecx
mov rcx, rbx
mov r10d, 1
shl r10d, cl
and r10d, r9d
dec r10d
mov r11d, eax
shr eax, cl
and eax, r9d
and r10d, r11d
test sil, sil
je 0x478127
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r9d, 1
shl r9d, cl
and r9d, r8d
cmp r9d, r10d
jb 0x478116
jne 0x47811d
nop
test dil, dil
je 0x478116
cmp r9d, r10d
jne 0x47811d
test dil, dil
je 0x47811d
mov ebx, eax
and eax, 1
jmp 0x478121
mov ecx, 1
jmp 0x478148
mov ebx, eax
xor eax, eax
mov ecx, eax
mov eax, ebx
jmp 0x478148
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r9d, r10d
shr r10d, cl
and r10d, r8d
cmp r10d, 1
sete cl
mov r10d, r9d
test r10d, r10d
je 0x47814f
xor edi, edi
xor edi, 1
mov ebx, eax
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.00478500
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x30]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov esi, 1
mov ecx, 1
jmp 0x4780ad
inc rsi
mov eax, edi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x47818b
mov edi, eax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x47819a
mov eax, edi
mov rdx, r10
movzx esi, byte [rsp + 0x23]
jmp 0x4780ad
lea rax, [0x006bb4c0]
lea rbx, [0x007f1540]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1530]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1520]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00477fa0
Function at 0x478260
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4784c6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
nop dword [rax + rax]
cmp rdi, 0x12
jg 0x4784b2
test rbx, rbx
jne 0x47829e
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
cmp rsi, 0x37
jge 0x4782d9
lea rsi, [rdx - 0x36]
neg rsi
cmp rsi, 0x40
sbb r8, r8
mov r9, rcx
mov rcx, rsi
shl rbx, cl
and rbx, r8
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x36]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
imul rdx, rcx, 0x13441
add rdx, 0x4105b6
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x38], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x37
jg 0x478310
test rdx, rdx
setge r8b
jmp 0x478313
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x27], r8b
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.00479300
test rbx, rbx
jge 0x47849f
mov rdx, qword [rsp + 0x38]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x478365
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x47844f
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x47846a
movzx esi, byte [rsp + 0x27]
mov r8, rbx
neg rbx
cmp rbx, 0x40
sbb r9, r9
mov edi, ecx
mov rcx, rbx
mov r10d, 1
shl r10, cl
and r10, r9
dec r10
mov r11, rax
shr rax, cl
and rax, r9
and r10, r11
test sil, sil
je 0x4783ea
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x40
sbb r8, r8
mov r9d, 1
shl r9, cl
and r9, r8
cmp r9, r10
jb 0x4783d7
jne 0x4783de
nop dword [rax]
test dil, dil
je 0x4783d7
cmp r9, r10
jne 0x4783de
test dil, dil
je 0x4783de
mov rbx, rax
and eax, 1
jmp 0x4783e3
mov ecx, 1
jmp 0x47840b
mov rbx, rax
xor eax, eax
mov ecx, eax
mov rax, rbx
jmp 0x47840b
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x40
sbb r8, r8
mov r9, r10
shr r10, cl
and r10, r8
cmp r10, 1
sete cl
mov r10, r9
test r10, r10
je 0x478412
xor edi, edi
xor edi, 1
mov rbx, rax
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x50]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.00478500
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x38]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov esi, 1
mov ecx, 1
jmp 0x47836a
inc rsi
mov rax, rdi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x47844f
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x47845e
mov rax, rdi
mov rdx, r10
movzx esi, byte [rsp + 0x27]
jmp 0x47836a
lea rax, [0x006bb4c0]
lea rbx, [0x007f1560]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1550]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00478260
Function at 0x479220
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4792d2
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
test rcx, rcx
je 0x4792a8
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x4792be
shl rdx, 4
lea rsi, [0x00990980]
mov rdx, qword [rsi + rdx + 8]
lea rsi, [rdx + 1]
test rcx, rcx
cmovl rdx, rsi
mov eax, eax
mul rdx
mov rsi, rax
shl rax, 7
test rax, rax
sete dil
imul r8, rcx, 0x1a935
sar r8, 0xf
lea rbx, [r8 + rbx]
lea rbx, [rbx - 6]
shl rdx, 7
shr rsi, 0x39
or rdx, rsi
mov rax, rdx
mov ecx, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
shl eax, 6
add rbx, 0xfffffffffffffffa
mov ecx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f1570]
call fcn.00436580
nop
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov eax, dword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00479220

Function at 0x479300
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4793f5
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop dword [rax + rax]
test rcx, rcx
je 0x4793ca
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x4793e1
shl rdx, 4
lea rsi, [0x00990980]
add rdx, rsi
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x10], xmm0
test rcx, rcx
jge 0x47935d
inc qword [rsp + 0x10]
mov rdx, qword [rsp + 0x10]
mov rsi, rax
mov rax, rdx
mul rsi
mov rdi, qword [rsp + 0x18]
mov r8, rax
mov rax, rdi
mov rdi, rdx
mul rsi
add rax, rdi
sbb rsi, rsi
imul rdi, rcx, 0x1a935
sar rdi, 0xf
lea rbx, [rdi + rbx]
lea rbx, [rbx - 8]
sub rdx, rsi
mov rsi, rax
shl rax, 9
nop
test rax, rax
jne 0x4793ae
test r8, r8
sete dil
jmp 0x4793b0
xor edi, edi
shl rdx, 9
shr rsi, 0x37
or rdx, rsi
mov rax, rdx
mov ecx, edi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
shl rax, 8
add rbx, 0xfffffffffffffff8
mov ecx, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f1580]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00479300
Function at 0x479420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4794e6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
cmp rax, 0x64
jae 0x4794a6
nop
cmp rbx, 0xa
jne 0x4794a6
cmp rax, 0xa
jge 0x47946a
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x4794e0
lea rcx, [0x00728c8e]
add rcx, rax
mov eax, 1
jmp 0x479496
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x4794d3
mov rdx, rax
shl rax, 1
cmp rcx, rax
jb 0x4794ce
lea rsi, [0x00733e01]
lea rcx, [rsi + rdx*2]
mov eax, 2
mov rbx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor r8d, r8d
mov r9d, r8d
xor eax, eax
mov rbx, rcx
call fcn.00479940
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00465f80
mov edx, 0xc8
call fcn.00465f00
nop dword [rax]
call fcn.00465f80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00479420

Function at 0x479520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4795eb
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
cmp rax, 0x64
jae 0x4795a6
nop
cmp rbx, 0xa
jne 0x4795a6
cmp rax, 0xa
jge 0x47956a
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x4795e5
lea rcx, [0x00728c8e]
add rcx, rax
mov eax, 1
jmp 0x479596
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x4795da
mov rdx, rax
shl rax, 1
cmp rcx, rax
jb 0x4795d5
lea rsi, [0x00733e01]
lea rcx, [rsi + rdx*2]
mov eax, 2
mov rbx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
test rax, rax
setl r8b
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor r9d, r9d
xor eax, eax
mov rbx, rcx
nop dword [rax]
call fcn.00479940
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00465f80
mov edx, 0xc8
nop
call fcn.00465f00
call fcn.00465f80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00479520
Function at 0x479620
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x479766
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x68], rax
nop dword [rax]
cmp rdi, 0x64
jae 0x479724
cmp rsi, 0xa
jne 0x479724
cmp rdi, 0xa
jge 0x47967a
lea rdx, [rdi + 1]
nop
cmp rdi, rdx
ja 0x479759
lea rdx, [0x00728c8e]
add rdx, rdi
mov esi, 1
jmp 0x4796ae
lea r8, [rdi + rdi]
lea r8, [r8 + 2]
cmp r8, 0xc8
ja 0x47974c
mov rdx, rdi
shl rdi, 1
cmp r8, rdi
jb 0x479741
lea r8, [0x00733e01]
lea rdx, [r8 + rdx*2]
mov esi, 2
lea r8, [rbx + rsi]
cmp rcx, r8
jae 0x4796ea
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x48], rdx
mov rbx, r8
mov rdi, rsi
lea rsi, [0x006bb680]
call fcn.0044aa20
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x30]
mov r8, rbx
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rcx
lea rdi, [rax + rbx]
mov rbx, rdx
mov rax, rdi
mov rcx, rsi
call fcn.00466860
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
test rdi, rdi
setl r8b
mov r9d, 1
call fcn.00479940
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
mov rax, rdi
mov rcx, r8
call fcn.00465f80
mov rcx, r8
mov edx, 0xc8
call fcn.00465f00
mov rax, rdi
mov rcx, rdx
nop
call fcn.00465f80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.00479620
Function at 0x4797c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x479900
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x68], rax
nop dword [rax]
cmp rdi, 0x64
jae 0x4798c4
cmp rsi, 0xa
jne 0x4798c4
cmp rdi, 0xa
jge 0x47981a
lea rdx, [rdi + 1]
nop
cmp rdi, rdx
ja 0x4798f4
lea rdx, [0x00728c8e]
add rdx, rdi
mov esi, 1
jmp 0x47984e
lea r8, [rdi + rdi]
lea r8, [r8 + 2]
cmp r8, 0xc8
ja 0x4798e7
mov rdx, rdi
shl rdi, 1
cmp r8, rdi
jb 0x4798dc
lea r8, [0x00733e01]
lea rdx, [r8 + rdx*2]
mov esi, 2
lea r8, [rbx + rsi]
cmp rcx, r8
jae 0x47988a
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x70], rbx
mov rbx, r8
mov rdi, rsi
lea rsi, [0x006bb680]
call fcn.0044aa20
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x30]
mov r8, rbx
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rcx
lea rdi, [rbx + rax]
mov rbx, rdx
mov rax, rdi
mov rcx, rsi
call fcn.00466860
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
xor r8d, r8d
mov r9d, 1
call fcn.00479940
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, rdi
mov rcx, r8
call fcn.00465f80
mov rcx, r8
mov edx, 0xc8
call fcn.00465f00
mov rax, rdi
mov rcx, rdx
call fcn.00465f80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004797c0
Function at 0x47ece0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47edc6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, rbx
shl rbx, 0x20
mov rsi, rbx
lock xadd qword [rax], rbx
add rsi, rbx
mov rdi, rsi
shr rsi, 0x20
test esi, esi
jl 0x47edae
test edi, edi
je 0x47ed31
nop dword [rax]
test rdx, rdx
jle 0x47ed2d
cmp edx, esi
je 0x47ed9b
test esi, esi
jmp 0x47ed33
test esi, esi
jmp 0x47ed33
test esi, esi
jg 0x47ed51
test edi, edi
je 0x47ed51
mov rdx, qword [rax]
nop dword [rax]
cmp rdx, rdi
jne 0x47ed88
mov qword [rsp + 0x30], rax
xor edx, edx
xchg qword [rax], rdx
jmp 0x47ed7a
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edi
lea rdx, [rax + 8]
xor ebx, ebx
xor ecx, ecx
mov rax, rdx
call fcn.00461100
mov edi, dword [rsp + 0x1c]
dec edi
mov rax, qword [rsp + 0x30]
test edi, edi
jne 0x47ed5b
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f15d0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f15d0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f15c0]
nop dword [rax]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0047ece0

Function at 0x47ee60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47eee0
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
jmp 0x47ee79
mov rax, rbx
mov rcx, qword [rax]
mov rdx, rcx
shr rcx, 0x20
test ecx, ecx
je 0x47eec2
lea rcx, [rdx + 1]
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x47ee76
mov qword [rsp + 0x10], rbx
lea rax, [rbx + 8]
call fcn.00461040
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
test rcx, rcx
jne 0x47eecc
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f15e0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.0047ee60