joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ab00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40ac58
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
cmp dword [rax + 0xc0], 0
jne 0x40ac3e
mov rax, qword [0x007c36f8]
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
mov rbx, rdx
shr rdx, 2
lea rdx, [rdx + rdx*2]
cmp rcx, rdx
jae 0x40ab84
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.0040ac80
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x20], rax
lea rax, [rbx + rbx]
lea rax, [rax + 2]
shl rax, 3
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.0040daa0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
shl rdx, 1
mov qword [rax], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea rdx, [0x0046e680]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
mov qword [rsp], rdx
call fcn.0040bcc0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x28]
cmp qword [rcx + 8], rax
jne 0x40ac25
lea rax, [0x007c36f8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.004045c0
mov rax, qword [0x007c36f8]
nop dword [rax + rax]
jmp 0x40ab67
lea rax, [0x006659e7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.00439220
lea rax, [0x0065cec1]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
call fcn.00439220
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.0040ab00

Function at 0x40bd40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40be97
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 8]
inc rdx
mov qword [rcx + 8], rdx
nop
mov rbx, rcx
shl rcx, 0x10
mov rsi, rdx
and rdx, 0x7ffff
or rcx, rdx
mov rdx, rcx
sar rcx, 0x13
shl rcx, 3
cmp rbx, rcx
jne 0x40bdc3
mov rcx, qword [rsp + 0x38]
mov rsi, qword [rcx]
mov qword [rbx], rsi
mov rax, rsi
lock cmpxchg qword [rcx], rdx
sete sil
test sil, sil
je 0x40bda2
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x20], rcx
call fcn.0043aa00
lea rax, [0x00666c9c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.0043b480
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0043b3c0
lea rax, [0x0065a6cf]
mov qword [rsp], rax
mov qword [rsp + 8], 5
call fcn.0043b480
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0043b2a0
lea rax, [0x0065ae5e]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0043b480
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0043b2a0
lea rax, [0x0065b1f7]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0043b480
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0043b3c0
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x0065c1d3]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.00439220
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.0040bd40
Function at 0x40c3e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40c518
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
nop dword [rax]
cmp qword [rcx], rax
jne 0x40c4fe
mov qword [rsp + 0x18], rax
mov qword [rsp], rcx
call fcn.004350e0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x30]
mov rdx, rax
xor eax, eax
mov rbx, qword [rsp + 0x30]
lock cmpxchg qword [rbx], rcx
sete al
test al, al
je 0x40c4d5
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe5], 1
mov rax, qword [0x007c36f0]
cmp qword [rax], 0
jne 0x40c4a3
jmp 0x40c4c1
mov qword [rsp], 0x989680
call fcn.00434e20
mov rax, qword [0x007c36f0]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.0046c4a0
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
test rax, rax
je 0x40c470
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe5], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
nop
ret
mov qword [rsp], 0xffffffffffffffff
call fcn.00434e20
mov rdx, qword [rsp + 0x18]
jmp 0x40c4ab
cmp qword [rbx], 1
jne 0x40c4e5
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0066258c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.00439220
lea rax, [0x0065e4e8]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.00439220
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.0040c3e0
Function at 0x40c540
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x28]
lock cmpxchg qword [rbx], rdx
sete dl
test dl, dl
je 0x40c764
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x30]
test rax, rax
jge 0x40c607
mov rax, qword [rcx + 0x30]
mov byte [rax + 0xe5], 1
mov rax, qword [0x007c36f0]
cmp qword [rax], 0
nop
jne 0x40c5c5
jmp 0x40c5f8
mov rax, qword [0x007c36f0]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
nop dword [rax + rax]
call fcn.0046c4a0
mov qword [rsp], 0x989680
call fcn.00434e20
cmp dword [rsp + 8], 0
jl 0x40c5a4
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp], 0xffffffffffffffff
call fcn.00434e20
jmp 0x40c5d9
call fcn.0046e5a0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x40c622
mov rax, rdx
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rdx + 0x30]
mov byte [rbx + 0xe5], 1
mov rbx, qword [0x007c36f0]
cmp qword [rbx], 0
je 0x40c64e
nop
cmp rcx, 0x989680
jle 0x40c64e
mov ecx, 0x989680
mov qword [rsp], rcx
call fcn.00434e20
cmp dword [rsp + 8], 0
nop dword [rax]
jge 0x40c745
mov rax, qword [0x007c36f0]
mov rax, qword [rax]
test rax, rax
jne 0x40c72b
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.0046e5a0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
sub rcx, rax
nop dword [rax]
test rcx, rcx
jg 0x40c61f
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rcx]
mov rsi, qword [rdx + 0x30]
mov rdi, rsi
nop dword [rax]
cmp rbx, rsi
jne 0x40c6e5
mov rax, rbx
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete bl
test bl, bl
je 0x40c6b3
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rbx, 1
jne 0x40c792
mov byte [rdi + 0xe5], 1
mov qword [rsp], 0xffffffffffffffff
nop
call fcn.00434e20
cmp dword [rsp + 8], 0
jl 0x40c779
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.0046c4a0
nop dword [rax]
jmp 0x40c679
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp qword [rbx], 1
jne 0x40c7ab
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00667da1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x32
call fcn.00439220
lea rax, [0x00667a28]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.00439220
lea rax, [0x00662c3c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
nop
call fcn.00439220
nop
int3
Function at 0x40d6a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40d820
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor eax, eax
jmp 0x40d6cf
inc rax
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
lea rsi, [rbx + rdx]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 8], rsi
call fcn.00419fe0
mov rax, qword [rsp + 0x10]
mov rcx, rax
test rax, rax
je 0x40d7e8
mov rdx, qword [rsp + 0x58]
lea rbx, [rdx - 1]
test rax, rbx
je 0x40d7cf
mov qword [rsp + 0x28], rax
mov qword [rsp], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
call fcn.00419e80
nop
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax]
lea rax, [rax - 1]
neg rcx
and rcx, rax
mov qword [rsp + 0x18], rcx
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 8], rcx
call fcn.00419fe0
mov rax, qword [rsp + 0x10]
mov rcx, rax
mov rdx, qword [rsp + 0x18]
nop dword [rax]
cmp rdx, rax
je 0x40d7b6
mov qword [rsp], rcx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
nop dword [rax]
call fcn.00419e80
mov rax, qword [rsp + 0x20]
cmp rax, 0x63
jne 0x40d6cc
jmp 0x40d804
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006688de]
mov qword [rsp], rax
mov qword [rsp + 8], 0x38
call fcn.00439220
nop
nop
call fcn.0046abe0
jmp fcn.0040d6a0
Function at 0x40d840
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40da93
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
test byte [rdx], al
movzx eax, byte [rsp + 0x40]
nop word [rax + rax]
nop dword [rax]
cmp rax, 0x88
jae 0x40da88
mov rcx, qword [rdx + rax*8 + 0x28]
mov qword [rsp + 0x20], rcx
mov qword [rsp], rcx
call fcn.004156e0
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x38]
cmp rax, rdx
jne 0x40d95d
movzx eax, word [rcx + 0x60]
nop word [rax + rax]
cmp rdx, rax
jne 0x40da05
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
movzx ecx, byte [rsp + 0x40]
mov byte [rsp + 8], cl
nop dword [rax + rax]
call fcn.00418680
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax*8 + 0x28]
mov qword [rsp + 0x20], rax
mov qword [rsp], rax
nop dword [rax]
call fcn.004156e0
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x20]
mov edx, 1
cmp qword [rcx + 0x38], rax
jbe 0x40d9e8
mov rbx, qword [rcx + 0x68]
imul rax, rbx
add rax, qword [rcx + 0x18]
movzx ebx, word [rcx + 0x60]
inc ebx
mov word [rcx + 0x60], bx
movzx esi, bx
mov rdi, qword [rcx + 0x38]
nop dword [rax + rax]
cmp rsi, rdi
ja 0x40d962
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x58], dl
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
xor edx, edx
nop
jmp 0x40d914
mov word [rsp + 0x16], bx
mov qword [rsp + 0x18], rdi
call fcn.0043aa00
lea rax, [0x0065cae7]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0043b480
movzx eax, word [rsp + 0x16]
movzx eax, ax
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x0065b9cd]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0043b480
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
nop dword [rax]
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x0066012d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.00439220
lea rax, [0x0065f75a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
nop dword [rax]
call fcn.00439220
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x16], ax
call fcn.0043aa00
lea rax, [0x00660116]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0043b480
movzx eax, word [rsp + 0x16]
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x0065b9cd]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0043b480
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
nop dword [rax]
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x00667a59]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.00439220
mov ecx, 0x88
call fcn.0046cdc0
nop
call fcn.0046abe0
jmp fcn.0040d840
Function at 0x40e5c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40e68a
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
cmp rax, 1
je 0x40e63e
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
mov rbx, rax
mul rdx
jo 0x40e66d
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x40e66d
test rbx, rbx
jl 0x40e66d
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 1
call fcn.0040daa0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], 1
call fcn.0040daa0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0061e920]
mov qword [rsp], rax
lea rax, [0x006a1930]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.0040e5c0

Function at 0x40e6a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40e766
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test rax, rax
je 0x40e73f
mov rax, qword [rax + 0x40]
test rax, rax
je 0x40e748
mov rcx, qword [0x007a3298]
cmp rcx, 1
jne 0x40e725
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.0042f6e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rax
mov qword [rsp], rcx
call fcn.0040e780
movsxd rcx, dword [rsp + 8]
mov rax, qword [rsp + 0x10]
jmp 0x40e700
mov rax, qword [0x00811238]
jmp 0x40e6ec
lea rax, [0x0066894e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x38
nop dword [rax]
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0040e6a0
Function at 0x40f6c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40f920
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x40f8c5
cmp qword [rax], 0
nop word [rax + rax]
je 0x40f8c5
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x40f906
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x48]
mov rbx, qword [rdx]
mov esi, dword [rax + 0xc]
mov rdi, qword [rsp + 0x50]
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x48]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x40]
movzx edi, word [rsi + 0x52]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x40f7aa
movzx r9d, byte [rdx + 8]
nop word [rax + rax]
nop
test r9b, 8
je 0x40f8bd
and rbx, rax
imul rdi, rbx
lea rbx, [r8 + rdi]
movzx edi, byte [r8 + rdi]
add edi, 0xfffffffe
nop dword [rax]
cmp dil, 3
jae 0x40f8b5
shr rax, 0x38
cmp al, 5
jae 0x40f7b5
add eax, 5
mov byte [rsp + 0x1f], al
jmp 0x40f8a0
inc rdx
cmp rdx, 8
jae 0x40f88b
movzx ebx, byte [rdx + rcx]
cmp al, bl
je 0x40f7ed
test bl, bl
jne 0x40f7be
lea rax, [0x008123e0]
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x20], rdx
movzx ebx, byte [rsi + 0x50]
imul rbx, rdx
lea rcx, [rbx + rcx]
lea rcx, [rcx + 8]
mov ebx, dword [rsi + 0x54]
bt ebx, 0
jae 0x40f80e
mov rcx, qword [rcx]
mov rax, qword [rsi + 0x30]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx]
mov rbx, qword [rsp + 0x50]
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
call rax
cmp byte [rsp + 0x10], 0
jne 0x40f849
movzx eax, byte [rsp + 0x1f]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
jmp 0x40f7be
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0x50]
movzx edx, byte [rax + 0x51]
mov rbx, qword [rsp + 0x20]
imul rbx, rdx
lea rcx, [rbx + rcx*8]
mov rdx, qword [rsp + 0x28]
lea rcx, [rcx + rdx]
lea rcx, [rcx + 8]
mov eax, dword [rax + 0x54]
bt eax, 1
jae 0x40f87c
mov rcx, qword [rcx]
mov qword [rsp + 0x58], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
movzx ebx, word [rsi + 0x52]
lea rbx, [rcx + rbx]
lea rbx, [rbx - 8]
mov rcx, qword [rbx]
nop word [rax + rax]
test rcx, rcx
je 0x40f7d7
mov qword [rsp + 0x28], rcx
xor edx, edx
jmp 0x40f7c1
mov rcx, rbx
jmp 0x40f7aa
shr rbx, 1
jmp 0x40f78a
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x54]
bt ecx, 4
jb 0x40f8e9
lea rax, [0x008123e0]
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, qword [rax + 0x48]
mov rax, qword [rdx]
mov rcx, qword [rsp + 0x50]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
call rax
jmp 0x40f8d3
lea rax, [0x00663ad6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0040f6c0
Function at 0x40f940
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40fbad
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x40fb4d
cmp qword [rax], 0
nop word [rax + rax]
je 0x40fb4d
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x40fb93
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x48]
mov rbx, qword [rdx]
mov esi, dword [rax + 0xc]
mov rdi, qword [rsp + 0x50]
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x48]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x40]
movzx edi, word [rsi + 0x52]
imul rcx, rdi
add rcx, qword [rdx + 0x10]
mov r8, qword [rdx + 0x18]
test r8, r8
je 0x40fa2a
movzx r9d, byte [rdx + 8]
nop word [rax + rax]
nop
test r9b, 8
je 0x40fb45
and rbx, rax
imul rdi, rbx
lea rbx, [r8 + rdi]
movzx edi, byte [r8 + rdi]
add edi, 0xfffffffe
nop dword [rax]
cmp dil, 3
jae 0x40fb39
shr rax, 0x38
cmp al, 5
jae 0x40fa35
add eax, 5
mov byte [rsp + 0x1f], al
jmp 0x40fb24
inc rdx
cmp rdx, 8
jae 0x40fb15
movzx ebx, byte [rdx + rcx]
cmp al, bl
je 0x40fa72
test bl, bl
jne 0x40fa3e
lea rax, [0x008123e0]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x60], 0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x20], rdx
movzx ebx, byte [rsi + 0x50]
imul rbx, rdx
lea rcx, [rbx + rcx]
lea rcx, [rcx + 8]
mov ebx, dword [rsi + 0x54]
bt ebx, 0
jae 0x40fa93
mov rcx, qword [rcx]
mov rax, qword [rsi + 0x30]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx]
mov rbx, qword [rsp + 0x50]
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
call rax
cmp byte [rsp + 0x10], 0
jne 0x40face
movzx eax, byte [rsp + 0x1f]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
jmp 0x40fa3e
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0x50]
movzx edx, byte [rax + 0x51]
mov rbx, qword [rsp + 0x20]
imul rbx, rdx
lea rcx, [rbx + rcx*8]
mov rdx, qword [rsp + 0x28]
lea rcx, [rcx + rdx]
lea rcx, [rcx + 8]
mov eax, dword [rax + 0x54]
bt eax, 1
jae 0x40fb01
mov rcx, qword [rcx]
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
movzx ebx, word [rsi + 0x52]
lea rbx, [rcx + rbx]
lea rbx, [rbx - 8]
mov rcx, qword [rbx]
test rcx, rcx
je 0x40fa57
mov qword [rsp + 0x28], rcx
xor edx, edx
jmp 0x40fa41
mov rcx, rbx
nop dword [rax]
jmp 0x40fa2a
shr rbx, 1
jmp 0x40fa0a
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x54]
bt ecx, 4
jb 0x40fb76
lea rax, [0x008123e0]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x60], 0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, qword [rax + 0x48]
mov rax, qword [rdx]
mov rcx, qword [rsp + 0x50]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
call rax
jmp 0x40fb5b
lea rax, [0x00663ad6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0040f940
Function at 0x411d00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x411ea8
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x411e78
cmp qword [rax], 0
nop word [rax + rax]
je 0x411e78
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x411e8e
cmp byte [rax + 9], 0
jne 0x411de4
mov rax, qword [rax + 0x10]
jmp 0x411dc0
inc rdx
add rcx, 4
cmp rdx, 8
jae 0x411da9
mov ebx, dword [rsp + 0x38]
cmp dword [rcx], ebx
jne 0x411d63
movzx ebx, byte [rdx + rax]
nop dword [rax]
cmp bl, 1
jbe 0x411d63
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x51]
imul rdx, rcx
lea rax, [rdx + rax]
lea rax, [rax + 0x28]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x52]
lea rdx, [rax + rdx]
lea rdx, [rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
nop
test rax, rax
je 0x411dce
nop
lea rcx, [rax + 8]
xor edx, edx
jmp 0x411d6a
lea rax, [0x008123e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x48]
mov rbx, qword [rdx]
mov esi, dword [rax + 0xc]
lea rdi, [rsp + 0x38]
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x52]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
nop dword [rax]
test r8, r8
je 0x411e66
movzx edx, byte [rdx + 8]
test dl, 8
je 0x411e73
and rbx, rax
imul rdi, rbx
lea rax, [r8 + rdi]
movzx edx, byte [r8 + rdi]
add edx, 0xfffffffe
cmp dl, 3
jae 0x411e6e
mov rax, rcx
jmp 0x411dc0
mov rcx, rax
jmp 0x411e66
shr rbx, 1
jmp 0x411e4e
lea rax, [0x008123e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00663ad6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00411d00
Function at 0x411ec0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x412073
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x41203e
cmp qword [rax], 0
nop word [rax + rax]
je 0x41203e
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x412059
cmp byte [rax + 9], 0
jne 0x411fad
mov rax, qword [rax + 0x10]
jmp 0x411f84
inc rdx
add rcx, 4
cmp rdx, 8
jae 0x411f6e
mov ebx, dword [rsp + 0x38]
cmp dword [rcx], ebx
jne 0x411f23
movzx ebx, byte [rdx + rax]
nop dword [rax]
cmp bl, 1
jbe 0x411f23
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x51]
imul rdx, rcx
lea rax, [rdx + rax]
lea rax, [rax + 0x28]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x52]
lea rdx, [rax + rdx]
lea rdx, [rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
test rax, rax
je 0x411f92
nop
lea rcx, [rax + 8]
xor edx, edx
jmp 0x411f2a
lea rax, [0x008123e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x48]
mov rbx, qword [rdx]
mov esi, dword [rax + 0xc]
lea rdi, [rsp + 0x38]
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x52]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x41202c
movzx edx, byte [rdx + 8]
test dl, 8
je 0x412039
and rbx, rax
imul rdi, rbx
lea rax, [r8 + rdi]
movzx edx, byte [r8 + rdi]
add edx, 0xfffffffe
cmp dl, 3
jae 0x412034
mov rax, rcx
jmp 0x411f84
mov rcx, rax
jmp 0x41202c
shr rbx, 1
jmp 0x412014
lea rax, [0x008123e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00663ad6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00411ec0