joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc250
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bc37b
sub esp, 0x14
nop
mov eax, dword [esp + 0x20]
test eax, 0x60
jne 0x4bc27a
test eax, 0x100
jne 0x4bc286
mov dword [esp], eax
call fcn.004b9640
mov eax, dword [esp + 0x20]
and eax, 0x1f
nop
cmp eax, 0x17
jne 0x4bc314
mov eax, dword [esp + 0x18]
test byte [eax], al
mov dword [esp], eax
call fcn.004b5d70
mov eax, dword [esp + 4]
test eax, eax
je 0x4bc2b1
lea ecx, [0x7b31a4]
jmp 0x4bc2b5
xor ecx, ecx
xor eax, eax
mov ecx, dword [ecx + 0x50]
mov dword [esp], eax
call ecx
cmp dword [esp + 4], 8
jne 0x4bc2fc
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [ecx + 8], eax
mov eax, dword [0x995310]
test eax, eax
jne 0x4bc2e6
mov eax, dword [esp + 0x24]
jmp 0x4bc2f6
call fcn.00468e70
mov eax, dword [esp + 0x24]
mov dword [edi], eax
mov edx, dword [ecx]
mov dword [edi + 4], edx
mov dword [ecx], eax
add esp, 0x14
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b05a8]
mov dword [esp + 4], eax
call fcn.00438b10
mov dword [esp + 0xc], eax
call fcn.004b9350
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp]
mov dword [esp + 0x10], ecx
lea edx, [0x70a680]
mov dword [esp], edx
call fcn.0040c500
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x4bc36e
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x6fc440]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
call fcn.00468e60
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
jmp 0x4bc34f
call fcn.00467a60
jmp fcn.004bc250
Function at 0x4bc390
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bc4da
sub esp, 0x14
nop
mov eax, dword [esp + 0x20]
test eax, 0x60
jne 0x4bc3ba
test eax, 0x100
jne 0x4bc3c6
mov dword [esp], eax
call fcn.004b9640
mov eax, dword [esp + 0x20]
and eax, 0x1f
nop
cmp eax, 0x17
jne 0x4bc473
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 0xf]
and ecx, 0x1f
cmp ecx, 0x12
ja 0x4bc3f7
cmp ecx, 0x11
jne 0x4bc3ed
mov eax, dword [eax + 0x20]
jmp 0x4bc417
cmp ecx, 0x12
jne 0x4bc415
mov eax, dword [eax + 0x20]
jmp 0x4bc417
cmp ecx, 0x15
jne 0x4bc401
mov eax, dword [eax + 0x24]
jmp 0x4bc417
cmp ecx, 0x16
jne 0x4bc40b
mov eax, dword [eax + 0x20]
jmp 0x4bc417
cmp ecx, 0x17
jne 0x4bc415
mov eax, dword [eax + 0x20]
jmp 0x4bc417
xor eax, eax
movzx eax, byte [eax + 0xf]
and eax, 0x1f
cmp eax, 5
jne 0x4bc45b
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [ecx + 8], eax
mov eax, dword [0x995310]
test eax, eax
jne 0x4bc445
mov eax, dword [esp + 0x24]
jmp 0x4bc455
call fcn.00468e70
mov eax, dword [esp + 0x24]
mov dword [edi], eax
mov edx, dword [ecx]
mov dword [edi + 4], edx
mov dword [ecx], eax
add esp, 0x14
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b05b0]
mov dword [esp + 4], eax
call fcn.00438b10
mov dword [esp + 0xc], eax
call fcn.004b9350
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp]
mov dword [esp + 0x10], ecx
lea edx, [0x70a680]
mov dword [esp], edx
call fcn.0040c500
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x4bc4cd
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x6fc440]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
call fcn.00468e60
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
jmp 0x4bc4ae
call fcn.00467a60
jmp fcn.004bc390
Function at 0x4bcb70
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bccaf
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4bcc74
test eax, 0x200
je 0x4bcc2e
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 0xf]
and edx, 0x1f
sar eax, 0xa
cmp edx, 0x14
jne 0x4bcbe6
cmp dword [ecx + 0x28], eax
jbe 0x4bcc5c
mov edx, dword [ecx + 0x24]
lea eax, [edx + eax*8 + 4]
mov eax, dword [eax]
nop
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00465760
mov eax, dword [esp + 8]
lea ecx, [0x7b31a4]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x14
ret
mov dword [esp + 0x10], eax
mov dword [esp], ecx
call fcn.004011f0
mov eax, dword [esp + 0x10]
cmp dword [esp + 8], eax
jbe 0x4bcc44
mov ecx, dword [esp + 4]
shl eax, 4
mov eax, dword [ecx + eax + 4]
nop
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00465760
mov eax, dword [esp + 8]
lea ecx, [0x7b31a4]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x14
ret
lea eax, [0x7b31a4]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add esp, 0x14
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0510]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0510]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x70a680]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x12
lea ecx, [0x73f2c2]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x6fc440]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004bcb70
Function at 0x4bccc0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bce5d
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 8], eax
nop
cmp eax, 0x15
ja 0x4bcd5d
cmp eax, 0x12
jne 0x4bccf8
mov eax, dword [esp + 0x10]
jmp 0x4bcda4
cmp eax, 0x13
jne 0x4bcd4e
test ecx, 0x200
jne 0x4bcd3f
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4bce44
mov eax, dword [eax + 4]
test eax, eax
je 0x4bce44
test ecx, 0x80
je 0x4bcd2d
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4bcd31
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4bcd37
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x4c00a0]
nop
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x15
jne 0x4bcdf2
mov eax, dword [esp + 0x10]
jmp 0x4bcda4
cmp eax, 0x16
jne 0x4bcd96
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 4]
test edx, edx
jne 0x4bcda4
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov dword [esp], ecx
call fcn.00463e60
movzx eax, byte [esp + 4]
test al, al
je 0x4bce2c
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
cmp eax, 0x17
je 0x4bcdcc
cmp eax, 0x1a
jne 0x4bcdf2
mov eax, dword [esp + 0x10]
cmp dword [eax], 4
jne 0x4bcdda
mov eax, dword [eax + 4]
test eax, eax
je 0x4bcdda
test ecx, 0x80
je 0x4bcdc0
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
jmp 0x4bcdc4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0480]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x70a680]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1b
lea ecx, [0x74406c]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x6fc440]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b05d0]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0480]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004bccc0
Function at 0x4cbd10
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cbd9f
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
nop
test ecx, ecx
je 0x4cbd34
cmp eax, ecx
je 0x4cbd4c
jmp 0x4cbd86
mov ecx, dword [0x995310]
test ecx, ecx
je 0x4cbd4a
call fcn.00468e70
mov dword [edi], eax
mov ecx, dword [eax]
mov dword [edi + 4], ecx
mov dword [eax], eax
mov ecx, dword [esp + 0x10]
test ecx, ecx
jl 0x4cbd6e
mov edx, dword [eax + 0xc]
sub edx, dword [eax + 8]
cmp ecx, edx
jle 0x4cbd6a
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004cbc60
add esp, 8
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0438]
mov dword [esp + 4], eax
call fcn.00438b10
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b028c]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004cbd10

Function at 0x4cbee0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cbffd
sub esp, 0x24
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
nop
test ecx, ecx
je 0x4cbf0b
cmp eax, ecx
je 0x4cbf23
jmp 0x4cbfe4
mov ecx, dword [0x995310]
test ecx, ecx
je 0x4cbf21
call fcn.00468e70
mov dword [edi], eax
mov ecx, dword [eax]
mov dword [edi + 4], ecx
mov dword [eax], eax
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 8]
mov dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x2c]
cmp ebp, 0x7f
ja 0x4cbf82
lea esi, [ebx + 1]
cmp ecx, esi
jae 0x4cbf7a
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 1
lea eax, [0x6f4820]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
xchg ebp, eax
mov byte [esi + edx - 1], al
xchg ebp, eax
jmp 0x4cbfaa
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
call fcn.00475000
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov ecx, dword [0x995310]
sub esi, ebx
test ecx, ecx
je 0x4cbfc9
call fcn.00468e70
mov dword [edi], edx
mov ecx, dword [eax + 4]
mov dword [edi + 4], ecx
mov dword [eax + 4], edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
add esp, 0x24
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b028c]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004cbee0
Function at 0x4d46f0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d4896
sub esp, 0x3c
mov eax, dword [esp + 0x40]
mov byte [eax + 0x10], 0
xor ecx, ecx
xor edx, edx
jmp 0x4d471b
mov eax, esi
mov ecx, edi
mov edx, ebp
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x200
call fcn.004d4350
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x40]
mov edx, dword [eax + 8]
cmp edx, ecx
jb 0x4d4890
mov dword [eax + 4], ecx
mov edx, dword [eax + 8]
cmp edx, ecx
jb 0x4d4887
mov dword [esp + 0x1c], ecx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x10]
sub edx, ecx
mov esi, edx
neg edx
sar edx, 0x1f
and edx, ecx
mov edi, dword [eax]
mov ebx, dword [esp + 0x48]
mov dword [esp], ebx
add edx, edi
mov dword [esp + 4], edx
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
call ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
test eax, eax
jl 0x4d4868
mov dword [esp + 0x34], ebp
mov esi, dword [esp + 0x40]
mov edi, dword [esi + 8]
mov ebp, dword [esp + 0x1c]
add ebp, eax
cmp edi, ebp
jb 0x4d485f
mov dword [esp + 0x38], ebx
mov edi, eax
sar eax, 0x1f
mov ebx, dword [esp + 0x14]
mov dword [esi + 4], ebp
mov ebp, dword [esp + 0x30]
add ebp, edi
mov edi, dword [esp + 0x2c]
adc edi, eax
cmp dword [0x967010], ebx
jne 0x4d4817
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edx
mov eax, dword [0x967014]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00404290
movzx eax, byte [esp + 0xc]
test al, al
jne 0x4d483b
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x24]
test edx, edx
je 0x4d4715
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebp
mov eax, dword [esp + 0x38]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x58], eax
add esp, 0x3c
ret
mov eax, dword [esp + 0x24]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
add esp, 0x3c
ret
mov ecx, ebp
mov edx, edi
call fcn.00468f10
mov eax, dword [0x967288]
test eax, eax
je 0x4d4875
mov eax, dword [eax + 4]
mov ecx, dword [0x96728c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00438b10
mov eax, ecx
mov ecx, edx
call fcn.00468f30
call fcn.00468f10
nop
call fcn.00467a60
jmp fcn.004d46f0
Function at 0x4d97a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d9891
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [esp + 0x24]
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x18], ecx
xor eax, eax
jmp 0x4d97dc
mov ebx, dword [esp + 0xc]
inc ebx
mov ecx, dword [esp + 0x18]
mov eax, ebx
cmp eax, 4
jge 0x4d9815
mov dword [esp + 0xc], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.0046d750
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x28]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4d97d1
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x4d981f
inc eax
cmp eax, 4
jge 0x4d9834
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
xor esi, esi
jmp 0x4d988a
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0046d7a0
mov byte [esp + 0x2c], 0
add esp, 0x1c
ret
mov edi, ebp
and edi, 0xff
xor edx, edi
shr ebp, 8
mov edi, ebx
shl edi, 0x18
mov dword [esp + 0x10], edi
mov eax, edx
mov edi, 0x1b3
mul edi
inc esi
mov edi, dword [esp + 0x10]
or ebp, edi
shr ebx, 8
mov edx, eax
mov eax, dword [esp + 0x14]
cmp esi, 8
jl 0x4d985b
jmp 0x4d981e
call fcn.00467a60
jmp fcn.004d97a0
Function at 0x4e65a0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e668e
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x20]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
jne 0x4e6675
lea eax, [0x6ff220]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 8], ecx
call fcn.00409f50
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4e6633
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
call fcn.004e63f0
mov eax, dword [esp + 0x14]
lea ecx, [0x7b195c]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
add esp, 0x18
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b03d8]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004e65a0

Function at 0x4e69c0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e6aae
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x20]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
jne 0x4e6a95
lea eax, [0x6ff1c0]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 8], ecx
call fcn.00409f50
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4e6a53
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
call fcn.004e63f0
mov eax, dword [esp + 0x14]
lea ecx, [0x7b1944]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
add esp, 0x18
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0400]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.004e69c0
Function at 0x4ec460
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ec586
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 8]
lea edx, [0x6f4820]
mov dword [esp], edx
shl ecx, 2
mov dword [esp + 0x14], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.0044e560
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 4]
mov dword [esp + 0x24], ecx
mov eax, dword [eax + 8]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
mov ebp, ebx
xor esi, esi
jmp 0x4ec4be
mov edi, dword [esp + 0x18]
lea esi, [edi + 1]
cmp esi, eax
jge 0x4ec4d9
mov dword [esp + 0x18], esi
mov edi, dword [ecx + esi*4]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
jmp 0x4ec53e
test ebx, ebx
jge 0x4ec4e2
xor ebx, ebx
jmp 0x4ec4e2
inc ebx
cmp ebx, ebp
jge 0x4ec4f4
jae 0x4ec521
movzx esi, byte [edx + ebx]
xchg esi, eax
test al, al
xchg esi, eax
je 0x4ec4e1
cmp ebx, ebp
ja 0x4ec518
sub ebp, ebx
mov eax, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebx, ebp
lea ecx, [edx + ebx]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
add esp, 0x28
ret
mov eax, ebx
mov ecx, ebp
call fcn.00468f30
mov eax, ebx
mov ecx, ebp
call fcn.00468ed0
lea ebx, [esi + 1]
shr edi, 8
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], ebx
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
cmp esi, 4
jge 0x4ec4b7
lea ecx, [ebx - 1]
test ecx, ecx
jl 0x4ec55e
cmp ebp, ecx
jbe 0x4ec57c
xchg edi, eax
mov byte [ebx + edx - 1], al
xchg edi, eax
jmp 0x4ec52a
xchg edi, eax
test al, al
xchg edi, eax
je 0x4ec52a
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0840]
mov dword [esp + 4], eax
call fcn.00438b10
mov eax, ecx
mov ecx, ebp
call fcn.00468ed0
nop
call fcn.00467a60
jmp fcn.004ec460
Function at 0x4ec590
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ec68a
sub esp, 0x1c
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4ec5c3
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00469620
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ebx, dword [edx + 4]
mov dword [esp + 0x18], ebx
mov edx, dword [edx + 8]
mov dword [esp + 8], edx
mov ebp, dword [esp + 0x24]
mov eax, ecx
xor esi, esi
jmp 0x4ec5e4
inc esi
mov ebx, dword [esp + 0x18]
cmp esi, edx
jge 0x4ec5fb
mov edi, dword [ebx + esi*4]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
jmp 0x4ec646
test ecx, ecx
jge 0x4ec604
xor ecx, ecx
jmp 0x4ec604
inc ecx
cmp eax, ecx
jle 0x4ec613
jbe 0x4ec627
movzx edx, byte [ebp + ecx]
test dl, dl
je 0x4ec603
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
add esp, 0x1c
ret
mov edx, eax
mov eax, ecx
mov ecx, edx
call fcn.00468ed0
lea ecx, [ebx + 1]
shr edi, 8
mov ebx, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
mov ecx, edx
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
cmp ebx, 4
jge 0x4ec5df
lea edx, [ecx - 1]
test edx, edx
jl 0x4ec662
cmp eax, edx
jbe 0x4ec680
xchg edi, eax
mov byte [ecx + ebp - 1], al
xchg edi, eax
jmp 0x4ec632
xchg edi, eax
test al, al
xchg edi, eax
je 0x4ec632
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b0840]
mov dword [esp + 4], eax
call fcn.00438b10
mov ecx, eax
mov eax, edx
call fcn.00468ed0
nop
call fcn.00467a60
jmp fcn.004ec590
Function at 0x4fe800
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fe8a6
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4fe859
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x4fe890
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.00467a60
jmp fcn.004fe800
Function at 0x502430
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x18]
cmp eax, dword [ecx + 8]
jbe 0x50252e
sub esp, 0x98
nop
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.004690e9
nop
mov dword [esp + 0x3c], 0x67452301
mov dword [esp + 0x40], 0xefcdab89
mov dword [esp + 0x44], 0x98badcfe
mov dword [esp + 0x48], 0x10325476
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
lea ecx, [esp + 0x1c]
mov dword [esp], ecx
mov ecx, dword [esp + 0x9c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0xa0]
mov dword [esp + 8], ecx
call fcn.00452560
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
lea ebp, [esp + 0x3c]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.004fd4a0
lea ecx, [esp + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.004fd670
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
add esp, 0x98
ret
call fcn.00467a60
jmp fcn.00502430