joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bb00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43bcd8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x60], al
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x01375c90]
test edx, edx
je 0x43bb54
xor eax, eax
nop dword [rax]
call fcn.00430c00
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.0043f680
nop
nop
lea rax, [0x01322698]
nop dword [rax]
call fcn.0040b740
mov ecx, dword [0x01375c84]
mov edx, dword [0x01375c9c]
test edx, edx
je 0x43bb82
mov dword [0x01375c9c], 0
nop
jmp 0x43bb84
mov edx, ecx
mov eax, edx
call fcn.00442ec0
mov qword [rsp + 0x40], rax
nop
nop
xor ecx, ecx
lea rdx, [0x01322768]
xchg byte [rdx], cl
mov cl, byte [0x01322778]
test cl, cl
je 0x43bbc5
nop
nop
xor ecx, ecx
lea rdx, [0x01322778]
xchg byte [rdx], cl
lea rax, [0x01322780]
nop dword [rax + rax]
call fcn.0040ba40
nop
nop
lea rax, [0x01322698]
call fcn.0040b960
mov rcx, qword [rsp + 0x40]
jmp 0x43bbe0
mov rcx, qword [rsp + 0x48]
nop
test rcx, rcx
je 0x43bc3a
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rax, rax
je 0x43bc27
nop
mov qword [rcx + 0x38], 0
cmp qword [rax + 0xa8], 0
jne 0x43bcc6
nop
mov qword [rax + 0xa8], rcx
add rax, 0x118
nop dword [rax]
call fcn.0040ba40
jmp 0x43bbda
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
call fcn.0043ce00
jmp 0x43bbda
nop
nop dword [rax + rax]
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x43bc85
nop
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
nop dword [rax]
call fcn.004553c0
call fcn.0043da20
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
nop
cmp ecx, 1
jne 0x43bcb7
cmp byte [r14 + 0xb1], 0
je 0x43bcb7
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x006d8d0f]
mov ebx, 0x25
call fcn.00436b60
nop
mov byte [rsp + 8], al
nop dword [rax]
call fcn.004633c0
movzx eax, byte [rsp + 8]
jmp fcn.0043bb00
Function at 0x43ce00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43cf6c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043c5a0
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43cf21
mov rcx, qword [rdx + 0x30]
nop word [rax + rax]
test rcx, rcx
je 0x43cf21
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x238], 0
jne 0x43ce86
cmp byte [rcx + 0xe8], 0
nop
je 0x43cf21
nop
nop
lea rax, [0x013762a0]
call fcn.0040b740
cmp dword [0x013762c0], 0
nop dword [rax + rax]
je 0x43cf5a
mov rcx, qword [0x013762a8]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x128], rcx
nop
mov qword [0x013762a8], rdx
cmp byte [0x013762b0], 0
je 0x43cedd
mov byte [0x013762b0], 0
lea rax, [0x013762b8]
call fcn.0040ba40
nop
nop
lea rax, [0x013762a0]
call fcn.0040b960
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43cf17
cmp byte [r14 + 0xb1], 0
je 0x43cf17
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043cfa0
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43cf50
cmp byte [r14 + 0xb1], 0
je 0x43cf50
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006da76e]
mov ebx, 0x2a
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043ce00
Function at 0x43db80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ddbd
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x130]
test rdx, rdx
je 0x43ddab
mov rdx, qword [rdx + 0xe8]
cmp rdx, rcx
jne 0x43ddab
mov qword [rsp + 0x30], r14
cmp qword [rcx + 0xa0], 0
je 0x43dbd5
call fcn.004438c0
call fcn.0043d6e0
mov eax, 1
call fcn.00443a20
nop
call fcn.0043bee0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x130]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43dc34
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.00443740
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov dword [rsp + 0x1c], ebx
call fcn.004384a0
lea rax, [0x006dad1a]
mov ebx, 0x2b
call fcn.00438da0
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.00438aa0
lea rax, [0x006d818a]
mov ebx, 0x24
call fcn.00438da0
call fcn.00438520
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x130]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
nop
call fcn.004384a0
lea rax, [0x006cfe70]
mov ebx, 0x12
call fcn.00438da0
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00438d20
lea rax, [0x006cc04b]
mov ebx, 7
call fcn.00438da0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438aa0
lea rax, [0x006d0001]
mov ebx, 0x13
call fcn.00438da0
mov eax, dword [rsp + 0x18]
mov eax, eax
nop dword [rax]
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.004384a0
lea rax, [0x006cfe82]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.00438da0
mov rax, qword [rsp + 0x28]
call fcn.00438d20
lea rax, [0x006cc04b]
mov ebx, 7
nop dword [rax + rax]
call fcn.00438da0
mov rax, qword [rsp + 0x20]
call fcn.00438aa0
lea rax, [0x006cffee]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00438da0
mov eax, dword [rsp + 0x14]
mov eax, eax
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
lea rax, [0x006d356d]
mov ebx, 0x19
call fcn.00436b60
lea rax, [0x006d71ff]
mov ebx, 0x21
call fcn.00436b60
nop
nop dword [rax]
call fcn.004633c0
jmp fcn.0043db80
Function at 0x43f960
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43fb9a
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jne 0x43fb88
mov qword [rsp + 0x18], rcx
cmp qword [rcx + 0x130], 0
je 0x43f9b8
call fcn.0043db80
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x130]
xor ebx, ebx
mov rax, rcx
call fcn.0043dfa0
mov rcx, qword [rsp + 0x18]
cmp byte [rcx + 0xe8], 0
nop
je 0x43f9d1
jmp 0x43fb77
call fcn.0043dde0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0xa0]
test byte [rdx], al
mov byte [rdx + 0x22c0], 0
cmp byte [rcx + 0xe4], 0
je 0x43fa0c
cmp qword [rdx + 0x998], 0
jne 0x43fb66
mov esi, dword [rdx + 0x190]
nop
cmp dword [rdx + 0x194], esi
jne 0x43fb66
call fcn.0043e120
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x17], bl
mov byte [rsp + 0x16], cl
mov rdx, qword [rsp + 0x18]
cmp byte [rdx + 0xe4], 0
je 0x43fa45
call fcn.0043f600
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
cmp byte [0x01322700], 0
jne 0x43fa52
xor esi, esi
jmp 0x43fa75
mov ebx, 1
call fcn.0045ab00
xor eax, 1
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
mov esi, eax
mov rax, qword [rsp + 0x20]
test sil, sil
je 0x43fb31
nop
nop
lea rax, [0x01322698]
call fcn.0040b740
cmp byte [0x01322700], 0
jne 0x43fa9c
mov eax, 1
jmp 0x43faab
mov rax, qword [rsp + 0x20]
mov ebx, 1
call fcn.0045ab00
test al, al
jne 0x43fb0f
nop
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0xa0], 0
mov rdx, qword [0x01322710]
test rdx, rdx
je 0x43fad8
mov rbx, rcx
mov qword [rdx + 0xa0], rcx
jmp 0x43fae6
nop
mov rdx, rcx
mov qword [0x01322708], rcx
mov rbx, rdx
nop
mov qword [0x01322710], rbx
inc dword [0x01322718]
nop
nop
lea rax, [0x01322698]
nop dword [rax]
call fcn.0040b960
mov rcx, qword [rsp + 0x18]
jmp 0x43f9d1
nop
nop
lea rax, [0x01322698]
call fcn.0040b960
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
test cl, cl
je 0x43fb49
call fcn.0043da20
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
cmp qword [rax + 0xe8], 0
jne 0x43f9c7
call fcn.0043dfa0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006d78f8]
mov ebx, 0x22
call fcn.00436b60
lea rax, [0x006cf29d]
mov ebx, 0x10
call fcn.00436b60
lea rax, [0x006d2686]
mov ebx, 0x17
call fcn.00436b60
nop
call fcn.004633c0
nop
jmp fcn.0043f960
Function at 0x440340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4405ac
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
cmp byte [0x01327e10], 0
je 0x440377
mov eax, 0x14
xor ebx, ebx
call fcn.00456a20
mov rax, qword [rsp + 0x48]
nop
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
jne 0x440485
cmp byte [rax + 0xb4], 0
je 0x4403bc
mov rcx, qword [rax + 0x40]
mov rax, rcx
nop dword [rax + rax]
call fcn.004512a0
test rax, rax
je 0x44046f
movzx edx, byte [rax + 0x29]
test dl, 2
jne 0x440414
mov rax, qword [rsp + 0x48]
mov ebx, 2
mov ecx, 0x1009
call fcn.0043b480
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop
nop
xor esi, esi
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
nop
xor esi, esi
mov qword [rdx + 0x90], rsi
mov rax, qword [rsp + 0x48]
mov ebx, 0x1009
mov ecx, 9
nop dword [rax + rax]
call fcn.0043aba0
call fcn.0043f960
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00451a40
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.004384a0
lea rax, [0x006d8cc5]
mov ebx, 0x25
call fcn.00438da0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
call fcn.00438da0
lea rax, [0x006cf94e]
mov ebx, 0x12
call fcn.00438da0
call fcn.00438520
lea rax, [0x006ceb71]
mov ebx, 0xf
call fcn.00436b60
lea rax, [0x006d14f0]
mov ebx, 0x15
nop dword [rax + rax]
call fcn.00436b60
nop
mov qword [rsp + 0x28], r14
nop
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.004384a0
lea rax, [0x006cfe70]
mov ebx, 0x12
call fcn.00438da0
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.00438d20
lea rax, [0x006cc04b]
mov ebx, 7
call fcn.00438da0
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00438aa0
lea rax, [0x006d0001]
mov ebx, 0x13
call fcn.00438da0
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x10], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.004384a0
lea rax, [0x006cfe82]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.00438da0
mov rax, qword [rsp + 0x28]
call fcn.00438d20
lea rax, [0x006cc04b]
mov ebx, 7
nop dword [rax + rax]
call fcn.00438da0
mov rax, qword [rsp + 0x18]
call fcn.00438aa0
lea rax, [0x006cffee]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00438da0
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
lea rax, [0x006cda77]
mov ebx, 0xc
call fcn.00436b60
nop
mov qword [rsp + 8], rax
call fcn.00467e40
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.00440340
Function at 0x443a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x443d86
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp byte [0x01375c3d], 0
nop
jne 0x443c59
cmp byte [0x01375c3b], 0
jne 0x443c59
mov ecx, dword [0x01375ca0]
nop dword [rax]
test ecx, ecx
ja 0x443c4f
cmp byte [0x01375c3c], 0
je 0x443ad5
xor ecx, ecx
jmp 0x443b05
cmp byte [0x01375c36], 0
jne 0x443ae2
xor ecx, ecx
jmp 0x443b05
mov eax, 1
call fcn.0043cd00
cmp dword [0x01375c68], 0
seta cl
nop
nop
lea rdx, [0x01375d50]
xchg qword [rdx], rax
movzx ecx, cl
mov edx, dword [0x013226a8]
mov rbx, qword [0x013226b0]
sub rbx, qword [0x013226c0]
mov rsi, rbx
sub ebx, edx
mov edi, dword [0x013226ac]
sub ebx, edi
mov r8d, dword [0x013226bc]
sub ebx, r8d
cmp ecx, ebx
jl 0x443c45
nop dword [rax + rax]
test ebx, ebx
jl 0x443cd0
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00443da0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x30]
call fcn.0043a1a0
cmp qword [rsp + 0x20], 0
jne 0x443b9e
nop
nop
lea rax, [0x01322698]
call fcn.0040b960
lea rax, [0x006dd98f]
mov ebx, 0x36
call fcn.00436c60
cmp qword [0x01375d58], 0
je 0x443bbc
call fcn.00454cc0
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jl 0x443bd1
mov rcx, qword [0x01321470]
mov rdx, qword [0x01321478]
xor eax, eax
jmp 0x443c88
mov qword [0x01375d58], rax
call fcn.00445540
nop dword [rax]
test rax, rax
je 0x443c74
nop
mov rcx, qword [0x013226a0]
test rcx, rcx
je 0x443c0d
mov rdx, qword [rcx + 0x128]
mov qword [0x013226a0], rdx
dec dword [0x013226a8]
test rcx, rcx
je 0x443c63
nop
mov edx, 1
lea rbx, [0x013226dc]
lock xadd dword [rbx], edx
mov byte [rcx + 0xe4], 1
nop
mov qword [rcx + 0xa8], rax
lea rax, [rcx + 0x118]
call fcn.0040ba40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006d316c]
mov ebx, 0x19
call fcn.00436b60
lea rax, [0x006d3185]
mov ebx, 0x19
call fcn.00436b60
inc rax
cmp rax, rdx
jge 0x443ca7
mov rbx, qword [rcx + rax*8]
test byte [rbx], al
cmp qword [rbx + 0x2288], 0
je 0x443c85
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
nop
nop
lea rax, [0x01322698]
call fcn.0040b960
lea rax, [0x006d88de]
mov ebx, 0x25
call fcn.00436c60
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x14], r8d
call fcn.004384a0
lea rax, [0x006d441c]
mov ebx, 0x1b
call fcn.00438da0
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
nop
call fcn.00438ba0
lea rax, [0x006ce25e]
mov ebx, 0xe
call fcn.00438da0
mov eax, dword [rsp + 0x18]
movsxd rax, eax
nop dword [rax]
call fcn.00438ba0
lea rax, [0x006cc3ae]
mov ebx, 8
call fcn.00438da0
mov rax, qword [rsp + 0x28]
movsxd rax, eax
nop
call fcn.00438ba0
lea rax, [0x006cc01a]
mov ebx, 7
call fcn.00438da0
mov eax, dword [rsp + 0x14]
movsxd rax, eax
nop dword [rax]
call fcn.00438ba0
call fcn.00438700
call fcn.00438520
lea rax, [0x006d579f]
mov ebx, 0x1e
nop dword [rax + rax]
call fcn.00436b60
nop
call fcn.004633c0
jmp fcn.00443a80
Function at 0x4453a0
Capabilities:
Encode data using base64
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44550a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4453b8
cmp edx, ecx
jne 0x4454f8
nop dword [rax]
test rsi, rsi
jne 0x4454f8
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x445414
nop
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004452a0
mov rcx, qword [0x013214f8]
mov rdx, qword [0x013214f0]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x4454f3
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x4454e8
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x013226d0]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x013226d0], rbx
nop
mov edx, 1
lea rsi, [0x013226d8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x4454d7
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d9d80]
mov ebx, 0x28
call fcn.00436b60
mov rcx, rax
mov rax, rsi
call fcn.00465a20
call fcn.00435020
lea rax, [0x006d7ecc]
mov ebx, 0x23
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004453a0
Function at 0x44a000
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], r14
mov edx, dword [0x01375ca0]
test edx, edx
je 0x44a040
mov qword [rsp + 0x60], rax
mov eax, 2
call fcn.004329a0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
nop
mov ecx, 1
lea rdx, [0x01375ca0]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x40]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x38], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x30], rsi
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbx + 0xf8]
mov qword [rsp + 0x20], rdi
call fcn.004384a0
lea rax, [0x006ccde3]
mov ebx, 0xa
call fcn.00438da0
mov rax, qword [rsp + 0x38]
call fcn.00438c00
call fcn.004386c0
mov rax, qword [rsp + 0x30]
call fcn.00438c00
nop
call fcn.004386c0
mov rax, qword [rsp + 0x28]
call fcn.00438c00
call fcn.004386c0
mov rax, qword [rsp + 0x20]
call fcn.00438c00
nop
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
call fcn.004384a0
lea rax, [0x006cb7af]
mov ebx, 3
call fcn.00438da0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438c00
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe8], 0
nop
je 0x44a197
mov rdx, qword [rsp + 0x70]
cmp qword [rcx], rdx
jne 0x44a192
cmp qword [rcx + 0x90], 0
je 0x44a18d
cmp byte [0x01375c3c], 0
je 0x44a180
nop
call fcn.004384a0
lea rax, [0x006dbba0]
mov ebx, 0x2e
call fcn.00438da0
call fcn.00438520
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x90]
jmp 0x44a19c
mov rcx, rdx
jmp 0x44a19c
mov rcx, rdx
jmp 0x44a19c
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x48], rcx
call fcn.004384a0
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 2
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov qword [rax + 0x98], rdi
mov eax, dword [0x009441bc]
mov rdx, qword [r14 + 0x30]
mov ebx, dword [rdx + 0xc4]
movzx edx, byte [rdx + 0xf9]
test dl, dl
jne 0x44a201
shr eax, 2
cmp ebx, 2
mov esi, 2
cmovae eax, esi
mov edx, eax
test edx, edx
jle 0x44a239
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
mov rdi, rcx
xor ecx, ecx
nop dword [rax]
call fcn.00459720
mov rax, qword [rsp + 0x48]
call fcn.0045a6a0
mov rax, qword [rsp + 0x68]
call fcn.004078a0
mov eax, 2
nop
call fcn.004329a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x44a6a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44a7c9
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
cmp rcx, rbx
jae 0x44a6fd
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
mov rsi, rax
mov rax, rbx
mul rdx
jo 0x44a7b4
movabs rdx, 0x1000000000000
nop
cmp rax, rdx
ja 0x44a7b4
test rbx, rbx
jl 0x44a7b4
mov rdx, qword [rsp + 0x28]
imul rcx, rdx
jmp 0x44a70a
mov rcx, qword [rax]
imul rcx, rbx
mov rsi, rax
mov rax, rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], rcx
cmp qword [rsi + 8], 0
jne 0x44a758
mov qword [rsp + 0x18], rax
xor ebx, ebx
xor ecx, ecx
call fcn.0040cf40
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
cmp rcx, rbx
jae 0x44a791
mov qword [rsp + 0x30], rax
sub rbx, rcx
lea rdx, [rax + rcx]
mov rax, rdx
call fcn.004660c0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
jmp 0x44a791
mov rbx, rsi
mov ecx, 1
call fcn.0040cf40
mov rcx, qword [rsp + 0x20]
test rcx, rcx
jbe 0x44a791
cmp byte [0x013760e0], 0
je 0x44a791
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x60]
call fcn.00414ae0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x60]
nop dword [rax + rax]
call fcn.004663c0
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
nop
lea rax, [0x006889c0]
lea rbx, [0x007585d0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax]
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044a6a0

Function at 0x44a800
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44a8b1
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rsi, rax
mov rax, rdx
mov rdi, rax
mul rcx
jo 0x44a8a5
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x44a85c
test rbx, rbx
jl 0x44a85c
nop dword [rax]
cmp rcx, rbx
jl 0x44a85c
mov rbx, rsi
mov ecx, 1
call fcn.0040cf40
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rdi
mul rbx
jno 0x44a878
nop
lea rax, [0x006889c0]
lea rbx, [0x007585d0]
call fcn.004363c0
movabs rcx, 0x1000000000000
cmp rax, rcx
ja 0x44a864
test rbx, rbx
jl 0x44a864
nop
lea rax, [0x006889c0]
lea rbx, [0x007585e0]
nop dword [rax + rax]
call fcn.004363c0
movabs rdx, 0x1000000000000
jmp 0x44a85c
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0044a800
Function at 0x44e3c0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x44e4e6
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
lea rdi, [rsp + 0x20]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465cab
mov rbp, qword [rbp]
lea rcx, [0x006ad120]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + 0x17]
test dl, 0x40
jne 0x44e4d0
lea rdx, [0x013760c0]
lea rax, [0x0094e360]
jmp 0x44e452
mov rax, qword [rax + 0x230]
test rax, rax
je 0x44e474
nop word [rax + rax]
cmp qword [rax + 0x140], rdx
ja 0x44e44b
cmp qword [rax + 0x110], rdx
jbe 0x44e44b
jmp 0x44e476
xor eax, eax
test rax, rax
je 0x44e4bf
mov rdx, qword [rcx]
lea rbx, [rdx + 7]
and rbx, 0xfffffffffffffff8
neg ebx
mov rsi, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rax + 0x138]
mov dword [0x013760c0], ebx
mov dword [0x013760c4], edx
mov dword [0x013760c8], esi
mov dword [0x013760cc], ecx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
lea rax, [0x006dab16]
mov ebx, 0x2b
call fcn.00436b60
lea rax, [0x006de91d]
mov ebx, 0x3d
nop dword [rax]
call fcn.00436b60
nop
call fcn.004633c0
jmp fcn.0044e3c0