joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fc7f9e0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xb8]
cmp eax, dword [ecx + 8]
jbe 0x6fc7fbee
sub esp, 0x138
mov eax, dword [esp + 0x14c]
test eax, 0x200
je 0x6fc7fbd5
nop
mov ecx, dword [esp + 0x144]
movzx edx, byte [ecx + 0xf]
mov byte [esp + 0x6f], dl
mov dword [esp], ecx
mov ebx, dword [esp + 0x148]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call fcn.6fc86840
mov eax, dword [esp + 0x14c]
and eax, 0x1e0
movzx edx, byte [esp + 0x6f]
and edx, 0x1f
or edx, eax
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
lea ebp, [0x6fee060c]
cmp ebx, ebp
jne 0x6fc7fbb9
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], eax
nop
lea ecx, [0x6fc87700]
mov dword [esp + 0x70], ecx
lea edi, [esp + 0xdc]
mov edx, eax
xor eax, eax
call fcn.6fc62189
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.6fc82970
lea edi, [esp + 0xdc]
lea esi, [esp + 0x10]
call fcn.6fc625ca
lea edi, [esp + 0x80]
lea esi, [esp + 0xdc]
call fcn.6fc625ca
lea ecx, [0x6fe636c0]
mov dword [esp], ecx
call fcn.6fc0ba30
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x70]
mov dword [ecx], edx
mov edx, dword [0x700a7770]
mov eax, dword [esp + 0xd4]
test edx, edx
jne 0x6fc7faec
mov dword [ecx + 4], eax
jmp 0x6fc7faf4
lea edi, [ecx + 4]
call fcn.6fc61f00
mov dword [esp + 0x7c], ecx
mov edx, dword [esp + 0xc8]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x14c]
sar edx, 0xa
mov dword [ecx + 0x10], edx
mov ebp, dword [esp + 0x74]
mov dword [ecx + 0x1c], ebp
mov esi, dword [0x700a7770]
test esi, esi
jne 0x6fc7fb36
mov eax, dword [esp + 0x144]
mov dword [ecx + 0x14], eax
mov esi, dword [esp + 0x148]
mov dword [ecx + 0x18], esi
jmp 0x6fc7fb5c
lea edi, [ecx + 0x14]
mov eax, dword [esp + 0x144]
call fcn.6fc61f00
lea edi, [ecx + 0x18]
mov esi, eax
mov eax, dword [esp + 0x148]
call fcn.6fc61f00
mov edi, eax
mov eax, esi
mov esi, edi
mov ecx, dword [esp + 0x13c]
mov dword [esp], ecx
mov ecx, dword [esp + 0x140]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
call fcn.6fc83d90
mov eax, dword [esp + 0x78]
test byte [eax], al
mov dword [esp + 0x150], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x14c]
and eax, 0x60
or eax, 0x13
mov dword [esp + 0x158], eax
add esp, 0x138
ret
mov dword [esp], ebx
lea eax, [0x6fe785a0]
mov dword [esp + 4], eax
lea eax, [0x6fe744c0]
mov dword [esp + 8], eax
call fcn.6fc09100
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede934]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc7f9e0
Function at 0x6fc83860
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc8395b
sub esp, 0x2c
mov eax, dword [esp + 0x30]
test eax, eax
je 0x6fc838fa
test eax, 0x60
jne 0x6fc8388c
add esp, 0x2c
ret
call fcn.6fc83680
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp], 0
lea edx, [0x6fe7d04a]
mov dword [esp + 4], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0x6fe8a089]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x2c
call fcn.6fc4e6f0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.6fc09410
mov eax, dword [esp + 8]
lea ecx, [0x6fe514c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6fc36660
call fcn.6fc83680
mov eax, dword [esp]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x24], ecx
lea edx, [0x6fe5dce0]
mov dword [esp], edx
call fcn.6fc0ba30
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x24]
mov dword [edi + 4], eax
mov eax, dword [0x700a7770]
test eax, eax
jne 0x6fc83950
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov dword [edi + 8], 0
lea eax, [0x6fe55fe0]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.6fc36660
mov eax, dword [esp + 0x28]
call fcn.6fc61f00
jmp 0x6fc83937
call fcn.6fc60ad0
jmp fcn.6fc83860
Function at 0x6fc83970
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc83ae4
sub esp, 0x2c
mov eax, dword [esp + 0x30]
test eax, eax
je 0x6fc83a83
test eax, 0x60
jne 0x6fc83a15
test eax, 0x100
je 0x6fc839a7
add esp, 0x2c
ret
call fcn.6fc83680
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp], 0
lea edx, [0x6fe7d04a]
mov dword [esp + 4], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0x6fe83434]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x1a
call fcn.6fc4e6f0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.6fc09410
mov eax, dword [esp + 8]
lea ecx, [0x6fe514c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6fc36660
call fcn.6fc83680
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp], 0
lea edx, [0x6fe7d04a]
mov dword [esp + 4], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0x6fe8a089]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x2c
call fcn.6fc4e6f0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.6fc09410
mov eax, dword [esp + 8]
lea ecx, [0x6fe514c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6fc36660
call fcn.6fc83680
mov eax, dword [esp]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x24], ecx
lea edx, [0x6fe5dce0]
mov dword [esp], edx
call fcn.6fc0ba30
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x24]
mov dword [edi + 4], eax
mov eax, dword [0x700a7770]
test eax, eax
jne 0x6fc83ad9
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov dword [edi + 8], 0
lea eax, [0x6fe55fe0]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.6fc36660
mov eax, dword [esp + 0x28]
call fcn.6fc61f00
jmp 0x6fc83ac0
call fcn.6fc60ad0
jmp fcn.6fc83970

Function at 0x6fc83af0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc83b57
sub esp, 8
mov eax, dword [esp + 0x14]
test eax, 0x100
je 0x6fc83b3e
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.6fc814c0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
and eax, 0x60
or eax, 0x16
mov dword [esp + 0x20], eax
add esp, 8
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede95c]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc83af0
Function at 0x6fc83c00
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc83d80
sub esp, 0x14
mov eax, dword [esp + 0x20]
and eax, 0x1f
cmp eax, 0x11
je 0x6fc83c71
cmp eax, 0x17
jne 0x6fc83d41
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fc80880
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov eax, dword [eax + 0x50]
mov dword [esp], ecx
call eax
cmp dword [esp + 4], 8
jne 0x6fc83d29
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
add esp, 0x14
ret
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fc80880
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov eax, dword [eax + 0x50]
mov dword [esp], ecx
call eax
cmp dword [esp + 4], 8
jne 0x6fc83d11
mov ecx, dword [esp + 0x20]
test ecx, 0x100
je 0x6fc83cf9
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 0x10], ecx
test ecx, ecx
jge 0x6fc83cb8
call fcn.6fc4aeb0
mov ecx, dword [esp + 0x10]
mov eax, 1
mul ecx
jno 0x6fc83cc7
mov ebx, dword [esp + 0x1c]
jmp 0x6fc83cd3
mov edx, dword [esp + 0x1c]
mov ebx, edx
neg edx
cmp eax, edx
jbe 0x6fc83ce9
test ebx, ebx
jne 0x6fc83cdc
call fcn.6fc4aef0
call fcn.6fc4aeb0
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
add esp, 0x14
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede974]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede96c]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede964]
mov dword [esp + 4], eax
call fcn.6fc36660
mov dword [esp + 0xc], eax
lea eax, [0x6fe5dce0]
mov dword [esp], eax
call fcn.6fc0ba30
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x6fe806e7]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x6fe55fe0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc83c00
Function at 0x6fc84b00
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc84ca0
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov ecx, eax
and eax, 0x1f
cmp eax, 0x14
je 0x6fc84bc2
cmp eax, 0x16
jne 0x6fc84c61
test ecx, 0x80
je 0x6fc84b74
mov eax, dword [esp + 0x18]
movzx edx, byte [eax + 0xf]
test dl, 0x20
jne 0x6fc84b6c
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp], ecx
call fcn.6fc5db80
movzx eax, byte [esp + 4]
test al, al
je 0x6fc84c49
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
jmp 0x6fc84b7c
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x6fc84ba6
mov eax, dword [eax + 0x20]
nop
movzx ebx, byte [eax + 0xf]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
and ecx, 0x60
and ebx, 0x1f
or ecx, ebx
or ecx, 0x180
mov dword [esp + 0x2c], ecx
add esp, 0x14
ret
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
add esp, 0x14
ret
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fc80630
mov eax, dword [esp + 4]
test eax, eax
jne 0x6fc84be1
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x6fc84bf1
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
test ecx, ecx
je 0x6fc84bf1
mov ecx, dword [ecx + 4]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x6fc84c18
nop
movzx edx, byte [ecx + 0xf]
mov ebx, edx
and edx, 0x1f
test bl, 0x20
jne 0x6fc84c1e
or edx, 0x80
jmp 0x6fc84c1e
xor edx, edx
xor ecx, ecx
xor eax, eax
test edx, edx
je 0x6fc84c39
mov ebx, dword [esp + 0x20]
test ebx, 0x60
je 0x6fc84c35
mov ebx, 0x20
jmp 0x6fc84c37
xor ebx, ebx
or edx, ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
add esp, 0x14
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede9b4]
mov dword [esp + 4], eax
call fcn.6fc36660
mov dword [esp + 8], eax
lea eax, [0x6fe5dce0]
mov dword [esp], eax
call fcn.6fc0ba30
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x12
lea ecx, [0x6fe7ff1b]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
lea ecx, [0x6fe55fe0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc84b00
Function at 0x6fc85140
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc852f6
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 0xc], eax
cmp eax, 0x12
ja 0x6fc851c9
cmp eax, 0x11
je 0x6fc851ba
cmp eax, 0x12
jne 0x6fc8528b
mov eax, dword [esp + 0x14]
cmp dword [eax], 4
jne 0x6fc852dd
nop
mov eax, dword [eax + 4]
test eax, eax
je 0x6fc852dd
test ecx, 0x80
je 0x6fc851a2
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
jmp 0x6fc851a6
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fc5d670
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp eax, 0x15
jne 0x6fc8520f
mov eax, dword [esp + 0x14]
cmp dword [eax], 4
jne 0x6fc852c5
nop
mov eax, dword [eax + 4]
test eax, eax
je 0x6fc852c5
test ecx, 0x80
je 0x6fc851f7
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
jmp 0x6fc851fb
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fc5d9a0
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp eax, 0x16
je 0x6fc85228
cmp eax, 0x18
jne 0x6fc8528b
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.6fc80880
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov eax, dword [eax + 0x50]
mov dword [esp], ecx
call eax
cmp dword [esp + 4], 0x11
jne 0x6fc85273
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.6fc80880
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov eax, dword [eax + 0x54]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede88c]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe5dce0]
mov dword [esp], eax
call fcn.6fc0ba30
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x11
lea ecx, [0x6fe7f93a]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x6fe55fe0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede8ec]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede8ec]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc85140
Function at 0x6fc857d0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc8588b
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x6fc85872
lea ecx, [eax + 0xc]
mov dword [esp], ecx
call fcn.6fc5d940
mov eax, dword [esp + 4]
test eax, eax
je 0x6fc8585a
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x20]
mov ecx, dword [ecx + 8]
test ecx, 0x60
je 0x6fc85822
mov ecx, 0x20
jmp 0x6fc85824
xor ecx, ecx
nop
movzx ebx, byte [edx + 0xf]
mov dword [esp], edx
and ebx, 0x1f
or ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.6fc85b00
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
add esp, 0x18
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede89c]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede894]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc857d0

Function at 0x6fc858a0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc8595b
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x6fc85942
lea ecx, [eax + 0xc]
mov dword [esp], ecx
call fcn.6fc5d970
mov eax, dword [esp + 4]
test eax, eax
je 0x6fc8592a
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x24]
mov ecx, dword [ecx + 8]
test ecx, 0x60
je 0x6fc858f2
mov ecx, 0x20
jmp 0x6fc858f4
xor ecx, ecx
nop
movzx ebx, byte [edx + 0xf]
mov dword [esp], edx
and ebx, 0x1f
or ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.6fc85b00
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
add esp, 0x18
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede8ac]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede8a4]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc858a0
Function at 0x6fc85970
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc85a56
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x6fc85a3d
lea edx, [eax + 0xc]
mov dword [esp + 0xc], edx
mov ebx, dword [eax + 0x14]
test ebx, ebx
jne 0x6fc859d4
mov ebx, dword [eax]
mov eax, dword [eax + 4]
cmp dword [ebx], 4
jne 0x6fc85a25
nop
mov ebp, dword [ebx + 4]
test ebp, ebp
je 0x6fc85a25
test ecx, 0x80
je 0x6fc859c2
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.6fc5d8d0
jmp 0x6fc859f0
mov dword [esp], edx
call fcn.6fc5d940
mov eax, dword [esp + 4]
test eax, eax
je 0x6fc85a0d
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.6fc5d910
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.6fc5d940
mov eax, dword [esp + 4]
test eax, eax
setne al
mov byte [esp + 0x18], al
add esp, 0x10
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede8bc]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede8ec]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede8b4]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc85970
Function at 0x6fc85cd0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc85e72
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, eax
and eax, 0x1f
mov dword [esp + 0xc], eax
cmp eax, 0x15
ja 0x6fc85d6f
cmp eax, 0x12
jne 0x6fc85d09
mov eax, dword [esp + 0x14]
jmp 0x6fc85db8
cmp eax, 0x13
jne 0x6fc85d60
test ecx, 0x200
jne 0x6fc85d51
mov eax, dword [esp + 0x14]
cmp dword [eax], 4
jne 0x6fc85e59
nop
mov eax, dword [eax + 4]
test eax, eax
je 0x6fc85e59
test ecx, 0x80
je 0x6fc85d3f
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
jmp 0x6fc85d43
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6fc85d49
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
nop
lea eax, [0x6fc87700]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp eax, 0x15
jne 0x6fc85e07
mov eax, dword [esp + 0x14]
jmp 0x6fc85db8
cmp eax, 0x16
jne 0x6fc85daa
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 4]
test edx, edx
jne 0x6fc85db8
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.6fc5db80
movzx eax, byte [esp + 4]
test al, al
je 0x6fc85e41
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
cmp eax, 0x17
je 0x6fc85de1
cmp eax, 0x1a
jne 0x6fc85e07
mov eax, dword [esp + 0x14]
cmp dword [eax], 4
jne 0x6fc85def
nop
mov eax, dword [eax + 4]
test eax, eax
je 0x6fc85def
test ecx, 0x80
je 0x6fc85dd5
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
jmp 0x6fc85dd9
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede8ec]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe5dce0]
mov dword [esp], eax
call fcn.6fc0ba30
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x15
lea ecx, [0x6fe8143c]
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [0x6fe55fe0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede8cc]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede8ec]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc85cd0
Function at 0x6fc86840
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc8697f
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6fc86944
test eax, 0x200
je 0x6fc868fe
sar eax, 0xa
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 0xf]
and edx, 0x1f
cmp edx, 0x14
jne 0x6fc868b7
mov edx, dword [ecx + 0x24]
cmp dword [ecx + 0x28], eax
jbe 0x6fc8692c
lea eax, [edx + eax*8 + 4]
mov eax, dword [eax]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6fc5f1e0
mov eax, dword [esp + 8]
lea ecx, [0x6fee060c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x14
ret
mov dword [esp + 0x10], eax
mov dword [esp], ecx
call fcn.6fc805a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 8], ecx
jbe 0x6fc86914
shl ecx, 4
mov eax, dword [eax + ecx + 4]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6fc5f1e0
mov eax, dword [esp + 8]
lea ecx, [0x6fee060c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
add esp, 0x14
ret
lea eax, [0x6fee060c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add esp, 0x14
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede98c]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede98c]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe5dce0]
mov dword [esp], eax
call fcn.6fc0ba30
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x12
lea ecx, [0x6fe7ff2d]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x6fe55fe0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc86840
Function at 0x6fc8d940
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc8da30
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x20]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
jne 0x6fc8da17
lea eax, [0x6fe56f40]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 8], ecx
call fcn.6fc09620
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x6fc8d9d5
mov eax, dword [eax + 0x10]
mov dword [esp], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
call fcn.6fc8d7f0
mov eax, dword [esp + 0x14]
lea ecx, [0x6fedf48c]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
add esp, 0x18
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede534]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc8d940

Function at 0x6fc8dd70
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc8de60
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x20]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
jne 0x6fc8de47
lea eax, [0x6fe56fa0]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 8], ecx
call fcn.6fc09620
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x6fc8de05
mov eax, dword [eax + 0x10]
mov dword [esp], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
call fcn.6fc8d7f0
mov eax, dword [esp + 0x14]
lea ecx, [0x6fedf474]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
add esp, 0x18
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede574]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc8dd70