joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fc96990
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc969f7
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.6fc967b0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
test edx, edx
jne 0x6fc969de
test ecx, ecx
jbe 0x6fc969d5
mov dword [esp + 0x28], eax
add esp, 0x1c
ret
xor eax, eax
mov ecx, eax
call fcn.6fc61f80
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede60c]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fc96990
Function at 0x6fca8ec0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fca8f11
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x6fca8ef8
add eax, 4
mov dword [esp], eax
call fcn.6fc60390
movzx eax, byte [esp + 4]
mov byte [esp + 0x10], al
add esp, 8
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fedeb48]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fca8ec0

Function at 0x6fca9010
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fca9089
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x6fca9070
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fca8e30
mov eax, dword [esp + 0x14]
add eax, 4
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call fcn.6fc603d0
movzx eax, byte [esp + 0xc]
mov byte [esp + 0x20], al
add esp, 0x10
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede6dc]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fca9010
Function at 0x6fcb2a40
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fcb2ad1
sub esp, 0x18
mov eax, dword [esp + 0x1c]
test byte [eax], al
mov dword [esp], eax
call fcn.6fc663d0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
test ecx, 1
jne 0x6fcb2aaf
add ecx, 8
adc eax, 0
test ecx, 0x7ffff8
sete dl
and edx, 1
test dl, dl
jne 0x6fcb2ab8
mov edx, dword [esp + 0x1c]
mov dword [esp], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
call fcn.6fc66370
movzx eax, byte [esp + 0x14]
test al, al
je 0x6fcb2a55
mov byte [esp + 0x20], 1
add esp, 0x18
ret
mov byte [esp + 0x20], 0
add esp, 0x18
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede804]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fcb2a40

Function at 0x6fcb2ae0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fcb2c2b
sub esp, 0x28
mov eax, dword [esp + 0x2c]
test byte [eax], al
mov dword [esp], eax
call fcn.6fc663d0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
test ecx, 1
jne 0x6fcb2b78
mov edx, ecx
or ecx, 1
add ecx, 8
mov ebx, eax
adc eax, 0
test ecx, 0x7ffff8
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, 1
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x6fcb2c12
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ebx
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
and eax, 0x80000000
mov dword [esp + 0x10], eax
and ecx, 0x7fffff
mov dword [esp + 0xc], ecx
call fcn.6fc66370
movzx eax, byte [esp + 0x14]
test al, al
je 0x6fcb2af9
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
jmp 0x6fcb2bb5
mov byte [esp + 0x30], 0
add esp, 0x28
ret
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
add eax, 0xff800000
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x2c]
lea ebx, [edx + 8]
mov dword [esp], ebx
call fcn.6fc5f4e0
mov eax, dword [esp + 0x18]
add eax, 0xff800000
mov ecx, dword [esp + 0x1c]
adc ecx, 0xffffffff
mov eax, dword [esp + 0x24]
test eax, 0xff800000
setne dl
test ecx, 0x7ff
setne bl
or ebx, edx
test bl, bl
jne 0x6fcb2b81
jmp 0x6fcb2c01
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
add eax, 0
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x2c]
lea ebx, [edx + 0xc]
mov dword [esp], ebx
call fcn.6fc5f4e0
mov eax, dword [esp + 0x18]
add eax, 0
mov ecx, dword [esp + 0x1c]
adc ecx, 0xfffff800
mov eax, dword [esp + 0x24]
test ecx, 0x7ffff800
jne 0x6fcb2bce
mov byte [esp + 0x30], 1
add esp, 0x28
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede804]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fcb2ae0
Function at 0x6fcb2cf0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fcb2e6e
sub esp, 0x34
movzx eax, byte [esp + 0x3c]
test al, al
je 0x6fcb2d33
mov eax, dword [esp + 0x38]
test byte [eax], al
lea ecx, [eax + 8]
mov edx, 2
mov ebx, 0x800000
xor ebp, ebp
mov esi, 0xff800000
mov edi, 0x7ff
jmp 0x6fcb2d4f
mov eax, dword [esp + 0x38]
test byte [eax], al
lea ecx, [eax + 0xc]
mov edx, 4
xor ebx, ebx
mov ebp, 0x800
xor esi, esi
mov edi, 0x7ffff800
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ecx
mov dword [esp + 0x24], edx
jmp 0x6fcb2d6d
mov eax, dword [esp + 0x38]
test byte [eax], al
mov dword [esp], eax
call fcn.6fc663d0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
test ecx, 1
jne 0x6fcb2e34
mov edx, dword [esp + 0x24]
test edx, ecx
sete bl
and ebx, 1
mov byte [esp + 0x1b], bl
test bl, bl
je 0x6fcb2dc2
or ecx, edx
add ecx, 8
adc eax, 0
test ecx, 0x7ffff8
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, 1
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x6fcb2df0
jmp 0x6fcb2e55
mov ebp, dword [esp + 0x28]
add ecx, ebp
mov esi, dword [esp + 0x2c]
adc eax, esi
mov edi, dword [esp + 0x1c]
test ecx, edi
xchg edi, ebx
sete bl
xchg edi, ebx
mov esi, dword [esp + 0x20]
test esi, eax
xchg esi, ebx
sete bl
xchg esi, ebx
and esi, edi
xchg esi, eax
test al, al
xchg esi, eax
jne 0x6fcb2e3d
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
call fcn.6fc66370
movzx eax, byte [esp + 0x14]
test al, al
je 0x6fcb2d69
movzx eax, byte [esp + 0x1b]
test al, al
jne 0x6fcb2e2b
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.6fc5f400
jmp 0x6fcb2d69
mov byte [esp + 0x40], 1
add esp, 0x34
ret
mov byte [esp + 0x40], 0
add esp, 0x34
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede804]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede804]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fcb2cf0
Function at 0x6fcb8930
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fcb8988
sub esp, 8
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x6fcb8963
call fcn.6fcb0f80
movzx eax, byte [esp]
test al, al
jne 0x6fcb896f
call fcn.6fc5ea10
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.6fc5ed70
add esp, 8
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fedeac8]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fcb8930
Function at 0x6fcc3c30
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fcc3e33
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov ebx, dword [eax]
test ebx, ebx
je 0x6fcc3c5c
cmp eax, ebx
je 0x6fcc3c71
jmp 0x6fcc3e1a
mov ebx, dword [0x700a7770]
test ebx, ebx
jne 0x6fcc3c6a
mov dword [eax], eax
jmp 0x6fcc3c71
mov edi, eax
call fcn.6fc61f00
mov ebx, dword [esp + 0x34]
cmp ebx, 0x80
jae 0x6fcc3d07
mov ecx, dword [eax + 8]
lea edx, [ecx + 1]
mov ebp, dword [eax + 4]
mov esi, dword [eax + 0xc]
cmp esi, edx
jae 0x6fcc3ce1
lea eax, [0x6fe51840]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
call fcn.6fc4af30
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
mov dword [ebx + 0xc], edx
mov edx, dword [0x700a7770]
test edx, edx
jne 0x6fcc3cd1
mov dword [ebx + 4], eax
jmp 0x6fcc3cd9
lea edi, [ebx + 4]
call fcn.6fc61f00
mov ebp, eax
mov eax, ebx
mov ebx, dword [esp + 0x34]
lea edx, [ecx + 1]
mov dword [eax + 8], edx
mov byte [ebp + ecx], bl
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x2c
ret
mov ebp, dword [eax + 8]
mov dword [esp + 0x20], ebp
mov esi, dword [eax + 0xc]
mov edi, esi
sub esi, ebp
cmp esi, 4
jge 0x6fcc3da0
lea eax, [0x6fe51840]
mov dword [esp], eax
mov dword [esp + 4], ebp
shl edi, 1
lea eax, [edi + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 8], eax
call fcn.6fc4adf0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov ebp, dword [esp + 0x20]
cmp ebx, ebp
jl 0x6fcc3d55
mov ebx, ebp
cmp edx, eax
je 0x6fcc3d79
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
call fcn.6fc62890
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov ebp, dword [esp + 0x20]
mov dword [ecx + 8], ebp
mov ebx, dword [esp + 0x24]
mov dword [ecx + 0xc], ebx
mov ebx, dword [0x700a7770]
test ebx, ebx
jne 0x6fcc3d92
mov dword [ecx + 4], eax
jmp 0x6fcc3d9a
lea edi, [ecx + 4]
call fcn.6fc61f00
mov eax, ecx
mov ebx, dword [esp + 0x34]
mov edx, dword [eax + 0xc]
mov esi, dword [eax + 4]
lea ecx, [ebp + 4]
cmp edx, ecx
jb 0x6fcc3e15
cmp ebp, ecx
ja 0x6fcc3e0e
sub edx, ebp
mov eax, edx
neg edx
sar edx, 0x1f
and edx, ebp
lea ecx, [esi + edx]
mov dword [esp], ecx
mov dword [esp + 4], 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.6fc684d0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0xc]
mov ebx, dword [esp + 0x20]
add ebx, eax
cmp edx, ebx
jb 0x6fcc3e07
mov dword [ecx + 8], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x2c
ret
mov ecx, ebx
call fcn.6fc61fc0
mov eax, ebp
call fcn.6fc61fe0
call fcn.6fc61fc0
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede6c4]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fcc3c30
Function at 0x6fcc8170
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fcc8292
sub esp, 0x24
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 8]
lea edx, [0x6fe51840]
mov dword [esp], edx
shl ecx, 2
mov dword [esp + 0x14], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.6fc4adf0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
mov ebp, ebx
xor esi, esi
jmp 0x6fcc81cc
mov edi, dword [esp + 0x18]
lea esi, [edi + 1]
cmp esi, eax
jge 0x6fcc81e7
mov dword [esp + 0x18], esi
mov edi, dword [ecx + esi*4]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
jmp 0x6fcc824a
test ebx, ebx
jge 0x6fcc81f0
xor ebx, ebx
jmp 0x6fcc81f0
inc ebx
cmp ebx, ebp
jge 0x6fcc8202
jae 0x6fcc822f
movzx esi, byte [edx + ebx]
xchg esi, eax
test al, al
xchg esi, eax
je 0x6fcc81ef
cmp ebx, ebp
ja 0x6fcc8226
sub ebp, ebx
mov eax, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebx, ebp
lea ecx, [edx + ebx]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
add esp, 0x24
ret
mov eax, ebx
mov ecx, ebp
call fcn.6fc61fe0
mov eax, ebx
mov ecx, ebp
call fcn.6fc61f80
mov ebx, dword [esp + 0x10]
inc ebx
shr edi, 8
mov dword [esp + 0x10], ebx
mov ebx, esi
mov esi, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
cmp esi, 4
jge 0x6fcc81c5
lea esi, [ebx - 1]
test esi, esi
jl 0x6fcc826a
cmp ebp, esi
jbe 0x6fcc8288
xchg edi, eax
mov byte [ebx + edx - 1], al
xchg edi, eax
jmp 0x6fcc8238
xchg edi, eax
test al, al
xchg edi, eax
je 0x6fcc8238
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede78c]
mov dword [esp + 4], eax
call fcn.6fc36660
mov eax, esi
mov ecx, ebp
call fcn.6fc61f80
nop
call fcn.6fc60ad0
jmp fcn.6fcc8170
Function at 0x6fcc82a0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fcc839c
sub esp, 0x1c
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x6fcc82d5
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.6fc626c0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ebx, dword [edx + 4]
mov dword [esp + 0x18], ebx
mov edx, dword [edx + 8]
mov dword [esp + 8], edx
mov ebp, dword [esp + 0x24]
mov eax, ecx
xor esi, esi
jmp 0x6fcc82f6
inc esi
mov ebx, dword [esp + 0x18]
cmp esi, edx
jge 0x6fcc830d
mov edi, dword [ebx + esi*4]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
jmp 0x6fcc8358
test ecx, ecx
jge 0x6fcc8316
xor ecx, ecx
jmp 0x6fcc8316
inc ecx
cmp eax, ecx
jle 0x6fcc8325
jbe 0x6fcc8339
movzx edx, byte [ebp + ecx]
test dl, dl
je 0x6fcc8315
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
add esp, 0x1c
ret
mov edx, eax
mov eax, ecx
mov ecx, edx
call fcn.6fc61f80
lea ecx, [ebx + 1]
shr edi, 8
mov ebx, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
mov ecx, edx
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
cmp ebx, 4
jge 0x6fcc82f1
lea edx, [ecx - 1]
test edx, edx
jl 0x6fcc8374
cmp eax, edx
jbe 0x6fcc8392
xchg edi, eax
mov byte [ecx + ebp - 1], al
xchg edi, eax
jmp 0x6fcc8344
xchg edi, eax
test al, al
xchg edi, eax
je 0x6fcc8344
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede78c]
mov dword [esp + 4], eax
call fcn.6fc36660
mov ecx, eax
mov eax, edx
call fcn.6fc61f80
nop
call fcn.6fc60ad0
jmp fcn.6fcc82a0
Function at 0x6fd1e880
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x6fd1ea34
sub esp, 0x84
movzx ecx, byte [esp + 0x90]
cmp cl, 0x10
jae 0x6fd1ea1b
nop
lea edi, [esp + 0x58]
xor eax, eax
call fcn.6fc62198
lea edi, [esp + 0x38]
call fcn.6fc62198
nop
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x44], 0xffffffff
lea edi, [esp + 0x18]
call fcn.6fc62198
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
lea ecx, [esp + 0x58]
mov dword [esp + 0x78], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x7c], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx]
test byte [edx], al
mov dword [esp], edx
lea edx, [esp + 0x58]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x20
call fcn.6fc62890
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx + 4]
test byte [edx], al
mov ebx, dword [esp + 0x7c]
test byte [ebx], al
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x20
call fcn.6fc62890
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx + 8]
test byte [edx], al
mov ebx, dword [esp + 0x80]
test byte [ebx], al
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x20
call fcn.6fc62890
mov ecx, dword [esp + 0x88]
movzx edx, byte [esp + 0x90]
mov ebx, dword [esp + 0x8c]
mov eax, 1
jmp 0x6fd1e9ed
xchg esi, eax
mov byte [esp + 0x17], al
xchg esi, eax
mov edx, dword [ecx + ebp*4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
movzx eax, al
dec eax
shr eax, 0x1f
mov dword [esp + 0xc], eax
call fcn.6fd1e790
movzx eax, byte [esp + 0x17]
inc eax
mov ecx, dword [esp + 0x88]
movzx edx, byte [esp + 0x90]
mov ebx, dword [esp + 0x8c]
cmp al, 0x10
jae 0x6fd1ea08
test byte [ecx], al
lea ebp, [eax - 1]
xchg ebp, eax
movzx eax, al
xchg ebp, eax
nop
mov esi, eax
xor eax, edx
cmp ebp, 0xf
jb 0x6fd1e9ad
jmp 0x6fd1ea0f
add esp, 0x84
ret
mov eax, ebp
mov ecx, 0xf
call fcn.6fc61f80
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede59c]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd1e880
Function at 0x6fd22020
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x6fd221ec
sub esp, 0x84
movzx ecx, byte [esp + 0x90]
cmp cl, 0x10
jae 0x6fd221d3
nop
lea edi, [esp + 0x58]
xor eax, eax
call fcn.6fc62198
lea edi, [esp + 0x38]
call fcn.6fc62198
nop
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x50], 0xfffffffe
mov dword [esp + 0x54], 0
lea edi, [esp + 0x18]
call fcn.6fc62198
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
lea ecx, [esp + 0x58]
mov dword [esp + 0x78], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x7c], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx]
test byte [edx], al
mov dword [esp], edx
lea edx, [esp + 0x58]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x20
call fcn.6fc62890
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx + 4]
test byte [edx], al
mov ebx, dword [esp + 0x7c]
test byte [ebx], al
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x20
call fcn.6fc62890
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx + 8]
test byte [edx], al
mov ebx, dword [esp + 0x80]
test byte [ebx], al
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x20
call fcn.6fc62890
mov ecx, dword [esp + 0x88]
movzx edx, byte [esp + 0x90]
mov ebx, dword [esp + 0x8c]
mov eax, 1
jmp 0x6fd221a5
xchg esi, eax
mov byte [esp + 0x17], al
xchg esi, eax
mov edx, dword [ecx + ebp*4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
movzx eax, al
dec eax
shr eax, 0x1f
mov dword [esp + 0xc], eax
call fcn.6fd21f30
movzx eax, byte [esp + 0x17]
inc eax
mov ecx, dword [esp + 0x88]
movzx edx, byte [esp + 0x90]
mov ebx, dword [esp + 0x8c]
cmp al, 0x10
jae 0x6fd221c0
test byte [ecx], al
lea ebp, [eax - 1]
xchg ebp, eax
movzx eax, al
xchg ebp, eax
nop
mov esi, eax
xor eax, edx
cmp ebp, 0xf
jb 0x6fd22165
jmp 0x6fd221c7
add esp, 0x84
ret
mov eax, ebp
mov ecx, 0xf
call fcn.6fc61f80
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede5a4]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd22020
Function at 0x6fd256d0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x34]
cmp eax, dword [ecx + 8]
jbe 0x6fd258a3
sub esp, 0xb4
movzx ecx, byte [esp + 0xc0]
cmp cl, 0x10
jae 0x6fd2588a
nop
lea edi, [esp + 0x78]
xor eax, eax
call fcn.6fc62194
lea edi, [esp + 0x48]
call fcn.6fc62194
nop
mov dword [esp + 0x48], 1
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0x58], 1
mov dword [esp + 0x5c], 0
lea edi, [esp + 0x18]
call fcn.6fc62194
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xb0], 0
lea ecx, [esp + 0x78]
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0x48]
mov dword [esp + 0xac], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0xb0], ecx
mov ecx, dword [esp + 0xbc]
mov edx, dword [ecx]
test byte [edx], al
mov dword [esp], edx
lea edx, [esp + 0x78]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x30
call fcn.6fc62890
mov ecx, dword [esp + 0xbc]
mov edx, dword [ecx + 4]
test byte [edx], al
mov ebx, dword [esp + 0xac]
test byte [ebx], al
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x30
call fcn.6fc62890
mov ecx, dword [esp + 0xbc]
mov edx, dword [ecx + 8]
test byte [edx], al
mov ebx, dword [esp + 0xb0]
test byte [ebx], al
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x30
call fcn.6fc62890
mov ecx, dword [esp + 0xb8]
movzx edx, byte [esp + 0xc0]
mov ebx, dword [esp + 0xbc]
mov eax, 1
jmp 0x6fd2585c
xchg esi, eax
mov byte [esp + 0x17], al
xchg esi, eax
mov edx, dword [ecx + ebp*4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
movzx eax, al
dec eax
shr eax, 0x1f
mov dword [esp + 0xc], eax
call fcn.6fd255e0
movzx eax, byte [esp + 0x17]
inc eax
mov ecx, dword [esp + 0xb8]
movzx edx, byte [esp + 0xc0]
mov ebx, dword [esp + 0xbc]
cmp al, 0x10
jae 0x6fd25877
test byte [ecx], al
lea ebp, [eax - 1]
xchg ebp, eax
movzx eax, al
xchg ebp, eax
nop
mov esi, eax
xor eax, edx
cmp ebp, 0xf
jb 0x6fd2581c
jmp 0x6fd2587e
add esp, 0xb4
ret
mov eax, ebp
mov ecx, 0xf
call fcn.6fc61f80
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede5ac]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd256d0
Function at 0x6fd29010
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x7c]
cmp eax, dword [ecx + 8]
jbe 0x6fd291cc
sub esp, 0xfc
movzx ecx, byte [esp + 0x108]
cmp cl, 0x10
jae 0x6fd291b3
nop
lea edi, [esp + 0xa8]
xor eax, eax
call fcn.6fc6218e
lea edi, [esp + 0x60]
call fcn.6fc6218e
nop
mov dword [esp + 0x64], 0x800000
lea edi, [esp + 0x18]
call fcn.6fc6218e
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf8], 0
lea ecx, [esp + 0xa8]
mov dword [esp + 0xf0], ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0xf4], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0xf8], ecx
mov ecx, dword [esp + 0x104]
mov edx, dword [ecx]
test byte [edx], al
mov dword [esp], edx
lea edx, [esp + 0xa8]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x48
call fcn.6fc62890
mov ecx, dword [esp + 0x104]
mov edx, dword [ecx + 4]
test byte [edx], al
mov ebx, dword [esp + 0xf4]
test byte [ebx], al
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x48
call fcn.6fc62890
mov ecx, dword [esp + 0x104]
mov edx, dword [ecx + 8]
test byte [edx], al
mov ebx, dword [esp + 0xf8]
test byte [ebx], al
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x48
call fcn.6fc62890
mov ecx, dword [esp + 0x100]
movzx edx, byte [esp + 0x108]
mov ebx, dword [esp + 0x104]
mov eax, 1
jmp 0x6fd29185
xchg esi, eax
mov byte [esp + 0x17], al
xchg esi, eax
mov edx, dword [ecx + ebp*4]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
movzx eax, al
dec eax
shr eax, 0x1f
mov dword [esp + 0xc], eax
call fcn.6fd28f20
movzx eax, byte [esp + 0x17]
inc eax
mov ecx, dword [esp + 0x100]
movzx edx, byte [esp + 0x108]
mov ebx, dword [esp + 0x104]
cmp al, 0x10
jae 0x6fd291a0
test byte [ecx], al
lea ebp, [eax - 1]
xchg ebp, eax
movzx eax, al
xchg ebp, eax
nop
mov esi, eax
xor eax, edx
cmp ebp, 0xf
jb 0x6fd29145
jmp 0x6fd291a7
add esp, 0xfc
ret
mov eax, ebp
mov ecx, 0xf
call fcn.6fc61f80
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede5b4]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd29010
Function at 0x6fd2be20
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd2becb
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x6fd2be48
xor ecx, ecx
jmp 0x6fd2be5b
movzx ecx, byte [eax]
test cl, cl
je 0x6fd2be56
mov ecx, 0xffffffff
jmp 0x6fd2be5b
mov ecx, 1
test ecx, ecx
jne 0x6fd2be89
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + 8]
test edx, edx
jne 0x6fd2be6e
xor edx, edx
jmp 0x6fd2be81
movzx edx, byte [ecx]
test dl, dl
je 0x6fd2be7c
mov edx, 0xffffffff
jmp 0x6fd2be81
mov edx, 1
test edx, edx
jne 0x6fd2be8d
add esp, 0x10
ret
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov edx, dword [edx + 0x18]
mov ebx, dword [esp + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call edx
movzx eax, byte [esp + 0xc]
test al, al
je 0x6fd2beb2
add esp, 0x10
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fedeb10]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd2be20