joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ae60
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x48], r14
mov edx, dword [0x00921104]
test edx, edx
je 0x44ae9a
mov eax, 2
call fcn.004331e0
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
nop
mov ecx, 1
lea rdx, [0x00921104]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x48]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x40], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x38], rsi
mov rdi, qword [rax + 0x28]
mov qword [rsp + 0x30], rdi
mov r8, qword [rbx + 0xf8]
mov qword [rsp + 0x28], r8
call fcn.00438be0
lea rax, [0x006b1e8c]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00439460
mov rax, qword [rsp + 0x40]
call fcn.004392e0
call fcn.00438de0
mov rax, qword [rsp + 0x38]
call fcn.004392e0
nop
call fcn.00438de0
mov rax, qword [rsp + 0x30]
call fcn.004392e0
call fcn.00438de0
mov rax, qword [rsp + 0x28]
call fcn.004392e0
nop
call fcn.00438e20
call fcn.00438c40
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x28], rcx
nop dword [rax + rax]
call fcn.00438be0
lea rax, [0x006b06c6]
mov ebx, 3
call fcn.00439460
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.004392e0
call fcn.00438e20
call fcn.00438c40
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe8], 0
nop
je 0x44aff7
mov rdx, qword [rsp + 0x78]
cmp qword [rcx], rdx
jne 0x44aff2
cmp qword [rcx + 0x90], 0
je 0x44afed
cmp byte [0x009210ad], 0
je 0x44afe0
nop
call fcn.00438be0
lea rax, [0x006c0a24]
mov ebx, 0x2e
call fcn.00439460
call fcn.00438c40
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x90]
jmp 0x44affc
mov rcx, rdx
jmp 0x44affc
mov rcx, rdx
jmp 0x44affc
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rcx
call fcn.00438be0
call fcn.00438e20
call fcn.00438c40
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 2
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
mov qword [rax + 0x98], rcx
mov eax, dword [0x0088c3fc]
mov rcx, qword [r14 + 0x30]
movzx edx, byte [rcx + 0xf9]
test dl, dl
jne 0x44b060
mov edx, eax
shr edx, 2
cmp dword [rcx + 0xc4], 2
mov esi, 2
cmovae edx, esi
nop
test edx, edx
jle 0x44b09d
mov dword [rsp + 0x24], eax
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
xor ecx, ecx
nop dword [rax]
call fcn.00459520
mov rax, qword [rsp + 0x50]
call fcn.0045af00
mov rax, qword [rsp + 0x70]
call fcn.00407760
mov eax, dword [rsp + 0x24]
bt eax, 0
jae 0x44b0b2
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
call fcn.0044b360
mov eax, 2
call fcn.004331e0
add rsp, 0x58
pop rbp
ret
Function at 0x44f2c0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x44f3c6
push rbp
mov rbp, rsp
sub rsp, 0x130
lea rdi, [rsp + 0x20]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466c4b
mov rbp, qword [rbp]
lea rcx, [0x006910e0]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + 0x17]
nop dword [rax + rax]
test dl, 0x40
jne 0x44f3b3
lea rdx, [0x00921520]
lea rax, [0x008938e0]
jmp 0x44f340
mov rax, qword [rax + 0x248]
test rax, rax
je 0x44f359
cmp qword [rax + 0x140], rdx
ja 0x44f339
cmp qword [rax + 0x110], rdx
jbe 0x44f339
jmp 0x44f360
xor eax, eax
nop dword [rax + rax]
test rax, rax
je 0x44f3a2
mov rdx, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rax + 0x138]
lea rax, [rdx + 7]
and rax, 0xfffffffffffffff8
neg eax
mov dword [0x00921520], eax
mov dword [0x00921524], edx
mov dword [0x00921528], ebx
mov dword [0x0092152c], ecx
add rsp, 0x130
pop rbp
ret
lea rax, [0x006bfbf0]
mov ebx, 0x2b
call fcn.00437240
lea rax, [0x006c3909]
mov ebx, 0x3d
nop
call fcn.00437240
nop
call fcn.004646a0
jmp fcn.0044f2c0
Function at 0x452f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4530b7
movzx edx, byte [rax]
test edx, edx
jne 0x452f74
nop dword [rax]
test r8b, r8b
jne 0x452f74
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x452f87
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x453077
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x453065
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x453057
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x452fdd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x453020
mov eax, 1
cmp rax, rbx
ja 0x45300b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00466a20
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45304f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x453013
mov rcx, r11
mov eax, r12d
jmp 0x452fe2
mov rcx, rbx
call fcn.00466960
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00466960
mov eax, r8d
mov rcx, rbx
call fcn.00466a20
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4530ad
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x453070
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x452f8d
mov eax, edx
mov rcx, rbx
call fcn.00466960
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00466960
nop
int3
Function at 0x4535a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4538f5
push rbp
mov rbp, rsp
sub rsp, 0xa8
movzx edx, byte [rbx + 0x17]
and edx, 0x1f
dec rdx
cmp rdx, 0x19
ja 0x4538ad
mov qword [rsp + 0xb8], rax
lea rsi, [0x0072c520]
nop dword [rax]
jmp qword [rsi + rdx*8]
mov rax, rbx
call fcn.0045b860
mov ecx, 0x16
mov rdi, rax
mov rsi, rbx
lea r8, [0x006c2d5e]
mov r9d, 0x37
xor eax, eax
lea rbx, [0x006b68f1]
call fcn.0044f6c0
nop dword [rax + rax]
call fcn.0040ae40
mov rbx, rax
lea rax, [0x0065b7a0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004535a0

Function at 0x453bc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453ce8
push rbp
mov rbp, rsp
sub rsp, 0x38
cmp qword [rax + 8], 0
jle 0x453cd6
cmp qword [rax + 0x10], 0
jl 0x453cc5
mov ecx, dword [rax + 0x40]
test ecx, ecx
jne 0x453cb0
mov qword [rsp + 0x48], rax
nop
mov ecx, 1
xchg dword [rax + 0x40], ecx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x28], r14
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0xa0]
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx + 0x30]
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x30], rdx
test byte [rdx], al
lea rsi, [rdx + 0x2280]
mov qword [rsp + 0x20], rsi
nop
mov rax, rsi
call fcn.0040b580
mov rax, qword [rsp + 0x30]
call fcn.004549e0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
call fcn.00453d00
nop
nop
mov rax, qword [rsp + 0x20]
call fcn.0040b7a0
mov rax, qword [rsp + 0x10]
call fcn.004400c0
mov rcx, qword [rsp + 0x18]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
nop
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x453caa
cmp byte [r14 + 0xb1], 0
je 0x453caa
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x38
pop rbp
ret
lea rax, [0x006bdf82]
mov ebx, 0x26
nop dword [rax]
call fcn.00437240
lea rax, [0x006bbe2c]
mov ebx, 0x21
call fcn.00437240
lea rax, [0x006b9240]
mov ebx, 0x1b
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.00453bc0
Function at 0x4584e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45860b
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rax + 0x10], 0
movzx ecx, byte [rax + 0x59]
nop
test cl, 3
jne 0x458519
mov rcx, qword [rax + 0x48]
mov rax, qword [rax + 0x28]
mov rdx, qword [rcx + 0x80]
cmp rdx, rax
jne 0x45851f
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x18], rdx
mov rax, qword [rcx + 0x98]
mov qword [rsp + 0x10], rax
call fcn.00438be0
lea rax, [0x006b1ebe]
mov ebx, 0xa
call fcn.00439460
mov rax, qword [rsp + 0x10]
call fcn.004391a0
lea rax, [0x006b2425]
mov ebx, 0xb
call fcn.00439460
mov rax, qword [rsp + 0x20]
call fcn.004392e0
lea rax, [0x006b0b16]
mov ebx, 5
call fcn.00439460
mov rax, qword [rsp + 0x18]
call fcn.004392e0
call fcn.00438e20
call fcn.00438c40
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x18], rax
call fcn.00438be0
lea rax, [0x006b15a1]
mov ebx, 8
call fcn.00439460
mov rax, qword [rsp + 0x20]
call fcn.004392e0
lea rax, [0x00725a40]
mov ebx, 1
nop dword [rax]
call fcn.00439460
mov rax, qword [rsp + 0x18]
call fcn.004392e0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006bcb3b]
mov ebx, 0x23
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.004584e0
Function at 0x45a760
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a80f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0045a860]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00464560
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0045a760
Function at 0x45b9c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45bc06
push rbp
mov rbp, rsp
sub rsp, 0x48
test ebx, ebx
je 0x45b9e3
mov dword [rsp + 0x60], ebx
lea rcx, [0x008938e0]
jmp 0x45b9f2
xor eax, eax
add rsp, 0x48
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x45ba2f
mov rdx, qword [rcx + 0x128]
nop
cmp rax, rdx
jb 0x45b9eb
mov rsi, qword [rcx + 0x130]
cmp rax, rsi
jae 0x45b9eb
movsxd rcx, ebx
lea rax, [rdx + rcx]
nop dword [rax + rax]
cmp rsi, rax
jb 0x45bb7b
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x28], rax
nop
nop
nop
lea rax, [0x008cc960]
nop
call fcn.0040b580
mov rbx, qword [0x008cc970]
lea rax, [0x0066a100]
mov ecx, dword [rsp + 0x60]
call fcn.004106e0
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
nop
nop
nop
lea rax, [0x008cc960]
call fcn.0040b7a0
movzx ecx, byte [rsp + 0x1f]
nop dword [rax]
test cl, cl
jne 0x45bae7
call fcn.00438be0
lea rax, [0x006b4563]
mov ebx, 0x11
call fcn.00439460
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.004392e0
lea rax, [0x006b0dc5]
mov ebx, 6
call fcn.00439460
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.004392e0
lea rax, [0x006b3f3e]
mov ebx, 0x10
call fcn.00439460
call fcn.00438c40
lea rax, [0x008938e0]
jmp 0x45bb65
mov rax, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x30], rdx
call fcn.00438be0
lea rax, [0x006b1124]
mov ebx, 7
call fcn.00439460
mov rax, qword [rsp + 0x38]
call fcn.004392e0
lea rax, [0x006b15b1]
mov ebx, 8
nop dword [rax + rax]
call fcn.00439460
mov rax, qword [rsp + 0x30]
call fcn.004392e0
call fcn.00438e20
call fcn.00438c40
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x248]
test rax, rax
jne 0x45baf2
lea rax, [0x006c0a80]
mov ebx, 0x2e
call fcn.00437240
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rsi
call fcn.00438be0
lea rax, [0x006b4563]
mov ebx, 0x11
call fcn.00439460
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.004392e0
lea rax, [0x006b343e]
mov ebx, 0xe
call fcn.00439460
mov rax, qword [rsp + 0x38]
nop dword [rax]
call fcn.004392e0
lea rax, [0x006b06ba]
mov ebx, 3
call fcn.00439460
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.004392e0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006bbe4d]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.0045b9c0
Function at 0x45bc40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45bec6
push rbp
mov rbp, rsp
sub rsp, 0x48
test ebx, ebx
je 0x45bc64
cmp ebx, 0xffffffff
je 0x45bc64
lea rcx, [0x008938e0]
jmp 0x45bc73
xor eax, eax
add rsp, 0x48
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x45bc94
nop dword [rax + rax]
cmp qword [rcx + 0x128], rax
ja 0x45bc6c
cmp qword [rcx + 0x130], rax
jbe 0x45bc6c
jmp 0x45bc96
xor ecx, ecx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x45bcf9
mov qword [rsp + 0x20], rcx
mov rdx, qword [rcx + 0x238]
lea rax, [0x0066a040]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
call fcn.00410560
mov rax, qword [rax]
test rax, rax
jne 0x45bcf3
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x128]
mov ebx, dword [rsp + 0x60]
movsxd rsi, ebx
lea rax, [rdx + rsi]
mov rcx, qword [rcx + 0x130]
cmp rcx, rax
jb 0x45be36
add rsp, 0x48
pop rbp
ret
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x28], rax
nop
nop
nop
lea rax, [0x008cc960]
call fcn.0040b580
mov rbx, qword [0x008cc970]
lea rax, [0x0066a100]
mov ecx, dword [rsp + 0x60]
nop
call fcn.00410560
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
nop
nop
nop
lea rax, [0x008cc960]
call fcn.0040b7a0
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x45bda4
call fcn.00438be0
lea rax, [0x006b4574]
mov ebx, 0x11
call fcn.00439460
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.004392e0
lea rax, [0x006b0dc5]
mov ebx, 6
call fcn.00439460
mov rax, qword [rsp + 0x28]
nop
call fcn.004392e0
lea rax, [0x006b3f3e]
mov ebx, 0x10
call fcn.00439460
call fcn.00438c40
lea rax, [0x008938e0]
jmp 0x45be20
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x18], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x30], rdx
call fcn.00438be0
lea rax, [0x006b1124]
mov ebx, 7
call fcn.00439460
mov rax, qword [rsp + 0x38]
call fcn.004392e0
lea rax, [0x006b15b1]
mov ebx, 8
call fcn.00439460
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.004392e0
call fcn.00438e20
call fcn.00438c40
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x248]
nop dword [rax + rax]
test rax, rax
jne 0x45bdaa
lea rax, [0x006c0aae]
mov ebx, 0x2e
call fcn.00437240
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.00438be0
lea rax, [0x006b4574]
mov ebx, 0x11
call fcn.00439460
mov eax, dword [rsp + 0x60]
movsxd rax, eax
nop dword [rax]
call fcn.004392e0
lea rax, [0x006b343e]
mov ebx, 0xe
call fcn.00439460
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.004392e0
lea rax, [0x006b06ba]
mov ebx, 3
call fcn.00439460
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.004392e0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006bbe6e]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.0045bc40
Function at 0x45bf00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c0b7
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp ebx, 0xffffffff
je 0x45bf22
lea rcx, [0x008938e0]
nop
jmp 0x45bf36
lea rax, [0x0040b2c0]
add rsp, 0x40
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x45bf54
nop dword [rax + rax]
cmp qword [rcx + 0x128], rax
ja 0x45bf2f
cmp qword [rcx + 0x130], rax
jbe 0x45bf2f
jmp 0x45bf56
xor ecx, ecx
test rcx, rcx
jne 0x45c01c
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebx
nop
nop
nop
lea rax, [0x008cc960]
call fcn.0040b580
mov rbx, qword [0x008cc970]
lea rax, [0x0066a100]
mov ecx, dword [rsp + 0x58]
call fcn.00410560
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
nop
nop
nop
lea rax, [0x008cc960]
call fcn.0040b7a0
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x45c016
call fcn.00438be0
lea rax, [0x006b4585]
mov ebx, 0x11
call fcn.00439460
mov eax, dword [rsp + 0x58]
movsxd rax, eax
call fcn.004392e0
lea rax, [0x006b0dc5]
mov ebx, 6
nop dword [rax]
call fcn.00439460
mov rax, qword [rsp + 0x20]
call fcn.004392e0
lea rax, [0x006b3f3e]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00439460
call fcn.00438c40
lea rax, [0x008938e0]
jmp 0x45c0a0
add rsp, 0x40
pop rbp
ret
mov rax, rcx
nop
call fcn.00451da0
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 0x18], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x28], rdx
call fcn.00438be0
lea rax, [0x006b1124]
mov ebx, 7
call fcn.00439460
mov rax, qword [rsp + 0x30]
call fcn.004392e0
lea rax, [0x006b15b1]
mov ebx, 8
call fcn.00439460
mov rax, qword [rsp + 0x28]
nop
call fcn.004392e0
call fcn.00438e20
call fcn.00438c40
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x248]
nop dword [rax + rax]
test rax, rax
jne 0x45c02b
lea rax, [0x006c0adc]
mov ebx, 0x2e
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0045bf00
Function at 0x460480
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4605bf
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
nop
xor edi, edi
mov esi, 0x12
lea rax, [0x0088c3f0]
mov ebx, 1
xor ecx, ecx
call fcn.00449860
nop dword [rax]
call fcn.004171a0
mov rbx, qword [0x008cbd48]
lea rax, [0x0066a220]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
nop dword [rax]
call fcn.004127e0
mov rdx, qword [rax]
test bl, bl
je 0x46059c
mov qword [rsp + 0x28], rdx
lea rax, [0x00677b00]
nop dword [rax]
call fcn.0040d680
lea rcx, [0x0046ad40]
mov qword [rax], rcx
cmp dword [0x00921500], 0
jne 0x460520
mov rdx, qword [rsp + 0x58]
jmp 0x46052d
call fcn.004665a0
mov rdx, qword [rsp + 0x58]
mov qword [r11], rdx
mov qword [rsp + 0x30], rax
mov qword [rax + 8], rdx
mov rbx, qword [0x008cbd48]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
lea rax, [0x0066a220]
call fcn.00412bc0
mov rdx, qword [rsp + 0x28]
mov qword [rax], rdx
cmp dword [0x00921500], 0
jne 0x46056b
mov rdx, qword [rsp + 0x30]
jmp 0x460580
call fcn.004665c0
mov rdx, qword [rsp + 0x30]
mov qword [r11], rdx
mov rsi, qword [rax + 8]
mov qword [r11 + 8], rsi
mov qword [rax + 8], rdx
nop
nop
lea rax, [0x0088c3f0]
xor ebx, ebx
xor ecx, ecx
call fcn.00449bc0
add rsp, 0x38
pop rbp
ret
xor eax, eax
lea rbx, [0x006bfffe]
mov ecx, 0x2c
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
call fcn.0044f620
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00460480
Function at 0x460740
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46088f
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
lea rax, [0x00921510]
nop
call fcn.00431420
mov qword [rsp + 0x20], rax
test byte [rax], al
lea rcx, [rax + 0x30]
mov qword [rsp + 0x28], rcx
nop
mov rax, rcx
call fcn.0040b580
nop
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x460797
cmp rcx, 1
jne 0x46087d
nop
mov rdx, qword [rax + 0x20]
nop dword [rax]
test rdx, rdx
je 0x4607af
cmp rdx, 1
jne 0x46086c
mov rdx, qword [rsp + 0x40]
mov qword [rax + 8], rdx
mov rsi, qword [rax + 0x10]
nop dword [rax]
test rsi, rsi
jne 0x4607cf
nop
mov esi, 1
xchg qword [rax + 0x10], rsi
mov byte [rax + 0x38], 0
xor ebx, ebx
xor ecx, ecx
call fcn.00430b20
mov rax, qword [rsp + 0x20]
inc qword [rax + 0x40]
nop
xor edx, edx
xchg qword [rax + 0x20], rdx
mov qword [rax + 0x90], 0
inc qword [rax + 0x98]
nop
xor edx, edx
xchg qword [rax + 0x28], rdx
mov qword [rax + 0xe8], 0
mov qword [rax + 0xf0], rax
call fcn.00430ac0
nop
nop
mov rax, qword [rsp + 0x28]
call fcn.0040b7a0
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x20]
call fcn.004315c0
test eax, eax
je 0x46085f
mov dword [rsp + 0x1c], eax
lea rax, [0x00921510]
mov rbx, qword [rsp + 0x20]
call fcn.00430c00
mov ecx, dword [rsp + 0x1c]
movsxd rbx, ecx
xor eax, eax
add rsp, 0x30
pop rbp
ret
mov rax, qword [rsp + 0x20]
xor ebx, ebx
add rsp, 0x30
pop rbp
ret
lea rax, [0x006bdf10]
mov ebx, 0x26
call fcn.00437240
lea rax, [0x006be5a4]
mov ebx, 0x27
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
nop
jmp fcn.00460740

Function at 0x4608c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46093f
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [rax + 0x38], 0
je 0x46092d
nop
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x4608e6
nop
cmp rcx, 1
jne 0x46091c
nop
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x4608f6
cmp rcx, 1
jne 0x46090b
mov rbx, rax
lea rax, [0x00921510]
call fcn.00430c00
add rsp, 0x10
pop rbp
ret
lea rax, [0x006bf1ca]
mov ebx, 0x29
call fcn.00437240
lea rax, [0x006bf6a2]
mov ebx, 0x2a
call fcn.00437240
lea rax, [0x006bcaaf]
mov ebx, 0x23
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.004608c0