joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e5a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e69c
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
nop dword [rax]
test rcx, rcx
je 0x47e666
test dil, dil
je 0x47e5d7
test rcx, 0x60
jne 0x47e653
bt ecx, 9
jae 0x47e5f7
mov rdi, rbx
mov rsi, rcx
mov ebx, 9
mov rcx, rax
lea rax, [0x004dfbac]
call fcn.0047ace0
mov rdx, rcx
and edx, 0x1f
nop dword [rax]
cmp rdx, 0x14
jne 0x47e648
mov qword [rsp + 0x28], rbx
call fcn.0047ed60
test rax, rax
je 0x47e636
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
nop dword [rax]
test rdx, rdx
je 0x47e629
mov rdx, qword [rdx + 8]
mov rbx, qword [rcx + 8]
mov rax, rdx
add rsp, 0x30
pop rbp
ret
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
add rsp, 0x30
pop rbp
ret
call fcn.0047c560
add rsp, 0x30
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509d60]
call fcn.00436480
lea rax, [0x004cf400]
call fcn.0040dfe0
mov qword [rax + 8], 0x17
lea rcx, [0x004e42e6]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x004c8220]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0047e5a0
Function at 0x47e780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e980
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x47e7f5
cmp rcx, 0x11
je 0x47e7eb
cmp rcx, 0x12
jne 0x47e910
cmp qword [rax], 8
jne 0x47e96c
cmp qword [rax + 8], 0
je 0x47e96c
bt edx, 7
jae 0x47e7db
mov rbx, qword [rbx]
mov rax, rbx
nop
call fcn.00460ea0
add rsp, 0x18
pop rbp
ret
mov rax, qword [rax + 0x40]
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x15
jne 0x47e82b
cmp qword [rax], 8
nop
jne 0x47e959
cmp qword [rax + 8], 0
je 0x47e959
bt edx, 7
jae 0x47e81a
mov rbx, qword [rbx]
mov rax, rbx
nop dword [rax]
call fcn.00460fc0
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x16
jne 0x47e900
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax]
cmp rcx, 0x12
ja 0x47e860
cmp rcx, 0x11
jne 0x47e852
mov rdx, qword [rax + 0x30]
jmp 0x47e886
cmp rcx, 0x12
jne 0x47e884
mov rdx, qword [rax + 0x30]
jmp 0x47e886
cmp rcx, 0x15
jne 0x47e86c
mov rdx, qword [rax + 0x38]
jmp 0x47e886
cmp rcx, 0x16
jne 0x47e878
mov rdx, qword [rax + 0x30]
jmp 0x47e886
cmp rcx, 0x17
jne 0x47e884
mov rdx, qword [rax + 0x30]
jmp 0x47e886
xor edx, edx
movzx edx, byte [rdx + 0x17]
and edx, 0x1f
cmp rdx, 0x11
jne 0x47e946
cmp rcx, 0x12
ja 0x47e8b8
nop dword [rax]
cmp rcx, 0x11
jne 0x47e8ac
mov rcx, qword [rax + 0x30]
jmp 0x47e8de
cmp rcx, 0x12
jne 0x47e8dc
mov rcx, qword [rax + 0x30]
jmp 0x47e8de
cmp rcx, 0x15
jne 0x47e8c4
mov rcx, qword [rax + 0x38]
jmp 0x47e8de
cmp rcx, 0x16
jne 0x47e8d0
mov rcx, qword [rax + 0x30]
jmp 0x47e8de
cmp rcx, 0x17
jne 0x47e8dc
mov rcx, qword [rax + 0x30]
jmp 0x47e8de
xor ecx, ecx
movzx edx, byte [rcx + 0x17]
and edx, 0x1f
cmp rdx, 0x11
jne 0x47e8f1
mov rcx, qword [rcx + 0x40]
jmp 0x47e8f3
xor ecx, ecx
mov rax, rcx
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x18
jne 0x47e910
mov rax, qword [rbx + 8]
add rsp, 0x18
pop rbp
ret
lea rax, [0x004cf400]
call fcn.0040dfe0
mov qword [rax + 8], 0x11
lea rcx, [0x004e1db4]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004c8220]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509d70]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509c40]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509c40]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047e780
Function at 0x47e9c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ea59
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp qword [rax + 0x28], 0
je 0x47ea45
mov qword [rsp + 0x28], rax
lea rcx, [rax + 0x18]
mov rax, rcx
call fcn.00460f80
test rax, rax
je 0x47ea2f
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 0x30]
mov rdx, qword [rdx + 0x10]
movzx ebx, byte [rsi + 0x17]
and ebx, 0x1f
test rdx, 0x60
mov edx, 0
mov edi, 0x20
cmovne rdx, rdi
or rbx, rdx
mov rcx, rax
mov rax, rsi
call fcn.0047ecc0
add rsp, 0x18
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509d90]
nop dword [rax]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509d80]
call fcn.00436480
nop
mov qword [rsp + 8], rax
nop
call fcn.00464520
mov rax, qword [rsp + 8]
jmp fcn.0047e9c0

Function at 0x47ea80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47eb19
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp qword [rax + 0x28], 0
je 0x47eb05
mov qword [rsp + 0x28], rax
lea rcx, [rax + 0x18]
mov rax, rcx
call fcn.00460fa0
test rax, rax
je 0x47eaef
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 0x38]
mov rdx, qword [rdx + 0x10]
movzx ebx, byte [rsi + 0x17]
and ebx, 0x1f
test rdx, 0x60
mov edx, 0
mov edi, 0x20
cmovne rdx, rdi
or rbx, rdx
mov rcx, rax
mov rax, rsi
call fcn.0047ecc0
add rsp, 0x18
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509db0]
nop dword [rax]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509da0]
call fcn.00436480
nop
mov qword [rsp + 8], rax
nop
call fcn.00464520
mov rax, qword [rsp + 8]
jmp fcn.0047ea80

Function at 0x47eb40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ec06
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x47ebf0
lea rcx, [rax + 0x18]
mov qword [rsp + 0x18], rcx
cmp qword [rax + 0x28], 0
jne 0x47eb99
mov rsi, qword [rax]
cmp qword [rsi], 8
jne 0x47ebdd
cmp qword [rsi + 8], 0
je 0x47ebdd
mov rdi, qword [rax + 8]
bt edx, 7
jae 0x47eb8c
mov rdi, qword [rdi]
mov rax, rsi
mov rbx, rdi
call fcn.00460f00
jmp 0x47ebb4
mov rax, rcx
nop dword [rax]
call fcn.00460f80
test rax, rax
je 0x47ebca
mov rax, qword [rsp + 0x18]
call fcn.00460f40
mov rax, qword [rsp + 0x18]
call fcn.00460f80
test rax, rax
setne al
add rsp, 0x20
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509dd0]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509c40]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509dc0]
nop
call fcn.00436480
nop
mov qword [rsp + 8], rax
call fcn.00464520
mov rax, qword [rsp + 8]
jmp fcn.0047eb40
Function at 0x47eec0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f066
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop
cmp byte [0x00611aa0], 0
je 0x47ef1a
lea rdx, [0x004c3a40]
mov qword [0x00611aa8], rdx
cmp dword [0x00696870], 0
je 0x47ef13
nop dword [rax]
call fcn.00466460
mov qword [r11], rbx
mov rdx, qword [0x00611ab0]
mov qword [r11 + 8], rdx
mov qword [0x00611ab0], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x18], rcx
nop
cmp rcx, 0x15
ja 0x47ef88
cmp rcx, 0x12
je 0x47efc6
cmp rcx, 0x13
jne 0x47ef80
bt edx, 9
jb 0x47ef72
nop
cmp qword [rax], 8
jne 0x47f04e
cmp qword [rax + 8], 0
je 0x47f04e
bt edx, 7
jae 0x47ef61
mov rbx, qword [rbx]
test rbx, rbx
je 0x47ef69
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
lea rax, [0x0047fc80]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x15
je 0x47efc6
jmp 0x47f005
cmp rcx, 0x16
jne 0x47efb8
cmp qword [rax + 8], 0
jne 0x47efc6
mov rax, qword [rbx]
mov qword [rsp + 0x10], rax
nop dword [rax]
call fcn.00461060
test al, al
je 0x47f03b
mov rax, qword [rsp + 0x10]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x17
je 0x47efe5
nop
cmp rcx, 0x1a
jne 0x47f005
cmp qword [rax], 8
jne 0x47efee
cmp qword [rax + 8], 0
je 0x47efee
bt edx, 7
jae 0x47efdc
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
mov rax, qword [rbx]
add rsp, 0x20
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509c40]
nop dword [rax]
call fcn.00436480
lea rax, [0x004cf400]
call fcn.0040dfe0
mov qword [rax + 8], 0x15
lea rcx, [0x004e35e4]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004c8220]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509de0]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509c40]
nop dword [rax]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047eec0
Function at 0x47f740
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f854
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop dword [rax]
test rcx, rcx
je 0x47f81e
bt ecx, 9
jae 0x47f7e8
movzx edx, byte [rax + 0x17]
and edx, 0x1f
sar rcx, 0xa
nop word [rax + rax]
cmp rdx, 0x14
jne 0x47f7aa
cmp qword [rax + 0x40], rcx
jbe 0x47f80b
mov rdx, qword [rax + 0x38]
mov ebx, dword [rdx + rcx*8 + 4]
nop
call fcn.00462180
mov rbx, rax
lea rax, [0x0050b120]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.00401120
mov rcx, qword [rsp + 0x10]
nop
cmp rbx, rcx
jbe 0x47f7f8
shl rcx, 4
mov ebx, dword [rax + rcx + 4]
nop
mov rax, qword [rsp + 0x18]
call fcn.00462180
mov rbx, rax
lea rax, [0x0050b120]
add rsp, 0x20
pop rbp
ret
mov rbx, rax
lea rax, [0x0050b120]
add rsp, 0x20
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509cd0]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509cd0]
call fcn.00436480
lea rax, [0x004cf400]
call fcn.0040dfe0
mov qword [rax + 8], 0x12
lea rcx, [0x004e232d]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x004c8220]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047f740

Function at 0x47f880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f9e6
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
nop
cmp rcx, 0x15
ja 0x47f90c
cmp rcx, 0x12
je 0x47f94c
cmp rcx, 0x13
jne 0x47f904
bt edx, 9
jb 0x47f8f6
nop
cmp qword [rax], 8
jne 0x47f9d0
cmp qword [rax + 8], 0
je 0x47f9d0
bt edx, 7
nop
jae 0x47f8e5
mov rbx, qword [rbx]
test rbx, rbx
je 0x47f8ed
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
lea rax, [0x0047fc80]
nop
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x15
je 0x47f94c
jmp 0x47f987
cmp rcx, 0x16
jne 0x47f940
cmp qword [rax + 8], 0
jne 0x47f94c
mov qword [rsp + 0x18], rbx
mov rax, qword [rbx]
call fcn.00461060
test al, al
je 0x47f9bd
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x17
je 0x47f96b
cmp rcx, 0x1a
jne 0x47f987
cmp qword [rax], 8
jne 0x47f974
cmp qword [rax + 8], 0
je 0x47f974
bt edx, 7
jae 0x47f962
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
mov rax, qword [rbx]
add rsp, 0x20
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509c40]
call fcn.00436480
lea rax, [0x004cf400]
call fcn.0040dfe0
mov qword [rax + 8], 0x1b
lea rcx, [0x004e5a47]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004c8220]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509df0]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509c40]
nop
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047f880
Function at 0x484440
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48450a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403360
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4844ef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004c3700]
xor ebx, ebx
mov rcx, rdx
call fcn.0044ba80
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00484fe0
inc rbx
cmp rcx, rbx
jae 0x4844de
mov edi, 1
lea rsi, [0x004c3700]
call fcn.0044bb60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00509f88]
lea rsi, [0x00509708]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00484440

Function at 0x489c60
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x489dee
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rax
lea rdi, [0x004e89ca]
mov esi, 0x27
call fcn.0048a4e0
mov rdx, qword [rsp + 0x70]
bt rdx, 0x3f
jae 0x489de5
mov rdx, qword [rsp + 0x78]
test rdx, rdx
jge 0x489cc2
neg rdx
mov ecx, 0x2d
nop
jmp 0x489cc7
mov ecx, 0x2b
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x80], rax
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
mov word [rsp + 0x40], 0x6d20
mov byte [rsp + 0x42], 0x3d
mov byte [rsp + 0x43], cl
mov r8, rdx
shr rdx, 1
movabs rax, 0x89705f4136b4a598
mul rdx
mov rdi, rdx
shr rdi, 0x1c
imul r9, rdi, 0x3b9aca00
shr rdx, 0x1d
movabs rax, 0x89705f4136b4a598
mul rdx
shr rdx, 0x1c
imul r10, rdx, 0x3b9aca00
sub r8, r9
mov qword [rsp + 0x60], r8
sub rdi, r10
test rdx, rdx
jne 0x489d50
mov eax, 0x18
mov edx, 4
xor esi, esi
lea r9, [rsp + 0x40]
jmp 0x489d81
mov qword [rsp + 0x68], rdi
lea rax, [rsp + 0x40]
mov ebx, 4
mov ecx, 0x18
mov rdi, rdx
xor esi, esi
call fcn.00489720
mov rdi, qword [rsp + 0x68]
mov rdx, rbx
mov esi, 9
mov r9, rax
mov rax, rcx
mov rbx, rdx
mov rcx, rax
mov rax, r9
call fcn.00489720
inc rbx
cmp rcx, rbx
jae 0x489da8
mov edi, 1
lea rsi, [0x004c3680]
call fcn.0044bb60
mov byte [rbx + rax - 1], 0x2e
mov rdi, qword [rsp + 0x60]
mov esi, 9
call fcn.00489720
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044fbc0
mov rcx, qword [rsp + 0x58]
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, qword [rsp + 0x80]
nop
call fcn.0044f840
add rsp, 0x88
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00489c60
Function at 0x4929a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492a90
push rbp
mov rbp, rsp
sub rsp, 0x20
jmp 0x4929b7
mov rax, rbx
mov rcx, qword [rax]
bt ecx, 0
nop
jb 0x492a02
mov rdx, rcx
or rcx, 1
add rcx, 8
test rcx, 0x7ffff8
je 0x492a7c
movabs rsi, 0x80000000007fffff
and rcx, rsi
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x4929b4
mov qword [rsp + 0x18], rbx
nop
jmp 0x492a29
xor eax, eax
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 8]
call fcn.00462480
mov rdx, qword [rsp + 0x10]
add rdx, 0xffffffffff800000
mov rbx, qword [rsp + 0x18]
movabs rcx, 0x7ffff800000
test rdx, rcx
jne 0x492a0a
jmp 0x492a62
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 0xc]
call fcn.00462480
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xfffff80000000000
add rcx, rdx
mov rbx, qword [rsp + 0x18]
mov rdx, rcx
movabs rcx, 0x7ffff80000000000
test rdx, rcx
jne 0x492a3a
mov eax, 1
add rsp, 0x20
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509ba0]
call fcn.00436480
nop
mov qword [rsp + 8], rax
call fcn.00464520
mov rax, qword [rsp + 8]
nop
jmp fcn.004929a0

Function at 0x492ac0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492bdc
push rbp
mov rbp, rsp
sub rsp, 0x30
test bl, bl
je 0x492af2
test byte [rax], al
lea rcx, [rax + 8]
mov edx, 2
mov ebx, 0x800000
movabs rsi, 0x7ffff800000
jmp 0x492b11
test byte [rax], al
lea rcx, [rax + 0xc]
mov edx, 4
movabs rbx, 0x80000000000
movabs rsi, 0x7ffff80000000000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdx
jmp 0x492b2f
mov rax, r9
mov rdi, qword [rax]
bt edi, 0
jb 0x492bad
test rdi, rdx
jne 0x492b52
mov r8, rdi
or rdi, rdx
add rdi, 8
test rdi, 0x7ffff8
jne 0x492b64
jmp 0x492bc8
lea r8, [rbx + rdi]
test rsi, r8
je 0x492bb5
mov r9, r8
mov r8, rdi
mov rdi, r9
mov r9, rax
mov rax, r8
lock cmpxchg qword [r9], rdi
sete dil
test dil, dil
je 0x492b2c
test r8, rdx
je 0x492ba2
mov rax, rcx
call fcn.004623a0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov r9, qword [rsp + 0x40]
nop
jmp 0x492b2c
mov eax, 1
add rsp, 0x30
pop rbp
ret
xor eax, eax
add rsp, 0x30
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509ba0]
call fcn.00436480
lea rax, [0x004c3600]
lea rbx, [0x00509ba0]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00464520
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00492ac0
Function at 0x4958c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x495aed
push rbp
mov rbp, rsp
sub rsp, 0x78
movups xmmword [rsp + 0x68], xmm15
mov byte [rsp + 0x1f], 0
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x28], xmm15
cmp byte [rax + 0x220], 3
je 0x4958f7
jmp 0x495930
mov qword [rsp + 0x20], 0
lea rdx, [0x00509f88]
mov qword [rsp + 0x28], rdx
lea rdx, [0x00509858]
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
add rsp, 0x78
pop rbp
ret
mov rax, rdi
mov rdx, qword [rax]
bt edx, 0
jb 0x49596b
lea rsi, [rdx + 8]
nop dword [rax]
test rsi, 0x7ffff8
je 0x495abf
mov rdi, rax
mov rax, rdx
lock cmpxchg qword [rdi], rsi
sete sil
nop dword [rax]
test sil, sil
je 0x49592d
bt edx, 0
jmp 0x49596e
mov rdi, rax
jae 0x495999
cmp byte [rdi + 0x21f], 0
je 0x495989
mov rdx, qword [0x00601f50]
mov rsi, qword [0x00601f58]
jmp 0x4959a0
lea rdx, [0x0050a068]
lea rsi, [0x00696600]
jmp 0x4959a0
xor edx, edx
xor esi, esi
nop dword [rax]
test rdx, rdx
jne 0x495a9b
movups xmmword [rsp + 0x58], xmm15
lea rdx, [0x00495b80]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdi
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x68], rdx
mov byte [rsp + 0x1f], 1
lea rdx, [rdi + 0x1c0]
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdi + 0x1c0], esi
sete sil
test sil, sil
jne 0x495a2a
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x38], rdx
mov rax, rdx
call fcn.0046dac0
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x40]
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00495b20]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x1f], 3
mov rax, qword [rdi + 0x10]
call fcn.00484f40
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 1
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx]
call rsi
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx]
call rsi
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x20]
mov rbx, rdx
mov rcx, rsi
add rsp, 0x78
pop rbp
ret
lea rax, [0x004c3600]
lea rbx, [0x00509ba0]
call fcn.00436480
nop
call fcn.00436160
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004958c0
Function at 0x496c60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x496e5f
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
test rdi, rdi
je 0x496e15
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
cmp qword [0x00601d00], rdi
je 0x496cb0
xor edx, edx
jmp 0x496ce0
mov rcx, qword [0x00601d08]
mov rax, rdi
mov rbx, rsi
nop dword [rax]
call fcn.00404aa0
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov edx, eax
mov rax, qword [rsp + 0x48]
test dl, dl
jne 0x496e15
cmp qword [0x00601f50], rdi
jne 0x496d32
mov rcx, qword [0x00601f58]
mov rax, rdi
mov rbx, rsi
nop
call fcn.00404aa0
test al, al
je 0x496d19
mov rdi, qword [0x006116e0]
mov rsi, qword [0x006116e8]
jmp 0x496d78
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
cmp byte [0x00696608], 0
je 0x496d78
mov rcx, qword [0x00601f50]
mov rdx, qword [0x00601f58]
mov rax, rdi
mov rbx, rsi
mov rdi, rdx
call fcn.0046c620
test al, al
jne 0x496e21
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
lea rax, [0x004d08a0]
call fcn.0040dfe0
mov rcx, qword [rsp + 0x58]
mov qword [rax + 8], rcx
cmp dword [0x00696870], 0
nop
jne 0x496da9
mov rcx, qword [rsp + 0x50]
jmp 0x496db6
call fcn.00466440
mov rcx, qword [rsp + 0x50]
mov qword [r11], rcx
mov qword [rax], rcx
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x230]
mov rcx, qword [rcx + 0x228]
mov qword [rax + 0x18], rdx
cmp dword [0x00696870], 0
jne 0x496de3
mov rdx, qword [rsp + 0x30]
jmp 0x496df4
call fcn.00466460
mov qword [r11], rcx
mov rdx, qword [rsp + 0x30]
mov qword [r11 + 8], rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rdx
mov rbx, rax
lea rax, [0x00509f68]
add rsp, 0x38
pop rbp
ret
mov rax, rdi
mov rbx, rsi
add rsp, 0x38
pop rbp
ret
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x68]
call rcx
mov ecx, 0x2f
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x004e9c25]
call fcn.0044f840
call fcn.0040b0c0
mov rbx, rax
lea rax, [0x004c3600]
call fcn.00436480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00496c60