joyce8/EMBER2024-capa huggingface dataset:
Function at 0x640da0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x640f0a
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rax
mov rdx, qword [rax + 0x20]
cmp rdx, 1
je 0x640e45
cmp rdx, 2
jne 0x640e0a
test rdi, rdi
je 0x640df4
nop
call fcn.00641e20
test rax, rax
je 0x640df9
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.00640980
mov rax, qword [rsp + 0x70]
nop
call fcn.00640a60
jmp 0x640ed5
cmp rdx, 6
jne 0x640ef6
test rdi, rdi
je 0x640e2f
call fcn.00641520
nop
test rax, rax
je 0x640e34
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.00640980
mov rax, qword [rsp + 0x70]
call fcn.00640a60
nop
jmp 0x640ed5
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rcx
nop
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x40], rcx
nop
call fcn.00640c00
mov r9, qword [rsp + 0x48]
test r9, r9
je 0x640ed5
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x10]
mov r11, qword [rax]
mov rcx, qword [rax + 0x18]
lea r12, [rcx - 1]
cmp rdx, r12
jb 0x640eee
mov r13, qword [rsp + 0x40]
lea r15, [r13 - 1]
cmp r12, r15
jb 0x640ee3
sub rcx, r13
sub rdx, r13
lea rdi, [rdx + 1]
mov rdx, rdi
neg rdi
sar rdi, 0x3f
and r15, rdi
lea rbx, [r11 + r15]
mov rdi, rdx
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
xor r10d, r10d
call fcn.00643c40
test rax, rax
je 0x640ed5
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, r15
mov rcx, r12
call fcn.00465f80
mov rcx, r12
call fcn.00465f40
lea rax, [0x006bb4c0]
lea rbx, [0x007f0980]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00640da0

Function at 0x640f40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x640fdd
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rax + 0x20]
nop dword [rax]
cmp rcx, 1
je 0x640f88
cmp rcx, 2
je 0x640f72
cmp rcx, 6
jne 0x640fc9
mov qword [rsp + 0x20], rax
call fcn.00640980
mov rax, qword [rsp + 0x20]
call fcn.00640a60
jmp 0x640fa7
call fcn.006464a0
test rax, rax
je 0x640fbf
cmp dword [rax + 0x10], 0x778cdb8
jne 0x640fa7
lea rcx, [0x006bb4c0]
cmp rax, rcx
je 0x640fbf
lea rax, [0x006cdcc0]
lea rbx, [0x00a04c58]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0980]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00640f40
Function at 0x645fc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x646067
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rax + 0x20]
nop dword [rax]
cmp rcx, 1
je 0x646044
mov qword [rsp + 0x38], rax
cmp rcx, 2
je 0x646022
cmp rcx, 6
jne 0x646053
call fcn.00646080
nop dword [rax]
call fcn.0040b1a0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x38]
call fcn.00640a60
lea rax, [0x006b76a0]
mov rbx, qword [rsp + 0x20]
jmp 0x646049
call fcn.00646240
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
call fcn.00640a60
lea rax, [0x006cc900]
mov rbx, qword [rsp + 0x18]
jmp 0x646049
call fcn.006464a0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0980]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00645fc0

Function at 0x646080
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x646218
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x90], rax
xor ebx, ebx
mov rcx, rbx
lea rax, [0x006c4820]
call fcn.0044a940
xor ecx, ecx
xor edx, edx
jmp 0x6460d1
mov rax, rsi
mov rbx, rcx
mov rcx, rdx
mov rdx, rbx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov ebx, 9
mov rax, qword [rsp + 0x90]
call fcn.00640b00
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x20], 8
nop
je 0x6461dc
call fcn.00645fc0
mov rcx, qword [rsp + 0x40]
inc rcx
mov rdx, qword [rsp + 0x48]
cmp rdx, rcx
jb 0x646124
mov rsi, qword [rsp + 0x60]
jmp 0x64615d
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x60]
mov rbx, rcx
mov rcx, rdx
mov edi, 1
lea rsi, [0x006c4820]
call fcn.0044aa20
mov rsi, rax
mov rdx, rcx
mov rax, qword [rsp + 0x70]
mov rcx, rbx
mov rbx, qword [rsp + 0x78]
lea r8, [rcx - 1]
shl r8, 4
mov qword [rsi + r8], rax
lea rdi, [rsi + r8]
lea rdi, [rdi + 8]
cmp dword [0x00a04ed0], 0
jne 0x646182
mov qword [rsi + r8 + 8], rbx
nop
jmp 0x646187
call fcn.00465b60
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x20], 9
jne 0x6461c6
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
mov ebx, 9
call fcn.00640b00
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rax + 0x20]
cmp rdi, 8
je 0x6461eb
cmp rdi, 7
je 0x6460c5
jmp 0x646204
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
mov rax, rsi
mov rbx, rcx
mov rcx, rdx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0980]
call fcn.00436580
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00646080
Function at 0x646240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x646472
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x68], rax
nop dword [rax]
call fcn.0040e5e0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov ebx, 9
call fcn.00640b00
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x20]
cmp rcx, 5
je 0x646402
cmp rcx, 1
jne 0x64645e
nop
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rcx
call fcn.00640c00
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x18]
lea rdi, [rsi - 1]
nop dword [rax]
cmp rdx, rdi
jb 0x646456
mov rax, qword [rsp + 0x30]
lea r8, [rax - 1]
cmp rdi, r8
jb 0x64644b
sub rdx, rax
lea rcx, [rdx + 1]
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
sub rsi, rax
lea rax, [rbx + r8]
nop
mov rbx, rsi
mov rcx, rdx
nop dword [rax]
call fcn.00646740
mov byte [rsp + 0x27], dil
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044ec00
movzx edx, byte [rsp + 0x27]
nop dword [rax]
test dl, dl
je 0x646438
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x68]
cmp qword [rcx + 0x20], 9
jne 0x64635a
mov rax, rcx
mov ebx, 9
call fcn.00640b00
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x28]
cmp qword [rcx + 0x20], 3
nop
jne 0x646425
mov rax, rcx
mov ebx, 9
call fcn.00640b00
mov rax, qword [rsp + 0x68]
call fcn.00645fc0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
lea rax, [0x006cc900]
mov rbx, qword [rsp + 0x40]
nop dword [rax]
call fcn.00413320
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
cmp dword [0x00a04ed0], 0
jne 0x6463c2
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
nop
jmp 0x6463d0
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x48]
call fcn.00465b20
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x20], 9
jne 0x6463eb
mov ebx, 9
call fcn.00640b00
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x20]
cmp rcx, 5
je 0x646402
cmp rcx, 4
je 0x64626a
nop
jmp 0x646411
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0980]
nop
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0980]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0980]
call fcn.00436580
mov rax, r8
mov rcx, rdi
call fcn.00465f80
mov rcx, rdi
call fcn.00465f40
lea rax, [0x006bb4c0]
lea rbx, [0x007f0980]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00646240
Function at 0x6464a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x646699
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rcx
call fcn.00640c00
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x18]
lea rdi, [rsi - 1]
nop
cmp rdx, rdi
jb 0x646690
mov rax, qword [rsp + 0x20]
lea r8, [rax - 1]
cmp rdi, r8
jb 0x646685
sub rsi, rax
sub rdx, rax
inc rdx
mov rdi, rdx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rax, [rbx + r8]
test rsi, rsi
jbe 0x646679
movzx edx, byte [rbx + r8]
cmp dl, 0x66
ja 0x646581
cmp dl, 0x22
je 0x646537
cmp dl, 0x66
je 0x64658f
jmp 0x6465b4
nop
mov rbx, rsi
mov rcx, rdi
nop
call fcn.00646740
mov byte [rsp + 0x1f], dil
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044ec00
movzx edx, byte [rsp + 0x1f]
nop dword [rax]
test dl, dl
je 0x646666
call fcn.0040b100
mov rbx, rax
lea rax, [0x006bb4c0]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp dl, 0x6e
je 0x646645
cmp dl, 0x74
jne 0x6465b4
cmp dl, 0x74
sete cl
movzx ecx, cl
lea rdx, [0x00984980]
lea rbx, [rdx + rcx*8]
lea rax, [0x006b9200]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp dl, 0x2d
je 0x6465c9
add edx, 0xffffffd0
nop dword [rax]
cmp dl, 9
ja 0x646653
mov rbx, rax
mov rcx, rsi
xor eax, eax
call fcn.0044ec00
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x48]
call fcn.00643aa0
test rcx, rcx
je 0x64663b
nop
mov rdx, qword [rsp + 0x48]
cmp qword [rdx + 0x70], 0
jne 0x64663b
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov rax, rdx
mov rbx, rcx
mov rcx, rdi
call fcn.00640840
mov rdi, qword [rsp + 0x48]
mov qword [rdi + 0x70], rax
cmp dword [0x00a04ed0], 0
jne 0x646628
mov qword [rdi + 0x78], rbx
jmp 0x646631
add rdi, 0x78
call fcn.00465b60
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0980]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0980]
call fcn.00436580
xor eax, eax
mov rcx, rax
nop
call fcn.00465ec0
mov rax, r8
mov rcx, rdi
call fcn.00465f80
mov rcx, rdi
call fcn.00465f40
nop
mov qword [rsp + 8], rax
nop
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.006464a0
Function at 0x647800
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6478df
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x009b0420]
nop
call fcn.0047dba0
test rax, rax
je 0x64787a
lea rdx, [0x0070eaa0]
cmp rax, rdx
jne 0x6478cf
mov qword [rbx + 8], 0
mov qword [rbx + 0x18], 0
mov byte [rbx + 0x20], 0
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x64785c
mov rcx, qword [rcx]
jmp 0x647860
xor ecx, ecx
nop
test rcx, rcx
jg 0x6478bc
mov qword [rbx + 0x68], 0
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0040e5e0
mov qword [rsp + 0x18], rax
lea rax, [0x006f7280]
call fcn.0040daa0
cmp dword [0x00a04ed0], 0
jne 0x6478a4
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x70], rcx
jmp 0x6478b2
lea rdi, [rax + 0x70]
mov rcx, qword [rsp + 0x18]
call fcn.00465b20
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0990]
call fcn.00436580
mov rbx, rdx
lea rcx, [0x006c4820]
call fcn.0040acc0
nop
nop
call fcn.00463860
jmp fcn.00647800
Function at 0x650340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6504aa
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
cmp bl, 0x20
ja 0x650380
je 0x65036f
nop
cmp bl, 9
je 0x65036f
cmp bl, 0xd
je 0x65036f
cmp bl, 0xa
jne 0x650380
mov eax, 9
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
cmp bl, 0x22
jne 0x6503ba
test byte [rax], al
cmp dword [0x00a04ed0], 0
jne 0x65039c
lea rcx, [0x0079ca00]
mov qword [rax], rcx
jmp 0x6503ab
mov rdi, rax
lea rcx, [0x0079ca00]
call fcn.00465b20
mov eax, 1
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 0x70], rax
test byte [rax], al
cmp dword [0x00a04ed0], 0
jne 0x6503d6
lea rcx, [0x0079c9a8]
mov qword [rax], rcx
jmp 0x6503e5
mov rdi, rax
lea rcx, [0x0079c9a8]
call fcn.00465b20
mov eax, ebx
call fcn.00652aa0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x006e1b40]
nop dword [rax]
call fcn.0040daa0
mov qword [rsp + 0x50], rax
lea rbx, [0x0071f079]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x007f0498]
mov r9d, 1
lea r10, [0x0072b8bc]
mov r11d, 0x2a
xor eax, eax
nop dword [rax]
call fcn.0044e9e0
mov rdi, qword [rsp + 0x50]
mov qword [rdi + 8], rbx
cmp dword [0x00a04ed0], 0
jne 0x650460
mov qword [rdi], rax
jmp 0x650465
call fcn.00465a20
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x38]
mov qword [rdi + 0x10], rdx
lea rdx, [0x007f1b60]
mov qword [rcx + 0x28], rdx
cmp dword [0x00a04ed0], 0
jne 0x65048c
mov qword [rcx + 0x30], rdi
jmp 0x65049b
add rcx, 0x30
mov rax, rdi
mov rdi, rcx
call fcn.00465a20
mov eax, 0xb
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00463860
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00650340
Function at 0x673a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x673ac6
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
nop
call fcn.0049b480
nop
test rdi, rdi
jne 0x673aaf
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0c10]
nop dword [rax]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00673a80
Function at 0x685200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6852fe
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rcx, qword [rax]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x68523c
lea rax, [0x007f7248]
jmp 0x685240
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x38], rax
mov rdx, qword [rax + 0x98]
mov rax, rcx
call rdx
nop word [rax + rax]
nop
cmp rax, 0x16
jne 0x6852ea
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x50]
call rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rax + 0xe8]
mov rax, rbx
call rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0xb8]
mov rax, qword [rsp + 0x58]
call rdx
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007197db]
mov esi, 1
mov r8, rax
mov r9, rbx
xor eax, eax
mov rbx, qword [rsp + 0x60]
call fcn.0044e900
mov rcx, rax
mov rdi, rbx
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0a90]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00685200
Function at 0x686a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x686b19
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x00727623]
mov ebx, 0x21
xor ecx, ecx
xor edi, edi
call fcn.004be360
lea rax, [0x007294bb]
mov ebx, 0x25
xor ecx, ecx
xor edi, edi
nop dword [rax]
call fcn.004be360
lea rax, [0x007286cd]
mov ebx, 0x23
lea rcx, [0x007eeb48]
mov edi, 1
nop dword [rax]
call fcn.004be360
lea rax, [0x00727f75]
mov ebx, 0x22
xor ecx, ecx
xor edi, edi
call fcn.004be360
lea rax, [0x0072300e]
mov ebx, 0x19
xor ecx, ecx
xor edi, edi
call fcn.004be360
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00463860
nop
jmp fcn.00686a80

Function at 0x6872a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x68730b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
call fcn.00687ee0
nop
test rdi, rdi
jne 0x6872f7
lea rdi, [0x0072a4e7]
mov esi, 0x27
call fcn.006881c0
test rcx, rcx
je 0x6872e9
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
xor eax, eax
xor ebx, ebx
mov rcx, rdi
mov rdi, rsi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.006872a0
Function at 0x687600
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x6877cf
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov byte [rsp + 0x90], al
xor ecx, ecx
jmp 0x687641
mov rcx, qword [rsp + 0x38]
inc rcx
movzx eax, byte [rsp + 0x90]
cmp rcx, 4
jge 0x6876b5
test al, al
je 0x687654
lea rdx, [rcx - 3]
neg rdx
jmp 0x687660
mov rdx, rcx
nop word [rax + rax]
cmp rdx, 4
jae 0x6877c1
mov qword [rsp + 0x38], rcx
shl rdx, 4
mov qword [rsp + 0x50], rdx
lea r8, [0x009a8740]
mov rdi, qword [rdx + r8]
mov rsi, qword [rdx + r8 + 8]
xor eax, eax
lea rbx, [0x0072b718]
mov ecx, 0x2a
call fcn.0044e860
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rbx
mov word [rsp + 0x2e], 0
mov byte [rsp + 0x2e], 1
xor ecx, ecx
jmp 0x6876eb
mov rdi, qword [0x009af320]
mov rsi, qword [0x009af328]
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rcx, qword [rsp + 0x48]
inc rcx
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x30]
cmp rcx, 2
jge 0x687631
mov qword [rsp + 0x48], rcx
movzx edx, byte [rsp + rcx + 0x2e]
mov ecx, edx
call fcn.00687800
mov rdx, qword [0x009af328]
cmp qword [0x009af320], rdi
jne 0x687760
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x70], rax
mov rax, rdi
mov rbx, rsi
mov rcx, rdx
call fcn.00403fe0
nop dword [rax]
test al, al
jne 0x6876d9
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
nop dword [rax]
test rdi, rdi
jne 0x6877aa
mov rdx, qword [rsp + 0x50]
lea r8, [0x009a8700]
mov r9, qword [r8 + rdx]
mov rdx, qword [r8 + rdx + 8]
mov qword [rcx + 0x28], rdx
cmp dword [0x00a04ed0], 0
jne 0x68778d
mov qword [rcx + 0x20], r9
jmp 0x687796
lea rdi, [rcx + 0x20]
call fcn.00465bc0
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
nop
ret
mov rax, rdx
mov ecx, 4
call fcn.00465ec0
nop
mov byte [rsp + 8], al
call fcn.00463860
movzx eax, byte [rsp + 8]
nop dword [rax]
jmp fcn.00687600
Function at 0x68a3a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x68a49e
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rcx, qword [rax]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x68a3dc
lea rax, [0x007f7248]
jmp 0x68a3e0
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x38], rax
mov rdx, qword [rax + 0x98]
mov rax, rcx
call rdx
nop word [rax + rax]
nop
cmp rax, 0x16
jne 0x68a48a
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x50]
call rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rax + 0xe8]
mov rax, rbx
call rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0xb8]
mov rax, qword [rsp + 0x58]
call rdx
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007197db]
mov esi, 1
mov r8, rax
mov r9, rbx
xor eax, eax
mov rbx, qword [rsp + 0x60]
call fcn.0044e900
mov rcx, rax
mov rdi, rbx
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0a90]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.0068a3a0
Function at 0x68acc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x68adbe
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rcx, qword [rax]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x68acfc
lea rax, [0x007f7248]
jmp 0x68ad00
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x38], rax
mov rdx, qword [rax + 0x98]
mov rax, rcx
call rdx
nop word [rax + rax]
nop
cmp rax, 0x16
jne 0x68adaa
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x50]
call rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rax + 0xe8]
mov rax, rbx
call rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0xb8]
mov rax, qword [rsp + 0x58]
call rdx
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007197db]
mov esi, 1
mov r8, rax
mov r9, rbx
xor eax, eax
mov rbx, qword [rsp + 0x60]
call fcn.0044e900
mov rcx, rax
mov rdi, rbx
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0a90]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.0068acc0
Function at 0x68b700
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x68b7fe
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rcx, qword [rax]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x68b73c
lea rax, [0x007f7248]
jmp 0x68b740
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x38], rax
mov rdx, qword [rax + 0x98]
mov rax, rcx
call rdx
nop word [rax + rax]
nop
cmp rax, 0x16
jne 0x68b7ea
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x50]
call rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rax + 0xe8]
mov rax, rbx
call rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0xb8]
mov rax, qword [rsp + 0x58]
call rdx
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007197db]
mov esi, 1
mov r8, rax
mov r9, rbx
xor eax, eax
mov rbx, qword [rsp + 0x60]
call fcn.0044e900
mov rcx, rax
mov rdi, rbx
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f0a90]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.0068b700

Function at 0x68f320
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x68f3cf
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
lea rax, [0x006d08e0]
call fcn.0040daa0
mov qword [rsp + 0x38], rax
mov ebx, 0x26
lea rax, [0x0072a364]
call fcn.00692880
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rdx
lea rax, [0x006bdce0]
nop
call fcn.0040daa0
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov rcx, qword [rcx]
mov rbx, rax
mov edi, 3
mov rax, rcx
mov rcx, rdi
call fcn.006918e0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
nop
jmp fcn.0068f320