joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ae20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44b006
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [0x0098c210], 0x2a
mov qword [0x0098c218], 0
xor eax, eax
lea rcx, [0x0098c210]
mov edx, 1
lock cmpxchg qword [rcx], rdx
sete sil
nop
test sil, sil
jne 0x44afef
cmp qword [0x0098c218], 0
jne 0x44afde
mov qword [0x0098c218], 0x2a
mov eax, 0x2a
lock cmpxchg qword [rcx], rdx
sete dl
test dl, dl
je 0x44afcd
cmp qword [0x0098c218], 0x2a
nop
jne 0x44afbc
cmp qword [0x0098c210], 1
jne 0x44afbc
mov rdx, qword [0x0098c210]
nop dword [rax + rax]
cmp rdx, 1
jne 0x44afab
movabs rdx, 0x10000000001
xchg qword [rcx], rdx
mov rdx, qword [0x0098c210]
movabs rsi, 0x10000000001
cmp rdx, rsi
jne 0x44af9a
movabs rdx, 0x10000000001
lock xadd qword [rcx], rdx
movabs rsi, 0x10000000001
add rdx, rsi
movabs rsi, 0x20000000002
cmp rsi, rdx
jne 0x44af89
mov rdx, qword [0x0098c210]
cmp rdx, rsi
jne 0x44af78
movabs rdx, 0x30000000003
xchg qword [rcx], rdx
cmp rdx, rsi
jne 0x44af67
mov rcx, qword [0x0098c210]
movabs rdx, 0x30000000003
cmp rcx, rdx
jne 0x44af56
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d338b]
mov ebx, 0xd
call fcn.00439560
lea rax, [0x006d338b]
mov ebx, 0xd
call fcn.00439560
lea rax, [0x006d337e]
mov ebx, 0xd
call fcn.00439560
lea rax, [0x006d337e]
mov ebx, 0xd
call fcn.00439560
lea rax, [0x006d3905]
mov ebx, 0xe
call fcn.00439560
lea rax, [0x006d3371]
mov ebx, 0xd
call fcn.00439560
lea rax, [0x006d2df0]
mov ebx, 0xc
call fcn.00439560
lea rax, [0x006d2df0]
mov ebx, 0xc
call fcn.00439560
lea rax, [0x006d2df0]
mov ebx, 0xc
call fcn.00439560
lea rax, [0x006d2df0]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00439560
nop
call fcn.0046a260
jmp fcn.0044ae20

Function at 0x44bcc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44bd78
push rbp
mov rbp, rsp
sub rsp, 0x10
mov ecx, 0xffffffff
lock xadd dword [rax + 0x28], ecx
dec ecx
nop
test ecx, ecx
jge 0x44bd36
cmp ecx, 0xffffffff
je 0x44bd66
cmp ecx, 0xbfffffff
je 0x44bd66
mov ecx, 0xffffffff
lock xadd dword [rax + 0x2c], ecx
dec ecx
nop dword [rax]
test ecx, ecx
jne 0x44bd36
mov qword [rsp + 0x20], rax
nop
nop
call fcn.0040c840
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x44bd2f
lea rax, [rcx + 0x110]
call fcn.0040cba0
mov rax, qword [rsp + 0x20]
nop
nop
call fcn.0040caa0
mov rax, qword [r14 + 0x30]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x44bd60
cmp byte [r14 + 0xb1], 0
je 0x44bd60
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x10
pop rbp
ret
lea rax, [0x006da782]
mov ebx, 0x1b
call fcn.00439560
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.0046a260
mov rax, qword [rsp + 8]
jmp fcn.0044bcc0
Function at 0x44f500
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44f636
push rbp
mov rbp, rsp
sub rsp, 0x48
cmp rcx, rbx
jae 0x44f55d
mov rdx, qword [rax]
mov qword [rsp + 0x30], rdx
mov rsi, rax
mov rax, rbx
mul rdx
jo 0x44f621
movabs rdx, 0x1000000000000
nop dword [rax + rax]
cmp rax, rdx
ja 0x44f621
test rbx, rbx
jl 0x44f621
mov rdx, qword [rsp + 0x30]
imul rcx, rdx
jmp 0x44f56a
mov rcx, qword [rax]
imul rcx, rbx
mov rsi, rax
mov rax, rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x28], rcx
cmp qword [rsi + 8], 0
jne 0x44f5b8
mov qword [rsp + 0x20], rax
xor ebx, ebx
xor ecx, ecx
call fcn.0040e080
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
cmp rcx, rbx
jae 0x44f607
mov qword [rsp + 0x38], rax
sub rbx, rcx
lea rdx, [rax + rcx]
mov rax, rdx
call fcn.0046cc00
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
jmp 0x44f607
mov qword [rsp + 0x40], rsi
mov rbx, rsi
mov ecx, 1
call fcn.0040e080
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x44f607
cmp byte [0x0098c4d0], 0
je 0x44f607
mov qword [rsp + 0x38], rax
mov rdx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, rbx
mov rdi, qword [rsp + 0x40]
mov rax, rdx
mov rbx, rsi
call fcn.00416460
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x70]
call fcn.0046cf00
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbp
ret
nop
lea rax, [0x0068b540]
lea rbx, [0x00756dc0]
call fcn.004389a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044f500

Function at 0x44f680
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44f71f
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rsi, rax
mov rax, rdx
mov rdi, rax
mul rcx
jo 0x44f713
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x44f6cf
test rbx, rbx
jl 0x44f6cf
cmp rcx, rbx
jl 0x44f6cf
mov rbx, rsi
mov ecx, 1
call fcn.0040e080
add rsp, 0x18
pop rbp
ret
mov rax, rdi
mul rbx
jno 0x44f6eb
nop
lea rax, [0x0068b540]
lea rbx, [0x00756dc0]
call fcn.004389a0
movabs rcx, 0x1000000000000
cmp rax, rcx
ja 0x44f6d7
test rbx, rbx
jl 0x44f6d7
nop
lea rax, [0x0068b540]
lea rbx, [0x00756dd0]
call fcn.004389a0
movabs rdx, 0x1000000000000
jmp 0x44f6cf
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0044f680
Function at 0x452420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45258a
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [rax], 0
je 0x452578
nop
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x452472
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
cmp rax, rdx
jne 0x452567
mov rsi, r14
cmp rsi, rdx
je 0x452567
cmp ecx, 2
jne 0x452567
cmp qword [rax + 0x70], 0
jne 0x452494
cmp byte [rax + 0xb4], 0
je 0x452486
xor ecx, ecx
jmp 0x452496
nop
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x452496
xor ecx, ecx
test cl, cl
je 0x452556
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x4524bd
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x3f0], 0
jne 0x452545
cmp dword [0x0098c8dc], 0
jg 0x45253f
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x128]
mov rax, rcx
call fcn.00456080
test rax, rax
je 0x4524eb
cmp byte [rax + 0x28], 7
jne 0x4524eb
add rsp, 0x10
pop rbp
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rdx, rcx
mov rcx, rdx
shr rdx, 1
cmp rdx, 0x2000
jb 0x452539
mov rsi, qword [rax + 0x38]
sub rbx, rsi
lea rsi, [rbx + 0x320]
shr rcx, 2
nop
cmp rcx, rsi
ja 0x45252b
add rsp, 0x10
pop rbp
ret
mov rbx, rdx
call fcn.00451320
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d9cc5]
mov ebx, 0x1a
call fcn.00439560
lea rax, [0x006d7eed]
mov ebx, 0x17
call fcn.00439560
lea rax, [0x006d926f]
mov ebx, 0x19
call fcn.00439560
lea rax, [0x006db0b9]
mov ebx, 0x1c
call fcn.00439560
nop
mov qword [rsp + 8], rax
call fcn.0046a260
mov rax, qword [rsp + 8]
jmp fcn.00452420
Function at 0x4532c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4534a7
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x78], rbx
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x4532fa
add r10, 0x10
lea r11, [rbx + 1]
mov rbx, r10
mov r9, r8
mov r8, rsi
mov rsi, r11
cmp rcx, rsi
jle 0x453331
mov r10, rbx
mov r11, qword [rbx + 8]
test r11, r11
jne 0x453316
mov rbx, rsi
mov rsi, r8
mov r8, r9
jmp 0x4532e6
lea r8, [r9 + r11]
nop word [rax + rax]
cmp r9, r8
jg 0x453495
inc rdi
mov rbx, rsi
jmp 0x4532e6
test rdi, rdi
je 0x4533be
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x58], rdx
cmp rdi, 1
jne 0x45339c
test rax, rax
jne 0x453376
cmp rcx, r8
jbe 0x45348d
mov rsi, r8
shl r8, 4
mov rdi, qword [rdx + r8]
cmp qword [r14], rdi
ja 0x453380
mov r8, qword [r14 + 8]
cmp rdi, r8
jb 0x45339c
jmp 0x453380
mov rsi, r8
nop dword [rax]
cmp rcx, rsi
jbe 0x453485
shl rsi, 4
mov rax, qword [rdx + rsi]
mov rbx, qword [rdx + rsi + 8]
add rsp, 0x60
pop rbp
ret
mov rbx, r9
nop
call fcn.00453960
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x80]
jmp 0x4533e8
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
sub rsi, r9
mov r10, rsi
neg r10
sar r10, 0x3f
and r10, r9
add rdx, 0x10
dec r8
sub r11, r9
add rcx, r10
mov rdi, r11
test r8, r8
jle 0x453471
mov r9, qword [rdx + 8]
mov r10, qword [rdx]
cmp rdi, r9
mov r11, rdi
cmovg rdi, r9
cmp rcx, r10
jne 0x45340c
cmp r11, r9
jmp 0x453469
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x18], r9
mov rax, rcx
mov rbx, r10
mov rcx, rdi
call fcn.0046cf00
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, rax
mov r11, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jae 0x4533c8
jmp 0x453477
add rsp, 0x60
pop rbp
ret
mov rax, r9
mov rcx, r11
nop dword [rax]
call fcn.0046c600
mov rax, rsi
call fcn.0046c540
mov rax, r8
call fcn.0046c540
lea rax, [0x006db9d5]
mov ebx, 0x1d
call fcn.00439560
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004532c0
Function at 0x456e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x456ff7
movzx edx, byte [rax]
test edx, edx
jne 0x456eb4
nop dword [rax]
test r8b, r8b
jne 0x456eb4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x456ec7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x456fb7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x456fa5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x456f97
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x456f1d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x456f60
mov eax, 1
cmp rax, rbx
ja 0x456f4b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.0046c600
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x456f8f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x456f53
mov rcx, r11
mov eax, r12d
jmp 0x456f22
mov rcx, rbx
call fcn.0046c540
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0046c540
mov eax, r8d
mov rcx, rbx
call fcn.0046c600
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x456fed
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x456fb0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x456ecd
mov eax, edx
mov rcx, rbx
call fcn.0046c540
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0046c540
nop
int3

Function at 0x45b0a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b177
push rbp
mov rbp, rsp
sub rsp, 0x18
lea rdx, [rbx + 7]
nop
and rdx, 0xfffffffffffffff8
cmp qword [rax], 0
nop
je 0x45b0d2
mov rsi, qword [rax + 8]
add rsi, rdx
cmp rsi, 0xfff8
jbe 0x45b11d
cmp rdx, 0xfff8
ja 0x45b165
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x10], rdx
mov eax, 0x10000
lea rbx, [0x00991860]
call fcn.00417e60
test rax, rax
je 0x45b154
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rax], rbx
mov qword [rdx], rax
mov qword [rdx + 8], 0
mov rax, rdx
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rax + 8]
cmp rbx, 0xfff8
jae 0x45b147
mov rcx, qword [rax]
test byte [rcx], al
lea rcx, [rcx + rbx]
lea rcx, [rcx + 8]
add rdx, rbx
mov qword [rax + 8], rdx
mov rax, rcx
add rsp, 0x18
pop rbp
ret
mov rax, rbx
mov ecx, 0xfff8
call fcn.0046c560
lea rax, [0x006d9cf9]
mov ebx, 0x1a
call fcn.00439560
lea rax, [0x006db129]
mov ebx, 0x1c
call fcn.00439560
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0045b0a0
Function at 0x45d000
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d0b5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.0045ac80
nop
test bl, bl
je 0x45d0af
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x0045d100]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.0046a140
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045d000
Function at 0x45fc40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45fdee
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
call fcn.0043b000
lea rax, [0x006db145]
mov ebx, 0x1c
call fcn.0043b880
mov rax, qword [rsp + 0x50]
call fcn.0043b5c0
lea rax, [0x006d0c9b]
mov ebx, 3
call fcn.0043b880
call fcn.0043b060
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rcx
xor edx, edx
jmp 0x45fcd9
mov rdx, qword [rsp + 0x30]
inc rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
jge 0x45fd5d
mov qword [rsp + 0x30], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.00456080
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
nop
test rax, rax
je 0x45fd13
mov edx, dword [rax + 4]
mov r9d, dword [rax + 0x24]
movzx r10d, byte [rax + 0x28]
jmp 0x45fd1d
xor r10d, r10d
xor r9d, r9d
xor edx, edx
xor ebx, ebx
mov r11, qword [rsp + 0x30]
test r11, r11
sete sil
mov rax, rbx
mov ebx, edx
mov ecx, r9d
mov edi, r10d
xor r8d, r8d
call fcn.004603c0
nop dword [rax]
test al, al
je 0x45fcc7
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.0045fe40
jmp 0x45fcc7
cmp qword [rsp + 0x78], 0x32
jne 0x45fd85
call fcn.0043b000
lea rax, [0x006dce34]
mov ebx, 0x1f
call fcn.0043b880
nop dword [rax + rax]
call fcn.0043b060
mov rax, qword [rsp + 0x90]
call fcn.00456080
test rax, rax
jne 0x45fd9b
xor ecx, ecx
jmp 0x45fdca
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rax
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0x24]
movzx edi, byte [rax + 0x28]
xor esi, esi
xor r8d, r8d
mov rax, rbx
mov ebx, edx
call fcn.004603c0
mov rbx, qword [rsp + 0x20]
mov ecx, eax
mov rax, qword [rsp + 0x40]
test cl, cl
je 0x45fde8
cmp qword [rsp + 0x88], 1
je 0x45fde8
mov rcx, qword [rsp + 0x90]
xor edi, edi
call fcn.0045eb80
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0045fc40
Function at 0x460020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4600cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00460120]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046a140
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00460020
Function at 0x470ca0
Capabilities:
Reference http user-agent string

Disassembly:
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp fcn.0043ca60
Function at 0x4f2e80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f2fe6
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
nop
cmp rcx, 0x15
ja 0x4f2f0c
cmp rcx, 0x12
je 0x4f2f4c
cmp rcx, 0x13
jne 0x4f2f04
bt edx, 9
jb 0x4f2ef6
nop
cmp qword [rax], 8
jne 0x4f2fd0
cmp qword [rax + 8], 0
je 0x4f2fd0
bt edx, 7
nop
jae 0x4f2ee5
mov rbx, qword [rbx]
test rbx, rbx
je 0x4f2eed
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
lea rax, [0x004f6600]
nop
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x15
je 0x4f2f4c
jmp 0x4f2f87
cmp rcx, 0x16
jne 0x4f2f40
cmp qword [rax + 8], 0
jne 0x4f2f4c
mov qword [rsp + 0x18], rbx
mov rax, qword [rbx]
call fcn.00465d00
test al, al
je 0x4f2fbd
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x17
je 0x4f2f6b
cmp rcx, 0x1a
jne 0x4f2f87
cmp qword [rax], 8
jne 0x4f2f74
cmp qword [rax + 8], 0
je 0x4f2f74
bt edx, 7
jae 0x4f2f62
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
mov rax, qword [rbx]
add rsp, 0x20
pop rbp
ret
lea rax, [0x0067b380]
lea rbx, [0x00757440]
call fcn.004389a0
lea rax, [0x0069f0c0]
call fcn.0040eaa0
mov qword [rax + 8], 0x1b
lea rcx, [0x006daac7]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00687cc0]
call fcn.004389a0
lea rax, [0x0067b380]
lea rbx, [0x00757670]
call fcn.004389a0
lea rax, [0x0067b380]
lea rbx, [0x00757440]
nop
call fcn.004389a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004f2e80
Function at 0x4f39e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4f3c7a
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xd0], r8
mov qword [rsp + 0xd8], r9
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xc0], rdi
bt ecx, 9
jae 0x4f3a55
mov rdx, rax
mov rax, rdi
mov r8, rbx
mov rbx, rsi
mov r9, rcx
mov rcx, rdx
mov rdi, r8
mov rsi, r9
call fcn.004ebdc0
mov r8, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
mov rdx, rax
mov rax, r8
mov rbx, rdx
call fcn.004ed8e0
nop dword [rax + rax]
test al, al
jne 0x4f3bb1
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x80]
call fcn.004ed1e0
nop dword [rax]
test al, al
je 0x4f3bfa
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
and edx, 0x1f
nop
cmp rdx, 0x14
jne 0x4f3ae1
mov rbx, qword [rsp + 0x88]
cmp qword [rbx], 0
jne 0x4f3ae9
mov rax, qword [rsp + 0xd0]
xor ebx, ebx
mov ecx, 0x14
add rsp, 0x98
pop rbp
nop
ret
mov rbx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x80]
xor edi, edi
call fcn.004f14c0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rbx
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
jne 0x4f3b1f
mov rax, qword [rsp + 0xd0]
call fcn.00465920
mov rdx, rax
mov qword [rsp + 0x90], rdx
mov rax, qword [rsp + 0xd0]
call fcn.004011e0
test rax, rax
jne 0x4f3b74
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x90]
mov qword [rbx], rdx
cmp dword [0x0098c4d0], 0
jne 0x4f3b59
mov rdx, qword [rsp + 0x78]
jmp 0x4f3b6e
call fcn.0046c1a0
mov rdx, qword [rsp + 0x78]
mov qword [r11], rdx
mov rsi, qword [rbx + 8]
mov qword [r11 + 8], rsi
mov qword [rbx + 8], rdx
jmp 0x4f3b9b
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x90]
call fcn.00465720
mov rbx, qword [rsp + 0x90]
mov rax, qword [rsp + 0xd0]
mov ecx, 0x94
add rsp, 0x98
pop rbp
ret
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
and edx, 0x180
mov rax, qword [rsp + 0xd0]
movzx esi, byte [rax + 0x17]
and esi, 0x1f
test rcx, 0x60
mov ecx, 0
mov edi, 0x20
cmovne rcx, rdi
or rcx, rdx
or rcx, rsi
mov rbx, qword [rsp + 0x88]
add rsp, 0x98
pop rbp
ret
mov rax, qword [rsp + 0x80]
call fcn.004ec360
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0xd0]
call fcn.004ec360
mov qword [rsp], rax
mov qword [rsp + 8], rbx
xor eax, eax
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
lea rdi, [0x006d488a]
mov esi, 0x10
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x58]
lea r10, [0x006daae2]
mov r11d, 0x1b
nop dword [rax]
call fcn.00453740
call fcn.0040bb80
mov rbx, rax
lea rax, [0x0067b380]
call fcn.004389a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
nop dword [rax]
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004f39e0