joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4526e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x452a49
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
movzx edx, byte [rbx + 0x17]
and edx, 0x1f
dec rdx
cmp rdx, 0x19
ja 0x452a06
mov qword [rsp + 0xb8], rax
lea rsi, [0x0075ca80]
jmp qword [rsi + rdx*8]
mov rax, rbx
call fcn.0045b060
mov ecx, 0x16
mov rdi, rax
mov rsi, rbx
lea r8, [0x006ddb09]
mov r9d, 0x37
xor eax, eax
lea rbx, [0x006d1a98]
call fcn.0044e7e0
call fcn.0040af60
mov rbx, rax
lea rax, [0x006797e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004526e0

Function at 0x452f80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4530f0
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov edx, dword [0x01375c90]
test edx, edx
jne 0x452fbb
call fcn.00430060
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
cmp qword [rbx], 0
nop
jne 0x4530de
nop
mov rdx, rax
mov qword [rbx], rax
test byte [rdx], al
mov rax, qword [rdx + 0x2280]
mov rdi, qword [rdx + 0x2288]
mov rcx, qword [rdx + 0x2290]
lea r8, [rdi + 1]
cmp rcx, r8
jae 0x453049
mov qword [rsp + 0x40], rdi
mov rbx, r8
mov edi, 1
lea rsi, [0x00673640]
call fcn.0044a8e0
mov rdi, qword [rsp + 0x58]
mov qword [rdi + 0x2290], rcx
cmp dword [0x013760e0], 0
jne 0x453024
mov qword [rdi + 0x2280], rax
jmp 0x453039
lea rdx, [rdi + 0x2280]
mov rcx, rdi
mov rdi, rdx
call fcn.00465580
mov rdi, rcx
mov rdx, rdi
mov rdi, qword [rsp + 0x40]
mov r8, rbx
mov rbx, qword [rsp + 0x60]
mov qword [rdx + 0x2288], r8
lea rsi, [rax + r8*8]
lea rsi, [rsi - 8]
cmp dword [0x013760e0], 0
nop
jne 0x453069
mov qword [rax + r8*8 - 8], rbx
jmp 0x453077
mov rax, rdi
mov rdi, rsi
call fcn.004656c0
mov rdi, rax
mov rax, qword [rdx + 0x2280]
mov rbx, qword [rdx + 0x2288]
mov rcx, qword [rdx + 0x2290]
call fcn.00454d80
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x2280]
cmp qword [rdx + 0x2288], 0
jbe 0x4530d4
mov rax, qword [rsp + 0x60]
cmp qword [rsi], rax
jne 0x4530bc
mov rax, qword [rax + 8]
xchg qword [rdx + 0x1200], rax
nop
mov eax, 1
lock xadd dword [rdx + 0x2298], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
mov rcx, rax
call fcn.00465a20
lea rax, [0x006d7650]
mov ebx, 0x22
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00452f80
Function at 0x459f80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a039
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045a080]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00463280
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00459f80
Function at 0x45b200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b466
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x45b229
mov dword [rsp + 0x60], ebx
lea rcx, [0x0094e360]
jmp 0x45b240
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x230]
nop dword [rax]
test rcx, rcx
je 0x45b277
mov rdx, qword [rcx + 0x128]
cmp rax, rdx
jb 0x45b235
mov rsi, qword [rcx + 0x130]
cmp rax, rsi
jae 0x45b235
movsxd rcx, ebx
lea rax, [rdx + rcx]
cmp rsi, rax
jb 0x45b3d6
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rax
nop
nop
nop
lea rax, [0x013216e0]
call fcn.0040b740
mov rbx, qword [0x013216f0]
lea rax, [0x006863a0]
mov ecx, dword [rsp + 0x60]
nop dword [rax]
call fcn.00410b60
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
nop
nop
nop
lea rax, [0x013216e0]
nop dword [rax + rax]
call fcn.0040b960
movzx ecx, byte [rsp + 0x1f]
test cl, cl
jne 0x45b336
call fcn.004384a0
lea rax, [0x006cf7d6]
mov ebx, 0x11
nop
call fcn.00438da0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438c00
lea rax, [0x006cbcd8]
mov ebx, 6
nop dword [rax]
call fcn.00438da0
mov rax, qword [rsp + 0x20]
call fcn.00438c00
lea rax, [0x006cecbd]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00438da0
call fcn.00438520
lea rax, [0x0094e360]
jmp 0x45b3c0
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x40], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x28], rdx
call fcn.004384a0
lea rax, [0x006cc26d]
mov ebx, 7
call fcn.00438da0
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00438c00
lea rax, [0x006cc38e]
mov ebx, 8
call fcn.00438da0
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438c00
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x230]
nop dword [rax + rax]
test rax, rax
jne 0x45b345
lea rax, [0x006dbae8]
mov ebx, 0x2e
call fcn.00436b60
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
call fcn.004384a0
lea rax, [0x006cf7d6]
mov ebx, 0x11
call fcn.00438da0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
nop dword [rax]
call fcn.00438c00
lea rax, [0x006ce27a]
mov ebx, 0xe
call fcn.00438da0
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.00438c00
lea rax, [0x006cb67d]
mov ebx, 3
call fcn.00438da0
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438c00
call fcn.00438700
call fcn.00438520
lea rax, [0x006d7118]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.0045b200
Function at 0x45b4a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b72b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x45b4ce
nop dword [rax]
cmp ebx, 0xffffffff
je 0x45b4ce
lea rcx, [0x0094e360]
jmp 0x45b4e1
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x230]
test rcx, rcx
je 0x45b4fa
cmp qword [rcx + 0x128], rax
ja 0x45b4da
cmp qword [rcx + 0x130], rax
jbe 0x45b4da
jmp 0x45b4fc
xor ecx, ecx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x45b568
mov qword [rsp + 0x40], rcx
mov rdx, qword [rcx + 0x220]
lea rax, [0x00686880]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
nop
call fcn.004109c0
mov rax, qword [rax]
test rax, rax
jne 0x45b55e
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x128]
mov ebx, dword [rsp + 0x60]
movsxd rsi, ebx
lea rax, [rdx + rsi]
mov rcx, qword [rcx + 0x130]
cmp rcx, rax
jb 0x45b6a5
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x18], rax
nop
nop
nop
lea rax, [0x013216e0]
call fcn.0040b740
mov rbx, qword [0x013216f0]
lea rax, [0x006863a0]
mov ecx, dword [rsp + 0x60]
call fcn.004109c0
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x013216e0]
call fcn.0040b960
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x45b613
call fcn.004384a0
lea rax, [0x006cf81a]
mov ebx, 0x11
call fcn.00438da0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438c00
lea rax, [0x006cbcd8]
mov ebx, 6
call fcn.00438da0
mov rax, qword [rsp + 0x18]
call fcn.00438c00
lea rax, [0x006cecbd]
mov ebx, 0x10
nop dword [rax]
call fcn.00438da0
call fcn.00438520
lea rax, [0x0094e360]
jmp 0x45b68b
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x20], rdx
call fcn.004384a0
lea rax, [0x006cc26d]
mov ebx, 7
call fcn.00438da0
mov rax, qword [rsp + 0x28]
call fcn.00438c00
lea rax, [0x006cc38e]
mov ebx, 8
call fcn.00438da0
mov rax, qword [rsp + 0x20]
call fcn.00438c00
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x230]
test rax, rax
jne 0x45b61d
lea rax, [0x006dbb72]
mov ebx, 0x2e
nop dword [rax]
call fcn.00436b60
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.004384a0
lea rax, [0x006cf81a]
mov ebx, 0x11
call fcn.00438da0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438c00
lea rax, [0x006ce27a]
mov ebx, 0xe
nop dword [rax]
call fcn.00438da0
mov rax, qword [rsp + 0x28]
call fcn.00438c00
lea rax, [0x006cb67d]
mov ebx, 3
nop dword [rax + rax]
call fcn.00438da0
mov rax, qword [rsp + 0x20]
call fcn.00438c00
call fcn.00438700
call fcn.00438520
lea rax, [0x006d715a]
mov ebx, 0x21
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0045b4a0
Function at 0x45b760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b93b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp ebx, 0xffffffff
je 0x45b786
lea rcx, [0x0094e360]
jmp 0x45b7a0
lea rax, [method.Ld_M_f.1.virtual_0]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x230]
nop
test rcx, rcx
je 0x45b7b9
cmp qword [rcx + 0x128], rax
ja 0x45b797
cmp qword [rcx + 0x130], rax
jbe 0x45b797
jmp 0x45b7c0
xor ecx, ecx
nop dword [rax + rax]
test rcx, rcx
jne 0x45b891
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x58], ebx
nop
nop
nop
lea rax, [0x013216e0]
nop dword [rax]
call fcn.0040b740
mov rbx, qword [0x013216f0]
lea rax, [0x006863a0]
mov ecx, dword [rsp + 0x58]
call fcn.004109c0
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x013216e0]
call fcn.0040b960
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x45b887
nop dword [rax]
call fcn.004384a0
lea rax, [0x006cf809]
mov ebx, 0x11
call fcn.00438da0
mov eax, dword [rsp + 0x58]
movsxd rax, eax
nop dword [rax]
call fcn.00438c00
lea rax, [0x006cbcd8]
mov ebx, 6
call fcn.00438da0
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00438c00
lea rax, [0x006cecbd]
mov ebx, 0x10
call fcn.00438da0
call fcn.00438520
lea rax, [0x0094e360]
jmp 0x45b920
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rcx
call fcn.00451020
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x20], rdx
call fcn.004384a0
lea rax, [0x006cc26d]
mov ebx, 7
call fcn.00438da0
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438c00
lea rax, [0x006cc38e]
mov ebx, 8
call fcn.00438da0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438c00
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x230]
nop dword [rax + rax]
test rax, rax
jne 0x45b8a3
lea rax, [0x006dbb44]
mov ebx, 0x2e
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0045b760
Function at 0x45d880
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x45d953
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
lea rax, [rsp + 0x98]
call fcn.00436b20
test rax, rax
jne 0x45d8c8
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
cmp dword [rax + 0x10], 0x778cdb8
jne 0x45d90b
lea rdx, [0x006797e0]
cmp rax, rdx
jne 0x45d90b
mov r9, qword [rbx + 8]
mov r8, qword [rbx]
lea rax, [rsp + 0x58]
lea rbx, [0x006d6790]
mov ecx, 0x20
lea rdi, [0x006cb5d8]
mov esi, 2
call fcn.0044e7e0
call fcn.00436b60
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov rax, qword [rsp + 0x78]
nop dword [rax]
call fcn.0045b060
mov ecx, 0x20
lea rdi, [0x006cc091]
mov esi, 7
mov r8, rax
mov r9, rbx
lea rax, [rsp + 0x38]
lea rbx, [0x006d6790]
call fcn.0044e7e0
call fcn.00436b60
nop
call fcn.004633c0
jmp fcn.0045d880
Function at 0x460000
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x40]
nop dword [rax]
cmp qword [r14 + 0x70], rcx
jb 0x46026c
mov qword [rsp + 0x10], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rax
mov qword [rcx + 0xb0], 0
call fcn.00441380
test al, al
jne 0x460085
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], 0
cmp byte [0x01327e10], 0
je 0x4601af
mov rax, qword [rsp + 0x18]
jmp 0x460229
cmp byte [0x0131aac4], 0
je 0x4600ca
movups xmmword [rsp + 0x20], xmm15
lea rax, [0x00441340]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00463280
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp byte [0x01327e10], 0
je 0x460122
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x18]
cmp rsi, rdi
jne 0x4600f8
mov edx, dword [rdx + 0x26c]
cmp dword [rsi + 0x14], edx
je 0x460127
lea rax, [0x00711990]
mov qword [rsp], rax
call fcn.00463280
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
nop
jmp 0x460127
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
nop
call fcn.0043b040
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rdx, qword [rax + 0x30]
dec dword [rdx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x46016f
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x46017d
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x01322700], 0
je 0x4601a5
mov ebx, 1
call fcn.0045ab00
test al, al
jne 0x4601a5
nop dword [rax + rax]
call fcn.00439600
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x007116f8]
call fcn.00463200
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, fcn.00591d80
mov qword [rsp], rax
nop dword [rax]
call fcn.00463280
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, rcx
mov rcx, qword [rsp + 0x10]
test rax, rax
je 0x46023d
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rax + 0x14]
cmp dword [rdx + 0x26c], ebx
je 0x4601f1
nop dword [rax]
call fcn.00465400
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], rax
jmp 0x4601af
lea rax, [0x006db3cd]
mov ebx, 0x2d
call fcn.00436b60
nop
int3
Function at 0x4654c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x013761c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x01375c41], 0
je 0x4654f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x01376540]
aesenc xmm0, xmmword [0x01376550]
aesenc xmm0, xmmword [0x01376560]
movq rax, xmm0
ret
jmp 0x409fe0

Function at 0x467a00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x432274
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
cmp dword [0x013760e0], 0
nop
jne 0x432132
lea rdx, [0x00466e80]
mov qword [0x0131fad8], rdx
jmp 0x432145
lea rdi, [0x0131fad8]
lea rdx, [0x00466e80]
call fcn.004656a0
xor eax, eax
jmp 0x432160
lea r8, [0x013764c0]
mov byte [r8 + rax], sil
inc dword [0x01375c60]
mov rax, rdi
nop dword [rax]
cmp rax, 0x36
jge 0x4321b0
lea rdx, [0x006dd9fb]
movzx esi, byte [rdx + rax]
cmp esi, 0x80
jge 0x43217f
lea rdi, [rax + 1]
jmp 0x4321a5
mov qword [rsp + 0x20], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
call fcn.0045d100
lea rdx, [0x006dd9fb]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x20]
cmp rax, 0x64
jb 0x432149
jmp 0x432269
call fcn.00431320
call fcn.00449b60
call fcn.00449c00
nop
call fcn.00431da0
xor eax, eax
call fcn.00431ce0
mov dword [0x01375cac], eax
call fcn.00431e60
call fcn.00431bc0
mov dword [0x01375c8c], eax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [0x009440f0]
lea rcx, [rsp + 0x28]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433c60
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x2c]
mov qword [0x01375de0], rax
mov rax, qword [0x009440a0]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 1
call fcn.00433ce0
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov ecx, 0x64
call fcn.00465a20
nop
call fcn.004633c0
jmp 0x432100
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x432100
Function at 0x467e40
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x006dcbd8]
mov ebx, 0x32
call fcn.00436b60
nop
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x461300
Function at 0x46d540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d66a
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rax]
mov rsi, qword [0x0131fb78]
cmp rdx, rsi
je 0x46d5da
test rdx, rdx
jne 0x46d5c2
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x18], rbx
lea rax, [0x006812a0]
call fcn.0040d900
mov rcx, qword [rsp + 0x18]
mov qword [rax], rcx
cmp dword [0x013760e0], 0
jne 0x46d5ad
mov rdx, qword [rsp + 0x48]
mov qword [rax + 8], rdx
jmp 0x46d5bb
lea rdi, [rax + 8]
mov rdx, qword [rsp + 0x48]
call fcn.004656a0
mov qword [rsp + 0x20], rax
jmp 0x46d5f1
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov ecx, 1
mov edi, ecx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov edi, ecx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, qword [rsp + 0x20]
xor ebx, ebx
mov rcx, rax
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.0045e900
test al, al
jne 0x46d64f
nop
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rsi, qword [0x0131fb78]
cmp rdx, rsi
je 0x46d63d
nop
test rdx, rdx
je 0x46d5ec
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov ecx, 1
mov edi, ecx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov edi, ecx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
mov edi, 1
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046d540
Function at 0x4a5ac0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4a5cf0
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x90], rax
mov rdx, qword [rax + 0x20]
inc rdx
mov r8, qword [rax + 0x18]
mov rcx, qword [rax + 0x28]
mov r9, qword [rax + 8]
cmp rcx, rdx
jae 0x4a5b6d
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x48], r9
mov rax, r8
mov rbx, rdx
mov edi, 1
lea rsi, [0x006790e0]
call fcn.0044a8e0
mov rdi, qword [rsp + 0x90]
mov qword [rdi + 0x28], rcx
cmp dword [0x013760e0], 0
jne 0x4a5b45
mov qword [rdi + 0x18], rax
jmp 0x4a5b57
lea rdx, [rdi + 0x18]
mov rcx, rdi
mov rdi, rdx
call fcn.00465580
mov rdi, rcx
mov r9, qword [rsp + 0x48]
mov rdx, rbx
mov r8, rax
mov rax, rdi
mov rbx, qword [rsp + 0x98]
mov qword [rax + 0x20], rdx
mov qword [r8 + rdx*8 - 8], r9
movzx edx, byte [rbx + 0x17]
test dl, 0x20
je 0x4a5b86
cmp qword [rbx + 8], 0
je 0x4a5ba3
xor ebx, ebx
mov ecx, 8
mov edi, 1
mov esi, 1
call fcn.004a63c0
mov ecx, 1
jmp 0x4a5bc0
xor ebx, ebx
mov ecx, 8
mov edi, 1
xor esi, esi
call fcn.004a63c0
xor ecx, ecx
nop dword [rax + rax]
test al, al
jne 0x4a5cd0
nop
mov rdx, qword [rsp + 0x90]
mov r8, qword [rdx + 0x30]
add r8, 7
and r8, 0xfffffffffffffff8
mov qword [rdx + 0x30], r8
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x60], 8
mov r8, qword [rdx + 0x30]
mov qword [rsp + 0x68], r8
mov rbx, qword [rdx + 8]
inc rbx
mov rax, qword [rdx]
mov r8, qword [rdx + 0x10]
nop dword [rax]
cmp r8, rbx
jae 0x4a5c64
mov byte [rsp + 0x47], cl
mov rcx, r8
mov edi, 1
lea rsi, [0x006b51c0]
call fcn.0044a8e0
mov rdi, qword [rsp + 0x90]
mov qword [rdi + 0x10], rcx
cmp dword [0x013760e0], 0
jne 0x4a5c57
mov qword [rdi], rax
jmp 0x4a5c5c
call fcn.00465580
movzx ecx, byte [rsp + 0x47]
mov rdx, rdi
mov qword [rdx + 8], rbx
lea rsi, [rbx + rbx*2]
shl rsi, 4
lea rdi, [rax + rsi]
lea rdi, [rdi - 0x30]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rdi], xmm0
lea rsi, [rsi + rax]
lea rsi, [rsi - 0x20]
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x10], xmm0
add qword [rdx + 0x30], 8
mov rax, qword [rdx + 8]
mov rdx, qword [rdx]
lea rsi, [rax - 1]
cmp rax, rsi
jbe 0x4a5ce4
lea rsi, [rax + rax*2]
shl rsi, 4
lea rax, [rdx + rsi]
lea rax, [rax - 0x30]
mov ebx, ecx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
xor eax, eax
mov ebx, ecx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rcx, rax
mov rax, rsi
call fcn.00465a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004a5ac0
Function at 0x4a5d20
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x88]
cmp r12, qword [r14 + 0x10]
jbe 0x4a638d
sub rsp, 0x108
mov qword [rsp + 0x100], rbp
lea rbp, [rsp + 0x100]
movzx edx, byte [rbx + 0x17]
and edx, 0x1f
lea r8, [rdx - 1]
nop
cmp r8, 0x19
ja 0x4a6347
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x110], rax
lea rdx, [0x0075c9a0]
jmp qword [rdx + r8*8]
mov qword [rsp + 0x40], rdx
call fcn.004384a0
lea rax, [0x006cd103]
mov ebx, 0xa
nop dword [rax]
call fcn.00438da0
mov rax, qword [rsp + 0x40]
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
lea rax, [0x006797e0]
lea rbx, [0x007584c0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004a5d20