joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478e40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47909c
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp rdi, 0x12
jg 0x479088
nop dword [rax]
test rbx, rbx
jne 0x478e70
movups xmmword [rax + 0x18], xmm15
add rsp, 0x40
pop rbp
ret
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
cmp rsi, 0x37
jge 0x478ead
lea rsi, [rdx - 0x36]
neg rsi
mov r8, rcx
mov rcx, rsi
shl rbx, cl
lea rdx, [rdx + r8]
lea rdx, [rdx - 0x36]
cmp rcx, 0x40
sbb rsi, rsi
and rbx, rsi
jmp 0x478eb0
mov rdx, rcx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
imul rsi, rdx, 0x13441
add rsi, 0x4105b6
sar rsi, 0x12
mov rcx, rdi
sub rcx, rsi
mov qword [rsp + 0x38], rcx
lea rsi, [rcx - 1]
nop dword [rax + rax]
cmp rsi, 0x37
jg 0x478eef
test rsi, rsi
setge r8b
jmp 0x478ef2
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x27], r8b
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov rbx, rdx
mov rcx, rsi
call fcn.00479e80
test rbx, rbx
jge 0x479075
mov rdx, qword [rsp + 0x38]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x478f45
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x479025
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
nop
jmp 0x479040
movzx esi, byte [rsp + 0x27]
mov r8, rbx
neg rbx
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9, cl
mov r10, rax
shr rax, cl
cmp rcx, 0x40
sbb rbx, rbx
and r9, rbx
dec r9
and rbx, rax
and r9, r10
test sil, sil
je 0x478fc7
lea rcx, [r8 + 1]
neg rcx
mov r8d, 1
shl r8, cl
cmp rcx, 0x40
sbb r10, r10
and r8, r10
cmp r8, r9
jb 0x478fb8
jne 0x478fc2
nop dword [rax]
test dil, dil
je 0x478fb8
cmp r8, r9
jne 0x478fc2
test dil, dil
je 0x478fc2
mov r8, rbx
and r8d, 1
jmp 0x478fe9
mov r8d, 1
nop
jmp 0x478fe9
xor r8d, r8d
jmp 0x478fe9
lea rcx, [r8 + 1]
neg rcx
mov r10, r9
shr r9, cl
cmp rcx, 0x40
sbb r11, r11
and r9, r11
cmp r9, 1
sete r8b
mov r9, r10
test r9, r9
je 0x478ff0
xor edi, edi
xor edi, 1
mov rax, qword [rsp + 0x50]
mov ecx, edi
mov edi, r8d
mov rsi, qword [rsp + 0x68]
call fcn.004790e0
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x38]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
add rsp, 0x40
pop rbp
ret
mov esi, 1
mov ecx, 1
jmp 0x478f4a
inc rsi
mov rax, rdi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x479025
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x479034
mov rax, rdi
mov rdx, r10
movzx esi, byte [rsp + 0x27]
jmp 0x478f4a
lea rax, [0x0065b7a0]
lea rbx, [0x00727610]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727600]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00478e40
Function at 0x479da0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x479e46
push rbp
mov rbp, rsp
sub rsp, 0x10
test rcx, rcx
je 0x479e1d
lea rdx, [rcx + 0x15c]
nop
cmp rdx, 0x2b7
ja 0x479e2f
shl rdx, 4
lea rsi, [0x008aa360]
mov rdx, qword [rsi + rdx + 8]
lea rsi, [rdx + 1]
test rcx, rcx
cmovl rdx, rsi
mov eax, eax
mul rdx
shl rdx, 7
mov rsi, rax
shr rsi, 0x39
or rdx, rsi
shl rax, 7
imul rsi, rcx, 0x1a935
sar rsi, 0xf
lea rbx, [rsi + rbx]
lea rbx, [rbx - 6]
test rax, rax
sete cl
mov rax, rdx
add rsp, 0x10
pop rbp
ret
shl eax, 6
add rbx, 0xfffffffffffffffa
mov ecx, 1
add rsp, 0x10
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727620]
nop dword [rax]
call fcn.00436ac0
nop
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov eax, dword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00479da0

Function at 0x479e80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x479f5b
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
je 0x479f34
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x479f47
shl rdx, 4
lea rsi, [0x008aa360]
add rdx, rsi
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x10], xmm0
test rcx, rcx
jge 0x479ecf
inc qword [rsp + 0x10]
mov rdx, qword [rsp + 0x10]
mov rsi, rax
mov rax, rdx
mul rsi
mov rdi, qword [rsp + 0x18]
mov r8, rax
mov rax, rdi
mov rdi, rdx
mul rsi
imul rsi, rcx, 0x1a935
sar rsi, 0xf
lea rbx, [rsi + rbx]
lea rbx, [rbx - 8]
add rax, rdi
sbb rsi, rsi
mov rdi, rax
shl rdi, 9
sub rdx, rsi
test rdi, rdi
jne 0x479f1f
test r8, r8
sete sil
jmp 0x479f21
xor esi, esi
shl rdx, 9
shr rax, 0x37
or rax, rdx
mov ecx, esi
add rsp, 0x20
pop rbp
ret
shl rax, 8
add rbx, 0xfffffffffffffff8
mov ecx, 1
add rsp, 0x20
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727630]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.00479e80

Function at 0x479fa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a05d
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp rax, 0x64
jae 0x47a021
cmp rbx, 0xa
jne 0x47a021
nop
cmp rax, 0xa
jge 0x479fe4
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x47a057
lea rcx, [0x006bd02b]
add rcx, rax
mov eax, 1
jmp 0x47a015
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x47a04d
mov rdx, rax
shl rdx, 1
nop dword [rax + rax]
cmp rcx, rdx
jb 0x47a045
lea rdx, [0x006c5cc2]
lea rcx, [rdx + rax*2]
mov eax, 2
mov rbx, rax
mov rax, rcx
add rsp, 0x30
pop rbp
ret
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor r8d, r8d
mov r9d, r8d
xor eax, eax
mov rbx, rcx
call fcn.0047a340
mov rax, rdi
mov rbx, rsi
add rsp, 0x30
pop rbp
ret
mov rax, rdx
call fcn.00466a20
mov edx, 0xc8
call fcn.004669a0
call fcn.00466a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00479fa0
Function at 0x47a080
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a146
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp rax, 0x64
jae 0x47a101
cmp rbx, 0xa
jne 0x47a101
nop
cmp rax, 0xa
jge 0x47a0c4
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x47a140
lea rcx, [0x006bd02b]
add rcx, rax
mov eax, 1
jmp 0x47a0f5
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x47a131
mov rdx, rax
shl rdx, 1
nop dword [rax + rax]
cmp rcx, rdx
jb 0x47a129
lea rdx, [0x006c5cc2]
lea rcx, [rdx + rax*2]
mov eax, 2
mov rbx, rax
mov rax, rcx
add rsp, 0x30
pop rbp
ret
test rax, rax
setl r8b
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor r9d, r9d
xor eax, eax
mov rbx, rcx
call fcn.0047a340
mov rax, rdi
mov rbx, rsi
add rsp, 0x30
pop rbp
ret
mov rax, rdx
call fcn.00466a20
mov edx, 0xc8
call fcn.004669a0
nop dword [rax + rax]
call fcn.00466a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0047a080

Function at 0x47a1c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a2fe
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
nop word [rax + rax]
cmp rdi, 0x64
jae 0x47a2c1
cmp rsi, 0xa
jne 0x47a2c1
cmp rdi, 0xa
jge 0x47a21a
lea rdx, [rdi + 1]
nop
cmp rdi, rdx
ja 0x47a2f2
lea rdx, [0x006bd02b]
add rdx, rdi
mov esi, 1
jmp 0x47a24e
lea r8, [rdi + rdi]
lea r8, [r8 + 2]
cmp r8, 0xc8
ja 0x47a2e5
mov rdx, rdi
shl rdi, 1
cmp r8, rdi
jb 0x47a2d9
lea r8, [0x006c5cc2]
lea rdx, [r8 + rdx*2]
mov esi, 2
lea r8, [rbx + rsi]
cmp rcx, r8
jae 0x47a28a
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x48], rdx
mov rbx, r8
mov rdi, rsi
lea rsi, [0x0065bae0]
call fcn.0044b880
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x30]
mov r8, rbx
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rcx
lea rdi, [rax + rbx]
mov rbx, rdx
mov rax, rdi
mov rcx, rsi
call fcn.00467360
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
add rsp, 0x58
pop rbp
nop
ret
test rdi, rdi
setl r8b
mov r9d, 1
call fcn.0047a340
add rsp, 0x58
pop rbp
ret
mov rax, rdi
mov rcx, r8
nop
call fcn.00466a20
mov rcx, r8
mov edx, 0xc8
call fcn.004669a0
mov rax, rdi
mov rcx, rdx
call fcn.00466a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0047a1c0
Function at 0x482520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4825f9
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdx, rbx
shl rbx, 0x20
mov rsi, rbx
lock xadd qword [rax], rbx
add rsi, rbx
mov rdi, rsi
shr rsi, 0x20
test esi, esi
jl 0x4825e5
test edi, edi
je 0x48256c
test rdx, rdx
jle 0x482568
nop dword [rax]
cmp edx, esi
je 0x4825cd
test esi, esi
jmp 0x48256e
test esi, esi
jmp 0x48256e
test esi, esi
jg 0x482588
test edi, edi
je 0x482588
mov rdx, qword [rax]
cmp rdx, rdi
jne 0x4825ba
mov qword [rsp + 0x30], rax
xor edx, edx
xchg qword [rax], rdx
jmp 0x4825b0
add rsp, 0x20
pop rbp
ret
mov dword [rsp + 0x1c], edi
lea rdx, [rax + 8]
xor ebx, ebx
xor ecx, ecx
mov rax, rdx
nop dword [rax]
call fcn.00462060
mov edi, dword [rsp + 0x1c]
dec edi
mov rax, qword [rsp + 0x30]
test edi, edi
jne 0x48258e
add rsp, 0x20
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727570]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727570]
nop dword [rax + rax]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727560]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00482520

Function at 0x4840a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48411d
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [rax]
nop
test rcx, rcx
je 0x4840be
cmp rax, rcx
je 0x4840d9
jmp 0x484109
cmp dword [0x00921500], 0
je 0x4840d6
call fcn.004665c0
mov qword [r11], rax
mov rcx, qword [rax]
mov qword [r11 + 8], rcx
mov qword [rax], rax
test rbx, rbx
jl 0x4840f6
mov rcx, qword [rax + 0x18]
sub rcx, qword [rax + 0x10]
cmp rbx, rcx
jle 0x4840f0
call fcn.00483fc0
add rsp, 0x10
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x007274f0]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x007274e0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004840a0
Function at 0x484140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48424a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov rdx, qword [rax]
nop
test rdx, rdx
je 0x48416a
nop dword [rax + rax]
cmp rax, rdx
je 0x484185
jmp 0x484236
cmp dword [0x00921500], 0
je 0x484182
call fcn.004665c0
mov qword [r11], rax
mov rdx, qword [rax]
mov qword [r11 + 8], rdx
mov qword [rax], rax
mov qword [rsp + 0x58], rax
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov qword [rsp + 0x40], r8
nop dword [rax + rax]
cmp ebx, 0x7f
ja 0x4841e4
lea r9, [r8 + 1]
cmp rcx, r9
jae 0x4841dd
mov dword [rsp + 0x60], ebx
mov rax, rdx
mov rbx, r9
mov edi, 1
lea rsi, [0x0065bae0]
call fcn.0044b880
mov r8, qword [rsp + 0x40]
mov r9, rbx
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x60]
mov byte [r9 + rdx - 1], bl
jmp 0x484201
mov rax, rdx
mov edi, ebx
mov rbx, r8
call fcn.004746a0
mov r8, qword [rsp + 0x40]
mov r9, rbx
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x10], r9
mov qword [rax + 0x18], rcx
sub r9, r8
cmp dword [0x00921500], 0
je 0x484225
call fcn.004665c0
mov qword [r11], rdx
mov rsi, qword [rax + 8]
mov qword [r11 + 8], rsi
mov qword [rax + 8], rdx
mov rax, r9
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x007274e0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.00484140
Function at 0x499cc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499e2e
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov byte [rax + 0x20], 0
xor edx, edx
jmp 0x499cef
mov rdx, rax
mov rax, rsi
mov qword [rsp + 0x30], rdx
mov ebx, 0x200
call fcn.00499860
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x10]
cmp rax, rdx
ja 0x499e25
mov qword [rcx + 8], rax
mov rdi, qword [rcx + 0x10]
nop dword [rax + rax]
cmp rax, rdi
ja 0x499e18
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x18]
sub rdi, rax
mov r8, rdi
neg r8
sar r8, 0x3f
and r8, rax
mov r9, qword [rcx]
lea rbx, [r9 + r8]
mov rax, qword [rsp + 0x68]
mov rcx, rdi
call rsi
nop dword [rax + rax]
test rax, rax
jl 0x499df6
mov rsi, qword [rsp + 0x58]
mov rdx, qword [rsi + 0x10]
mov rdi, qword [rsp + 0x20]
add rdi, rax
cmp rdx, rdi
jb 0x499dee
mov qword [rsi + 8], rdi
mov rdx, qword [rsp + 0x30]
add rax, rdx
cmp qword [0x008bd9f0], rbx
jne 0x499dd0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], rax
mov rdx, qword [0x008bd9f8]
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.00404940
test al, al
jne 0x499ddf
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
test rbx, rbx
je 0x499ce9
add rsp, 0x48
pop rbp
ret
mov rax, qword [rsp + 0x28]
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rdi
call fcn.004669e0
mov rcx, qword [0x008bdaa0]
nop dword [rax]
test rcx, rcx
je 0x499e09
mov rcx, qword [rcx + 8]
mov rbx, qword [0x008bdaa8]
mov rax, rcx
call fcn.00436ac0
mov rcx, rdi
nop dword [rax + rax]
call fcn.00466a20
mov rcx, rax
call fcn.004669e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00499cc0

Function at 0x4a3900
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4a396b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4a3924
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4a3941
cmp rdx, 0
je 0x4a398d
test rdx, 0xf
je 0x4a391d
test rdx, 7
jne 0x4a3941
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4a391d
ret
Function at 0x4a4700
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a48f1
push rbp
mov rbp, rsp
sub rsp, 0x78
cmp rdi, 8
ja 0x4a48dd
nop dword [rax]
test sil, sil
je 0x4a472f
cmp rcx, 8
jne 0x4a48ca
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x0088c590], rdx
jl 0x4a476b
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
mov qword [rsp + 0x98], rcx
xor edx, edx
jmp 0x4a47c0
xor eax, eax
add rsp, 0x78
pop rbp
ret
mov qword [rax + 8], r9
lea r9, [r9 + r9*2]
movups xmm0, xmmword [rsp + 0x48]
shl r9, 4
lea r12, [r9 + r10]
lea r12, [r12 - 0x20]
lea r9, [r9 + r10]
lea r9, [r9 - 0x30]
movups xmmword [r9], xmm0
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r12], xmm0
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r12 + 0x10], xmm0
inc qword [rax + 0x38]
inc rdx
mov rcx, r8
nop dword [rax + rax]
cmp rdi, rdx
jle 0x4a48bf
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
mov r8, rcx
mov rcx, rdx
mov r9d, 1
shl r9d, cl
imul rcx, r8
lea r10, [rbx + rcx]
cmp rdx, 0x20
sbb r11d, r11d
and r9d, r11d
test sil, r9b
mov r9d, 2
mov r11d, 3
cmovne r9, r11
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x58], r8
mov r9, qword [rax + 0x38]
mov qword [rsp + 0x68], r9
mov rcx, qword [rax + 0x10]
mov r9, qword [rax + 8]
inc r9
mov r10, qword [rax]
cmp rcx, r9
jae 0x4a4773
mov qword [rsp + 0x40], rdx
mov rax, r10
mov rbx, r9
mov edi, 1
lea rsi, [0x00698c60]
call fcn.0044b880
mov rdx, qword [rsp + 0x88]
mov qword [rdx + 0x10], rcx
cmp dword [0x00921500], 0
je 0x4a487e
call fcn.004665c0
mov qword [r11], rax
mov r8, qword [rdx]
mov qword [r11 + 8], r8
mov qword [rdx], rax
mov rdx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x98]
mov r11d, 3
mov r9, rbx
mov r10, rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
jmp 0x4a4773
mov eax, 1
add rsp, 0x78
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727c00]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727be0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp fcn.004a4700
Function at 0x4a6e00
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x1f8]
cmp r12, qword [r14 + 0x10]
jbe 0x4a70a6
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x298], rdi
bt esi, 9
jae 0x4a7091
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0x280], rax
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xf0], rcx
mov rdx, rsi
and esi, 0x1e0
movzx r8d, byte [rcx + 0x17]
and r8d, 0x1f
or r8, rsi
mov qword [rsp + 0xd0], r8
mov rax, rcx
mov rbx, rdi
mov rcx, rdx
call fcn.004ae300
lea rdx, [0x0072d308]
nop dword [rax]
cmp rax, rdx
jne 0x4a707e
mov qword [rsp + 0xe0], rbx
lea rcx, [0x004b1c80]
mov qword [rsp + 0xc8], rcx
nop
movups xmmword [rsp + 0x1b8], xmm15
lea rdi, [rsp + 0x1c0]
lea rdi, [rdi - 0x10]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466c6f
mov rbp, qword [rbp]
mov rax, rbx
xor ebx, ebx
call fcn.004a9620
mov rcx, qword [rsp]
mov qword [rsp + 0x1b8], rcx
lea rdi, [rsp + 0x1c0]
lea rsi, [rsp + 8]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466fa6
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x1b8]
mov qword [rsp + 0x100], rcx
lea rdi, [rsp + 0x108]
lea rsi, [rsp + 0x1c0]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466fa6
mov rbp, qword [rbp]
lea rax, [0x00687420]
call fcn.0040d680
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1a8]
cmp dword [0x00921500], 0
je 0x4a6fa8
nop dword [rax + rax]
call fcn.004665a0
mov qword [r11], rcx
mov qword [rax + 8], rcx
mov rdx, qword [rsp + 0x190]
mov qword [rax + 0x10], rdx
movzx edx, word [rsp + 0x1b0]
mov word [rax + 0x18], dx
mov r8, qword [rsp + 0xd8]
mov rdx, r8
sar rdx, 0xa
mov qword [rax + 0x20], rdx
mov rsi, qword [rsp + 0xd0]
mov qword [rax + 0x38], rsi
cmp dword [0x00921500], 0
jne 0x4a7000
mov rcx, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
jmp 0x4a702c
call fcn.00466600
mov rcx, qword [rsp + 0xf0]
mov qword [r11], rcx
mov r9, qword [rax + 0x28]
mov qword [r11 + 8], r9
mov rdi, qword [rsp + 0xf8]
mov qword [r11 + 0x10], rdi
mov r9, qword [rax + 0x30]
mov qword [r11 + 0x18], r9
mov qword [rsp + 0xe8], rax
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rdi
mov rbx, qword [rsp + 0x288]
mov r8, rdx
mov rax, qword [rsp + 0x280]
call fcn.004aada0
mov rax, qword [rsp + 0xe0]
test byte [rax], al
mov rcx, qword [rsp + 0xd8]
and ecx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xe8]
add rsp, 0x270
pop rbp
ret
mov rbx, qword [0x0072d310]
lea rcx, [0x0069f7a0]
call fcn.0040ab20
lea rax, [0x0065b7a0]
lea rbx, [0x00727c30]
nop
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.004a6e00
Function at 0x4a7dc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a7f27
push rbp
mov rbp, rsp
sub rsp, 0x20
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466c8b
mov rbp, qword [rbp]
test rbx, rbx
jl 0x4a7f13
nop dword [rax]
cmp qword [rax + 0x40], rbx
jle 0x4a7f13
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov rcx, qword [rax + 0x38]
lea rdx, [rbx + rbx*2]
mov rsi, qword [rcx + rdx*8 + 8]
test rsi, rsi
je 0x4a7e35
lea rdi, [0x0072d308]
jmp 0x4a7e39
xor edi, edi
xor esi, esi
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov rax, qword [rcx + rdx*8]
call fcn.00402300
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rdx + rcx*8]
movzx ebx, byte [rbx]
test bl, 8
setne byte [rsp + 0x90]
mov rbx, qword [rdx + rcx*8]
movzx ebx, byte [rbx]
test bl, 1
jne 0x4a7ead
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x30]
call fcn.00402300
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rax, qword [rdx + rcx*8]
call fcn.004023c0
test rbx, rbx
je 0x4a7ec5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rdx + rcx*8 + 0x10]
mov qword [rsp + 0x70], rcx
lea rax, [0x006624e0]
call fcn.0040d680
mov rcx, qword [rsp + 0xa0]
mov qword [rax], rcx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov qword [rsp + 0x88], 1
add rsp, 0x20
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727c40]
call fcn.00436ac0
nop
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
call fcn.004646a0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp fcn.004a7dc0