joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44efc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44f217
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
test rcx, rcx
je 0x44eff7
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x44f1c8
xor edx, edx
xor esi, esi
xor edi, edi
nop dword [rax]
test rdx, rdx
je 0x44f0c5
cmp rdx, 1
jne 0x44f062
test rax, rax
je 0x44f020
mov rdx, rsi
mov esi, 1
jmp 0x44f067
cmp rcx, rsi
jbe 0x44f1b0
mov rdx, rsi
shl rsi, 4
mov r8, qword [rbx + rsi]
mov rsi, qword [rbx + rsi + 8]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x58]
mov r8, qword [r14 + 8]
cmp qword [r14], rsi
ja 0x44f05a
cmp rsi, r8
setb sil
jmp 0x44f05c
xor esi, esi
xor esi, 1
nop
jmp 0x44f067
mov rdx, rsi
xor esi, esi
test sil, sil
jne 0x44f0a9
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rbx
mov rbx, rdi
nop
call fcn.0044f700
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x44f0db
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov r8, qword [rsp + 0x80]
xor r9d, r9d
jmp 0x44f0f5
cmp rcx, rdx
jbe 0x44f0d3
shl rdx, 4
mov rax, qword [rbx + rdx]
mov rbx, qword [rbx + rdx + 8]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
call fcn.00465080
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
add r8, 0x10
mov rcx, rsi
mov rsi, r9
mov r9, rdi
mov rdi, r11
mov r10, qword [r8 + 8]
cmp rdi, r10
mov r11, rdi
cmovg rdi, r10
mov r12, qword [r8]
cmp rcx, r12
jne 0x44f110
cmp r11, r10
jmp 0x44f175
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x18], r10
mov rax, rcx
mov rbx, r12
mov rcx, rdi
call fcn.00465a20
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
mov r10, rax
mov r11, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jb 0x44f1a5
lea rdi, [r9 + 1]
sub rsi, r10
sub r11, r10
mov r9, rsi
neg rsi
sar rsi, 0x3f
and r10, rsi
lea rsi, [rcx + r10]
cmp rdx, rdi
jg 0x44f0e5
nop dword [rax + rax]
jmp 0x44f0db
mov rax, r10
mov rcx, r11
call fcn.00465140
mov rax, rsi
call fcn.00465080
add rbx, 0x10
mov r10, rsi
mov rsi, r9
mov r9, r8
mov r8, r10
mov r10, qword [rbx + 8]
test r10, r10
jne 0x44f1df
mov r10, r9
mov r9, rsi
mov rsi, r8
mov r8, r10
jmp 0x44f1ee
lea r8, [r9 + r10]
cmp r9, r8
jg 0x44f205
inc rdi
mov r9, rsi
inc r9
cmp rcx, r9
jg 0x44f1b8
mov rbx, rdx
mov rdx, rdi
mov rdi, r8
nop
jmp 0x44f000
lea rax, [0x006bf5b7]
mov ebx, 0x1d
call fcn.00437c00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044efc0
Function at 0x453980
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453aaf
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
cmp qword [rax + 8], 0
nop dword [rax]
jle 0x453a9d
cmp qword [rax + 0x10], 0
jl 0x453a8c
cmp dword [rax + 0x40], 0
jne 0x453a7b
mov qword [rsp + 0x48], rax
mov dword [rax + 0x40], 1
mov qword [rsp + 0x28], r14
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x10], rdx
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
mov qword [rsp + 0x30], rcx
test byte [rcx], al
lea rbx, [rcx + 0x2280]
mov qword [rsp + 0x20], rbx
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi + 0x30]
mov qword [rsp + 0x18], rsi
nop
mov rax, rbx
call fcn.0040b680
mov rax, qword [rsp + 0x30]
call fcn.004547e0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
call fcn.00453ae0
nop
nop
mov rax, qword [rsp + 0x20]
call fcn.0040b8a0
mov rax, qword [rsp + 0x10]
nop
call fcn.00440360
nop
mov rcx, qword [rsp + 0x18]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x453a71
cmp byte [r14 + 0xb1], 0
je 0x453a71
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006c3e85]
mov ebx, 0x26
call fcn.00437c00
lea rax, [0x006c1b76]
mov ebx, 0x21
call fcn.00437c00
lea rax, [0x006be4bb]
mov ebx, 0x1b
call fcn.00437c00
nop
mov qword [rsp + 8], rax
call fcn.004629a0
mov rax, qword [rsp + 8]
nop
jmp fcn.00453980

Function at 0x4542e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45478d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r8
test rbx, rbx
jle 0x45477b
test rcx, rcx
jl 0x45476a
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x30], rsi
jmp 0x45433c
mov rax, r11
mov edx, dword [rax + 0x40]
mov r10d, edx
cmp r10, 9
ja 0x454537
lea r11, [0x0073e2a0]
jmp qword [r11 + r10*8]
call fcn.00455ce0
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
mov r11, qword [rsp + 0x48]
mov r12d, 6
jmp 0x454339
lea rax, [0x006c1b76]
mov ebx, 0x21
call fcn.00437c00
lea rax, [0x006be4bb]
mov ebx, 0x1b
call fcn.00437c00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004542e0
Function at 0x45cf40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x45dba6
sub rsp, 0x120
mov qword [rsp + 0x118], rbp
lea rbp, [rsp + 0x118]
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rbx
lea rax, [0x006716e0]
mov rbx, rcx
lea rcx, [rsp + 0x108]
call fcn.0040e9c0
test bl, bl
jne 0x45d541
mov rdx, qword [rsp + 0x128]
mov qword [rsp + 0x108], rdx
mov rsi, qword [rsp + 0x130]
mov qword [rsp + 0x110], rsi
lea rax, [0x006716e0]
mov rbx, qword [rsp + 0x100]
lea rcx, [rsp + 0x108]
call fcn.0040ee00
test byte [rax], al
mov rax, qword [rsp + 0x128]
mov rdx, qword [rsp + 0x130]
nop
cmp rax, rdx
je 0x45d52b
movzx ecx, byte [rax + 0x17]
mov ebx, ecx
and ecx, 0x1f
movzx esi, byte [rdx + 0x17]
and esi, 0x1f
nop dword [rax]
cmp sil, cl
jne 0x45d519
mov byte [rsp + 0x1b], bl
mov byte [rsp + 0x1a], cl
call fcn.0045bc80
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x68], rbx
mov rax, qword [rsp + 0x130]
call fcn.0045bc80
mov rcx, qword [rsp + 0x68]
cmp rbx, rcx
jne 0x45d06e
mov rbx, rax
mov rax, qword [rsp + 0xf8]
call fcn.00402da0
test al, al
jne 0x45d081
xor eax, eax
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
nop
ret
mov rax, qword [rsp + 0x128]
call fcn.0045bd20
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x130]
nop
call fcn.0045bd20
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x45d0c5
test rax, rax
je 0x45d14d
nop dword [rax + rax]
test rcx, rcx
je 0x45d0ca
test rax, rax
jne 0x45d0dc
xor eax, eax
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov qword [rsp + 0x98], rax
mov ebx, dword [rcx]
mov rax, qword [rsp + 0x128]
call fcn.0045be40
call fcn.0045c5a0
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x98]
mov ecx, dword [rcx]
mov rax, qword [rsp + 0x130]
mov ebx, ecx
call fcn.0045be40
nop
call fcn.0045c5a0
mov rcx, qword [rsp + 0x30]
cmp rbx, rcx
jne 0x45d507
mov rbx, rax
mov rax, qword [rsp + 0xb8]
nop
call fcn.00402da0
test al, al
je 0x45d507
movzx esi, byte [rsp + 0x1a]
dec esi
cmp sil, 0xf
jbe 0x45d4f2
movzx esi, byte [rsp + 0x1b]
and esi, 0x1f
add rsi, 0xffffffffffffffef
cmp rsi, 9
ja 0x45db60
lea rax, [0x0073e3c0]
jmp qword [rax + rsi*8]
mov eax, 1
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
xor eax, eax
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
xor eax, eax
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov eax, 1
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
nop
ret
mov eax, 1
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
call fcn.004394c0
lea rax, [0x006bfe54]
mov ebx, 0x1e
call fcn.00439dc0
movzx eax, byte [rsp + 0x1b]
and eax, 0x1f
nop
call fcn.00439ac0
call fcn.00439720
call fcn.00439540
lea rax, [0x006bf4b2]
mov ebx, 0x1d
nop dword [rax + rax]
call fcn.00437c00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0045cf40
Function at 0x464ac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40350f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409e20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4034e0
cmp byte [0x00913b23], 0
je 0x464ad5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x461aa0
jmp 0x4034e0

Function at 0x464ae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00913fe0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00913b23], 0
je 0x464b15
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00914340]
aesenc xmm0, xmmword [0x00914350]
aesenc xmm0, xmmword [0x00914360]
movq rax, xmm0
ret
jmp 0x40a020

Function at 0x464b20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00913fe0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00913b23], 0
je 0x464b56
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00914340]
aesenc xmm0, xmmword [0x00914350]
aesenc xmm0, xmmword [0x00914360]
movq rax, xmm0
ret
jmp 0x40a080

Function at 0x4664e0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x009142c0]
mov qword [rsp + 8], rdx
lea r8d, [0x00913b44]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00464a00
add rsp, 0x30
ret

Function at 0x466e80
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rbx, qword [0x008afb60]
mov rcx, qword [0x008afb68]
mov eax, 2
call fcn.00455d60
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x43afc0
Function at 0x46b800
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b913
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop
cmp rcx, 0x12
ja 0x46b880
cmp rcx, 0x11
jne 0x46b84f
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x46b83e
lea rax, [0x0073e708]
jmp 0x46b842
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp rcx, 0x12
jne 0x46b8ff
mov rcx, qword [rax + 0x30]
nop dword [rax]
test rcx, rcx
je 0x46b86e
lea rax, [0x0073e708]
jmp 0x46b872
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp rcx, 0x15
jne 0x46b8a9
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x46b898
lea rax, [0x0073e708]
jmp 0x46b89c
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp rcx, 0x16
jne 0x46b8d3
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x46b8c2
lea rax, [0x0073e708]
nop
jmp 0x46b8c6
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp rcx, 0x17
jne 0x46b8ff
mov rcx, qword [rax + 0x30]
nop dword [rax]
test rcx, rcx
je 0x46b8ee
lea rax, [0x0073e708]
jmp 0x46b8f2
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006654e0]
lea rbx, [0x0073a550]
call fcn.00437460
nop
mov qword [rsp + 8], rax
call fcn.004629a0
mov rax, qword [rsp + 8]
jmp fcn.0046b800
Function at 0x4b29a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2b0b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
lea rax, [0x006b4f78]
mov ebx, 6
call fcn.004a01a0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004b2b20]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
nop
call fcn.004032a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
nop
cmp rcx, 0xffffffffffffffff
je 0x4b2ac9
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4b2b05
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
nop
cmp rbx, rcx
jb 0x4b2af8
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
nop
call fcn.00465140
call fcn.004650c0
nop
call fcn.004629a0
jmp fcn.004b29a0
Function at 0x4cdae0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4cdd43
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4cdd27
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4cdb2d
xor ebx, ebx
xor ecx, ecx
jmp 0x4cdb40
mov rax, rdx
call fcn.004bfcc0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4cdc5b
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00472c80
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006b441b]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044f300
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004032a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4cdc1e
xor eax, eax
lea rbx, [0x006b4450]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006b45b7]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044f3e0
jmp 0x4cdc4b
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x006b442f]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044f300
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.00472c80
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.004032a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4cdcea
xor eax, eax
lea rbx, [0x006b4450]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006b45b7]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044f3e0
jmp 0x4cdd17
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006b442f]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044f300
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006b4b4e]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.004629a0
mov rax, qword [rsp + 8]
jmp fcn.004cdae0
Function at 0x4e0780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e0849
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx esi, byte [rax + 0x17]
and esi, 0x1f
nop
cmp rsi, 0x13
jne 0x4e0816
movzx esi, byte [rax + 0x14]
test sil, 1
je 0x4e07b7
mov ecx, 0x48
jmp 0x4e07bc
mov ecx, 0x38
movzx edx, word [rax + 0x30]
test dx, dx
jne 0x4e07cb
xor edx, edx
xor esi, esi
jmp 0x4e07d8
lea rsi, [rax + rcx]
cmp rdx, 0x100000
ja 0x4e080c
cmp rbx, rdx
jae 0x4e0801
mov rcx, qword [rsi + rbx*8]
test rcx, rcx
je 0x4e07ef
lea rax, [0x0073f900]
jmp 0x4e07f3
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov rax, rbx
mov rcx, rdx
call fcn.00465080
mov ebx, 0x100000
call fcn.00465180
call fcn.004e0140
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006bf45b]
call fcn.0044f260
call fcn.0040aec0
mov rbx, rax
lea rax, [0x006654e0]
call fcn.00437460
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004e0780

Function at 0x4e0880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e08fc
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x15
jne 0x4e08c9
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x4e08b8
lea rax, [0x0073f900]
jmp 0x4e08bc
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004e0140
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006bf478]
call fcn.0044f260
call fcn.0040aec0
mov rbx, rax
lea rax, [0x006654e0]
call fcn.00437460
nop
mov qword [rsp + 8], rax
call fcn.004629a0
mov rax, qword [rsp + 8]
jmp fcn.004e0880
Function at 0x4e11a0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e13eb
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x4e124c
mov qword [rsp + 0x88], rax
lea rbx, [0x006ae1e0]
mov rcx, rax
lea rax, [0x008be600]
call fcn.0046fb00
test cl, cl
jne 0x4e1231
mov rax, qword [rsp + 0x88]
call fcn.004e0140
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x006b4420]
call fcn.0044f260
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.004e24c0
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x4e126d
lea rdx, [0x006adf20]
cmp rax, rdx
jne 0x4e125b
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
call fcn.00460060
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x0066c880]
call fcn.0040aa80
inc rdx
cmp rbx, rdx
jle 0x4e12b8
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4e126a
lea rax, [0x008be600]
lea rbx, [0x006ae1e0]
lea rdi, [0x006adf20]
call fcn.00470320
lea rdx, [0x006adf20]
nop dword [rax]
cmp rax, rdx
jne 0x4e13db
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x00660740]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x00684dc0]
nop
call fcn.0040d780
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00913f20], 0
jne 0x4e131a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x4e1329
mov rbx, rax
lea rax, [0x00684dc0]
call fcn.00413c80
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.004dfba0
call fcn.00460120
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x4e1376
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x4e1368
mov dword [rsi + 0x10], edx
cmp dword [0x00913f20], 0
jne 0x4e138e
mov qword [rsi + 0x30], rcx
jmp 0x4e1397
lea rdi, [rsi + 0x30]
call fcn.00464ce0
lea rax, [0x008be600]
lea rbx, [0x006ae1e0]
lea rdi, [0x006adf20]
call fcn.00470320
lea rdx, [0x006adf20]
cmp rax, rdx
jne 0x4e13cc
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x0066c880]
call fcn.0040aa80
mov rbx, rdx
lea rcx, [0x0066c880]
call fcn.0040aa80
nop
mov qword [rsp + 8], rax
call fcn.004629a0
mov rax, qword [rsp + 8]
jmp fcn.004e11a0