joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442d80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x442ff9
push rbp
mov rbp, rsp
sub rsp, 0x58
cmp byte [0x01bbb6a8], 0
je 0x442da5
nop dword [rax + rax]
call fcn.00461b60
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jg 0x442fe7
mov qword [rsp + 0x40], r14
nop
nop
lea rax, [0x01bb37b8]
call fcn.0040f080
mov ecx, dword [0x01c095e4]
mov dword [0x01bb388c], ecx
nop
nop
mov ecx, 1
lea rdx, [0x01bb3888]
xchg byte [rdx], cl
call fcn.0044c0a0
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0xa0]
mov dword [rcx + 4], 3
dec dword [0x01bb388c]
mov rcx, qword [0x01bafac0]
mov qword [rsp + 0x50], rcx
mov rdx, qword [0x01bafac8]
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x442e27
lea rax, [rsi + 1]
cmp rax, rdx
jge 0x442eb6
mov rbx, qword [rcx + rax*8]
cmp dword [rbx + 4], 2
jne 0x442e52
mov rsi, rax
mov eax, 2
mov edi, 3
lock cmpxchg dword [rbx + 4], edi
sete r8b
jmp 0x442e60
mov rsi, rax
mov edi, 3
xor r8d, r8d
nop dword [rax]
test r8b, r8b
je 0x442e23
cmp byte [0x01bbb6a8], 0
je 0x442ea8
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
nop dword [rax + rax]
call fcn.004621c0
mov rax, qword [rsp + 0x38]
call fcn.00461aa0
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
mov edi, 3
inc dword [rbx + 0x14]
dec dword [0x01bb388c]
jmp 0x442e23
nop
call fcn.00474160
xorps xmm15, xmm15
mov r14, qword [0x01c099d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x18], rax
jmp 0x442eeb
mov dword [rax + 4], 3
dec dword [0x01bb388c]
mov rax, qword [rsp + 0x18]
call fcn.0044d000
test rax, rax
jne 0x442ed9
nop
nop
mov ecx, dword [0x01bb388c]
mov dword [rsp + 0x14], ecx
lea rax, [0x01bb37b8]
call fcn.0040f2a0
mov ecx, dword [rsp + 0x14]
test ecx, ecx
jle 0x442f3d
jmp 0x442f1c
call fcn.0044c0a0
lea rax, [0x01bb3890]
mov ebx, 0x186a0
call fcn.0040f7c0
test al, al
je 0x442f17
nop
mov qword [0x01bb3890], 0
cmp dword [0x01bb388c], 0
jne 0x442f5f
mov rcx, qword [0x01bafac0]
mov rdx, qword [0x01bafac8]
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x442fda
mov eax, 0x29
lea rcx, [0x0106bb28]
mov dl, byte [0x01c09561]
test dl, dl
je 0x442fa5
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rcx
nop
nop
lea rax, [0x01c09760]
call fcn.0040f080
nop
nop
lea rax, [0x01c09760]
call fcn.0040f080
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
test rax, rax
jne 0x442fb0
add rsp, 0x58
pop rbp
ret
mov rbx, rax
mov rax, rcx
call fcn.0043dc80
mov rdi, qword [rcx + rax*8]
inc rax
cmp dword [rdi + 4], 3
mov edi, 0x2e
cmovne rbx, rdi
lea r8, [0x01075c5e]
cmovne rsi, r8
cmp rax, rdx
jl 0x442fbb
mov rax, rbx
mov rcx, rsi
jmp 0x442f6b
lea rax, [0x0104c718]
mov ebx, 0x1b
call fcn.0043dc80
nop
mov byte [rsp + 8], al
nop dword [rax]
call fcn.004705e0
movzx eax, byte [rsp + 8]
jmp fcn.00442d80
Function at 0x4453a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x445477
push rbp
mov rbp, rsp
sub rsp, 0x18
mov cl, byte [0x01bb3888]
nop dword [rax + rax]
test cl, cl
je 0x445465
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
je 0x4453f2
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x01bb37fc]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x445450
call fcn.0044b2e0
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x01bb37b8]
call fcn.0040f080
mov rax, qword [rsp + 0x10]
mov dword [rax + 4], 3
mov eax, dword [0x01bb388c]
lea ecx, [rax - 1]
mov dword [0x01bb388c], ecx
cmp eax, 1
jne 0x445436
lea rax, [0x01bb3890]
call fcn.0040f380
nop
nop
lea rax, [0x01bb37b8]
nop
call fcn.0040f2a0
call fcn.004447e0
add rsp, 0x18
pop rbp
ret
lea rax, [0x0104e46a]
mov ebx, 0x1c
nop dword [rax]
call fcn.0043dc80
lea rax, [0x0104c733]
mov ebx, 0x1b
call fcn.0043dc80
nop
call fcn.004705e0
nop dword [rax]
jmp fcn.004453a0
Function at 0x446b80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x446be7
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
je 0x446bd5
mov byte [rcx + 0xe4], 0
nop
mov ecx, 0xffffffff
lea rdx, [0x01bb37fc]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x446bc4
call fcn.00444f20
add rsp, 0x10
pop rbp
ret
lea rax, [0x01059c3e]
mov ebx, 0x21
call fcn.0043dc80
lea rax, [0x01054870]
mov ebx, 0x1f
call fcn.0043dc80
nop
call fcn.004705e0
jmp fcn.00446b80

Function at 0x447f20
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [r14 + 0x30]
mov rdx, r14
cmp qword [rcx], rdx
je 0x447f59
cmp qword [rcx + 0x50], rdx
je 0x447f59
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x38], rbx
movups xmmword [rdx + 0x58], xmm15
cmp qword [rdx + 0x50], 0
je 0x447f53
call fcn.00441120
add rsp, 0x10
pop rbp
ret
lea rax, [0x0104e4a2]
mov ebx, 0x1c
call fcn.0043dc80
nop
int3
Function at 0x44d2e0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x3b0]
cmp r12, qword [r14 + 0x10]
jbe 0x44d486
push rbp
mov rbp, rsp
sub rsp, 0x428
sub edi, ecx
shr edi, 1
movups xmmword [rsp + 0x20], xmm15
mov edx, edi
lea rdi, [rsp + 0x28]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00472a80
mov rbp, qword [rbp]
cmp edx, 0x80
jne 0x44d474
xor edx, edx
jmp 0x44d360
test byte [rax], al
lea esi, [rdx + rcx]
movzx esi, sil
mov rsi, qword [rax + rsi*8 + 0x198]
lea edi, [rdx + 1]
mov qword [rsp + rdx*8 + 0x20], rsi
mov edx, edi
nop
cmp edx, 0x80
jb 0x44d343
lea edx, [rcx + 0x80]
mov rsi, rax
mov eax, ecx
lock cmpxchg dword [rsi + 0x190], edx
sete dl
nop
test dl, dl
je 0x44d390
mov qword [rsp + 0x420], rbx
xor eax, eax
jmp 0x44d3a9
xor eax, eax
add rsp, 0x428
pop rbp
ret
mov rsi, qword [rsp + rdx*8 + 0x20]
mov qword [rbx + 0xa0], rsi
mov eax, edx
cmp eax, 0x80
jae 0x44d3ce
lea edx, [rax + 1]
mov rbx, qword [rsp + rax*8 + 0x20]
nop dword [rax + rax]
cmp rdx, 0x81
jb 0x44d39b
jmp 0x44d468
movups xmmword [rsp + 0x10], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x420]
mov qword [rsp + 0x18], rcx
nop
nop
lea rax, [0x01bb37b8]
call fcn.0040f080
mov rcx, qword [rsp + 0x18]
nop
nop
test rcx, rcx
je 0x44d43c
mov rdx, rcx
mov rbx, qword [rsp + 0x10]
mov qword [rcx + 0xa0], 0
mov rcx, qword [0x01bb3810]
nop
test rcx, rcx
je 0x44d42e
mov qword [rcx + 0xa0], rbx
jmp 0x44d435
mov qword [0x01bb3808], rbx
mov qword [0x01bb3810], rdx
add dword [0x01bb3818], 0x81
movups xmmword [rsp + 0x10], xmm15
nop
nop
lea rax, [0x01bb37b8]
call fcn.0040f2a0
mov eax, 1
add rsp, 0x428
pop rbp
ret
mov eax, edx
mov ecx, 0x81
call fcn.004728a0
lea rax, [0x010526d1]
mov ebx, 0x1e
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.0044d2e0

Function at 0x4501c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x450277
push rbp
mov rbp, rsp
sub rsp, 0x10
mov ecx, 0xffffffff
lock xadd dword [rax + 0x28], ecx
dec ecx
nop
test ecx, ecx
jge 0x450235
cmp ecx, 0xffffffff
je 0x450265
cmp ecx, 0xbfffffff
je 0x450265
mov ecx, 0xffffffff
lock xadd dword [rax + 0x2c], ecx
dec ecx
nop dword [rax]
test ecx, ecx
jne 0x450235
mov qword [rsp + 0x20], rax
nop
call fcn.0040f080
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x45022e
lea rax, [rcx + 0x118]
call fcn.0040f380
mov rax, qword [rsp + 0x20]
nop
nop
call fcn.0040f2a0
mov rax, qword [r14 + 0x30]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x45025f
cmp byte [r14 + 0xb1], 0
je 0x45025f
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x10
pop rbp
ret
lea rax, [0x0104c79f]
mov ebx, 0x1b
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004705e0
mov rax, qword [rsp + 8]
jmp fcn.004501c0
Function at 0x453840
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45396c
push rbp
mov rbp, rsp
sub rsp, 0x38
cmp rcx, rbx
jae 0x45389d
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
mov rsi, rax
mov rax, rbx
mul rdx
jo 0x453957
movabs rdx, 0x1000000000000
nop dword [rax + rax]
cmp rax, rdx
ja 0x453957
test rbx, rbx
jl 0x453957
mov rdx, qword [rsp + 0x28]
imul rcx, rdx
jmp 0x4538aa
mov rcx, qword [rax]
imul rcx, rbx
mov rsi, rax
mov rax, rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], rcx
cmp qword [rsi + 8], 0
jne 0x4538f8
mov qword [rsp + 0x18], rax
xor ebx, ebx
xor ecx, ecx
call fcn.00410820
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
cmp rcx, rbx
jae 0x45393d
mov qword [rsp + 0x30], rax
sub rbx, rcx
lea rdx, [rax + rcx]
mov rax, rdx
call fcn.00472fa0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
jmp 0x45393d
mov rbx, rsi
mov ecx, 1
call fcn.00410820
mov rcx, qword [rsp + 0x20]
test rcx, rcx
jbe 0x45393d
cmp byte [0x01c09e00], 0
je 0x45393d
mov qword [rsp + 0x30], rax
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
mov rax, rdx
mov rbx, rsi
call fcn.00418ac0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x60]
call fcn.004732a0
mov rax, qword [rsp + 0x30]
add rsp, 0x38
pop rbp
ret
nop
lea rax, [0x00ee20e0]
lea rbx, [0x014196e0]
call fcn.0043d500
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00453840

Function at 0x4539a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453a3f
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rsi, rax
mov rax, rdx
mov rdi, rax
mul rcx
jo 0x453a33
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x4539ef
test rbx, rbx
jl 0x4539ef
cmp rcx, rbx
jl 0x4539ef
mov rbx, rsi
mov ecx, 1
call fcn.00410820
add rsp, 0x18
pop rbp
ret
mov rax, rdi
mul rbx
jno 0x453a0b
nop
lea rax, [0x00ee20e0]
lea rbx, [0x014196e0]
call fcn.0043d500
movabs rcx, 0x1000000000000
cmp rax, rcx
ja 0x4539f7
test rbx, rbx
jl 0x4539f7
nop
lea rax, [0x00ee20e0]
lea rbx, [0x014196f0]
call fcn.0043d500
movabs rdx, 0x1000000000000
jmp 0x4539ef
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004539a0
Function at 0x454ec0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45506e
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x38], rsi
mov rdx, rax
mov qword [rsp + 0x30], rax
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov r10, qword [rcx]
movsxd r11, dword [rbx]
mov qword [rsp + 0x28], r11
mov rcx, qword [rcx + 0x118]
xor r12d, r12d
jmp 0x454f07
lea r12, [r13 + 8]
cmp r12, r11
jae 0x454f23
mov qword [rsp + 0x20], r12
mov r13, r12
shr r12, 3
add r12, qword [rbx + 8]
movzx r12d, byte [r12]
jmp 0x454f33
add rsp, 0x50
pop rbp
ret
mov rbx, qword [rsp + 0x68]
mov r11, qword [rsp + 0x28]
test r12b, r12b
je 0x454f03
bsf r15d, r12d
lea ebx, [r12 - 1]
add r15, r13
and r12d, ebx
lea rbx, [rdx + r15*8]
jmp 0x454f71
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
jmp 0x454f29
add r11, r9
mov qword [rdx + r15*8], r11
jmp 0x454f29
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r11, qword [rsp + 0x28]
mov r11, qword [rdx + r15*8]
mov qword [rsp + 0x18], r11
test rdi, rdi
je 0x454fa1
lea r13, [r11 - 1]
cmp r13, 0xfff
jae 0x454f9c
cmp dword [0x01c0a5a8], 0
jne 0x454fd2
mov r13, qword [rsp + 0x20]
jmp 0x454fa1
mov r13, qword [rsp + 0x20]
cmp r11, r10
jb 0x454f29
cmp r11, r8
jae 0x454f29
cmp rcx, rax
jbe 0x454f59
mov rsi, qword [rsp + 0x18]
add rsi, r9
mov rax, r11
lock cmpxchg qword [rbx], rsi
sete sil
test sil, sil
je 0x454f62
jmp 0x454f4d
mov qword [rsp + 0x48], rbx
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
mov ebx, dword [rdi + 4]
mov rax, rsi
call fcn.0045a0e0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x10], rbx
call fcn.0043f620
lea rax, [0x010526ef]
mov ebx, 0x1e
call fcn.0043fea0
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x10]
call fcn.0043fea0
lea rax, [0x0102ce4b]
mov ebx, 4
call fcn.0043fea0
mov rax, qword [rsp + 0x48]
call fcn.0043fe20
lea rax, [0x0102bed3]
mov ebx, 2
call fcn.0043fea0
mov rax, qword [rsp + 0x18]
call fcn.0043fd20
call fcn.0043f860
call fcn.0043f680
lea rax, [0x0105270d]
mov ebx, 0x1e
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00454ec0
Function at 0x456720
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45688a
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [rax], 0
je 0x456878
nop
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x456772
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
cmp rax, rdx
jne 0x456867
mov rsi, r14
cmp rsi, rdx
je 0x456867
cmp ecx, 2
jne 0x456867
cmp qword [rax + 0x70], 0
jne 0x456794
cmp byte [rax + 0xb4], 0
je 0x456786
xor ecx, ecx
jmp 0x456796
nop
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x456796
xor ecx, ecx
test cl, cl
je 0x456856
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x4567bd
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x2b8], 0
jne 0x456845
cmp dword [0x01c0a59c], 0
jg 0x45683f
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x128]
mov rax, rcx
call fcn.0045a520
test rax, rax
je 0x4567eb
cmp byte [rax + 0x28], 6
jne 0x4567eb
add rsp, 0x10
pop rbp
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rdx, rcx
mov rcx, rdx
shr rdx, 1
cmp rdx, 0x2000
jb 0x456839
mov rsi, qword [rax + 0x38]
sub rbx, rsi
lea rsi, [rbx + 0x320]
shr rcx, 2
nop
cmp rcx, rsi
ja 0x45682b
add rsp, 0x10
pop rbp
ret
mov rbx, rdx
call fcn.00455680
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
lea rax, [0x0104ab55]
mov ebx, 0x1a
call fcn.0043dc80
lea rax, [0x010458e2]
mov ebx, 0x17
call fcn.0043dc80
lea rax, [0x01048e2f]
mov ebx, 0x19
call fcn.0043dc80
lea rax, [0x0104e52e]
mov ebx, 0x1c
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
call fcn.004705e0
mov rax, qword [rsp + 8]
jmp fcn.00456720
Function at 0x457600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4577f0
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x78], rbx
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x45763a
add r10, 0x10
lea r11, [rbx + 1]
mov rbx, r10
mov r9, r8
mov r8, rsi
mov rsi, r11
cmp rcx, rsi
jle 0x457671
mov r10, rbx
mov r11, qword [rbx + 8]
test r11, r11
jne 0x457656
mov rbx, rsi
mov rsi, r8
mov r8, r9
jmp 0x457626
lea r8, [r9 + r11]
nop word [rax + rax]
cmp r9, r8
jg 0x4577de
inc rdi
mov rbx, rsi
jmp 0x457626
test rdi, rdi
je 0x457702
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x58], rdx
cmp rdi, 1
jne 0x4576dc
test rax, rax
jne 0x4576b6
cmp rcx, r8
jbe 0x4577d6
mov rsi, r8
shl r8, 4
mov rdi, qword [rdx + r8]
cmp qword [r14], rdi
ja 0x4576c0
mov r8, qword [r14 + 8]
cmp rdi, r8
jb 0x4576dc
jmp 0x4576c0
mov rsi, r8
nop dword [rax]
cmp rcx, rsi
jbe 0x4577ce
shl rsi, 4
mov rax, qword [rdx + rsi]
mov rbx, qword [rdx + rsi + 8]
add rsp, 0x60
pop rbp
ret
mov rbx, r9
nop
call fcn.00457cc0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x80]
xor r9d, r9d
nop
jmp 0x45772c
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
sub rsi, r10
mov r11, rsi
neg r11
sar r11, 0x3f
and r11, r10
add rdx, 0x10
inc r9
sub r12, r10
add rcx, r11
mov rdi, r12
cmp r8, r9
jle 0x4577bd
mov r10, qword [rdx + 8]
mov r11, qword [rdx]
cmp rdi, r10
mov r12, rdi
cmovg rdi, r10
cmp rcx, r11
jne 0x457750
cmp r12, r10
jmp 0x4577b5
mov qword [rsp + 0x18], r10
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r12
mov rax, rcx
mov rbx, r11
mov rcx, rdi
call fcn.004732a0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x38]
mov r10, rax
mov r12, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jae 0x45770c
jmp 0x4577c3
add rsp, 0x60
pop rbp
ret
mov rax, r10
mov rcx, r12
call fcn.00472960
mov rax, rsi
call fcn.004728a0
mov rax, r8
call fcn.004728a0
lea rax, [0x0105052b]
mov ebx, 0x1d
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00457600
Function at 0x464c20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x464dce
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
call fcn.0043f620
lea rax, [0x0104e59e]
mov ebx, 0x1c
call fcn.0043fea0
mov rax, qword [rsp + 0x50]
call fcn.0043fbe0
lea rax, [0x0102c30a]
mov ebx, 3
call fcn.0043fea0
call fcn.0043f680
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rcx
xor edx, edx
jmp 0x464cb9
mov rdx, qword [rsp + 0x38]
inc rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
jge 0x464d3d
mov qword [rsp + 0x38], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x30], rcx
mov rax, rcx
call fcn.0045a520
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rbx
nop
test rax, rax
je 0x464cf3
mov edx, dword [rax + 4]
mov r9d, dword [rax + 0x24]
movzx r10d, byte [rax + 0x28]
jmp 0x464cfd
xor r10d, r10d
xor r9d, r9d
xor edx, edx
xor ebx, ebx
mov r11, qword [rsp + 0x38]
test r11, r11
sete sil
mov rax, rbx
mov ebx, edx
mov ecx, r9d
mov edi, r10d
xor r8d, r8d
call fcn.004653c0
nop dword [rax]
test al, al
je 0x464ca7
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.00464e20
jmp 0x464ca7
cmp qword [rsp + 0x78], 0x32
jne 0x464d65
call fcn.0043f620
lea rax, [0x0105490b]
mov ebx, 0x1f
call fcn.0043fea0
nop dword [rax + rax]
call fcn.0043f680
mov rax, qword [rsp + 0x90]
call fcn.0045a520
test rax, rax
jne 0x464d7b
xor ecx, ecx
jmp 0x464daa
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0x24]
movzx edi, byte [rax + 0x28]
xor esi, esi
xor r8d, r8d
mov rax, rbx
mov ebx, edx
call fcn.004653c0
mov rbx, qword [rsp + 0x20]
mov ecx, eax
mov rax, qword [rsp + 0x40]
test cl, cl
je 0x464dc8
cmp qword [rsp + 0x88], 1
je 0x464dc8
mov rcx, qword [rsp + 0x90]
xor edi, edi
call fcn.00463bc0
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00464c20
Function at 0x4670a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xa8]
cmp r12, qword [r14 + 0x10]
jbe 0x467ca6
push rbp
mov rbp, rsp
sub rsp, 0x120
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x108], rcx
movups xmmword [rsp + 0x110], xmm15
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rbx
lea rax, [0x00ed3220]
mov rbx, rcx
lea rcx, [rsp + 0x110]
call fcn.004122c0
test bl, bl
jne 0x467681
lea rax, [0x00ed3220]
mov rbx, qword [rsp + 0x108]
lea rcx, [rsp + 0x110]
call fcn.004126c0
test byte [rax], al
mov rax, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x138]
nop dword [rax + rax]
cmp rax, rdx
je 0x467673
movzx ecx, byte [rax + 0x17]
mov ebx, ecx
and ecx, 0x1f
movzx esi, byte [rdx + 0x17]
and esi, 0x1f
nop dword [rax]
cmp sil, cl
jne 0x467668
mov byte [rsp + 0x1f], bl
mov byte [rsp + 0x1e], cl
call fcn.00466120
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x138]
call fcn.00466120
mov rcx, qword [rsp + 0x78]
cmp rbx, rcx
jne 0x46765d
mov rbx, rax
mov rax, qword [rsp + 0x100]
call fcn.00406c40
test al, al
je 0x46765d
mov rax, qword [rsp + 0x130]
movzx esi, byte [rax + 0x14]
test sil, 1
jne 0x4671cc
xor esi, esi
jmp 0x46721b
movzx esi, byte [rax + 0x17]
and esi, 0x1f
add rsi, 0xffffffffffffffef
cmp rsi, 8
ja 0x467217
lea rcx, [0x014281e0]
jmp qword [rcx + rsi*8]
lea rsi, [rax + 0x30]
mov rdi, qword [rsp + 0x138]
movzx r8d, byte [rdi + 0x14]
test r8b, 1
jne 0x467233
xor r8d, r8d
jmp 0x467286
movzx r8d, byte [rdi + 0x17]
and r8d, 0x1f
add r8, 0xffffffffffffffef
cmp r8, 8
ja 0x467282
lea rcx, [0x01428240]
jmp qword [rcx + r8*8]
lea r8, [rdi + 0x30]
test rsi, rsi
jne 0x467299
test r8, r8
je 0x467320
test rsi, rsi
je 0x46729e
test r8, r8
jne 0x4672a9
xor eax, eax
add rsp, 0x120
pop rbp
ret
mov qword [rsp + 0xa0], r8
mov ebx, dword [rsi]
call fcn.00466280
call fcn.00401ee0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0xc0], rax
mov rcx, qword [rsp + 0xa0]
mov ecx, dword [rcx]
mov rax, qword [rsp + 0x138]
mov ebx, ecx
nop
call fcn.00466280
call fcn.00401ee0
mov rcx, qword [rsp + 0x40]
cmp rbx, rcx
jne 0x467652
mov rbx, rax
mov rax, qword [rsp + 0xc0]
call fcn.00406c40
test al, al
je 0x467652
mov rax, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x138]
movzx esi, byte [rsp + 0x1e]
test sil, sil
je 0x46733e
cmp sil, 0x10
ja 0x46733e
mov eax, 1
add rsp, 0x120
pop rbp
ret
movzx esi, byte [rsp + 0x1f]
and esi, 0x1f
add rsi, 0xffffffffffffffef
cmp rsi, 9
ja 0x467c66
lea rcx, [0x0142a060]
jmp qword [rcx + rsi*8]
xor eax, eax
add rsp, 0x120
pop rbp
ret
xor eax, eax
add rsp, 0x120
pop rbp
ret
xor eax, eax
add rsp, 0x120
pop rbp
ret
mov eax, 1
add rsp, 0x120
pop rbp
ret
mov eax, 1
add rsp, 0x120
pop rbp
ret
call fcn.0043f620
lea rax, [0x01052767]
mov ebx, 0x1e
call fcn.0043fea0
movzx eax, byte [rsp + 0x1f]
and eax, 0x1f
call fcn.0043fbe0
call fcn.0043f860
call fcn.0043f680
lea rax, [0x0105059f]
mov ebx, 0x1d
nop
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004670a0
Function at 0x46dee0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46df5a
push rbp
mov rbp, rsp
sub rsp, 0x18
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x46df45
mov qword [rsp + 0x28], rax
xor ebx, ebx
xor ecx, ecx
call fcn.00410820
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jl 0x46df40
mov rdx, rax
neg rdx
nop dword [rax + rax]
cmp rcx, rdx
ja 0x46df2e
mov rbx, rcx
add rsp, 0x18
pop rbp
ret
test rax, rax
je 0x46df38
call fcn.00467d60
call fcn.00467e00
nop dword [rax]
call fcn.00467d60
nop
lea rax, [0x00ee20e0]
lea rbx, [0x014196e0]
call fcn.0043d500
nop
mov qword [rsp + 8], rax
nop
call fcn.004705e0
mov rax, qword [rsp + 8]
jmp fcn.0046dee0
Function at 0x472420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x01c0a2a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x01c09552], 0
je 0x472456
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x01c0a600]
aesenc xmm0, xmmword [0x01c0a610]
aesenc xmm0, xmmword [0x01c0a620]
movq rax, xmm0
ret
jmp 0x40d920

Function at 0x477280
Capabilities:
Reference http user-agent string

Disassembly:
xorps xmm15, xmm15
mov r14, qword [0x01c099d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp fcn.004410e0