joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47fae0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47fd39
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0xa0], rdi
mov rax, rcx
call fcn.0047dcc0
cmp rax, 0x11
jne 0x47fbc0
mov rbx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x70]
nop
cmp qword [rdx + 0x40], rbx
jbe 0x47fd25
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x58], rdx
mov rsi, qword [rdx]
imul rbx, rsi
mov rax, qword [rsp + 0x68]
lea rcx, [0x0064ce86]
mov edi, 0x19
call fcn.0047b660
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
call fcn.0047dce0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
call fcn.0047aaa0
mov rcx, qword [rsp + 0x38]
and ecx, 0x180
mov rdx, qword [rsp + 0x30]
or rcx, rdx
or rcx, rax
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
cmp rax, 0x17
jne 0x47fc50
mov rbx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x68]
nop word [rax + rax]
cmp qword [rdx + 8], rbx
jbe 0x47fd0f
mov r8, qword [rsp + 0x70]
mov r8, qword [r8 + 0x30]
mov qword [rsp + 0x50], r8
mov rax, qword [rdx]
mov rcx, qword [r8]
lea rdi, [0x0064596a]
mov esi, 9
call fcn.00482180
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
call fcn.0047dce0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
call fcn.0047aaa0
mov rcx, qword [rsp + 0x38]
or rcx, rax
or rcx, 0x180
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
cmp rax, 0x18
jne 0x47fcc9
mov rbx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x68]
cmp qword [rdx + 8], rbx
jbe 0x47fcb6
mov rax, qword [rdx]
mov ecx, 1
lea rdi, [0x0064596a]
mov esi, 9
nop dword [rax]
call fcn.00482180
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
call fcn.0047dce0
or rax, 0x88
mov rdx, qword [0x007df0c0]
mov rbx, qword [rsp + 0x60]
mov rcx, rax
mov rax, rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x005fe120]
lea rbx, [0x00684e10]
call fcn.00436780
mov rax, qword [rsp + 0x38]
call fcn.0047dcc0
mov qword [rsp + 0x28], rax
lea rax, [0x0061aa40]
nop
call fcn.0040d1e0
mov qword [rax + 8], 0x13
lea rcx, [0x00649adc]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006075a0]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684c90]
nop dword [rax]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684e00]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0047fae0
Function at 0x47ffc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4800fb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
test rcx, rcx
je 0x4800c5
test dil, dil
je 0x47fffd
test rcx, 0x60
jne 0x4800af
bt ecx, 9
jae 0x48001d
mov rdi, rbx
mov rsi, rcx
mov ebx, 9
mov rcx, rax
lea rax, [0x006457f9]
call fcn.00479a20
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rbx
mov rax, rcx
call fcn.0047dcc0
cmp rax, 0x14
jne 0x48008c
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.00480d00
test rax, rax
je 0x480076
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
mov rbx, qword [rcx + 8]
nop
test rdx, rdx
je 0x480069
mov rdx, qword [rdx + 8]
mov rax, rdx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.0047dda0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x005fe120]
lea rbx, [0x00684e20]
nop dword [rax]
call fcn.00436780
lea rax, [0x0061aa40]
call fcn.0040d1e0
mov qword [rax + 8], 0x17
lea rcx, [0x0064bce0]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006075a0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0047ffc0

Function at 0x4808e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48099c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
test byte [rax], al
lea rcx, [rax + 0x18]
mov qword [rsp + 0x30], rcx
mov rax, rcx
call fcn.004808c0
test al, al
je 0x480988
mov rax, qword [rsp + 0x30]
call fcn.0045b560
nop
test rax, rax
je 0x480975
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx]
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x20], rdx
mov rax, qword [rcx + 0x10]
nop
call fcn.0047dce0
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x20]
call fcn.0047aaa0
mov rbx, qword [rsp + 0x18]
or rbx, rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.00480c40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x005fe120]
lea rbx, [0x00684e40]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684e30]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.004808e0
Function at 0x4809c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x480a7c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
test byte [rax], al
lea rcx, [rax + 0x18]
mov qword [rsp + 0x30], rcx
mov rax, rcx
call fcn.004808c0
test al, al
je 0x480a68
mov rax, qword [rsp + 0x30]
call fcn.0045b580
nop
test rax, rax
je 0x480a55
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx]
mov rdx, qword [rdx + 0x38]
mov qword [rsp + 0x20], rdx
mov rax, qword [rcx + 0x10]
nop
call fcn.0047dce0
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x20]
call fcn.0047aaa0
mov rbx, qword [rsp + 0x18]
or rbx, rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.00480c40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x005fe120]
lea rbx, [0x00684e60]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684e50]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.004809c0

Function at 0x480aa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x480b7c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.00480280
test al, al
je 0x480b68
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + 0x18]
mov qword [rsp + 0x18], rax
call fcn.004808c0
test al, al
je 0x480b0a
mov rax, qword [rsp + 0x18]
call fcn.0045b560
test rax, rax
je 0x480b55
mov rax, qword [rsp + 0x18]
call fcn.0045b520
jmp 0x480b37
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
mov rax, qword [rdx]
call fcn.0047dd00
mov rdx, qword [rsp + 0x30]
mov rdx, qword [rdx]
mov rbx, rax
mov rcx, qword [rsp + 0x18]
mov rax, rdx
call fcn.0045b4c0
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.0045b560
test rax, rax
setne al
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00684e80]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684e70]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.00480aa0
Function at 0x481080
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4811fa
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.0047dcc0
cmp rax, 0x15
ja 0x481123
nop
cmp rax, 0x12
jne 0x4810d0
mov rax, qword [rsp + 0x30]
jmp 0x481171
cmp rax, 0x13
jne 0x481112
mov rcx, qword [rsp + 0x28]
bt ecx, 9
nop
jb 0x481103
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
call fcn.0047dd00
test rax, rax
je 0x4810f9
mov rax, qword [rax]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00479ce0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp rax, 0x15
jne 0x4811a1
mov rax, qword [rsp + 0x30]
jmp 0x481171
cmp rax, 0x16
jne 0x481160
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], 0
jne 0x481171
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov qword [rsp + 0x18], rax
call fcn.0045b7a0
test al, al
je 0x4811e6
mov rax, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp rax, 0x17
je 0x48118f
cmp rax, 0x1a
jne 0x4811a1
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.0047dd00
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x28]
call fcn.0047dcc0
mov qword [rsp + 0x20], rax
lea rax, [0x0061aa40]
call fcn.0040d1e0
mov qword [rax + 8], 0x15
lea rcx, [0x0064aaea]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006075a0]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684e90]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00481080
Function at 0x481ba0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x481cdb
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rcx, rcx
je 0x481ca5
bt ecx, 9
jae 0x481c6b
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
nop
call fcn.0047aaa0
mov rcx, qword [rsp + 0x18]
sar rcx, 0xa
cmp rax, 0x14
jne 0x481c27
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x38]
nop dword [rax]
cmp qword [rax + 0x40], rcx
jbe 0x481c92
mov ebx, dword [rdx + rcx*8 + 4]
call fcn.0047a840
mov rbx, rax
lea rax, [0x006880c0]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x10], rcx
mov rax, qword [rsp + 0x20]
call fcn.0047ab00
mov rcx, qword [rsp + 0x10]
nop dword [rax + rax]
cmp rbx, rcx
jbe 0x481c7f
shl rcx, 4
mov ebx, dword [rax + rcx + 4]
mov rax, qword [rsp + 0x20]
call fcn.0047a840
mov rbx, rax
lea rax, [0x006880c0]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rbx, rax
lea rax, [0x006880c0]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x005fe120]
lea rbx, [0x00684d80]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684d80]
call fcn.00436780
lea rax, [0x0061aa40]
call fcn.0040d1e0
mov qword [rax + 8], 0x12
lea rcx, [0x00649205]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006075a0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.00481ba0
Function at 0x4825a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4826ff
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x98]
mov rax, rbx
call rdx
nop dword [rax + rax]
cmp rax, 0x17
jne 0x4826eb
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jl 0x4826d8
mov rdx, qword [rsp + 0x48]
nop dword [rax]
test rdx, rdx
jl 0x4826c5
cmp rcx, rdx
jg 0x4826b1
lea rax, [0x00620ca0]
call fcn.0040d1e0
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x38]
call rdx
lea rcx, [0x006880c0]
cmp rax, rcx
jne 0x48269e
mov rax, rbx
mov rbx, qword [rsp + 0x48]
call fcn.0045b3a0
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rbx + 0x10], rcx
mov qword [rbx], rax
mov rax, qword [rsp + 0x30]
lea rcx, [0x006880c0]
cmp rax, rcx
jne 0x48268b
mov rax, qword [rsp + 0x38]
mov ecx, 0x97
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rbx, [0x0063e560]
lea rcx, [0x00637020]
call fcn.0040a560
lea rbx, [0x0063e560]
lea rcx, [0x00637020]
call fcn.0040a560
lea rax, [0x005fe120]
lea rbx, [0x00684cd0]
nop
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684cc0]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684cb0]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684ca0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004825a0

Function at 0x48be20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48be66
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
call fcn.0048bea0
nop
test rdi, rdi
jne 0x48be4f
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x00685140]
nop dword [rax]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0048be20
Function at 0x48daa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48db86
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov dword [rsp + 0x1c], eax
mov qword [rsp + 0x20], 0
mov ebx, eax
xor ecx, ecx
lea rdi, [rsp + 0x20]
xor eax, eax
call fcn.0048ff20
test rax, rax
je 0x48db4f
lea rdx, [0x00615ac0]
cmp qword [rax + 8], rdx
je 0x48daec
test rax, rax
jmp 0x48db4f
cmp qword [rbx], 0x7a
je 0x48daf7
test rax, rax
jmp 0x48db4f
mov rcx, qword [rsp + 0x20]
lea rax, [0x005fe2e0]
mov rbx, rcx
call fcn.00448e60
mov qword [rsp + 0x28], rax
mov ebx, dword [rsp + 0x1c]
xor ecx, ecx
lea rdi, [rsp + 0x20]
nop dword [rax + rax]
call fcn.0048ff20
test rax, rax
je 0x48db3c
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x28]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
je 0x48db63
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00658424]
mov ebx, 0x42
call fcn.00468600
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov dword [rsp + 8], eax
call fcn.0045f280
mov eax, dword [rsp + 8]
jmp fcn.0048daa0

Function at 0x49b240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b286
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x49b26f
add rax, 8
nop
call fcn.0045e200
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x00685160]
nop dword [rax]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0049b240

Function at 0x49b360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b3ba
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x49b3a6
mov qword [rsp + 0x20], rax
mov rax, rbx
call fcn.0049b1c0
mov rcx, qword [rsp + 0x20]
add rcx, 8
mov rbx, rax
mov rax, rcx
call fcn.0045e240
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x00685170]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049b360
Function at 0x49da40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x49dc86
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
test r10, r10
je 0x49dc6f
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r8
mov qword [rsp + 0xd0], r10
dec rbx
mov ecx, 0xc
call fcn.0049d9a0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov ecx, 0x3b9aca00
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
call fcn.0049d9a0
mov qword [rsp + 0x50], rbx
mov ecx, 0x3c
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov rbx, rdx
call fcn.0049d9a0
mov qword [rsp + 0x58], rbx
mov ecx, 0x3c
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, rdx
call fcn.0049d9a0
mov qword [rsp + 0x60], rbx
mov ecx, 0x18
mov rdx, rax
mov rax, qword [rsp + 0x68]
mov rbx, rdx
call fcn.0049d9a0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
mov rax, qword [rsp + 0x40]
call fcn.0049d180
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x20]
lea rsi, [0x007a59a0]
lea rsi, [rsi + rdx*4]
movsxd rsi, dword [rsi]
mov qword [rsp + 0x38], rsi
mov rax, qword [rsp + 0x40]
nop
call fcn.0049d920
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
lea rdi, [rsi + rdx]
test al, al
je 0x49db6e
mov rcx, qword [rsp + 0x20]
inc rcx
nop
cmp rcx, 3
jl 0x49db6e
lea rdi, [rsi + rdx]
lea rdi, [rdi + 1]
mov rcx, qword [rsp + 0x68]
lea rcx, [rdi + rcx]
lea rcx, [rcx - 1]
imul rcx, rcx, 0x15180
mov rdx, qword [rsp + 0x48]
imul rdx, rdx, 0xe10
mov rsi, qword [rsp + 0x60]
imul rsi, rsi, 0x3c
add rdx, rsi
mov rsi, qword [rsp + 0x58]
add rdx, rsi
add rcx, rdx
mov qword [rsp + 0x30], rcx
movabs rdx, 0x80000001e5263700
lea rbx, [rdx + rcx]
mov qword [rsp + 0x18], rbx
mov rax, qword [rsp + 0xd0]
call fcn.0049e2a0
test rcx, rcx
je 0x49dc17
mov rdx, qword [rsp + 0x30]
mov r8, rdx
sub rdx, rcx
movabs r9, 0x80000001e5263700
lea rbx, [rdx + r9]
cmp rdi, rbx
jg 0x49dbf2
cmp rsi, rbx
jg 0x49dc0e
mov rax, qword [rsp + 0xd0]
call fcn.0049e2a0
mov r8, qword [rsp + 0x30]
movabs r9, 0x80000001e5263700
sub r8, rcx
lea rbx, [r8 + r9]
jmp 0x49dc1c
mov rbx, qword [rsp + 0x18]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
call fcn.0049d2c0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
lea rax, [rsp + 0x70]
mov rbx, qword [rsp + 0xd0]
call fcn.0049b7a0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x005fe120]
lea rbx, [0x00685150]
nop dword [rax]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
nop dword [rax + rax]
jmp fcn.0049da40
Function at 0x4a2ca0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a2d13
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
jmp 0x4a2cb9
mov rax, rbx
mov rcx, qword [rax]
bt ecx, 0
jb 0x4a2cf3
lea rdx, [rcx + 8]
test rdx, 0x7ffff8
je 0x4a2cff
mov rbx, rax
mov rax, rcx
lock cmpxchg qword [rbx], rdx
sete cl
nop dword [rax]
test cl, cl
je 0x4a2cb6
mov eax, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x005fe120]
lea rbx, [0x00684990]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.004a2ca0

Function at 0x4a2d40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a2e3c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
jmp 0x4a2d5d
mov rax, rbx
mov rcx, qword [rax]
bt ecx, 0
jb 0x4a2da4
mov rdx, rcx
or rcx, 1
add rcx, 8
test rcx, 0x7ffff8
je 0x4a2e28
movabs rsi, 0x80000000007fffff
and rcx, rsi
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x4a2d5a
mov qword [rsp + 0x18], rbx
jmp 0x4a2dcf
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 8]
call fcn.0045ce20
mov rcx, qword [rsp + 0x10]
lea rdx, [rcx - 0x800000]
mov rbx, qword [rsp + 0x18]
movabs rcx, 0x7ffff800000
test rdx, rcx
jne 0x4a2db0
nop
jmp 0x4a2e0a
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 0xc]
call fcn.0045ce20
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xfffff80000000000
add rcx, rdx
mov rbx, qword [rsp + 0x18]
mov rdx, rcx
movabs rcx, 0x7ffff80000000000
test rdx, rcx
jne 0x4a2de2
mov eax, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00684990]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.004a2d40
Function at 0x4a2ee0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a300f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test bl, bl
je 0x4a2f18
test byte [rax], al
lea rcx, [rax + 8]
mov edx, 2
mov ebx, 0x800000
movabs rsi, 0x7ffff800000
jmp 0x4a2f37
test byte [rax], al
lea rcx, [rax + 0xc]
mov edx, 4
movabs rbx, 0x80000000000
movabs rsi, 0x7ffff80000000000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdx
jmp 0x4a2f55
mov rax, r9
mov rdi, qword [rax]
bt edi, 0
jb 0x4a2fdc
nop
test rdi, rdx
jne 0x4a2f7d
mov r8, rdi
or rdi, rdx
add rdi, 8
test rdi, 0x7ffff8
jne 0x4a2f8f
jmp 0x4a2ffb
lea r8, [rbx + rdi]
test rsi, r8
je 0x4a2fe8
mov r9, r8
mov r8, rdi
mov rdi, r9
mov r9, rax
mov rax, r8
lock cmpxchg qword [r9], rdi
sete dil
nop
test dil, dil
je 0x4a2f52
test r8, rdx
je 0x4a2fcd
mov rax, rcx
call fcn.0045cd00
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov r9, qword [rsp + 0x40]
jmp 0x4a2f52
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x005fe120]
lea rbx, [0x00684990]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684990]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.0045f280
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004a2ee0