joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df460
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4df659
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rcx
call fcn.004d9bc0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x18]
lea rdi, [rsi - 1]
nop
cmp rdx, rdi
jb 0x4df650
mov rax, qword [rsp + 0x20]
lea r8, [rax - 1]
cmp rdi, r8
jb 0x4df645
sub rsi, rax
sub rdx, rax
inc rdx
mov rdi, rdx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rax, [rbx + r8]
test rsi, rsi
jbe 0x4df639
movzx edx, byte [rbx + r8]
cmp dl, 0x66
ja 0x4df541
cmp dl, 0x22
je 0x4df4f7
cmp dl, 0x66
je 0x4df54f
jmp 0x4df574
nop
mov rbx, rsi
mov rcx, rdi
nop
call fcn.004df700
mov byte [rsp + 0x1f], dil
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044eb00
movzx edx, byte [rsp + 0x1f]
nop dword [rax]
test dl, dl
je 0x4df626
call fcn.0040afc0
mov rbx, rax
lea rax, [0x00679500]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp dl, 0x6e
je 0x4df605
cmp dl, 0x74
jne 0x4df574
cmp dl, 0x74
sete cl
movzx ecx, cl
lea rdx, [0x008ac160]
lea rbx, [rdx + rcx*8]
lea rax, [0x00677780]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp dl, 0x2d
je 0x4df589
add edx, 0xffffffd0
nop dword [rax]
cmp dl, 9
ja 0x4df613
mov rbx, rax
mov rcx, rsi
xor eax, eax
call fcn.0044eb00
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x48]
call fcn.004dca60
test rcx, rcx
je 0x4df5fb
nop
mov rdx, qword [rsp + 0x48]
cmp qword [rdx + 0x70], 0
jne 0x4df5fb
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov rax, rdx
mov rbx, rcx
mov rcx, rdi
call fcn.004d9800
mov rdi, qword [rsp + 0x48]
mov qword [rdi + 0x70], rax
cmp dword [0x0092b0b0], 0
jne 0x4df5e8
mov qword [rdi + 0x78], rbx
jmp 0x4df5f1
add rdi, 0x78
call fcn.00465a40
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00679500]
lea rbx, [0x00741e00]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741e00]
call fcn.00436420
xor eax, eax
mov rcx, rax
nop
call fcn.00465da0
mov rax, r8
mov rcx, rdi
call fcn.00465e60
mov rcx, rdi
call fcn.00465e20
nop
mov qword [rsp + 8], rax
nop
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.004df460
Function at 0x4e04c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e059f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x008d66e0]
nop
call fcn.0046ed00
test rax, rax
je 0x4e053a
lea rdx, [0x006c00a0]
cmp rax, rdx
jne 0x4e058f
mov qword [rbx + 8], 0
mov qword [rbx + 0x18], 0
mov byte [rbx + 0x20], 0
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x4e051c
mov rcx, qword [rcx]
jmp 0x4e0520
xor ecx, ecx
nop
test rcx, rcx
jg 0x4e057c
mov qword [rbx + 0x68], 0
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0040e4a0
mov qword [rsp + 0x18], rax
lea rax, [0x006aa760]
call fcn.0040d960
cmp dword [0x0092b0b0], 0
jne 0x4e0564
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x70], rcx
jmp 0x4e0572
lea rdi, [rax + 0x70]
mov rcx, qword [rsp + 0x18]
call fcn.00465a00
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00679500]
lea rbx, [0x00741e10]
call fcn.00436420
mov rbx, rdx
lea rcx, [0x00680900]
call fcn.0040ab80
nop
nop
call fcn.00463740
jmp fcn.004e04c0
Function at 0x4e8ca0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e8e0a
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
cmp bl, 0x20
ja 0x4e8ce0
je 0x4e8ccf
nop
cmp bl, 9
je 0x4e8ccf
cmp bl, 0xd
je 0x4e8ccf
cmp bl, 0xa
jne 0x4e8ce0
mov eax, 9
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
cmp bl, 0x22
jne 0x4e8d1a
test byte [rax], al
cmp dword [0x0092b0b0], 0
jne 0x4e8cfc
lea rcx, [0x006fa6a0]
mov qword [rax], rcx
jmp 0x4e8d0b
mov rdi, rax
lea rcx, [0x006fa6a0]
call fcn.00465a00
mov eax, 1
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 0x70], rax
test byte [rax], al
cmp dword [0x0092b0b0], 0
jne 0x4e8d36
lea rcx, [0x006fa648]
mov qword [rax], rcx
jmp 0x4e8d45
mov rdi, rax
lea rcx, [0x006fa648]
call fcn.00465a00
mov eax, ebx
call fcn.004eb400
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x00698440]
nop dword [rax]
call fcn.0040d960
mov qword [rsp + 0x50], rax
lea rbx, [0x006cdadf]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x007418f0]
mov r9d, 1
lea r10, [0x006d8a9f]
mov r11d, 0x2a
xor eax, eax
nop dword [rax]
call fcn.0044e8e0
mov rdi, qword [rsp + 0x50]
mov qword [rdi + 8], rbx
cmp dword [0x0092b0b0], 0
jne 0x4e8dc0
mov qword [rdi], rax
jmp 0x4e8dc5
call fcn.00465900
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x38]
mov qword [rdi + 0x10], rdx
lea rdx, [0x00742b60]
mov qword [rcx + 0x28], rdx
cmp dword [0x0092b0b0], 0
jne 0x4e8dec
mov qword [rcx + 0x30], rdi
jmp 0x4e8dfb
add rcx, 0x30
mov rax, rdi
mov rdi, rcx
call fcn.00465900
mov eax, 0xb
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00463740
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004e8ca0
Function at 0x4ebd40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ebe9e
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rcx, qword [rax + 0x110]
cmp rcx, 3
je 0x4ebe08
cmp rcx, 6
jne 0x4ebe2d
call fcn.004ebec0
nop dword [rax]
test rbx, rbx
jne 0x4ebdf8
cmp al, 0x3a
jne 0x4ebda5
mov rcx, qword [rsp + 0x30]
inc qword [rcx + 0xb0]
mov qword [rcx + 0x110], 7
jmp 0x4ebe2d
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0xb8]
add rdx, qword [rcx + 0xb0]
mov qword [rsp + 0x10], rdx
lea rax, [0x00698440]
call fcn.0040d960
mov qword [rax + 8], 0x1f
lea rcx, [0x006d407f]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00742b60]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rbx
mov rbx, rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.004ebec0
test rbx, rbx
jne 0x4ebe8e
cmp al, 0x2c
jne 0x4ebe3b
mov rcx, qword [rsp + 0x30]
inc qword [rcx + 0xb0]
mov qword [rcx + 0x110], 2
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0xb8]
add rdx, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rdx
lea rax, [0x00698440]
call fcn.0040d960
mov qword [rax + 8], 0x22
lea rcx, [0x006d5883]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00742b60]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rbx
mov rbx, rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.004ebd40
Function at 0x4eeb60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eecd9
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov ebx, 0xa
call fcn.004ee900
mov rdx, qword [0x008d5288]
cmp qword [0x008d5280], rdi
jne 0x4eec44
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x28], rax
mov rax, rdi
mov rbx, rsi
mov rcx, rdx
nop dword [rax]
call fcn.00403fe0
test al, al
je 0x4eec2b
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x4eec0a
mov rax, qword [rsp + 0x28]
movzx r9d, byte [rax + rdx - 1]
nop
cmp r9b, 0xd
jne 0x4eec05
mov r9, qword [rsp + 0x50]
mov r10, qword [r9 + 0x28]
test r10, r10
je 0x4eecc5
dec r10
mov qword [r9 + 0x28], r10
lea rbx, [rdx - 1]
jmp 0x4eec12
mov rbx, rdx
jmp 0x4eec12
mov rax, qword [rsp + 0x28]
mov rbx, rdx
mov rcx, qword [rsp + 0x18]
mov edi, 1
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
test rbx, rbx
je 0x4eec8c
movzx r9d, byte [rax + rbx - 1]
cmp r9b, 0xa
jne 0x4eec7b
cmp rbx, 1
jle 0x4eec6e
movzx r9d, byte [rbx + rax - 2]
cmp r9b, 0xd
jne 0x4eec6e
mov edx, 2
jmp 0x4eec73
mov edx, 1
sub rbx, rdx
cmp rcx, rbx
jb 0x4eecb7
xor edi, edi
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test rdi, rdi
mov edx, 0
cmovne rbx, rdx
cmovne rcx, rdx
mov edx, 0
cmovne rax, rdx
mov r8, rsi
mov rsi, rdi
xor edi, edi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdx, rcx
mov rcx, rbx
nop dword [rax]
call fcn.00465e20
lea rax, [0x00679500]
lea rbx, [0x007419c0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
nop
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.004eeb60

Function at 0x4f3f60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f4006
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rax, rax
je 0x4f3fee
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
nop
lea rax, [0x006b4200]
call fcn.0040d960
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
cmp dword [0x0092b0b0], 0
jne 0x4f3fba
mov rbx, qword [rsp + 0x40]
mov qword [rax + 8], rbx
jmp 0x4f3fc8
lea rdi, [rax + 8]
mov rbx, qword [rsp + 0x40]
call fcn.00465a40
mov qword [rsp + 0x20], rax
mov rdi, rax
mov rax, rcx
lea rcx, [0x00743b80]
call fcn.004f41e0
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00679500]
lea rbx, [0x00741a40]
nop dword [rax]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004f3f60
Function at 0x4f57e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f58f9
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
mov byte [rsp + 0x48], bl
mov qword [rsp + 0x40], rax
mov rdx, qword [rax]
mov rax, rdx
xor ebx, ebx
nop dword [rax]
call fcn.004f4ce0
movzx edx, byte [rsp + 0x48]
test dl, dl
je 0x4f5849
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rdi]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
lea rcx, [0x00743ba8]
call fcn.004f4680
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx + 0x10], esi
sete sil
test sil, sil
jne 0x4f5874
lea rax, [rdx + 0x10]
call fcn.0046e660
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + 8]
test rax, rax
je 0x4f58bf
nop
cmp qword [rax + 0x20], 0
je 0x4f58e5
add rax, 8
call fcn.004626a0
cmp dword [0x0092b0b0], 0
jne 0x4f58a6
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], 0
jmp 0x4f58bf
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 8]
mov rax, rdi
mov rdi, rcx
xor edx, edx
call fcn.00465a20
mov rcx, rax
mov rax, qword [rcx]
mov ebx, 0xffffffff
lock xadd dword [rax + 0x10], ebx
dec ebx
test ebx, ebx
je 0x4f58db
add rax, 0x10
call fcn.0046e960
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00679500]
lea rbx, [0x007420b0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463740
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004f57e0
Function at 0x4f59c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f5b39
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
test rax, rax
je 0x4f5b25
nop
test rcx, rcx
je 0x4f5b0d
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x4f5a44
lea r9, [0x00745fc8]
jmp 0x4f5a49
xor r9d, r9d
xor edx, edx
mov rcx, qword [r9 + 0x20]
mov rax, rdx
call rcx
test al, al
je 0x4f5afa
lea rax, [0x006aea20]
call fcn.0040d960
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
cmp dword [0x0092b0b0], 0
jne 0x4f5a82
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
jmp 0x4f5a90
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x48]
call fcn.00465a00
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
cmp dword [0x0092b0b0], 0
jne 0x4f5aad
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x18], rcx
jmp 0x4f5abb
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x58]
call fcn.00465a00
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x20], rcx
cmp dword [0x0092b0b0], 0
jne 0x4f5ad8
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x28], rcx
jmp 0x4f5ae6
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x68]
call fcn.00465a00
mov rbx, rax
lea rax, [0x00744c58]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00679500]
lea rbx, [0x00741a70]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741a60]
nop dword [rax + rax]
call fcn.00436420
lea rax, [0x00679500]
lea rbx, [0x00741a40]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004f59c0
Function at 0x4fe9a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4feafb
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x008d4a30]
call fcn.004ed660
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004feb20]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4feabb
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4feaf5
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4feaea
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.00465e60
call fcn.00465de0
nop
nop dword [rax + rax]
call fcn.00463740
jmp fcn.004fe9a0
Function at 0x51ae20
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x51b081
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x51b065
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x51ae6d
xor ebx, ebx
xor ecx, ecx
jmp 0x51ae80
mov rax, rdx
call fcn.0050b8c0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x51af98
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.004839c0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00740090]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e800
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x51af5b
xor eax, eax
lea rbx, [0x007402b8]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006c9408]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e8e0
jmp 0x51af88
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00740158]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e800
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.004839c0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x51b028
xor eax, eax
lea rbx, [0x007402b8]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006c9408]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e8e0
jmp 0x51b055
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00740158]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e800
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006c98ec]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.0051ae20
Function at 0x51c600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c714
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [0x008ca538]
cmp qword [rax + 0x18], 1
jle 0x51c67b
movzx ecx, byte [rax + 2]
mov byte [rsp + 0x17], cl
movzx eax, byte [rax + 1]
mov byte [rsp + 0x16], al
call fcn.00438500
lea rax, [0x006d4fac]
mov ebx, 0x21
call fcn.00438e00
movzx eax, byte [rsp + 0x17]
call fcn.004387a0
lea rax, [0x006ca9dc]
mov ebx, 0xa
call fcn.00438e00
movzx eax, byte [rsp + 0x16]
call fcn.004387a0
call fcn.00438760
call fcn.00438580
mov rax, qword [0x008ca538]
cmp byte [rax + 1], 0
je 0x51c6cc
cmp byte [0x0092ac0e], 0
je 0x51c6ae
call fcn.00438500
lea rax, [0x006dd944]
mov ebx, 0x44
call fcn.00438e00
call fcn.00438580
jmp 0x51c70a
call fcn.00438500
lea rax, [0x006dce48]
mov ebx, 0x3d
nop
call fcn.00438e00
call fcn.00438580
jmp 0x51c70a
cmp byte [rax], 0
je 0x51c6ee
call fcn.00438500
lea rax, [0x006d7978]
mov ebx, 0x27
call fcn.00438e00
call fcn.00438580
jmp 0x51c70a
call fcn.00438500
lea rax, [0x006db143]
mov ebx, 0x32
nop
call fcn.00438e00
call fcn.00438580
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00463740
jmp fcn.0051c600
Function at 0x522b60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x522cb3
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.00523900
test rbx, rbx
je 0x522c81
test rdi, rdi
je 0x522c73
cmp byte [rcx], 0x2f
nop word [rax + rax]
jne 0x522c41
lea rbx, [rdi - 1]
mov rdx, rbx
neg rbx
sar rbx, 0x3f
and ebx, 1
lea rax, [rcx + rbx]
mov rbx, rdx
nop
call fcn.00523900
test rbx, rbx
je 0x522c0f
test rdi, rdi
je 0x522c01
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x2c
lea rcx, [0x006d9432]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00742c00]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x20
lea rcx, [0x006d489a]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00742c00]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x26
lea rcx, [0x006d75e0]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00742c00]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00690f40]
call fcn.0040d960
mov qword [rax + 8], 0x13
lea rcx, [0x006ce380]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00742c00]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00522b60
Function at 0x5286c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5287c6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rcx, qword [rax + 0x10]
shl rcx, 3
mov qword [rsp + 0x18], rcx
mov rbx, rcx
lea rax, [0x006796c0]
call fcn.0044a840
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov rdi, qword [rsp + 0x18]
mov rcx, rdi
xor ebx, ebx
jmp 0x528715
inc rbx
cmp rbx, rdx
jge 0x528723
mov r8, qword [rsi + rbx*8]
xor r9d, r9d
jmp 0x528780
test rdi, rdi
jge 0x52872f
xor edi, edi
jmp 0x52872f
inc rdi
cmp rdi, rcx
jge 0x528743
jae 0x52876d
movzx edx, byte [rax + rdi]
test dl, dl
je 0x52872c
nop
cmp rdi, rcx
ja 0x528765
sub rcx, rdi
mov rbx, rcx
neg rcx
sar rcx, 0x3f
and rdi, rcx
add rax, rdi
mov rcx, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rdi
call fcn.00465e60
mov rax, rdi
call fcn.00465da0
inc r9
shr r8, 8
mov rdi, r10
nop
cmp r9, 8
jge 0x528712
lea r10, [rdi - 1]
test r10, r10
jl 0x5287a0
cmp rcx, r10
jbe 0x5287b8
mov byte [rdi + rax - 1], r8b
jmp 0x528775
test r8b, r8b
je 0x528775
lea rax, [0x00679500]
lea rbx, [0x00741f40]
call fcn.00436420
mov rax, r10
nop dword [rax + rax]
call fcn.00465da0
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
jmp fcn.005286c0

Function at 0x5287e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5288e6
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
nop dword [rax]
test rcx, rcx
je 0x528839
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov rax, rbx
mov rbx, rcx
nop
call fcn.00466440
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
mov rsi, qword [rax + 0x10]
mov rax, rcx
xor r8d, r8d
jmp 0x52884c
inc r8
cmp r8, rsi
jge 0x52885a
mov r9, qword [rdx + r8*8]
xor r10d, r10d
jmp 0x5288a3
test rcx, rcx
jge 0x528866
xor ecx, ecx
jmp 0x528866
inc rcx
cmp rax, rcx
jle 0x528875
jbe 0x52888b
movzx edx, byte [rbx + rcx]
test dl, dl
je 0x528863
mov rcx, rdi
mov rdx, rax
mov rax, rbx
mov rbx, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.00465da0
inc r10
shr r9, 8
mov rcx, r11
cmp r10, 8
jge 0x528849
lea r11, [rcx - 1]
test r11, r11
jl 0x5288c0
cmp rax, r11
jbe 0x5288d8
mov byte [rcx + rbx - 1], r9b
jmp 0x528899
test r9b, r9b
je 0x528899
lea rax, [0x00679500]
lea rbx, [0x00741f40]
call fcn.00436420
mov rcx, rax
mov rax, r11
nop
call fcn.00465da0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005287e0