joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491f00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492097
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and edx, 0x1f
nop
cmp rdx, 0x14
je 0x491faa
cmp rdx, 0x16
jne 0x49205b
bt ecx, 7
jae 0x491f7a
movzx edx, byte [rax + 0x17]
test dl, 0x20
jne 0x491f77
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
call fcn.00459c20
nop dword [rax]
test al, al
je 0x492048
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x30]
mov rbx, qword [rbx]
test rbx, rbx
je 0x491f9e
mov rax, qword [rax + 0x30]
and ecx, 0x60
movzx edx, byte [rax + 0x17]
and edx, 0x1f
or rcx, rdx
or rcx, 0x180
nop
add rsp, 0x38
pop rbp
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
add rsp, 0x38
pop rbp
ret
call fcn.00401160
test rax, rax
jne 0x491fc2
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
jmp 0x491fd7
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx]
test rsi, rsi
je 0x491fd3
mov rsi, qword [rsi + 8]
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x18]
test rdx, rdx
je 0x49200e
movzx esi, byte [rdx + 0x17]
mov edi, esi
and esi, 0x1f
mov r8, rsi
or rsi, 0x80
nop
mov r9, qword [rsp + 0x20]
test dil, 0x20
cmove r8, rsi
jmp 0x492016
xor r8d, r8d
xor edx, edx
xor r9d, r9d
test r8, r8
je 0x492039
nop
mov rsi, qword [rsp + 0x10]
test rsi, 0x60
mov esi, 0
mov edi, 0x20
cmovne rsi, rdi
or r8, rsi
mov rax, rdx
mov rbx, r9
mov rcx, r8
add rsp, 0x38
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740880]
call fcn.004337c0
mov qword [rsp + 0x10], rdx
lea rax, [0x006907a0]
call fcn.0040d480
mov qword [rax + 8], 0x12
lea rcx, [0x006c82ae]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00679700]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00491f00
Function at 0x493140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493340
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
nop
cmp rcx, 0x12
ja 0x4931b6
cmp rcx, 0x11
je 0x4931ac
cmp rcx, 0x12
jne 0x4932d0
nop
cmp qword [rax], 8
jne 0x49332c
nop
cmp qword [rax + 8], 0
je 0x49332c
bt edx, 7
jae 0x49319e
mov rbx, qword [rbx]
mov rax, rbx
call fcn.00459220
add rsp, 0x18
pop rbp
ret
mov rax, qword [rax + 0x40]
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x15
jne 0x4931eb
nop
cmp qword [rax], 8
jne 0x493319
nop
cmp qword [rax + 8], 0
je 0x493319
bt edx, 7
jae 0x4931dc
mov rbx, qword [rbx]
mov rax, rbx
nop
call fcn.00459a80
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x16
jne 0x4932c0
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax]
cmp rcx, 0x12
ja 0x493220
cmp rcx, 0x11
jne 0x493212
mov rdx, qword [rax + 0x30]
jmp 0x493246
cmp rcx, 0x12
jne 0x493244
mov rdx, qword [rax + 0x30]
jmp 0x493246
cmp rcx, 0x15
jne 0x49322c
mov rdx, qword [rax + 0x38]
jmp 0x493246
cmp rcx, 0x16
jne 0x493238
mov rdx, qword [rax + 0x30]
jmp 0x493246
cmp rcx, 0x17
jne 0x493244
mov rdx, qword [rax + 0x30]
jmp 0x493246
xor edx, edx
movzx edx, byte [rdx + 0x17]
and edx, 0x1f
cmp rdx, 0x11
jne 0x493306
cmp rcx, 0x12
ja 0x493278
nop dword [rax]
cmp rcx, 0x11
jne 0x49326c
mov rcx, qword [rax + 0x30]
jmp 0x49329e
cmp rcx, 0x12
jne 0x49329c
mov rcx, qword [rax + 0x30]
jmp 0x49329e
cmp rcx, 0x15
jne 0x493284
mov rcx, qword [rax + 0x38]
jmp 0x49329e
cmp rcx, 0x16
jne 0x493290
mov rcx, qword [rax + 0x30]
jmp 0x49329e
cmp rcx, 0x17
jne 0x49329c
mov rcx, qword [rax + 0x30]
jmp 0x49329e
xor ecx, ecx
movzx edx, byte [rcx + 0x17]
and edx, 0x1f
cmp rdx, 0x11
jne 0x4932b1
mov rcx, qword [rcx + 0x40]
jmp 0x4932b3
xor ecx, ecx
mov rax, rcx
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x18
jne 0x4932d0
mov rax, qword [rbx + 8]
add rsp, 0x18
pop rbp
ret
lea rax, [0x006907a0]
call fcn.0040d480
mov qword [rax + 8], 0x11
lea rcx, [0x006c7cd9]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00679700]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007408d0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007407b0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007407b0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00493140
Function at 0x493380
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4935b4
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], r8
mov rdx, rcx
and ecx, 0x1f
nop
nop dword [rax + rax]
cmp rcx, 0x15
jne 0x49354f
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov r10, qword [rax + 0x30]
nop dword [rax]
cmp qword [0x008a65b8], r10
je 0x4933f9
mov rcx, r8
and r8d, 0x1f
cmp r8, 0x18
jne 0x493445
mov r8, rcx
cmp rdi, r10
jne 0x493448
mov r11, qword [rax + 0x38]
cmp qword [r11], 0x80
ja 0x493448
nop
cmp qword [rax], 8
jne 0x49353c
nop
cmp qword [rax + 8], 0
nop dword [rax]
je 0x49353c
bt edx, 7
jae 0x49342f
mov rbx, qword [rbx]
mov rcx, qword [rsi]
mov rdi, qword [rsi + 8]
call fcn.004597a0
nop dword [rax + rax]
jmp 0x4934ce
mov r8, rcx
mov rax, rdi
mov rbx, rsi
mov rcx, r8
lea rdi, [0x006c9f3c]
mov esi, 0x16
mov r8, r10
xor r9d, r9d
call fcn.00496040
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
bt ecx, 7
jb 0x49348e
lea rbx, [rsp + 0x90]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 8
jne 0x493529
nop
cmp qword [rax + 8], 0
je 0x493529
mov rdx, qword [rsp + 0x40]
bt edx, 7
jae 0x4934be
mov rsi, qword [rsp + 0x58]
mov rsi, qword [rsi]
jmp 0x4934c3
mov rsi, qword [rsp + 0x58]
mov rcx, rbx
mov rbx, rsi
call fcn.00459740
test rax, rax
je 0x49351d
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0x38]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x40]
or rsi, rdi
movzx ebx, byte [rdx + 0x17]
and ebx, 0x1f
nop
test rsi, 0x60
mov esi, 0
mov edi, 0x20
cmovne rsi, rdi
or rbx, rsi
mov rcx, rax
mov rax, rdx
call fcn.00493900
add rsp, 0x60
pop rbp
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
add rsp, 0x60
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x007407b0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007407b0]
call fcn.004337c0
mov qword [rsp + 0x40], rcx
call fcn.00490320
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rax
lea rax, [0x006907a0]
call fcn.0040d480
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x0092d940], 0
nop
jne 0x4935a5
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00679700]
nop dword [rax]
call fcn.004337c0
call fcn.0045fe20
mov rcx, qword [rsp + 0x48]
mov qword [r11], rcx
jmp 0x493582
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00493380
Function at 0x493600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493699
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp qword [rax + 0x28], 0
je 0x493685
mov qword [rsp + 0x28], rax
lea rcx, [rax + 0x18]
mov rax, rcx
call fcn.00459a40
test rax, rax
je 0x493670
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 0x30]
mov rdx, qword [rdx + 0x10]
movzx ebx, byte [rsi + 0x17]
and ebx, 0x1f
nop
test rdx, 0x60
mov edx, 0
mov edi, 0x20
cmovne rdx, rdi
or rbx, rdx
mov rcx, rax
mov rax, rsi
call fcn.00493900
add rsp, 0x18
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x007408f0]
nop
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007408e0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
nop
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.00493600

Function at 0x4936c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493759
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp qword [rax + 0x28], 0
je 0x493745
mov qword [rsp + 0x28], rax
lea rcx, [rax + 0x18]
mov rax, rcx
call fcn.00459a60
test rax, rax
je 0x493730
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 0x38]
mov rdx, qword [rdx + 0x10]
movzx ebx, byte [rsi + 0x17]
and ebx, 0x1f
nop
test rdx, 0x60
mov edx, 0
mov edi, 0x20
cmovne rdx, rdi
or rbx, rdx
mov rcx, rax
mov rax, rsi
call fcn.00493900
add rsp, 0x18
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740910]
nop
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740900]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
nop
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.004936c0

Function at 0x493780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493846
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x493830
lea rcx, [rax + 0x18]
mov qword [rsp + 0x18], rcx
cmp qword [rax + 0x28], 0
jne 0x4937dc
mov rsi, qword [rax]
cmp qword [rsi], 8
jne 0x49381d
nop
cmp qword [rsi + 8], 0
nop
je 0x49381d
mov rdi, qword [rax + 8]
bt edx, 7
jae 0x4937cf
mov rdi, qword [rdi]
mov rax, rsi
mov rbx, rdi
call fcn.004599c0
jmp 0x4937f4
mov rax, rcx
nop
call fcn.00459a40
test rax, rax
je 0x49380a
mov rax, qword [rsp + 0x18]
call fcn.00459a00
mov rax, qword [rsp + 0x18]
call fcn.00459a40
test rax, rax
setne al
add rsp, 0x20
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740930]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007407b0]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740920]
nop
call fcn.004337c0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.00493780
Function at 0x493b00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493ca6
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop
cmp byte [0x008a6cb0], 0
je 0x493b5a
lea rdx, [0x0066d580]
mov qword [0x008a6cb8], rdx
cmp dword [0x0092d940], 0
je 0x493b53
nop dword [rax]
call fcn.0045fe40
mov qword [r11], rbx
mov rdx, qword [0x008a6cc0]
mov qword [r11 + 8], rdx
mov qword [0x008a6cc0], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x18], rcx
nop
cmp rcx, 0x15
ja 0x493bc9
cmp rcx, 0x12
je 0x493c06
cmp rcx, 0x13
jne 0x493bc1
bt edx, 9
jb 0x493bb3
nop
cmp qword [rax], 8
jne 0x493c8e
nop
cmp qword [rax + 8], 0
je 0x493c8e
bt edx, 7
jae 0x493ba2
mov rbx, qword [rbx]
test rbx, rbx
je 0x493baa
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
lea rax, [0x00498e60]
nop
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x15
je 0x493c06
jmp 0x493c45
cmp rcx, 0x16
jne 0x493bf8
cmp qword [rax + 8], 0
jne 0x493c06
mov rax, qword [rbx]
mov qword [rsp + 0x10], rax
nop
call fcn.00459c20
test al, al
je 0x493c7b
mov rax, qword [rsp + 0x10]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x17
je 0x493c26
nop
cmp rcx, 0x1a
jne 0x493c45
cmp qword [rax], 8
jne 0x493c2f
nop
cmp qword [rax + 8], 0
je 0x493c2f
bt edx, 7
jae 0x493c1d
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
mov rax, qword [rbx]
add rsp, 0x20
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x007407b0]
nop dword [rax]
call fcn.004337c0
lea rax, [0x006907a0]
call fcn.0040d480
mov qword [rax + 8], 0x15
lea rcx, [0x006c98fe]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00679700]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740940]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007407b0]
nop dword [rax]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00493b00
Function at 0x493f80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4940e2
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x28], rax
nop
test rcx, 0x60
jne 0x493fc5
bt ecx, 8
jb 0x493ff0
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.00490640
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
and ecx, 0x1f
nop
cmp rcx, 0x17
jne 0x49407f
test byte [rax], al
nop
call fcn.0048d420
test rax, rax
je 0x494014
lea rcx, [0x007469a8]
jmp 0x494018
xor ecx, ecx
xor eax, eax
mov rcx, qword [rcx + 0x98]
nop
call rcx
cmp rax, 8
jne 0x49406c
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x70]
mov qword [rcx + 0x10], rax
cmp dword [0x0092d940], 0
jne 0x49404f
mov rax, qword [rsp + 0x60]
jmp 0x494063
call fcn.0045fe40
mov rax, qword [rsp + 0x60]
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
add rsp, 0x38
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740950]
call fcn.004337c0
mov qword [rsp + 0x18], rcx
call fcn.00490320
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rax
lea rax, [0x006907a0]
call fcn.0040d480
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x0092d940], 0
jne 0x4940d1
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00679700]
call fcn.004337c0
call fcn.0045fe20
mov rcx, qword [rsp + 0x20]
mov qword [r11], rcx
nop
jmp 0x4940b1
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00493f80
Function at 0x494140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4942bc
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
nop
test rcx, 0x60
jne 0x494185
bt ecx, 8
jb 0x4941b0
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.00490640
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
and ecx, 0x1f
nop
cmp rcx, 0x17
jne 0x494257
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
ja 0x4941e3
cmp rcx, 0x11
jne 0x4941d7
mov rcx, qword [rax + 0x30]
jmp 0x49420e
cmp rcx, 0x12
jne 0x49420c
mov rcx, qword [rax + 0x30]
jmp 0x49420e
cmp rcx, 0x15
jne 0x4941ef
mov rcx, qword [rax + 0x38]
jmp 0x49420e
cmp rcx, 0x16
jne 0x494200
mov rcx, qword [rax + 0x30]
jmp 0x49420e
cmp rcx, 0x17
jne 0x49420c
mov rcx, qword [rax + 0x30]
jmp 0x49420e
xor ecx, ecx
movzx ecx, byte [rcx + 0x17]
and ecx, 0x1f
cmp rcx, 5
jne 0x494244
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], r8
cmp dword [0x0092d940], 0
je 0x49423b
call fcn.0045fe40
mov qword [r11], rdi
mov rax, qword [rbx]
mov qword [r11 + 8], rax
mov qword [rbx], rdi
add rsp, 0x38
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740960]
call fcn.004337c0
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.00490320
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rax
lea rax, [0x006907a0]
call fcn.0040d480
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x0092d940], 0
jne 0x4942ad
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00679700]
call fcn.004337c0
call fcn.0045fe20
mov rcx, qword [rsp + 0x20]
mov qword [r11], rcx
jmp 0x49428d
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.00494140
Function at 0x494660
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494746
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], rbx
nop
test rcx, 0x60
jne 0x494696
bt ecx, 8
jb 0x4946b4
mov qword [rsp + 0x18], rcx
mov rax, rcx
nop
call fcn.00490640
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x58]
and ecx, 0x1f
nop
cmp rcx, 0x17
jne 0x4946e5
nop
cmp qword [rbx + 0x10], rdi
jb 0x4946d0
mov qword [rbx + 8], rdi
add rsp, 0x30
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740970]
nop
call fcn.004337c0
mov qword [rsp + 0x18], rcx
call fcn.00490320
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rax
lea rax, [0x006907a0]
call fcn.0040d480
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x0092d940], 0
jne 0x494737
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00679700]
call fcn.004337c0
call fcn.0045fe20
mov rcx, qword [rsp + 0x20]
mov qword [r11], rcx
jmp 0x494717
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00494660
Function at 0x495060
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49517b
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop dword [rax]
test rcx, rcx
je 0x495145
bt ecx, 9
jae 0x49510b
movzx edx, byte [rax + 0x17]
and edx, 0x1f
sar rcx, 0xa
nop word [rax + rax]
cmp rdx, 0x14
jne 0x4950ce
cmp qword [rax + 0x40], rcx
jbe 0x49512e
mov rdx, qword [rax + 0x38]
mov ebx, dword [rdx + rcx*8 + 4]
nop
call fcn.0045b5e0
mov rbx, rax
lea rax, [0x007469a8]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.004010c0
mov rcx, qword [rsp + 0x10]
cmp rbx, rcx
jbe 0x49511b
shl rcx, 4
mov ebx, dword [rax + rcx + 4]
nop
nop
mov rax, qword [rsp + 0x18]
call fcn.0045b5e0
mov rbx, rax
lea rax, [0x007469a8]
add rsp, 0x20
pop rbp
ret
mov rbx, rax
lea rax, [0x007469a8]
add rsp, 0x20
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740830]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740830]
nop dword [rax]
call fcn.004337c0
lea rax, [0x006907a0]
call fcn.0040d480
mov qword [rax + 8], 0x12
lea rcx, [0x006c82c0]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00679700]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.00495060
Function at 0x4951c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49532c
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
nop
cmp rcx, 0x15
ja 0x49524c
cmp rcx, 0x12
je 0x49528c
cmp rcx, 0x13
jne 0x495244
bt edx, 9
jb 0x495236
nop
cmp qword [rax], 8
jne 0x495318
nop
cmp qword [rax + 8], 0
je 0x495318
bt edx, 7
nop
jae 0x495225
mov rbx, qword [rbx]
test rbx, rbx
je 0x49522d
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
lea rax, [0x00498e60]
nop
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x15
je 0x49528c
jmp 0x4952ca
cmp rcx, 0x16
jne 0x495280
cmp qword [rax + 8], 0
jne 0x49528c
mov qword [rsp + 0x18], rbx
mov rax, qword [rbx]
call fcn.00459c20
test al, al
je 0x495305
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
add rsp, 0x20
pop rbp
ret
cmp rcx, 0x17
je 0x4952ae
cmp rcx, 0x1a
jne 0x4952ca
nop
cmp qword [rax], 8
jne 0x4952b7
nop
cmp qword [rax + 8], 0
je 0x4952b7
bt edx, 7
nop
jae 0x4952a5
mov rbx, qword [rbx]
mov rax, rbx
add rsp, 0x20
pop rbp
ret
mov rax, qword [rbx]
add rsp, 0x20
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x007407b0]
call fcn.004337c0
lea rax, [0x006907a0]
call fcn.0040d480
mov qword [rax + 8], 0x1b
lea rcx, [0x006cc5d2]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00679700]
nop dword [rax + rax]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x00740980]
call fcn.004337c0
lea rax, [0x0066d140]
lea rbx, [0x007407b0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004951c0

Function at 0x49dca0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49dd6a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49dd4f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0066d240]
xor ebx, ebx
mov rcx, rdx
call fcn.004479c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049f580
inc rbx
cmp rcx, rbx
jae 0x49dd3e
mov edi, 1
lea rsi, [0x0066d240]
call fcn.00447aa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00741ec0]
lea rsi, [0x0073fc70]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049dca0
Function at 0x49de80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49dec9
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
call fcn.0049dca0
test rdi, rdi
jne 0x49deb5
nop dword [rax]
test rbx, rbx
jbe 0x49deab
add rsp, 0x10
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.004601e0
lea rax, [0x0066d140]
lea rbx, [0x007405b0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049de80

Function at 0x4ad040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad078
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [rax + 0x20], 0
je 0x4ad064
add rax, 8
call fcn.0045cd80
add rsp, 0x10
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x007401d0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.004ad040

Function at 0x4ad180
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad1d3
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [rax + 0x20], 0
je 0x4ad1bf
mov qword [rsp + 0x20], rax
mov rax, rbx
nop dword [rax]
call fcn.004acfe0
mov rcx, qword [rsp + 0x20]
add rcx, 8
mov rbx, rax
mov rax, rcx
call fcn.0045cdc0
add rsp, 0x10
pop rbp
ret
lea rax, [0x0066d140]
lea rbx, [0x00740650]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ad180