joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7620
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x00727440]
movdqu xmm14, xmmword [0x00727450]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x4b770b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x4b770b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x4b7770
ret
Function at 0x4bc620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc6ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403d80
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4bc6cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0065bc20]
xor ebx, ebx
mov rcx, rdx
call fcn.0044b7a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004bdc80
inc rbx
cmp rcx, rbx
jae 0x4bc6be
mov edi, 1
lea rsi, [0x0065bc20]
call fcn.0044b880
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00728820]
lea rsi, [0x007271e8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004bc620

Function at 0x4bc800
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc849
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
call fcn.004bc620
test rdi, rdi
jne 0x4bc835
nop dword [rax]
test rbx, rbx
jbe 0x4bc82b
add rsp, 0x10
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.00466960
lea rax, [0x0065b7a0]
lea rbx, [0x00727eb0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004bc800
Function at 0x4c6360
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4c64ef
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
lea rdi, [0x006be667]
mov esi, 0x27
call fcn.004c6b80
mov rdx, qword [rsp + 0x60]
bt rdx, 0x3f
jae 0x4c64e6
mov rdx, qword [rsp + 0x58]
test rdx, rdx
jge 0x4c63c2
neg rdx
mov ecx, 0x2d
nop
jmp 0x4c63c7
mov ecx, 0x2b
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x80], rax
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x70], xmm15
mov word [rsp + 0x68], 0x6d20
mov byte [rsp + 0x6a], 0x3d
mov byte [rsp + 0x6b], cl
mov r8, rdx
shr rdx, 1
movabs rax, 0x89705f4136b4a598
mul rdx
mov rdi, rdx
shr rdi, 0x1c
imul r9, rdi, 0x3b9aca00
shr rdx, 0x1d
movabs rax, 0x89705f4136b4a598
mul rdx
shr rdx, 0x1c
imul r10, rdx, 0x3b9aca00
sub r8, r9
mov qword [rsp + 0x48], r8
sub rdi, r10
test rdx, rdx
jne 0x4c6450
mov eax, 4
xor edx, edx
mov esi, 0x18
lea r9, [rsp + 0x68]
jmp 0x4c6481
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x68]
mov ebx, 4
mov ecx, 0x18
mov rdi, rdx
xor esi, esi
call fcn.004c5e20
mov rdi, qword [rsp + 0x50]
mov edx, 9
mov rsi, rcx
mov r9, rax
mov rax, rbx
mov rbx, rax
mov rcx, rsi
mov rsi, rdx
mov rax, r9
call fcn.004c5e20
inc rbx
cmp rcx, rbx
jae 0x4c64ab
mov edi, 1
lea rsi, [0x0065bae0]
call fcn.0044b880
mov byte [rbx + rax - 1], 0x2e
mov rdi, qword [rsp + 0x48]
mov esi, 9
call fcn.004c5e20
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044f9a0
mov rcx, qword [rsp + 0x40]
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, qword [rsp + 0x80]
call fcn.0044f620
add rsp, 0x88
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004c6360
Function at 0x4c6cc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c6e4c
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0xa0], r10
cmp r10, 0x19
je 0x4c6dbd
nop dword [rax + rax]
cmp r10, 0x23
jne 0x4c6e0c
mov rax, r9
lea rbx, [0x006bcb81]
mov ecx, 0x23
call fcn.00403880
nop
test al, al
jne 0x4c6d85
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xa0]
nop dword [rax + rax]
jmp 0x4c6e0c
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
mov r9d, 1
call fcn.004ccb60
add rsp, 0x58
pop rbp
ret
mov rax, r9
lea rbx, [0x006b8093]
mov ecx, 0x19
call fcn.00403880
test al, al
jne 0x4c6e17
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xa0]
call fcn.004c6ec0
add rsp, 0x58
pop rbp
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
xor r9d, r9d
call fcn.004ccb60
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.004c6cc0
Function at 0x4c9960
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c9a5c
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
cmp rbx, 0x19
je 0x4c9990
xor edx, edx
jmp 0x4c99bb
lea rbx, [0x006b8093]
mov ecx, 0x19
nop dword [rax]
call fcn.00403880
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
je 0x4c99c6
mov edx, 1
jmp 0x4c99fb
cmp rbx, 0x23
je 0x4c99d0
xor edx, edx
jmp 0x4c99fb
lea rbx, [0x006bcb81]
mov ecx, 0x23
nop dword [rax]
call fcn.00403880
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
je 0x4c9a39
mov rdx, qword [0x008bd668]
lea rax, [0x00729680]
mov rbx, rcx
mov rcx, rdi
mov rdi, rdx
call fcn.004d3620
nop dword [rax + rax]
test dil, dil
jne 0x4c9a52
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov r8, qword [0x008bd668]
mov rsi, qword [0x008bd660]
call fcn.004c9aa0
add rsp, 0x30
pop rbp
ret
xor edi, edi
xor esi, esi
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004c9960

Function at 0x4cd000
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cd038
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [rax + 0x20], 0
je 0x4cd024
add rax, 8
call fcn.00463520
add rsp, 0x10
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727780]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.004cd000

Function at 0x4cd140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cd193
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [rax + 0x20], 0
je 0x4cd17f
mov qword [rsp + 0x20], rax
mov rax, rbx
nop dword [rax]
call fcn.004ccfa0
mov rcx, qword [rsp + 0x20]
add rcx, 8
mov rbx, rax
mov rax, rcx
call fcn.00463560
add rsp, 0x10
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727920]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004cd140
Function at 0x4d6080
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6170
push rbp
mov rbp, rsp
sub rsp, 0x20
jmp 0x4d6097
mov rax, rbx
mov rcx, qword [rax]
bt ecx, 0
nop
jb 0x4d60e2
mov rdx, rcx
or rcx, 1
add rcx, 8
test rcx, 0x7ffff8
je 0x4d615c
movabs rsi, 0x80000000007fffff
and rcx, rsi
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x4d6094
mov qword [rsp + 0x18], rbx
nop
jmp 0x4d6109
xor eax, eax
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 8]
call fcn.004621c0
mov rdx, qword [rsp + 0x10]
add rdx, 0xffffffffff800000
mov rbx, qword [rsp + 0x18]
movabs rcx, 0x7ffff800000
test rdx, rcx
jne 0x4d60ea
jmp 0x4d6142
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 0xc]
call fcn.004621c0
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xfffff80000000000
add rcx, rdx
mov rbx, qword [rsp + 0x18]
mov rdx, rcx
movabs rcx, 0x7ffff80000000000
test rdx, rcx
jne 0x4d611a
mov eax, 1
add rsp, 0x20
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727ec0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
nop
jmp fcn.004d6080

Function at 0x4d61a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d62bc
push rbp
mov rbp, rsp
sub rsp, 0x30
test bl, bl
je 0x4d61d2
test byte [rax], al
lea rcx, [rax + 8]
mov edx, 2
mov ebx, 0x800000
movabs rsi, 0x7ffff800000
jmp 0x4d61f1
test byte [rax], al
lea rcx, [rax + 0xc]
mov edx, 4
movabs rbx, 0x80000000000
movabs rsi, 0x7ffff80000000000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdx
jmp 0x4d620f
mov rax, r9
mov rdi, qword [rax]
bt edi, 0
jb 0x4d628d
test rdi, rdx
jne 0x4d6232
mov r8, rdi
or rdi, rdx
add rdi, 8
test rdi, 0x7ffff8
jne 0x4d6244
jmp 0x4d62a8
lea r8, [rbx + rdi]
test rsi, r8
je 0x4d6295
mov r9, r8
mov r8, rdi
mov rdi, r9
mov r9, rax
mov rax, r8
lock cmpxchg qword [r9], rdi
sete dil
test dil, dil
je 0x4d620c
test r8, rdx
je 0x4d6282
mov rax, rcx
call fcn.00462020
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov r9, qword [rsp + 0x40]
nop
jmp 0x4d620c
mov eax, 1
add rsp, 0x30
pop rbp
ret
xor eax, eax
add rsp, 0x30
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727ec0]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727ec0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.004646a0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004d61a0
Function at 0x4d6940
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6b43
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x90], rdi
movq qword [rsp + 0x60], xmm15
mov byte [rsp + 0x1f], 0
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov r8, qword [rsp + 0x48]
bt r8, 0x3f
jae 0x4d69a2
mov r8, qword [rsp + 0x48]
shl r8, 1
shr r8, 0x1f
movabs r9, 0xdd7b17f80
add r8, r9
jmp 0x4d69a7
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x78], rax
test r8, r8
jne 0x4d69cb
mov r8, qword [rsp + 0x48]
and r8d, 0x3fffffff
test r8d, r8d
jne 0x4d69cb
xor ecx, ecx
jmp 0x4d69f4
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call fcn.004ce280
test rax, rax
mov rdx, 0xffffffffffffffff
cmove rax, rdx
mov rsi, qword [rsp + 0x20]
mov rcx, rax
mov rax, qword [rsp + 0x78]
test byte [rax], al
jmp 0x4d69fb
mov rax, rdx
mov rdi, qword [rax]
bt edi, 0
jb 0x4d6a2f
lea r8, [rdi + 8]
test r8, 0x7ffff8
je 0x4d6b1a
mov rdx, rax
mov rax, rdi
lock cmpxchg qword [rdx], r8
sete r8b
test r8b, r8b
je 0x4d69f8
bt edi, 0
jmp 0x4d6a32
mov rdx, rax
jae 0x4d6a5d
cmp byte [rdx + 0x21f], 0
je 0x4d6a4d
mov rdi, qword [0x008be550]
mov r8, qword [0x008be558]
jmp 0x4d6a62
lea rdi, [0x00728b60]
lea r8, [0x009210a0]
jmp 0x4d6a62
xor edi, edi
xor r8d, r8d
test rdi, rdi
jne 0x4d6b04
movups xmmword [rsp + 0x38], xmm15
lea rdi, [0x004d6ba0]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x1f], 1
mov rax, qword [rdx + 0x1b8]
test rax, rax
jne 0x4d6ad4
mov rax, qword [0x008be560]
mov rcx, qword [0x008be568]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
add rsp, 0x68
pop rbp
ret
mov rbx, rcx
mov rcx, rsi
call fcn.00460b60
movups xmmword [rsp + 0x28], xmm15
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx]
call rsi
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], r8
mov rax, rdi
mov rbx, r8
add rsp, 0x68
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727ec0]
call fcn.00436ac0
nop
call fcn.00435fa0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.004d6940
Function at 0x4d9220
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d936b
push rbp
mov rbp, rsp
sub rsp, 0x50
movq qword [rsp + 0x48], xmm15
mov byte [rsp + 0x23], 0
movups xmmword [rsp + 0x28], xmm15
test byte [rax], al
jmp 0x4d924b
mov rax, rsi
mov rdx, qword [rax]
bt edx, 0
jb 0x4d928b
lea r8, [rdx + 8]
nop dword [rax + rax]
test r8, 0x7ffff8
je 0x4d9342
mov rsi, rax
mov rax, rdx
lock cmpxchg qword [rsi], r8
sete r8b
nop dword [rax]
test r8b, r8b
je 0x4d9248
bt edx, 0
jmp 0x4d928e
mov rsi, rax
jae 0x4d92b9
cmp byte [rsi + 0x21f], 0
je 0x4d92a9
mov rdx, qword [0x008be550]
mov r8, qword [0x008be558]
jmp 0x4d92c0
lea rdx, [0x00728b60]
lea r8, [0x009210a0]
jmp 0x4d92c0
xor edx, edx
xor r8d, r8d
nop
test rdx, rdx
je 0x4d92db
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
mov rax, rdx
mov rbx, r8
add rsp, 0x50
pop rbp
ret
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x004d93a0]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x23], 1
mov rax, qword [rsi + 0x10]
mov dword [rsp + 0x24], edi
lea rdi, [rsp + 0x24]
mov esi, 4
call fcn.004c15e0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x23], 0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx]
call r8
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x50
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727ec0]
call fcn.00436ac0
nop
call fcn.00435fa0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004d9220
Function at 0x4d9400
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d953d
push rbp
mov rbp, rsp
sub rsp, 0x78
movq qword [rsp + 0x70], xmm15
mov byte [rsp + 0x4f], 0
movups xmmword [rsp + 0x50], xmm15
test byte [rax], al
jmp 0x4d942b
mov rax, r13
mov rdx, qword [rax]
bt edx, 0
jb 0x4d946b
lea r12, [rdx + 8]
nop dword [rax + rax]
test r12, 0x7ffff8
je 0x4d9514
mov r13, rax
mov rax, rdx
lock cmpxchg qword [r13], r12
sete r12b
nop dword [rax]
test r12b, r12b
je 0x4d9428
bt edx, 0
jmp 0x4d946e
mov r13, rax
jae 0x4d949a
cmp byte [r13 + 0x21f], 0
je 0x4d948a
mov rdx, qword [0x008be550]
mov r12, qword [0x008be558]
jmp 0x4d94a0
lea rdx, [0x00728b60]
lea r12, [0x009210a0]
jmp 0x4d94a0
xor edx, edx
xor r12d, r12d
nop
test rdx, rdx
je 0x4d94bb
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r12
mov rax, rdx
mov rbx, r12
add rsp, 0x78
pop rbp
ret
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x004d95a0]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r13
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x4f], 1
mov rax, qword [r13 + 0x10]
call fcn.004c0880
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x4f], 0
mov rdx, qword [rsp + 0x70]
mov r12, qword [rdx]
call r12
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x78
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727ec0]
call fcn.00436ac0
nop
call fcn.00435fa0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.004646a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004d9400
Function at 0x4da4c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4da6d5
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
test rdi, rdi
je 0x4da686
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
cmp qword [0x008bd9f0], rdi
je 0x4da510
xor edx, edx
jmp 0x4da540
mov rcx, qword [0x008bd9f8]
mov rax, rdi
mov rbx, rsi
nop dword [rax]
call fcn.00404940
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov edx, eax
mov rax, qword [rsp + 0x48]
test dl, dl
jne 0x4da686
cmp qword [0x008be550], rdi
jne 0x4da592
mov rcx, qword [0x008be558]
mov rax, rdi
mov rbx, rsi
nop
call fcn.00404940
test al, al
je 0x4da579
mov rdi, qword [0x008cc2d0]
mov rsi, qword [0x008cc2d8]
jmp 0x4da5d8
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
cmp byte [0x009210aa], 0
je 0x4da5d8
mov rcx, qword [0x008be550]
mov rdx, qword [0x008be558]
mov rax, rdi
mov rbx, rsi
mov rdi, rdx
call fcn.00473760
test al, al
jne 0x4da692
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
lea rax, [0x006850e0]
call fcn.0040d680
mov rcx, qword [rsp + 0x58]
mov qword [rax + 8], rcx
cmp dword [0x00921500], 0
nop
jne 0x4da609
mov rcx, qword [rsp + 0x50]
jmp 0x4da616
call fcn.004665a0
mov rcx, qword [rsp + 0x50]
mov qword [r11], rcx
mov qword [rax], rcx
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x230]
mov rcx, qword [rcx + 0x228]
mov qword [rax + 0x18], rdx
cmp dword [0x00921500], 0
je 0x4da648
nop dword [rax]
call fcn.004665a0
mov qword [r11], rcx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
cmp dword [0x00921500], 0
jne 0x4da665
mov rcx, qword [rsp + 0x30]
jmp 0x4da672
call fcn.004665a0
mov rcx, qword [rsp + 0x30]
mov qword [r11], rcx
mov qword [rax + 0x28], rcx
mov rbx, rax
lea rax, [0x00728800]
add rsp, 0x38
pop rbp
ret
mov rax, rdi
mov rbx, rsi
add rsp, 0x38
pop rbp
ret
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x68]
call rcx
mov ecx, 0x2f
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006c0e74]
call fcn.0044f620
nop dword [rax + rax]
call fcn.0040ae40
mov rbx, rax
lea rax, [0x0065b7a0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004da4c0
Function at 0x4db580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db5d2
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x4db5a9
call fcn.004d4600
nop dword [rax]
test al, al
jne 0x4db5be
mov rax, qword [rsp + 0x20]
call fcn.004613c0
mov rax, qword [rsp + 0x20]
call fcn.00461800
add rsp, 0x10
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727770]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.004db580