joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b510
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49b5a2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x11
jne 0x49b559
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006d8289]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1e
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.0049b510

Function at 0x49b650
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49b6e2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x49b699
movzx eax, word [rax + 0x30]
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006d8795]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1f
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.0049b650

Function at 0x49b6f0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49b7c5
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x49b77c
movzx ecx, byte [rax + 0x14]
test cl, 1
je 0x49b773
mov rcx, 0x48
add rcx, rax
test byte [rcx], al
movzx ecx, word [rax + 0x32]
movzx eax, word [rax + 0x30]
and ecx, 0x7fff
add ecx, eax
movzx eax, ax
movzx ecx, cx
cmp rax, rcx
ja 0x49b76c
sub rcx, rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00429450
ud2
mov rcx, 0x38
jmp 0x49b73a
lea rax, [0x006d8b0b]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x20
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.0049b6f0
Function at 0x49b7d0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x49b8fc
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x49b8b3
movzx ecx, byte [rax + 0x14]
test cl, 1
je 0x49b8a7
mov rcx, 0x48
add rcx, rax
test byte [rcx], al
movzx edx, word [rax + 0x32]
movzx eax, word [rax + 0x30]
and edx, 0x7fff
add edx, eax
movzx eax, ax
movzx edx, dx
cmp rax, rdx
ja 0x49b8a0
sub rdx, rax
lea rbx, [rax - 0x100000]
neg rbx
dec rbx
sar rbx, 0x3f
shl rax, 3
xor rbx, 0xffffffffffffffff
and rax, rbx
add rax, rcx
mov rcx, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x49b899
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x49b892
lea rcx, [0x007ecc20]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rcx, rax
jmp 0x49b87e
call fcn.004293e0
ud2
call fcn.00429450
ud2
mov rcx, 0x38
jmp 0x49b822
lea rax, [0x006d7c87]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1d
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.0049b7d0
Function at 0x4a24a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a255f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
cmp rcx, 8
jne 0x4a2516
movzx eax, byte [rax + 0x17]
test al, 0x80
jne 0x4a2516
mov rax, qword [rsp + 0x50]
test rax, 0x80
je 0x4a2502
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006db13a]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x29
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.004a24a0

Function at 0x4a2990
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a2af8
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x4a2a72
test rax, 0x60
jne 0x4a29db
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
call fcn.004a2810
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov qword [rsp], 0
lea rdx, [0x006d0a65]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
lea rax, [0x006dbbe7]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x2c
call fcn.00442520
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.004a2810
mov rax, qword [rsp]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x48], rcx
lea rdx, [0x006960a0]
mov qword [rsp], rdx
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4a2ade
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
lea rcx, [0x00681000]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
mov qword [rsp], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x50]
jmp 0x4a2abf
call fcn.00452210
jmp fcn.004a2990
Function at 0x4a2b10
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 8]
cmp rax, qword [rcx + 0x10]
jbe 0x4a2d2f
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x4a2ca9
test rax, 0x60
jne 0x4a2c12
test rax, 0x100
je 0x4a2b7b
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
call fcn.004a2810
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov qword [rsp], 0
lea rdx, [0x006d0a65]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
lea rax, [0x006d6612]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x1a
call fcn.00442520
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.004a2810
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov qword [rsp], 0
lea rdx, [0x006d0a65]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
lea rax, [0x006dbbe7]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x2c
call fcn.00442520
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.004a2810
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp]
mov qword [rsp + 0x58], rcx
lea rdx, [0x006960a0]
mov qword [rsp], rdx
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4a2d15
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
lea rcx, [0x00681000]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
mov qword [rsp], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x50]
jmp 0x4a2cf6
call fcn.00452210
jmp fcn.004a2b10
Function at 0x4a2da0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a2e81
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.004a28b0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0049abf0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx + 0xa0]
mov qword [rsp], rax
call rcx
mov rax, qword [rsp + 8]
cmp rax, 8
jne 0x4a2e38
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006da2f1]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x25
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.004a2da0
Function at 0x4a3ac0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a3c6e
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [rsp + 0x70]
mov rcx, rax
and rax, 0x1f
mov qword [rsp + 0x20], rax
cmp rax, 0x19
jne 0x4a3bfc
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x38]
mov rax, qword [rax + 0x40]
mov rbx, qword [rsp + 0x78]
cmp rbx, rax
jae 0x4a3bb3
lea rax, [rbx + rbx*2]
mov rbx, qword [rdx + rax*8 + 8]
mov rsi, qword [rdx + rax*8]
movzx edi, byte [rbx + 0x17]
and edi, 0x1f
and rcx, 0x1a0
or rdi, rcx
movzx ecx, byte [rsi]
test cl, 1
je 0x4a3b73
mov rax, qword [rdx + rax*8 + 0x10]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rsp + 0x68]
add rax, rcx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rdi
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rcx, [rsi + 3]
mov qword [rsp + 0x30], rcx
movzx ecx, byte [rsi + 2]
movzx esi, byte [rsi + 1]
shl rsi, 8
or rsi, rcx
mov qword [rsp + 0x38], rsi
test rsi, rsi
jne 0x4a3bad
or rdi, 0x40
jmp 0x4a3b44
or rdi, 0x20
jmp 0x4a3b44
lea rax, [0x006d91c2]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x21
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
lea rcx, [0x006960a0]
mov qword [rsp], rcx
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x28], rax
mov qword [rax + 8], 0x13
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4a3c52
lea rcx, [0x006d3e25]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x10], rcx
lea rcx, [0x00681000]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
mov qword [rsp], rax
lea rcx, [0x006d3e25]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x28]
jmp 0x4a3c32
call fcn.00452210
jmp fcn.004a3ac0
Function at 0x4a3d80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a403a
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x80]
mov rcx, rax
and rax, 0x1f
mov qword [rsp + 0x20], rax
cmp rax, 0x11
jne 0x4a3e6b
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x40]
mov rbx, qword [rsp + 0x88]
cmp rbx, rdx
jae 0x4a3e22
mov rax, qword [rax + 0x30]
mov rdx, qword [rax]
movzx esi, byte [rax + 0x17]
mov qword [rsp + 0x90], rax
imul rbx, rdx
mov rax, qword [rsp + 0x78]
add rax, rbx
mov qword [rsp + 0x98], rax
and esi, 0x1f
and rcx, 0x1e0
or rsi, rcx
mov qword [rsp + 0xa0], rsi
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x006d9204]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x21
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
cmp rax, 0x17
jne 0x4a3f21
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax + 8]
mov rbx, qword [rsp + 0x88]
cmp rbx, rdx
jae 0x4a3ed8
mov rdx, qword [rsp + 0x70]
mov rdx, qword [rdx + 0x30]
mov rsi, qword [rdx]
mov rax, qword [rax]
movzx edi, byte [rdx + 0x17]
mov qword [rsp + 0x90], rdx
imul rbx, rsi
add rax, rbx
mov qword [rsp + 0x98], rax
and edi, 0x1f
and rcx, 0x60
or rcx, 0x180
or rdi, rcx
mov qword [rsp + 0xa0], rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x006d9225]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x21
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
cmp rax, 0x18
jne 0x4a3fc8
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax + 8]
mov rbx, qword [rsp + 0x88]
cmp rbx, rdx
jae 0x4a3f7f
mov rax, qword [rax]
mov rdx, qword [0x00896530]
mov qword [rsp + 0x90], rdx
add rax, rbx
mov qword [rsp + 0x98], rax
and rcx, 0x60
or rcx, 8
or rcx, 0x80
mov qword [rsp + 0xa0], rcx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x006d9720]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x22
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
lea rcx, [0x006960a0]
mov qword [rsp], rcx
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x28], rax
mov qword [rax + 8], 0x13
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4a401e
lea rcx, [0x006d3e4b]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x10], rcx
lea rcx, [0x00681000]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
mov qword [rsp], rax
lea rcx, [0x006d3e4b]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x28]
jmp 0x4a3ffe
call fcn.00452210
jmp fcn.004a3d80
Function at 0x4a42f0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a450f
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x4a449e
movzx ecx, byte [rsp + 0x80]
test cl, cl
je 0x4a433e
test rax, 0x60
jne 0x4a4455
test rax, 0x200
jne 0x4a440f
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x70], rcx
mov rbx, rax
and rax, 0x1f
cmp rax, 0x14
jne 0x4a43d8
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
call fcn.004a4e40
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x4a43b2
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
test rcx, rcx
je 0x4a4398
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
call fcn.004a2570
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rcx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rcx, [0x006d07d4]
mov qword [rsp], rcx
mov qword [rsp + 8], 9
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
call fcn.00498070
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
jmp 0x4a4354
lea rax, [0x006df345]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x55
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
lea rax, [0x006960a0]
mov qword [rsp], rax
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x40], rax
mov qword [rax + 8], 0x17
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4a44f3
lea rcx, [0x006d57fe]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
lea rcx, [0x00681000]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
mov qword [rsp], rax
lea rcx, [0x006d57fe]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x40]
jmp 0x4a44d4
call fcn.00452210
jmp fcn.004a42f0
Function at 0x4a5c40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a5e84
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x4a5e13
test rax, 0x200
je 0x4a5df0
sar rax, 0xa
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x60]
movzx edx, byte [rcx + 0x17]
and edx, 0x1f
cmp rdx, 0x14
jne 0x4a5d2f
mov rdx, qword [rcx + 0x40]
mov rbx, qword [rcx + 0x38]
cmp rax, rdx
jae 0x4a5ce6
shl rax, 3
mov eax, dword [rbx + rax + 4]
mov dword [rsp + 8], eax
mov qword [rsp], rcx
call fcn.00499310
mov rax, qword [rsp + 0x10]
lea rcx, [0x007ecc20]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x006dc06a]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x2d
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
mov qword [rsp], rcx
call fcn.004993d0
mov rax, qword [rsp + 8]
test rax, rax
je 0x4a5da7
movzx ecx, word [rax + 4]
movzx edx, cx
mov rbx, qword [rsp + 0x20]
cmp rbx, rdx
jae 0x4a5da7
mov edx, dword [rax + 8]
add rax, rdx
test byte [rax], al
movzx ecx, cx
cmp rbx, rcx
jae 0x4a5da0
shl rbx, 4
mov eax, dword [rax + rbx + 4]
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov dword [rsp + 8], eax
call fcn.00499310
mov rax, qword [rsp + 0x10]
lea rcx, [0x007ecc20]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.004293e0
ud2
lea rax, [0x006dc06a]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x2d
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
lea rax, [0x007ecc20]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x006960a0]
mov qword [rsp], rax
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x28], rax
mov qword [rax + 8], 0x12
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4a5e68
lea rcx, [0x006d3726]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
lea rcx, [0x00681000]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
mov qword [rsp], rax
lea rcx, [0x006d3726]
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x28]
jmp 0x4a5e49
call fcn.00452210
jmp fcn.004a5c40
Function at 0x4a66a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a6954
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 0xa0]
mov rdx, qword [rsp + 0x80]
mov qword [rsp], rdx
call rcx
mov rax, qword [rsp + 8]
cmp rax, 0x17
jne 0x4a690b
mov rax, qword [rsp + 0x88]
test rax, rax
jl 0x4a68c2
mov rcx, qword [rsp + 0x90]
test rcx, rcx
jl 0x4a6879
cmp rax, rcx
jg 0x4a6830
lea rdx, [0x0069fa60]
mov qword [rsp], rdx
call fcn.0040f840
mov rax, qword [rsp + 8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx + 0x50]
mov rbx, qword [rsp + 0x80]
mov qword [rsp], rbx
call rdx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
test rcx, rcx
je 0x4a6760
mov rcx, qword [rcx + 8]
lea rdx, [0x006c7880]
cmp rdx, rcx
jne 0x4a6814
mov qword [rsp], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 8], rax
call fcn.0040f9e0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x20]
mov qword [rdx + 8], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rdx + 0x10], rcx
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x4a67ff
mov qword [rdx], rax
mov rax, qword [rsp + 0x78]
mov rax, qword [rax + 0x108]
mov rcx, qword [rsp + 0x80]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0x97
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp], rdx
mov qword [rsp + 8], rax
call fcn.00410240
mov rdx, qword [rsp + 0x20]
jmp 0x4a67b5
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
lea rax, [0x006bdfe0]
mov qword [rsp + 0x10], rax
call fcn.0040cb00
ud2
lea rax, [0x006d765a]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x1c
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
lea rax, [0x006d8757]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x1f
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
lea rax, [0x006d8776]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x1f
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
lea rax, [0x006d9bdf]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0x23
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a540
ud2
call fcn.00452210
jmp fcn.004a66a0