joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a63c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a65bb
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
nop dword [rax + rax]
cmp rdi, 8
ja 0x4a65a7
test sil, sil
je 0x4a63f9
cmp rcx, 8
jne 0x4a6594
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x00944320], rdx
jl 0x4a6435
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
mov qword [rsp + 0x98], rcx
xor edx, edx
jmp 0x4a6485
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rax + 8], r8
lea r8, [r8 + r8*2]
shl r8, 4
lea r12, [r8 + r11]
lea r12, [r12 - 0x30]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r12], xmm0
lea r8, [r8 + r11]
lea r8, [r8 - 0x20]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r8 + 0x10], xmm0
inc qword [rax + 0x38]
inc rdx
mov rcx, r9
cmp rdi, rdx
jle 0x4a6585
cmp rdx, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rdx
mov r10d, 1
shl r10d, cl
and r10d, r8d
test sil, r10b
mov r8d, 2
mov r10d, 3
cmovne r8, r10
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
mov qword [rsp + 0x48], r8
imul rcx, r9
lea r8, [rbx + rcx]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov r8, qword [rax + 0x38]
mov qword [rsp + 0x68], r8
mov r8, qword [rax + 8]
inc r8
mov r11, qword [rax]
mov rcx, qword [rax + 0x10]
nop word [rax + rax]
cmp rcx, r8
jae 0x4a6441
mov qword [rsp + 0x40], rdx
mov rax, r11
mov rbx, r8
mov edi, 1
lea rsi, [0x006b51c0]
call fcn.0044a8e0
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 0x10], rcx
cmp dword [0x013760e0], 0
jne 0x4a6540
mov qword [rdi], rax
jmp 0x4a6545
call fcn.00465580
mov rdx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x98]
mov r10d, 3
mov r8, rbx
mov r11, rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
nop
jmp 0x4a6441
mov eax, 1
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006797e0]
lea rbx, [0x00758520]
call fcn.004363c0
lea rax, [0x006797e0]
lea rbx, [0x00758340]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp fcn.004a63c0
Function at 0x4a6f40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a6fa7
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp rcx, 8
ja 0x4a6f93
test rcx, rcx
je 0x4a6f93
lea rdx, [rcx - 1]
test rdx, rcx
jne 0x4a6f93
test byte [rax], al
cmp rbx, 9
jae 0x4a6f86
lea rbx, [rax + rbx*8]
mov rax, rdi
call fcn.004613e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rbx
mov ecx, 9
call fcn.00465a20
lea rax, [0x006797e0]
lea rbx, [0x00758350]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004a6f40

Function at 0x4a6fe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a7047
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp rcx, 8
ja 0x4a7033
test rcx, rcx
je 0x4a7033
lea rdx, [rcx - 1]
test rdx, rcx
jne 0x4a7033
test byte [rax], al
cmp rbx, 9
jae 0x4a7026
lea rax, [rax + rbx*8]
mov rbx, rdi
call fcn.004613e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rbx
mov ecx, 9
call fcn.00465a20
lea rax, [0x006797e0]
lea rbx, [0x00758350]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004a6fe0
Function at 0x4a8cc0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x200]
cmp r12, qword [r14 + 0x10]
jbe 0x4a8f79
sub rsp, 0x280
mov qword [rsp + 0x278], rbp
lea rbp, [rsp + 0x278]
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x298], rcx
mov qword [rsp + 0x2a0], rdi
bt esi, 9
jae 0x4a8f65
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf8], rcx
nop
movzx edx, byte [rcx + 0x17]
mov byte [rsp + 0xcf], dl
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
call fcn.004b0bc0
mov rdx, qword [rsp + 0xe0]
and edx, 0x1e0
movzx edi, byte [rsp + 0xcf]
and edi, 0x1f
or rdi, rdx
mov rdx, qword [fcn.004a9da0]
lea r8, vtable.Ld_M_f.1.0
nop word [rax + rax]
cmp rax, r8
jne 0x4a8f56
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe8], rbx
nop
lea rcx, [0x004b20c0]
mov qword [rsp + 0xd0], rcx
movups xmmword [rsp + 0x1c0], xmm15
lea rdi, [rsp + 0x1c8]
lea rdi, [rdi - 0x10]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465ccf
mov rbp, qword [rbp]
mov rax, rbx
xor ebx, ebx
call fcn.004ac220
mov rcx, qword [rsp]
mov qword [rsp + 0x1c0], rcx
lea rdi, [rsp + 0x1c8]
lea rsi, [rsp + 8]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466006
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x1c0]
mov qword [rsp + 0x108], rcx
lea rdi, [rsp + 0x110]
lea rsi, [rsp + 0x1c8]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00466006
mov rbp, qword [rbp]
lea rax, [0x006a3e60]
call fcn.0040d900
mov rcx, qword [rsp + 0xd0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1b0]
cmp dword [0x013760e0], 0
jne 0x4a8e82
mov qword [rax + 8], rcx
nop
jmp 0x4a8e8b
lea rdi, [rax + 8]
call fcn.00465680
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0x198]
mov qword [rax + 0x10], rdx
movzx edx, word [rsp + 0x1b8]
mov word [rax + 0x18], dx
mov r8, qword [rsp + 0xe0]
sar r8, 0xa
mov qword [rax + 0x20], r8
mov rsi, qword [rsp + 0xd8]
mov qword [rax + 0x38], rsi
cmp dword [0x013760e0], 0
jne 0x4a8eea
mov rcx, qword [rsp + 0xf8]
mov qword [rax + 0x28], rcx
mov rdi, qword [rsp + 0x100]
mov qword [rax + 0x30], rdi
jmp 0x4a8f0f
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0xf8]
call fcn.00465680
lea rdi, [rax + 0x30]
mov r9, qword [rsp + 0x100]
call fcn.00465720
mov rdi, r9
mov rax, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x290]
nop
call fcn.004ad8a0
mov rax, qword [rsp + 0xe8]
test byte [rax], al
mov rcx, qword [rsp + 0xe0]
and ecx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0x278]
add rsp, 0x280
ret
mov rbx, rdx
lea rcx, [0x006bc320]
call fcn.0040ac00
lea rax, [0x006797e0]
lea rbx, [0x007584a0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004a8cc0
Function at 0x4a9d20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9d87
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x12
jne 0x4a9d54
mov rax, qword [rax + 0x38]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004a9940
mov ecx, 0x22
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006d782c]
call fcn.0044e740
call fcn.0040af60
mov rbx, rax
lea rax, [0x006797e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
call fcn.004633c0
mov rax, qword [rsp + 8]
jmp fcn.004a9d20

Function at 0x4a9da0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9ed5
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop
cmp rcx, 0x12
ja 0x4a9e20
cmp rcx, 0x11
jne 0x4a9def
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x4a9dde
lea rax, vtable.Ld_M_f.1.0
jmp 0x4a9de2
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x12
jne 0x4a9e9f
mov rcx, qword [rax + 0x30]
nop dword [rax]
test rcx, rcx
je 0x4a9e0e
lea rax, vtable.Ld_M_f.1.0
jmp 0x4a9e12
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x15
jne 0x4a9e49
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x4a9e38
lea rax, vtable.Ld_M_f.1.0
jmp 0x4a9e3c
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x16
jne 0x4a9e73
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x4a9e62
lea rax, vtable.Ld_M_f.1.0
nop
jmp 0x4a9e66
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x17
jne 0x4a9e9f
mov rcx, qword [rax + 0x30]
nop dword [rax]
test rcx, rcx
je 0x4a9e8e
lea rax, vtable.Ld_M_f.1.0
jmp 0x4a9e92
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
nop
call fcn.004a9940
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006d5a33]
call fcn.0044e740
nop
call fcn.0040af60
mov rbx, rax
lea rax, [0x006797e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
call fcn.004633c0
mov rax, qword [rsp + 8]
jmp fcn.004a9da0
Function at 0x4aa040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa109
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx esi, byte [rax + 0x17]
and esi, 0x1f
nop
cmp rsi, 0x13
jne 0x4aa0d6
movzx esi, byte [rax + 0x14]
test sil, 1
je 0x4aa077
mov ecx, 0x48
jmp 0x4aa07c
mov ecx, 0x38
movzx edx, word [rax + 0x30]
test dx, dx
jne 0x4aa08b
xor edx, edx
xor esi, esi
jmp 0x4aa098
lea rsi, [rax + rcx]
cmp rdx, 0x100000
ja 0x4aa0cc
cmp rbx, rdx
jae 0x4aa0c1
mov rcx, qword [rsi + rbx*8]
test rcx, rcx
je 0x4aa0af
lea rax, vtable.Ld_M_f.1.0
jmp 0x4aa0b3
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov rax, rbx
mov rcx, rdx
call fcn.00465a20
mov ebx, 0x100000
call fcn.00465b20
call fcn.004a9940
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006d52af]
call fcn.0044e740
call fcn.0040af60
mov rbx, rax
lea rax, [0x006797e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004aa040

Function at 0x4aa140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa1bc
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x15
jne 0x4aa189
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x4aa178
lea rax, vtable.Ld_M_f.1.0
jmp 0x4aa17c
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004a9940
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006d52cc]
call fcn.0044e740
call fcn.0040af60
mov rbx, rax
lea rax, [0x006797e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
call fcn.004633c0
mov rax, qword [rsp + 8]
jmp fcn.004aa140

Function at 0x4aa1e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa247
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x11
jne 0x4aa214
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004a9940
mov ecx, 0x1f
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006d61a1]
call fcn.0044e740
call fcn.0040af60
mov rbx, rax
lea rax, [0x006797e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
call fcn.004633c0
mov rax, qword [rsp + 8]
jmp fcn.004aa1e0

Function at 0x4aa2e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa347
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x13
jne 0x4aa314
movzx eax, word [rax + 0x30]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004a9940
mov ecx, 0x20
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006d67f0]
call fcn.0044e740
call fcn.0040af60
mov rbx, rax
lea rax, [0x006797e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
call fcn.004633c0
mov rax, qword [rsp + 8]
jmp fcn.004aa2e0
Function at 0x4aa360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa3f5
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx edx, byte [rax + 0x17]
and edx, 0x1f
nop
cmp rdx, 0x13
jne 0x4aa3c0
movzx edx, word [rax + 0x32]
and edx, 0x7fff
test dx, dx
jne 0x4aa399
xor ecx, ecx
jmp 0x4aa3aa
movzx eax, word [rax + 0x30]
add edx, eax
movzx ecx, dx
cmp rax, rcx
ja 0x4aa3b7
sub rcx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00465b80
nop dword [rax]
call fcn.004a9940
mov ecx, 0x21
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006d7010]
call fcn.0044e740
nop
call fcn.0040af60
mov rbx, rax
lea rax, [0x006797e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
call fcn.004633c0
mov rax, qword [rsp + 8]
jmp fcn.004aa360

Function at 0x4aa420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa50d
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx edx, byte [rax + 0x17]
and edx, 0x1f
nop
cmp rdx, 0x13
jne 0x4aa4da
movzx edx, byte [rax + 0x14]
test dl, 1
je 0x4aa45a
mov ecx, 0x48
jmp 0x4aa45f
mov ecx, 0x38
movzx edx, word [rax + 0x32]
and edx, 0x7fff
test dx, dx
jne 0x4aa474
xor edx, edx
xor esi, esi
jmp 0x4aa4a0
movzx esi, word [rax + 0x30]
add edx, esi
lea rdi, [rax + rcx]
movzx ecx, dx
cmp rsi, rcx
ja 0x4aa4d3
sub rcx, rsi
mov rdx, rcx
neg rcx
shl rsi, 3
sar rcx, 0x3f
and rsi, rcx
add rsi, rdi
nop dword [rax]
cmp rbx, rdx
jae 0x4aa4c8
mov rcx, qword [rsi + rbx*8]
test rcx, rcx
je 0x4aa4b7
lea rax, vtable.Ld_M_f.1.0
jmp 0x4aa4bb
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rbx
mov rcx, rdx
call fcn.00465a20
mov eax, esi
call fcn.00465b80
call fcn.004a9940
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006d5a6f]
call fcn.0044e740
call fcn.0040af60
mov rbx, rax
lea rax, [0x006797e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004aa420
Function at 0x4acee0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4acf93
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
movups xmmword [rsp + 0x30], xmm15
movzx edx, byte [rax + 0x17]
test dl, 0x20
jne 0x4acf56
bt ecx, 7
jae 0x4acf7f
bt ecx, 8
jae 0x4acf4f
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
call fcn.0045eaa0
mov qword [rsp + 0x18], rax
mov rbx, rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
nop
call fcn.0045eda0
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x4acf6b
bt ecx, 7
jae 0x4acf66
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rcx
jmp 0x4acf6b
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006797e0]
lea rbx, [0x00757e58]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004acee0

Function at 0x4ad700
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad866
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rbx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
je 0x4ad775
cmp rcx, 0x17
jne 0x4ad825
nop dword [rax]
call fcn.004a9da0
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
cmp rax, 8
jne 0x4ad810
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rax
nop
call fcn.004a9da0
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
cmp rax, 8
jne 0x4ad7fd
mov rdx, qword [rsp + 0x10]
bt edx, 8
jae 0x4ad7ea
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rdx + 0x40]
test rcx, rcx
jl 0x4ad7e5
mov rax, qword [rsp + 0x20]
mov rdx, rax
neg rax
nop dword [rax + rax]
cmp rcx, rax
ja 0x4ad7d5
mov rax, rdx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
test rdx, rdx
je 0x4ad7e0
call fcn.0045d080
nop
call fcn.0045d0c0
call fcn.0045d080
lea rax, [0x006797e0]
lea rbx, [0x00758500]
call fcn.004363c0
lea rax, [0x006797e0]
lea rbx, [0x007584f0]
call fcn.004363c0
lea rax, [0x006797e0]
lea rbx, [0x007584e0]
nop
call fcn.004363c0
mov qword [rsp + 0x10], rcx
lea rax, [0x0069b1e0]
call fcn.0040d900
mov qword [rax + 8], 0x13
lea rcx, [0x006d06fb]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006844e0]
nop dword [rax + rax]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004ad700
Function at 0x4aee00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aeee6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x19
jne 0x4aeea5
mov rsi, qword [rax + 0x38]
cmp qword [rax + 0x40], rdi
jbe 0x4aee91
lea rdi, [rdi + rdi*2]
mov rax, qword [rsi + rdi*8 + 8]
mov r8, qword [rsi + rdi*8]
and edx, 0x1a0
movzx r9d, byte [rax + 0x17]
and r9d, 0x1f
or rdx, r9
nop
movzx r8d, byte [r8]
nop dword [rax]
test r8b, 1
jne 0x4aee7e
mov r9, rdx
or rdx, 0x40
or r9, 0x20
test r8b, 8
cmovne r9, rdx
nop
nop
mov rdx, r9
nop
add rbx, qword [rsi + rdi*8 + 0x10]
mov rcx, rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006797e0]
lea rbx, [0x00758590]
nop
call fcn.004363c0
mov qword [rsp + 0x10], rcx
lea rax, [0x0069b1e0]
call fcn.0040d900
mov qword [rax + 8], 0x13
lea rcx, [0x006d070e]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006844e0]
nop dword [rax + rax]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004aee00
Function at 0x4aef20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af0ac
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
jne 0x4aefa0
cmp qword [rax + 0x40], rdi
jbe 0x4af098
mov rax, qword [rax + 0x30]
test rdx, 0x60
mov ecx, 0
mov esi, 0x20
cmovne rcx, rsi
mov rsi, qword [rax]
imul rdi, rsi
nop
and edx, 0x180
or rcx, rdx
movzx edx, byte [rax + 0x17]
and edx, 0x1f
or rcx, rdx
nop
add rbx, rdi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
jne 0x4aeff3
cmp qword [rbx + 8], rdi
jbe 0x4af085
mov rax, qword [rax + 0x30]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
mov rdx, qword [rax]
movzx esi, byte [rax + 0x17]
and esi, 0x1f
or rcx, rsi
or rcx, 0x180
nop
nop
imul rdi, rdx
add rdi, qword [rbx]
mov rbx, rdi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x18
jne 0x4af047
cmp qword [rbx + 8], rdi
jbe 0x4af034
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
mov rdx, qword [rbx]
or rcx, 0x88
mov rax, qword [0x0131fa40]
nop
lea rbx, [rdx + rdi]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006797e0]
lea rbx, [0x007585b0]
call fcn.004363c0
mov qword [rsp + 0x10], rcx
lea rax, [0x0069b1e0]
call fcn.0040d900
mov qword [rax + 8], 0x13
lea rcx, [0x006d0734]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006844e0]
nop dword [rax]
call fcn.004363c0
lea rax, [0x006797e0]
lea rbx, [0x00757e18]
call fcn.004363c0
lea rax, [0x006797e0]
lea rbx, [0x007585a0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004aef20
Function at 0x4af0e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af1ef
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
test rcx, rcx
je 0x4af1b8
test dil, dil
je 0x4af11d
test rcx, 0x60
jne 0x4af1a5
bt ecx, 9
jae 0x4af13d
mov rdi, rbx
mov rsi, rcx
mov ebx, 9
mov rcx, rax
lea rax, [0x006cc97c]
call fcn.004a8cc0
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x14
jne 0x4af193
mov qword [rsp + 0x28], rbx
mov rcx, rdx
call fcn.004afe00
test rax, rax
je 0x4af17d
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
mov rbx, qword [rcx + 8]
test rdx, rdx
je 0x4af170
mov rdx, qword [rdx + 8]
mov rax, rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, rdx
call fcn.004acee0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006797e0]
lea rbx, [0x007585c0]
call fcn.004363c0
lea rax, [0x0069b1e0]
nop
call fcn.0040d900
mov qword [rax + 8], 0x17
lea rcx, [0x006d25e5]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006844e0]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp fcn.004af0e0
Function at 0x4af2e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af479
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x4af36f
cmp rcx, 0x11
je 0x4af361
nop dword [rax]
cmp rcx, 0x12
jne 0x4af419
nop
cmp qword [rax], 8
jne 0x4af465
nop
cmp qword [rax + 8], 0
nop dword [rax + rax]
je 0x4af465
bt edx, 7
jae 0x4af34f
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045e960
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x15
jne 0x4af3af
nop
cmp qword [rax], 8
nop word [rax + rax]
jne 0x4af44f
nop
cmp qword [rax + 8], 0
je 0x4af44f
bt edx, 7
jae 0x4af39b
mov rbx, qword [rbx]
mov rax, rbx
nop
call fcn.0045ed60
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x16
je 0x4af3c9
cmp rcx, 0x18
jne 0x4af419
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
call fcn.004a9da0
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
nop
cmp rax, 0x11
jne 0x4af406
mov rax, qword [rsp + 0x18]
call fcn.004a9da0
mov rcx, qword [rax + 0xa0]
mov rax, rbx
call rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006797e0]
lea rbx, [0x00758360]
call fcn.004363c0
lea rax, [0x0069b1e0]
call fcn.0040d900
mov qword [rax + 8], 0x11
lea rcx, [0x006cf770]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006844e0]
call fcn.004363c0
lea rax, [0x006797e0]
lea rbx, [0x00757e48]
nop dword [rax]
call fcn.004363c0
lea rax, [0x006797e0]
lea rbx, [0x00757e48]
call fcn.004363c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004af2e0