joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467040
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x30]
cmp qword [rax + 0x70], rcx
jb 0x467257
mov qword [rsp + 0x10], rax
mov qword [rax + 0xa8], 0
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rdx
mov qword [rcx + 0xb0], 0
mov qword [rsp], rdx
call fcn.00443fa0
cmp byte [rsp + 8], 0
jne 0x467176
mov rax, qword [rsp + 0x10]
mov qword [rax + 0xc0], 0
cmp byte [0x007d2d10], 0
je 0x467171
mov rcx, qword [rsp + 0x18]
jmp 0x467100
nop
mov rax, qword [0x007cc4b8]
mov qword [rsp], rax
mov dword [rsp + 8], 0
call fcn.0046e420
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
test rcx, rcx
je 0x467114
mov rdx, qword [rax + 0x30]
mov edx, dword [rdx + 0x274]
cmp dword [rcx + 0x14], edx
je 0x4670da
call fcn.0046c760
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xc0], rax
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
lea rax, [0x0066ac38]
mov qword [rsp], rax
nop
call fcn.0046a9e0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0xa0]
inc dword [rcx + 0x14]
mov byte [rax + 0xb7], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, rax
jmp 0x467129
cmp byte [0x007d2d10], 0
je 0x4671ad
mov rax, qword [rsp + 0x10]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0xa0]
mov rbx, qword [rsp + 0x18]
cmp rbx, rdx
je 0x467243
lea rax, fcn.00459ec0
mov qword [rsp], rax
call fcn.0046aa80
mov rax, qword [rsp + 0x10]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0xa0]
inc dword [rcx + 0x14]
mov qword [rsp], rax
movabs rcx, 0x200000003
mov qword [rsp + 8], rcx
call fcn.0043dac0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rcx, qword [rax + 0x30]
dec dword [rcx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x467233
mov qword [rax + 0x10], 0xfffffffffffffade
mov byte [rax + 0xb7], 0
cmp byte [0x007cdb78], 0
jne 0x46721a
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rax
nop
call fcn.00448180
cmp byte [rsp + 8], 0
jne 0x467210
call fcn.0043bda0
jmp 0x467210
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
jmp 0x467200
mov edx, dword [rdx + 0x14]
cmp dword [rcx + 0x274], edx
jne 0x46719d
jmp 0x4671ad
lea rax, [0x00666eb0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2d
call fcn.00439220
nop
int3
Function at 0x468380
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x468436
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
cmp rax, 0x20
jne 0x4683bd
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
nop dword [rax]
call fcn.0043aa00
lea rax, [0x00664d84]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0043b480
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x0065b251]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0043b480
mov qword [rsp], 0x20
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x0065e36c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.00439220
nop
call fcn.0046abe0
nop dword [rax + rax]
jmp fcn.00468380

Function at 0x4684c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x468620
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
jmp 0x4685c6
lea eax, [rdx + 1]
cmp eax, 0x41
jae 0x46852d
mov edx, eax
shr eax, 5
nop word [rax + rax]
cmp rax, 3
jae 0x468612
lea rbx, [0x008116ac]
mov esi, dword [rbx + rax*4]
bt esi, edx
jae 0x4684ed
btr esi, edx
mov dword [rbx + rax*4], esi
mov dword [rsp + 0x28], edx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov edx, dword [0x008116b8]
test edx, edx
jne 0x4685cd
xor eax, eax
lea rdx, [0x008116b8]
mov ebx, 1
lock cmpxchg dword [rdx], ebx
sete sil
test sil, sil
je 0x46852d
lea rax, [0x00811680]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
call fcn.0040c880
nop
mov qword [0x00811680], 0
mov eax, 3
lea rcx, [0x008116b8]
xor edx, edx
lock cmpxchg dword [rcx], edx
sete al
test al, al
je 0x46859b
mov ebx, 1
jmp 0x46852d
xor eax, eax
jmp 0x4685c0
lea rbx, [0x00811688]
lea rbx, [rbx + rax*4]
xchg dword [rbx], edx
lea rbx, [0x008116ac]
mov dword [rbx + rax*4], edx
inc rax
xor edx, edx
nop dword [rax + rax]
cmp rax, 3
jl 0x46859f
xor eax, eax
jmp 0x4684f0
cmp edx, 2
jne 0x4685f9
mov eax, 2
lea rdx, [0x008116b8]
xor ebx, ebx
lock cmpxchg dword [rdx], ebx
sete dl
test dl, dl
jne 0x4685f5
mov ebx, 1
jmp 0x46852d
xor edx, edx
jmp 0x46859b
lea rax, [0x00663238]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.00439220
mov ecx, 3
call fcn.0046cdc0
nop
nop dword [rax]
call fcn.0046abe0
jmp fcn.004684c0
Function at 0x46c7c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x403180
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.0040a360
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0046abe0
jmp 0x403120
cmp byte [0x008110db], 0
je 0x46c7df
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
lea rdx, [rsp + 0x18]
jmp 0x469c00
jmp 0x403120

Function at 0x46c800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x00811500]
nop
mov rcx, qword [rsp + 8]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*4]
xor rax, rcx
shl rcx, 0x20
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rcx, rax
movabs rax, 0x83cf8eadf876d2d7
imul rax, rcx
mov rcx, rax
shr rax, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x008110db], 0
je 0x46c83c
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x008117c0]
aesenc xmm0, xmmword [0x008117d0]
aesenc xmm0, xmmword [0x008117e0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a5e0

Function at 0x46c860
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x00811500]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x008110db], 0
je 0x46c89d
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x008117c0]
aesenc xmm0, xmmword [0x008117d0]
aesenc xmm0, xmmword [0x008117e0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a660

Function at 0x46e100
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00811740]
mov qword [rsp + 8], rdx
lea r8d, [0x008110f8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
add rsp, 0x30
ret
Function at 0x472a80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x472bb4
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
cmp qword [rsp + 0x38], 0
je 0x472b97
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
nop dword [rax]
test rcx, rcx
je 0x472afa
mov rdx, rcx
cmp rcx, 0xffffffffffffffff
je 0x472ab9
cmp qword [rsp + 0x38], rdx
jne 0x472b7b
add rax, 8
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00465700
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.004672e0
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rax
nop dword [rax]
call fcn.00465760
cmp byte [rsp + 0x18], 0
jne 0x472b38
call fcn.00467320
mov rax, qword [rsp + 0x30]
jmp 0x472ab9
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 8]
mov rdx, qword [rsp + 0x40]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
call fcn.00465700
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00465700
call fcn.00467320
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1a50]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1a40]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00472a80

Function at 0x473b20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x473c74
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
ja 0x473bc7
nop word [rax + rax]
cmp rcx, 0x11
jne 0x473b90
mov rax, qword [rax + 0x30]
test rax, rax
je 0x473b8a
lea rcx, [0x006a91a8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor ecx, ecx
xor eax, eax
jmp 0x473b76
cmp rcx, 0x12
jne 0x473c57
mov rax, qword [rax + 0x30]
nop
test rax, rax
je 0x473bc1
lea rcx, [0x006a91a8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
xor ecx, ecx
xor eax, eax
jmp 0x473bac
cmp rcx, 0x15
jne 0x473bf7
mov rax, qword [rax + 0x38]
test rax, rax
je 0x473bf1
lea rcx, [0x006a91a8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor ecx, ecx
xor eax, eax
jmp 0x473bdd
cmp rcx, 0x16
jne 0x473c27
mov rax, qword [rax + 0x30]
test rax, rax
je 0x473c21
lea rcx, [0x006a91a8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor ecx, ecx
xor eax, eax
jmp 0x473c0d
cmp rcx, 0x17
jne 0x473c57
mov rax, qword [rax + 0x30]
test rax, rax
je 0x473c51
lea rcx, [0x006a91a8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor ecx, ecx
xor eax, eax
jmp 0x473c3d
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1430]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00473b20
Function at 0x473e80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x473f0f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rdx + 0x17]
and ebx, 0x1f
cmp rbx, 0x13
jne 0x473ef2
movzx ebx, word [rdx + 0x32]
and ebx, 0x7fff
test bx, bx
jne 0x473ed6
xor eax, eax
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx eax, word [rdx + 0x30]
lea edx, [rbx + rax]
movzx ecx, dx
cmp rax, rcx
ja 0x473eed
sub rcx, rax
mov rax, rcx
jmp 0x473ec7
call fcn.0046cf20
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1480]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00473e80

Function at 0x473f20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x474015
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rdx + 0x17]
and ebx, 0x1f
cmp rbx, 0x13
jne 0x473ff8
movzx ebx, byte [rdx + 0x14]
test bl, 1
je 0x473fdf
mov eax, 0x48
movzx ebx, word [rdx + 0x32]
and ebx, 0x7fff
test bx, bx
jne 0x473fb3
xor eax, eax
xor ecx, ecx
mov rdx, qword [rsp + 0x28]
cmp rdx, rax
jae 0x473fe6
mov rax, qword [rcx + rdx*8]
test rax, rax
je 0x473fad
lea rcx, [0x006a91a8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor ecx, ecx
xor eax, eax
jmp 0x473f99
movzx esi, word [rdx + 0x30]
add ebx, esi
add rdx, rax
movzx ecx, bx
nop
cmp rsi, rcx
ja 0x473ff1
sub rcx, rsi
mov rax, rcx
neg rcx
shl rsi, 3
sar rcx, 0x3f
and rsi, rcx
lea rcx, [rdx + rsi]
jmp 0x473f7f
mov eax, 0x38
jmp 0x473f6c
mov rcx, rax
mov rax, rdx
call fcn.0046cdc0
mov eax, esi
call fcn.0046cf20
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1490]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00473f20
Function at 0x475a00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x475bd4
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, rax
and rax, 0x1f
mov qword [rsp + 0x10], rax
nop dword [rax]
cmp rax, 0x12
ja 0x475ac0
cmp rax, 0x11
je 0x475aa6
cmp rax, 0x12
jne 0x475b56
mov rax, qword [rsp + 0x28]
cmp qword [rax], 8
jne 0x475bb7
cmp qword [rax + 8], 0
je 0x475bb7
bt ecx, 7
jae 0x475a9f
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp], rax
call fcn.00465800
mov rax, qword [rsp + 8]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x30]
jmp 0x475a82
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rax, 0x15
jne 0x475b18
mov rax, qword [rsp + 0x28]
cmp qword [rax], 8
jne 0x475b9b
cmp qword [rax + 8], 0
nop word [rax + rax]
je 0x475b9b
bt ecx, 7
jae 0x475b11
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp], rax
call fcn.00465ba0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x30]
jmp 0x475af4
cmp rax, 0x17
je 0x475b3e
nop
cmp rax, 0x18
jne 0x475b56
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0062d980]
mov qword [rsp], rax
call fcn.0040e560
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0x11
lea rcx, [0x0065d8ed]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
lea rcx, [0x0061b6a0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a15f0]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a15f0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00475a00
Function at 0x47bf00
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rdx, 5
sar rsi, 0x3f
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x47bfd9
lea rsi, [rdx + rdx*2]
lea rdi, [0x007b42e0]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x47bf82
inc rdx
nop
jmp 0x47bf58
cmp r9, 0xffffffffffffffe0
jle 0x47bf8d
dec rdx
jmp 0x47bf58
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.0046cdc0
nop
int3
Function at 0x47c500
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x47c66d
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x38]
cmp rcx, 0x40
sbb rdx, rdx
mov rbx, qword [rsp + 0x30]
shl rbx, cl
and rbx, rdx
mov rdx, qword [rsp + 0x28]
cmp rdx, rbx
ja 0x47c650
mov rsi, qword [rsp + 0x40]
mov rdi, rsi
shl rsi, 1
nop dword [rax + rax]
cmp rbx, rsi
jb 0x47c634
lea rsi, [rdx + rdi]
shl rsi, 1
cmp rbx, rsi
ja 0x47c60e
sub rdx, rdi
shl rdx, 1
nop
cmp rbx, rdx
jae 0x47c5ff
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 0x18]
dec rbx
jmp 0x47c59a
dec qword [rdx + 0x18]
dec rbx
test rbx, rbx
jl 0x47c5bc
mov rcx, qword [rdx + 8]
mov rsi, qword [rdx]
cmp rbx, rcx
jae 0x47c62c
movzx esi, byte [rbx + rsi]
cmp sil, 0x39
je 0x47c593
test rbx, rbx
jge 0x47c5e8
mov rcx, qword [rdx + 8]
mov rbx, qword [rdx]
test rcx, rcx
jbe 0x47c625
mov byte [rbx], 0x31
mov qword [rdx + 0x18], 1
inc qword [rdx + 0x20]
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rsi, qword [rdx]
mov rcx, qword [rdx + 8]
cmp rbx, rcx
jae 0x47c61d
movzx eax, byte [rbx + rsi]
inc eax
mov byte [rsi + rbx], al
jmp 0x47c5d9
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rbx
call fcn.0046cdc0
xor eax, eax
call fcn.0046cdc0
mov rax, rbx
call fcn.0046cdc0
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a19c0]
mov qword [rsp + 8], rax
call fcn.00438920
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a19b0]
mov qword [rsp + 8], rax
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.0047c500
Function at 0x47fc80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x47fd95
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x68]
cmp rax, 0x64
jae 0x47fd74
mov rbx, qword [rsp + 0x70]
nop dword [rax]
cmp rbx, 0xa
jne 0x47fd2d
cmp rax, 0xa
jge 0x47fcff
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x47fd8f
lea rcx, [0x00664a00]
add rax, rcx
mov ecx, 1
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x47fd85
mov rdx, rax
shl rax, 1
cmp rcx, rax
jb 0x47fd80
lea rbx, [0x00669f08]
lea rax, [rbx + rdx*2]
mov ecx, 2
jmp 0x47fce8
xorps xmm0, xmm0
movups xmmword [rsp], xmm0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov word [rsp + 0x28], 0
call fcn.0047fee0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rbx, qword [rsp + 0x70]
jmp 0x47fd2d
call fcn.0046ce80
mov edx, 0xc8
call fcn.0046ce00
call fcn.0046ce80
nop
call fcn.0046abe0
jmp fcn.0047fc80

Function at 0x47fda0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x47feb7
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x68]
cmp rax, 0x64
jae 0x47fe9a
mov rbx, qword [rsp + 0x70]
nop dword [rax]
cmp rbx, 0xa
jne 0x47fe4d
cmp rax, 0xa
jge 0x47fe1f
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x47feb1
lea rcx, [0x00664a00]
add rax, rcx
mov ecx, 1
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x47fea7
mov rdx, rax
shl rax, 1
cmp rax, rcx
ja 0x47fea2
lea rbx, [0x00669f08]
lea rax, [rbx + rdx*2]
mov ecx, 2
jmp 0x47fe08
xorps xmm0, xmm0
movups xmmword [rsp], xmm0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
test rax, rax
setl byte [rsp + 0x28]
mov byte [rsp + 0x29], 0
call fcn.0047fee0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rbx, qword [rsp + 0x70]
nop
jmp 0x47fe4d
call fcn.0046ce80
mov edx, 0xc8
call fcn.0046ce00
call fcn.0046ce80
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.0047fda0
Function at 0x4848c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4849a7
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rsp + 0x30]
lea edx, [rcx + 1]
bt edx, 0
jae 0x484985
bt ecx, 2
jb 0x484959
mov rdx, qword [rsp + 0x28]
jmp 0x484908
mov ecx, dword [rdx]
mov eax, ecx
sar ecx, 3
test ecx, ecx
je 0x48494f
test eax, 7
jne 0x48494f
lea ecx, [rax - 8]
or ecx, 2
lock cmpxchg dword [rdx], ecx
sete cl
test cl, cl
je 0x484906
lea rax, [rdx + 4]
mov qword [rsp], rax
mov byte [rsp + 8], 0
mov qword [rsp + 0x10], 1
nop
call fcn.00467d80
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x28]
test byte [rax], al
add rax, 4
mov qword [rsp], rax
mov byte [rsp + 8], 1
mov qword [rsp + 0x10], 1
call fcn.00467d80
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00662e3a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.00466f80
mov ecx, dword [rsp + 0x30]
jmp 0x4848f9
call fcn.0046abe0
jmp fcn.004848c0

Function at 0x485c00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x485c90
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, dword [rsp + 0x30]
cmp eax, 0xffffffff
jne 0x485c87
lea rax, [0x00663ed5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00466f80
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
lock xadd dword [rcx + 0x14], eax
dec eax
test eax, eax
je 0x485c65
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [rcx + 8]
mov qword [rsp], rax
mov byte [rsp + 8], 0
mov qword [rsp + 0x10], 1
nop dword [rax + rax]
call fcn.00467d80
jmp 0x485c5b
cmp eax, 0xbfffffff
je 0x485c2d
jmp 0x485c46
call fcn.0046abe0
jmp fcn.00485c00

Function at 0x485d60
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x485e34
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov eax, 0x40000000
mov rcx, qword [rsp + 0x38]
lock xadd dword [rcx + 0x10], eax
add eax, 0x40000000
mov dword [rsp + 0x1c], eax
cmp eax, 0x40000000
jge 0x485e0d
xor edx, edx
jmp 0x485ddd
mov qword [rsp + 0x20], rdx
lea rax, [rcx + 0xc]
mov qword [rsp], rax
mov byte [rsp + 8], 0
mov qword [rsp + 0x10], 0
call fcn.00467d80
mov rax, qword [rsp + 0x20]
lea rdx, [rax + 1]
mov eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x38]
movsxd rbx, eax
cmp rdx, rbx
jl 0x485dab
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jne 0x485dfe
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp], rcx
mov dword [rsp + 8], eax
call fcn.004848c0
jmp 0x485df4
lea rax, [0x0066394e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.00466f80
mov eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x38]
jmp 0x485da7
call fcn.0046abe0
jmp fcn.00485d60