joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fc11650
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x6fc11882
mov ecx, dword [esp + 0x38]
cmp dword [eax], ecx
jne 0x6fc117bd
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x6fc11745
movzx ecx, byte [0x700a7774]
test cl, cl
je 0x6fc116ad
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x24], ecx
test byte [ecx], al
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor esi, esi
xor edi, edi
jmp 0x6fc116b4
add esp, 0x28
ret
add esi, 4
cmp dword [eax + 4], esi
jbe 0x6fc11741
test esi, 0x1f
jne 0x6fc116cb
movzx edi, byte [edx]
inc edx
jmp 0x6fc116cd
shr edi, 1
test edi, 1
je 0x6fc116b1
add ebp, esi
add ebx, esi
mov eax, dword [ecx + 0x978]
mov ebp, dword [ebp]
mov ebx, dword [ebx]
mov dword [eax], ebp
mov dword [eax + 4], ebx
mov eax, dword [ecx + 0x978]
add eax, 8
mov dword [ecx + 0x978], eax
cmp dword [ecx + 0x97c], eax
jne 0x6fc11730
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edx
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.6fc30400
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
jmp 0x6fc116b1
add esp, 0x28
ret
mov dword [esp], eax
call fcn.6fc5a7b0
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
call fcn.6fc38990
lea eax, [0x6fe89323]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.6fc39270
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.6fc39270
lea eax, [0x6fe7ea52]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.6fc39270
call fcn.6fc38a00
lea eax, [0x6fe87b29]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.6fc36d90
mov dword [esp], eax
call fcn.6fc5a7b0
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x2c]
mov edx, dword [edx]
mov dword [esp + 0x14], edx
call fcn.6fc38990
lea eax, [0x6fe89323]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.6fc39270
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.6fc39270
lea eax, [0x6fe7d568]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.6fc38f10
lea eax, [0x6fe7fae3]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.6fc38f10
call fcn.6fc38bb0
call fcn.6fc38a00
lea eax, [0x6fe87b29]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.6fc36d90
lea eax, [0x6fe89770]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.6fc36d90
nop
int3
Function at 0x6fc140f0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc141d9
sub esp, 0x20
mov edx, dword [0x7008758c]
mov dword [esp + 0x1c], edx
mov ebx, dword [0x70087590]
mov dword [esp + 0x18], ebx
xor eax, eax
jmp 0x6fc14130
mov ebp, dword [esp + 0x14]
lea eax, [ebp + 1]
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
cmp eax, ebx
jge 0x6fc141ab
mov ebp, dword [0x70087564]
test byte [ebp], al
mov esi, dword [edx + eax*4]
cmp esi, 0x400
jae 0x6fc141cc
mov dword [esp + 0x14], eax
mov ecx, dword [ebp + esi*4]
test byte [ecx], al
mov ebp, dword [ecx + 0x408c0]
test ebp, ebp
je 0x6fc14172
mov dword [esp], ebp
mov dword [esp + 4], 0x20000
call fcn.6fc626c0
jmp 0x6fc14121
mov dword [esp + 0x10], ecx
mov dword [esp], 0x20000
mov dword [esp + 4], 0
lea eax, [0x700ac6f0]
mov dword [esp + 8], eax
call fcn.6fc0bd80
mov eax, dword [esp + 0xc]
test eax, eax
je 0x6fc141b6
mov edx, dword [esp + 0x10]
mov dword [edx + 0x408c0], eax
jmp 0x6fc14121
mov byte [0x700a7434], 1
add esp, 0x20
ret
lea eax, [0x6fe89adb]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.6fc36d90
mov eax, esi
mov ecx, 0x400
call fcn.6fc61f90
nop
call fcn.6fc60ad0
jmp fcn.6fc140f0
Function at 0x6fc14250
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc14418
sub esp, 0x18
mov eax, dword [esp + 0x28]
movzx eax, byte [eax]
movzx ecx, byte [esp + 0x2c]
test al, cl
je 0x6fc142ec
mov eax, dword [0x70087564]
test byte [eax], al
nop
mov ecx, dword [esp + 0x1c]
mov edx, ecx
shr ecx, 0x16
mov dword [esp + 0x10], ecx
mov eax, dword [eax + ecx*4]
test byte [eax], al
mov eax, dword [eax + 0x408c0]
test byte [eax], al
shr edx, 0x19
and edx, 0x1ffff
add eax, edx
mov dword [esp + 0x14], eax
mov dword [esp], eax
call fcn.6fc02140
mov ecx, dword [esp + 0x10]
and ecx, 7
mov eax, 1
shl eax, cl
movzx ecx, byte [esp + 4]
test al, cl
je 0x6fc142d3
mov byte [esp + 0x34], 1
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov byte [esp + 4], al
call fcn.6fc02420
mov byte [esp + 0x34], 0
add esp, 0x18
ret
call fcn.6fc38990
call fcn.6fc38990
lea eax, [0x6fe8ce9f]
mov dword [esp], eax
mov dword [esp + 4], 0x39
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.6fc390f0
call fcn.6fc38bb0
call fcn.6fc38a00
call fcn.6fc38990
lea eax, [0x6fe82bc0]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.6fc390f0
lea eax, [0x6fe7bb7a]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.6fc390f0
lea eax, [0x6fe7bba6]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.6fc39270
call fcn.6fc38a00
lea eax, [0x6fe7bf53]
mov dword [esp], eax
mov dword [esp + 4], 4
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
call fcn.6fc1dd10
lea eax, [0x6fe7bdfe]
mov dword [esp], eax
mov dword [esp + 4], 3
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
call fcn.6fc1dd10
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x9d], 2
lea eax, [0x6fe858ca]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc14250
Function at 0x6fc14b80
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc14d94
sub esp, 0x18
mov eax, dword [0x700a74e0]
test eax, eax
jne 0x6fc14d7d
nop
lea eax, [0x700a74c8]
mov dword [esp], eax
call fcn.6fc099f0
mov eax, dword [0x700a74cc]
test eax, eax
je 0x6fc14bc9
cmp dword [eax + 8], 0xcc
jne 0x6fc14c3f
mov edx, dword [0x700a74c0]
test edx, edx
jne 0x6fc14c21
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x700ac6f0]
mov dword [esp + 8], eax
call fcn.6fc0bd80
mov eax, dword [esp + 0xc]
mov dword [0x700a74c0], eax
mov ecx, dword [0x700a7484]
mov dword [eax], ecx
mov eax, dword [0x700a74c0]
mov dword [0x700a7484], eax
movzx eax, byte [0x700a7ae0]
test al, al
jne 0x6fc14c21
xor eax, eax
jmp 0x6fc14d29
mov edx, dword [0x700a74c0]
mov ebx, dword [edx + 4]
mov dword [0x700a74c0], ebx
mov ebx, dword [0x700a74cc]
mov dword [edx + 4], ebx
mov dword [0x700a74cc], edx
mov edx, dword [0x700a74cc]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x6fc14d11
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.6fc022e0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x700a7770]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x6fc14c9d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x6fc14caa
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.6fc61f00
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x700a7770]
test edx, edx
jne 0x6fc14cd6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x6fc14cf7
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.6fc61f00
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.6fc61f00
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.6fc61f00
mov byte [0x700a742d], 1
nop
lea eax, [0x700a74c8]
mov dword [esp], eax
call fcn.6fc09bf0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.6fc61f90
lea esi, [0x700a7ae0]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x6fc14c21
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x6fc14d73
lea edx, [0x6fe010e4]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x6fc14d1b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.6fc61f80
mov ecx, 5
call fcn.6fc61f80
lea eax, [0x6fe82b30]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc14b80
Function at 0x6fc15a30
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc15b35
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
test ecx, ecx
je 0x6fc15afe
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x6fc15a8e
mov ecx, dword [ebx]
mov dword [eax + 0xc], ecx
mov ecx, dword [eax]
add dword [eax + 0x1c], ecx
movzx ecx, byte [eax + 0x24]
test cl, cl
je 0x6fc15a86
mov dword [esp + 0x10], ebx
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.6fc626c0
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
add esp, 0x18
ret
cmp dword [eax + 0x14], ecx
jae 0x6fc15ac0
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], edx
call fcn.6fc0bd80
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x14], eax
mov eax, ecx
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 4]
test edx, edx
je 0x6fc15ae4
mov dword [esp + 0x14], ecx
mov ebx, dword [edx]
mov ebp, dword [eax + 8]
mov dword [esp], ebp
mov dword [esp + 4], ecx
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
add dword [eax + 0x10], edx
mov edx, dword [eax + 0x14]
sub edx, dword [eax]
mov dword [eax + 0x14], edx
mov edx, dword [eax]
add dword [eax + 0x1c], edx
mov dword [esp + 0x20], ecx
add esp, 0x18
ret
call fcn.6fc38990
lea eax, [0x6fe8c281]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.6fc39270
call fcn.6fc38a00
lea eax, [0x6fe824a3]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc15a30
Function at 0x6fc18d90
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x6fc18f77
sub esp, 0xc
mov eax, dword [0x700a74e0]
test eax, eax
jne 0x6fc18f60
nop
lea eax, [0x70087480]
mov dword [esp], eax
call fcn.6fc099f0
add dword [0x70087520], 2
nop
nop
lea eax, [0x70081214]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.6fc023a0
nop
lea eax, [0x70087538]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.6fc023f0
mov eax, dword [0x7008758c]
mov ecx, dword [0x70087590]
mov edx, dword [0x70087594]
mov dword [0x7008759c], ecx
mov dword [0x700875a0], edx
mov ecx, dword [0x700a7770]
test ecx, ecx
jne 0x6fc18e34
mov dword [0x70087598], eax
jmp 0x6fc18e3f
lea edi, [0x70087598]
call fcn.6fc61f00
nop
lea eax, [0x70087558]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.6fc023f0
nop
lea eax, [0x70087560]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.6fc02240
nop
nop
lea eax, [0x70087480]
mov dword [esp], eax
call fcn.6fc09bf0
lea eax, [0x70081218]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.6fc023a0
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x6fc18ed1
nop
nop
lea eax, [0x70087480]
mov dword [esp], eax
call fcn.6fc099f0
xorps xmm0, xmm0
movsd qword [0x70087550], xmm0
nop
nop
lea eax, [0x70087480]
mov dword [esp], eax
call fcn.6fc09bf0
jmp 0x6fc18f27
nop
lea eax, [0x70081200]
mov dword [esp], eax
call fcn.6fc099f0
movzx eax, byte [0x70081208]
test al, al
je 0x6fc18f0d
mov byte [0x70081208], 0
mov eax, dword [0x70081204]
mov dword [esp], eax
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.6fc3af50
nop
nop
lea eax, [0x70081200]
mov dword [esp], eax
call fcn.6fc09bf0
add esp, 0xc
ret
inc dword [0x70081210]
call fcn.6fc24080
cmp dword [esp], 0xffffffff
jne 0x6fc18f21
call fcn.6fc25e80
mov byte [esp], 0
call fcn.6fc25f90
movzx eax, byte [esp + 4]
test al, al
jne 0x6fc18f37
lea eax, [0x700a74f0]
mov dword [esp], eax
call fcn.6fc2d9b0
call fcn.6fc2df50
add esp, 0xc
ret
lea eax, [0x6fe895d6]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.6fc36d90
nop
call fcn.6fc5f610
jmp fcn.6fc18d90

Function at 0x6fc19710
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc197b7
sub esp, 0x10
mov eax, dword [esp + 0x14]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.6fc021b0
movzx eax, byte [esp + 0xc]
test al, al
je 0x6fc197a0
movzx eax, byte [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp byte [ecx + 0x20], al
je 0x6fc1978a
mov dword [esp], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.6fc19980
movzx eax, byte [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov byte [ecx + 0x20], al
mov byte [ecx + 0x21], 1
add esp, 0x10
ret
lea eax, [0x6fe8a82b]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.6fc36d90
lea eax, [0x6fe8afb9]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc19710
Function at 0x6fc197d0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc198cc
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x21]
test cl, cl
je 0x6fc198b5
lea ecx, [eax + 0x40]
mov dword [esp + 0x18], ecx
mov dword [esp], ecx
call fcn.6fc02270
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x28]
cmp ecx, eax
setg dl
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 0x24]
cmp ebp, ebx
xchg esi, ebx
setae bl
xchg esi, ebx
cmp ecx, eax
xchg edi, ebx
sete bl
xchg edi, ebx
and edi, esi
or edx, edi
test dl, dl
je 0x6fc19888
mov dword [esp + 0x14], eax
sub ebp, ebx
mov esi, dword [esp + 0x20]
mov edi, dword [esi + 0x4c]
mov eax, ebp
mul edi
mov dword [esp], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov esi, dword [esp + 0x24]
sub esi, ebx
mov ebx, dword [esp + 0x14]
sbb ecx, ebx
mov ebx, edi
sar edi, 0x1f
imul ebp, edi
imul ebx, ecx
lea ecx, [ebx + edx]
add ecx, ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
call fcn.6fc19d40
mov ebp, dword [esp + 0x24]
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
call fcn.6fc02230
mov eax, dword [esp + 0x20]
mov byte [eax + 0x21], 0
mov dword [esp], eax
call fcn.6fc19f40
add esp, 0x1c
ret
lea eax, [0x6fe8afe8]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc197d0
Function at 0x6fc19fa0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc1a0ea
sub esp, 0x18
mov eax, dword [esp + 0x1c]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.6fc021b0
movzx eax, byte [esp + 0xc]
test al, al
je 0x6fc1a0d3
mov eax, dword [esp + 0x28]
mov ecx, 0x3b9aca00
mul ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov ebp, dword [esp + 0x24]
mov dword [esp + 8], ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 4], ebp
call fcn.6fc19980
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov dword [edx + 0x4c], ecx
mov ebx, dword [esp + 0x10]
mov dword [edx + 0x10], ebx
sar ecx, 0x1f
imul ecx, ecx, 0x3b9aca00
mov ebp, dword [esp + 0x14]
add ecx, ebp
mov dword [esp + 0x14], ecx
mov dword [edx + 0x14], ecx
mov ebp, dword [edx + 0xc]
cmp ebp, ecx
xchg esi, ebx
sete bl
xchg esi, ebx
mov edi, dword [edx + 8]
cmp ebx, edi
mov eax, edx
setb dl
cmp ebp, ecx
seta cl
and edx, esi
or edx, ecx
test dl, dl
jne 0x6fc1a08d
cmp ebx, edi
seta cl
mov edx, dword [esp + 0x14]
cmp ebp, edx
setb dl
and esi, ecx
or esi, edx
xchg esi, eax
test al, al
xchg esi, eax
je 0x6fc1a0c7
nop
lea ecx, [eax + 4]
mov dword [esp], ecx
mov byte [esp + 4], 0
call fcn.6fc02440
mov eax, dword [esp + 0x1c]
jmp 0x6fc1a0c7
mov dword [eax + 8], ebx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xc], ecx
nop
nop
lea ecx, [eax + 4]
mov dword [esp], ecx
mov byte [esp + 4], 1
call fcn.6fc02440
mov eax, dword [0x700ad710]
mov ecx, dword [esp + 0x1c]
lea edx, [ecx + 0x48]
mov dword [esp], edx
inc eax
mov dword [esp + 4], eax
call fcn.6fc023a0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.6fc19f40
add esp, 0x18
ret
lea eax, [0x6fe89143]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc19fa0
Function at 0x6fc1a2d0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc1a488
sub esp, 0x20
mov eax, dword [esp + 0x24]
test byte [eax], al
mov dword [esp], eax
call fcn.6fc023d0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, ecx
shr ecx, 0x1d
movzx ebx, byte [esp + 0x28]
cmp bl, cl
jne 0x6fc1a406
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.6fc02290
movzx eax, byte [esp + 0x14]
test al, al
je 0x6fc1a2e9
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
setb dl
mov ebx, dword [esp + 0x30]
mov ebp, ebx
and ebx, 0xe0000000
mov esi, dword [esp + 0x1c]
and esi, 0x1fffffff
or ebx, esi
cmp ebp, ebx
xchg esi, ebx
sete bl
xchg esi, ebx
xchg edi, ebx
setl bl
xchg edi, ebx
and edx, esi
or edi, edx
xchg edi, eax
test al, al
xchg edi, eax
je 0x6fc1a383
xor ebp, ebp
xor eax, eax
jmp 0x6fc1a387
sub eax, ecx
sbb ebp, ebx
test ebp, ebp
sete cl
test eax, eax
sete dl
and ecx, edx
test cl, cl
jne 0x6fc1a3ec
movzx ecx, byte [esp + 0x28]
cmp cl, 2
ja 0x6fc1a3ad
cmp cl, 1
je 0x6fc1a3d0
cmp cl, 2
je 0x6fc1a3b2
jmp 0x6fc1a3f0
cmp cl, 3
jne 0x6fc1a3cb
nop
lea ecx, [0x700a7a28]
mov dword [esp], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.6fc02280
jmp 0x6fc1a3e8
cmp cl, 4
jne 0x6fc1a3f0
nop
nop
lea ecx, [0x700a7a38]
mov dword [esp], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.6fc02280
add esp, 0x20
ret
add esp, 0x20
ret
lea eax, [0x6fe8bfe3]
mov dword [esp], eax
mov dword [esp + 4], 0x33
call fcn.6fc36d90
mov dword [esp + 0x1c], ecx
call fcn.6fc38990
lea eax, [0x6fe7e93a]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.6fc39270
mov dword [esp + 4], 0
movzx eax, byte [esp + 0x28]
movzx eax, al
mov dword [esp], eax
call fcn.6fc38f10
lea eax, [0x6fe7c043]
mov dword [esp], eax
mov dword [esp + 4], 5
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.6fc38f10
call fcn.6fc38bb0
call fcn.6fc38a00
lea eax, [0x6fe8d613]
mov dword [esp], eax
mov dword [esp + 4], 0x3e
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc1a2d0
Function at 0x6fc1e120
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 8
movzx edx, byte [0x700a7434]
test dl, dl
jne 0x6fc1e1f3
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub eax, dword [edx + 0xc]
mov ebx, dword [edx + 0x34]
mov ecx, edx
mul ebx
nop
nop
nop
nop
nop
nop
mov ebx, edx
shr edx, 3
nop
add edx, dword [ecx + 0x2c]
mov dword [esp], edx
and ebx, 7
mov ecx, ebx
mov edx, 1
shl edx, cl
mov byte [esp + 4], dl
call fcn.6fc02420
mov edx, dword [0x70087564]
test byte [edx], al
nop
nop
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebx + 0xc]
nop
mov eax, ecx
shr ecx, 0x16
mov edx, dword [edx + ecx*4]
test byte [edx], al
mov ecx, eax
shr eax, 0x10
and eax, 0x3f
movzx ebx, byte [edx + eax + 0x40840]
lea eax, [edx + eax + 0x40840]
shr ecx, 0xd
and ecx, 7
mov edx, 1
shl edx, cl
test dl, bl
jne 0x6fc1e1bb
mov dword [esp], eax
mov byte [esp + 4], dl
call fcn.6fc02420
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x58]
mov ecx, dword [eax + 0x964]
mov edx, dword [esp + 0x14]
add ecx, edx
mov edx, dword [eax + 0x968]
mov dword [eax + 0x964], ecx
adc edx, 0
mov dword [eax + 0x968], edx
add esp, 8
ret
lea eax, [0x6fe8a299]
mov dword [esp], eax
mov dword [esp + 4], 0x2c
call fcn.6fc36d90
nop
int3
Function at 0x6fc1fc50
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc1fd37
sub esp, 0x14
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x6fc1fcd7
cmp eax, 2
je 0x6fc1fcb2
cmp eax, 3
jne 0x6fc1fd20
mov eax, dword [esp + 0x18]
test byte [eax], al
lea ecx, [eax + 0xf0]
mov dword [esp], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.6fc02280
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fc20ef0
jmp 0x6fc1fd1c
mov eax, dword [esp + 0x18]
test byte [eax], al
add eax, 0xe8
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.6fc02280
jmp 0x6fc1fd1c
mov eax, dword [esp + 0x18]
test byte [eax], al
lea ecx, [eax + 0xe0]
mov dword [esp], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.6fc02280
mov eax, dword [esp + 0x18]
add eax, 0x100
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
call fcn.6fc02280
add esp, 0x14
ret
lea eax, [0x6fe891bb]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc1fc50
Function at 0x6fc20b90
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc20c72
sub esp, 0x1c
lea eax, [0x6fe7d28e]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.6fc06140
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x6fc20bdd
cmp ecx, 3
jne 0x6fc20bf1
cmp word [eax], 0x666f
jne 0x6fc20bf1
cmp byte [eax + 2], 0x66
jne 0x6fc20bf1
mov dword [esp + 0x24], 0x7fffffff
mov dword [esp + 0x20], 0xffffffff
add esp, 0x1c
ret
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.6fc4f450
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
test al, al
je 0x6fc20c22
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
add esp, 0x1c
ret
call fcn.6fc38990
lea eax, [0x6fe7d715]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.6fc39270
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.6fc39270
call fcn.6fc38bb0
call fcn.6fc38a00
lea eax, [0x6fe8d789]
mov dword [esp], eax
mov dword [esp + 4], 0x3f
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc20b90
Function at 0x6fc21920
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc2199a
sub esp, 0x10
mov eax, dword [esp + 0x14]
test byte [eax], al
nop
mov dword [esp], eax
call fcn.6fc099f0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 4], eax
jne 0x6fc21983
mov byte [ecx + 8], 1
lea eax, [0x6fe94884]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov word [esp + 8], 0x140d
mov dword [esp + 0xc], 2
call fcn.6fc39b40
add esp, 0x10
ret
lea eax, [0x6fe8ad89]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc21920