joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480190
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x48038c
sub rsp, 0x80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x4801eb
test rax, 0x60
jne 0x4802f5
bt eax, 8
jae 0x48025e
mov rbp, qword [rsp + 0x78]
add rsp, 0x80
ret
call fcn.0047fec0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp]
mov qword [rsp + 0x50], rcx
lea rdx, [0x00671340]
mov qword [rsp], rdx
call fcn.00410b80
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x48]
mov qword [rdi + 8], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x480235
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
jmp 0x48023f
mov rax, qword [rsp + 0x50]
call fcn.004553b0
mov qword [rdi + 0x10], 0
lea rax, [0x0065a860]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042aba0
ud2
call fcn.0047fec0
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov qword [rsp], 0
lea rdx, [0x006ac3bf]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
lea rax, [0x006b1f4e]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x1a
call fcn.00441cc0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 8], rax
call fcn.0040e0f0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042aba0
ud2
call fcn.0047fec0
mov rax, qword [rsp + 8]
mov rcx, qword [rsp]
mov qword [rsp], 0
lea rdx, [0x006ac3bf]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
lea rax, [0x006b7ac8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x2c
call fcn.00441cc0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 8], rax
call fcn.0040e0f0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00480190

Function at 0x4803a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x48043d
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x30]
bt eax, 8
jae 0x48041f
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0047b680
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x30]
test rcx, 0x60
je 0x48041b
mov ecx, 0x20
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
or rcx, 0x16
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor ecx, ecx
jmp 0x4803f9
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6bf0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.004803a0
Function at 0x4804b0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x480566
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0047ff60
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.00478fc0
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov rax, qword [rax + 0x98]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
cmp rax, 8
jne 0x480548
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6c00]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.004804b0
Function at 0x481190
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4812d2
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, rax
and rax, 0x1f
cmp rax, 0x19
jne 0x481250
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x40]
mov rax, qword [rax + 0x38]
mov rbx, qword [rsp + 0x40]
cmp rbx, rdx
jae 0x4812b4
lea rdx, [rbx + rbx*2]
mov rbx, qword [rax + rdx*8 + 8]
mov rsi, qword [rax + rdx*8]
and rcx, 0x1a0
movzx edi, byte [rbx + 0x17]
and edi, 0x1f
or rcx, rdi
movzx esi, byte [rsi]
test sil, 1
je 0x481239
mov rax, qword [rax + rdx*8 + 0x10]
mov qword [rsp + 0x48], rbx
shr rax, 1
mov rdx, qword [rsp + 0x30]
add rax, rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rsi, qword [rax + rdx*8 + 0x10]
bt esi, 0
jae 0x48124a
or rcx, 0x40
jmp 0x481210
or rcx, 0x20
jmp 0x481210
mov qword [rsp + 0x10], rax
lea rax, [0x00671340]
mov qword [rsp], rax
call fcn.00410b80
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x13
mov eax, dword [0x00850df0]
test eax, eax
jne 0x481288
lea rax, [0x006af679]
mov qword [rdi], rax
jmp 0x481294
lea rax, [0x006af679]
call fcn.004553b0
mov rax, qword [rsp + 0x10]
mov qword [rdi + 0x10], rax
lea rax, [0x0065a860]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6c60]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00481190
Function at 0x4813d0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4815f8
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, rax
and rax, 0x1f
cmp rax, 0x11
jne 0x481473
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x40]
mov rbx, qword [rsp + 0x40]
cmp rbx, rdx
jae 0x4815da
mov rax, qword [rax + 0x30]
mov rdx, qword [rax]
imul rbx, rdx
mov rdx, qword [rsp + 0x30]
add rdx, rbx
test rcx, 0x60
je 0x48146f
mov ebx, 0x20
movzx esi, byte [rax + 0x17]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdx
and rcx, 0x180
or rbx, rcx
and esi, 0x1f
or rsi, rbx
mov qword [rsp + 0x58], rsi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor ebx, ebx
jmp 0x481442
cmp rax, 0x17
jne 0x4814de
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 8]
mov rbx, qword [rsp + 0x40]
cmp rbx, rdx
jae 0x4815bc
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 0x30]
mov rsi, qword [rdx]
imul rbx, rsi
add rbx, qword [rax]
test rcx, 0x60
je 0x4814da
mov eax, 0x20
movzx ecx, byte [rdx + 0x17]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rbx
and ecx, 0x1f
or rax, rcx
or rax, 0x180
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
jmp 0x4814b1
cmp rax, 0x18
jne 0x48153a
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 8]
mov rbx, qword [rsp + 0x40]
cmp rbx, rdx
jae 0x48159e
mov rax, qword [rax]
add rax, rbx
test rcx, 0x60
je 0x481536
mov ecx, 0x20
mov rdx, qword [0x00833ad8]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rax
or rcx, 0x88
mov qword [rsp + 0x58], rcx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor ecx, ecx
jmp 0x48150f
mov qword [rsp + 0x10], rax
lea rax, [0x00671340]
mov qword [rsp], rax
call fcn.00410b80
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x13
mov eax, dword [0x00850df0]
test eax, eax
jne 0x481572
lea rax, [0x006af69f]
mov qword [rdi], rax
jmp 0x48157e
lea rax, [0x006af69f]
call fcn.004553b0
mov rax, qword [rsp + 0x10]
mov qword [rdi + 0x10], rax
lea rax, [0x0065a860]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6c90]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6c80]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6c70]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.004813d0
Function at 0x481880
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x481a4a
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x4819ce
movzx ecx, byte [rsp + 0x68]
test cl, cl
je 0x4818cb
test rax, 0x60
jne 0x481a2c
bt eax, 9
jb 0x481988
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rbx, rax
and rax, 0x1f
cmp rax, 0x14
jne 0x481957
mov qword [rsp + 0x58], rcx
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
call fcn.004822c0
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x481937
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
test rax, rax
je 0x481923
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
call fcn.0047fc70
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [0x006ac221]
mov qword [rsp], rcx
mov qword [rsp + 8], 9
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
call fcn.004768f0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
jmp 0x4818df
lea rax, [0x00671340]
mov qword [rsp], rax
call fcn.00410b80
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x17
mov eax, dword [0x00850df0]
test eax, eax
jne 0x481a01
lea rax, [0x006b1090]
mov qword [rdi], rax
jmp 0x481a0d
lea rax, [0x006b1090]
call fcn.004553b0
mov qword [rdi + 0x10], 0
lea rax, [0x0065a860]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6ca0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00481880
Function at 0x482a10
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x482aea
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.00480190
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0047ff60
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.00478fc0
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov rax, qword [rax + 0x98]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
cmp rax, 8
jne 0x482acc
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x30]
mov qword [rdi + 8], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rdi + 0x10], rcx
mov ecx, dword [0x00850df0]
test ecx, ecx
jne 0x482ac0
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x40]
call fcn.004553b0
jmp 0x482ab6
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6cc0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00482a10

Function at 0x482e10
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x482e98
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.00480190
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0047ff60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rsp + 0x38]
cmp rdx, rcx
ja 0x482e7a
mov qword [rax + 8], rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6ce0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00482e10
Function at 0x483720
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4838d2
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x483838
bt eax, 9
jae 0x483818
sar rax, 0xa
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rcx + 0x17]
and edx, 0x1f
cmp rdx, 0x14
jne 0x4837b8
mov rdx, qword [rcx + 0x38]
mov rbx, qword [rcx + 0x40]
cmp rax, rbx
jae 0x4838b4
mov eax, dword [rdx + rax*8 + 4]
mov dword [rsp + 8], eax
mov qword [rsp], rcx
call fcn.00477950
mov rax, qword [rsp + 0x10]
lea rcx, [0x006fb820]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x20], rax
mov qword [rsp], rcx
call fcn.00477d10
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x20]
cmp rdx, rax
jae 0x483896
shl rdx, 4
mov eax, dword [rcx + rdx + 4]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rcx
mov dword [rsp + 8], eax
call fcn.00477950
mov rax, qword [rsp + 0x10]
lea rcx, [0x006fb820]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006fb820]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00671340]
mov qword [rsp], rax
call fcn.00410b80
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x12
mov eax, dword [0x00850df0]
test eax, eax
jne 0x48386b
lea rax, [0x006aef52]
mov qword [rdi], rax
jmp 0x483877
lea rax, [0x006aef52]
call fcn.004553b0
mov qword [rdi + 0x10], 0
lea rax, [0x0065a860]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f69c0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6d20]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00483720
Function at 0x484130
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x484307
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x98]
mov rdx, qword [rsp + 0x38]
mov qword [rsp], rdx
call rcx
mov rax, qword [rsp + 8]
cmp rax, 0x17
jne 0x4842e9
mov rax, qword [rsp + 0x40]
test rax, rax
jl 0x4842cb
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jl 0x4842ad
cmp rax, rcx
jg 0x48428f
lea rax, [0x0067a780]
mov qword [rsp], rax
call fcn.00410b80
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x48]
mov rbx, qword [rsp + 0x38]
mov qword [rsp], rbx
call rdx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
lea rdx, [0x006fb820]
cmp rcx, rdx
jne 0x48426c
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.00410d30
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x18]
mov qword [rdi + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rdi + 0x10], rcx
mov ecx, dword [0x00850df0]
test ecx, ecx
jne 0x484265
mov qword [rdi], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x100]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0x97
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.004553b0
jmp 0x484227
mov qword [rsp], rcx
lea rax, [0x006a26a0]
mov qword [rsp + 8], rax
lea rax, [0x00699000]
mov qword [rsp + 0x10], rax
call fcn.0040de40
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6a20]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6a10]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6a00]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f69f0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00484130
Function at 0x4843a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4844a0
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x98]
mov rdx, qword [rsp + 0x38]
mov qword [rsp], rdx
call rcx
mov rax, qword [rsp + 8]
cmp rax, 0x15
jne 0x484482
mov rax, qword [rsp + 0x30]
lea rcx, [0x006fb820]
cmp rax, rcx
jne 0x48445f
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 8], rcx
call fcn.00409780
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x100]
mov rdx, qword [rsp + 0x38]
mov qword [rsp], rdx
call rcx
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x15
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rax
lea rax, [0x006a26a0]
mov qword [rsp + 8], rax
lea rax, [0x00699000]
mov qword [rsp + 0x10], rax
call fcn.0040de40
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6a30]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.004843a0
Function at 0x484c00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x484e59
sub rsp, 0x80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rax, qword [rsp + 0x98]
bt eax, 9
jb 0x484d24
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x88], rdx
mov rbx, qword [rsp + 0xa0]
mov rsi, qword [rbx + 0x100]
mov rdi, qword [rsp + 0xa8]
mov qword [rsp], rdi
call rsi
mov rax, qword [rsp + 8]
mov qword [rsp], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 8], rax
call fcn.00484e70
mov rdx, qword [rsp + 0x10]
test rdx, rdx
je 0x484d70
mov rax, qword [rsp + 0x88]
mov qword [rsp], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov rax, qword [rdx]
call rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rbx
mov rbp, qword [rsp + 0x78]
add rsp, 0x80
ret
lea rcx, [0x006abaad]
mov qword [rsp], rcx
mov qword [rsp + 8], 7
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
call fcn.004768f0
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x484c4d
mov rax, qword [rsp + 0x88]
mov qword [rsp], rax
call fcn.00477ad0
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x60], rcx
mov rdx, qword [rsp + 0xa0]
mov rdx, qword [rdx + 0xf8]
mov rbx, qword [rsp + 0xa8]
mov qword [rsp], rbx
call rdx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov qword [rsp], 0
lea rdx, [0x006b608b]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0x25
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea rdx, [0x006b3187]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], 0x1d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
call fcn.00441d40
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 8], rax
call fcn.0040e0f0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00484c00
Function at 0x48b9e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x48ba99
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a23]
cmp al, 1
jbe 0x48ba1d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x48ba26
call fcn.00429df0
ud2
mov byte [0x00850a23], 1
call fcn.0045f790
call fcn.00469ae0
call fcn.004871b0
lea rax, [0x006b6f4c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834400], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x48ba88
mov qword [0x00834408], rcx
mov byte [0x00850a23], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x00834408]
mov rax, rcx
call fcn.004553b0
jmp 0x48ba77
call fcn.00452950
jmp fcn.0048b9e0

Function at 0x48bab0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x48bbd3
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
cmp rax, 0x40
jne 0x48bbb5
mov rcx, qword [rsp + 0x30]
xor edx, edx
jmp 0x48baf3
inc rdx
cmp rdx, rax
jge 0x48bb10
movzx ebx, byte [rcx + rdx]
cmp bl, 0xa
je 0x48bb97
cmp bl, 0xd
je 0x48bb97
jmp 0x48baf0
lea rax, [0x00689e60]
mov qword [rsp], rax
call fcn.00410b80
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
mov dword [rax + 0x140], 0x3d
mov qword [rsp], rax
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
call fcn.00455c10
mov rax, qword [rsp + 0x18]
xor ecx, ecx
jmp 0x48bb61
mov byte [rax + rcx + 0x40], 0xff
inc rcx
cmp rcx, 0x100
jl 0x48bb59
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
xor ebx, ebx
jmp 0x48bb83
movzx esi, byte [rdx + rbx]
mov byte [rax + rsi + 0x40], bl
inc rbx
cmp rbx, rcx
jl 0x48bb78
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6650]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6640]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.0048bab0