joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fd2f880
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd2f986
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call fcn.6fd2f2e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x6fd2f96d
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x34]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0xc], edx
call fcn.6fd2f2e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x6fd2f955
mov ecx, dword [esp + 0x24]
mov ebp, dword [ecx + 0x20]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea edx, [ecx + 0x20]
call ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.6fd2f660
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x20
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fedeaf0]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fedeaf0]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd2f880
Function at 0x6fd2fb50
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd2fc6e
sub esp, 0x24
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x30]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0xc], edx
call fcn.6fd2f2e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x6fd2fc55
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x10], edx
call fcn.6fd2f990
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov esi, dword [eax + 0x20]
mov edi, dword [esp + 0x20]
mov dword [esp], edi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
lea edx, [eax + 0x20]
call esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x6fd2fc3d
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.6fd2f660
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x24
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fedeb00]
mov dword [esp + 4], eax
call fcn.6fc36660
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fedeaf8]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd2fb50
Function at 0x6fd2fc80
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd2fd69
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x10], edx
call fcn.6fd2f990
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
mov ebx, dword [esp + 0x34]
mov ebp, dword [ebx]
mov esi, dword [ebp]
mov edx, ebp
call esi
mov eax, dword [esp + 0x30]
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0xc], ebx
add eax, 0x20
mov ebx, edx
mov edx, eax
call ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x6fd2fd50
mov ecx, dword [esp + 0x30]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.6fd2f660
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x2c
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fedeb00]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd2fc80
Function at 0x6fd313e0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd315f6
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x6fd31479
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x6fd315d7
cmp ecx, 0xe
jne 0x6fd314f2
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x6fd315d7
cmp ecx, 0xf
jne 0x6fd31568
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x6fd315d7
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.6fc60ad0
jmp fcn.6fd313e0
Function at 0x6fd34e40
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd34f46
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor edx, edx
jmp 0x6fd34e66
inc edx
cmp eax, edx
jle 0x6fd34f0e
movzx ebx, byte [ecx + edx]
lea ebp, [ebx - 0x61]
xchg ebp, eax
cmp al, 0x19
xchg ebp, eax
jbe 0x6fd34e65
lea ebp, [ebx - 0x41]
xchg ebp, eax
cmp al, 0x19
xchg ebp, eax
jbe 0x6fd34e65
lea ebp, [ebx - 0x30]
xchg ebp, eax
cmp al, 9
xchg ebp, eax
jbe 0x6fd34e65
lea ebp, [ebx - 0x27]
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jbe 0x6fd34e65
lea ebp, [ebx - 0x2b]
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jbe 0x6fd34e65
cmp bl, 0x20
je 0x6fd34e65
cmp bl, 0x3a
je 0x6fd34e65
cmp bl, 0x3d
je 0x6fd34e65
cmp bl, 0x3f
je 0x6fd34e65
cmp bl, 0x2a
je 0x6fd34e65
cmp bl, 0x26
je 0x6fd34e65
lea eax, [0x6fe89961]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x2a
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.6fc09410
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea ecx, [0x6fedf018]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
add esp, 0x1c
ret
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.6fc4e900
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
add esp, 0x1c
ret
call fcn.6fc60ad0
jmp fcn.6fd34e40
Function at 0x6fd3fbf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd3fda8
sub esp, 0x34
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.6fd40780
movzx eax, byte [esp + 0xc]
test al, al
je 0x6fd3fc81
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
test ecx, ecx
je 0x6fd3fc81
cmp ecx, 1
je 0x6fd3fc74
movzx ebx, byte [edx]
test bl, bl
jne 0x6fd3fc66
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x6fd3fc81
cmp bl, 0xff
jne 0x6fd3fc74
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x6fd3fc81
cmp ecx, 8
jg 0x6fd3fc8a
mov ebx, dword [esp + 0x3c]
xor eax, eax
jmp 0x6fd3fca1
mov byte [esp + 0x40], 0
add esp, 0x34
ret
jg 0x6fd3fc81
mov byte [esp + 0x40], 1
add esp, 0x34
ret
movzx esi, byte [edx + eax]
or esi, ebp
mov dword [ebx], esi
mov dword [ebx + 4], edi
inc eax
cmp eax, ecx
jge 0x6fd3fcc5
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
cmp eax, ecx
jb 0x6fd3fc95
jmp 0x6fd3fda2
mov dword [esp + 0x14], ecx
shl ecx, 3
lea edx, [ecx - 0x40]
neg edx
mov byte [esp + 0x13], dl
cmp dl, 0x20
sbb ebp, ebp
mov dword [esp + 0x24], ebp
add ecx, 0xffffffe0
mov esi, ecx
neg ecx
mov byte [esp + 0x12], cl
cmp cl, 0x20
sbb edi, edi
mov dword [esp + 0x20], edi
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb eax, eax
mov dword [esp + 0x1c], eax
mov edi, dword [ebx]
mov dword [esp + 0x18], edi
mov ebx, dword [ebx + 4]
shl edi, cl
mov ecx, edx
shl ebx, cl
and ebx, ebp
mov ecx, esi
mov ebp, dword [esp + 0x18]
shr ebp, cl
and ebp, eax
or ebp, ebx
mov ebx, dword [esp + 0x20]
and ebx, edi
or ebp, ebx
mov ebx, dword [esp + 0x3c]
mov dword [ebx + 4], ebp
movzx edi, byte [esp + 0x12]
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ebx, ebx
shr dl, 5
movzx edx, dl
cmp edx, 1
sbb edx, edx
mov dword [esp + 0x20], edx
movzx ecx, byte [esp + 0x13]
mov edx, dword [esp + 0x18]
shl edx, cl
mov eax, dword [esp + 0x24]
and edx, eax
not ebx
or ebx, edi
mov edi, ecx
mov ecx, esi
mov esi, ebp
shl ebp, cl
mov ecx, edi
shr edx, cl
and edx, eax
mov eax, dword [esp + 0x1c]
and ebp, eax
or edx, ebp
mov ecx, ebx
mov eax, esi
sar esi, cl
mov ebx, dword [esp + 0x20]
xor ebx, 0xffffffff
and ebx, esi
or ebx, edx
mov edx, dword [esp + 0x3c]
mov dword [edx], ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ecx, ecx
not ecx
or ecx, edi
sar eax, cl
mov dword [edx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x6fd3fc8a
call fcn.6fc61f80
nop
call fcn.6fc60ad0
jmp fcn.6fd3fbf0
Function at 0x6fd438a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd43a84
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.6fc6264c
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.6fd42dd0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.6fc62196
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x6fd43952
mov edx, dword [esp + 8]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x6fd43a25
mov dword [esp + 8], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
sar edx, 3
mov dword [esp + 0x1c], edx
shl edx, 3
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [esp + ecx*8 + 0x58]
mov edi, dword [esi]
mov dword [esp + 0x10], edi
mov esi, dword [esi + 4]
mov ecx, ebx
shl edi, cl
and edi, edx
mov dword [esp + 0xc], edi
xchg edi, eax
mov byte [esp + 0x20], al
xchg edi, eax
lea ebp, [ecx - 0x20]
mov dword [esp + 0x18], ebp
cmp ebp, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
shl esi, cl
and esi, edx
mov ecx, ebp
mov edx, dword [esp + 0x10]
mov ebx, edx
shr edx, cl
and edx, edi
or edx, esi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov ebp, dword [esp + 0x14]
and ebx, ebp
or ebx, edx
mov edx, dword [esp + 0xc]
mov ebp, edx
shr edx, 8
mov esi, ebx
shl ebx, 0x18
or edx, ebx
mov byte [esp + 0x21], dl
mov edx, ebp
shr ebp, 0x10
mov ebx, esi
shl esi, 0x10
or esi, ebp
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov ebp, ebx
shl ebx, 8
shr edx, 0x18
or edx, ebx
mov byte [esp + 0x23], dl
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x6fd43a56
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + ebp]
or esi, ebx
xchg esi, ebx
mov byte [eax + ebp], bl
xchg esi, ebx
inc ecx
cmp ecx, 8
jge 0x6fd4394b
movzx ebx, byte [esp + ecx + 0x28]
lea ebp, [edx + ecx]
cmp ebp, 0x20
jge 0x6fd4394b
test byte [eax], al
cmp ebp, 0x20
jb 0x6fd43a48
mov eax, ebp
mov ecx, 0x20
call fcn.6fc61f80
nop
call fcn.6fc60ad0
jmp fcn.6fd438a0
Function at 0x6fd458e0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xa8]
cmp eax, dword [ecx + 8]
jbe 0x6fd45b3a
sub esp, 0x128
mov dword [esp + 0x124], 0
mov ecx, dword [esp + 0x12c]
mov dword [esp + 0x124], ecx
xor eax, eax
jmp 0x6fd4592e
mov edx, dword [esp + 0x14]
lea eax, [edx + 1]
mov ecx, dword [esp + 0x12c]
cmp eax, 1
jge 0x6fd459c9
mov dword [esp + 0x14], eax
mov ecx, dword [esp + eax*4 + 0x124]
mov dword [esp + 0x120], ecx
lea edi, [esp + 0xf8]
xor eax, eax
call fcn.6fc62196
mov ecx, dword [esp + 0x120]
test byte [ecx], al
mov dword [esp], ecx
lea ebx, [esp + 0xf8]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x28
call fcn.6fc02ba0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x6fd45920
lea edi, [esp + 0xd0]
xor eax, eax
call fcn.6fc62196
mov ecx, dword [esp + 0x120]
add ecx, 0x28
mov dword [esp], ecx
lea ecx, [esp + 0xd0]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x28
call fcn.6fc02ba0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x6fd45920
jmp 0x6fd45b21
lea edi, [esp + 0xa8]
xor eax, eax
call fcn.6fc62196
lea edi, [esp + 0x80]
call fcn.6fc62196
lea edi, [esp + 0x58]
call fcn.6fc62196
mov ecx, dword [esp + 0x12c]
test byte [ecx], al
lea edx, [esp + 0xa8]
mov dword [esp], edx
lea ebx, [ecx + 0x50]
mov dword [esp + 4], ebx
call fcn.6fd430e0
nop
lea ecx, [esp + 0x80]
mov dword [esp], ecx
mov edx, dword [esp + 0x12c]
mov dword [esp + 4], edx
lea ebx, [esp + 0xa8]
mov dword [esp + 8], ebx
call fcn.6fd44530
nop
lea ecx, [esp + 0x58]
mov dword [esp], ecx
mov edx, dword [esp + 0x12c]
add edx, 0x28
mov dword [esp + 4], edx
lea edx, [esp + 0xa8]
mov dword [esp + 8], edx
call fcn.6fd44530
mov ecx, dword [esp + 0x130]
test byte [ecx], al
nop
lea edi, [esp + 0x38]
xor eax, eax
call fcn.6fc62198
lea ecx, [esp + 0x58]
mov dword [esp], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 4], ecx
call fcn.6fd438a0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
cmp edx, 0x20
jl 0x6fd45a92
mov edx, 0x20
mov ebx, dword [esp + 0x130]
cmp ebx, ecx
je 0x6fd45aad
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.6fc62890
lea edi, [esp + 0x18]
xor eax, eax
call fcn.6fc62198
lea ecx, [esp + 0x80]
mov dword [esp], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 4], ecx
call fcn.6fd438a0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
test edx, edx
jbe 0x6fd45b18
movzx eax, byte [ecx]
and eax, 1
shl eax, 7
mov ecx, dword [esp + 0x130]
movzx edx, byte [ecx + 0x1f]
or edx, eax
mov byte [ecx + 0x1f], dl
mov dword [esp + 0x134], ecx
mov dword [esp + 0x138], 0x20
mov dword [esp + 0x13c], 0x20
add esp, 0x128
ret
xor eax, eax
mov ecx, eax
call fcn.6fc61f80
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede5d4]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd458e0
Function at 0x6fd46310
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x134]
cmp eax, dword [ecx + 8]
jbe 0x6fd464a8
sub esp, 0x1b4
mov dword [esp + 0x1ac], 0
mov dword [esp + 0x1b0], 0
mov ecx, dword [esp + 0x1bc]
mov dword [esp + 0x1ac], ecx
mov edx, dword [esp + 0x1c0]
mov dword [esp + 0x1b0], edx
xor eax, eax
jmp 0x6fd4637e
mov ebx, dword [esp + 0x10]
lea eax, [ebx + 1]
mov ecx, dword [esp + 0x1bc]
mov edx, dword [esp + 0x1c0]
cmp eax, 2
jge 0x6fd4640d
mov dword [esp + 0x10], eax
mov ecx, dword [esp + eax*4 + 0x1ac]
mov dword [esp + 0x1a8], ecx
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.6fc62196
mov ecx, dword [esp + 0x1a8]
test byte [ecx], al
mov dword [esp], ecx
lea ebx, [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x28
call fcn.6fc02ba0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x6fd46369
lea edi, [esp + 0x14]
xor eax, eax
call fcn.6fc62196
mov ecx, dword [esp + 0x1a8]
add ecx, 0x28
mov dword [esp], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x28
call fcn.6fc02ba0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x6fd46369
jmp 0x6fd4648f
lea edi, [esp + 0x104]
xor eax, eax
call fcn.6fc62178
lea ecx, [esp + 0x104]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.6fd46150
mov ecx, dword [esp + 8]
mov dword [esp + 0x1a4], ecx
lea edi, [esp + 0x64]
xor eax, eax
call fcn.6fc62178
lea ecx, [esp + 0x64]
mov dword [esp], ecx
mov ecx, dword [esp + 0x1bc]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1a4]
mov dword [esp + 8], ecx
call fcn.6fd464c0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x1b8]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.6fd45fd0
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c4], ecx
add esp, 0x1b4
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede5d4]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd46310
Function at 0x6fd46eb0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd46fe9
sub esp, 0x6c
mov dword [esp + 0x68], 0
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x68], ecx
xor eax, eax
jmp 0x6fd46ee8
mov edx, dword [esp + 0x10]
lea eax, [edx + 1]
mov ecx, dword [esp + 0x74]
cmp eax, 1
jge 0x6fd46f64
mov dword [esp + 0x10], eax
mov ecx, dword [esp + eax*4 + 0x68]
mov dword [esp + 0x64], ecx
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.6fc62196
mov ecx, dword [esp + 0x64]
test byte [ecx], al
mov dword [esp], ecx
lea ebx, [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x28
call fcn.6fc02ba0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x6fd46edd
lea edi, [esp + 0x14]
xor eax, eax
call fcn.6fc62196
mov ecx, dword [esp + 0x64]
add ecx, 0x28
mov dword [esp], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x28
call fcn.6fc02ba0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x6fd46edd
jmp 0x6fd46fd0
mov eax, dword [esp + 0x70]
test byte [eax], al
test byte [ecx], al
mov edx, dword [0x6fe30470]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.6fd42fb0
mov eax, dword [esp + 0x70]
lea edi, [eax + 0x28]
mov ecx, dword [esp + 0x74]
lea esi, [ecx + 0x28]
call fcn.6fc6264c
lea edi, [eax + 0x50]
mov ecx, dword [esp + 0x74]
lea esi, [ecx + 0x50]
call fcn.6fc6264c
lea ecx, [eax + 0x78]
mov edx, dword [0x6fe30470]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x74]
add ecx, 0x78
mov dword [esp + 8], ecx
call fcn.6fd42fb0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x78], eax
add esp, 0x6c
ret
lea eax, [0x6fe514c0]
mov dword [esp], eax
lea eax, [0x6fede5d4]
mov dword [esp + 4], eax
call fcn.6fc36660
nop
call fcn.6fc60ad0
jmp fcn.6fd46eb0

Function at 0x6fd47000
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fd470ba
sub esp, 0x4c
mov ecx, dword [esp + 0x58]
cmp ecx, 0x40
jne 0x6fd4707f
lea edi, [esp + 0xc]
xor eax, eax
call fcn.6fc62190
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0xc]
cmp ecx, edx
je 0x6fd4704d
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
call fcn.6fc62890
mov eax, dword [esp + 0x50]
test byte [eax], al
mov dword [esp], eax
lea ecx, [esp + 0xc]
mov dword [esp + 4], ecx
call fcn.6fd47210
mov eax, dword [esp + 0x50]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
add esp, 0x4c
ret
lea eax, [0x6fe587c0]
mov dword [esp], eax
call fcn.6fc0ba30
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x32
lea ecx, [0x6fe8bc8e]
mov dword [eax], ecx
mov dword [esp + 0x60], 0
lea ecx, [0x6fededfc]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], eax
add esp, 0x4c
ret
call fcn.6fc60ad0
jmp fcn.6fd47000