joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e837
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop dword [rax + rax]
test rcx, rcx
je 0x46e80d
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x46e823
mov qword [rsp + 0x38], rbx
shl rdx, 4
lea rbx, [0x007c1d40]
mov rdx, qword [rbx + rdx + 8]
lea rbx, [rdx + 1]
test rcx, rcx
cmovl rdx, rbx
mov eax, eax
mul rdx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], rax
mov rax, rcx
call fcn.0046e2e0
mov rcx, qword [rsp + 0x10]
mov rdx, rcx
shl rcx, 7
test rcx, rcx
sete cl
mov rbx, qword [rsp + 0x38]
lea rbx, [rax + rbx]
lea rbx, [rbx - 6]
mov rax, qword [rsp + 0x18]
shl rax, 7
shr rdx, 0x39
or rax, rdx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
shl eax, 6
add rbx, 0xfffffffffffffffa
mov ecx, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00685070]
call fcn.00436780
nop
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov eax, dword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046e760

Function at 0x46e860
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e96e
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop dword [rax + rax]
test rcx, rcx
je 0x46e943
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x46e95a
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
shl rdx, 4
lea rsi, [0x007c1d40]
add rdx, rsi
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x10], xmm0
nop dword [rax]
test rcx, rcx
jge 0x46e8ca
inc qword [rsp + 0x10]
mov rax, rcx
call fcn.0046e2e0
mov rcx, qword [rsp + 0x10]
mov rdx, rax
mov rax, rcx
mov rbx, qword [rsp + 0x30]
mov rcx, rdx
mul rbx
mov rsi, qword [rsp + 0x18]
mov rdi, rax
mov rax, rsi
mov rsi, rdx
mul rbx
add rax, rsi
sbb rbx, rbx
mov rsi, qword [rsp + 0x38]
lea rcx, [rcx + rsi]
lea rcx, [rcx - 8]
sub rdx, rbx
mov rbx, rax
shl rax, 9
test rax, rax
jne 0x46e924
test rdi, rdi
sete sil
jmp 0x46e926
xor esi, esi
shl rdx, 9
shr rbx, 0x37
or rdx, rbx
mov rax, rdx
mov rbx, rcx
mov ecx, esi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
shl rax, 8
add rbx, 0xfffffffffffffff8
mov ecx, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00685080]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046e860

Function at 0x46eb00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rax, 0xa
jge 0x46eb16
lea rcx, [0x00651cf5]
add rax, rcx
mov ebx, 1
ret
lea rcx, [0x00659bcb]
lea rax, [rcx + rax*2]
mov ebx, 2
ret
Function at 0x473d40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473e2c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x40], rbx
nop dword [rax]
call fcn.00473d20
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
shl rcx, 0x20
mov rsi, rcx
lock xadd qword [rax], rcx
add rcx, rsi
mov rsi, rcx
shr rcx, 0x20
test ecx, ecx
jl 0x473e18
test esi, esi
je 0x473da2
test rdx, rdx
jle 0x473d9c
cmp edx, ecx
je 0x473e05
test ecx, ecx
jmp 0x473da4
test ecx, ecx
nop
jmp 0x473da4
test ecx, ecx
jg 0x473dbd
test esi, esi
je 0x473dbd
cmp qword [rax], rsi
jne 0x473df1
mov qword [rsp + 0x20], rbx
mov qword [rax], 0
jmp 0x473de3
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov dword [rsp + 0x1c], esi
mov rax, rbx
xor ebx, ebx
xor ecx, ecx
call fcn.0045cd60
mov edx, dword [rsp + 0x1c]
lea esi, [rdx - 1]
mov rbx, qword [rsp + 0x20]
test esi, esi
jne 0x473dc7
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x005fe120]
lea rbx, [0x00685100]
nop
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00685100]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x006850f0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00473d40

Function at 0x473ec0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473f46
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
call fcn.00473d20
jmp 0x473ee2
mov rax, rsi
mov rcx, qword [rax]
mov rdx, rcx
shr rcx, 0x20
test ecx, ecx
je 0x473f28
lea rcx, [rdx + 1]
mov rsi, rax
mov rax, rdx
lock cmpxchg qword [rsi], rcx
sete cl
test cl, cl
je 0x473edf
mov qword [rsp + 0x10], rsi
mov rax, rbx
call fcn.0045cca0
mov rcx, qword [rsp + 0x10]
cmp qword [rcx], 0
jne 0x473f32
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x005fe120]
lea rbx, [0x00685110]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.00473ec0
Function at 0x477740
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477928
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
nop dword [rax + rax]
cmp rdi, 8
ja 0x477914
test sil, sil
je 0x477779
cmp rcx, 8
jne 0x477901
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x007a34a0], rdx
jl 0x4777b5
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
mov qword [rsp + 0x98], rcx
xor edx, edx
jmp 0x477804
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea r8, [rcx + 1]
mov qword [rax + 8], r8
lea r8, [rcx + rcx*2]
shl r8, 4
lea r12, [r11 + r8]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r12], xmm0
lea r8, [r11 + r8]
lea r8, [r8 + 0x10]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r8 + 0x10], xmm0
inc qword [rax + 0x38]
inc rdx
mov rcx, r9
cmp rdi, rdx
jle 0x4778f2
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
cmp rdx, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rdx
mov r10d, 1
shl r10d, cl
and r10d, r8d
test sil, r10b
mov r8d, 2
mov r10d, 3
cmovne r8, r10
mov qword [rsp + 0x48], r8
imul rcx, r9
lea r8, [rbx + rcx]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov r8, qword [rax + 0x38]
mov qword [rsp + 0x68], r8
mov rcx, qword [rax + 8]
lea r8, [rcx + 1]
mov r11, qword [rax]
mov r12, qword [rax + 0x10]
nop word [rax + rax]
cmp r12, r8
jae 0x4777c1
mov qword [rsp + 0x40], rdx
lea rax, [0x00630f40]
mov rbx, r11
mov rdi, r12
mov rsi, r8
nop
call fcn.00448f20
mov rdx, qword [rsp + 0x88]
mov qword [rdx + 0x10], rcx
mov qword [rdx], rax
mov rdx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x98]
mov r10d, 3
mov rcx, rbx
mov r11, rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
jmp 0x4777c1
mov eax, 1
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x005fe120]
lea rbx, [0x00684d30]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684d20]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
nop
jmp fcn.00477740
Function at 0x479a20
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x200]
cmp r12, qword [r14 + 0x10]
jbe 0x479c9d
sub rsp, 0x280
mov qword [rsp + 0x278], rbp
lea rbp, [rsp + 0x278]
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x298], rcx
mov qword [rsp + 0x2a0], rdi
bt esi, 9
jae 0x479c89
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf8], rcx
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], rbx
mov rax, rcx
call fcn.0047aaa0
mov qword [rsp + 0xd8], rax
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xf8]
nop dword [rax + rax]
call fcn.00481ba0
mov rcx, qword [rsp + 0xe0]
and ecx, 0x1e0
mov rsi, qword [rsp + 0xd8]
or rsi, rcx
lea rcx, [0x006880c0]
cmp rax, rcx
jne 0x479c76
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xf0], rbx
nop
call fcn.00479ce0
mov qword [rsp + 0xd0], rax
movups xmmword [rsp + 0x1c0], xmm15
lea rdi, [rsp + 0x1c8]
lea rdi, [rdi - 0x10]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004618cf
mov rbp, qword [rbp]
xor ebx, ebx
mov rax, qword [rsp + 0xf0]
nop
call fcn.0047d300
mov rax, qword [rsp]
mov qword [rsp + 0x1c0], rax
lea rdi, [rsp + 0x1c8]
lea rsi, [rsp + 8]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00461c06
mov rbp, qword [rbp]
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x108], rax
lea rdi, [rsp + 0x110]
lea rsi, [rsp + 0x1c8]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00461c06
mov rbp, qword [rbp]
lea rax, [0x00621d20]
call fcn.0040d1e0
mov qword [rsp + 0xe8], rax
mov rcx, qword [rsp + 0xd0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1b0]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x198]
mov qword [rax + 0x10], rcx
movzx ecx, word [rsp + 0x1b8]
mov word [rax + 0x18], cx
mov r8, qword [rsp + 0xe0]
sar r8, 0xa
mov qword [rax + 0x20], r8
mov rsi, qword [rsp + 0xc8]
mov qword [rax + 0x38], rsi
mov rdx, qword [rsp + 0xf8]
mov qword [rax + 0x28], rdx
mov rdi, qword [rsp + 0x100]
mov qword [rax + 0x30], rdi
mov rbx, qword [rsp + 0x290]
mov rax, qword [rsp + 0x288]
mov rcx, rdx
nop dword [rax]
call fcn.0047e6c0
mov rax, qword [rsp + 0xf0]
test byte [rax], al
mov rcx, qword [rsp + 0xe0]
and ecx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0x278]
add rsp, 0x280
ret
lea rbx, [0x0063e560]
lea rcx, [0x00637020]
call fcn.0040a560
lea rax, [0x005fe120]
lea rbx, [0x00684c50]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00479a20
Function at 0x47ad40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47adb5
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
call fcn.0047aaa0
nop
cmp rax, 0x12
jne 0x47ad79
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + 0x38]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, qword [rsp + 0x38]
nop
call fcn.0047aa00
mov ecx, 0x22
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00651466]
call fcn.0044c9c0
nop
call fcn.0040a840
mov rbx, rax
lea rax, [0x005fe120]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0047ad40

Function at 0x47ba00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47bb7f
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movups xmmword [rsp + 0x38], xmm15
lea rdi, [rsp + 0x40]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004618eb
mov rbp, qword [rbp]
nop word [rax + rax]
test rbx, rbx
jl 0x47bb6b
mov rcx, qword [rax + 0x38]
cmp qword [rax + 0x40], rbx
jle 0x47bb6b
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0xa8], rbx
lea rdx, [rbx + rbx*2]
mov qword [rsp + 0x10], rdx
mov rax, qword [rcx + rdx*8 + 8]
call fcn.0047d2e0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx + rcx*8]
call fcn.00479fe0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
lea rax, [rdx + rcx*8]
mov qword [rsp + 0x18], rax
call fcn.00479e00
mov byte [rsp + 0x98], al
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx + rcx*8]
call fcn.00479e80
test al, al
jne 0x47baf7
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rcx + 0x30]
call fcn.00479fe0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx + rcx*8]
call fcn.0047a080
test rbx, rbx
je 0x47bb19
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov rax, qword [rsp + 0x18]
nop
call fcn.00479de0
mov qword [rsp + 0x78], rax
lea rax, [0x005ff300]
call fcn.0040d1e0
mov rcx, qword [rsp + 0xa8]
mov qword [rax], rcx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], 1
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x005fe120]
lea rbx, [0x00684d10]
call fcn.00436780
nop
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
call fcn.0045f280
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp fcn.0047ba00

Function at 0x47be80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x47be98
movzx esi, byte [rbx + rdx]
inc rdx
imul eax, eax, 0x1000193
xor eax, esi
cmp rcx, rdx
jg 0x47be89
ret
Function at 0x47dd00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47dd77
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
cmp qword [rax], 8
jne 0x47dd63
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rbx
call fcn.0047aac0
test al, al
je 0x47dd63
mov rcx, qword [rsp + 0x10]
bt ecx, 7
jae 0x47dd54
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00684d40]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047dd00

Function at 0x47e240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e2f8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test rax, rax
je 0x47e2b4
nop dword [rax]
test rax, 0x60
jne 0x47e272
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0047e0c0
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x00654711]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x00645a1e]
call fcn.0044ca60
nop dword [rax]
call fcn.0040a840
mov rbx, rax
lea rax, [0x005fe120]
call fcn.00436780
call fcn.0047e0c0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x0061aa40]
call fcn.0040d1e0
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006075a0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.0047e240

Function at 0x47e380
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e48e
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
nop dword [rax + rax]
test rax, rax
je 0x47e445
test rax, 0x60
jne 0x47e405
bt eax, 8
jae 0x47e3c1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0047e0c0
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x0064cffd]
mov r9d, 0x1a
xor eax, eax
lea rbx, [0x00645a1e]
call fcn.0044ca60
call fcn.0040a840
mov rbx, rax
lea rax, [0x005fe120]
nop dword [rax + rax]
call fcn.00436780
call fcn.0047e0c0
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x00654711]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x00645a1e]
call fcn.0044ca60
call fcn.0040a840
mov rbx, rax
lea rax, [0x005fe120]
nop
call fcn.00436780
call fcn.0047e0c0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x0061aa40]
nop dword [rax + rax]
call fcn.0040d1e0
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006075a0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.0047e380
Function at 0x47e4c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e526
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
bt ecx, 8
jae 0x47e50e
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rbx
call fcn.0047bc00
mov rcx, qword [rsp + 0x10]
and ecx, 0x60
or rcx, 0x16
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00684d60]
nop dword [rax]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047e4c0

Function at 0x47e5e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e65f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x10], rbx
mov rax, rcx
mov ebx, 0x17
call fcn.0047e120
mov rax, qword [rsp + 0x18]
call fcn.0047ade0
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
cmp rax, 8
jne 0x47e64b
mov rdx, qword [rsp + 0x10]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005fe120]
lea rbx, [0x00684d70]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047e5e0
Function at 0x47e6c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e93d
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa8], r8
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
mov rax, rcx
call fcn.0047aaa0
cmp rax, 0x14
jne 0x47e7b1
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x38]
mov rdx, qword [rsp + 0xa8]
cmp qword [rax + 0x40], rdx
jbe 0x47e929
mov qword [rsp + 0x50], rcx
mov ebx, dword [rcx + rdx*8]
nop
call fcn.0047a800
call fcn.00479e80
test al, al
je 0x47e8e5
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx]
nop word [rax + rax]
test rdx, rdx
je 0x47e89f
mov qword [rsp + 0x48], rdx
mov rcx, qword [rdx + 8]
mov qword [rsp + 0x40], rcx
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x50]
mov ebx, dword [rdi + rsi*8 + 4]
mov rax, qword [rsp + 0x60]
call fcn.0047a840
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x48]
lea rcx, [rdx + rcx*8]
lea rcx, [rcx + 0x18]
mov rdx, qword [rsp + 0x40]
jmp 0x47e838
mov rax, qword [rsp + 0x60]
call fcn.0047ab00
mov rcx, qword [rsp + 0xa8]
cmp rbx, rcx
jbe 0x47e88c
shl rcx, 4
mov edx, dword [rax + rcx + 4]
mov dword [rsp + 0x3c], edx
mov esi, dword [rax + rcx + 8]
mov dword [rsp + 0x38], esi
mov ebx, dword [rax + rcx]
mov rax, qword [rsp + 0x60]
call fcn.0047a800
call fcn.00479e80
test al, al
je 0x47e848
lea rax, [0x005fe360]
nop dword [rax]
call fcn.0040d1e0
mov qword [rsp + 0x68], rax
mov ebx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
call fcn.0047a880
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x3c]
call fcn.0047a840
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbx, rax
mov rax, rdx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor eax, eax
lea rbx, [0x00645a1e]
mov ecx, 9
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
lea r8, [0x0064a4ae]
mov r9d, 0x15
call fcn.0044ca60
call fcn.0040a840
mov rbx, rax
lea rax, [0x005fe120]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684d80]
call fcn.00436780
xor eax, eax
lea rbx, [0x00645a1e]
mov ecx, 9
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
lea r8, [0x006507a4]
mov r9d, 0x21
call fcn.0044ca60
call fcn.0040a840
mov rbx, rax
lea rax, [0x005fe120]
nop
call fcn.00436780
xor eax, eax
lea rbx, [0x00645a1e]
mov ecx, 9
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
lea r8, [0x0064a4ae]
mov r9d, 0x15
call fcn.0044ca60
call fcn.0040a840
mov rbx, rax
lea rax, [0x005fe120]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684d80]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax + rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0047e6c0
Function at 0x47f620
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f7e6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov rax, rcx
call fcn.0047dcc0
nop dword [rax]
cmp rax, 0x14
je 0x47f70d
cmp rax, 0x16
jne 0x47f797
mov rdx, qword [rsp + 0x20]
bt edx, 7
jb 0x47f686
mov rbx, qword [rsp + 0x38]
jmp 0x47f6ba
mov rax, qword [rsp + 0x40]
call fcn.0047d9e0
test al, al
je 0x47f6ad
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
nop dword [rax]
call fcn.0045b7a0
test al, al
je 0x47f784
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rdx]
mov rdx, qword [rsp + 0x20]
test rbx, rbx
je 0x47f6fd
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x28], rax
call fcn.0047aaa0
mov rcx, qword [rsp + 0x20]
and ecx, 0x60
or rcx, rax
or rcx, 0x180
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x40]
call fcn.0047ab60
test rax, rax
jne 0x47f72a
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
jmp 0x47f73f
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
test rdx, rdx
je 0x47f73f
mov rdx, qword [rdx + 8]
mov rax, rdx
mov rbx, rcx
call fcn.0047dec0
test rcx, rcx
je 0x47f77a
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x20]
call fcn.0047dce0
mov rcx, qword [rsp + 0x18]
or rcx, rax
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x005fe120]
lea rbx, [0x00684de0]
call fcn.00436780
mov rax, qword [rsp + 0x20]
nop dword [rax]
call fcn.0047dcc0
mov qword [rsp + 0x10], rax
lea rax, [0x0061aa40]
call fcn.0040d1e0
mov qword [rax + 8], 0x12
lea rcx, [0x006491f3]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006075a0]
nop dword [rax + rax]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047f620