joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493f20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494159
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x90], rdi
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov r8, qword [rsp + 0x48]
bt r8, 0x3f
jae 0x493f8d
mov r8, qword [rsp + 0x48]
shl r8, 1
shr r8, 0x1f
movabs r9, 0xdd7b17f80
add r8, r9
jmp 0x493f92
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x78], rax
nop dword [rax]
test r8, r8
jne 0x493fba
mov r8, qword [rsp + 0x48]
and r8d, 0x3fffffff
test r8d, r8d
jne 0x493fba
xor ecx, ecx
jmp 0x493fe3
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call fcn.00485f80
test rax, rax
mov rdx, 0xffffffffffffffff
cmove rax, rdx
mov rsi, qword [rsp + 0x20]
mov rcx, rax
mov rax, qword [rsp + 0x78]
test byte [rax], al
jmp 0x493fea
mov rax, rdx
mov rdi, qword [rax]
bt edi, 0
jb 0x49402b
lea r8, [rdi + 8]
nop word [rax + rax]
test r8, 0x7ffff8
je 0x494128
mov rdx, rax
mov rax, rdi
lock cmpxchg qword [rdx], r8
sete r8b
nop dword [rax]
test r8b, r8b
je 0x493fe7
bt edi, 0
jmp 0x49402e
mov rdx, rax
jae 0x494059
cmp byte [rdx + 0x21f], 0
je 0x494049
mov rdi, qword [0x008b5e80]
mov r8, qword [0x008b5e88]
jmp 0x494060
lea rdi, [0x0072efe0]
lea r8, [0x00918838]
jmp 0x494060
xor edi, edi
xor r8d, r8d
nop
test rdi, rdi
jne 0x49410e
movups xmmword [rsp + 0x38], xmm15
lea rdi, [0x004941a0]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x1f], 1
mov rax, qword [rdx + 0x1b8]
test rax, rax
jne 0x4940d6
mov rax, qword [0x008b5e90]
mov rcx, qword [0x008b5e98]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbx, rcx
mov rcx, rsi
nop dword [rax]
call fcn.0045f6e0
movups xmmword [rsp + 0x28], xmm15
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx]
call rsi
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], r8
mov rax, rdi
mov rbx, r8
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x00667a40]
lea rbx, [0x0072db90]
call fcn.00436260
nop
nop dword [rax]
call fcn.00435700
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00493f20
Function at 0x496b40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x496c99
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov r13, 0
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x23], 0
movups xmmword [rsp + 0x28], xmm15
test byte [rax], al
jmp 0x496b76
mov rax, rsi
mov rdx, qword [rax]
bt edx, 0
jb 0x496bab
lea r8, [rdx + 8]
test r8, 0x7ffff8
je 0x496c6a
mov rsi, rax
mov rax, rdx
lock cmpxchg qword [rsi], r8
sete r8b
nop
test r8b, r8b
je 0x496b73
bt edx, 0
jmp 0x496bae
mov rsi, rax
jae 0x496bd9
cmp byte [rsi + 0x21f], 0
je 0x496bc9
mov rdx, qword [0x008b5e80]
mov r8, qword [0x008b5e88]
jmp 0x496be0
lea rdx, [0x0072efe0]
lea r8, [0x00918838]
jmp 0x496be0
xor edx, edx
xor r8d, r8d
nop
test rdx, rdx
je 0x496bff
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
mov rax, rdx
mov rbx, r8
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x00496ce0]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x23], 1
mov rax, qword [rsi + 0x10]
mov dword [rsp + 0x24], edi
lea rdi, [rsp + 0x24]
mov esi, 4
call fcn.00478ce0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x23], 0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx]
call r8
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x00667a40]
lea rbx, [0x0072db90]
call fcn.00436260
nop
nop
call fcn.00435700
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00496b40
Function at 0x496d40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x496e89
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov r13, 0
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x4f], 0
movups xmmword [rsp + 0x50], xmm15
test byte [rax], al
jmp 0x496d76
mov rax, r13
mov rdx, qword [rax]
bt edx, 0
jb 0x496dab
lea r12, [rdx + 8]
test r12, 0x7ffff8
je 0x496e5c
mov r13, rax
mov rax, rdx
lock cmpxchg qword [r13], r12
sete r12b
test r12b, r12b
je 0x496d73
bt edx, 0
jmp 0x496dae
mov r13, rax
jae 0x496dda
cmp byte [r13 + 0x21f], 0
je 0x496dca
mov rdx, qword [0x008b5e80]
mov r12, qword [0x008b5e88]
jmp 0x496de0
lea rdx, [0x0072efe0]
lea r12, [0x00918838]
jmp 0x496de0
xor edx, edx
xor r12d, r12d
nop
test rdx, rdx
je 0x496dff
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r12
mov rax, rdx
mov rbx, r12
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x00496f00]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r13
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x4f], 1
mov rax, qword [r13 + 0x10]
call fcn.00477e60
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x4f], 0
mov rdx, qword [rsp + 0x70]
mov r12, qword [rdx]
call r12
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x00667a40]
lea rbx, [0x0072db90]
call fcn.00436260
nop
call fcn.00435700
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.00496d40

Function at 0x4991c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49921b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x4991ee
nop
call fcn.00491fc0
test al, al
jne 0x499207
mov rax, qword [rsp + 0x20]
call fcn.00460080
mov rax, qword [rsp + 0x20]
call fcn.004604c0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00667a40]
lea rbx, [0x0072de50]
call fcn.00436260
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004991c0
Function at 0x49f020
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f292
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rdi, rdi
jl 0x49f27e
cmp rdi, 9
jg 0x49f26b
test ebx, ebx
jne 0x49f066
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov edx, ebx
lea rsi, [rdx + 1]
add rdx, rsi
bsr rdx, rdx
cmp rdx, 0x19
jge 0x49f099
add rdx, 0xffffffffffffffe7
mov rsi, rdx
neg rdx
cmp rdx, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rdx
shl ebx, cl
and ebx, r8d
lea rcx, [r9 + rsi]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x48], rax
imul rdx, rcx, 0x13441
add rdx, 0x1ce618
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x30], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x1b
jg 0x49f0d0
test rdx, rdx
setge r8b
jmp 0x49f0d3
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x23], r8b
mov dword [rsp + 0x24], ebx
mov eax, ebx
mov rbx, rcx
mov rcx, rdx
call fcn.004a02a0
test rbx, rbx
jge 0x49f258
mov rdx, qword [rsp + 0x30]
lea r8, [rdx + 9]
cmp r8, 0xa
jae 0x49f126
mov r8d, dword [rsp + 0x24]
mov r8d, r8d
test r8, r8
je 0x49f20b
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x49f225
movzx esi, byte [rsp + 0x23]
mov r8, rbx
neg rbx
cmp rbx, 0x20
sbb r9d, r9d
mov edi, ecx
mov rcx, rbx
mov r10d, 1
shl r10d, cl
and r10d, r9d
dec r10d
mov r11d, eax
shr eax, cl
and eax, r9d
and r10d, r11d
test sil, sil
je 0x49f1a7
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r9d, 1
shl r9d, cl
and r9d, r8d
cmp r9d, r10d
jb 0x49f196
jne 0x49f19d
nop dword [rax]
test dil, dil
je 0x49f196
cmp r9d, r10d
jne 0x49f19d
test dil, dil
je 0x49f19d
mov ebx, eax
and eax, 1
jmp 0x49f1a1
mov ecx, 1
jmp 0x49f1c8
mov ebx, eax
xor eax, eax
mov ecx, eax
mov eax, ebx
jmp 0x49f1c8
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r9d, r10d
shr r10d, cl
and r10d, r8d
cmp r10d, 1
sete cl
mov r10d, r9d
test r10d, r10d
je 0x49f1cf
xor edi, edi
xor edi, 1
mov ebx, eax
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.0049f580
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x30]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov esi, 1
mov ecx, 1
jmp 0x49f12b
inc rsi
mov eax, edi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x49f20b
mov edi, eax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x49f21a
mov eax, edi
mov rdx, r10
movzx esi, byte [rsp + 0x23]
jmp 0x49f12b
lea rax, [0x00667a40]
lea rbx, [0x0072e320]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072e310]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072e300]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0049f020
Function at 0x49f2e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f546
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
nop dword [rax + rax]
cmp rdi, 0x12
jg 0x49f532
test rbx, rbx
jne 0x49f31e
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
cmp rsi, 0x37
jge 0x49f358
add rdx, 0xffffffffffffffca
mov rsi, rdx
neg rdx
cmp rdx, 0x40
sbb r8, r8
mov r9, rcx
mov rcx, rdx
shl rbx, cl
and rbx, r8
lea rcx, [r9 + rsi]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
imul rdx, rcx, 0x13441
add rdx, 0x4105b6
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x38], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x37
jg 0x49f38f
test rdx, rdx
setge r8b
jmp 0x49f392
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x27], r8b
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.004a0380
test rbx, rbx
jge 0x49f51f
mov rdx, qword [rsp + 0x38]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x49f3e5
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x49f4cf
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
nop
jmp 0x49f4ea
movzx esi, byte [rsp + 0x27]
mov r8, rbx
neg rbx
cmp rbx, 0x40
sbb r9, r9
mov edi, ecx
mov rcx, rbx
mov r10d, 1
shl r10, cl
and r10, r9
dec r10
mov r11, rax
shr rax, cl
and rax, r9
and r10, r11
test sil, sil
je 0x49f46a
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x40
sbb r8, r8
mov r9d, 1
shl r9, cl
and r9, r8
cmp r9, r10
jb 0x49f457
jne 0x49f45e
nop dword [rax]
test dil, dil
je 0x49f457
cmp r9, r10
jne 0x49f45e
test dil, dil
je 0x49f45e
mov rbx, rax
and eax, 1
jmp 0x49f463
mov ecx, 1
jmp 0x49f48b
mov rbx, rax
xor eax, eax
mov ecx, eax
mov rax, rbx
jmp 0x49f48b
lea rcx, [r8 + 1]
neg rcx
cmp rcx, 0x40
sbb r8, r8
mov r9, r10
shr r10, cl
and r10, r8
cmp r10, 1
sete cl
mov r10, r9
test r10, r10
je 0x49f492
xor edi, edi
xor edi, 1
mov rbx, rax
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x50]
mov edx, ecx
mov ecx, edi
mov edi, edx
call fcn.0049f580
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x38]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov esi, 1
mov ecx, 1
jmp 0x49f3ea
inc rsi
mov rax, rdi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x49f4cf
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x49f4de
mov rax, rdi
mov rdx, r10
movzx esi, byte [rsp + 0x27]
jmp 0x49f3ea
lea rax, [0x00667a40]
lea rbx, [0x0072e340]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072e330]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0049f2e0
Function at 0x4a02a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0351
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
test rcx, rcx
je 0x4a0327
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x4a033d
shl rdx, 4
lea rsi, [0x008a2b80]
mov rdx, qword [rsi + rdx + 8]
lea rsi, [rdx + 1]
test rcx, rcx
cmovl rdx, rsi
mov eax, eax
mul rdx
mov rsi, rax
shl rax, 7
test rax, rax
sete dil
imul r8, rcx, 0x1a935
sar r8, 0xf
add r8, 0xfffffffffffffffa
add rbx, r8
shl rdx, 7
shr rsi, 0x39
or rdx, rsi
mov rax, rdx
mov ecx, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
shl eax, 6
add rbx, 0xfffffffffffffffa
mov ecx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00667a40]
lea rbx, [0x0072e350]
call fcn.00436260
nop
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.00463440
mov eax, dword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004a02a0

Function at 0x4a0380
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0475
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop dword [rax + rax]
test rcx, rcx
je 0x4a044a
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x4a0461
shl rdx, 4
lea rsi, [0x008a2b80]
add rdx, rsi
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x10], xmm0
test rcx, rcx
jge 0x4a03dd
inc qword [rsp + 0x10]
mov rdx, qword [rsp + 0x10]
mov rsi, rax
mov rax, rdx
mul rsi
mov rdi, qword [rsp + 0x18]
mov r8, rax
mov rax, rdi
mov rdi, rdx
mul rsi
add rax, rdi
sbb rsi, rsi
imul rdi, rcx, 0x1a935
sar rdi, 0xf
add rdi, 0xfffffffffffffff8
add rbx, rdi
sub rdx, rsi
mov rsi, rax
shl rax, 9
nop
test rax, rax
jne 0x4a042e
test r8, r8
sete dil
jmp 0x4a0430
xor edi, edi
shl rdx, 9
shr rsi, 0x37
or rdx, rsi
mov rax, rdx
mov ecx, edi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
shl rax, 8
add rbx, 0xfffffffffffffff8
mov ecx, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667a40]
lea rbx, [0x0072e360]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004a0380
Function at 0x4a04a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a056b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
cmp rax, 0x64
jae 0x4a0526
nop
cmp rbx, 0xa
jne 0x4a0526
cmp rax, 0xa
jge 0x4a04ea
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x4a0565
lea rcx, [0x006c4f48]
add rcx, rax
mov eax, 1
jmp 0x4a0516
lea rsi, [rax + 2]
lea rcx, [rax + rsi]
cmp rcx, 0xc8
ja 0x4a055a
mov rdx, rax
shl rax, 1
cmp rcx, rax
jb 0x4a0555
lea rsi, [0x006cde50]
lea rcx, [rsi + rdx*2]
mov eax, 2
mov rbx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
test rax, rax
setl r8b
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor r9d, r9d
xor eax, eax
mov rbx, rcx
nop dword [rax]
call fcn.004a05a0
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00465b60
mov edx, 0xc8
nop
call fcn.00465ae0
call fcn.00465b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004a04a0
Function at 0x4a73e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a754e
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
mov byte [rax + 0x20], 0
xor edx, edx
jmp 0x4a7415
mov rdx, rax
mov rax, rsi
mov qword [rsp + 0x30], rdx
mov ebx, 0x200
nop
call fcn.004a6f40
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x10]
cmp rax, rdx
ja 0x4a7545
mov qword [rcx + 8], rax
mov rdi, qword [rcx + 0x10]
mov rdx, qword [rcx]
cmp rax, rdi
ja 0x4a753d
mov qword [rsp + 0x20], rax
mov rsi, qword [rsp + 0x60]
mov r8, qword [rsi + 0x18]
sub rdi, rax
mov rcx, rdi
neg rdi
sar rdi, 0x3f
and rdi, rax
lea rbx, [rdx + rdi]
mov rdi, rcx
mov rax, qword [rsp + 0x68]
call r8
nop dword [rax + rax]
test rax, rax
jl 0x4a751e
mov rsi, qword [rsp + 0x58]
mov rdx, qword [rsi + 0x10]
mov rdi, qword [rsp + 0x20]
add rdi, rax
cmp rdx, rdi
jb 0x4a7516
mov qword [rsi + 8], rdi
mov rdx, qword [rsp + 0x30]
add rax, rdx
mov rdx, qword [0x008b5f98]
cmp qword [0x008b5f90], rbx
jne 0x4a74f0
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x28], rax
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.004040a0
test al, al
jne 0x4a7503
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
test rbx, rbx
je 0x4a740f
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x28]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rdi
call fcn.00465b20
mov rcx, qword [0x008b5a80]
mov rbx, qword [0x008b5a88]
test rcx, rcx
je 0x4a7535
mov rcx, qword [rcx + 8]
mov rax, rcx
call fcn.00436260
mov rcx, rdi
call fcn.00465b60
mov rcx, rax
call fcn.00465b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004a73e0

Function at 0x4a8f60
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4a8fcb
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4a8f84
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4a8fa1
cmp rdx, 0
je 0x4a8fed
test rdx, 0xf
je 0x4a8f7d
test rdx, 7
jne 0x4a8fa1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4a8f7d
ret
Function at 0x4a9c00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9dfb
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
nop dword [rax + rax]
cmp rdi, 8
ja 0x4a9de7
test sil, sil
je 0x4a9c39
cmp rcx, 8
jne 0x4a9dd4
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x00883530], rdx
jl 0x4a9c75
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
mov qword [rsp + 0x98], rcx
xor edx, edx
jmp 0x4a9cc2
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rax + 8], r8
lea r8, [r8 + r8*2]
shl r8, 4
lea r12, [r8 - 0x30]
add r12, r11
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r12], xmm0
add r8, 0xffffffffffffffe0
add r8, r11
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r8 + 0x10], xmm0
inc qword [rax + 0x38]
inc rdx
mov rcx, r9
cmp rdi, rdx
jle 0x4a9dc5
cmp rdx, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rdx
mov r10d, 1
shl r10d, cl
and r10d, r8d
test sil, r10b
mov r8d, 2
mov r10d, 3
cmovne r8, r10
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
mov qword [rsp + 0x48], r8
imul rcx, r9
lea r8, [rbx + rcx]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov r8, qword [rax + 0x38]
mov qword [rsp + 0x68], r8
mov r8, qword [rax + 8]
inc r8
mov r11, qword [rax]
mov rcx, qword [rax + 0x10]
nop word [rax + rax]
cmp rcx, r8
jae 0x4a9c81
mov qword [rsp + 0x40], rdx
mov rax, r11
mov rbx, r8
mov edi, 1
lea rsi, [0x006a1960]
call fcn.0044a700
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 0x10], rcx
cmp dword [0x00918a90], 0
jne 0x4a9d80
mov qword [rdi], rax
jmp 0x4a9d85
call fcn.00465600
mov rdx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x98]
mov r10d, 3
mov r8, rbx
mov r11, rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
nop
jmp 0x4a9c81
mov eax, 1
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x00667a40]
lea rbx, [0x0072e0a0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072de80]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp fcn.004a9c00