joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452fa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453110
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov edx, dword [0x00a04a54]
test edx, edx
jne 0x452fdb
call fcn.00430220
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
cmp qword [rbx], 0
nop
jne 0x4530fe
nop
mov rdx, rax
mov qword [rbx], rax
test byte [rdx], al
mov rax, qword [rdx + 0x2280]
mov rdi, qword [rdx + 0x2288]
mov rcx, qword [rdx + 0x2290]
lea r8, [rdi + 1]
cmp rcx, r8
jae 0x453069
mov qword [rsp + 0x40], rdi
mov rbx, r8
mov edi, 1
lea rsi, [0x006b4da0]
call fcn.0044aa20
mov rdi, qword [rsp + 0x58]
mov qword [rdi + 0x2290], rcx
cmp dword [0x00a04ed0], 0
jne 0x453044
mov qword [rdi + 0x2280], rax
jmp 0x453059
lea rdx, [rdi + 0x2280]
mov rcx, rdi
mov rdi, rdx
call fcn.00465a20
mov rdi, rcx
mov rdx, rdi
mov rdi, qword [rsp + 0x40]
mov r8, rbx
mov rbx, qword [rsp + 0x60]
mov qword [rdx + 0x2288], r8
lea rsi, [rax + r8*8]
lea rsi, [rsi - 8]
cmp dword [0x00a04ed0], 0
nop
jne 0x453089
mov qword [rax + r8*8 - 8], rbx
jmp 0x453097
mov rax, rdi
mov rdi, rsi
call fcn.00465b60
mov rdi, rax
mov rax, qword [rdx + 0x2280]
mov rbx, qword [rdx + 0x2288]
mov rcx, qword [rdx + 0x2290]
call fcn.00454da0
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x2280]
cmp qword [rdx + 0x2288], 0
jbe 0x4530f4
mov rax, qword [rsp + 0x60]
cmp qword [rsi], rax
jne 0x4530dc
mov rax, qword [rax + 8]
xchg qword [rdx + 0x1200], rax
nop
mov eax, 1
lock xadd dword [rdx + 0x2298], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
mov rcx, rax
call fcn.00465ec0
lea rax, [0x00728063]
mov ebx, 0x22
call fcn.00436d20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00452fa0
Function at 0x459f00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459fb9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045a000]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00459f00
Function at 0x45b180
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b3e6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x45b1a9
mov dword [rsp + 0x60], ebx
lea rcx, [0x0097ba40]
jmp 0x45b1c0
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x230]
nop dword [rax]
test rcx, rcx
je 0x45b1f7
mov rdx, qword [rcx + 0x128]
cmp rax, rdx
jb 0x45b1b5
mov rsi, qword [rcx + 0x130]
cmp rax, rsi
jae 0x45b1b5
movsxd rcx, ebx
lea rax, [rdx + rcx]
cmp rsi, rax
jb 0x45b356
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rax
nop
nop
nop
lea rax, [0x009b03e0]
call fcn.0040b8e0
mov rbx, qword [0x009b03f0]
lea rax, [0x006cb940]
mov ecx, dword [rsp + 0x60]
nop dword [rax]
call fcn.00410d00
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
nop
nop
nop
lea rax, [0x009b03e0]
nop dword [rax + rax]
call fcn.0040bb00
movzx ecx, byte [rsp + 0x1f]
test cl, cl
jne 0x45b2b6
call fcn.00438660
lea rax, [0x0071e8c0]
mov ebx, 0x11
nop
call fcn.00438f60
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438dc0
lea rax, [0x00719f54]
mov ebx, 6
nop dword [rax]
call fcn.00438f60
mov rax, qword [rsp + 0x20]
call fcn.00438dc0
lea rax, [0x0071db39]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00438f60
call fcn.004386e0
lea rax, [0x0097ba40]
jmp 0x45b340
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x40], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x28], rdx
call fcn.00438660
lea rax, [0x0071a53a]
mov ebx, 7
call fcn.00438f60
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00438dc0
lea rax, [0x0071a677]
mov ebx, 8
call fcn.00438f60
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438dc0
call fcn.004388c0
call fcn.004386e0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x230]
nop dword [rax + rax]
test rax, rax
jne 0x45b2c5
lea rax, [0x0072ceeb]
mov ebx, 0x2e
call fcn.00436d20
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
call fcn.00438660
lea rax, [0x0071e8c0]
mov ebx, 0x11
call fcn.00438f60
mov eax, dword [rsp + 0x60]
movsxd rax, eax
nop dword [rax]
call fcn.00438dc0
lea rax, [0x0071ce40]
mov ebx, 0xe
call fcn.00438f60
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.00438dc0
lea rax, [0x007198c8]
mov ebx, 3
call fcn.00438f60
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00438dc0
call fcn.004388c0
call fcn.004386e0
lea rax, [0x00727b09]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436d20
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463860
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.0045b180
Function at 0x45b420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b6ab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x45b44e
nop dword [rax]
cmp ebx, 0xffffffff
je 0x45b44e
lea rcx, [0x0097ba40]
jmp 0x45b461
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x230]
test rcx, rcx
je 0x45b47a
cmp qword [rcx + 0x128], rax
ja 0x45b45a
cmp qword [rcx + 0x130], rax
jbe 0x45b45a
jmp 0x45b47c
xor ecx, ecx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x45b4e8
mov qword [rsp + 0x40], rcx
mov rdx, qword [rcx + 0x220]
lea rax, [0x006cc180]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
nop
call fcn.00410b60
mov rax, qword [rax]
test rax, rax
jne 0x45b4de
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x128]
mov ebx, dword [rsp + 0x60]
movsxd rsi, ebx
lea rax, [rdx + rsi]
mov rcx, qword [rcx + 0x130]
cmp rcx, rax
jb 0x45b625
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x18], rax
nop
nop
nop
lea rax, [0x009b03e0]
call fcn.0040b8e0
mov rbx, qword [0x009b03f0]
lea rax, [0x006cb940]
mov ecx, dword [rsp + 0x60]
call fcn.00410b60
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x009b03e0]
call fcn.0040bb00
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x45b593
call fcn.00438660
lea rax, [0x0071e904]
mov ebx, 0x11
call fcn.00438f60
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438dc0
lea rax, [0x00719f54]
mov ebx, 6
call fcn.00438f60
mov rax, qword [rsp + 0x18]
call fcn.00438dc0
lea rax, [0x0071db39]
mov ebx, 0x10
nop dword [rax]
call fcn.00438f60
call fcn.004386e0
lea rax, [0x0097ba40]
jmp 0x45b60b
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x20], rdx
call fcn.00438660
lea rax, [0x0071a53a]
mov ebx, 7
call fcn.00438f60
mov rax, qword [rsp + 0x28]
call fcn.00438dc0
lea rax, [0x0071a677]
mov ebx, 8
call fcn.00438f60
mov rax, qword [rsp + 0x20]
call fcn.00438dc0
call fcn.004388c0
call fcn.004386e0
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x230]
test rax, rax
jne 0x45b59d
lea rax, [0x0072cf75]
mov ebx, 0x2e
nop dword [rax]
call fcn.00436d20
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.00438660
lea rax, [0x0071e904]
mov ebx, 0x11
call fcn.00438f60
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00438dc0
lea rax, [0x0071ce40]
mov ebx, 0xe
nop dword [rax]
call fcn.00438f60
mov rax, qword [rsp + 0x28]
call fcn.00438dc0
lea rax, [0x007198c8]
mov ebx, 3
nop dword [rax + rax]
call fcn.00438f60
mov rax, qword [rsp + 0x20]
call fcn.00438dc0
call fcn.004388c0
call fcn.004386e0
lea rax, [0x00727b4b]
mov ebx, 0x21
call fcn.00436d20
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463860
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0045b420
Function at 0x45eb20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ed1b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax + 0x30]
cmp qword [rdx + 0x18], 0
je 0x45ed09
mov rsi, qword [rdx]
cmp rsi, 0x80
jbe 0x45eb79
mov edi, dword [rax + 0x54]
bt edi, 0
nop word [rax + rax]
jae 0x45ecf8
cmp byte [rax + 0x50], 8
jne 0x45ecf8
cmp rsi, 0x80
ja 0x45eb90
mov edi, dword [rax + 0x54]
bt edi, 0
jb 0x45ecf8
cmp byte [rax + 0x50], sil
jne 0x45ecf8
mov rdi, qword [rax + 0x38]
mov r8, qword [rdi]
nop word [rax + rax]
cmp r8, 0x80
jbe 0x45ebcf
mov r9d, dword [rax + 0x54]
bt r9d, 1
jae 0x45ece7
cmp byte [rax + 0x51], 8
nop dword [rax]
jne 0x45ece7
cmp r8, 0x80
ja 0x45ebea
mov r9d, dword [rax + 0x54]
bt r9d, 1
jb 0x45ece7
nop
cmp byte [rax + 0x51], r8b
jne 0x45ece7
movzx edx, byte [rdx + 0x15]
cmp dl, 8
ja 0x45ecd6
movzx edi, byte [rdi + 0x15]
nop dword [rax + rax]
cmp dil, 8
ja 0x45ecc5
test rdx, rdx
je 0x45ecc0
mov rcx, rax
mov rax, rsi
mov r9d, edx
xor edx, edx
div r9
test rdx, rdx
jne 0x45ecac
test rdi, rdi
je 0x45eca7
mov rax, r8
xor edx, edx
div rdi
test rdx, rdx
jne 0x45ec96
mov eax, 8
xor edx, edx
div r9
test rdx, rdx
jne 0x45ec85
mov eax, 8
xor edx, edx
div rdi
test rdx, rdx
jne 0x45ec6f
mov rax, rcx
xor ecx, ecx
nop
call fcn.0040e660
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x007257ad]
mov ebx, 0x1d
nop dword [rax + rax]
call fcn.00436d20
lea rax, [0x00724fb4]
mov ebx, 0x1c
call fcn.00436d20
lea rax, [0x00729dc0]
mov ebx, 0x26
call fcn.00436d20
call fcn.00435240
lea rax, [0x00728fa6]
mov ebx, 0x24
call fcn.00436d20
nop dword [rax]
call fcn.00435240
lea rax, [0x0071ef59]
mov ebx, 0x12
call fcn.00436d20
lea rax, [0x0071e75b]
mov ebx, 0x11
call fcn.00436d20
lea rax, [0x0071d8fd]
mov ebx, 0xf
call fcn.00436d20
lea rax, [0x0071d2ca]
mov ebx, 0xe
call fcn.00436d20
lea rax, [0x0072df71]
mov ebx, 0x31
call fcn.00436d20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0045eb20
Function at 0x45f580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f717
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
lea rax, [0x00a04ec0]
call fcn.00430a20
mov qword [rsp + 0x18], rax
test byte [rax], al
lea rcx, [rax + 0x28]
mov qword [rsp + 0x20], rcx
nop
mov rax, rcx
nop dword [rax]
call fcn.0040b8e0
nop
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x20]
test rdx, rdx
je 0x45f5de
cmp rdx, 1
jne 0x45f705
nop
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x45f5f2
cmp rdx, 1
jne 0x45f6f2
mov rdx, qword [rsp + 0x38]
mov qword [rcx + 8], rdx
mov byte [rcx + 0x30], 0
nop
nop
mov ebx, dword [rcx + 0x10]
jmp 0x45f60a
nop
mov ebx, dword [rcx + 0x10]
bt ebx, 1
jae 0x45f622
mov eax, ebx
xor ebx, 2
lock cmpxchg dword [rcx + 0x10], ebx
sete bl
xor ebx, 1
jmp 0x45f624
xor ebx, ebx
test bl, bl
jne 0x45f606
inc qword [rcx + 0x38]
nop
xor ebx, ebx
xchg qword [rcx + 0x18], rbx
mov qword [rcx + 0x88], 0
inc qword [rcx + 0x90]
nop
xor ebx, ebx
xchg qword [rcx + 0x20], rbx
mov qword [rcx + 0xe0], 0
mov qword [rcx + 0xe8], rcx
nop
movzx ebx, byte [rcx + 0x30]
nop
mov rsi, qword [rcx + 0x88]
mov edi, dword [rcx + 0x10]
mov r8d, ebx
or ebx, 4
test rsi, rsi
cmovl r8d, ebx
jmp 0x45f681
nop
mov edi, dword [rcx + 0x10]
mov eax, edi
and edi, 2
or edi, r8d
lock cmpxchg dword [rcx + 0x10], edi
sete bl
test bl, bl
je 0x45f67d
nop
nop
mov rax, qword [rsp + 0x20]
nop dword [rax]
call fcn.0040bb00
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x18]
call fcn.00430be0
test eax, eax
je 0x45f6e1
mov dword [rsp + 0x14], eax
lea rax, [0x00a04ec0]
mov rbx, qword [rsp + 0x18]
call fcn.004302a0
mov ecx, dword [rsp + 0x14]
movsxd rbx, ecx
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov rax, qword [rsp + 0x18]
xor ebx, ebx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x0072a06c]
mov ebx, 0x26
nop
call fcn.00436d20
lea rax, [0x0072a757]
mov ebx, 0x27
call fcn.00436d20
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.0045f580

Function at 0x45f740
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f7cb
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [rax + 0x30], 0
je 0x45f7b9
nop
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x45f76e
cmp rcx, 1
jne 0x45f7a8
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x45f77e
cmp rcx, 1
jne 0x45f797
mov rbx, rax
lea rax, [0x00a04ec0]
call fcn.004302a0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0072b4ab]
mov ebx, 0x29
call fcn.00436d20
lea rax, [0x0072ba60]
mov ebx, 0x2a
call fcn.00436d20
lea rax, [0x007289f2]
mov ebx, 0x23
call fcn.00436d20
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.0045f740
Function at 0x4600a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4602cd
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
test byte [rax], al
lea rcx, [rax + 0x28]
mov qword [rsp + 0x28], rcx
nop
mov rax, rcx
call fcn.0040b8e0
mov rcx, qword [rsp + 0x40]
cmp byte [rcx + 0x30], 0
nop word [rax + rax]
jne 0x4602bb
mov byte [rcx + 0x30], 1
inc qword [rcx + 0x38]
inc qword [rcx + 0x90]
nop
movzx edx, byte [rcx + 0x30]
nop
mov rbx, qword [rcx + 0x88]
mov rsi, qword [rcx + 0xe0]
mov edi, dword [rcx + 0x10]
mov r8d, edx
or edx, 4
test rbx, rbx
cmovl r8d, edx
mov edx, r8d
or r8d, 8
test rsi, rsi
cmovl edx, r8d
jmp 0x46012d
nop
mov edi, dword [rcx + 0x10]
mov eax, edi
and edi, 2
or edi, edx
lock cmpxchg dword [rcx + 0x10], edi
sete bl
nop dword [rax]
test bl, bl
je 0x460129
nop
mov rax, qword [rcx + 0x18]
cmp rax, 1
je 0x46017d
test rax, rax
je 0x460177
mov qword [rsp + 0x10], rax
xor edx, edx
lock cmpxchg qword [rcx + 0x18], rdx
sete bl
test bl, bl
je 0x460144
mov rbx, qword [rsp + 0x10]
cmp rbx, 2
cmove rbx, rdx
jmp 0x460181
xor edx, edx
xor ebx, ebx
jmp 0x460181
xor edx, edx
xor ebx, ebx
nop
mov rax, qword [rcx + 0x20]
cmp rax, 1
je 0x4601b8
test rax, rax
je 0x4601b4
mov qword [rsp + 0x10], rax
lock cmpxchg qword [rcx + 0x20], rdx
sete sil
test sil, sil
je 0x460181
mov rsi, qword [rsp + 0x10]
cmp rsi, 2
cmove rsi, rdx
jmp 0x4601ba
xor esi, esi
jmp 0x4601ba
xor esi, esi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], rsi
cmp qword [rcx + 0x58], 0
je 0x460212
lea rax, [rcx + 0x40]
call fcn.00453140
cmp dword [0x00a04ed0], 0
jne 0x4601ec
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x58], 0
jmp 0x460205
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 0x58]
mov rax, rdi
mov rdi, rcx
xor edx, edx
nop dword [rax]
call fcn.00465b40
mov rcx, rax
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
cmp qword [rcx + 0xb0], 0
je 0x460256
lea rax, [rcx + 0x98]
call fcn.00453140
cmp dword [0x00a04ed0], 0
jne 0x460243
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0xb0], 0
jmp 0x460256
mov rdi, qword [rsp + 0x40]
add rdi, 0xb0
xor ecx, ecx
call fcn.00465b20
nop
nop
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.0040bb00
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x46028b
nop
nop
mov ecx, 0xffffffff
lea rdx, [0x00a04a58]
lock xadd dword [rdx], ecx
mov ebx, 4
call fcn.00439980
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x4602b1
nop
nop
mov ecx, 0xffffffff
lea rdx, [0x00a04a58]
lock xadd dword [rdx], ecx
mov ebx, 4
call fcn.00439980
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x007291e6]
mov ebx, 0x24
call fcn.00436d20
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.004600a0
Function at 0x460420
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x40]
nop dword [rax]
cmp qword [r14 + 0x70], rcx
jb 0x46068c
mov qword [rsp + 0x10], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rax
mov qword [rcx + 0xb0], 0
call fcn.004414c0
test al, al
jne 0x4604a5
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], 0
cmp byte [0x009b6bd0], 0
je 0x4605cf
mov rax, qword [rsp + 0x18]
jmp 0x460649
cmp byte [0x009a8784], 0
je 0x4604ea
movups xmmword [rsp + 0x20], xmm15
lea rax, [0x00441480]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp byte [0x009b6bd0], 0
je 0x460542
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x18]
cmp rsi, rdi
jne 0x460518
mov edx, dword [rdx + 0x26c]
cmp dword [rsi + 0x14], edx
je 0x460547
lea rax, fcn.00456880
mov qword [rsp], rax
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
nop
jmp 0x460547
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
nop
call fcn.0043b1e0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rdx, qword [rax + 0x30]
dec dword [rdx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x46058f
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x46059d
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x009b14c0], 0
je 0x4605c5
mov ebx, 1
call fcn.0045aa80
test al, al
jne 0x4605c5
nop dword [rax + rax]
call fcn.004397a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x0079d098]
call fcn.004636a0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0079d308]
mov qword [rsp], rax
nop dword [rax]
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, rcx
mov rcx, qword [rsp + 0x10]
test rax, rax
je 0x46065d
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rax + 0x14]
cmp dword [rdx + 0x26c], ebx
je 0x460611
nop dword [rax]
call fcn.004658a0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], rax
jmp 0x4605cf
lea rax, [0x0072c749]
mov ebx, 0x2d
call fcn.00436d20
nop
int3
Function at 0x461720
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4617ab
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp rax, 0x20
jne 0x461748
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 0x20], rax
call fcn.00438660
lea rax, [0x007290ea]
mov ebx, 0x24
nop
call fcn.00438f60
mov rax, qword [rsp + 0x20]
call fcn.00438c60
lea rax, [0x0071abdd]
mov ebx, 9
nop dword [rax + rax]
call fcn.00438f60
mov eax, 0x20
call fcn.00438c60
call fcn.004388c0
call fcn.004386e0
lea rax, [0x0071f98b]
mov ebx, 0x13
call fcn.00436d20
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00461720
Function at 0x4625e0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
cmp rcx, 4
jge 0x462670
lea rdx, [rsp + 0x38]
cmp rbx, rdx
je 0x462664
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
shl rcx, 3
mov rax, rdx
call fcn.00466860
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov edx, 4
lea rbx, [rsp + 0x38]
jmp 0x46267d
cmp rcx, 0x2a
jg 0x46273f
mov rdx, rcx
mov rsi, qword [r14 + 0x30]
nop
inc dword [rsi + 0x23c]
mov rsi, qword [r14 + 0x30]
nop
mov rdi, r14
mov qword [rsi + 0x130], rdi
mov rsi, qword [r14 + 0x30]
mov qword [r14 + 0xe8], rsi
lea rsi, fcn.00442980
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x1f], 1
mov rsi, qword [r14 + 0x30]
mov qword [rsi + 0x2c0], rax
mov qword [rsi + 0x2c8], rcx
test rdx, rdx
jbe 0x462735
mov qword [rsp + 0x58], rsi
mov qword [rsi + 0x2d0], rbx
lea rbx, [rsi + 0x2c0]
mov rax, qword [0x009ae908]
call fcn.00404520
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x2d8]
mov rsi, qword [rcx + 0x2e0]
mov rcx, qword [rcx + 0x2e8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
call fcn.00442980
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
mov rcx, rax
call fcn.00465ec0
lea rax, [0x006bb4c0]
lea rbx, [0x007f1400]
call fcn.00436580
nop
call fcn.00435a20
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret