joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fc21e00
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc21fa8
sub esp, 0x20
mov eax, dword [esp + 0x24]
test byte [eax], al
nop
mov dword [esp], eax
call fcn.6fc099f0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 4], eax
jne 0x6fc21f91
nop
mov dword [esp], ecx
call fcn.6fc09bf0
xorps xmm0, xmm0
xor eax, eax
jmp 0x6fc21e54
mov eax, ecx
movsd xmm1, qword [0x6fede43c]
ucomisd xmm1, xmm0
jbe 0x6fc21f5a
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x6c]
mov ecx, dword [edx]
call ecx
movzx eax, byte [esp]
test al, al
jne 0x6fc21f4e
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x68]
mov ecx, dword [edx]
mov dword [esp], 0x10000
call ecx
mov eax, dword [esp + 0xc]
test eax, eax
sete al
mov ecx, dword [esp + 8]
test ecx, ecx
sete bl
mov ebp, dword [esp + 4]
mov dword [esp + 0x10], ebp
mov esi, dword [esp + 0xc]
and eax, ebx
test al, al
je 0x6fc21ef7
mov ecx, dword [0x700a752c]
test ecx, ecx
je 0x6fc21f8c
mov eax, ebp
xor edx, edx
div ecx
mov dword [esp], eax
call fcn.6fc61eb0
movsd xmm0, qword [esp + 4]
movsd xmm1, qword [0x6fede434]
mulsd xmm0, xmm1
movsd xmm2, qword [esp + 0x18]
addsd xmm0, xmm2
jmp 0x6fc21f1b
mov dword [esp + 4], esi
mov dword [esp], ecx
call fcn.6fc5cb40
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm1, qword [0x6fede434]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add ecx, eax
cmp eax, 0x10000
jb 0x6fc21f5c
mov eax, dword [0x700a7590]
test eax, eax
setne al
mov ebx, dword [0x700a7594]
test ebx, ebx
setne bl
or ebx, eax
test bl, bl
je 0x6fc21e52
jmp 0x6fc21f5c
mov ecx, dword [esp + 0x14]
movsd xmm0, qword [esp + 0x18]
jmp 0x6fc21f5c
mov ecx, eax
test ecx, ecx
jbe 0x6fc21f68
cmp dword [0x700a752c], ecx
ja 0x6fc21f76
mov dword [esp + 0x28], ecx
movsd qword [esp + 0x2c], xmm0
add esp, 0x20
ret
lea eax, [0x6fe8ab05]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.6fc36d90
call fcn.6fc353b0
lea eax, [0x6fe8a858]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc21e00
Function at 0x6fc235c0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc236d7
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 0xdc]
test ebx, ebx
jne 0x6fc23608
call fcn.6fc25ac0
mov ebx, dword [esp]
mov dword [ebx + 0x10], 0
mov eax, dword [esp + 0x10]
mov dword [eax + 0xd8], ebx
mov dword [eax + 0xdc], ebx
mov edx, eax
mov ebp, dword [ebx + 0xc]
test ebp, ebp
jle 0x6fc2366b
mov esi, dword [edx + 0xc0]
mov edi, dword [esp + 0x14]
mov eax, edi
sub edi, esi
lea esi, [ebp - 1]
cmp esi, 0x65
jae 0x6fc236ca
lea esi, [ebp + ebp*4]
mov ecx, edx
mov edx, dword [ebx + esi*4]
add edx, dword [ebx + esi*4 + 4]
cmp edx, edi
ja 0x6fc236b4
cmp ebp, 0x65
jne 0x6fc23671
mov dword [esp + 8], ebx
call fcn.6fc25ac0
mov ebx, dword [esp]
mov dword [ebx + 0x10], 0
mov eax, dword [esp + 8]
mov dword [eax + 0x10], ebx
mov eax, dword [esp + 0x10]
mov dword [eax + 0xdc], ebx
mov ecx, eax
mov eax, dword [esp + 0x14]
jmp 0x6fc23671
mov eax, dword [esp + 0x14]
mov ecx, edx
mov edx, dword [ebx + 0xc]
cmp edx, 0x65
jae 0x6fc236a8
lea ebp, [edx + 1]
mov dword [ebx + 0xc], ebp
lea edx, [edx + edx*4]
mov ebp, dword [ecx + 0xc0]
sub eax, ebp
mov dword [ebx + edx*4 + 0x14], eax
mov eax, dword [esp + 0x18]
mov ebp, dword [eax + 4]
mov dword [ebx + edx*4 + 0x18], ebp
nop
mov dword [ebx + edx*4 + 0x1c], eax
inc dword [ecx + 0xe0]
add esp, 0xc
ret
mov eax, edx
mov ecx, 0x65
call fcn.6fc61f80
lea eax, [0x6fe896cc]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.6fc36d90
mov eax, esi
mov ecx, 0x65
call fcn.6fc61f80
nop
call fcn.6fc60ad0
jmp fcn.6fc235c0
Function at 0x6fc23a40
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc23c48
sub esp, 0x34
mov eax, dword [esp + 0x3c]
cmp dword [0x70087520], eax
jne 0x6fc23c31
mov eax, dword [esp + 0x38]
test byte [eax], al
mov dword [esp], eax
call fcn.6fc02190
mov eax, dword [esp + 4]
mov ecx, eax
and eax, 0x7fffffff
dec eax
cmp eax, 0x80000000
jae 0x6fc23c1b
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea edx, [ecx - 1]
mov dword [esp + 8], edx
call fcn.6fc021b0
movzx eax, byte [esp + 0xc]
test al, al
je 0x6fc23a69
mov eax, dword [esp + 0x28]
cmp eax, 0x80000000
jne 0x6fc23c17
mov eax, dword [0x700a79b0]
test eax, eax
jle 0x6fc23c13
lea eax, [0x70087538]
mov dword [esp], eax
call fcn.6fc023d0
mov eax, dword [0x700a81c0]
mov dword [esp + 0x28], eax
mov ecx, dword [0x70087548]
mov dword [esp + 0x24], ecx
sub eax, ecx
mov dword [esp + 0x20], eax
mov ebx, dword [0x700a81c4]
mov dword [esp + 0x1c], ebx
mov ebp, dword [0x7008754c]
mov dword [esp + 0x18], ebp
movsd xmm0, qword [0x70087550]
movsd qword [esp + 0x2c], xmm0
mov esi, dword [esp + 8]
mov dword [esp + 0x14], esi
mov edi, dword [esp + 4]
mov dword [esp + 0x10], edi
call fcn.6fc38990
lea eax, [0x6fe859e1]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.6fc39270
mov eax, dword [esp + 0x1c]
mov ecx, eax
shr eax, 0x14
mov dword [esp + 4], eax
shl ecx, 0xc
mov edx, dword [esp + 0x28]
shr edx, 0x14
or ecx, edx
mov dword [esp], ecx
call fcn.6fc38f10
lea eax, [0x6fe7e6fc]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.6fc39270
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
sub eax, ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
sbb eax, ecx
mov ecx, eax
shr eax, 0x14
mov dword [esp + 4], eax
shl ecx, 0xc
mov eax, dword [esp + 0x20]
shr eax, 0x14
or ecx, eax
mov dword [esp], ecx
call fcn.6fc38f10
lea eax, [0x6fe81efa]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.6fc39270
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.6fc38f10
lea eax, [0x6fe7d0d6]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.6fc39270
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp], xmm0
call fcn.6fc38c50
lea eax, [0x6fe7daf3]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.6fc39270
call fcn.6fc38a00
add esp, 0x34
ret
add esp, 0x34
ret
lea eax, [0x6fe8745b]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.6fc36d90
lea eax, [0x6fe8ba3b]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc23a40
Function at 0x6fc23cd0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc23dd3
sub esp, 0x18
jmp 0x6fc23cf1
inc dword [0x70081210]
call fcn.6fc24080
cmp dword [esp], 0xffffffff
jne 0x6fc23ceb
nop
lea eax, [0x70081214]
mov dword [esp], eax
call fcn.6fc02190
mov eax, dword [esp + 4]
test eax, 0x7fffffff
jne 0x6fc23dbc
mov edx, dword [0x70087520]
mov dword [esp + 8], edx
xor eax, eax
jmp 0x6fc23d77
mov dword [esp + 0xc], eax
shl eax, 7
mov dword [esp + 0x14], eax
lea ebx, [0x700875bc]
lea ebp, [ebx + eax]
lea edx, [edx + edx*2]
mov dword [esp + 0x10], edx
lea ebp, [ebp + edx*8 + 4]
mov dword [esp], ebp
call fcn.6fc2fd30
mov eax, dword [esp + 0x14]
lea ecx, [0x700875bc]
lea eax, [ecx + eax + 0x34]
mov ecx, dword [esp + 0x10]
lea eax, [eax + ecx*8]
mov dword [esp], eax
call fcn.6fc2fd30
mov eax, dword [esp + 0xc]
inc eax
mov ecx, dword [esp + 8]
mov edx, ecx
cmp eax, 0x88
jge 0x6fc23d8f
jae 0x6fc23db2
shr edx, 1
and edx, 1
dec edx
neg edx
cmp edx, 2
jb 0x6fc23d28
jmp 0x6fc23da6
lea eax, [0x70081340]
mov dword [esp], eax
call fcn.6fc219b0
call fcn.6fc28ee0
add esp, 0x18
ret
mov eax, edx
mov ecx, 2
call fcn.6fc61f90
mov ecx, 0x88
call fcn.6fc61f80
lea eax, [0x6fe8a165]
mov dword [esp], eax
mov dword [esp + 4], 0x2c
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc23cd0
Function at 0x6fc25e80
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc25f7d
sub esp, 8
nop
lea eax, [0x700815f0]
mov dword [esp], eax
call fcn.6fc099f0
mov eax, dword [0x700815a4]
test eax, eax
setne al
mov ecx, dword [0x700815a0]
test ecx, ecx
setne cl
or eax, ecx
test al, al
jne 0x6fc25f66
mov dword [0x700815a8], 0
mov dword [0x700815ac], 0
mov eax, dword [0x700815fc]
test eax, eax
jne 0x6fc25f05
nop
nop
lea eax, [0x700815f0]
mov dword [esp], eax
call fcn.6fc09bf0
add esp, 8
ret
lea ecx, [0x700815f4]
mov dword [eax + 8], ecx
mov eax, dword [eax]
test eax, eax
jne 0x6fc25efa
mov eax, dword [0x700815f4]
test eax, eax
je 0x6fc25f38
mov ecx, dword [0x70081600]
mov dword [ecx], eax
mov eax, dword [0x700815f4]
mov ecx, dword [0x70081600]
mov dword [eax + 4], ecx
mov eax, dword [0x700815fc]
mov dword [0x700815f4], eax
jmp 0x6fc25f50
mov eax, dword [0x70081600]
mov ecx, dword [0x700815fc]
mov dword [0x700815f4], ecx
mov dword [0x700815f8], eax
mov dword [0x700815fc], 0
mov dword [0x70081600], 0
jmp 0x6fc25ee6
lea eax, [0x6fe89003]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc25e80

Function at 0x6fc26c50
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x6fc26cae
sub esp, 0x10
movzx eax, byte [esp + 0x1c]
test al, al
je 0x6fc26c97
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov byte [esp + 8], al
mov byte [esp + 9], 0
call fcn.6fc26fe0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x6fe8d245]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.6fc36d90
nop
call fcn.6fc5f610
jmp fcn.6fc26c50
Function at 0x6fc26d50
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc26e9b
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
xor edx, edx
jmp 0x6fc26d84
sub ebp, ecx
lea ecx, [ebp + edx]
shr ebp, 0xd
sub esi, ebp
mov eax, esi
mov edx, ebx
test eax, eax
jbe 0x6fc26e1c
mov ebx, dword [esp + 0x2c]
mov ebp, dword [ebx + 0xe4]
test byte [ebp], al
mov dword [esp + 0x20], eax
mov byte [esp + 0x13], dl
mov dword [esp + 0x14], ecx
shr ecx, 0x16
mov ecx, dword [ebp + ecx*4]
test byte [ecx], al
add ecx, 0x408c4
mov dword [esp + 0x24], ecx
mov dword [esp], ecx
call fcn.6fc02200
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov edx, ecx
and ecx, 0x3fffff
cmp eax, ecx
seta bl
mov ebp, dword [esp + 0x20]
mov esi, ebp
shl ebp, 0xd
add ebp, ecx
movzx edi, byte [esp + 0x13]
or ebx, edi
cmp ebp, 0x400000
jbe 0x6fc26df4
mov ebp, 0x400000
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebp
mov byte [esp + 0x13], bl
jmp 0x6fc26e37
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0x13]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
jmp 0x6fc26d75
mov byte [esp + 0x38], dl
add esp, 0x28
ret
mov ecx, edx
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0x13]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp ebp, eax
jbe 0x6fc26d75
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
call fcn.6fc021e0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x6fc26e02
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.6fc02200
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jb 0x6fc26e7e
mov edx, dword [esp + 0x1c]
cmp eax, edx
jbe 0x6fc26e24
jmp 0x6fc26e84
mov edx, dword [esp + 0x1c]
jmp 0x6fc26e24
lea eax, [0x6fe8c016]
mov dword [esp], eax
mov dword [esp + 4], 0x33
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc26d50
Function at 0x6fc28210
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc28360
sub esp, 0x14
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x18]
cmp edx, ecx
jne 0x6fc28276
cmp dword [edx], eax
jne 0x6fc28242
mov ecx, dword [eax]
mov dword [edx], ecx
jmp 0x6fc28249
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
mov dword [ecx], ebx
cmp dword [edx + 4], eax
jne 0x6fc28256
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x6fc2825e
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
add esp, 0x14
ret
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
call fcn.6fc38990
lea eax, [0x6fe8a777]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.6fc38f10
lea eax, [0x6fe7c2f3]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.6fc39270
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.6fc39230
lea eax, [0x6fe7c2ed]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.6fc39270
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.6fc39230
lea eax, [0x6fe7d60d]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.6fc39270
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.6fc39230
lea eax, [0x6fe7c2c9]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.6fc39270
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fc39230
call fcn.6fc38bb0
call fcn.6fc38a00
lea eax, [0x6fe7f38d]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc28210
Function at 0x6fc28560
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc286d0
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.6fc26320
mov eax, dword [esp + 4]
test eax, eax
je 0x6fc286b9
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.6fc242f0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.6fc099f0
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x6fc285f7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x6fc2865d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x6fc2860c
cmp byte [ebp + 6], dl
je 0x6fc28617
cmp esi, ebx
ja 0x6fc2865d
jne 0x6fc285f5
cmp byte [ebp + 6], dl
jbe 0x6fc285f5
jmp 0x6fc2865d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fc09bf0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x6fc28654
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x6fc28654
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.6fc28460
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.6fc09bf0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x6fc286b0
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x6fc286b0
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x6fe84a47]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc28560
Function at 0x6fc28b40
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc28c5c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x6fc28bd5
cmp cl, 2
je 0x6fc28b7d
cmp cl, 3
jne 0x6fc28c45
mov byte [eax + 8], 1
jmp 0x6fc28c41
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.6fc2e2d0
nop
lea eax, [0x7008ba84]
mov dword [esp], eax
call fcn.6fc099f0
nop
mov eax, dword [0x7008ba50]
sub eax, dword [0x7008ba34]
mov dword [0x7008ba50], eax
mov eax, dword [0x7008ba40]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7008ba40], ecx
nop
lea eax, [0x7008ba84]
mov dword [esp], eax
call fcn.6fc09bf0
jmp 0x6fc28c41
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.6fc14b80
nop
lea eax, [0x7008ba84]
mov dword [esp], eax
call fcn.6fc099f0
nop
mov eax, dword [0x7008ba28]
sub eax, dword [0x7008ba0c]
mov dword [0x7008ba28], eax
mov eax, dword [0x7008ba18]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7008ba18], ecx
nop
nop
lea eax, [0x7008ba84]
mov dword [esp], eax
call fcn.6fc09bf0
add esp, 0x14
ret
lea eax, [0x6fe7f24d]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc28b40

Function at 0x6fc29060
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc2919c
sub esp, 0xc
mov ecx, dword [0x6fe01800]
cmp ecx, 0x12
ja 0x6fc29100
mov ecx, dword [esp + 0x10]
test byte [ecx], al
mov edx, dword [0x700a7770]
test edx, edx
jne 0x6fc290a0
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x8c], eax
jmp 0x6fc290af
lea edi, [ecx + 0x8c]
mov eax, dword [esp + 0x18]
call fcn.6fc61f00
lea edx, [ecx + 0x40]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.6fc2f2d0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.6fc2aeb0
mov eax, dword [0x6fe010b8]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x34], eax
mov eax, dword [0x700a7770]
test eax, eax
jne 0x6fc290ed
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x88], eax
jmp 0x6fc290fc
lea edi, [ecx + 0x88]
mov eax, dword [esp + 0x14]
call fcn.6fc61f00
add esp, 0xc
ret
mov dword [esp + 8], ecx
call fcn.6fc38990
lea eax, [0x6fe860ce]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.6fc39270
mov ecx, dword [esp + 8]
cmp ecx, 0x20
sbb eax, eax
mov edx, 1
shl edx, cl
and edx, eax
mov eax, edx
sar edx, 0x1f
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.6fc39070
call fcn.6fc38bb0
call fcn.6fc38a00
call fcn.6fc38990
lea eax, [0x6fe84e78]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.6fc39270
mov dword [esp + 4], 0
mov dword [esp], 0x40000
call fcn.6fc39070
call fcn.6fc38bb0
call fcn.6fc38a00
lea eax, [0x6fe89e85]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc29060
Function at 0x6fc2b080
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc2b1e7
sub esp, 0x14
mov ebx, dword [esp + 0x1c]
test ebx, 0x3fffff
jne 0x6fc2b16d
mov ebp, dword [esp + 0x20]
test ebp, 0x3fffff
jne 0x6fc2b16d
mov ebx, dword [esp + 0x18]
mov eax, 3
jmp 0x6fc2b0cd
dec eax
mov esi, dword [esp + 0x20]
mov ebx, ebp
mov ebp, esi
test eax, eax
jl 0x6fc2b158
nop
cmp eax, 4
jae 0x6fc2b163
test byte [ebx], al
lea esi, [0x6fe01810]
mov ecx, dword [esi + eax*4]
cmp ecx, 0x20
sbb edi, edi
mov dword [esp + 0x10], edi
lea esi, [0x6fe017f0]
mov esi, dword [esi + eax*4]
cmp esi, 0x20
mov edx, esi
sbb esi, esi
mov dword [esp + 0xc], esi
nop
lea esi, [eax + eax*2]
mov dword [esp + 8], esi
mov edi, dword [ebx + esi*4 + 8]
lea ebx, [ebx + esi*4]
dec ebp
shr ebp, cl
mov esi, dword [esp + 0x10]
and ebp, esi
mov ecx, edx
mov esi, 1
shl esi, cl
mov ecx, dword [esp + 0xc]
and ecx, esi
nop
add ebp, ecx
neg ecx
and ecx, ebp
cmp dword [ebx + 4], ecx
jge 0x6fc2b14f
cmp edi, ecx
jb 0x6fc2b15c
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x18]
mov dword [ebp + ebx*4 + 4], ecx
jmp 0x6fc2b0c4
mov ebp, dword [esp + 0x18]
jmp 0x6fc2b0c4
add esp, 0x14
ret
mov edx, edi
call fcn.6fc61fc0
mov ecx, 4
call fcn.6fc61f80
call fcn.6fc38990
lea eax, [0x6fe7f46d]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.6fc390f0
lea eax, [0x6fe7d18a]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.6fc390f0
call fcn.6fc38bb0
call fcn.6fc38a00
lea eax, [0x6fe8aca3]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc2b080

Function at 0x6fc2f130
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc2f17e
sub esp, 8
mov eax, dword [esp + 0xc]
cmp eax, eax
setbe cl
mov edx, dword [esp + 0x10]
cmp edx, edx
setbe bl
cmp bl, cl
jne 0x6fc2f167
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
add esp, 8
ret
lea eax, [0x6fe8d1cd]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc2f130
Function at 0x6fc2fd30
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc2feaf
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp], ecx
call fcn.6fc023d0
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
cmp ecx, eax
ja 0x6fc2fe2d
shr eax, 9
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 8], eax
jbe 0x6fc2fdc9
mov edx, dword [ecx + 4]
mov ebx, dword [edx + eax*4]
lea eax, [edx + eax*4]
test ebx, ebx
je 0x6fc2fdc9
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x6fc2fe17
cmp edx, 0x200
je 0x6fc2fe01
mov dword [esp + 0x18], ebx
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.6fc02390
lea eax, [0x700a75d8]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.6fc2ff30
mov ecx, dword [esp + 0x20]
nop
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.6fc023f0
mov eax, dword [esp + 0x20]
add eax, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.6fc02240
add esp, 0x1c
ret
lea eax, [0x6fe8b7be]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.6fc36d90
lea eax, [0x6fe8c2b5]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.6fc36d90
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
call fcn.6fc38990
lea eax, [0x6fe7c832]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.6fc38f10
lea eax, [0x6fe7cdc2]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.6fc38f10
call fcn.6fc38bb0
call fcn.6fc38a00
lea eax, [0x6fe872b7]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc2fd30