joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48455b
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
nop dword [rax + rax]
cmp rdi, 8
ja 0x484547
test sil, sil
je 0x484399
cmp rcx, 8
jne 0x484534
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x00971570], rdx
jl 0x4843d5
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
mov qword [rsp + 0x98], rcx
xor edx, edx
jmp 0x484425
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rax + 8], r8
lea r8, [r8 + r8*2]
shl r8, 4
lea r12, [r8 + r11]
lea r12, [r12 - 0x30]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r12], xmm0
lea r8, [r8 + r11]
lea r8, [r8 - 0x20]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r8 + 0x10], xmm0
inc qword [rax + 0x38]
inc rdx
mov rcx, r9
cmp rdi, rdx
jle 0x484525
cmp rdx, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rdx
mov r10d, 1
shl r10d, cl
and r10d, r8d
test sil, r10b
mov r8d, 2
mov r10d, 3
cmovne r8, r10
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
mov qword [rsp + 0x48], r8
imul rcx, r9
lea r8, [rbx + rcx]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov r8, qword [rax + 0x38]
mov qword [rsp + 0x68], r8
mov r8, qword [rax + 8]
inc r8
mov r11, qword [rax]
mov rcx, qword [rax + 0x10]
nop word [rax + rax]
cmp rcx, r8
jae 0x4843e1
mov qword [rsp + 0x40], rdx
mov rax, r11
mov rbx, r8
mov edi, 1
lea rsi, [0x007008c0]
call fcn.0044aa20
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 0x10], rcx
cmp dword [0x00a04ed0], 0
jne 0x4844e0
mov qword [rdi], rax
jmp 0x4844e5
call fcn.00465a20
mov rdx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x98]
mov r10d, 3
mov r8, rbx
mov r11, rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
nop
jmp 0x4843e1
mov eax, 1
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f1250]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f0f00]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp fcn.00484360
Function at 0x486c60
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x200]
cmp r12, qword [r14 + 0x10]
jbe 0x486f19
sub rsp, 0x280
mov qword [rsp + 0x278], rbp
lea rbp, [rsp + 0x278]
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x298], rcx
mov qword [rsp + 0x2a0], rdi
bt esi, 9
jae 0x486f05
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf8], rcx
movzx edx, byte [rcx + 0x17]
mov byte [rsp + 0xcf], dl
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
call fcn.00491600
mov rdx, qword [rsp + 0xe0]
and edx, 0x1e0
movzx edi, byte [rsp + 0xcf]
and edi, 0x1f
or rdi, rdx
mov rdx, qword [0x007f7250]
lea r8, [0x007f7248]
cmp rax, r8
jne 0x486ef6
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe8], rbx
nop
lea rcx, [0x004951a0]
mov qword [rsp + 0xd0], rcx
movups xmmword [rsp + 0x1c0], xmm15
lea rdi, [rsp + 0x1c8]
lea rdi, [rdi - 0x10]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046616f
mov rbp, qword [rbp]
mov rax, rbx
xor ebx, ebx
call fcn.0048a3c0
mov rcx, qword [rsp]
mov qword [rsp + 0x1c0], rcx
lea rdi, [rsp + 0x1c8]
lea rsi, [rsp + 8]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004664a6
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x1c0]
mov qword [rsp + 0x108], rcx
lea rdi, [rsp + 0x110]
lea rsi, [rsp + 0x1c8]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004664a6
mov rbp, qword [rbp]
lea rax, [0x006ee040]
call fcn.0040daa0
mov rcx, qword [rsp + 0xd0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1b0]
cmp dword [0x00a04ed0], 0
jne 0x486e22
mov qword [rax + 8], rcx
nop
jmp 0x486e2b
lea rdi, [rax + 8]
call fcn.00465b20
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0x198]
mov qword [rax + 0x10], rdx
movzx edx, word [rsp + 0x1b8]
mov word [rax + 0x18], dx
mov r8, qword [rsp + 0xe0]
sar r8, 0xa
mov qword [rax + 0x20], r8
mov rsi, qword [rsp + 0xd8]
mov qword [rax + 0x38], rsi
cmp dword [0x00a04ed0], 0
jne 0x486e8a
mov rcx, qword [rsp + 0xf8]
mov qword [rax + 0x28], rcx
mov rdi, qword [rsp + 0x100]
mov qword [rax + 0x30], rdi
jmp 0x486eaf
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0xf8]
call fcn.00465b20
lea rdi, [rax + 0x30]
mov r9, qword [rsp + 0x100]
call fcn.00465bc0
mov rdi, r9
mov rax, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x290]
nop
call fcn.0048d8a0
mov rax, qword [rsp + 0xe8]
test byte [rax], al
mov rcx, qword [rsp + 0xe0]
and ecx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0x278]
add rsp, 0x280
ret
mov rbx, rdx
lea rcx, [0x00708720]
call fcn.0040ada0
lea rax, [0x006bb4c0]
lea rbx, [0x007f10b0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00486c60
Function at 0x4879a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487a28
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
test rax, rax
je 0x487a14
nop
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
add rcx, 0xfffffffffffffffe
cmp rcx, 0xe
ja 0x4879e1
mov rax, qword [rax]
shl rax, 3
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
call fcn.004878e0
mov ecx, 0x25
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x007298c7]
call fcn.0044e860
nop
call fcn.0040b100
mov rbx, rax
lea rax, [0x006bb4c0]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f10d0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.004879a0

Function at 0x487d40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487da7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x12
jne 0x487d74
mov rax, qword [rax + 0x38]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004878e0
mov ecx, 0x22
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x007282c7]
call fcn.0044e860
call fcn.0040b100
mov rbx, rax
lea rax, [0x006bb4c0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00487d40

Function at 0x487dc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487e35
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x13
jne 0x487dfc
movzx ecx, word [rax + 0x32]
test cx, 0x8000
setne al
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
nop dword [rax]
call fcn.004878e0
mov ecx, 0x25
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x007298ec]
call fcn.0044e860
nop
call fcn.0040b100
mov rbx, rax
lea rax, [0x006bb4c0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00487dc0
Function at 0x487fc0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x68]
cmp r12, qword [r14 + 0x10]
jbe 0x4880da
sub rsp, 0xe8
mov qword [rsp + 0xe0], rbp
lea rbp, [rsp + 0xe0]
movups xmmword [rsp + 0xf0], xmm15
lea rdi, [rsp + 0xf8]
lea rdi, [rdi - 0x20]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046618b
mov rbp, qword [rbp]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop word [rax + rax]
cmp rcx, 0x19
jne 0x4880a3
call fcn.00488980
mov rcx, qword [rsp]
mov qword [rsp + 0x78], rcx
lea rdi, [rsp + 0x80]
lea rsi, [rsp + 8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004664ec
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0xf0], rcx
lea rdi, [rsp + 0xf8]
lea rsi, [rsp + 0x80]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004664ec
mov rbp, qword [rbp]
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
call fcn.004878e0
mov ecx, 0x22
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x0072830b]
nop dword [rax]
call fcn.0044e860
call fcn.0040b100
mov rbx, rax
lea rax, [0x006bb4c0]
call fcn.00436580
nop
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
call fcn.00463860
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp fcn.00487fc0

Function at 0x488320
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488387
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x19
jne 0x488354
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004878e0
mov ecx, 0x25
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00729911]
call fcn.0044e860
call fcn.0040b100
mov rbx, rax
lea rax, [0x006bb4c0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00488320
Function at 0x488980
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488afa
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046618b
mov rbp, qword [rbp]
nop word [rax + rax]
test rbx, rbx
jl 0x488ae6
mov rcx, qword [rax + 0x38]
cmp qword [rax + 0x40], rbx
jle 0x488ae6
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
lea rdx, [rbx + rbx*2]
mov rsi, qword [rcx + rdx*8 + 8]
test rsi, rsi
je 0x4889fe
lea rdi, [0x007f7248]
jmp 0x488a02
xor edi, edi
xor esi, esi
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov rax, qword [rcx + rdx*8]
call fcn.00487020
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rdx + rcx*8]
movzx ebx, byte [rbx]
test bl, 8
setne byte [rsp + 0x90]
mov rbx, qword [rdx + rcx*8]
movzx ebx, byte [rbx]
test bl, 1
jne 0x488a79
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x30]
nop dword [rax]
call fcn.00487020
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rax, qword [rdx + rcx*8]
nop dword [rax]
call fcn.00487100
test rbx, rbx
je 0x488a94
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rdx + rcx*8 + 0x10]
mov qword [rsp + 0x70], rcx
lea rax, [0x006bcde0]
call fcn.0040daa0
mov rcx, qword [rsp + 0xa0]
mov qword [rax], rcx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov qword [rsp + 0x88], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f10e0]
call fcn.00436580
nop
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
call fcn.00463860
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp fcn.00488980
Function at 0x488b20
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488d6b
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x488bcc
mov qword [rsp + 0x88], rax
lea rbx, [0x00711700]
mov rcx, rax
lea rax, [0x009b03a0]
call fcn.0047c220
test cl, cl
jne 0x488bb1
mov rax, qword [rsp + 0x88]
call fcn.004878e0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x007eeb28]
call fcn.0044e860
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.0048a040
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x488bed
lea rdx, [0x00711440]
cmp rax, rdx
jne 0x488bdb
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
call fcn.00460e40
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x006c4820]
call fcn.0040acc0
inc rdx
cmp rbx, rdx
jle 0x488c38
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x488bea
lea rax, [0x009b03a0]
lea rbx, [0x00711700]
lea rdi, [0x00711440]
call fcn.0047c3e0
lea rdx, [0x00711440]
nop dword [rax]
cmp rax, rdx
jne 0x488d5b
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x006b58a0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x006e4700]
nop
call fcn.0040daa0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00a04ed0], 0
jne 0x488c9a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x488ca9
mov rbx, rax
lea rax, [0x006e4700]
call fcn.00413f80
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.004873a0
call fcn.00460f00
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x488cf6
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x488ce8
mov dword [rsi + 0x10], edx
cmp dword [0x00a04ed0], 0
jne 0x488d0e
mov qword [rsi + 0x30], rcx
jmp 0x488d17
lea rdi, [rsi + 0x30]
call fcn.00465b20
lea rax, [0x009b03a0]
lea rbx, [0x00711700]
lea rdi, [0x00711440]
call fcn.0047c3e0
lea rdx, [0x00711440]
cmp rax, rdx
jne 0x488d4c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x006c4820]
call fcn.0040acc0
mov rbx, rdx
lea rcx, [0x006c4820]
call fcn.0040acc0
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00488b20
Function at 0x488d80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488e31
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
test rbx, rbx
je 0x488e1d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x40], rbx
mov rdx, qword [rbx + 0x98]
mov rax, rcx
call rdx
cmp rax, 0x14
jne 0x488e0a
mov rbx, qword [0x007f7250]
mov rax, qword [rsp + 0x40]
lea rdx, [0x007f7248]
nop dword [rax + rax]
cmp rax, rdx
jne 0x488dfe
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
call fcn.00488f60
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rcx, [0x00708720]
call fcn.0040ada0
lea rax, [0x006bb4c0]
lea rbx, [0x007f1100]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f10f0]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00488d80

Function at 0x488e60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488ef9
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
test rbx, rbx
je 0x488ee5
mov rdx, qword [0x007f7250]
lea rsi, [0x007f7248]
cmp rbx, rsi
jne 0x488ed3
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x18], rax
mov rbx, rax
mov rax, rcx
call fcn.00489620
test al, al
je 0x488eba
mov eax, 1
jmp 0x488ec9
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x18]
call fcn.00488f60
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rbx
mov rbx, rdx
lea rcx, [0x00708720]
call fcn.0040ada0
lea rax, [0x006bb4c0]
lea rbx, [0x007f1110]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00488e60
Function at 0x48b500
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b5d4
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test rax, rax
je 0x48b574
nop dword [rax]
test rax, 0x60
jne 0x48b532
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0048b280
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x0072c112]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x0071af7c]
call fcn.0044e900
nop dword [rax]
call fcn.0040b100
mov rbx, rax
lea rax, [0x006bb4c0]
call fcn.00436580
call fcn.0048b280
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x006e4520]
call fcn.0040daa0
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00a04ed0], 0
nop
jne 0x48b5c5
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006c9120]
nop dword [rax]
call fcn.00436580
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00465b20
jmp 0x48b5aa
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.0048b500

Function at 0x48b600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b727
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
nop dword [rax + rax]
test rax, rax
je 0x48b6c5
test rax, 0x60
jne 0x48b685
bt eax, 8
jae 0x48b641
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0048b280
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x00723635]
mov r9d, 0x1a
xor eax, eax
lea rbx, [0x0071af7c]
call fcn.0044e900
call fcn.0040b100
mov rbx, rax
lea rax, [0x006bb4c0]
nop dword [rax + rax]
call fcn.00436580
call fcn.0048b280
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x0072c112]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x0071af7c]
call fcn.0044e900
call fcn.0040b100
mov rbx, rax
lea rax, [0x006bb4c0]
nop
call fcn.00436580
call fcn.0048b280
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x006e4520]
nop dword [rax + rax]
call fcn.0040daa0
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00a04ed0], 0
jne 0x48b716
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006c9120]
call fcn.00436580
mov rdi, rax
mov rcx, qword [rsp + 0x40]
nop
call fcn.00465b20
jmp 0x48b6ff
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.0048b600

Function at 0x48b740
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b7a6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
bt ecx, 8
jae 0x48b78e
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rbx
call fcn.00488b20
mov rcx, qword [rsp + 0x10]
and ecx, 0x60
or rcx, 0x16
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f1140]
nop dword [rax]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0048b740
Function at 0x48b8a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48ba06
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rbx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
je 0x48b915
cmp rcx, 0x17
jne 0x48b9c5
nop dword [rax]
call fcn.00487e60
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
cmp rax, 8
jne 0x48b9b0
mov rdx, qword [rsp + 0x20]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rax
nop
call fcn.00487e60
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
cmp rax, 8
jne 0x48b99d
mov rdx, qword [rsp + 0x10]
bt edx, 8
jae 0x48b98a
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rdx + 0x40]
test rcx, rcx
jl 0x48b985
mov rax, qword [rsp + 0x20]
mov rdx, rax
neg rax
nop dword [rax + rax]
cmp rcx, rax
ja 0x48b975
mov rax, rdx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
test rdx, rdx
je 0x48b980
call fcn.0045d000
nop
call fcn.0045d040
call fcn.0045d000
lea rax, [0x006bb4c0]
lea rbx, [0x007f1170]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1160]
call fcn.00436580
lea rax, [0x006bb4c0]
lea rbx, [0x007f1150]
nop
call fcn.00436580
mov qword [rsp + 0x10], rcx
lea rax, [0x006e4520]
call fcn.0040daa0
mov qword [rax + 8], 0x13
lea rcx, [0x0071fc96]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006c9120]
nop dword [rax + rax]
call fcn.00436580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0048b8a0

Function at 0x48ba40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48bb16
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
and ecx, 0x1f
cmp rcx, 0x17
jne 0x48bab5
mov qword [rsp + 0x28], rbx
call fcn.00487e60
mov rcx, qword [rax + 0x98]
mov rax, rbx
nop
call rcx
cmp rax, 5
jne 0x48baa2
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006bb4c0]
lea rbx, [0x007f1180]
call fcn.00436580
mov qword [rsp + 0x18], rcx
call fcn.0048b280
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rbx
lea rax, [0x006e4520]
call fcn.0040daa0
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x00a04ed0], 0
jne 0x48bb07
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006c9120]
call fcn.00436580
mov rdi, rax
mov rcx, qword [rsp + 0x20]
call fcn.00465b20
jmp 0x48baef
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0048ba40