joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f790
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45fa77
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a39]
cmp al, 1
jbe 0x45f7cd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x45f7d6
call fcn.00429df0
ud2
mov byte [0x00850a39], 1
call fcn.0045de10
lea rax, [0x006acba7]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0045e8c0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x00834540], rcx
mov ecx, dword [0x00850df0]
test ecx, ecx
jne 0x45fa66
mov qword [0x00834548], rax
lea rax, [0x006ad05e]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0045e8c0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x00834530], rcx
mov ecx, dword [0x00850df0]
test ecx, ecx
jne 0x45fa55
mov qword [0x00834538], rax
lea rax, [0x006ab172]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834500], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x45fa41
mov qword [0x00834508], rcx
lea rax, [0x006ad997]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834550], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x45fa2d
mov qword [0x00834558], rcx
lea rax, [0x006b7843]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834520], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x45fa19
mov qword [0x00834528], rcx
lea rax, [0x006afa4c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834570], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x45fa05
mov qword [0x00834578], rcx
lea rax, [0x006afa38]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834560], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x45f9f4
mov qword [0x00834568], rcx
lea rax, [0x006b34b3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00834510], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x45f9e3
mov qword [0x00834518], rcx
mov byte [0x00850a39], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x00834518]
mov rax, rcx
call fcn.004553b0
jmp 0x45f9d2
lea rdi, [0x00834568]
mov rax, rcx
call fcn.004553b0
jmp 0x45f997
lea rdi, [0x00834578]
mov rax, rcx
call fcn.004553b0
jmp 0x45f95c
lea rdi, [0x00834528]
mov rax, rcx
call fcn.004553b0
jmp 0x45f91d
lea rdi, [0x00834558]
mov rax, rcx
call fcn.004553b0
jmp 0x45f8de
lea rdi, [0x00834508]
mov rax, rcx
call fcn.004553b0
jmp 0x45f89f
lea rdi, [0x00834538]
call fcn.004553b0
jmp 0x45f860
lea rdi, [0x00834548]
call fcn.004553b0
jmp 0x45f821
call fcn.00452950
jmp fcn.0045f790
Function at 0x467590
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x467617
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
jl 0x4675f9
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004672d0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x10]
cmp rax, rdx
ja 0x4675f2
mov qword [rcx + 8], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00429bc0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f62e0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00467590

Function at 0x469820
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x46992a
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a04]
cmp al, 1
jbe 0x46985d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x469866
call fcn.00429df0
ud2
mov byte [0x00850a04], 1
call fcn.0045f790
call fcn.00461350
call fcn.00466f80
lea rax, [0x006b0dde]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x008341c0], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x469919
mov qword [0x008341c8], rcx
lea rax, [0x006b9b61]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0045e8c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x008341d0], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x469908
mov qword [0x008341d8], rcx
call fcn.00468d20
mov byte [0x00850a04], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x008341d8]
mov rax, rcx
call fcn.004553b0
jmp 0x4698f2
lea rdi, [0x008341c8]
mov rax, rcx
call fcn.004553b0
jmp 0x4698b7
call fcn.00452950
jmp fcn.00469820
Function at 0x46df50
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x46e1fc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movzx eax, byte [rsp + 0x61]
test al, al
je 0x46e1d9
mov eax, 4
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
mov qword [rdx + 8], 0
movzx ebx, byte [rsp + 0x60]
mov byte [rdx + 0x10], bl
mov rbx, qword [rsp + 0x58]
lea rsi, [rbx + 0x15c]
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
cmp rbx, 0xfffffffffffffea4
jge 0x46dfd6
mov byte [rsp + 0x70], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rbx, [rbx + rsi + 0x15c]
sar rbx, 3
cmp rbx, 0x57
jge 0x46dfc7
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
shl rbx, 3
sub rdi, rbx
mov qword [rsp + 0x30], rdi
cmp rdi, 0x13
jge 0x46e172
lea rbx, [rdi - 0x13]
neg rbx
cmp rbx, 0x14
jae 0x46e1f5
lea r8, [0x007fb340]
mov rbx, qword [r8 + rbx*8]
cmp rcx, rbx
jae 0x46e172
mov rcx, qword [rdx]
cmp rdi, 0x14
jae 0x46e1ee
mov rax, qword [r8 + rdi*8]
imul rcx, rax
mov qword [rdx], rcx
mov qword [rsp], rdx
call fcn.0046de00
mov rax, qword [rsp + 0x20]
cmp rax, 0x57
mov rcx, qword [rsp + 0x28]
jae 0x46e1e0
mov qword [rsp + 0x28], rcx
lea rax, [rax + rax*2]
lea rcx, [0x00808b40]
mov rdx, qword [rcx + rax*8 + 8]
mov rbx, rax
shl rax, 3
movzx eax, byte [rcx + rax + 0x10]
mov rcx, qword [rcx + rbx*8]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov byte [rsp + 0x18], al
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0046ded0
mov rax, qword [rsp + 0x28]
test rax, rax
jle 0x46e0b0
inc rax
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp], rcx
call fcn.0046de00
mov rax, qword [rsp + 0x28]
add rax, 4
mov rcx, qword [rsp + 8]
shl rax, cl
cmp rcx, 0x40
sbb rcx, rcx
and rax, rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx + 0x10]
add rdx, 0xffffffffffffffc1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rbx + 8]
cmp rsi, rdx
jg 0x46e166
sub rdx, rsi
sub rdx, qword [rcx]
add rdx, 0x40
lea rcx, [rdx - 1]
mov esi, 1
shl rsi, cl
cmp rcx, 0x40
sbb rdi, rdi
and rdi, rsi
mov rcx, rdx
mov esi, 1
shl rsi, cl
cmp rcx, 0x40
sbb rdx, rdx
and rsi, rdx
lea rdx, [rsi - 1]
and rdx, qword [rbx]
mov rbx, rdi
sub rdi, rax
cmp rdi, rdx
jge 0x46e148
add rax, rbx
cmp rdx, rax
jl 0x46e157
mov byte [rsp + 0x70], 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov byte [rsp + 0x70], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rsi, qword [rcx]
lea rdx, [rsi - 0x3f]
neg rdx
jmp 0x46e103
mov qword [rsp], rdx
call fcn.0046de00
mov rax, qword [rsp + 0x30]
cmp rax, 8
jae 0x46e1e7
lea rax, [rax + rax*2]
mov rcx, rax
shl rax, 3
lea rdx, [0x007fb860]
movzx eax, byte [rdx + rax + 0x10]
mov rbx, qword [rdx + rcx*8 + 8]
mov rcx, qword [rdx + rcx*8]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], al
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0046ded0
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 4]
mov rax, qword [rsp + 0x20]
cmp rax, 0x57
jmp 0x46e05c
xor eax, eax
jmp 0x46df8a
call fcn.00429b50
ud2
call fcn.00429b50
ud2
call fcn.00429b50
ud2
call fcn.00429b50
ud2
call fcn.00452950
jmp fcn.0046df50
Function at 0x46e210
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x46e31a
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
lea rbx, [rdx + 0x2e]
neg rbx
imul rbx, rbx, 0x1c
movabs rax, 0x5816058160581606
mov rsi, rdx
imul rbx
sar rbx, 0x3f
sar rdx, 5
sub rdx, rbx
lea rbx, [rdx + 0x15c]
sar rbx, 0x3f
shr rbx, 0x3d
lea rdx, [rbx + rdx + 0x15c]
sar rdx, 3
jmp 0x46e287
mov rdx, rax
cmp rdx, 0x57
jae 0x46e313
lea rax, [rdx + rdx*2]
lea rbx, [0x00808b40]
mov rdi, qword [rbx + rax*8 + 8]
mov r8, rax
shl rax, 3
lea r9, [rsi + rdi + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x46e2b9
lea rax, [rdx + 1]
jmp 0x46e284
cmp r9, 0xffffffffffffffe0
jle 0x46e2c5
lea rax, [rdx - 1]
jmp 0x46e284
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbx + r8*8]
movzx eax, byte [rbx + rax + 0x10]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdi
mov byte [rsp + 0x18], al
mov qword [rsp], rcx
call fcn.0046ded0
mov rax, qword [rsp + 0x20]
mov rcx, rax
shl rax, 3
add rax, 0xfffffffffffffea4
neg rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00429b50
ud2
call fcn.00452950
jmp fcn.0046e210
Function at 0x46e7d0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x46e931
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
shl rax, cl
cmp rcx, 0x40
sbb rdx, rdx
and rax, rdx
mov rdx, qword [rsp + 0x28]
cmp rdx, rax
ja 0x46e913
mov rcx, qword [rsp + 0x40]
mov rbx, rcx
shl rcx, 1
cmp rcx, rax
ja 0x46e8f5
lea rcx, [rdx + rbx]
shl rcx, 1
cmp rcx, rax
jb 0x46e8d1
sub rdx, rbx
shl rdx, 1
cmp rdx, rax
jbe 0x46e8c2
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
dec rcx
jmp 0x46e862
add qword [rax + 0x18], 0xffffffffffffffff
dec rcx
test rcx, rcx
jl 0x46e87f
mov rdx, qword [rax + 8]
mov rbx, qword [rax]
cmp rcx, rdx
jae 0x46e8ee
movzx edx, byte [rcx + rbx]
cmp dl, 0x39
je 0x46e85a
test rcx, rcx
jge 0x46e8ab
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
test rdx, rdx
jbe 0x46e8e7
mov byte [rcx], 0x31
mov qword [rax + 0x18], 1
inc qword [rax + 0x20]
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rdx, qword [rax]
mov rax, qword [rax + 8]
cmp rcx, rax
jae 0x46e8e0
movzx eax, byte [rcx + rdx]
inc eax
mov byte [rdx + rcx], al
jmp 0x46e89c
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.00429b50
ud2
call fcn.00429b50
ud2
call fcn.00429b50
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6ea0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6e90]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.0046e7d0
Function at 0x4768f0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x476b4b
sub rsp, 0x80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rax, qword [rsp + 0xa8]
bt eax, 9
jae 0x476b2d
mov rcx, qword [rsp + 0x98]
movzx edx, byte [rcx + 0x17]
mov byte [rsp + 0x4f], dl
mov qword [rsp], rcx
mov rbx, qword [rsp + 0xa0]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rax
call fcn.00483720
mov rax, qword [rsp + 0xa8]
and rax, 0x1e0
movzx edx, byte [rsp + 0x4f]
and edx, 0x1f
or rdx, rax
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
lea rsi, [0x006fb820]
cmp rbx, rsi
jne 0x476b0a
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x70], rax
lea rcx, [0x006d5460]
test byte [rcx], al
mov rcx, qword [0x006d5460]
mov qword [rsp + 0x58], rcx
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.0047eb00
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rcx, [0x00683480]
mov qword [rsp], rcx
call fcn.00410b80
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
mov ecx, dword [0x00850df0]
lea rdi, [rax + 8]
test ecx, ecx
jne 0x476af5
mov rcx, qword [rsp + 0x60]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xa8]
sar rcx, 0xa
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x28], rcx
mov ecx, dword [0x00850df0]
lea rbx, [rax + 0x20]
lea rdi, [rax + 0x18]
test ecx, ecx
jne 0x476ac7
mov rcx, qword [rsp + 0x98]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rax + 0x20], rcx
mov qword [rsp + 0x68], rax
mov rdx, qword [rax + 0x28]
mov rbx, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
mov qword [rsp + 0x28], rsi
mov rsi, qword [rsp + 0x88]
mov qword [rsp], rsi
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdx
call fcn.00480630
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xa8]
and rax, 0x60
or rax, 0x13
mov qword [rsp + 0xc0], rax
mov rbp, qword [rsp + 0x78]
add rsp, 0x80
ret
mov rcx, rax
mov rax, qword [rsp + 0x98]
call fcn.004553b0
mov rdi, rbx
mov rax, qword [rsp + 0xa0]
call fcn.004553b0
mov rbx, rax
mov rax, rcx
mov rcx, rbx
jmp 0x476a45
mov rcx, rax
mov rax, qword [rsp + 0x60]
call fcn.004553b0
mov rax, rcx
jmp 0x4769fe
mov qword [rsp], rbx
lea rax, [0x006a26a0]
mov qword [rsp + 8], rax
lea rax, [0x00699000]
mov qword [rsp + 0x10], rax
call fcn.0040de40
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f69a0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.004768f0
Function at 0x478ed0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x478f37
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
jne 0x478f19
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6bb0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00478ed0

Function at 0x478fc0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x47910c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
ja 0x47905e
cmp rcx, 0x11
jne 0x47902a
mov rax, qword [rax + 0x30]
test rax, rax
je 0x479024
lea rcx, [0x006fb820]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ecx, ecx
jmp 0x479010
cmp rcx, 0x12
jne 0x4790ee
mov rax, qword [rax + 0x30]
test rax, rax
je 0x479058
lea rcx, [0x006fb820]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ecx, ecx
jmp 0x479044
cmp rcx, 0x15
jne 0x47908e
mov rax, qword [rax + 0x38]
test rax, rax
je 0x479088
lea rcx, [0x006fb820]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ecx, ecx
jmp 0x479074
cmp rcx, 0x16
jne 0x4790be
mov rax, qword [rax + 0x30]
test rax, rax
je 0x4790b8
lea rcx, [0x006fb820]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ecx, ecx
jmp 0x4790a4
cmp rcx, 0x17
jne 0x4790ee
mov rax, qword [rax + 0x30]
test rax, rax
je 0x4790e8
lea rcx, [0x006fb820]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ecx, ecx
jmp 0x4790d4
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6c50]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00478fc0

Function at 0x479860
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4798c7
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x11
jne 0x4798a9
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6ac0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00479860
Function at 0x479940
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4799a7
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x479989
movzx eax, word [rax + 0x30]
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6ae0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00479940

Function at 0x4799b0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x479a63
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x479a45
movzx ecx, byte [rax + 0x14]
test cl, 1
je 0x479a37
mov ecx, 0x48
movzx edx, word [rax + 0x32]
mov ebx, edx
and edx, 0x7fff
test bx, 0x7fff
jne 0x479a1c
xor eax, eax
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
add rcx, rax
test byte [rcx], al
movzx eax, word [rax + 0x30]
movzx ecx, ax
add eax, edx
movzx eax, ax
cmp rcx, rax
ja 0x479a3e
sub rax, rcx
jmp 0x479a0d
mov ecx, 0x38
jmp 0x4799f8
call fcn.00429bc0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6af0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.004799b0

Function at 0x479a70
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x479b78
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x479b5a
movzx ecx, byte [rax + 0x14]
test cl, 1
je 0x479b42
mov ecx, 0x48
movzx edx, word [rax + 0x32]
mov ebx, edx
and edx, 0x7fff
test bx, 0x7fff
jne 0x479b0c
xor eax, eax
xor ecx, ecx
mov rdx, qword [rsp + 0x28]
cmp rdx, rax
jae 0x479b4c
mov rax, qword [rcx + rdx*8]
test rax, rax
je 0x479b05
lea rcx, [0x006fb820]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor ecx, ecx
mov rax, rcx
jmp 0x479af1
add rcx, rax
test byte [rcx], al
movzx eax, word [rax + 0x30]
movzx ebx, ax
add eax, edx
movzx eax, ax
cmp rbx, rax
ja 0x479b53
sub rax, rbx
lea rdx, [rbx - 0x100000]
neg rdx
neg rdx
sar rdx, 0x3f
shl rbx, 3
and rbx, rdx
add rcx, rbx
jmp 0x479ad7
mov ecx, 0x38
jmp 0x479ac0
call fcn.00429b50
ud2
call fcn.00429bc0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6b00]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00479a70

Function at 0x47ba70
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x47ba95
lea rsi, [rbx + 1]
imul edx, edx, 0x1000193
movzx edi, byte [rcx + rbx]
xor edx, edi
mov rbx, rsi
cmp rbx, rax
jl 0x47ba82
mov dword [rsp + 0x28], edx
ret
Function at 0x47fbd0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x47fc5e
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
cmp rcx, 8
jne 0x47fc40
movzx eax, byte [rax + 0x17]
test al, 0x80
jne 0x47fc40
mov rax, qword [rsp + 0x30]
bt eax, 7
jae 0x47fc2c
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6bd0]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.0047fbd0

Function at 0x480030
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x48017e
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x480074
test rax, 0x60
jne 0x4800e7
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
call fcn.0047fec0
mov rax, qword [rsp]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x48], rcx
lea rdx, [0x00671340]
mov qword [rsp], rdx
call fcn.00410b80
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x48]
mov qword [rdi + 8], rax
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4800be
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
jmp 0x4800c8
mov rax, qword [rsp + 0x50]
call fcn.004553b0
mov qword [rdi + 0x10], 0
lea rax, [0x0065a860]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042aba0
ud2
call fcn.0047fec0
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov qword [rsp], 0
lea rdx, [0x006ac3bf]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
lea rax, [0x006b7ac8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x2c
call fcn.00441cc0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 8], rax
call fcn.0040e0f0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00480030