joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2be0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2d6c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x4b2c68
cmp rcx, 0x11
je 0x4b2c5a
nop dword [rax]
cmp rcx, 0x12
jne 0x4b2d0e
cmp qword [rax], 8
jne 0x4b2d58
cmp qword [rax + 8], 0
je 0x4b2d58
bt edx, 7
jae 0x4b2c48
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045e960
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x15
jne 0x4b2ca1
cmp qword [rax], 8
jne 0x4b2d45
cmp qword [rax + 8], 0
nop dword [rax]
je 0x4b2d45
bt edx, 7
jae 0x4b2c8f
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045ee60
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x16
je 0x4b2cbb
cmp rcx, 0x18
jne 0x4b2d0e
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
call fcn.004ad5c0
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
cmp rax, 0x11
jne 0x4b2cfb
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.004ad5c0
mov rcx, qword [rax + 0xa0]
mov rax, rbx
call rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667a40]
lea rbx, [0x0072dea0]
call fcn.00436260
lea rax, [0x00688ce0]
call fcn.0040da20
mov qword [rax + 8], 0x11
lea rcx, [0x006bc640]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006724e0]
nop
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b2be0
Function at 0x4b2da0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2fdf
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], r8
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x15
jne 0x4b2f7e
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov r10, qword [rax + 0x30]
nop dword [rax]
cmp qword [0x008c3598], r10
je 0x4b2e20
mov rcx, r8
and r8d, 0x1f
cmp r8, 0x18
jne 0x4b2e6a
mov r8, rcx
nop dword [rax]
cmp qword [rsp + 0x88], r10
jne 0x4b2e6d
mov r11, qword [rax + 0x38]
cmp qword [r11], 0x80
ja 0x4b2e6d
mov rcx, qword [rsi]
mov rdi, qword [rsi + 8]
cmp qword [rax], 8
jne 0x4b2f6b
cmp qword [rax + 8], 0
je 0x4b2f6b
bt edx, 7
jae 0x4b2e5c
mov rbx, qword [rbx]
nop dword [rax]
call fcn.0045ed00
jmp 0x4b2ef6
mov r8, rcx
mov rax, rdi
mov rbx, rsi
mov rcx, r8
lea rdi, [0x006beb2b]
mov esi, 0x16
mov r8, r10
xor r9d, r9d
call fcn.004b5440
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
bt ecx, 7
jb 0x4b2eb3
lea rbx, [rsp + 0x90]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 8
nop dword [rax]
jne 0x4b2f58
cmp qword [rax + 8], 0
je 0x4b2f58
mov rdx, qword [rsp + 0x40]
bt edx, 7
jae 0x4b2ee6
mov rsi, qword [rsp + 0x58]
mov rsi, qword [rsi]
jmp 0x4b2eeb
mov rsi, qword [rsp + 0x58]
mov rcx, rbx
mov rbx, rsi
call fcn.0045eca0
test rax, rax
je 0x4b2f48
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0x38]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x40]
or rsi, rdi
test rsi, 0x60
mov ebx, 0
mov esi, 0x20
cmovne rbx, rsi
movzx esi, byte [rdx + 0x17]
and esi, 0x1f
or rbx, rsi
mov rcx, rax
mov rax, rdx
call fcn.004b3620
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
mov qword [rsp + 0x40], rcx
call fcn.004b08e0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x00688ce0]
call fcn.0040da20
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00918a90], 0
jne 0x4b2fd0
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006724e0]
call fcn.00436260
mov rdi, rax
mov rcx, qword [rsp + 0x48]
call fcn.00465700
jmp 0x4b2fb8
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004b2da0
Function at 0x4b3040
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x50]
cmp r12, qword [r14 + 0x10]
jbe 0x4b329d
sub rsp, 0xd0
mov qword [rsp + 0xc8], rbp
lea rbp, [rsp + 0xc8]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rbx
mov rdx, rcx
and ecx, 0x1f
nop dword [rax]
cmp rcx, 0x15
jne 0x4b323c
mov rsi, qword [rax + 0x30]
test rdx, 0x60
mov r8d, 0
mov r9d, 0x20
cmovne r8, r9
movzx r9d, byte [rsi + 0x17]
and r9d, 0x1f
or r8, r9
cmp qword [rax], 8
jne 0x4b3229
cmp qword [rax + 8], 0
je 0x4b3229
bt edx, 7
jae 0x4b30cf
mov rbx, qword [rbx]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x28], r8
test rbx, rbx
jne 0x4b30e2
xor ecx, ecx
jmp 0x4b3101
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x60], rax
mov rax, rbx
call fcn.0045ee60
mov rbx, qword [rsp + 0x40]
mov rcx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rdi, [rsp + 0x68]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d8b
mov rbp, qword [rbp]
lea rcx, [rsp + 0x68]
call fcn.0045ed80
lea rax, [0x006b7f60]
mov rbx, qword [rsp + 0x18]
mov rcx, rbx
call fcn.0044a620
mov qword [rsp + 0x58], rax
xor ecx, ecx
jmp 0x4b3172
lea rax, [rsp + 0x68]
nop
call fcn.0045ede0
mov rcx, qword [rsp + 0x20]
inc rcx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x18]
nop word [rax + rax]
cmp rcx, rdx
jge 0x4b320c
mov qword [rsp + 0x20], rcx
lea rax, [rsp + 0x68]
call fcn.0045ee20
test rax, rax
je 0x4b31fa
mov rbx, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x48]
call fcn.004b3620
mov rdx, qword [rsp + 0x20]
lea rsi, [rdx + rdx*2]
mov rdi, qword [rsp + 0x58]
mov qword [rdi + rsi*8 + 0x10], rcx
lea r8, [rdi + rsi*8]
lea r9, [rdi + rsi*8]
lea r9, [r9 + 8]
cmp dword [0x00918a90], 0
jne 0x4b31e5
mov qword [rdi + rsi*8], rax
mov qword [rdi + rsi*8 + 8], rbx
jmp 0x4b315a
mov rdi, r8
call fcn.00465600
mov rdi, r9
call fcn.00465740
jmp 0x4b315a
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
cmp rcx, rdx
mov rax, qword [rsp + 0x58]
ja 0x4b3224
mov rbx, rcx
mov rcx, rdx
mov rbp, qword [rsp + 0xc8]
add rsp, 0xd0
ret
call fcn.00465b20
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
mov qword [rsp + 0x38], rcx
call fcn.004b08e0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rbx
lea rax, [0x00688ce0]
call fcn.0040da20
mov rcx, qword [rsp + 0x30]
mov qword [rax + 8], rcx
cmp dword [0x00918a90], 0
jne 0x4b328e
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006724e0]
call fcn.00436260
mov rdi, rax
mov rcx, qword [rsp + 0x50]
call fcn.00465700
jmp 0x4b3276
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b3040
Function at 0x4b32e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3380
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp qword [rax + 0x28], 0
je 0x4b336c
mov qword [rsp + 0x28], rax
lea rcx, [rax + 0x18]
mov rax, rcx
call fcn.0045ee20
test rax, rax
je 0x4b3359
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 0x30]
mov rdx, qword [rdx + 0x10]
test rdx, 0x60
mov ebx, 0
mov edx, 0x20
cmovne rbx, rdx
movzx edx, byte [rsi + 0x17]
and edx, 0x1f
or rbx, rdx
mov rcx, rax
mov rax, rsi
call fcn.004b3620
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00667a40]
lea rbx, [0x0072dec0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072deb0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004b32e0

Function at 0x4b33a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3440
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp qword [rax + 0x28], 0
je 0x4b342c
mov qword [rsp + 0x28], rax
lea rcx, [rax + 0x18]
mov rax, rcx
call fcn.0045ee40
test rax, rax
je 0x4b3419
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 0x38]
mov rdx, qword [rdx + 0x10]
test rdx, 0x60
mov ebx, 0
mov edx, 0x20
cmovne rbx, rdx
movzx edx, byte [rsi + 0x17]
and edx, 0x1f
or rbx, rdx
mov rcx, rax
mov rax, rsi
call fcn.004b3620
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00667a40]
lea rbx, [0x0072dee0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072ded0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004b33a0

Function at 0x4b3460
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3532
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, qword [rax + 0x10]
nop dword [rax]
test rdx, rdx
je 0x4b351e
lea rcx, [rax + 0x18]
mov qword [rsp + 0x18], rcx
cmp qword [rax + 0x28], 0
jne 0x4b34c7
mov rsi, qword [rax]
mov rdi, qword [rax + 8]
cmp qword [rsi], 8
jne 0x4b350b
cmp qword [rsi + 8], 0
je 0x4b350b
bt edx, 7
jae 0x4b34b6
mov rdi, qword [rdi]
mov rax, rsi
mov rbx, rdi
nop dword [rax]
call fcn.0045ed80
jmp 0x4b34de
mov rax, rcx
call fcn.0045ee20
test rax, rax
je 0x4b34f8
mov rax, qword [rsp + 0x18]
call fcn.0045ede0
mov rax, qword [rsp + 0x18]
call fcn.0045ee20
test rax, rax
setne al
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667a40]
lea rbx, [0x0072df00]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072def0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004b3460
Function at 0x4b3880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3a06
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x18], rcx
cmp rcx, 0x15
ja 0x4b3925
cmp rcx, 0x12
je 0x4b3966
nop dword [rax]
cmp rcx, 0x13
jne 0x4b3915
bt edx, 9
jb 0x4b3904
nop
cmp qword [rax], 8
jne 0x4b39f2
cmp qword [rax + 8], 0
nop dword [rax]
je 0x4b39f2
bt edx, 7
jae 0x4b38ef
mov rbx, qword [rbx]
test rbx, rbx
je 0x4b38f7
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x004b82a0]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x15
je 0x4b3966
nop dword [rax + rax]
jmp 0x4b39a9
cmp rcx, 0x16
jne 0x4b3957
cmp qword [rax + 8], 0
jne 0x4b3966
mov rax, qword [rbx]
mov qword [rsp + 0x10], rax
call fcn.0045f060
nop
test al, al
je 0x4b39df
mov rax, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x17
je 0x4b3989
nop dword [rax]
cmp rcx, 0x1a
jne 0x4b39a9
cmp qword [rax], 8
jne 0x4b3996
cmp qword [rax + 8], 0
je 0x4b3996
bt edx, 7
jae 0x4b397c
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rbx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
lea rax, [0x00688ce0]
call fcn.0040da20
mov qword [rax + 8], 0x15
lea rcx, [0x006be32c]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006724e0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072df10]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b3880
Function at 0x4b3d00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3e54
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x28], rbx
nop dword [rax + rax]
test rcx, 0x60
jne 0x4b3d4f
bt ecx, 8
jb 0x4b3d7a
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.004b0c60
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
nop
and ecx, 0x1f
nop
cmp rcx, 0x17
jne 0x4b3dee
call fcn.004ad5c0
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
cmp rax, 8
jne 0x4b3ddb
mov rax, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x28]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x10], rax
cmp dword [0x00918a90], 0
jne 0x4b3dc7
mov rax, qword [rsp + 0x60]
mov qword [rdi], rax
jmp 0x4b3dd1
mov rax, qword [rsp + 0x60]
call fcn.00465600
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00667a40]
lea rbx, [0x0072df30]
call fcn.00436260
mov qword [rsp + 0x18], rcx
call fcn.004b08e0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rbx
lea rax, [0x00688ce0]
call fcn.0040da20
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x00918a90], 0
nop
jne 0x4b3e45
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006724e0]
nop dword [rax]
call fcn.00436260
mov rdi, rax
mov rcx, qword [rsp + 0x20]
call fcn.00465700
jmp 0x4b3e2a
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004b3d00
Function at 0x4b3ea0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3ff4
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x28], rbx
nop dword [rax + rax]
test rcx, 0x60
jne 0x4b3eef
bt ecx, 8
jb 0x4b3f1a
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.004b0c60
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
nop
and ecx, 0x1f
nop
cmp rcx, 0x17
jne 0x4b3f8e
call fcn.004ad5c0
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
cmp rax, 5
jne 0x4b3f7b
mov rax, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x28]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x10], rax
cmp dword [0x00918a90], 0
jne 0x4b3f67
mov rax, qword [rsp + 0x60]
mov qword [rdi], rax
jmp 0x4b3f71
mov rax, qword [rsp + 0x60]
call fcn.00465600
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00667a40]
lea rbx, [0x0072df40]
call fcn.00436260
mov qword [rsp + 0x18], rcx
call fcn.004b08e0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rbx
lea rax, [0x00688ce0]
call fcn.0040da20
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x00918a90], 0
nop
jne 0x4b3fe5
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006724e0]
nop dword [rax]
call fcn.00436260
mov rdi, rax
mov rcx, qword [rsp + 0x20]
call fcn.00465700
jmp 0x4b3fca
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004b3ea0
Function at 0x4b43e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b463b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x18], rcx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
jne 0x4b4431
bt edx, 8
jae 0x4b4627
mov rcx, qword [rax + 0x40]
mov rax, qword [rax + 0x38]
jmp 0x4b4445
cmp rcx, 0x17
jne 0x4b4540
mov r8, qword [rbx]
mov rcx, qword [rbx + 0x10]
mov rbx, r8
test rdi, rdi
jl 0x4b4614
cmp rsi, rdi
jl 0x4b4614
nop word [rax + rax]
cmp rsi, rcx
jg 0x4b4614
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x10], rcx
lea rax, [0x006654c0]
nop
call fcn.0040da20
mov qword [rax], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x10]
sub rcx, rdx
mov qword [rax + 0x10], rcx
test rcx, rcx
jle 0x4b44de
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsi + 0x30]
mov r8, qword [r8]
imul rdx, r8
mov r8, qword [rsp + 0x28]
add rdx, r8
cmp dword [0x00918a90], 0
jne 0x4b44d4
mov qword [rax], rdx
jmp 0x4b4503
mov rdi, rax
call fcn.00465720
jmp 0x4b4503
cmp dword [0x00918a90], 0
jne 0x4b44f1
mov rdx, qword [rsp + 0x28]
mov qword [rax], rdx
jmp 0x4b44fe
mov rdi, rax
mov rdx, qword [rsp + 0x28]
call fcn.00465720
mov rsi, qword [rsp + 0x20]
test byte [rsi], al
mov rdx, qword [rsp + 0x18]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
or rcx, 0x97
mov rbx, rax
mov rax, rsi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp rcx, 0x18
jne 0x4b45d9
test rdi, rdi
jl 0x4b45c6
cmp rsi, rdi
jl 0x4b45c6
cmp qword [rbx + 8], rsi
jl 0x4b45c6
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x00687ac0]
call fcn.0040da20
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x38]
nop word [rax + rax]
cmp qword [rdx + 8], rcx
jle 0x4b45af
mov rdx, qword [rdx]
mov rsi, qword [rsp + 0x70]
sub rsi, rcx
nop
mov qword [rax + 8], rsi
add rdx, rcx
cmp dword [0x00918a90], 0
jne 0x4b45a7
mov qword [rax], rdx
jmp 0x4b45af
mov rdi, rax
call fcn.00465720
mov rbx, rax
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00667a40]
lea rbx, [0x0072df60]
call fcn.00436260
mov qword [rsp + 0x18], rcx
lea rax, [0x00688ce0]
call fcn.0040da20
mov qword [rax + 8], 0x13
lea rcx, [0x006bd583]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006724e0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072df70]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072df50]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004b43e0
Function at 0x4b47e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b490f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
test rcx, rcx
je 0x4b48d8
bt ecx, 9
jae 0x4b4899
sar rcx, 0xa
movzx edx, byte [rax + 0x17]
and edx, 0x1f
cmp rdx, 0x14
jne 0x4b4851
mov rdx, qword [rax + 0x38]
cmp qword [rax + 0x40], rcx
jbe 0x4b48c5
mov ebx, dword [rdx + rcx*8 + 4]
call fcn.00460a20
mov rbx, rax
lea rax, [0x007331e8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x10], rcx
nop dword [rax + rax]
call fcn.004ad280
mov rcx, qword [rsp + 0x10]
cmp rbx, rcx
jbe 0x4b48ad
shl rcx, 4
mov ebx, dword [rax + rcx + 4]
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.00460a20
mov rbx, rax
lea rax, [0x007331e8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, rax
lea rax, [0x007331e8]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667a40]
lea rbx, [0x0072e0b0]
nop dword [rax + rax]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072e0b0]
call fcn.00436260
lea rax, [0x00688ce0]
nop
call fcn.0040da20
mov qword [rax + 8], 0x12
lea rcx, [0x006bccb0]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006724e0]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b47e0
Function at 0x4b4940
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b4acc
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x15
ja 0x4b49e5
cmp rcx, 0x12
je 0x4b4a2c
nop dword [rax]
cmp rcx, 0x13
jne 0x4b49d6
bt edx, 9
jb 0x4b49c4
nop
cmp qword [rax], 8
jne 0x4b4ab8
cmp qword [rax + 8], 0
nop dword [rax]
je 0x4b4ab8
bt edx, 7
jae 0x4b49af
mov rbx, qword [rbx]
test rbx, rbx
je 0x4b49b7
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
lea rax, [0x004b82a0]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x15
je 0x4b4a2c
nop dword [rax]
jmp 0x4b4a6f
cmp rcx, 0x16
jne 0x4b4a20
cmp qword [rax + 8], 0
jne 0x4b4a2c
mov qword [rsp + 0x18], rbx
mov rax, qword [rbx]
call fcn.0045f060
nop
test al, al
je 0x4b4aa5
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x17
je 0x4b4a4f
cmp rcx, 0x1a
jne 0x4b4a6f
cmp qword [rax], 8
jne 0x4b4a5c
cmp qword [rax + 8], 0
je 0x4b4a5c
bt edx, 7
jae 0x4b4a42
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rbx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
lea rax, [0x00688ce0]
call fcn.0040da20
mov qword [rax + 8], 0x1b
lea rcx, [0x006c12b8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006724e0]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072df80]
call fcn.00436260
lea rax, [0x00667a40]
lea rbx, [0x0072dc10]
call fcn.00436260
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b4940