joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e93a0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4e93b7
inc rax
cmp rax, 4
jge 0x4e93cf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4e93b4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4e93e0
inc rax
cmp rax, 4
jge 0x4e93ee
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4e9417
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4e93fb
jmp 0x4e93dd

Function at 0x4e9580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e9695
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rax + 0x20]
mov rdx, qword [rdx + 0x20]
nop word [rax + rax]
test rdx, rdx
je 0x4e9661
cmp byte [rdx + 0x38], 0
jne 0x4e9661
mov qword [rsp + 0x60], rax
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
nop
test rcx, rcx
je 0x4e95dd
cmp byte [rdx], 0x23
jne 0x4e95dd
dec rcx
mov rbx, rcx
neg rbx
sar rbx, 0x3f
and ebx, 1
add rdx, rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea rax, [0x00678d80]
call fcn.0040d680
lea rcx, [0x004ea300]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x20]
test byte [rcx], al
add rcx, 0x18
cmp dword [0x00921500], 0
je 0x4e961d
call fcn.004665a0
mov qword [r11], rcx
mov qword [rsp + 0x48], rax
mov qword [rax + 8], rcx
lea rbx, [0x006ba79b]
mov ecx, 0x1e
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
lea r8, [0x006b1083]
mov r9d, 7
xor eax, eax
call fcn.0044f6c0
mov rcx, qword [rsp + 0x48]
call fcn.00460480
add rsp, 0x50
pop rbp
nop
ret
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
xor eax, eax
lea rbx, [0x006bdad5]
mov ecx, 0x25
call fcn.0044f620
nop dword [rax + rax]
call fcn.0040ae40
mov rbx, rax
lea rax, [0x0065b7a0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.004e9580

Function at 0x4eaf00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eafb5
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
nop
nop dword [rax]
test rax, rax
je 0x4eafa1
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
lea rax, [0x00699c60]
call fcn.0040d680
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00729f18]
mov rsi, rax
call fcn.004eb800
lea rax, [0x00678e80]
call fcn.0040d680
lea rcx, [0x004eafe0]
mov qword [rax], rcx
cmp dword [0x00921500], 0
jne 0x4eaf80
mov rbx, qword [rsp + 0x28]
jmp 0x4eaf8d
call fcn.004665a0
mov rbx, qword [rsp + 0x28]
mov qword [r11], rbx
mov qword [rax + 8], rbx
mov rcx, rax
lea rax, [0x0072a7f8]
add rsp, 0x30
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727ee0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004eaf00
Function at 0x4ec980
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eca8c
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r8
mov byte [rsp + 0x50], bl
mov qword [rsp + 0x48], rax
test byte [rax], al
xor ebx, ebx
call fcn.004ebf20
movzx edx, byte [rsp + 0x50]
nop dword [rax]
test dl, dl
je 0x4ec9dc
mov rdi, qword [rsp + 0x48]
mov rax, qword [rdi]
mov rbx, qword [rdi + 8]
lea rcx, [0x00729ef0]
call fcn.004eb2e0
mov rcx, qword [rsp + 0x48]
lea rdx, [rcx + 0x10]
mov qword [rsp + 0x30], rdx
xor eax, eax
mov esi, 1
lock cmpxchg dword [rcx + 0x10], esi
sete sil
test sil, sil
jne 0x4eca11
mov rax, rdx
call fcn.00480e60
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx + 0x50]
test rax, rax
je 0x4eca59
nop
cmp qword [rax + 0x20], 0
je 0x4eca78
add rax, 8
call fcn.00463520
cmp dword [0x00921500], 0
jne 0x4eca3b
mov rcx, qword [rsp + 0x48]
jmp 0x4eca4c
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx + 0x50]
call fcn.004665a0
mov qword [r11], rdx
mov qword [rcx + 0x50], 0
mov rdx, qword [rsp + 0x30]
nop
mov ebx, 0xffffffff
lock xadd dword [rcx + 0x10], ebx
dec ebx
test ebx, ebx
je 0x4eca72
mov rax, rdx
call fcn.00481140
add rsp, 0x38
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727780]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004646a0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004ec980
Function at 0x4ecb60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ecccf
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
test rax, rax
je 0x4eccbb
nop dword [rax]
test rcx, rcx
je 0x4ecca8
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x4ecbe4
lea r9, [0x0072bd48]
jmp 0x4ecbe9
xor r9d, r9d
xor edx, edx
mov rcx, qword [r9 + 0x20]
mov rax, rdx
call rcx
test al, al
je 0x4ecc95
lea rax, [0x00695260]
call fcn.0040d680
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
cmp dword [0x00921500], 0
jne 0x4ecc20
mov rcx, qword [rsp + 0x48]
jmp 0x4ecc2d
call fcn.004665a0
mov rcx, qword [rsp + 0x48]
mov qword [r11], rcx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
cmp dword [0x00921500], 0
jne 0x4ecc4a
mov rcx, qword [rsp + 0x58]
jmp 0x4ecc57
call fcn.004665a0
mov rcx, qword [rsp + 0x58]
mov qword [r11], rcx
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x20], rcx
cmp dword [0x00921500], 0
jne 0x4ecc74
mov rcx, qword [rsp + 0x68]
jmp 0x4ecc81
call fcn.004665a0
mov rcx, qword [rsp + 0x68]
mov qword [r11], rcx
mov qword [rax + 0x28], rcx
mov rbx, rax
lea rax, [0x0072a7c0]
add rsp, 0x30
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727f10]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727f00]
call fcn.00436ac0
lea rax, [0x0065b7a0]
lea rbx, [0x00727ee0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004ecb60
Function at 0x4eebc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eed8b
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov rsi, qword [rax + 0x28]
nop dword [rax + rax]
test rsi, rsi
jle 0x4eec4a
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x30]
cmp rdx, rcx
jb 0x4eed85
cmp rcx, rsi
jb 0x4eed7a
mov r8, qword [rax]
mov r9, qword [rax + 8]
sub rcx, rsi
mov r10, rsi
sub rsi, rdx
sar rsi, 0x3f
and r10, rsi
lea rbx, [r10 + r8]
cmp r9, rcx
cmovg r9, rcx
test r10, r10
je 0x4eec36
mov rax, r8
mov rcx, r9
call fcn.00467360
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 0x30]
sub rdx, qword [rax + 0x28]
mov qword [rax + 0x30], rdx
mov qword [rax + 0x28], 0
mov rdx, qword [rax + 8]
cmp qword [rax + 0x30], rdx
jge 0x4eed67
mov ecx, 0x64
jmp 0x4eec6a
mov rcx, qword [rsp + 0x20]
dec rcx
mov rax, rdx
test rcx, rcx
jle 0x4eed08
mov rdx, qword [rax + 8]
mov rsi, qword [rax + 0x30]
nop dword [rax + rax]
cmp rsi, rdx
ja 0x4eed5c
mov qword [rsp + 0x20], rcx
mov r8, qword [rax + 0x18]
mov r9, qword [rax + 0x20]
mov r8, qword [r8 + 0x18]
mov r10, qword [rax]
mov rdi, qword [rax + 0x10]
sub rdi, rsi
sub rdx, rsi
mov r11, rdi
neg r11
sar r11, 0x3f
and r11, rsi
lea rbx, [r11 + r10]
mov rcx, rdx
mov rax, r9
nop
call r8
test rax, rax
jl 0x4eed3d
mov rdx, qword [rsp + 0x38]
add qword [rdx + 0x30], rax
test rbx, rbx
jne 0x4eece1
test rax, rax
jle 0x4eec5f
add rsp, 0x28
pop rbp
ret
mov qword [rdx + 0x38], rbx
cmp dword [0x00921500], 0
je 0x4eecfe
call fcn.004665c0
mov qword [r11], rcx
mov rax, qword [rdx + 0x40]
mov qword [r11 + 8], rax
mov qword [rdx + 0x40], rcx
add rsp, 0x28
pop rbp
ret
mov rcx, qword [0x008bda10]
mov rdx, qword [0x008bda18]
mov qword [rax + 0x38], rcx
cmp dword [0x00921500], 0
je 0x4eed33
call fcn.004665c0
mov qword [r11], rdx
mov rcx, qword [rax + 0x40]
mov qword [r11 + 8], rcx
mov qword [rax + 0x40], rdx
add rsp, 0x28
pop rbp
ret
mov rcx, qword [0x008be680]
test rcx, rcx
je 0x4eed4d
mov rcx, qword [rcx + 8]
mov rbx, qword [0x008be688]
mov rax, rcx
call fcn.00436ac0
mov rax, rsi
mov rcx, rdx
call fcn.00466a20
lea rax, [0x0065b7a0]
lea rbx, [0x00727f20]
call fcn.00436ac0
mov rax, rsi
nop dword [rax]
call fcn.00466a20
call fcn.004669e0
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.004eebc0
Function at 0x4ef9a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efb06
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov ebx, 0xa
nop dword [rax]
call fcn.004ef740
cmp qword [0x008be660], rdi
jne 0x4efa7a
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov rcx, qword [0x008be668]
mov rax, rdi
mov rbx, rsi
call fcn.00404940
nop dword [rax]
test al, al
je 0x4efa61
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x4efa43
mov rax, qword [rsp + 0x30]
movzx r9d, byte [rax + rdx - 1]
cmp r9b, 0xd
jne 0x4efa3e
mov r9, qword [rsp + 0x50]
mov r10, qword [r9 + 0x28]
test r10, r10
je 0x4efaf0
dec r10
mov qword [r9 + 0x28], r10
lea rbx, [rdx - 1]
jmp 0x4efa4b
mov rbx, rdx
jmp 0x4efa4b
mov rax, qword [rsp + 0x30]
mov rbx, rdx
mov rcx, qword [rsp + 0x18]
mov edi, 1
xor esi, esi
xor r8d, r8d
add rsp, 0x40
pop rbp
nop
ret
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
test rbx, rbx
je 0x4efabe
movzx r9d, byte [rax + rbx - 1]
cmp r9b, 0xa
jne 0x4efab1
cmp rbx, 1
jle 0x4efaa4
movzx r9d, byte [rbx + rax - 2]
cmp r9b, 0xd
jne 0x4efaa4
mov edx, 2
jmp 0x4efaa9
mov edx, 1
sub rbx, rdx
cmp rcx, rbx
jb 0x4efae5
xor edi, edi
xor esi, esi
xor r8d, r8d
add rsp, 0x40
pop rbp
ret
test rdi, rdi
mov edx, 0
cmovne rbx, rdx
cmovne rcx, rdx
mov edx, 0
cmovne rax, rdx
mov r8, rsi
mov rsi, rdi
xor edi, edi
add rsp, 0x40
pop rbp
ret
mov rdx, rcx
mov rcx, rbx
call fcn.004669e0
lea rax, [0x0065b7a0]
lea rbx, [0x00727f30]
nop
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.004ef9a0

Function at 0x4efd40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efdee
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x10]
mov rsi, qword [rax + 0x30]
cmp rdx, rsi
jb 0x4efde5
mov r8, qword [rax + 0x28]
cmp rsi, r8
jb 0x4efdd8
mov qword [rsp + 0x30], rax
mov r9, qword [rbx + 0x18]
mov r10, qword [rax]
sub rdx, r8
sub rsi, r8
mov rdi, rdx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rbx, [r10 + r8]
mov rax, rcx
mov rcx, rsi
call r9
nop
test rax, rax
jl 0x4efdb4
mov rdx, qword [rsp + 0x30]
add qword [rdx + 0x28], rax
add rsp, 0x20
pop rbp
ret
mov rcx, qword [0x008be690]
nop dword [rax + rax]
test rcx, rcx
je 0x4efdc9
mov rcx, qword [rcx + 8]
mov rbx, qword [0x008be698]
mov rax, rcx
call fcn.00436ac0
mov rax, r8
mov rcx, rsi
nop
call fcn.00466a20
mov rcx, rsi
call fcn.004669e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004efd40
Function at 0x4f0b20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f0d51
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
cmp qword [rax], 2
nop dword [rax + rax]
jl 0x4f0bf6
cmp qword [rax + 0xa0070], 0
jne 0x4f0d3d
cmp qword [rax + 0xa0090], 0
nop dword [rax]
jne 0x4f0d3d
cmp rcx, 0x8000
jle 0x4f0b92
sub rdi, rcx
lea r9, [rdi + 0x8000]
neg r9
sar r9, 0x3f
lea r10, [rcx - 0x8000]
and r9, r10
add rbx, r9
mov ecx, 0x8000
mov qword [rsp + 0x68], rax
mov r9, qword [rax + 0xa0078]
mov r10, qword [rax + 0xa0080]
cmp rcx, r10
cmovl r10, rcx
mov qword [rsp + 0x30], r10
cmp rbx, r9
je 0x4f0bcf
mov rax, r9
mov rcx, r10
nop dword [rax]
call fcn.00467360
mov rax, qword [rsp + 0x68]
mov r10, qword [rsp + 0x30]
lea r9, [r10 + 0xfc]
sar r9, 0x3f
shr r9, 0x38
lea r9, [r10 + r9]
lea r9, [r9 + 0xfc]
sar r9, 8
mov qword [rsp + 0x38], r9
xor ecx, ecx
jmp 0x4f0c00
add rsp, 0x58
pop rbp
ret
inc rcx
nop
cmp rcx, r9
jge 0x4f0cc6
mov rsi, rcx
shl rsi, 8
lea rbx, [rsi + 0x103]
mov rdx, qword [rax + 0xa0088]
cmp r10, rbx
cmovl rbx, r10
cmp rdx, rbx
jb 0x4f0d35
cmp rbx, rsi
jb 0x4f0d2a
mov r11, qword [rax + 0xa0078]
sub rbx, rsi
sub rdx, rsi
mov r12, rdx
neg rdx
sar rdx, 0x3f
and rdx, rsi
lea r13, [rbx - 3]
add r11, rdx
test r13, r13
jle 0x4f0bfc
nop dword [rax]
cmp r13, 0x101
ja 0x4f0d1d
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r13
lea rdi, [rax + 0xa00e8]
mov rdx, qword [rax + 0x38]
mov r9, qword [rdx]
mov rcx, r12
mov rsi, r13
mov r8d, 0x101
mov rax, r11
call r9
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x68]
mov r9, qword [rsp + 0x50]
xor eax, eax
jmp 0x4f0d16
mov rax, rdi
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x30]
jmp 0x4f0bfc
mov qword [rax + 0xa0090], r10
mov qword [rax + 0xa0070], r10
add rsp, 0x58
pop rbp
ret
mov r10d, dword [rdi + rax*4 + 0xa00e8]
lea r11, [rax + r9]
and r10d, 0x1ffff
mov r12, r11
and r11d, 0x7fff
mov r13d, dword [rdi + r10*4 + 0x68]
mov dword [rdi + r11*4 + 0x80068], r13d
mov r11, qword [rdi + 0xa0068]
add r11, r12
mov dword [rdi + r10*4 + 0x68], r11d
inc rax
cmp rax, rsi
jl 0x4f0cda
jmp 0x4f0caf
mov rcx, r13
mov edx, 0x101
call fcn.004669a0
mov rax, rsi
mov rcx, rbx
call fcn.00466a20
mov rcx, rbx
call fcn.004669e0
lea rax, [0x0065b7a0]
lea rbx, [0x00727f40]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.004f0b20
Function at 0x4fa520
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4fa5f5
movdqa xmm0, xmmword [0x00727460]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4fa561
movdqa xmm0, xmmword [0x00727470]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4fa677
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4fa64b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00727188]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00727480]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret

Function at 0x4fb7e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fb896
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
lea rdx, [rcx + 2]
cmp rdx, 0xb
jbe 0x4fb853
movups xmmword [rsp + 0x30], xmm15
mov rax, rcx
call fcn.0040adc0
lea rcx, [0x0065b920]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x006bcba4]
mov ebx, 0x23
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
nop
call fcn.004dd6a0
mov rcx, rbx
mov rbx, rax
xor eax, eax
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
lea rax, [0x0069eb40]
call fcn.0040d680
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
call fcn.004fb8c0
mov rax, qword [rsp + 0x28]
xor ebx, ebx
xor ecx, ecx
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004fb7e0
Function at 0x4fba20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fbaf3
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rcx, 0xffff
jg 0x4fbac5
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
lea rbx, [rax + 0x89]
mov word [rax + 0x89], cx
mov rdx, qword [rax + 0x58]
mov rsi, qword [rax + 0x60]
mov rdx, qword [rdx + 0x18]
mov edi, 0xa
mov rax, rsi
mov ecx, 2
call rdx
test rbx, rbx
je 0x4fba97
mov rax, rbx
mov rbx, rcx
add rsp, 0x20
pop rbp
ret
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx + 0x58]
mov rax, qword [rdx + 0x60]
mov rdx, qword [rsi + 0x18]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
call rdx
mov rax, rbx
mov rbx, rcx
add rsp, 0x20
pop rbp
ret
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x23
lea rcx, [0x006bcbc7]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004fba20
Function at 0x4fbb40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fbd71
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rbx
xor edx, edx
xor esi, esi
jmp 0x4fbb80
cmp r8d, 0x7f
setg r8b
or esi, r8d
nop dword [rax + rax]
cmp rcx, rdx
jle 0x4fbc0b
movzx r8d, byte [rbx + rdx]
cmp r8d, 0x80
jge 0x4fbb9c
inc rdx
jmp 0x4fbbcf
mov byte [rsp + 0x43], sil
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.0045d600
mov rcx, qword [rsp + 0x88]
movzx esi, byte [rsp + 0x43]
mov r8d, eax
mov rdx, rbx
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
test r8d, r8d
je 0x4fbbdd
cmp r8d, 0xff
jle 0x4fbb6d
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x25
lea rcx, [0x006bd8aa]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00728640]
add rsp, 0x68
pop rbp
ret
test sil, sil
je 0x4fbc37
lea rax, [0x0065bae0]
xor ebx, ebx
call fcn.0044b7a0
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rbx, rcx
xor esi, esi
xor edi, edi
jmp 0x4fbca3
mov rdx, qword [rax + 0x58]
mov rsi, qword [rax + 0x60]
mov rdi, rcx
mov rcx, rbx
mov rbx, rsi
mov rax, rdx
call fcn.00482940
test rbx, rbx
je 0x4fbc61
mov rax, rbx
mov rbx, rcx
add rsp, 0x68
pop rbp
ret
mov rbx, qword [rsp + 0x78]
mov byte [rbx + 0x89], 0
mov rdx, qword [rbx + 0x58]
mov rax, qword [rbx + 0x60]
mov rdx, qword [rdx + 0x18]
add rbx, 0x89
mov ecx, 1
mov edi, 0xa
call rdx
mov rax, rbx
mov rbx, rcx
add rsp, 0x68
pop rbp
ret
mov byte [r10 + rax - 1], r8b
mov rsi, r9
mov rdi, r10
cmp rbx, rsi
jle 0x4fbd4a
movzx r8d, byte [rdx + rsi]
cmp r8d, 0x80
jge 0x4fbcc2
lea r9, [rsi + 1]
nop
jmp 0x4fbd01
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov rax, rdx
mov rcx, rsi
call fcn.0045d600
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x48]
mov r8d, eax
mov r9, rbx
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x88]
lea r10, [rdi + 1]
cmp rcx, r10
jae 0x4fbc98
mov dword [rsp + 0x44], r8d
mov qword [rsp + 0x58], r9
mov rbx, r10
mov edi, 1
lea rsi, [0x0065bae0]
call fcn.0044b880
mov rdx, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x44]
mov r9, qword [rsp + 0x58]
mov r10, rbx
mov rbx, qword [rsp + 0x88]
jmp 0x4fbc98
mov rdx, qword [rsp + 0x78]
mov rsi, qword [rdx + 0x58]
mov r8, qword [rdx + 0x60]
mov rsi, qword [rsi + 0x18]
mov rbx, rax
mov rax, r8
mov r8, rcx
mov rcx, rdi
mov rdi, r8
call rsi
jmp 0x4fbc50
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004fbb40
Function at 0x50a4a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x50a631
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rax + 0x10]
mov rax, rcx
call fcn.004fc460
nop word [rax + rax]
nop
cmp rax, 1
je 0x50a5f8
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
mov rcx, qword [rsp + 0xc0]
mov rbx, qword [rcx + 0x10]
lea rax, [rsp + 0x80]
call fcn.004fde80
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
test byte [rax], al
mov rcx, qword [rsp + 0xc0]
mov rbx, qword [rcx]
test byte [rbx], al
mov rcx, rax
lea rax, [rsp + 0x60]
call fcn.004fc800
mov rcx, qword [rsp + 0xc8]
test byte [rcx], al
movups xmmword [rsp + 0x44], xmm15
movups xmmword [rsp + 0x50], xmm15
lea rax, [rsp + 0x60]
lea rbx, [rsp + 0x44]
nop dword [rax]
call fcn.004fc4e0
cmp rbx, 0x1c
ja 0x50a57d
mov rcx, rbx
mov rdx, qword [rsp + 0xc8]
mov esi, 0x1c
jmp 0x50a5b9
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0xc8]
mov ecx, 0x1c
mov rdi, rbx
lea rsi, [0x0065bae0]
call fcn.0044b880
mov rdx, rax
mov rsi, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rsi
mov rdi, rax
mov rax, rdx
mov rbx, rdi
call fcn.00467360
mov rax, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor esi, esi
add rsp, 0xb0
pop rbp
ret
lea rax, [0x00673e00]
nop
call fcn.0040d680
mov qword [rax + 8], 0x23
lea rcx, [0x006bce83]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00728640]
mov rsi, rax
xor eax, eax
add rsp, 0xb0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0050a4a0