joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416560
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416610
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp word [rbx + 0x68], 0
je 0x4165fe
mov ecx, dword [0x008f3440]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x60]
cmp esi, edx
jne 0x416597
lea edi, [rcx - 1]
xchg dword [rbx + 0x60], edi
cmp esi, edx
jmp 0x4165a0
mov edx, ecx
xchg dword [rbx + 0x60], ecx
mov ecx, edx
nop
je 0x4165e7
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x68]
sub rdx, rsi
test rdx, rdx
jle 0x4165cc
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.0042ff20
jmp 0x4165f8
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
nop
call fcn.0042ff20
jmp 0x4165f8
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
call fcn.00424e00
add rsp, 0x18
pop rbp
ret
lea rax, [0x006bd0df]
mov ebx, 0x24
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416560

Function at 0x416700
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4167f6
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rdx, qword [0x008f36e8]
mov qword [rsp + 0x30], rdx
mov rsi, qword [0x008f36f0]
mov qword [rsp + 0x28], rsi
xor eax, eax
jmp 0x416732
lea rax, [rbx + 1]
cmp rax, rsi
jge 0x4167ca
mov r8, qword [rdx + rax*8]
mov r9, r8
shr r8, 0x14
cmp r8, 0x40
jae 0x4167e8
lea r10, [0x008f3498]
mov r8, qword [r10 + r8*8]
test byte [r8], al
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
mov rdi, qword [r8 + 0x114c0]
test rdi, rdi
je 0x416787
mov ecx, 0x2000
mov rbx, rax
xor eax, eax
rep stosq qword [rdi], rax
jmp 0x41672e
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x18], r8
mov eax, 0x10000
xor ebx, ebx
lea rcx, [0x009267b8]
nop
call fcn.0040d940
test rax, rax
je 0x4167d7
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x114c0], rax
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp 0x41672e
mov byte [0x009210b3], 1
add rsp, 0x38
pop rbp
ret
lea rax, [0x006bf5a6]
mov ebx, 0x2a
call fcn.00437240
mov rax, r8
mov ecx, 0x40
call fcn.00466980
nop
call fcn.004646a0
nop dword [rax + rax]
jmp fcn.00416700
Function at 0x4168a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416a46
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
nop word [rax + rax]
test dl, sil
je 0x416952
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
nop
cmp rdx, 0x40
jae 0x416945
lea rsi, [0x008f3498]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx esi, ax
shr rcx, 0x16
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x114c0]
test byte [rdx], al
add rdx, rsi
mov bl, byte [rdx]
test dil, bl
je 0x416939
mov eax, 1
add rsp, 0x30
pop rbp
ret
lock or byte [rdx], dil
xor eax, eax
add rsp, 0x30
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00466980
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.00438be0
call fcn.00438be0
lea rax, [0x006c325e]
mov ebx, 0x39
call fcn.00439460
mov rax, qword [rsp + 0x40]
call fcn.004392e0
call fcn.00438e20
call fcn.00438c40
call fcn.00438be0
lea rax, [0x006b7882]
mov ebx, 0x18
call fcn.00439460
mov rax, qword [rsp + 0x28]
call fcn.004392e0
lea rax, [0x006b059f]
mov ebx, 1
nop dword [rax]
call fcn.00439460
mov rax, qword [rsp + 0x20]
call fcn.004392e0
lea rax, [0x006b0607]
mov ebx, 2
nop dword [rax + rax]
call fcn.00439460
call fcn.00438c40
lea rax, [0x006b08c8]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.0041ff40
lea rax, [0x006b06a2]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.0041ff40
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x006baddb]
mov ebx, 0x1f
nop dword [rax]
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004168a0
Function at 0x416ba0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416d2b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434480
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416c05
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416c14
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416c33
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416c43
cmp rbx, 0x1000
jae 0x416c0b
jmp 0x416cad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416c55
xor edx, edx
jmp 0x416ca4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434480
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416c39
jmp 0x416c28
call fcn.00467e00
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438be0
lea rax, [0x006b789a]
mov ebx, 0x18
nop dword [rax]
call fcn.00439460
mov rax, qword [rsp + 0x38]
call fcn.004391a0
lea rax, [0x006b7ed1]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439460
mov rax, qword [rsp + 0x30]
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006bbc3d]
mov ebx, 0x21
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416ba0
Function at 0x416d60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416f86
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434500
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416dd3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416de2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416e05
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416e15
cmp rbx, 0x1000
jae 0x416dd9
nop
jmp 0x416e98
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416e2d
xor esi, esi
jmp 0x416e8a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434500
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x416e0b
jmp 0x416df6
call fcn.00467e00
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416f20
nop dword [rax + rax]
call fcn.00438be0
lea rax, [0x006b7eea]
mov ebx, 0x19
call fcn.00439460
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004391a0
lea rax, [0x006b7ed1]
mov ebx, 0x19
call fcn.00439460
mov eax, dword [rsp + 0x34]
call fcn.004391a0
nop
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006b2ddf]
mov ebx, 0xd
call fcn.00437240
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416ec0
call fcn.00438be0
lea rax, [0x006b7eea]
mov ebx, 0x19
call fcn.00439460
mov rax, qword [rsp + 0x38]
call fcn.004391a0
lea rax, [0x006b7ed1]
mov ebx, 0x19
call fcn.00439460
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006badfa]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416d60
Function at 0x4198e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4199dc
push rbp
mov rbp, rsp
sub rsp, 0x28
mov rsi, qword [rax]
test rsi, rsi
je 0x4199ae
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x419939
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x419930
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.00467060
mov rdi, qword [rsp + 0x18]
mov rax, rdi
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x419969
mov edx, dword [rax + 0x2c]
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov rax, rdx
call fcn.0040d940
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov esi, dword [rdx + 0x2c]
mov dword [rdx + 0x28], esi
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x419991
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
add rsp, 0x28
pop rbp
ret
call fcn.00438be0
lea rax, [0x006c2434]
mov ebx, 0x34
nop
call fcn.00439460
call fcn.00438c40
lea rax, [0x006b7051]
mov ebx, 0x17
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.004198e0
Function at 0x41bfc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x41c188
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp dword [0x009210dc], 0
jne 0x41c176
mov qword [rsp + 0x28], rax
nop
nop
lea rax, [0x008e3300]
call fcn.0040b580
add dword [0x008f3440], 2
nop
nop
xor ecx, ecx
lea rdx, [0x008ccafc]
xchg dword [rdx], ecx
nop
xor ecx, ecx
lea rdx, [0x008f3468]
xchg qword [rdx], rcx
mov rcx, qword [0x008f36f0]
mov rdx, qword [0x008f36f8]
mov rbx, qword [0x008f36e8]
mov qword [0x008f3708], rcx
mov qword [0x008f3710], rdx
cmp dword [0x00921500], 0
je 0x41c053
nop
call fcn.004665c0
mov qword [r11], rbx
mov rcx, qword [0x008f3700]
mov qword [r11 + 8], rcx
mov qword [0x008f3700], rbx
nop
xor ecx, ecx
lea rdx, [0x008f3488]
xchg qword [rdx], rcx
nop
xor ecx, ecx
lea rdx, [0x008f3490]
xchg qword [rdx], rcx
nop
nop
lea rax, [0x008e3300]
nop dword [rax]
call fcn.0040b7a0
nop
xor ecx, ecx
lea rdx, [0x008ccb00]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x28]
cmp rcx, 2
jne 0x41c0c7
nop
nop
lea rax, [0x008e3300]
call fcn.0040b580
xorps xmm0, xmm0
movsd qword [0x008f3480], xmm0
nop
nop
lea rax, [0x008e3300]
nop
call fcn.0040b7a0
jmp 0x41c112
nop
nop
lea rax, [0x008ccae0]
call fcn.0040b580
cmp byte [0x008ccaf0], 0
je 0x41c0f8
mov byte [0x008ccaf0], 0
mov rax, qword [0x008ccae8]
xor ebx, ebx
mov ecx, 1
call fcn.0043aee0
nop
nop
lea rax, [0x008ccae0]
call fcn.0040b7a0
add rsp, 0x18
pop rbp
ret
inc dword [0x008ccaf8]
call fcn.00424a40
cmp rax, 0xffffffffffffffff
jne 0x41c10c
nop dword [rax]
call fcn.00426d80
xor eax, eax
call fcn.00426e80
test al, al
jne 0x41c125
nop
nop
nop
mov eax, dword [0x009210e8]
mov ecx, eax
shr ecx, 1
lea edx, [rcx + 1]
mov ebx, 0xaaaaaaab
imul rdx, rbx
shr rdx, 0x3a
lea edx, [rdx + rdx*2]
shl edx, 0x19
sub ecx, edx
inc ecx
shl ecx, 1
lea rdx, [0x009210e8]
lock cmpxchg dword [rdx], ecx
sete cl
test cl, cl
je 0x41c132
call fcn.0042e460
add rsp, 0x18
pop rbp
ret
lea rax, [0x006bf0fd]
mov ebx, 0x29
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.0046b280
mov rax, qword [rsp + 8]
jmp fcn.0041bfc0
Function at 0x41c440
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
cmp rdi, 0x989680
jb 0x41c479
mov rdx, rax
movabs rax, 0x8637bd05af6c69b6
mov rsi, rdx
mul rdi
shr rdx, 0x13
lea rdi, [rbx - 1]
mov rax, rdi
jmp 0x41c5a5
shr rdi, 1
mov rdx, rax
movabs rax, 0x83126e978d4fdf3c
mov rsi, rdx
mul rdi
shr rdx, 8
test rdx, rdx
je 0x41c4a0
mov eax, 3
jmp 0x41c4ea
test rbx, rbx
jbe 0x41c4c8
mov byte [rsi], 0x30
cmp rcx, 1
jb 0x41c4bc
mov rax, rsi
mov ebx, 1
add rsp, 0x10
pop rbp
ret
mov ecx, 1
xor edx, edx
call fcn.004669e0
xor eax, eax
mov rcx, rax
call fcn.00466960
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mul rdx
shr rdx, 3
lea rax, [rdi - 1]
cmp rdx, 0x64
jae 0x41c4d2
mov rdi, rbx
sub rdi, rax
lea r8, [rbx - 1]
dec rdi
jmp 0x41c502
mov r8, rax
cmp rdx, 0xa
jae 0x41c50d
cmp r8, rdi
jl 0x41c556
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, r8
jbe 0x41c594
add r9, 0x30
mov byte [rsi + r8], r9b
lea rax, [r8 - 1]
nop dword [rax]
cmp rax, rdi
jne 0x41c4ff
cmp rbx, rax
jbe 0x41c58c
mov byte [r8 + rsi - 1], 0x2e
lea rax, [r8 - 2]
jmp 0x41c4ff
cmp rbx, r8
jbe 0x41c581
add rdx, 0x30
mov byte [rsi + r8], dl
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rdx, r8
lea rax, [rdx + rsi]
sub rbx, r8
add rsp, 0x10
pop rbp
nop
ret
mov rax, r8
mov rcx, rbx
call fcn.00466960
mov rcx, rbx
call fcn.00466960
mov rax, r8
mov rcx, rbx
call fcn.00466960
mov rdi, rax
mov rax, r8
cmp rdx, 0xa
jae 0x41c5b0
cmp rdi, rax
jl 0x41c5f7
mov r8, rax
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, rdi
jbe 0x41c634
add r9, 0x30
mov byte [rsi + rdi], r9b
lea rax, [rdi - 1]
cmp rax, r8
jne 0x41c59f
cmp rbx, rax
jbe 0x41c62c
mov byte [rdi + rsi - 1], 0x2e
lea rax, [rdi - 2]
jmp 0x41c59f
cmp rbx, rdi
jbe 0x41c621
add rdx, 0x30
mov byte [rsi + rdi], dl
sub rcx, rdi
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rdx, rdi
lea rax, [rsi + rdx]
sub rbx, rdi
add rsp, 0x10
pop rbp
nop
ret
mov rax, rdi
mov rcx, rbx
call fcn.00466960
mov rcx, rbx
call fcn.00466960
mov rax, rdi
mov rcx, rbx
call fcn.00466960
nop

Function at 0x41c640
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c6b8
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41c6a6
cmp byte [rdx + 0x20], bl
je 0x41c695
mov qword [rsp + 0x10], rdx
mov byte [rsp + 0x30], bl
mov rax, rdx
mov rbx, rcx
call fcn.0041c820
movzx ecx, byte [rsp + 0x30]
mov rdx, qword [rsp + 0x10]
mov byte [rdx + 0x20], cl
mov byte [rdx + 0x21], 1
add rsp, 0x18
pop rbp
ret
lea rax, [0x006c03f2]
mov ebx, 0x2d
call fcn.00437240
lea rax, [0x006c0f01]
mov ebx, 0x2f
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041c640
Function at 0x41c6e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c74c
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp byte [rax + 0x21], 0
je 0x41c73a
mov rdx, qword [rax + 0x40]
cmp rdx, rbx
jg 0x41c726
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov rcx, rbx
sub rcx, rdx
movsxd rdx, dword [rax + 0x4c]
imul rcx, rdx
xor ebx, ebx
call fcn.0041ca20
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
nop
xchg qword [rax + 0x40], rbx
mov byte [rax + 0x21], 0
call fcn.0041cac0
add rsp, 0x18
pop rbp
ret
lea rax, [0x006c0f30]
mov ebx, 0x2f
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041c6e0

Function at 0x41cb20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41cbc6
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41cbb2
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x10], rdx
mov rax, rdx
call fcn.0041c820
mov ecx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x10]
mov dword [rax + 0x4c], ecx
movsxd rcx, ecx
imul rcx, rcx, 0x3b9aca00
mov qword [rax + 0x10], rcx
mov rdx, qword [rax + 8]
cmp rdx, rcx
jbe 0x41cb9b
mov qword [rax + 8], rcx
lea rcx, [rax + 4]
nop
nop
mov edx, 1
xchg byte [rcx], dl
mov ecx, dword [0x009277d8]
inc ecx
xchg dword [rax + 0x48], ecx
jmp 0x41cba7
jae 0x41cba7
lea rcx, [rax + 4]
nop
nop
xor edx, edx
xchg byte [rcx], dl
call fcn.0041cac0
add rsp, 0x18
pop rbp
ret
lea rax, [0x006beb2d]
mov ebx, 0x28
nop
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.0041cb20
Function at 0x41cca0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41cdeb
push rbp
mov rbp, rsp
sub rsp, 0x18
jmp 0x41ccb7
mov rax, rdx
mov rdx, qword [rax]
mov rsi, rdx
shr rdx, 0x3d
cmp bl, dl
jne 0x41cd87
mov rdx, rax
mov rax, rsi
xor edi, edi
lock cmpxchg qword [rdx], rdi
sete r8b
test r8b, r8b
je 0x41ccb4
movabs rdx, 0xe000000000000000
and rdx, rcx
movabs rdi, 0x1fffffffffffffff
and rdi, rsi
or rdx, rdi
mov rsi, rcx
sub rcx, rdx
cmp rsi, rdx
mov edx, 0
cmovl rcx, rdx
test rcx, rcx
je 0x41cd70
cmp bl, 2
ja 0x41cd33
cmp bl, 1
jne 0x41cd2c
nop
lea rax, [0x009218b8]
lock xadd qword [rax], rcx
jmp 0x41cd6a
cmp bl, 2
je 0x41cd38
jmp 0x41cd76
cmp bl, 3
jne 0x41cd47
nop
lea rax, [0x009218a8]
lock xadd qword [rax], rcx
jmp 0x41cd6a
cmp bl, 4
jne 0x41cd76
nop
nop
lea rax, [0x009218b8]
mov rdx, rcx
lock xadd qword [rax], rcx
nop
lea rax, [0x008ce0d0]
lock xadd qword [rax], rdx
add rsp, 0x18
pop rbp
ret
add rsp, 0x18
pop rbp
ret
lea rax, [0x006c20ce]
mov ebx, 0x33
call fcn.00437240
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x10], rdx
call fcn.00438be0
lea rax, [0x006b3388]
mov ebx, 0xe
call fcn.00439460
movzx eax, byte [rsp + 0x30]
movzx eax, al
call fcn.004391a0
lea rax, [0x006b0ada]
mov ebx, 5
nop
call fcn.00439460
mov rax, qword [rsp + 0x10]
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006c3ab5]
mov ebx, 0x3e
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041cca0
Function at 0x41d960
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41dc08
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, qword [0x008f3720]
nop dword [rax]
cmp rbx, rcx
jae 0x41dbff
mov rdx, qword [0x008f3718]
mov rdx, qword [rdx + rbx*8]
mov rbx, rdx
shr rdx, 0x14
nop dword [rax + rax]
cmp rdx, 0x40
jae 0x41dbf2
mov qword [rsp + 0x68], rax
lea rsi, [0x008f3498]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
mov qword [rsp + 0x50], rdx
test byte [rdx], al
mov ebx, dword [0x008f3440]
mov dword [rsp + 0x30], ebx
xor ecx, ecx
jmp 0x41d9e0
inc rcx
nop
cmp rcx, 0x40
jge 0x41da07
lea rsi, [rdx + rcx]
lea rsi, [rsi + 0x11480]
mov sil, byte [rsi]
test sil, sil
je 0x41d9db
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x2f], sil
xor edi, edi
jmp 0x41da14
add rsp, 0x70
pop rbp
ret
lea rdi, [rcx + 1]
mov rcx, r8
cmp rdi, 8
jae 0x41d9db
mov r8, rcx
mov rcx, rdi
mov r9d, 1
shl r9d, cl
test sil, r9b
je 0x41da0d
lea r9, [rcx + r8*8]
cmp r9, 0x200
jae 0x41dbe5
mov r9, qword [rdx + r9*8 + 0x10400]
nop
mov r10b, byte [r9 + 0x6b]
cmp r10b, 1
jne 0x41db9b
mov qword [rsp + 0x58], rcx
cmp byte [0x009210b3], 0
jne 0x41da7a
mov r10d, dword [r9 + 0x60]
cmp r10d, ebx
je 0x41da7a
lea r11d, [rbx + 3]
cmp r10d, r11d
jne 0x41db47
mov qword [rsp + 0x40], r9
lea rax, [r9 + 0x80]
mov qword [rsp + 0x60], rax
nop
call fcn.0040b580
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x88]
jmp 0x41dad2
nop
mov rax, qword [rsp + 0x60]
call fcn.0040b7a0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov ebx, dword [rsp + 0x30]
movzx esi, byte [rsp + 0x2f]
mov rdi, rcx
mov r8, qword [rsp + 0x48]
jmp 0x41da0d
mov rdx, qword [rdx]
test rdx, rdx
je 0x41da9f
cmp byte [rdx + 0xa], 1
jne 0x41dacf
mov r8, qword [rcx + 0x70]
test r8, r8
je 0x41db42
mov qword [rsp + 0x38], rdx
movzx eax, word [rdx + 8]
mov rbx, rdx
xor edx, edx
div r8
imul rax, r8
movzx edx, byte [rcx + 0x6a]
mov r8, qword [rcx + 0x18]
add rax, r8
test dl, 1
jne 0x41db1a
mov rbx, qword [rsp + 0x68]
call fcn.0041f6c0
mov rbx, qword [rsp + 0x38]
lea rax, [rbx + 0x10]
lea rcx, [0x0088c3e1]
mov rdi, qword [rsp + 0x68]
xor esi, esi
mov ebx, 8
call fcn.0041f540
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
jmp 0x41dacf
call fcn.004357c0
mov dword [rsp + 0x34], r10d
call fcn.00438be0
lea rax, [0x006b0d53]
mov ebx, 6
nop dword [rax]
call fcn.00439460
mov eax, dword [rsp + 0x34]
call fcn.004391a0
call fcn.00438de0
mov eax, dword [rsp + 0x30]
call fcn.004391a0
nop dword [rax]
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006b3dce]
mov ebx, 0x10
call fcn.00437240
mov byte [rsp + 0x2e], r10b
call fcn.00438be0
lea rax, [0x006b1d9c]
mov ebx, 0xa
call fcn.00439460
movzx eax, byte [rsp + 0x2e]
movzx eax, al
nop
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006bfa98]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00437240
mov rax, r9
mov ecx, 0x200
call fcn.00466980
mov rax, rdx
mov ecx, 0x40
call fcn.00466980
mov rax, rbx
call fcn.00466960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041d960
Function at 0x420380
Capabilities:
Hash data using murmur3
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x009210b3], 0
jne 0x420467
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x42045a
lea rbx, [0x008f3498]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x420440
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00466980
lea rax, [0x006c002a]
mov ebx, 0x2c
call fcn.00437240
nop
int3