joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4296d0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x90]
cmp rcx, rax
jne 0x429814
lea rax, [rsp + 0x48]
mov rcx, rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp], rax
call fcn.00453bd0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
mov ecx, dword [rsp + 0x48]
mov dword [rsp], ecx
call fcn.00429b30
mov rax, qword [rsp + 8]
mov qword [rsp + 0x30], rax
mov rcx, qword [rax + 0x20]
test rcx, rcx
jne 0x4297f9
mov rcx, qword [rsp + 0x50]
mov edx, dword [0x008b4340]
lea rbx, [rax + 0x18]
test edx, edx
jne 0x4297e1
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x48]
test ecx, ecx
jne 0x42978f
call fcn.00454c90
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rsp + 0x20]
add rdx, 8
cmp ecx, 8
jne 0x4297b6
mov ecx, dword [rax]
test ecx, ecx
jne 0x4297b0
xor eax, eax
mov rcx, rdx
mov rcx, qword [rcx]
mov qword [rax], rcx
jmp 0x429780
add rax, 0x30
jmp 0x4297a5
mov ecx, dword [rax]
test ecx, ecx
jne 0x4297db
xor eax, eax
mov qword [rsp], rax
mov rax, rdx
mov qword [rsp + 8], rax
movsxd rax, dword [rsp + 0x48]
mov qword [rsp + 0x10], rax
call fcn.00455480
jmp 0x429780
add rax, 0x30
jmp 0x4297be
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
call fcn.00410240
mov rax, qword [rsp + 0x30]
jmp 0x429766
lea rax, [0x006dad23]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042aea0
ud2
lea rax, [0x006d4916]
mov qword [rsp], rax
mov qword [rsp + 8], 0x15
call fcn.0042aea0
ud2
Function at 0x42d940
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42dadd
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [0x00897fec], 0x2710
call fcn.00448a40
call fcn.00443c90
call fcn.0043ed50
call fcn.0040ded0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov qword [rsp], rcx
call fcn.0042dd90
call fcn.00402220
call fcn.00443940
call fcn.0044d4e0
call fcn.0040c9f0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
test byte [rax], al
call fcn.00438420
call fcn.00427cf0
call fcn.00438bf0
call fcn.004158b0
call fcn.004289c0
mov rax, qword [rsp]
mov qword [0x00897fc8], rax
mov eax, dword [0x008b4080]
mov dword [rsp + 0x24], eax
lea rcx, [0x006d0c15]
mov qword [rsp], rcx
mov qword [rsp + 8], 0xa
call fcn.004067a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004434c0
mov eax, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
test cl, cl
je 0x42dad4
test eax, eax
jle 0x42dad4
cmp eax, 0x100
jle 0x42da50
mov eax, 0x100
mov dword [rsp], eax
call fcn.00435120
mov rax, qword [rsp + 8]
test rax, rax
jne 0x42dab9
mov rax, qword [0x0088f018]
test rax, rax
jne 0x42da91
mov qword [0x0088f018], 7
mov eax, dword [0x008b4340]
test eax, eax
jne 0x42da9b
lea rax, [0x006d019f]
mov qword [0x0088f010], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0088f010]
mov qword [rsp], rax
lea rax, [0x006d019f]
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x42da91
lea rax, [0x006dbbbc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0042aea0
ud2
mov eax, dword [rsp + 0x24]
jmp 0x42da44
call fcn.00452210
jmp fcn.0042d940
Function at 0x42e460
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42e662
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov eax, dword [rsp + 0x28]
lea ecx, [rax - 0x1001]
cmp ecx, 3
ja 0x42e59f
mov ecx, eax
and eax, 0xffffefff
mov edx, dword [rsp + 0x2c]
cmp edx, eax
jne 0x42e593
mov eax, ecx
mov rbx, qword [rsp + 0x20]
lock cmpxchg dword [rbx + 0xb8], edx
sete sil
test sil, sil
je 0x42e4d0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.0042b850
lea rax, [0x006daa5d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042c220
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042c1d0
lea rax, [0x006d0717]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c220
mov eax, dword [rsp + 0x28]
mov eax, eax
mov qword [rsp], rax
call fcn.0042c0a0
lea rax, [0x006d070e]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c220
mov eax, dword [rsp + 0x2c]
mov eax, eax
mov qword [rsp], rax
call fcn.0042c0a0
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042daf0
lea rax, [0x006dd476]
mov qword [rsp], rax
mov qword [rsp + 8], 0x34
call fcn.0042aea0
ud2
mov rbx, qword [rsp + 0x20]
xor esi, esi
jmp 0x42e4c1
call fcn.0042b850
lea rax, [0x006dbaba]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0042c220
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042c1d0
lea rax, [0x006d0717]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c220
mov eax, dword [rsp + 0x28]
mov eax, eax
mov qword [rsp], rax
call fcn.0042c0a0
lea rax, [0x006d070e]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c220
mov eax, dword [rsp + 0x2c]
mov eax, eax
mov qword [rsp], rax
call fcn.0042c0a0
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042daf0
lea rax, [0x006ddd63]
mov qword [rsp], rax
mov qword [rsp + 8], 0x37
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.0042e460
Function at 0x42e670
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42e770
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov eax, dword [rsp + 0x28]
lea ecx, [rax - 1]
cmp ecx, 3
ja 0x42e765
mov ecx, eax
or eax, 0x1000
mov edx, dword [rsp + 0x2c]
cmp edx, eax
jne 0x42e6d7
mov eax, ecx
mov rbx, qword [rsp + 0x20]
lock cmpxchg dword [rbx + 0xb8], edx
sete cl
mov byte [rsp + 0x30], cl
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.0042b850
lea rax, [0x006d9267]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042c220
mov eax, dword [rsp + 0x28]
mov eax, eax
mov qword [rsp], rax
call fcn.0042c0a0
lea rax, [0x006d0202]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0042c220
mov eax, dword [rsp + 0x2c]
mov eax, eax
mov qword [rsp], rax
call fcn.0042c0a0
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006d2b79]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042aea0
ud2
mov ecx, eax
mov edx, dword [rsp + 0x2c]
jmp 0x42e6d7
call fcn.00452210
jmp fcn.0042e670

Function at 0x430b50
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x430cd9
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x10], rax
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0x128]
test rdx, rdx
je 0x430ba9
mov rdx, qword [rdx + 0x108]
cmp rdx, rcx
je 0x430bc4
lea rax, [0x006d936f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aea0
ud2
mov rcx, qword [rcx + 0xa0]
test rcx, rcx
jne 0x430cbd
mov dword [rsp], 1
call fcn.00435e60
mov rax, qword [rsp + 0x10]
mov rcx, qword [rax + 0x30]
test byte [rcx], al
add rcx, 0x108
mov qword [rsp], rcx
call fcn.0040da40
mov rax, qword [rsp + 0x10]
mov rcx, qword [rax + 0x30]
lea rdx, [rcx + 0x108]
test byte [rdx], al
mov qword [rcx + 0x108], 0
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x128]
mov qword [rsp], rcx
call fcn.0042e450
mov eax, dword [rsp + 8]
and eax, 0xffffefff
cmp eax, 1
jne 0x430c71
mov rax, qword [rsp + 0x10]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0xa8]
mov qword [rsp], rcx
call fcn.004359e0
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x30]
mov qword [rax + 0xa8], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.0042b850
lea rax, [0x006de264]
mov qword [rsp], rax
mov qword [rsp + 8], 0x39
call fcn.0042c220
call fcn.0042b8f0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042daf0
lea rax, [0x006d6531]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042aea0
ud2
call fcn.00435c10
mov rax, qword [rsp]
mov qword [rsp], rax
call fcn.00430850
mov rax, qword [rsp + 0x10]
jmp 0x430bd4
call fcn.00452210
jmp fcn.00430b50
Function at 0x431b60
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x431c17
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
movzx ecx, byte [rax + 0xe4]
test cl, cl
je 0x431bfc
mov byte [rax + 0xe4], 0
mov eax, 0xffffffff
lea rcx, [0x00898004]
lock xadd dword [rcx], eax
dec eax
test eax, eax
jl 0x431be1
jne 0x431bd0
mov eax, dword [0x00898000]
test eax, eax
ja 0x431bda
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.00430ae0
jmp 0x431bd0
lea rax, [0x006d8fd3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aea0
ud2
lea rax, [0x006d87b4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00431b60
Function at 0x432ef0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x18], rax
mov rcx, qword [rax + 0x30]
mov edx, dword [rcx + 0xd0]
inc edx
mov dword [rcx + 0xd0], edx
mov byte [rax + 0xed], 1
mov qword [rax + 0x10], 0xfffffffffffffade
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0xa0]
mov edx, dword [rdx + 0x1c]
mov dword [rcx + 0x314], edx
mov byte [rax + 0xef], 1
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0xa0]
mov edx, dword [rcx + 0x1c]
inc edx
mov dword [rcx + 0x1c], edx
lea rcx, [rsp + 0x70]
mov qword [rsp], rcx
call fcn.00453bd0
mov rax, qword [rsp + 8]
lea rcx, [rsp + 0x70]
mov rdx, rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rdx
call fcn.00432a80
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x40]
mov qword [rax + 0x78], rcx
mov rcx, qword [rax + 0x48]
mov qword [rax + 0x80], rcx
mov rcx, qword [rax + 0x78]
mov rdx, qword [rax]
cmp rcx, rdx
jae 0x4330e5
mov rdx, qword [rax + 0x40]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea rbx, [0x00451250]
mov qword [rsp + 0x38], rbx
mov rbx, qword [rsp + 0x10]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x38]
mov qword [rsp], rcx
call fcn.004520b0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
movabs rcx, 0x300000002
mov qword [rsp + 8], rcx
call fcn.0042e780
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x78]
mov rdx, qword [rax]
cmp rcx, rdx
jae 0x4330d7
mov qword [rsp + 0x20], 0
lea rcx, [0x004513c0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.004520b0
lea rax, [0x006e05f0]
mov qword [rsp], rax
call fcn.004520b0
lea rax, [rsp + 0x70]
mov qword [rsp], rax
call fcn.00453bd0
mov rax, qword [rsp + 8]
lea rcx, [rsp + 0x70]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00432a80
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax + 0xd0]
dec ecx
mov dword [rax + 0xd0], ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rdx, qword [rax + 8]
cmp rdx, rcx
jae 0x433080
jmp 0x43304e
mov rdx, qword [rax + 8]
cmp rdx, rcx
jae 0x43301c
jmp 0x432fb8
Function at 0x437890
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x437923
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.00437960
movzx eax, byte [rsp + 8]
test al, al
je 0x437908
mov rax, qword [0x00897ff8]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
lea rax, [0x00897ff8]
test byte [rax], al
mov rax, rcx
mov qword [0x00897ff8], rax
mov eax, 1
lea rcx, [0x00898000]
lock xadd dword [rcx], eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006d9bbc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00437890

Function at 0x437ab0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x3a8]
cmp rax, qword [rcx + 0x10]
jbe 0x437cb2
sub rsp, 0x428
mov qword [rsp + 0x420], rbp
lea rbp, [rsp + 0x420]
lea rdi, [rsp + 0x18]
mov rcx, 0x81
xor eax, eax
rep stosq qword [rdi], rax
mov edx, dword [rsp + 0x444]
mov eax, dword [rsp + 0x440]
sub edx, eax
shr edx, 1
mov dword [rsp + 0x14], edx
cmp edx, 0x80
jne 0x437c97
mov rcx, qword [rsp + 0x430]
xor ebx, ebx
cmp ebx, edx
jae 0x437b55
test byte [rcx], al
lea esi, [rax + rbx]
movzx esi, sil
mov rsi, qword [rcx + rsi*8 + 0x5c8]
mov edi, ebx
cmp rdi, 0x81
jae 0x437c90
mov qword [rsp + rdi*8 + 0x18], rsi
inc ebx
cmp ebx, edx
jb 0x437b2a
lea ebx, [rax + rdx]
lock cmpxchg dword [rcx + 0x5c0], ebx
sete cl
test cl, cl
je 0x437c78
cmp rdx, 0x81
jae 0x437c71
mov rax, qword [rsp + 0x438]
mov qword [rsp + rdx*8 + 0x18], rax
xor eax, eax
cmp eax, edx
jae 0x437bcb
mov ecx, eax
cmp rcx, 0x81
jae 0x437c6a
mov rcx, qword [rsp + rcx*8 + 0x18]
test byte [rcx], al
inc eax
mov ebx, eax
cmp rbx, 0x81
jae 0x437c6a
lea rsi, [rcx + 0xe0]
test byte [rsi], al
mov rbx, qword [rsp + rbx*8 + 0x18]
mov qword [rcx + 0xe0], rbx
cmp eax, edx
jb 0x437b8b
lea rax, [0x00897fd0]
mov qword [rsp], rax
call fcn.0040d6a0
mov eax, dword [rsp + 0x14]
mov rcx, qword [rsp + rax*8 + 0x18]
mov rdx, qword [rsp + 0x18]
mov qword [rcx + 0xe0], 0
mov rbx, qword [0x00898010]
test rbx, rbx
je 0x437c58
lea rsi, [rbx + 0xe0]
test byte [rsi], al
mov qword [rbx + 0xe0], rdx
lea rdx, [0x00898010]
test byte [rdx], al
mov qword [0x00898010], rcx
mov ecx, dword [0x00898018]
inc eax
add eax, ecx
mov dword [0x00898018], eax
lea rax, [0x00897fd0]
mov qword [rsp], rax
call fcn.0040d8b0
mov byte [rsp + 0x448], 1
mov rbp, qword [rsp + 0x420]
add rsp, 0x428
ret
lea rbx, [0x00898008]
test byte [rbx], al
mov qword [0x00898008], rdx
jmp 0x437c10
call fcn.004293e0
ud2
call fcn.004293e0
ud2
mov byte [rsp + 0x448], 0
mov rbp, qword [rsp + 0x420]
add rsp, 0x428
ret
call fcn.004293e0
ud2
lea rax, [0x006d82a7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00437ab0
Function at 0x43da00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x43dac8
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
cmp rax, 0x20
jne 0x43da3d
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.0042b850
lea rax, [0x006d9f14]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042c220
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006d06c6]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c220
mov qword [rsp], 0x20
call fcn.0042c020
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006d3bc5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.0043da00

Function at 0x43e3e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x43e497
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x28], rax
cmp rax, 0x36
jge 0x43e458
lea rcx, [0x006ddb0f]
movzx edx, byte [rcx + rax]
cmp dl, 0x80
jae 0x43e469
movzx edx, dl
lea rbx, [rax + 1]
cmp rax, 0x64
jae 0x43e462
lea rsi, [0x008b44a0]
mov byte [rsi + rax], dl
mov edx, dword [0x008b4048]
inc edx
mov dword [0x008b4048], edx
mov rax, rbx
mov qword [rsp + 0x28], rax
cmp rax, 0x36
jl 0x43e415
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.004293e0
ud2
mov qword [rsp], rcx
mov qword [rsp + 8], 0x36
mov qword [rsp + 0x10], rax
call fcn.0044eb20
mov edx, dword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
lea rcx, [0x006ddb0f]
jmp 0x43e42c
call fcn.00452210
jmp fcn.0043e3e0
Function at 0x43efc0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x43f120
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [0x0089e170]
mov rcx, qword [rsp + 0x28]
mov rdx, rcx
sub rcx, rax
mov rax, qword [0x0089dea8]
mov rbx, qword [0x0089deb0]
shr rcx, 0xd
cmp rcx, rbx
jae 0x43f119
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x10], rax
movzx ecx, byte [rax + 0x64]
cmp cl, 2
jne 0x43f0fe
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x43f0be
mov rcx, rdx
mov rbx, qword [rax + 0x28]
mov qword [rcx], rbx
mov qword [rax + 0x28], rdx
movzx ecx, word [rax + 0x60]
lea edx, [rcx - 1]
mov word [rax + 0x60], dx
mov edx, dword [0x008b4074]
test edx, edx
jne 0x43f0ad
cmp cx, 1
jne 0x43f0ad
movzx ecx, byte [rsp + 0x30]
movzx ecx, cl
cmp rcx, 2
jae 0x43f0b7
shl rcx, 4
lea rdx, [0x00897ac0]
add rcx, rdx
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00422340
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x28], 0
lea rcx, [0x0089ce60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00421880
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.004293e0
ud2
movzx ecx, byte [rsp + 0x30]
movzx ebx, cl
cmp rbx, 2
jae 0x43f0f7
shl rbx, 4
lea rsi, [0x00897ac0]
add rbx, rsi
mov qword [rsp], rbx
mov qword [rsp + 8], rax
call fcn.00422480
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x28]
jmp 0x43f038
call fcn.004293e0
ud2
lea rax, [0x006d8ff4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aea0
ud2
call fcn.004293e0
ud2
call fcn.00452210
jmp fcn.0043efc0
Function at 0x4421d0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x10]
cmp rax, qword [rcx + 0x10]
jbe 0x44248d
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa8]
mov rdx, rax
xor ebx, ebx
mov rsi, rbx
mov rdi, rsi
mov r8, rdi
cmp rbx, rcx
jge 0x44224a
mov r9, qword [rax + 8]
test r9, r9
jne 0x44245b
add rax, 0x10
inc rbx
cmp rbx, rcx
jl 0x442231
test rsi, rsi
je 0x442433
cmp rsi, 1
jne 0x442426
mov rax, qword [rsp + 0x98]
test rax, rax
jne 0x442421
cmp rdi, rcx
jae 0x44241a
mov rbx, rdi
shl rdi, 4
mov rsi, qword [rdx + rdi + 8]
mov rdi, qword [rdx + rdi]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
mov rsi, qword [rsp + 0x78]
mov rdi, qword gs:[0x28]
mov rdi, qword [rdi]
mov r9, qword [rdi + 8]
mov rdi, qword [rdi]
cmp rdi, rsi
ja 0x442413
cmp rsi, r9
setb sil
test sil, sil
je 0x4423da
mov qword [rsp], rax
mov qword [rsp + 8], r8
call fcn.00442780
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x60], rcx
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
xor edi, edi
mov r8, qword [rsp + 0xa0]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], rdx
mov r9, qword [rsp + 0xa8]
cmp rdi, r9
jge 0x4423ba
mov r10, qword [r8 + 8]
mov qword [rsp + 0x38], r10
mov r11, qword [r8]
cmp rbx, r10
jle 0x4423b2
mov r12, r10
mov qword [rsp], rsi
mov qword [rsp + 8], r11
mov qword [rsp + 0x10], r10
call fcn.00455480
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
cmp rax, rcx
ja 0x4423ab
mov r9, qword [rsp + 0x70]
lea r8, [r9 + 0x10]
mov r9, qword [rsp + 0x58]
lea rdi, [r9 + 1]
sub rcx, rax
mov rdx, qword [rsp + 0x50]
sub rdx, rax
lea r9, [rdx - 1]
sar r9, 0x3f
xor r9, 0xffffffffffffffff
and r9, rax
mov r10, qword [rsp + 0x68]
lea rsi, [r9 + r10]
mov rax, qword [rsp + 0x40]
mov rbx, rcx
mov rcx, qword [rsp + 0x60]
jmp 0x442304
call fcn.00429450
ud2
mov r12, r10
mov r10, rbx
jmp 0x442342
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
cmp rbx, rcx
jae 0x44240c
shl rbx, 4
mov rax, qword [rdx + rbx + 8]
mov rcx, qword [rdx + rbx]
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
call fcn.004293e0
ud2
xor esi, esi
jmp 0x4422c0
call fcn.004293e0
ud2
mov rbx, rdi
jmp 0x4423da
mov rax, qword [rsp + 0x98]
jmp 0x4422c9
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rdi, [r9 + r8]
cmp rdi, r8
jl 0x442472
inc rsi
mov r8, rdi
mov rdi, rbx
jmp 0x44223e
lea rax, [0x006d7dc6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.004421d0
Function at 0x444700
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x444875
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.004446c0
mov rax, qword [rsp + 8]
test rax, rax
je 0x444862
mov rcx, qword [rax + 0x50]
mov rdx, qword [rsp + 0x20]
mov rbx, rdx
sub rdx, rcx
mov rcx, rdx
shr rdx, 0xc
mov rsi, qword [rax + 0x48]
lea rdx, [rdx + rdx*4]
lea rdx, [rsi + rdx*4]
and rcx, 0xfff
shr rcx, 8
mov esi, dword [rdx]
cmp rcx, 0x10
jae 0x44485b
movzx ecx, byte [rdx + rcx + 4]
add ecx, esi
mov rdx, qword [rax + 0x18]
mov rsi, qword [rax + 0x20]
cmp ecx, esi
jb 0x444794
lea rcx, [rsi - 1]
mov edi, ecx
cmp rdi, rsi
jae 0x444854
shl rdi, 4
mov rdi, qword [rdx + rdi]
cmp rbx, rdi
jae 0x444828
mov edi, ecx
cmp rdi, rsi
jae 0x4447cd
shl rdi, 4
mov rdi, qword [rdx + rdi]
cmp rdi, rbx
jbe 0x4447d4
test ecx, ecx
jbe 0x4447d4
dec ecx
mov edi, ecx
cmp rdi, rsi
jb 0x4447b3
call fcn.004293e0
ud2
test ecx, ecx
je 0x44480d
mov rbx, qword [rax + 8]
mov rax, qword [rax]
mov ecx, ecx
cmp rcx, rsi
jae 0x444806
shl rcx, 4
mov rcx, qword [rdx + rcx + 8]
cmp rcx, rbx
jae 0x444806
add rax, rcx
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.004293e0
ud2
lea rax, [0x006d99af]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0042aea0
ud2
lea edi, [rcx + 1]
mov r8d, edi
cmp r8, rsi
jae 0x44484d
shl r8, 4
mov r8, qword [rdx + r8]
cmp r8, rbx
ja 0x4447d8
mov ecx, edi
lea edi, [rcx + 1]
mov r8d, edi
cmp r8, rsi
jb 0x444833
call fcn.004293e0
ud2
call fcn.004293e0
ud2
call fcn.004293e0
ud2
mov qword [rsp + 0x28], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.00452210
jmp fcn.00444700