joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008d9d0
Capabilities:
Encode data using xor

Disassembly:
lea eax, [rcx - 1]
cmp al, 1
jbe 0x18008d9d0
xor eax, eax
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r9, r8
mov rbx, rdx
test rdx, rdx
je 0x18008db34
cmp r8, 0xffffffffffffffff
jne 0x18008da0a
nop
inc r9
cmp byte [rdx + r9], 0
jne 0x18008da00
lea rax, [r9 - 1]
cmp rax, 0x10
ja 0x18008db34
movsx eax, byte [rdx]
sub eax, 0x61
cmp eax, 0x19
ja 0x18008db34
lea rcx, [rax*4]
lea r15, [0x180000000]
movzx eax, word [rcx + r15 + 0xb5200]
test ax, ax
je 0x18008db34
movzx r11d, word [rcx + r15 + 0xb5202]
lea r12, [0x1800af6d0]
shl r11, 3
lea rsi, [r12 + rax*8]
sub r11, rsi
add r11, r12
sar r11, 3
test r11, r11
je 0x18008db34
lea rbp, [0x18010ebe0]
xor r14d, r14d
nop dword [rax]
xorps xmm0, xmm0
lea rcx, [r15 + 0xf4010]
mov rax, r11
mov r8, rbp
shr rax, 1
mov edx, dword [rsi + rax*8]
lea rdi, [rsi + rax*8]
and edx, 0x3fff
add rcx, rdx
sub r8, rcx
movups xmmword [0x18010ebe0], xmm0
movups xmmword [0x18010ebf0], xmm0
nop dword [rax]
nop dword [rax + rax]
movzx eax, dl
inc edx
xor al, byte [rcx]
lea rcx, [rcx + 1]
xor al, 0x6e
mov byte [r8 + rcx - 1], al
test al, al
jne 0x18008dac0
mov rax, r14
test r9, r9
je 0x18008db0b
mov r10, rbx
sub r10, rbp
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rax + rbp]
lea rcx, [rax + rbp]
movzx edx, byte [r10 + rcx]
sub r8d, edx
jne 0x18008db10
inc rax
cmp rax, r9
jb 0x18008daf0
movzx r8d, byte [r9 + rbp]
test r8d, r8d
je 0x18008db51
lea rax, [r11 - 1]
cmovns rax, r11
mov r11, rax
lea rax, [rdi + 8]
cmovns rax, rsi
shr r11, 1
mov rsi, rax
jne 0x18008da80
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
sub rdi, r12
sar rdi, 3
mov eax, edi
jmp 0x18008db36

Function at 0x180092430
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
call fcn.180092dd0
mov rdi, qword [rsp + 0x70]
mov qword [rax + 0x138], rbx
mov rbx, qword [rdi + 8]
call fcn.180092dd0
mov qword [rax + 0x128], rbx
mov rax, qword [rsi]
mov rbx, qword [rax + 0x38]
call fcn.180092dd0
mov ecx, dword [0x18010f888]
mov r9, rdi
mov byte [rsp + 0x38], 1
mov r8, rbp
mov edx, 0x14
mov qword [rax + 0x130], rbx
xor ebx, ebx
mov rax, qword gs:[0x58]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov rcx, qword [rax + rcx*8]
mov eax, dword [rsp + 0x80]
mov dword [rdx + rcx], eax
mov rdx, r14
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rax
call fcn.1800942b0
call fcn.180092dd0
mov rcx, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov qword [rax + 0x138], rbx
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x50]
mov dword [rcx], 1
add rsp, 0x40
pop r14
ret
Function at 0x180095560
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x18010ab28]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18009559c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.18009216c
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x180095658
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1800956be
test ebx, ebx
jne 0x1800956be
lea ecx, [rax + 2]
call fcn.18009216c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.180091b90
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x18009f0e0
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x250
mov rax, qword [0x18010ab28]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x1800bba30]
mov rbp, rcx
call sub.msvcrt.dll_wcspbrk
test rax, rax
je 0x18009f2a1
mov qword [rsp + 0x268], rbx
xor ebx, ebx
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rdi
call sub.msvcrt.dll__errno
mov esi, dword [rax]
call sub.msvcrt.dll__errno
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], ebx
call sub.msvcrt.dll__wfullpath
mov rdi, rax
test rax, rax
je 0x18009f15f
call sub.msvcrt.dll__errno
mov dword [rax], esi
jmp 0x18009f190
call sub.msvcrt.dll__errno
cmp dword [rax], 0x22
jne 0x18009f27f
call sub.msvcrt.dll__errno
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], esi
call sub.msvcrt.dll__wfullpath
mov rbx, rax
mov rdi, rax
test rax, rax
je 0x18009f27f
mov rax, 0xffffffffffffffff
mov rcx, rax
nop word [rax + rax]
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x18009f1a0
cmp rcx, 3
je 0x18009f265
inc rax
cmp word [rdi + rax*2], 0
jne 0x18009f1b4
cmp rax, 5
jb 0x18009f27f
movzx eax, word [rdi]
cmp ax, 0x5c
je 0x18009f1db
cmp ax, 0x2f
jne 0x18009f27f
movzx eax, word [rdi + 2]
cmp ax, 0x5c
je 0x18009f1ef
cmp ax, 0x2f
jne 0x18009f27f
movzx eax, word [rdi + 4]
cmp ax, 0x5c
je 0x18009f27f
cmp ax, 0x2f
je 0x18009f27f
movzx eax, word [rdi + 6]
lea rcx, [rdi + 6]
test ax, ax
je 0x18009f27f
cmp ax, 0x5c
je 0x18009f229
cmp ax, 0x2f
je 0x18009f229
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x18009f210
test ax, ax
je 0x18009f27f
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
je 0x18009f27f
nop dword [rax + rax]
cmp ax, 0x5c
je 0x18009f259
cmp ax, 0x2f
je 0x18009f259
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x18009f240
test ax, ax
je 0x18009f265
cmp word [rcx + 2], 0
jne 0x18009f27f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
cmp eax, 1
jbe 0x18009f282
call fcn.180095704
mov al, 1
jmp 0x18009f289
mov rcx, rbx
call fcn.180095704
xor al, al
mov rsi, qword [rsp + 0x270]
mov rbx, qword [rsp + 0x268]
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180091b90
add rsp, 0x250
pop rbp
ret
Function at 0x18009faa0
Capabilities:
Get geographical location

Disassembly:
push rbx
push rbp
push rdi
push r15
sub rsp, 0x538
mov rax, qword [0x18010ab28]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov r15d, ecx
mov rbp, rdx
mov rcx, qword [0x18010f8f8]
test rcx, rcx
jne 0x18009fafb
call fcn.1800a1e60
mov rcx, rax
lea rdx, str._create_locale
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rcx, 0xffffffffffffffff
cmovne rcx, rax
mov qword [0x18010f8f8], rcx
xor ebx, ebx
cmp rcx, 0xffffffffffffffff
mov edi, ebx
cmovne rdi, rcx
test rdi, rdi
je 0x18009fc45
test rbp, rbp
je 0x18009fb4e
lea edx, [rbx + 0x2d]
mov rcx, rbp
call sub.msvcrt.dll_strchr
test rax, rax
je 0x18009fb4e
mov ecx, ebx
lea r8, [rsp + 0x120]
mov rdx, rbp
movsx eax, byte [rdx]
test al, al
je 0x18009fb5b
mov word [r8], ax
inc ecx
add r8, 2
inc rdx
cmp ecx, 0x100
jne 0x18009fb32
mov rdx, rbp
mov ecx, r15d
call rdi
jmp 0x18009fd22
movsxd rax, ecx
add rax, rax
cmp rax, 0x200
jae 0x18009fd3f
mov edx, 0x2d
mov word [rsp + rax + 0x120], bx
lea rcx, [rsp + 0x120]
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x18009fb4e
mov r9d, 0xff
lea r8, [rsp + 0x320]
mov edx, 0x1001
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x18009fb4e
lea ecx, [rax - 1]
mov r9d, 0x100
movsxd rdx, ecx
lea r8, [rsp + 0x320]
sub r9d, eax
mov ecx, 0x5f
cdqe
mov word [rsp + rdx*2 + 0x320], cx
mov edx, 0x1002
lea rcx, [rsp + 0x120]
lea r8, [r8 + rax*2]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x18009fb4e
lea rax, [rsp + 0x320]
lea rcx, [rsp + 0x20]
movzx edx, word [rax]
test dx, dx
je 0x18009fc2b
mov byte [rcx], dl
inc ebx
inc rcx
add rax, 2
cmp ebx, 0x100
jne 0x18009fc03
mov rdx, rbp
mov ecx, r15d
call rdi
jmp 0x18009fd22
movsxd rax, ebx
lea rbp, [rsp + 0x20]
mov rdx, rbp
mov ecx, r15d
mov byte [rsp + rax + 0x20], 0
call rdi
jmp 0x18009fd22
cmp r15d, 5
ja 0x18009fd14
test rbp, rbp
je 0x18009fd14
call fcn.18009fe80
mov rdi, rax
test rax, rax
je 0x18009fd1f
mov qword [rsp + 0x570], rsi
mov qword [rsp + 0x530], r14
call fcn.180092dd0
mov rdx, rbp
mov rsi, rax
mov r14d, dword [rax + 0xc8]
mov ecx, r14d
or ecx, 2
mov dword [rax + 0xc8], ecx
mov ecx, r15d
call fcn.18009ffe0
test rax, rax
je 0x18009fcbf
mov rax, qword [rsi + 0xc0]
mov ecx, dword [rax + 4]
call sub.msvcrt.dll__setmbcp
test eax, eax
jne 0x18009fcbf
call fcn.18009fe80
mov rbx, rax
mov rcx, qword [rsi + 0xc0]
mov dword [rsi + 0xc8], r14d
mov rax, qword [rdi]
mov r14, qword [rsp + 0x530]
cmp rax, rcx
je 0x18009fce7
mov qword [rdi], rcx
mov qword [rsi + 0xc0], rax
mov rax, qword [rdi + 8]
mov rcx, qword [rsi + 0xb8]
cmp rax, rcx
je 0x18009fd02
mov qword [rdi + 8], rcx
mov qword [rsi + 0xb8], rax
mov rcx, rdi
call fcn.18009fd50
mov rsi, qword [rsp + 0x570]
jmp 0x18009fd1f
call sub.msvcrt.dll__errno
mov dword [rax], 0x16
mov rax, rbx
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.180091b90
add rsp, 0x538
pop r15
pop rdi
pop rbp
pop rbx
ret
call fcn.180091cb8
int3
Function at 0x18009ffe0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x530
mov rax, qword [0x18010ab28]
xor rax, rsp
mov qword [rsp + 0x520], rax
xor ebx, ebx
mov rdi, rdx
mov esi, ecx
test rdx, rdx
je 0x1800a004c
lea edx, [rbx + 0x2d]
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1800a004c
mov ecx, ebx
lea r8, [rsp + 0x120]
mov rdx, rdi
nop dword [rax]
movsx eax, byte [rdx]
test al, al
je 0x1800a009f
mov word [r8], ax
inc ecx
add r8, 2
inc rdx
cmp ecx, 0x100
jne 0x1800a0030
mov rcx, qword [0x18010f908]
test rcx, rcx
jne 0x1800a0082
call fcn.1800a1e60
mov rcx, rax
lea rdx, str.setlocale
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rcx, 0xffffffffffffffff
cmovne rcx, rax
mov qword [0x18010f908], rcx
cmp rcx, 0xffffffffffffffff
cmovne rbx, rcx
test rbx, rbx
je 0x1800a0183
mov rdx, rdi
mov ecx, esi
call rbx
jmp 0x1800a0185
movsxd rax, ecx
add rax, rax
cmp rax, 0x200
jae 0x1800a01aa
mov edx, 0x2d
mov word [rsp + rax + 0x120], bx
lea rcx, [rsp + 0x120]
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x1800a004c
mov r9d, 0xff
lea r8, [rsp + 0x320]
mov edx, 0x1001
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x1800a004c
lea ecx, [rax - 1]
mov r9d, 0x100
movsxd rdx, ecx
lea r8, [rsp + 0x320]
sub r9d, eax
mov ecx, 0x5f
cdqe
mov word [rsp + rdx*2 + 0x320], cx
mov edx, 0x1002
lea rcx, [rsp + 0x120]
lea r8, [r8 + rax*2]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x1800a004c
lea rcx, [rsp + 0x320]
mov eax, ebx
lea rdx, [rsp + 0x20]
movzx r8d, word [rcx]
test r8w, r8w
je 0x1800a0173
mov byte [rdx], r8b
inc eax
inc rdx
add rcx, 2
cmp eax, 0x100
jne 0x1800a0151
jmp 0x1800a004c
cdqe
lea rdi, [rsp + 0x20]
mov byte [rsp + rax + 0x20], bl
jmp 0x1800a004c
xor eax, eax
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.180091b90
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.180091cb8
int3
Function at 0x404b00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404c80
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp byte [rax + 0x6d], 0
je 0x404c6e
mov rcx, qword [rax + 0x20]
shl rcx, 0xd
cmp rcx, 0x400000
jne 0x404c5d
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x1f], 1
movzx ecx, byte [rsp + 0x1f]
mov byte [rax + 0x6a], cl
mov rbx, qword [rax + 0x20]
shl rbx, 0xd
mov rcx, qword [rax + 0x18]
mov rdx, rbx
neg rdx
lea rsi, [0x009220f8]
lock xadd qword [rsi], rdx
nop
mov rax, rcx
call fcn.00416ba0
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
neg rbx
lea rax, [0x009220d0]
call fcn.004304a0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
lea rsi, [0x009220f0]
lock xadd qword [rsi], rdx
lea rax, [0x009259c0]
call fcn.00430560
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
neg rdx
lock xadd qword [rax], rdx
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
neg rdx
lock xadd qword [rax + 0x10], rdx
mov edx, 1
lock xadd qword [rax + 0x270], rdx
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
lock xadd qword [rax + 0x268], rdx
lea rax, [0x009259c0]
call fcn.00430640
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
neg rbx
lea rax, [0x00921fc0]
xor ecx, ecx
call fcn.00421440
movups xmmword [rsp + 0x20], xmm15
lea rcx, [0x00404ca0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
nop
call fcn.00464560
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x30
pop rbp
ret
lea rax, [0x006bff4e]
mov ebx, 0x2c
call fcn.00437240
lea rax, [0x006bea3d]
mov ebx, 0x28
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.00404b00
Function at 0x404f20
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x60], r14
mov rdx, qword [r14 + 0x30]
mov rsi, r14
cmp qword [rdx + 0x90], rsi
je 0x404f79
call fcn.00438be0
lea rax, [0x006ba66f]
mov ebx, 0x1e
nop dword [rax]
call fcn.00439460
call fcn.00438c40
mov eax, 2
call fcn.004331e0
mov rsi, qword [rsp + 0x60]
mov rax, qword [r14 + 0x30]
nop
inc dword [rax + 0x23c]
mov rax, qword [r14 + 0x30]
mov rcx, r14
nop
mov qword [rax + 0x130], rcx
mov rax, qword [r14 + 0x30]
mov qword [r14 + 0xd0], rax
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rax + 0x2c8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x2d8]
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [rax + 0x2e8]
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rsi + 0x70]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsi + 0x78]
mov qword [rsp + 0x18], rdx
nop dword [rax]
call fcn.00461420
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 0
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe9], 0
je 0x405009
mov byte [rcx + 0xea], 0
mov rdx, qword [rax + 0x30]
xor esi, esi
xchg dword [rdx + 0x338], esi
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x78]
call fcn.00405100
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x30]
mov byte [rsi + 0xe8], 1
mov rsi, qword [rdx + 0x30]
cmp byte [rsi + 0xe9], 0
je 0x40504d
mov byte [rsi + 0xea], 1
mov rcx, qword [rdx + 0x30]
mov rsi, qword [rsp + 0x68]
cmp rcx, rsi
jne 0x4050ee
mov qword [rsp + 0x68], rcx
nop
jmp 0x405094
nop
lea rax, [0x006e0ea0]
mov qword [rsp], rax
call fcn.00464560
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
xor eax, eax
mov esi, 1
lock cmpxchg dword [rcx + 0x338], esi
sete dil
test dil, dil
je 0x405067
mov rbx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x18]
call fcn.00441520
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x30]
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx + 0x2c8], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rcx + 0x2d8], xmm0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rcx + 0x2e8], xmm0
sub rsp, 0xffffffffffffff80
pop rbp
ret
lea rax, [0x006bde06]
mov ebx, 0x26
call fcn.00437240
nop
Function at 0x4055c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x405779
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx]
nop dword [rax]
cmp rsi, 0x10000
jae 0x405767
cmp byte [rdx + 0x15], 8
ja 0x405756
mov qword [rsp + 0x20], rdx
mov rax, rbx
mul rsi
jo 0x405743
movabs rdx, 0xffffffffffa0
cmp rax, rdx
ja 0x405743
nop dword [rax + rax]
test rbx, rbx
jl 0x405743
mov qword [rsp + 0x48], rbx
test rax, rax
je 0x4056d3
mov rdx, qword [rsp + 0x20]
cmp qword [rdx + 8], 0
jne 0x40567b
add rax, 0x60
xor ebx, ebx
mov ecx, 1
call fcn.0040cd20
test byte [rax], al
lea rdx, [rax + 0x60]
cmp dword [0x00921500], 0
je 0x405672
call fcn.004665c0
mov qword [r11], rdx
mov rcx, qword [rax + 0x10]
mov qword [r11 + 8], rcx
mov qword [rax + 0x10], rdx
jmp 0x405708
mov qword [rsp + 0x18], rax
lea rax, [0x0069fd60]
call fcn.0040d680
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x20]
mov ecx, 1
mov rax, qword [rsp + 0x18]
call fcn.0040cd20
cmp dword [0x00921500], 0
jne 0x4056b5
mov rcx, qword [rsp + 0x28]
jmp 0x4056ca
call fcn.004665c0
mov qword [r11], rax
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x10]
mov qword [r11 + 8], rdx
mov qword [rcx + 0x10], rax
mov rax, rcx
jmp 0x405708
mov eax, 0x60
xor ebx, ebx
mov ecx, 1
nop
call fcn.0040cd20
test byte [rax], al
lea rdx, [rax + 0x10]
cmp dword [0x00921500], 0
je 0x405704
call fcn.004665c0
mov qword [r11], rdx
mov rcx, qword [rax + 0x10]
mov qword [r11 + 8], rcx
mov qword [rax + 0x10], rdx
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
mov word [rax + 0x18], dx
cmp dword [0x00921500], 0
je 0x405730
nop dword [rax]
call fcn.004665c0
mov qword [r11], rcx
mov rdx, qword [rax + 0x20]
mov qword [r11 + 8], rdx
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
add rsp, 0x30
pop rbp
ret
lea rax, [0x0066c200]
lea rbx, [0x007277a0]
call fcn.00436ac0
lea rax, [0x006b6f99]
mov ebx, 0x17
call fcn.00437240
lea rax, [0x006bde2c]
mov ebx, 0x26
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004055c0
Function at 0x409880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x409997
push rbp
mov rbp, rsp
sub rsp, 0x20
cmp byte [0x008cc938], 0
jne 0x409985
mov qword [rsp + 0x30], rax
mov byte [0x008cc938], 1
mov rbx, qword [0x008cc928]
mov qword [rsp + 0x18], rbx
xor ecx, ecx
jmp 0x4098c0
inc rcx
nop
cmp rcx, rbx
jge 0x40992d
mov rsi, qword [0x008cc928]
mov rdi, rsi
sub rsi, rcx
dec rsi
cmp rdi, rsi
jbe 0x409976
mov qword [rsp + 0x10], rcx
shl rsi, 4
mov rdi, qword [0x008cc920]
movzx r8d, byte [rdi + rsi + 8]
mov rsi, qword [rdi + rsi]
test rax, rax
je 0x409905
nop dword [rax]
test r8b, r8b
je 0x4098bb
mov rcx, qword [0x006e0e40]
mov rax, rsi
lea rdx, [0x006e0e40]
call rcx
test al, al
jne 0x409965
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
jmp 0x4098bb
movups xmmword [0x008cc928], xmm15
cmp dword [0x00921500], 0
je 0x40994d
mov rax, qword [0x008cc920]
call fcn.004665a0
mov qword [r11], rax
mov qword [0x008cc920], 0
mov byte [0x008cc938], 0
add rsp, 0x20
pop rbp
ret
lea rax, [0x006be493]
mov ebx, 0x27
call fcn.00437240
mov rax, rsi
mov rcx, rdi
nop dword [rax]
call fcn.00466960
lea rax, [0x006bde52]
mov ebx, 0x26
call fcn.00437240
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.00409880

Function at 0x40a3e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a4f8
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdx, qword [r14 + 0x30]
cmp dword [rdx + 0xc0], 0
nop dword [rax]
jne 0x40a4e6
mov rdx, qword [0x008bd650]
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
mov r8, rdi
shr rdi, 2
lea rdi, [rdi + rdi*2]
nop
cmp rsi, rdi
jb 0x40a4c4
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x28], rax
lea rax, [r8 + r8]
lea rax, [rax + 2]
shl rax, 3
xor ebx, ebx
mov ecx, 1
call fcn.0040cd20
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x18]
mov rsi, qword [rdx]
shl rsi, 1
mov qword [rax], rsi
movups xmmword [rsp + 0x30], xmm15
lea rsi, [0x0046adc0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
call fcn.0040b240
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x18]
cmp qword [rsi + 8], rdx
jne 0x40a4d5
nop
cmp byte [0x00921500], 0
je 0x40a4ae
lea rax, [0x008bd650]
call fcn.00404d80
mov rbx, qword [rsp + 0x20]
lea rcx, [0x008bd650]
xchg qword [rcx], rbx
mov rdx, qword [0x008bd650]
mov rax, qword [rsp + 0x28]
mov rbx, rax
mov rax, rdx
call fcn.0040a520
add rsp, 0x40
pop rbp
ret
lea rax, [0x006be4ba]
mov ebx, 0x27
call fcn.00437240
lea rax, [0x006b37ff]
mov ebx, 0xf
call fcn.00437240
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.0040a3e0
Function at 0x40b300
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40b426
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rcx, qword [rbx + 8]
inc rcx
mov qword [rbx + 8], rcx
mov rdx, rbx
shl rbx, 0x10
mov rsi, rcx
and ecx, 0x7ffff
or rbx, rcx
mov rcx, rbx
sar rbx, 0x13
shl rbx, 3
nop
nop
nop
nop
cmp rdx, rbx
je 0x40b34a
jmp 0x40b36a
mov rax, rsi
mov rbx, qword [rax]
mov qword [rdx], rbx
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rsi], rcx
sete bl
nop
test bl, bl
je 0x40b347
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x20], rbx
nop
call fcn.00438be0
lea rax, [0x006bff7a]
mov ebx, 0x2c
call fcn.00439460
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.004393e0
lea rax, [0x006b0acb]
mov ebx, 5
call fcn.00439460
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.004392e0
lea rax, [0x006b1529]
mov ebx, 8
call fcn.00439460
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.004392e0
lea rax, [0x006b1954]
mov ebx, 9
call fcn.00439460
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004393e0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006b283d]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0040b300

Function at 0x40b460
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40b517
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov rdx, rax
xor ebx, ebx
mov rcx, rbx
mov rax, rdx
call fcn.00413ec0
test rax, rax
jne 0x40b505
mov rax, qword [rsp + 0x30]
mov rcx, rax
shl rax, 0x10
or rax, 0x7ffff
sar rax, 0x13
shl rax, 3
nop
nop
cmp rcx, rax
jne 0x40b4b3
add rsp, 0x20
pop rbp
ret
call fcn.00438be0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
call fcn.00438be0
lea rax, [0x006b9704]
mov ebx, 0x1c
call fcn.00439460
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.004392e0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006b49b0]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.00437240
lea rax, [0x006bd073]
mov ebx, 0x24
call fcn.00437240
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.0040b460