joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400023b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000e640]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400023d0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400023d8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x1400023f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000e640]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002410
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002418
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002410
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002410
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002454
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002468
add rax, 0x28
cmp r9, rax
jne 0x140002440
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x140002480
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14000e640]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400024a2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1400024b0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400024a2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400024a2
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x1400024a2
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400024fd
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002510
add rdx, 0x28
cmp r10, rdx
jne 0x1400024e8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x14000251f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14000252f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002506
test ecx, ecx
jg 0x140002518
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x140003ba0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14000e6f0]
mov rax, qword [rsi]
test rax, rax
je 0x140003c30
cmp qword [rax + 0x30], 0
jne 0x140003c50
lea rbx, [0x14000d078]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x140003c00
cmp qword [rax + 0x30], 0
jne 0x140003c20
lea rdx, [0x14000d078]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je sym.pthread_tls_init.cold
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140003be2
test rax, rax
jne 0x140003c20
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x140003bf0
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140003bc0
test rax, rax
jne 0x140003c50
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x140003bcb
Function at 0x140007820
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14000e6f0]
mov rax, qword [rbx]
mov r12, rcx
mov esi, edx
test rax, rax
je 0x1400078f0
cmp qword [rax + 0x60], 0
jne 0x140007910
lea rcx, [0x14000d068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
test rax, rax
je 0x140007920
cmp qword [rax + 0x1d8], r12
jne 0x140007920
test byte [rax + 0x40], 0xc
jne 0x140007920
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140007920
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140007920
mov rax, qword [rbx]
test rax, rax
je 0x140007980
cmp qword [rax + 0x60], 0
jne 0x1400079a0
lea rcx, [0x14000d068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
test esi, esi
je 0x1400079b0
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x1400079b8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp sym.pthread_cancel
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x14000784b
test rax, rax
jne 0x140007910
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007856
mov rax, qword [rbx]
test rax, rax
je 0x140007950
cmp qword [rax + 0x60], 0
jne 0x140007970
lea rcx, [0x14000d068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rbx]
cmp qword [r8 + 0x60], 0
je 0x14000792f
test rax, rax
jne 0x140007970
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x14000793a
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x1400078ba
test rax, rax
jne 0x1400079a0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x1400078c5
xor eax, eax
jmp 0x140007944
mov eax, 0x16
jmp 0x140007944
Function at 0x140001cec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d36
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d38
xor al, al
add rsp, 0x28
ret
Function at 0x404e80
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, rcx
shr rcx, 6
mov rsi, rcx
shl rcx, 6
nop
nop
sub rdx, rcx
add rdi, rdx
mov qword [rsp + 0x28], rdi
add rbx, rsi
add rcx, rax
mov qword [rsp + 0x30], rcx
xor eax, eax
xor esi, esi
jmp 0x404ec0
add rax, 8
nop
cmp rax, rdi
jae 0x404f2a
test rax, 0x3f
jne 0x404ed5
movzx esi, byte [rbx]
inc rbx
jmp 0x404ed7
shr esi, 1
test rdx, rdx
jbe 0x404ee2
add rdx, 0xfffffffffffffff8
jmp 0x404eba
bt esi, 0
jae 0x404eba
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x14], esi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rcx + rax]
mov rax, rdx
call fcn.004046e0
test al, al
jne 0x404f34
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
mov esi, dword [rsp + 0x14]
mov rdi, qword [rsp + 0x28]
jmp 0x404eba
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0076760b]
mov ebx, 0x24
call fcn.00435800
nop
int3

Function at 0x40a100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a226
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, qword [r14 + 0x30]
cmp dword [rdx + 0xc0], 0
jne 0x40a210
mov rdx, qword [0x00a17d80]
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
mov r8, rdi
shr rdi, 2
lea rdi, [rdi + rdi*2]
cmp rsi, rdi
jb 0x40a1ea
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x28], rax
lea rax, [r8 + r8]
lea rax, [rax + 2]
shl rax, 3
xor ebx, ebx
mov ecx, 1
call fcn.0040ca20
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x18]
mov rsi, qword [rdx]
shl rsi, 1
mov qword [rax], rsi
movups xmmword [rsp + 0x30], xmm15
lea rsi, [0x00464220]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
nop dword [rax]
call fcn.0040b020
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x18]
cmp qword [rsi + 8], rdx
jne 0x40a1ff
nop
cmp byte [0x00a7cac0], 0
je 0x40a1d4
lea rax, [0x00a17d80]
call fcn.00403e40
mov rbx, qword [rsp + 0x20]
lea rcx, [0x00a17d80]
xchg qword [rcx], rbx
mov rdx, qword [0x00a17d80]
mov rax, qword [rsp + 0x28]
mov rbx, rax
mov rax, rdx
call fcn.0040a240
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00768dff]
mov ebx, 0x27
call fcn.00435800
lea rax, [0x0075a956]
mov ebx, 0xf
nop dword [rax]
call fcn.00435800
nop
mov qword [rsp + 8], rax
call fcn.0045f860
mov rax, qword [rsp + 8]
jmp fcn.0040a100
Function at 0x40b0e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40b206
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rbx + 8]
inc rcx
mov qword [rbx + 8], rcx
nop
mov rdx, rbx
shl rbx, 0x10
mov rsi, rcx
and ecx, 0x7ffff
or rbx, rcx
mov rcx, rbx
sar rbx, 0x13
shl rbx, 3
cmp rdx, rbx
je 0x40b12c
jmp 0x40b14e
mov rax, rsi
mov rbx, qword [rax]
mov qword [rdx], rbx
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rsi], rcx
sete bl
test bl, bl
je 0x40b129
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x20], rbx
call fcn.00436fa0
lea rax, [0x0076acc8]
mov ebx, 0x2c
call fcn.004378a0
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.00437820
lea rax, [0x007573e2]
mov ebx, 5
call fcn.004378a0
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00437700
lea rax, [0x00757eaf]
mov ebx, 8
call fcn.004378a0
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00437700
lea rax, [0x00758370]
mov ebx, 9
call fcn.004378a0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437820
call fcn.00437200
call fcn.00437020
lea rax, [0x00759772]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00435800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0040b0e0
Function at 0x40b800
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
nop
test cl, cl
je 0x40b891
mov qword [rsp + 0x28], r14
test rbx, rbx
jge 0x40b85b
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x00a17d78]
cmp qword [rcx], 0
jne 0x40ba7f
mov rax, 0xffffffffffffffff
call fcn.00431a80
jmp 0x40ba30
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x48], rbx
call fcn.00463840
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x48]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40b8bd
cmp qword [rdx], 1
jne 0x40b8a6
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0076461f]
mov ebx, 0x1e
call fcn.00435800
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x00a17d78]
cmp qword [rdx], 0
je 0x40b8ee
nop word [rax + rax]
cmp rbx, 0x989680
jle 0x40b8ee
mov ebx, 0x989680
mov rax, rbx
call fcn.00431a80
test eax, eax
jge 0x40b982
mov rax, qword [0x00a17d78]
mov rax, qword [rax]
test rax, rax
je 0x40b933
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00461680
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.00463840
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40b8b7
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
nop
jmp 0x40b9a1
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rsi, qword [rcx]
mov rdi, qword [rdx + 0x30]
mov r8, rdi
cmp rsi, rdi
jne 0x40b9d1
mov rax, rsi
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
nop
test dil, dil
je 0x40b9a1
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp rsi, 1
jne 0x40ba1f
mov byte [r8 + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.00431a80
test eax, eax
jl 0x40ba0e
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0076ca7e]
mov ebx, 0x32
call fcn.00435800
lea rax, [0x0076c542]
mov ebx, 0x31
call fcn.00435800
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [0x00a17d78]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00461680
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, 0x989680
call fcn.00431a80
test eax, eax
jl 0x40ba4f
jmp 0x40ba30
Function at 0x40bce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40bfde
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [0x00989344], 0x10
jne 0x40bfcc
xor eax, eax
jmp 0x40bd27
lea rdx, [rax + rax*2]
lea rsi, [0x00989340]
movzx edi, word [rsi + rax*2]
lea r8, [0x00a820b0]
mov dword [r8 + rdx*8], edi
inc rax
cmp rax, 0x44
jl 0x40bd0a
mov rdx, qword [0x00a7c8d0]
test rdx, rdx
je 0x40bfbb
nop dword [rax]
cmp rdx, 0x80000
ja 0x40bf4c
cmp rdx, 0x1000
jb 0x40bee0
lea rbx, [rdx - 1]
nop
test rdx, rbx
jne 0x40be8e
mov rdx, qword [0x00a7c8c8]
lea rbx, [rdx - 1]
test rdx, rbx
jne 0x40be45
nop dword [rax]
cmp rdx, 0x400000
jbe 0x40bd94
mov qword [0x00a7c8c8], 0
cmp qword [0x00a7c8c8], 0
jne 0x40be1a
lea rax, [0x00a3e960]
call fcn.004258a0
call fcn.00416020
mov qword [0x00a7c888], rax
mov eax, 0x7f
jmp 0x40be00
mov qword [rsp + 0x10], rax
lea rax, [0x00a55508]
call fcn.00418ac0
mov rcx, qword [rsp + 0x10]
mov rdx, rcx
shl rcx, 0x28
movabs rbx, 0xc000000000
or rcx, rbx
mov qword [rax], rcx
mov rcx, qword [0x00a4ed10]
mov qword [rax + 0x10], rcx
mov qword [0x00a4ed10], rax
lea rax, [rdx - 1]
test rax, rax
jge 0x40bdbd
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rdx, [rcx + 1]
mov qword [0x00a7c8c0], rdx
mov rcx, qword [0x00a7c8c0]
cmp rcx, 0x40
sbb rdx, rdx
mov ebx, 1
shl rbx, cl
and rbx, rdx
cmp qword [0x00a7c8c8], rbx
jne 0x40be0f
nop dword [rax]
jmp 0x40bd9e
call fcn.00436fa0
lea rax, [0x007604df]
mov ebx, 0x17
call fcn.004378a0
mov rax, qword [0x00a7c8c8]
call fcn.004375a0
lea rax, [0x0075f6f2]
mov ebx, 0x17
call fcn.004378a0
call fcn.00437020
lea rax, [0x007612c9]
mov ebx, 0x19
call fcn.00435800
call fcn.00436fa0
lea rax, [0x0075c5b6]
mov ebx, 0x12
nop
call fcn.004378a0
mov rax, qword [0x00a7c8d0]
call fcn.004375a0
lea rax, [0x0075f6f2]
mov ebx, 0x17
nop dword [rax]
call fcn.004378a0
call fcn.00437020
lea rax, [0x0075d540]
mov ebx, 0x14
call fcn.00435800
nop dword [rax + rax]
call fcn.00436fa0
lea rax, [0x0075c5b6]
mov ebx, 0x12
call fcn.004378a0
mov rax, qword [0x00a7c8d0]
nop dword [rax]
call fcn.004375a0
lea rax, [0x00767d13]
mov ebx, 0x25
call fcn.004378a0
mov eax, 0x1000
nop dword [rax + rax]
call fcn.004376a0
lea rax, [0x00756e30]
mov ebx, 2
call fcn.004378a0
call fcn.00437020
lea rax, [0x0075d540]
mov ebx, 0x14
call fcn.00435800
call fcn.00436fa0
lea rax, [0x0075c5b6]
mov ebx, 0x12
nop dword [rax]
call fcn.004378a0
mov rax, qword [0x00a7c8d0]
call fcn.004375a0
lea rax, [0x00767533]
mov ebx, 0x24
nop dword [rax]
call fcn.004378a0
mov eax, 0x80000
call fcn.004376a0
lea rax, [0x00756e30]
mov ebx, 2
nop dword [rax + rax]
call fcn.004378a0
call fcn.00437020
lea rax, [0x0075d540]
mov ebx, 0x14
call fcn.00435800
lea rax, [0x007643e5]
mov ebx, 0x1e
call fcn.00435800
lea rax, [0x0075b6f1]
mov ebx, 0x11
call fcn.00435800
nop
nop
call fcn.0045f860
jmp fcn.0040bce0
Function at 0x40c6a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c7be
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
xor edx, edx
jmp 0x40c6dd
inc rdx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
lea rsi, [rcx + rbx]
mov qword [rsp + 0x28], rsi
mov rbx, rsi
call fcn.00417980
mov rcx, rax
test rax, rax
je 0x40c79e
mov rdx, qword [rsp + 0x58]
lea rsi, [rdx - 1]
test rax, rsi
je 0x40c78c
mov qword [rsp + 0x20], rax
mov rax, rcx
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
nop dword [rax]
call fcn.00417840
nop
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x58]
lea rdx, [rax + rdx]
lea rdx, [rdx - 1]
neg rax
and rax, rdx
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x50]
call fcn.00417980
mov rdx, rax
mov rsi, qword [rsp + 0x20]
cmp rax, rsi
je 0x40c77a
mov rax, rdx
mov rbx, qword [rsp + 0x50]
xor ecx, ecx
call fcn.00417840
mov rdx, qword [rsp + 0x18]
cmp rdx, 0x63
jne 0x40c6cb
jmp 0x40c7ac
mov rax, rdx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, rcx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x0076dbe9]
mov ebx, 0x38
call fcn.00435800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040c6a0
Function at 0x40c800
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c9f3
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x40c9e5
mov qword [rsp + 0x30], rdx
mov byte [rsp + 0x50], bl
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + rdx*8 + 0x28]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.004134e0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x38]
cmp rax, rdx
jne 0x40c8af
mov qword [rsp + 0x20], rdx
movzx ecx, word [rcx + 0x60]
cmp rdx, rcx
jne 0x40c976
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x48]
movzx ebx, byte [rsp + 0x50]
nop dword [rax]
call fcn.004162a0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx + rcx*8 + 0x28]
mov qword [rsp + 0x28], rax
call fcn.004134e0
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
jmp 0x40c8b2
mov rbx, rax
cmp qword [rcx + 0x38], rax
jbe 0x40c965
mov rsi, qword [rcx + 0x68]
imul rax, rsi
add rax, qword [rcx + 0x18]
movzx esi, word [rcx + 0x60]
inc esi
mov word [rcx + 0x60], si
movzx edi, si
mov r8, qword [rcx + 0x38]
cmp r8, rdi
jb 0x40c8f3
cmp rbx, rdx
sete dl
mov rbx, rcx
mov ecx, edx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov word [rsp + 0x16], si
mov qword [rsp + 0x20], r8
nop dword [rax]
call fcn.00436fa0
lea rax, [0x0075a332]
mov ebx, 0xe
call fcn.004378a0
movzx eax, word [rsp + 0x16]
movzx eax, ax
nop
call fcn.004375a0
lea rax, [0x00758d27]
mov ebx, 0xb
call fcn.004378a0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004375a0
call fcn.00437200
call fcn.00437020
lea rax, [0x00760410]
mov ebx, 0x17
nop dword [rax + rax]
call fcn.00435800
lea rax, [0x0075ed52]
mov ebx, 0x16
call fcn.00435800
mov word [rsp + 0x16], cx
nop dword [rax + rax]
call fcn.00436fa0
lea rax, [0x007603f9]
mov ebx, 0x17
call fcn.004378a0
movzx eax, word [rsp + 0x16]
nop dword [rax + rax]
call fcn.004375a0
lea rax, [0x00758d27]
mov ebx, 0xb
call fcn.004378a0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004375a0
call fcn.00437200
call fcn.00437020
lea rax, [0x0076c573]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.00435800
mov rax, rdx
mov ecx, 0x88
call fcn.00461f40
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax]
call fcn.0045f860
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0040c800
Function at 0x40d480
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d50d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp rbx, 1
je 0x40d4dc
mov rdx, qword [rax]
mov rcx, rax
mov rax, rbx
mul rdx
jo 0x40d4f9
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x40d4f9
nop dword [rax + rax]
test rbx, rbx
jl 0x40d4f9
mov rbx, rcx
mov ecx, 1
call fcn.0040ca20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rax]
mov rbx, rax
mov ecx, 1
mov rax, rdx
call fcn.0040ca20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x007089c0]
lea rbx, [0x007e5bf0]
call fcn.00435080
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0040d480

Function at 0x40d540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d5e6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rdx, qword [rax + 0xa0]
nop
test rdx, rdx
je 0x40d56b
mov rdx, qword [rdx + 0x40]
jmp 0x40d572
mov rdx, qword [0x00a7c888]
test rdx, rdx
je 0x40d5cf
mov rax, qword [0x00a7c7d0]
nop
cmp rax, 1
jne 0x40d58a
xor eax, eax
jmp 0x40d5b3
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
call fcn.0040d620
movsxd rcx, eax
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov rax, rcx
mov rcx, qword [rsp + 0x18]
mov qword [rdx], rax
mov rax, rbx
mov rbx, rcx
nop dword [rax]
call fcn.0042c540
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x0076dd71]
mov ebx, 0x38
nop dword [rax + rax]
call fcn.00435800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040d540
Function at 0x40d8a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40db37
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rax, rax
je 0x40db25
test rbx, rbx
je 0x40d8ee
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40db10
nop dword [rax + rax]
cmp rbx, 0x2000
jbe 0x40d8f3
jmp 0x40daff
mov ebx, 8
cmp rax, 0x10000
jae 0x40d9c5
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40d93e
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40d93e
test byte [rsi], al
add rsi, 0x11f0
jmp 0x40d967
nop
nop
lea rax, [0x00a7caf0]
call fcn.0040b340
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x00a7caf8]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
mov qword [rsi + 8], rdi
add rdi, rax
cmp rdi, 0x40000
ja 0x40d999
cmp qword [rsi], 0
jne 0x40d9d7
mov eax, 0x40000
lea rbx, [0x00a81080]
call fcn.00417380
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
jne 0x40da83
nop dword [rax]
jmp 0x40dad2
mov rbx, rcx
call fcn.00417380
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
nop
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
mov dword [rdx + 0xd8], r10d
lea rdx, [rdi + r8]
nop dword [rax]
cmp r9d, 1
jne 0x40da18
cmp byte [r14 + 0xb1], 0
je 0x40da18
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdx
lea rdi, [0x00a7caf8]
cmp rsi, rdi
jne 0x40da46
nop
nop
lea rax, [0x00a7caf0]
call fcn.0040b560
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
lea rsi, [0x00a81080]
cmp rcx, rsi
je 0x40da76
mov rbx, rax
mov rax, rcx
call fcn.0042e360
mov rbx, qword [rsp + 0x48]
neg rbx
lea rax, [0x00a81080]
call fcn.0042e360
mov rdx, qword [rsp + 0x30]
mov rax, rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rcx]
mov rax, qword [0x00a7c8b8]
mov qword [rdx], rax
mov rdx, qword [rcx]
lea rsi, [0x00a7c8b8]
lock cmpxchg qword [rsi], rdx
sete dl
test dl, dl
je 0x40da83
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x58]
jmp 0x40d9d7
lea rdx, [0x00a7caf8]
cmp rcx, rdx
je 0x40daef
lea rax, [0x00765073]
mov ebx, 0x1f
call fcn.00435800
nop
nop
lea rax, [0x00a7caf0]
call fcn.0040b560
jmp 0x40dade
lea rax, [0x00767277]
mov ebx, 0x23
call fcn.00435800
lea rax, [0x0076a1cf]
mov ebx, 0x2a
nop dword [rax]
call fcn.00435800
lea rax, [0x00762449]
mov ebx, 0x1a
call fcn.00435800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463f80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040d8a0