joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402085c4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1401fabc4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140208665
cmp ebx, dword [rsp + 0x30]
je 0x14020865e
test esi, esi
je 0x14020865e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140208639
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140208646
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140208623
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14020864a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140208667
mov eax, 1
jmp 0x140208667
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14020cbf4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140201918
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140201918
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14020cd44
cmp rax, 0xffffffffffffffff
je 0x14020cd44
xor edi, edi
test rbp, rbp
jle 0x14020ccef
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1401fec0c
mov rbx, rax
test rax, rax
jne 0x14020cc7c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14020cce5
mov edx, 0x8000
mov ecx, r14d
call fcn.1401f8128
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140201160
cmp eax, 0xffffffff
je 0x14020ccc5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14020cc8c
mov edx, r15d
mov ecx, r14d
call fcn.1401f8128
jmp 0x14020cce5
cmp byte [rsi + 0x38], dil
je 0x14020ccdc
cmp dword [rsi + 0x34], 5
jne 0x14020ccdc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
cmp byte [rsi + 0x30], dil
je 0x14020cce5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401faf24
jmp 0x14020cd58
jns 0x14020cd58
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140201918
cmp rax, 0xffffffffffffffff
jne 0x14020cd10
cmp byte [rsi + 0x30], dil
je 0x14020cd58
mov edi, dword [rsi + 0x2c]
jmp 0x14020cd58
mov ecx, r14d
call fcn.1401f67f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14020cd58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
jmp 0x14020cd58
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14020cd51
mov eax, dword [rsi + 0x2c]
jmp 0x14020cd56
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140201918
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14020d360
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14020d388
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14020d388
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1407ca058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407ca1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407ca089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ca06f
add dl, dl
jne 0x1407ca096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ca0f6
xor eax, eax
add dl, dl
jne 0x1407ca0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ca1ad
add dl, dl
jne 0x1407ca0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ca0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ca0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ca0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407ca0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407ca07e
mov eax, 1
add dl, dl
jne 0x1407ca106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ca113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ca0fb
sub eax, ebx
mov ebx, 1
jne 0x1407ca14c
mov ecx, 1
add dl, dl
jne 0x1407ca12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407ca13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ca123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ca07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407ca168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407ca175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ca15d
cmp eax, 0x7d00
jae 0x1407ca19b
cmp eax, 0x500
jb 0x1407ca196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ca07e
cmp eax, 0x7f
ja 0x1407ca19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ca07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407ca1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407ca07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14002982c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001ce24
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001ce24
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002997c
cmp rax, 0xffffffffffffffff
je 0x14002997c
xor edi, edi
test rbp, rbp
jle 0x140029927
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f738
mov rbx, rax
test rax, rax
jne 0x1400298b4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002991d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a758
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001db00
cmp eax, 0xffffffff
je 0x1400298fd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400298c4
mov edx, r15d
mov ecx, r14d
call fcn.14001a758
jmp 0x14002991d
cmp byte [rsi + 0x38], dil
je 0x140029914
cmp dword [rsi + 0x34], 5
jne 0x140029914
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002991d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b4ec
jmp 0x140029990
jns 0x140029990
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001ce24
cmp rax, 0xffffffffffffffff
jne 0x140029948
cmp byte [rsi + 0x30], dil
je 0x140029990
mov edi, dword [rsi + 0x2c]
jmp 0x140029990
mov ecx, r14d
call fcn.140018c10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029990
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029990
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029989
mov eax, dword [rsi + 0x2c]
jmp 0x14002998e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001ce24
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002aa80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002aaa8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002aaa8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140f601b4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f601be
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f601e7
pop rbp
sub rbp, 0x33
sub rbp, 0xf601b4
sub rsp, 0x20
jmp 0x140f60206
mov rax, 0xf601b4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x71ca717
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f60225
jmp 0x140f6023c
pop rdi
sahf
invalid
Function at 0x2fc4ca770
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4cb172
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ef108]
test eax, eax
je 0x2fc4cb20a
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ef110]
mov qword [rbp - 8], rax
jmp 0x2fc4cb1ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cb1e2
cmp qword [rbp - 0x10], 0
je 0x2fc4cb1e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cb1a8
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cb20b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cb310
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cb338
mov eax, 0
jmp 0x2fc4cb386
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cb361
mov eax, 0
jmp 0x2fc4cb386
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cb381
mov eax, 0
jmp 0x2fc4cb386
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cb38c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cb40a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cb401
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cb401
mov rax, qword [rbp - 8]
jmp 0x2fc4cb41f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cb3d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x4051c0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], rax
shr rcx, 6
mov qword [rsp + 0x28], rcx
mov rax, rbx
mov rbx, rcx
call fcn.004147a0
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x28]
shl rbx, 6
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x40]
call fcn.0044dae0
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x28]
sub rcx, rdx
mov rdx, qword [rsp + 0x70]
add rdx, rcx
mov qword [rsp + 0x28], rdx
mov rsi, qword [rsp + 0x30]
xor ebx, ebx
xor edi, edi
jmp 0x405240
add rbx, 8
nop dword [rax]
cmp rbx, rdx
jae 0x4052de
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rcx
test rbx, 0x3f
je 0x405262
shr edi, 1
nop
jmp 0x405291
movzx ecx, byte [rsi]
mov dword [rsp + 0x14], ecx
mov rax, rsi
mov ebx, 1
call fcn.004147a0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x18]
mov rsi, rax
mov edi, dword [rsp + 0x14]
mov rax, qword [rsp + 0x40]
test rcx, rcx
jbe 0x40529c
add rcx, 0xfffffffffffffff8
jmp 0x405238
bt edi, 0
jae 0x405238
mov dword [rsp + 0x10], edi
mov qword [rsp + 0x38], rsi
call fcn.0044dae0
mov rax, qword [rax]
call fcn.00404a20
test al, al
jne 0x4052e8
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x38]
mov edi, dword [rsp + 0x10]
jmp 0x405238
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00651d3d]
mov ebx, 0x24
call fcn.00436d80
nop
int3
Function at 0x405560
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4056d7
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx]
nop
cmp rsi, 0x10000
jae 0x4056c5
cmp byte [rdx + 0x15], 8
ja 0x4056b4
mov qword [rsp + 0x20], rdx
mov rax, rbx
mul rsi
jo 0x4056a1
movabs rdx, 0xffffffffffa0
cmp rax, rdx
ja 0x4056a1
nop dword [rax + rax]
test rbx, rbx
jl 0x4056a1
mov qword [rsp + 0x50], rbx
test rax, rax
je 0x405642
mov rdx, qword [rsp + 0x20]
cmp qword [rdx + 8], 0
jne 0x405609
add rax, 0x60
xor ebx, ebx
mov ecx, 1
call fcn.0040c9c0
mov qword [rsp + 0x30], rax
mov ebx, 0x60
call fcn.0044dae0
mov rdx, qword [rsp + 0x30]
mov qword [rdx + 0x10], rax
jmp 0x405666
mov qword [rsp + 0x18], rax
lea rax, [0x00637900]
call fcn.0040d1e0
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x20]
mov ecx, 1
mov rax, qword [rsp + 0x18]
call fcn.0040c9c0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rdx, rcx
nop
jmp 0x405666
mov eax, 0x60
xor ebx, ebx
mov ecx, 1
call fcn.0040c9c0
mov qword [rsp + 0x30], rax
call fcn.00406820
mov rdx, qword [rsp + 0x30]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0x28], rdx
mov rcx, qword [rsp + 0x20]
mov rsi, qword [rcx]
mov word [rdx + 0x18], si
mov qword [rdx + 0x20], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rdx + 8], rcx
lea rax, [rdx + 0x58]
mov ebx, 0x10
call fcn.0040b9c0
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x0060b1e0]
lea rbx, [0x00684f20]
call fcn.00436780
lea rax, [0x0064bb87]
mov ebx, 0x17
call fcn.00436d80
lea rax, [0x00652b7a]
mov ebx, 0x26
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00405560
Function at 0x408de0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xa8]
cmp r12, qword [r14 + 0x10]
jbe 0x4090fc
sub rsp, 0x128
mov qword [rsp + 0x120], rbp
lea rbp, [rsp + 0x120]
mov rax, qword [rsp + 0x128]
call fcn.0044f400
call fcn.0044fb80
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x28
call fcn.00403180
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
test rcx, rcx
jl 0x4090d3
lea rdx, [rcx + 2]
mov rsi, qword [rsp + 0x28]
cmp rsi, rdx
jg 0x408e8b
xor eax, eax
lea rbx, [0x00655ff5]
mov ecx, 0x31
mov rdi, qword [rsp + 0x80]
call fcn.0044c9c0
call fcn.00436d80
mov rdi, qword [rsp + 0x80]
movzx r8d, byte [rcx + rdi - 1]
movzx r9d, byte [rcx + rdi]
shl r9d, 8
or r8d, r9d
cmp r8w, 0x282e
jne 0x408e6b
movzx r8d, byte [rcx + rdi + 1]
cmp r8b, 0x2a
jne 0x408e6b
mov qword [rsp + 0x30], rcx
sub rsi, rcx
mov qword [rsp + 0x38], rsi
lea rax, [rsi - 2]
mov qword [rsp + 0x28], rax
mov rbx, rax
neg rax
sar rax, 0x3f
and rax, rdx
add rax, rdi
mov qword [rsp + 0x88], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x29
call fcn.00403180
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
test rax, rax
jl 0x4090ab
lea rdx, [rax + 2]
mov rsi, qword [rsp + 0x28]
cmp rdx, rsi
jl 0x408f4a
xor eax, eax
lea rbx, [0x00655216]
mov ecx, 0x2e
mov rdi, qword [rsp + 0x88]
call fcn.0044c9c0
call fcn.00436d80
mov rdi, qword [rsp + 0x88]
movzx r8d, word [rdi + rax]
cmp r8w, 0x2e29
jne 0x408f2a
mov rcx, rdi
lea rdi, [rsp + 0x90]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004618d9
mov rbp, qword [rbp]
lea rsi, [0x00647222]
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], 0xd
mov rsi, qword [rsp + 0x80]
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0x30]
dec rsi
mov qword [rsp + 0xa8], rsi
lea rsi, [0x00644398]
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], 1
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], 1
mov rsi, qword [rsp + 0x38]
sub rsi, rax
add rsi, 0xfffffffffffffffc
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rsi, rdx
lea rdx, [rcx + rsi]
mov qword [rsp + 0xe0], rdx
mov qword [rsp + 0xe8], r8
lea rdx, [0x00649370]
mov qword [rsp + 0xf0], rdx
mov qword [rsp + 0xf8], 0x13
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
lea rdx, [0x0064522f]
mov qword [rsp + 0x110], rdx
mov qword [rsp + 0x118], 8
xor eax, eax
lea rbx, [rsp + 0x90]
mov ecx, 9
mov rdi, rcx
call fcn.0044c760
call fcn.0040a840
mov rbx, rax
lea rax, [0x0060b1e0]
call fcn.00436780
lea rax, [rsp + 0x40]
lea rbx, [0x00649a90]
mov ecx, 0x13
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x28]
call fcn.0044c9c0
call fcn.00436d80
lea rax, [rsp + 0x60]
lea rbx, [0x00649a7d]
mov ecx, 0x13
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x28]
call fcn.0044c9c0
call fcn.00436d80
nop
nop dword [rax]
call fcn.0045f280
jmp fcn.00408de0
Function at 0x409e80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x409f89
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, qword [r14 + 0x30]
cmp dword [rdx + 0xc0], 0
jne 0x409f77
mov rdx, qword [0x007d4138]
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
mov r8, rdi
shr rdi, 2
lea rdi, [rdi + rdi*2]
cmp rsi, rdi
jb 0x409f51
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x28], rax
lea rax, [r8 + r8]
lea rax, [rax + 2]
shl rax, 3
xor ebx, ebx
mov ecx, 1
call fcn.0040c9c0
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x18]
mov rsi, qword [rdx]
shl rsi, 1
mov qword [rax], rsi
movups xmmword [rsp + 0x30], xmm15
lea rsi, [0x004638c0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
nop dword [rax]
call fcn.0040ac80
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x18]
cmp qword [rsi + 8], rdx
jne 0x409f66
lea rax, [0x007d4138]
call fcn.00404260
mov rdx, qword [0x007d4138]
mov rax, qword [rsp + 0x28]
mov rbx, rax
mov rax, rdx
call fcn.00409fa0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00653070]
mov ebx, 0x27
call fcn.00436d80
lea rax, [0x00647cbf]
mov ebx, 0xf
call fcn.00436d80
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
jmp fcn.00409e80

Function at 0x40ad60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40ae86
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rcx, qword [rbx + 8]
inc rcx
mov qword [rbx + 8], rcx
mov rax, rbx
mov rbx, rcx
call fcn.0040b020
mov qword [rsp + 0x10], rax
nop dword [rax]
call fcn.0040b040
mov rcx, qword [rsp + 0x40]
cmp rax, rcx
jne 0x40adda
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rdx]
mov qword [rcx], rsi
mov rax, rsi
lock cmpxchg qword [rdx], rbx
sete sil
test sil, sil
je 0x40adb9
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x18], rax
call fcn.00438460
lea rax, [0x00654a81]
mov ebx, 0x2c
call fcn.00438d00
mov rax, qword [rsp + 0x40]
call fcn.00438c80
lea rax, [0x006448a8]
mov ebx, 5
call fcn.00438d00
mov rax, qword [rsp + 0x18]
nop
call fcn.00438b80
lea rax, [0x0064521f]
mov ebx, 8
call fcn.00438d00
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00438b80
lea rax, [0x00645688]
mov ebx, 9
call fcn.00438d00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438c80
call fcn.004386a0
call fcn.004384e0
lea rax, [0x00646af5]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0040ad60
Function at 0x40b5a0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
nop
test cl, cl
je 0x40b619
mov qword [rsp + 0x28], r14
test rbx, rbx
jge 0x40b5fb
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x007d4130]
cmp qword [rcx], 0
jne 0x40b7e5
mov rax, 0xffffffffffffffff
call fcn.004339e0
jmp 0x40b796
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x48], rbx
call fcn.00452f40
mov rbx, qword [rsp + 0x48]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40b645
cmp qword [rdx], 1
jne 0x40b62e
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0064f6a1]
mov ebx, 0x1e
call fcn.00436d80
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x007d4130]
cmp qword [rdx], 0
je 0x40b670
cmp rbx, 0x989680
jle 0x40b670
mov ebx, 0x989680
mov rax, rbx
call fcn.004339e0
test eax, eax
jge 0x40b6e6
mov rax, qword [0x007d4130]
mov rax, qword [rax]
test rax, rax
je 0x40b6b1
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.004610a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.00452f40
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40b63f
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x40b705
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rsi, qword [rcx]
mov rdi, qword [rdx + 0x30]
mov r8, rdi
cmp rsi, rdi
jne 0x40b733
mov rax, rsi
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
test dil, dil
je 0x40b705
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp rsi, 1
jne 0x40b785
mov byte [r8 + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.004339e0
test eax, eax
jl 0x40b770
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006564fe]
mov ebx, 0x32
nop dword [rax]
call fcn.00436d80
lea rax, [0x00656057]
mov ebx, 0x31
call fcn.00436d80
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [0x007d4130]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.004610a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, 0x989680
call fcn.004339e0
test eax, eax
jl 0x40b7b5
jmp 0x40b796