joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004410
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140070080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov qword [rsp + 0x38], rdx
xor r15d, r15d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov ecx, 0x10025
call fcn.140020650
test rax, rax
je 0x140004576
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov qword [rsp + 0x40], rdi
lea rbx, [rdi + 0xfffe]
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0xfffe
mov rcx, rdi
call fcn.14003ae80
mov qword [rsp + 0x48], rbx
mov rax, rsi
cmp qword [rsi + 0x18], 7
jbe 0x1400044a0
mov rax, qword [rsi]
mov r9, qword [rsp + 0x40]
sub rbx, r9
sar rbx, 1
cmp qword [r14 + 0x18], 7
jbe 0x1400044b5
mov r14, qword [r14]
lea rcx, [rsi + 0x20]
cmp qword [rcx + 0x18], 7
jbe 0x1400044c3
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r8, [0x1400648d0]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
mov rdx, qword [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140004500
mov rcx, rbp
call fcn.140006880
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140004552
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rdi, rcx
cmp rdx, 0x1000
jb 0x14000454d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rdi, rcx
add rdi, 0xfffffffffffffff8
cmp rdi, 0x1f
ja 0x140004576
call fcn.140020694
mov rax, rbp
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140020630
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14002737c
int3
Function at 0x1400107e0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140070080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor r13d, r13d
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x14001098a
xorps xmm0, xmm0
lea r12d, [rax + 1]
movsxd r14, r12d
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
test r12d, r12d
je 0x1400108ba
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x1400109d8
lea rsi, [r14 + r14]
cmp rsi, 0x1000
jb 0x140010885
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x1400109de
call fcn.140020650
test rax, rax
je 0x1400109d2
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14001089a
test rsi, rsi
je 0x140010897
mov rcx, rsi
call fcn.140020650
mov rdi, rax
jmp 0x14001089a
mov rdi, r13
mov qword [rsp + 0x30], rdi
lea rbp, [rsi + rdi]
mov qword [rsp + 0x40], rbp
mov r8, rsi
xor edx, edx
mov rcx, rdi
call fcn.14003ae80
mov qword [rsp + 0x38], rbp
mov r8d, r12d
mov rdx, qword [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x14001094c
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov rdx, qword [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400108f0
mov rcx, rbx
call fcn.140006880
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400109aa
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rdi, rcx
cmp rdx, 0x1000
jb 0x140010945
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rdi, rcx
add rdi, 0xfffffffffffffff8
cmp rdi, 0x1f
ja 0x1400109d2
call fcn.140020694
jmp 0x1400109aa
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001098a
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010985
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400109d2
call fcn.140020694
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
xor r8d, r8d
lea rdx, [0x1400648d0]
mov rcx, rbx
call fcn.140006880
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140020630
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002737c
int3
call fcn.140006a80
int3
call fcn.140001180
int3
Function at 0x140013450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x140070080]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
xor ebx, ebx
lea rdi, [0x140072c90]
mov qword [rsp + 0x20], rdi
mov byte [0x140072c90], 1
xorps xmm0, xmm0
movups xmmword [0x140072c98], xmm0
mov qword [0x140072ca8], rbx
mov qword [0x140072cb0], rbx
xor r8d, r8d
lea rdx, [0x1400648d0]
lea rcx, [0x140072c98]
call fcn.140006880
nop
mov qword [0x140072cb8], rbx
xorps xmm0, xmm0
movups xmmword [0x140072cc0], xmm0
movups xmmword [0x140072cd0], xmm0
movups xmmword [0x140072ce0], xmm0
movups xmmword [0x140072cf0], xmm0
movups xmmword [0x140072d00], xmm0
mov dword [0x140072cc0], ebx
mov qword [0x140072cc8], rbx
mov qword [0x140072cd0], rbx
movups xmmword [0x140072cd8], xmm0
movups xmmword [0x140072ce8], xmm0
movups xmmword [0x140072cf8], xmm0
mov qword [0x140072d08], rbx
lea edx, [rbx + 2]
lea rcx, [0x140072cc0]
call fcn.14001ff90
nop
lea rcx, [rsp + 0x70]
call fcn.1400131b0
nop
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 7
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001355a
mov byte [0x140072c90], bl
lea rcx, [rsp + 0x50]
call fcn.140012f30
nop
lea r8, [rsp + 0x70]
cmp qword [rsp + 0x88], 7
cmova r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x80]
xor edx, edx
mov rcx, rax
call fcn.140006970
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rcx, [rdi + 8]
lea rdx, [rsp + 0x30]
call fcn.140014220
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400135fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400135f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400136a7
call fcn.140020694
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14001363b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013635
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400136ad
call fcn.140020694
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 7
jbe 0x14001367d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013677
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400136a1
call fcn.140020694
nop
mov rax, rdi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140020630
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
call fcn.14002737c
nop
call fcn.14002737c
nop
call fcn.14002737c
int3
Function at 0x140015be0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [0x140070080]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jne 0x140015e01
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x510
call fcn.14003ae80
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.140018d60
mov ebx, 1
lea r8, str.app_audio_loopback_mutex
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140015dd6
mov qword [rsp + 0x5e8], rsi
lea rcx, [rbx - 6]
mov qword [rsp + 0x5f0], rdi
call qword [sym.imp.USER32.dll_IsValidDpiAwarenessContext]
test eax, eax
je 0x140015c87
lea rcx, [rbx - 6]
call qword [sym.imp.USER32.dll_SetProcessDpiAwarenessContext]
mov rcx, qword [rbp - 0x50]
lea rax, [0x14001aa80]
xor esi, esi
mov dword [rsp + 0x60], 0x50
mov dword [rsp + 0x64], 3
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rsi
lea edx, [rsi + 0x65]
mov qword [rsp + 0x78], rcx
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x80], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
movdqa xmm0, xmmword [0x140068390]
lea rdi, str.app_audio_loopback_mainwindow
mov rcx, qword [rbp - 0x50]
lea edx, [rsi + 0x65]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x60], rdi
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x58], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
lea rax, [rbp - 0x50]
mov r9d, 0xc80000
mov qword [rsp + 0x58], rax
lea r8, [0x140067f40]
mov rax, qword [rbp - 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rdi, qword [rsp + 0x5f0]
mov rsi, qword [rsp + 0x5e8]
mov qword [rbp - 0x48], rax
test rax, rax
je 0x140015dd6
call qword [sym.imp.ole32.dll_CoUninitialize]
xor r9d, r9d
lea rcx, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140015dd0
nop word [rax + rax]
mov rcx, qword [rbp - 0x48]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140015db9
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140015d90
mov ebx, dword [rsp + 0x70]
jmp 0x140015ddc
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rbp + 0x4a0]
call fcn.14001ab90
lea rcx, [rbp + 0x400]
call fcn.140010b70
lea rcx, [rbp - 0x20]
call fcn.140004350
mov eax, ebx
jmp 0x140015e03
xor eax, eax
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.140020630
mov rbx, qword [rsp + 0x5f8]
add rsp, 0x5d0
pop rbp
ret
Function at 0x1400212c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002130e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002130e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002130e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002130e
cmp dword [rcx + 0x84], 0xe
jbe 0x14002130e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140021310
xor al, al
add rsp, 0x28
ret

Function at 0x14002b094
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002ae90
Function at 0x140033ef4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140033f7b
mov rsi, rbx
cmp word [rax], bp
je 0x140033f3a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140033f24
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140033f20
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14002fa10
mov rdi, rax
test rax, rax
je 0x140033f68
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14003a7e0
mov rbp, rdi
xor ecx, ecx
call fcn.14002ea5c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140036e00
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14002e4f4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140036ea1
cmp ebx, dword [rsp + 0x30]
je 0x140036e9a
test esi, esi
je 0x140036e9a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140036e75
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140036e82
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140036e5f
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140036e86
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140036ea3
mov eax, 1
jmp 0x140036ea3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003a570
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003a598
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003a598
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x404ea0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, rcx
shr rcx, 6
mov rsi, rcx
shl rcx, 6
nop
nop
sub rdx, rcx
add rdi, rdx
mov qword [rsp + 0x28], rdi
add rbx, rsi
add rcx, rax
mov qword [rsp + 0x30], rcx
xor eax, eax
xor esi, esi
jmp 0x404ee0
add rax, 8
nop
cmp rax, rdi
jae 0x404f4a
test rax, 0x3f
jne 0x404ef5
movzx esi, byte [rbx]
inc rbx
jmp 0x404ef7
shr esi, 1
test rdx, rdx
jbe 0x404f02
add rdx, 0xfffffffffffffff8
jmp 0x404eda
bt esi, 0
jae 0x404eda
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x14], esi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rcx + rax]
mov rax, rdx
call fcn.00404700
test al, al
jne 0x404f54
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
mov esi, dword [rsp + 0x14]
mov rdi, qword [rsp + 0x28]
jmp 0x404eda
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00734457]
mov ebx, 0x24
call fcn.00436360
nop
int3

Function at 0x40a100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a226
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, qword [r14 + 0x30]
cmp dword [rdx + 0xc0], 0
jne 0x40a210
mov rdx, qword [0x0096e348]
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
mov r8, rdi
shr rdi, 2
lea rdi, [rdi + rdi*2]
cmp rsi, rdi
jb 0x40a1ea
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x28], rax
lea rax, [r8 + r8]
lea rax, [rax + 2]
shl rax, 3
xor ebx, ebx
mov ecx, 1
call fcn.0040ca20
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x18]
mov rsi, qword [rdx]
shl rsi, 1
mov qword [rax], rsi
movups xmmword [rsp + 0x30], xmm15
lea rsi, [0x00465760]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
nop dword [rax]
call fcn.0040b020
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x18]
cmp qword [rsi + 8], rdx
jne 0x40a1ff
nop
cmp byte [0x009d0300], 0
je 0x40a1d4
lea rax, [0x0096e348]
call fcn.00403e80
mov rbx, qword [rsp + 0x20]
lea rcx, [0x0096e348]
xchg qword [rcx], rbx
mov rdx, qword [0x0096e348]
mov rax, qword [rsp + 0x28]
mov rbx, rax
mov rax, rdx
call fcn.0040a240
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00735b1d]
mov ebx, 0x27
call fcn.00436360
lea rax, [0x0072a16c]
mov ebx, 0xf
nop dword [rax]
call fcn.00436360
nop
mov qword [rsp + 8], rax
call fcn.00460d80
mov rax, qword [rsp + 8]
jmp fcn.0040a100
Function at 0x40b0e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40b206
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rbx + 8]
inc rcx
mov qword [rbx + 8], rcx
nop
mov rdx, rbx
shl rbx, 0x10
mov rsi, rcx
and ecx, 0x7ffff
or rbx, rcx
mov rcx, rbx
sar rbx, 0x13
shl rbx, 3
cmp rdx, rbx
je 0x40b12c
jmp 0x40b14e
mov rax, rsi
mov rbx, qword [rax]
mov qword [rdx], rbx
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rsi], rcx
sete bl
test bl, bl
je 0x40b129
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x20], rbx
call fcn.00437b00
lea rax, [0x00737805]
mov ebx, 0x2c
call fcn.00438400
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.00438380
lea rax, [0x00726fcd]
mov ebx, 5
call fcn.00438400
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00438260
lea rax, [0x00727985]
mov ebx, 8
call fcn.00438400
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00438260
lea rax, [0x00727df6]
mov ebx, 9
call fcn.00438400
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438380
call fcn.00437d60
call fcn.00437b80
lea rax, [0x007291d2]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00436360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460d80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0040b0e0
Function at 0x40b800
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
nop
test cl, cl
je 0x40b891
mov qword [rsp + 0x28], r14
test rbx, rbx
jge 0x40b85b
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x0096e340]
cmp qword [rcx], 0
jne 0x40ba7f
mov rax, 0xffffffffffffffff
call fcn.00432540
jmp 0x40ba30
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x48], rbx
call fcn.00464d80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x48]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40b8bd
cmp qword [rdx], 1
jne 0x40b8a6
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x007317f2]
mov ebx, 0x1e
call fcn.00436360
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x0096e340]
cmp qword [rdx], 0
je 0x40b8ee
nop word [rax + rax]
cmp rbx, 0x989680
jle 0x40b8ee
mov ebx, 0x989680
mov rax, rbx
call fcn.00432540
test eax, eax
jge 0x40b982
mov rax, qword [0x0096e340]
mov rax, qword [rax]
test rax, rax
je 0x40b933
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00462ba0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.00464d80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40b8b7
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
nop
jmp 0x40b9a1
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rsi, qword [rcx]
mov rdi, qword [rdx + 0x30]
mov r8, rdi
cmp rsi, rdi
jne 0x40b9d1
mov rax, rsi
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
nop
test dil, dil
je 0x40b9a1
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp rsi, 1
jne 0x40ba1f
mov byte [r8 + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.00432540
test eax, eax
jl 0x40ba0e
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0073973f]
mov ebx, 0x32
call fcn.00436360
lea rax, [0x007391a3]
mov ebx, 0x31
call fcn.00436360
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [0x0096e340]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00462ba0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, 0x989680
call fcn.00432540
test eax, eax
jl 0x40ba4f
jmp 0x40ba30
Function at 0x40bce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40bfde
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [0x00926924], 0x10
jne 0x40bfcc
xor eax, eax
jmp 0x40bd27
lea rdx, [rax + rax*2]
lea rsi, [0x00926920]
movzx edi, word [rsi + rax*2]
lea r8, [0x009d5790]
mov dword [r8 + rdx*8], edi
inc rax
cmp rax, 0x44
jl 0x40bd0a
mov rdx, qword [0x009d00d0]
test rdx, rdx
je 0x40bfbb
nop dword [rax]
cmp rdx, 0x80000
ja 0x40bf4c
cmp rdx, 0x1000
jb 0x40bee0
lea rbx, [rdx - 1]
nop
test rdx, rbx
jne 0x40be8e
mov rdx, qword [0x009d00c8]
lea rbx, [rdx - 1]
test rdx, rbx
jne 0x40be45
nop dword [rax]
cmp rdx, 0x400000
jbe 0x40bd94
mov qword [0x009d00c8], 0
cmp qword [0x009d00c8], 0
jne 0x40be1a
lea rax, [0x009921c0]
call fcn.00426280
call fcn.00416800
mov qword [0x009d0088], rax
mov eax, 0x7f
jmp 0x40be00
mov qword [rsp + 0x10], rax
lea rax, [0x009a8d68]
call fcn.004192a0
mov rcx, qword [rsp + 0x10]
mov rdx, rcx
shl rcx, 0x28
movabs rbx, 0xc000000000
or rcx, rbx
mov qword [rax], rcx
mov rcx, qword [0x009a2570]
mov qword [rax + 0x10], rcx
mov qword [0x009a2570], rax
lea rax, [rdx - 1]
test rax, rax
jge 0x40bdbd
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rdx, [rcx + 1]
mov qword [0x009d00c0], rdx
mov rcx, qword [0x009d00c0]
cmp rcx, 0x40
sbb rdx, rdx
mov ebx, 1
shl rbx, cl
and rbx, rdx
cmp qword [0x009d00c8], rbx
jne 0x40be0f
nop dword [rax]
jmp 0x40bd9e
call fcn.00437b00
lea rax, [0x0072e1a5]
mov ebx, 0x17
call fcn.00438400
mov rax, qword [0x009d00c8]
call fcn.00438100
lea rax, [0x0072d84d]
mov ebx, 0x17
call fcn.00438400
call fcn.00437b80
lea rax, [0x0072ec62]
mov ebx, 0x19
call fcn.00436360
call fcn.00437b00
lea rax, [0x0072b63a]
mov ebx, 0x12
nop
call fcn.00438400
mov rax, qword [0x009d00d0]
call fcn.00438100
lea rax, [0x0072d84d]
mov ebx, 0x17
nop dword [rax]
call fcn.00438400
call fcn.00437b80
lea rax, [0x0072c378]
mov ebx, 0x14
call fcn.00436360
nop dword [rax + rax]
call fcn.00437b00
lea rax, [0x0072b63a]
mov ebx, 0x12
call fcn.00438400
mov rax, qword [0x009d00d0]
nop dword [rax]
call fcn.00438100
lea rax, [0x00734b5f]
mov ebx, 0x25
call fcn.00438400
mov eax, 0x1000
nop dword [rax + rax]
call fcn.00438200
lea rax, [0x00726ac2]
mov ebx, 2
call fcn.00438400
call fcn.00437b80
lea rax, [0x0072c378]
mov ebx, 0x14
call fcn.00436360
call fcn.00437b00
lea rax, [0x0072b63a]
mov ebx, 0x12
nop dword [rax]
call fcn.00438400
mov rax, qword [0x009d00d0]
call fcn.00438100
lea rax, [0x00734337]
mov ebx, 0x24
nop dword [rax]
call fcn.00438400
mov eax, 0x80000
call fcn.00438200
lea rax, [0x00726ac2]
mov ebx, 2
nop dword [rax + rax]
call fcn.00438400
call fcn.00437b80
lea rax, [0x0072c378]
mov ebx, 0x14
call fcn.00436360
lea rax, [0x0073164e]
mov ebx, 0x1e
call fcn.00436360
lea rax, [0x0072ac22]
mov ebx, 0x11
call fcn.00436360
nop
nop
call fcn.00460d80
jmp fcn.0040bce0