joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421b60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421bcf
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
test byte [rax], al
nop
nop dword [rax]
call fcn.0040b860
mov rcx, r14
mov rbx, qword [rsp + 0x30]
cmp qword [rbx + 8], rcx
jne 0x421bbd
mov byte [rbx + 0x10], 1
nop
lea rax, [0x006e9998]
mov ecx, 0xd
mov edi, 0x14
mov esi, 2
call fcn.00439520
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006c8dba]
mov ebx, 0x2e
call fcn.00436a00
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
nop
jmp fcn.00421b60

Function at 0x422200
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4222fe
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x422240
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x4222ef
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00422da0
nop dword [rax]
test rax, rax
je 0x4222ef
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00422340]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00463300
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x4222dd
xor eax, eax
jmp 0x4222e7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x422232
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00422200
Function at 0x4234a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4235fa
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x138]
test rdx, rdx
jne 0x423505
call fcn.00425bc0
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x130], rax
mov qword [rcx + 0x138], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x423588
mov rdi, qword [rax + 0x100]
mov r8, rbx
sub rbx, rdi
lea rdi, [rsi - 1]
nop
cmp rdi, 0x3f
jae 0x4235ec
shl rdi, 5
mov r9d, dword [rdx + rdi + 0x20]
add r9d, dword [rdx + rdi + 0x24]
nop dword [rax + rax]
cmp r9d, ebx
ja 0x4235db
cmp rsi, 0x3f
jne 0x42358b
mov qword [rsp + 0x10], rdx
call fcn.00425bc0
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x138], rax
mov r8, qword [rsp + 0x30]
mov rdx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
jmp 0x42358b
mov r8, rbx
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x3f
jae 0x4235ce
lea rsi, [rbx + 1]
mov qword [rdx + 0x10], rsi
shl rbx, 5
mov rsi, qword [rax + 0x100]
sub r8, rsi
mov dword [rdx + rbx + 0x20], r8d
mov esi, dword [rcx + 4]
mov dword [rdx + rbx + 0x24], esi
nop
mov qword [rdx + rbx + 0x28], rcx
inc qword [rax + 0x140]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rbx
mov ecx, 0x3f
call fcn.00465aa0
lea rax, [0x006c730a]
mov ebx, 0x29
call fcn.00436a00
mov rax, rdi
mov ecx, 0x3f
call fcn.00465aa0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004234a0
Function at 0x423920
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423aa6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
cmp dword [0x008ea9d8], ebx
je 0x423950
jmp 0x423a8f
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
btr ecx, 0x1f
dec ecx
nop word [rax + rax]
cmp ecx, 0x80000000
jae 0x423a7e
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x42394d
nop
cmp edx, 0x80000000
jne 0x423a74
cmp dword [0x00918dd0], 0
jle 0x423a6a
nop
mov rax, qword [0x009195b0]
mov qword [rsp + 0x18], rax
mov rcx, qword [0x008eaa00]
mov qword [rsp + 0x10], rcx
mov rdx, qword [0x008eaa10]
mov qword [rsp + 0x28], rdx
movsd xmm0, qword [0x008eaa18]
movsd qword [rsp + 0x20], xmm0
call fcn.00438340
lea rax, [0x006c2fd0]
mov ebx, 0x1f
nop dword [rax]
call fcn.00438c40
mov rax, qword [rsp + 0x18]
shr rax, 0x14
call fcn.00438940
lea rax, [0x006bb326]
mov ebx, 0xe
nop
call fcn.00438c40
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
sub rax, rcx
shr rax, 0x14
call fcn.00438940
lea rax, [0x006beeac]
mov ebx, 0x17
call fcn.00438c40
mov rax, qword [rsp + 0x10]
call fcn.00438940
lea rax, [0x006b9c25]
mov ebx, 0xa
call fcn.00438c40
movsd xmm0, qword [rsp + 0x20]
call fcn.00438640
lea rax, [0x006ba6cc]
mov ebx, 0xc
nop
call fcn.00438c40
call fcn.004383c0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006c4bfd]
mov ebx, 0x23
call fcn.00436a00
lea rax, [0x006c9bbc]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.00423920

Function at 0x423ae0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423bdf
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
jmp 0x423b00
inc dword [0x008c4258]
call fcn.00423e20
cmp rax, 0xffffffffffffffff
jne 0x423afa
mov edx, dword [0x008c425c]
btr edx, 0x1f
test edx, edx
jne 0x423bcd
mov eax, dword [0x008ea9d8]
mov dword [rsp + 0x14], eax
xor ecx, ecx
jmp 0x423b89
mov qword [rsp + 0x18], rcx
shl rdx, 6
mov qword [rsp + 0x28], rdx
lea rcx, [0x008eacd0]
lea rbx, [rcx + rdx]
lea rsi, [rax + rax*4]
mov qword [rsp + 0x20], rsi
lea rax, [rbx + rsi*8]
lea rax, [rax + 8]
call fcn.0042f540
mov rcx, qword [rsp + 0x28]
add rcx, 0x58
lea rdx, [0x008eacd0]
add rcx, rdx
mov rdx, qword [rsp + 0x20]
lea rax, [rcx + rdx*8]
call fcn.0042f540
mov rcx, qword [rsp + 0x18]
inc rcx
mov edx, dword [rsp + 0x14]
mov eax, edx
cmp rcx, 0x88
jge 0x423ba8
lea rdx, [rcx + rcx*2]
shr eax, 1
and eax, 1
dec eax
neg eax
nop
cmp rax, 2
jb 0x423b2b
jmp 0x423bc3
lea rax, [0x008c46a0]
call fcn.00421c00
call fcn.004292c0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov ecx, 2
call fcn.00465aa0
lea rax, [0x006c7f20]
mov ebx, 0x2c
call fcn.00436a00
nop
nop
call fcn.00463440
jmp fcn.00423ae0
Function at 0x4240a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4241e7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jne 0x4240da
cmp dword [rcx + 0xc0], 0
jne 0x4240da
mov rdx, r14
cmp qword [rcx], rdx
jne 0x4241d5
jmp 0x4240df
mov rax, rbx
nop
mov ecx, dword [0x008c425c]
mov edx, ecx
and ecx, 0x80000000
test ecx, ecx
jne 0x424116
lea esi, [rdx + 1]
mov rbx, rax
mov eax, edx
lea rdi, [0x008c425c]
lock cmpxchg dword [rdi], esi
sete dl
test dl, dl
je 0x4240dc
mov edx, dword [0x008ea9d8]
test ecx, ecx
jmp 0x42411f
mov edx, dword [0x008ea9d8]
mov rbx, rax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
sete byte [rsp + 0x14]
jne 0x4241b9
lea rax, [rsp + 0x10]
call fcn.00423d80
mov qword [rsp + 0x18], rax
test bl, bl
jne 0x424162
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
lea rax, [0x008c425c]
call fcn.00423920
mov rbx, qword [rsp + 0x20]
jmp 0x4241b9
lea rax, [rsp + 0x18]
xor ebx, ebx
call fcn.00424200
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
lea rax, [0x008c425c]
nop
call fcn.00423920
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006e9a68]
mov qword [rsp], rax
call fcn.00463300
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbx, rax
mov eax, dword [rbx + 0x58]
mov ecx, dword [rsp + 0x10]
cmp eax, ecx
je 0x4241cb
add ecx, 3
cmp eax, ecx
jne 0x42418f
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006c4631]
mov ebx, 0x22
call fcn.00436a00
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004240a0
Function at 0x426060
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42614c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
nop
lea rax, [0x008c4ab0]
call fcn.0040b860
cmp qword [0x008c4a60], 0
jne 0x42613a
mov qword [0x008c4a68], 0
mov rcx, qword [0x008c4ac8]
test rcx, rcx
jne 0x4260d0
nop
nop
lea rax, [0x008c4ab0]
call fcn.0040ba80
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rdx, [0x008c4ab8]
mov qword [rcx + 0x10], rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x4260c2
mov rcx, qword [0x008c4ab8]
nop dword [rax]
test rcx, rcx
je 0x426111
mov rdx, qword [0x008c4ad0]
mov qword [rdx], rcx
mov rcx, qword [0x008c4ab8]
mov rdx, qword [0x008c4ad0]
mov qword [rcx + 8], rdx
mov rcx, qword [0x008c4ac8]
mov qword [0x008c4ab8], rcx
jmp 0x42612d
mov rcx, qword [0x008c4ad0]
mov rdx, qword [0x008c4ac8]
mov qword [0x008c4ab8], rdx
mov qword [0x008c4ac0], rcx
movups xmmword [0x008c4ac8], xmm15
jmp 0x4260aa
lea rax, [0x006c6a86]
mov ebx, 0x28
call fcn.00436a00
nop
call fcn.00463440
jmp fcn.00426060

Function at 0x426f00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x426f3b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test cl, cl
je 0x426f29
xor edi, edi
call fcn.004272c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006cb835]
mov ebx, 0x3c
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00467ec0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00426f00

Function at 0x427060
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42717a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
xor edx, edx
jmp 0x427093
sub r12, rbx
lea rbx, [r12 + r9]
shr r12, 0xd
sub r11, r12
mov rax, rcx
mov rcx, r11
mov edx, r10d
test rcx, rcx
jbe 0x427119
test byte [rax], al
nop
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
cmp rdi, 0x40
jae 0x42716c
mov rdi, qword [rax + rdi*8 + 0x10170]
test byte [rdi], al
shr r8, 0x16
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x114c8]
mov r9, rbx
and ebx, 0x3fffff
cmp r8, rbx
seta r10b
mov r11, rcx
shl rcx, 0xd
lea r12, [rcx + rbx]
or r10d, edx
nop
cmp r12, 0x400000
jbe 0x42712b
mov r12d, 0x400000
jmp 0x42712b
mov rcx, rax
jmp 0x42707c
mov eax, edx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rcx
mov r8, rdx
cmp r12, r8
jbe 0x427111
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x114c8], r12
sete dl
test dl, dl
jne 0x42707c
mov rdx, qword [rdi + 0x114c8]
cmp rdx, r12
ja 0x427125
cmp rdx, rbx
jbe 0x427125
lea rax, [0x006ca261]
mov ebx, 0x33
call fcn.00436a00
mov rax, rdi
mov ecx, 0x40
call fcn.00465ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00427060
Function at 0x427b00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x427da2
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
test byte [rax], al
add rbx, 0x1ff
and rbx, 0xfffffffffffffe00
shl rbx, 0xd
mov rdx, qword [rax + 0x10400]
lea rsi, [rbx + rdx]
mov r8, qword [0x009187a8]
lea r9, [r8 - 1]
add r9, rsi
neg r8
and r8, r9
cmp qword [rax + 0x10408], r8
jb 0x427b69
nop dword [rax]
cmp rdx, rsi
jbe 0x427d09
mov qword [rsp + 0x58], rbx
lea rcx, [rax + 0x10390]
mov edi, 1
call fcn.0040c520
nop
test rax, rax
je 0x427c76
mov rdx, rax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsi + 0x10408]
cmp rax, rdi
jne 0x427baf
lea rdx, [rax + rbx]
mov qword [rsi + 0x10408], rdx
xor eax, eax
jmp 0x427c4e
mov rax, qword [rsi + 0x10400]
sub rdi, rax
test rdi, rdi
jne 0x427bc2
xor eax, eax
jmp 0x427c39
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rdi
mov rbx, rdi
lea rcx, [0x00919660]
nop dword [rax + rax]
call fcn.00417600
lea rax, [0x0091cf40]
call fcn.0042f8e0
mov rdx, qword [rsp + 0x48]
lock xadd qword [rax + 8], rdx
lea rax, [0x0091cf40]
call fcn.0042f9c0
mov rax, qword [rsp + 0x78]
lea rdx, [rax + 8]
mov rbx, qword [rax + 0x10400]
mov rcx, qword [rsp + 0x48]
mov rax, rdx
call fcn.004295c0
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x48]
mov rdi, rdx
mov qword [rsi + 0x10400], rdx
lea rdx, [rdi + rbx]
mov qword [rsi + 0x10408], rdx
mov r8, qword [0x009187a8]
mov rdx, qword [rsi + 0x10400]
mov rdi, qword [rsp + 0x58]
add rdx, rdi
lea rdi, [r8 - 1]
add rdx, rdi
neg r8
and r8, rdx
jmp 0x427d0e
mov rax, qword [0x00919668]
mov qword [rsp + 0x30], rax
mov rcx, qword [0x00919660]
mov qword [rsp + 0x28], rcx
mov rdx, qword [0x00919658]
mov qword [rsp + 0x20], rdx
call fcn.00438340
lea rax, [0x006c6ebe]
mov ebx, 0x28
call fcn.00438c40
mov rax, qword [rsp + 0x58]
call fcn.00438940
lea rax, [0x006bad3e]
mov ebx, 0xd
call fcn.00438c40
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
add rax, rcx
mov rcx, qword [rsp + 0x20]
add rax, rcx
call fcn.00438940
lea rax, [0x006b9866]
mov ebx, 9
call fcn.00438c40
call fcn.004383c0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rsi, rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsi + 0x10400]
mov qword [rsp + 0x38], rdx
mov qword [rsi + 0x10400], r8
mov rdi, rdx
sub r8, rdi
mov qword [rsp + 0x58], r8
mov rbx, r8
lea rcx, [0x00919660]
mov rax, rdx
nop
call fcn.00417600
lea rax, [0x0091cf40]
call fcn.0042f8e0
mov rdx, qword [rsp + 0x58]
lock xadd qword [rax + 8], rdx
lea rax, [0x0091cf40]
call fcn.0042f9c0
mov rax, qword [rsp + 0x78]
add rax, 8
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
nop dword [rax + rax]
call fcn.004295c0
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x40]
lea rax, [rsi + rdx]
mov ebx, 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop dword [rax + rax]
jmp fcn.00427b00
Function at 0x4283a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4284eb
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rbx + 0x10]
nop dword [rax]
cmp rax, rcx
jne 0x428411
cmp qword [rax], rbx
jne 0x4283d2
mov rcx, qword [rbx]
mov qword [rax], rcx
jmp 0x4283e0
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov qword [rcx], rdx
nop dword [rax]
cmp qword [rax + 8], rbx
jne 0x4283f0
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
jmp 0x4283fb
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
movups xmmword [rbx], xmm15
mov qword [rbx + 0x10], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x10], rcx
call fcn.00438340
lea rax, [0x006c8694]
mov ebx, 0x2d
call fcn.00438c40
mov rax, qword [rsp + 0x18]
call fcn.00438940
lea rax, [0x006b8d7b]
mov ebx, 6
nop
call fcn.00438c40
mov rax, qword [rsp + 0x40]
call fcn.00438c00
lea rax, [0x006b8d75]
mov ebx, 6
nop dword [rax + rax]
call fcn.00438c40
mov rax, qword [rsp + 0x10]
call fcn.00438c00
lea rax, [0x006ba1a3]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.00438c40
mov rax, qword [rsp + 0x20]
call fcn.00438c00
lea rax, [0x006b8d51]
mov ebx, 6
nop dword [rax + rax]
call fcn.00438c40
mov rax, qword [rsp + 0x38]
call fcn.00438c00
call fcn.004385a0
call fcn.004383c0
lea rax, [0x006bc081]
mov ebx, 0x10
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004283a0

Function at 0x428d60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428dea
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x18], rax
nop
lea rax, [0x008f1438]
call fcn.0040b860
lea rax, [0x008f13a8]
call fcn.00418d80
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x008f1438]
call fcn.0040ba80
mov rbx, qword [rsp + 0x10]
mov byte [rbx + 0xa], 2
mov rcx, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rax, qword [rsp + 0x18]
call fcn.00428640
test al, al
je 0x428dd8
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006c5bab]
mov ebx, 0x25
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00428d60
Function at 0x429440
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x429586
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, qword [0x00885400]
nop
cmp rdx, 0x15
ja 0x4294f5
mov qword [rsp + 0x38], rbx
test byte [rax], al
cmp dword [0x00918a90], 0
jne 0x429483
mov qword [rax + 0x100f8], rcx
jmp 0x42948f
lea rdi, [rax + 0x100f8]
call fcn.00465700
mov qword [rsp + 0x30], rax
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call fcn.0042ea00
mov rax, qword [rsp + 0x30]
call fcn.0042b740
mov rcx, qword [0x00883568]
mov rdi, qword [rsp + 0x30]
mov qword [rdi + 0x10078], rcx
cmp dword [0x00918a90], 0
jne 0x4294da
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x100f0], rax
jmp 0x4294eb
add rdi, 0x100f0
mov rax, qword [rsp + 0x38]
call fcn.00465600
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rdx
cmp rdx, 0x40
sbb rax, rax
mov qword [rsp + 0x10], rax
call fcn.00438340
lea rax, [0x006c373b]
mov ebx, 0x20
call fcn.00438c40
mov rcx, qword [rsp + 0x18]
mov eax, 1
shl rax, cl
mov rcx, qword [rsp + 0x10]
and rax, rcx
call fcn.00438a40
call fcn.004385a0
nop dword [rax + rax]
call fcn.004383c0
call fcn.00438340
lea rax, [0x006c23ec]
mov ebx, 0x1d
call fcn.00438c40
mov eax, 0x200000
call fcn.00438a40
call fcn.004385a0
call fcn.004383c0
lea rax, [0x006c7c96]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00429440
Function at 0x42b740
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42b8d7
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov rdx, qword [0x00885440]
mov qword [rsp + 0x50], rdx
movups xmm0, xmmword [0x00885448]
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [0x00885458]
movups xmmword [rsp + 0x68], xmm0
xor ecx, ecx
jmp 0x42b78f
lea rcx, [r8 + 1]
mov rax, rsi
cmp rcx, 5
jge 0x42b852
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + rcx*8 + 0x50]
add rdx, 0xffffffffffffffd0
neg rdx
cmp rdx, 0x40
sbb rsi, rsi
mov rcx, rdx
mov edi, 1
shl rdi, cl
and rdi, rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [0x009187a8]
nop
lea rdx, [rbx + rdi*8]
dec rdx
neg rbx
and rbx, rdx
xor eax, eax
nop dword [rax + rax]
call fcn.00417be0
test rax, rax
je 0x42b8c5
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x48], rdx
mov rsi, qword [rsp + 0x88]
test byte [rsi], al
mov r8, qword [rsp + 0x10]
lea r9, [r8 + r8*2]
mov r10, qword [rsp + 0x38]
mov qword [rsi + r9*8 + 8], 0
mov qword [rsi + r9*8 + 0x10], rdx
lea rdi, [rsi + r9*8]
cmp dword [0x00918a90], 0
jne 0x42b845
mov qword [rsi + r9*8], r10
nop dword [rax]
jmp 0x42b788
mov rdx, r10
call fcn.00465720
jmp 0x42b788
nop
xor eax, eax
mov ebx, 0x800000
call fcn.00417be0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x800000
mov qword [rsp + 0x30], 0x800000
mov rdi, qword [rsp + 0x88]
test byte [rdi], al
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov qword [rdi + 0x100c8], rdx
mov qword [rdi + 0x100d0], rsi
cmp dword [0x00918a90], 0
jne 0x42b8af
mov qword [rdi + 0x100c0], rcx
jmp 0x42b8bb
add rdi, 0x100c0
call fcn.00465700
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006c5980]
mov ebx, 0x25
call fcn.00436a00
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0042b740
Function at 0x42df40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42df8d
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
nop
test rcx, rcx
je 0x42df7b
lea rbx, [0x006e9988]
call fcn.0042dfa0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006c81b4]
mov ebx, 0x2c
call fcn.00436a00
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0042df40

Function at 0x42e100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42e246
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop
mov ecx, dword [rax + 0x90]
nop
cmp ecx, 2
je 0x42e1f9
nop
mov ecx, 1
lea rdx, [0x008be848]
lock xadd qword [rdx], rcx
mov rdx, qword [0x008be858]
cmp rcx, rdx
jge 0x42e1e7
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x18], xmm15
mov qword [rsp + 0x28], 0
lea rdx, [0x0042e260]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp], rdx
call fcn.00463300
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [0x008be868]
mov rcx, qword [0x008be870]
test rax, rax
je 0x42e1dd
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + 0x168]
mov rbx, qword [rsp + 0x10]
nop
cmp rbx, rcx
jae 0x42e1f1
lea rdi, [rax + rbx*8]
cmp dword [0x00918a90], 0
jne 0x42e1d8
mov qword [rax + rbx*8], rdx
jmp 0x42e1dd
call fcn.00465720
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rbx
call fcn.00465aa0
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x10], rax
call fcn.00438340
lea rax, [0x006c1f9e]
mov ebx, 0x1d
call fcn.00438c40
mov rax, qword [rsp + 0x10]
call fcn.00438940
call fcn.004385a0
call fcn.004383c0
lea rax, [0x006c5f0a]
mov ebx, 0x26
nop dword [rax + rax]
call fcn.00436a00
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0042e100

Function at 0x42e880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42e8d1
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
movabs rcx, 0x800000000000
lea rdx, [rcx + rax]
cmp rax, rdx
setbe dl
add rcx, rbx
cmp rbx, rcx
setbe cl
cmp cl, dl
jne 0x42e8bf
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006cb7bd]
mov ebx, 0x3c
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0042e880