joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c800
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c9f3
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x40c9e5
mov qword [rsp + 0x30], rdx
mov byte [rsp + 0x50], bl
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + rdx*8 + 0x28]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.00413cc0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x38]
cmp rax, rdx
jne 0x40c8af
mov qword [rsp + 0x20], rdx
movzx ecx, word [rcx + 0x60]
cmp rdx, rcx
jne 0x40c976
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x48]
movzx ebx, byte [rsp + 0x50]
nop dword [rax]
call fcn.00416a80
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx + rcx*8 + 0x28]
mov qword [rsp + 0x28], rax
call fcn.00413cc0
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
jmp 0x40c8b2
mov rbx, rax
cmp qword [rcx + 0x38], rax
jbe 0x40c965
mov rsi, qword [rcx + 0x68]
imul rax, rsi
add rax, qword [rcx + 0x18]
movzx esi, word [rcx + 0x60]
inc esi
mov word [rcx + 0x60], si
movzx edi, si
mov r8, qword [rcx + 0x38]
cmp r8, rdi
jb 0x40c8f3
cmp rbx, rdx
sete dl
mov rbx, rcx
mov ecx, edx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov word [rsp + 0x16], si
mov qword [rsp + 0x20], r8
nop dword [rax]
call fcn.00437b00
lea rax, [0x00729cc1]
mov ebx, 0xe
call fcn.00438400
movzx eax, word [rsp + 0x16]
movzx eax, ax
nop
call fcn.00438100
lea rax, [0x00728809]
mov ebx, 0xb
call fcn.00438400
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
lea rax, [0x0072e035]
mov ebx, 0x17
nop dword [rax + rax]
call fcn.00436360
lea rax, [0x0072d3be]
mov ebx, 0x16
call fcn.00436360
mov word [rsp + 0x16], cx
nop dword [rax + rax]
call fcn.00437b00
lea rax, [0x0072e01e]
mov ebx, 0x17
call fcn.00438400
movzx eax, word [rsp + 0x16]
nop dword [rax + rax]
call fcn.00438100
lea rax, [0x00728809]
mov ebx, 0xb
call fcn.00438400
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
lea rax, [0x007391d4]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.00436360
mov rax, rdx
mov ecx, 0x88
call fcn.00463460
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax]
call fcn.00460d80
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0040c800
Function at 0x40d4a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d52d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp rbx, 1
je 0x40d4fc
mov rdx, qword [rax]
mov rcx, rax
mov rax, rbx
mul rdx
jo 0x40d519
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x40d519
nop dword [rax + rax]
test rbx, rbx
jl 0x40d519
mov rbx, rcx
mov ecx, 1
call fcn.0040ca20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rax]
mov rbx, rax
mov ecx, 1
mov rax, rdx
call fcn.0040ca20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d6be0]
lea rbx, [0x007ae280]
call fcn.00435be0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460d80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0040d4a0
Function at 0x40d8c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40db57
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rax, rax
je 0x40db45
test rbx, rbx
je 0x40d90e
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40db30
nop dword [rax + rax]
cmp rbx, 0x2000
jbe 0x40d913
jmp 0x40db1f
mov ebx, 8
cmp rax, 0x10000
jae 0x40d9e5
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40d95e
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40d95e
test byte [rsi], al
add rsi, 0x11f0
jmp 0x40d987
nop
nop
lea rax, [0x009d0330]
call fcn.0040b340
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x009d0338]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
mov qword [rsi + 8], rdi
add rdi, rax
cmp rdi, 0x40000
ja 0x40d9b9
cmp qword [rsi], 0
jne 0x40d9f7
mov eax, 0x40000
lea rbx, [0x009d4760]
call fcn.00417b60
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
jne 0x40daa3
nop dword [rax]
jmp 0x40daf2
mov rbx, rcx
call fcn.00417b60
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
nop
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
mov dword [rdx + 0xd8], r10d
lea rdx, [rdi + r8]
nop dword [rax]
cmp r9d, 1
jne 0x40da38
cmp byte [r14 + 0xb1], 0
je 0x40da38
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdx
lea rdi, [0x009d0338]
cmp rsi, rdi
jne 0x40da66
nop
nop
lea rax, [0x009d0330]
call fcn.0040b560
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
lea rsi, [0x009d4760]
cmp rcx, rsi
je 0x40da96
mov rbx, rax
mov rax, rcx
call fcn.0042ee20
mov rbx, qword [rsp + 0x48]
neg rbx
lea rax, [0x009d4760]
call fcn.0042ee20
mov rdx, qword [rsp + 0x30]
mov rax, rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rcx]
mov rax, qword [0x009d00b8]
mov qword [rdx], rax
mov rdx, qword [rcx]
lea rsi, [0x009d00b8]
lock cmpxchg qword [rsi], rdx
sete dl
test dl, dl
je 0x40daa3
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x58]
jmp 0x40d9f7
lea rdx, [0x009d0338]
cmp rcx, rdx
je 0x40db0f
lea rax, [0x00732071]
mov ebx, 0x1f
call fcn.00436360
nop
nop
lea rax, [0x009d0330]
call fcn.0040b560
jmp 0x40dafe
lea rax, [0x00733f85]
mov ebx, 0x23
call fcn.00436360
lea rax, [0x00736dbc]
mov ebx, 0x2a
nop dword [rax]
call fcn.00436360
lea rax, [0x0072f7d5]
mov ebx, 0x1a
call fcn.00436360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004654c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040d8c0
Function at 0x414860
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, rbx
or rbx, rax
or rbx, rcx
nop word [rax + rax]
test rbx, 7
jne 0x414a45
cmp byte [0x009d0304], 0
je 0x41492f
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
test byte [rsi], al
nop
movabs r8, 0x800000000000
add r8, rax
mov r9, r8
shr r8, 0x2a
nop dword [rax]
cmp r8, 0x40
jae 0x414a35
lea r10, [0x009a2350]
mov r8, qword [r10 + r8*8]
test byte [r8], al
shr r9, 0x16
mov r10, r9
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test r8, r8
je 0x414910
mov r11, rax
shr rax, 5
and eax, 0x1ffff
lea r12, [r8 + rax]
shr r11, 3
and r11d, 3
add r8, 0x1ffff
jmp 0x41491c
xor r10d, r10d
xor r11d, r11d
xor r8d, r8d
xor r12d, r12d
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rsi
xor eax, eax
jmp 0x414940
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rax, 8
mov r11d, r9d
cmp rcx, rax
jbe 0x414a2b
mov qword [rsp + 0x20], rax
movzx r9d, byte [r12]
bt r9d, r11d
jae 0x4149d3
lea r9, [rax + rdx]
mov r13, qword [rsi + 0x1260]
mov r9, qword [r9]
mov qword [r13], 0
mov qword [r13 + 8], r9
mov r9, qword [rsi + 0x1260]
add r9, 0x10
mov qword [rsi + 0x1260], r9
cmp qword [rsi + 0x1268], r9
jne 0x4149d3
mov dword [rsp + 0x18], r11d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x1c], r10d
xor eax, eax
xor ebx, ebx
call fcn.0042f120
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r10d, dword [rsp + 0x1c]
mov r11d, dword [rsp + 0x18]
mov r12, qword [rsp + 0x38]
cmp r11d, 3
jae 0x4149e5
lea r9d, [r11 + 1]
nop dword [rax]
jmp 0x414939
cmp r8, r12
je 0x4149f5
inc r12
xor r9d, r9d
jmp 0x414939
mov rax, r12
mov ebx, r11d
mov ecx, r10d
mov rdi, r8
call fcn.004141c0
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r10d, ecx
mov r9d, ebx
mov r8, rdi
mov r12, rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
jmp 0x414939
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, r8
mov ecx, 0x40
nop dword [rax]
call fcn.00463480
lea rax, [0x00735fb6]
mov ebx, 0x28
call fcn.00436360
nop
int3
Function at 0x416a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416c8a
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x416c7c
mov rcx, qword [rax + rdx*8 + 0x28]
movzx esi, word [rcx + 0x60]
nop word [rax + rax]
nop
cmp qword [rcx + 0x38], rsi
jne 0x416c6b
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x20], rdx
lea rsi, [0x009d08e0]
nop
cmp rcx, rsi
je 0x416b17
mov esi, dword [0x009a22f0]
add esi, 3
cmp dword [rcx + 0x58], esi
jne 0x416c5a
lea rsi, [rdx + rdx*2]
shl rsi, 6
lea rdi, [0x009a25f8]
lea rax, [rsi + rdi]
mov rbx, rcx
call fcn.00417540
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx + rdx*2]
shl rcx, 6
lea rbx, [0x009a25f8]
lea rax, [rcx + rbx]
call fcn.004171c0
test rax, rax
je 0x416c49
movzx ecx, word [rax + 0x60]
nop dword [rax]
cmp qword [rax + 0x38], rcx
je 0x416c38
mov qword [rsp + 0x18], rax
mov ecx, dword [0x009a22f0]
add ecx, 3
mov dword [rax + 0x58], ecx
lea rax, [0x009d5e08]
call fcn.0042eee0
test byte [rax], al
movzx ecx, byte [rsp + 0x40]
mov edx, ecx
shr cl, 1
movsx rcx, cl
nop word [rax + rax]
nop
cmp rcx, 0x44
jae 0x416c2b
lea rcx, [rax + rcx*8]
lea rcx, [rcx + 0x48]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rbx + 0x38]
movzx edi, word [rbx + 0x60]
sub rsi, rdi
lock xadd qword [rcx], rsi
cmp dl, 5
jne 0x416bc3
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x20]
lock xadd qword [rax + 0x30], rdx
mov qword [rcx + 0x20], 0
lea rax, [0x009d5e08]
call fcn.0042efc0
mov rcx, qword [rsp + 0x18]
movzx edx, word [rcx + 0x60]
mov rbx, qword [rcx + 0x68]
imul rdx, rbx
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
sub rbx, rdx
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rdx + 8]
lea rax, [0x009d0d00]
mov rcx, rsi
nop
call fcn.00420e40
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 8], 0
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov qword [rcx + rdx*8 + 0x28], rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rcx
mov ecx, 0x44
call fcn.00463460
lea rax, [0x0072d6d6]
mov ebx, 0x16
call fcn.00436360
lea rax, [0x007297be]
mov ebx, 0xd
call fcn.00436360
lea rax, [0x0072d2f8]
mov ebx, 0x16
call fcn.00436360
lea rax, [0x007362ae]
mov ebx, 0x28
call fcn.00436360
mov rax, rdx
mov ecx, 0x88
call fcn.00463460
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00460d80
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00416a80
Function at 0x417540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417606
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x4175ef
mov ecx, dword [0x009a22f0]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x417582
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x417589
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x4175cf
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
test rdx, rdx
jle 0x4175b5
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.0042e880
jmp 0x4175e5
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
call fcn.0042e880
jmp 0x4175e5
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
nop dword [rax + rax]
call fcn.004240a0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00734a87]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00436360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460d80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00417540
Function at 0x417be0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417d8b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00920228]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433500
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x417c4e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417c61
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417c85
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417c99
cmp rbx, 0x1000
jae 0x417c58
nop
jmp 0x417d09
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x417cad
xor edx, edx
jmp 0x417d00
mov rcx, qword [0x00920228]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433500
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x417c8f
jmp 0x417c75
call fcn.00464920
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437b00
lea rax, [0x0072e856]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00438400
mov rax, qword [rsp + 0x38]
call fcn.00438100
lea rax, [0x0072e9a6]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438400
mov rax, qword [rsp + 0x30]
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
lea rax, [0x007330a4]
mov ebx, 0x21
call fcn.00436360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460d80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417be0
Function at 0x417dc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417fea
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00920230]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433580
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417e3b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x417e4e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417e70
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417e84
cmp rbx, 0x1000
jae 0x417e45
jmp 0x417f0e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417e96
xor esi, esi
jmp 0x417f00
mov rax, qword [0x00920230]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433580
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x417e7a
jmp 0x417e62
call fcn.00464920
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417f89
call fcn.00437b00
lea rax, [0x0072efff]
mov ebx, 0x19
call fcn.00438400
mov rax, qword [rsp + 0x68]
call fcn.00438100
lea rax, [0x0072e9a6]
mov ebx, 0x19
nop
call fcn.00438400
mov eax, dword [rsp + 0x34]
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
lea rax, [0x007297be]
mov ebx, 0xd
call fcn.00436360
cmp eax, 0x5af
je 0x417f33
call fcn.00437b00
lea rax, [0x0072efff]
mov ebx, 0x19
call fcn.00438400
mov rax, qword [rsp + 0x38]
call fcn.00438100
lea rax, [0x0072e9a6]
mov ebx, 0x19
nop dword [rax]
call fcn.00438400
mov eax, dword [rsp + 0x34]
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
lea rax, [0x00732090]
mov ebx, 0x1f
call fcn.00436360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460d80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417dc0
Function at 0x41d340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41d5d0
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov edx, dword [0x009a22f0]
mov rcx, qword [0x009a25d0]
mov rsi, qword [0x009a25c8]
cmp rbx, rcx
jae 0x41d5c7
mov rbx, qword [rsi + rbx*8]
mov rsi, rbx
shr rbx, 0x14
cmp rbx, 0x40
jae 0x41d5ba
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x68], rax
lea rdi, [0x009a2350]
mov rbx, qword [rdi + rbx*8]
test byte [rbx], al
and esi, 0xfffff
mov rbx, qword [rbx + rsi*8]
mov qword [rsp + 0x50], rbx
test byte [rbx], al
xor ecx, ecx
jmp 0x41d3b8
inc rcx
cmp rcx, 0x40
jge 0x41d3df
lea rsi, [rbx + rcx]
lea rsi, [rsi + 0x21080]
mov sil, byte [rsi]
test sil, sil
je 0x41d3b5
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x2e], sil
xor edi, edi
jmp 0x41d3f0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rdi, [rcx + 1]
mov rcx, r8
cmp rdi, 8
jae 0x41d3b5
mov r8, rcx
mov rcx, rdi
mov r9d, 1
shl r9d, cl
test sil, r9b
je 0x41d3e9
lea r9, [rcx + r8*8]
cmp r9, 0x200
jae 0x41d5ad
mov r9, qword [rbx + r9*8 + 0x20000]
mov r10b, byte [r9 + 0x63]
cmp r10b, 1
jne 0x41d569
mov qword [rsp + 0x58], rcx
cmp byte [0x009cff06], 0
jne 0x41d455
mov r10d, dword [r9 + 0x58]
cmp r10d, edx
je 0x41d455
lea r11d, [rdx + 3]
cmp r10d, r11d
jne 0x41d517
mov qword [rsp + 0x40], r9
lea rax, [r9 + 0x78]
mov qword [rsp + 0x60], rax
nop
call fcn.0040b340
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x80]
jmp 0x41d4ad
nop
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.0040b560
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rsp + 0x2e]
mov rdi, rcx
mov r8, qword [rsp + 0x48]
jmp 0x41d3e9
mov rdx, qword [rdx]
test rdx, rdx
je 0x41d477
cmp byte [rdx + 0xa], 1
jne 0x41d4aa
movzx eax, word [rdx + 8]
mov rsi, qword [rcx + 0x68]
mov rdi, qword [rcx + 0x18]
test rsi, rsi
je 0x41d512
mov qword [rsp + 0x38], rdx
xor edx, edx
div rsi
imul rax, rsi
add rax, rdi
mov rbx, qword [rsp + 0x68]
nop
call fcn.0041f100
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + 0x10]
mov ebx, 8
mov rdi, qword [rsp + 0x68]
xor esi, esi
lea rcx, [0x0092034f]
call fcn.0041ef60
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
jmp 0x41d4aa
call fcn.00434880
mov dword [rsp + 0x34], r10d
nop dword [rax]
call fcn.00437b00
lea rax, [0x007274ea]
mov ebx, 6
call fcn.00438400
mov eax, dword [rsp + 0x34]
call fcn.00438100
nop
call fcn.00437d20
mov eax, dword [rsp + 0x30]
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
lea rax, [0x0072a75f]
mov ebx, 0x10
call fcn.00436360
mov byte [rsp + 0x2f], r10b
call fcn.00437b00
lea rax, [0x007286c4]
mov ebx, 0xa
nop
call fcn.00438400
movzx eax, byte [rsp + 0x2f]
movzx eax, al
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
lea rax, [0x007371e6]
mov ebx, 0x2b
call fcn.00436360
mov rax, r9
mov ecx, 0x200
call fcn.00463480
mov rax, rbx
mov ecx, 0x40
call fcn.00463480
mov rax, rbx
call fcn.00463460
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460d80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041d340
Function at 0x41fea0
Capabilities:
Hash data using murmur3
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x009cff06], 0
jne 0x41ff8f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41ff85
lea rbx, [0x009a2350]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41ff67
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00463480
lea rax, [0x00737621]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00436360
nop
int3
Function at 0x422240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4224c6
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x800000000000
lea r8, [rdx + rbx]
lea r9, [rdx + rcx]
cmp r9, r8
jbe 0x422278
nop
mov r8, rcx
sub rcx, rbx
jmp 0x422280
mov r8, rcx
xor ecx, ecx
nop dword [rax]
test rcx, rcx
je 0x42232d
test rbx, 0x3fffff
jne 0x4224b0
mov qword [rsp + 0x80], rax
mov rdx, qword [0x009d00d0]
shr rdx, 0xd
cmp rdx, 1
mov r9d, 1
cmovb rdx, r9
mov qword [rsp + 0x30], rdx
mov rsi, rdi
shr rsi, 0xd
lea r9, [rsi + 1]
test rdi, 0x1fff
cmovne rsi, r9
mov qword [rsp + 0x38], rsi
mov rcx, r8
mov rdi, rdx
nop dword [rax]
call fcn.00422680
test rax, rax
jne 0x422323
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x58], xmm15
mov qword [rsp + 0x68], 0
lea rsi, [0x00422500]
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x80]
mov qword [rsp + 0x60], rsi
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x68], rdi
jmp 0x42237a
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor eax, eax
mov rcx, r8
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx + 0x10110]
nop
call fcn.0040b560
nop
mov rcx, qword [rsp + 0x40]
shl rcx, 0x16
movabs rdx, 0xffff800000000000
add rcx, rdx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x30]
movabs r8, 0x800000000000
lea r9, [r8 + rbx]
lea r10, [rcx + r8]
cmp r10, r9
jbe 0x42239a
nop
mov r9, rcx
sub rcx, rbx
jmp 0x4223a0
mov r9, rcx
xor ecx, ecx
nop
test rcx, rcx
je 0x422497
mov rcx, qword [rsp + 0x58]
mov rax, rbx
mov rbx, r9
lea rdx, [rsp + 0x58]
call rcx
nop dword [rax + rax]
test bl, bl
je 0x42248f
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x80]
test byte [rcx], al
mov rax, qword [rcx + 0x10110]
nop
nop
call fcn.0040b340
nop
mov rax, qword [rsp + 0x40]
mov rcx, rax
shr rax, 0xd
cmp rax, 0x2000
jae 0x4224a6
mov rdx, qword [rsp + 0x80]
mov rsi, qword [rdx + rax*8 + 0x78]
test byte [rsi], al
and ecx, 0x1fff
shl rcx, 7
lea rax, [rsi + rcx]
mov ebx, 0x1ff
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
call fcn.00422d60
test rbx, rbx
jbe 0x42233c
mov qword [rsp + 0x28], rbx
mov rcx, rax
mov rdi, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x40]
call fcn.00422860
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx + 0x10110]
nop
mov rax, rdx
call fcn.0040b560
mov rax, qword [rsp + 0x28]
shl rax, 0xd
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rbx, qword [rsp + 0x50]
mov r9, rbx
xor eax, eax
mov rcx, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov ecx, 0x2000
call fcn.00463480
lea rax, [0x00737ce5]
mov ebx, 0x2d
nop dword [rax]
call fcn.00436360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00422240