joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003d470
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x18003d618
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x18003d4d5
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x18003d4d5
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x18003d4d5
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x18003d50c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x18003d562
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x18003d562
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x18003d562
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x18003d562
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x18003d562
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.18003cf20
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x18003d5c4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.18001e150
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.18003d2f0
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x18003d610
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.18001e150
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x18003ed80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x18006a080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x18003ee15
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x18003ee76
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.18001e150
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180051890
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x18003ef31
sub ecx, 1
je 0x18003efa4
sub ecx, 1
je 0x18003eee0
cmp ecx, 1
je 0x18003eec3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x18005b100]
call fcn.18001e150
jmp 0x18003efa4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.18003eab0
test eax, eax
je 0x18003efa4
jmp 0x18003ee4a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x18003efa4
sub rax, rsi
cmp rax, rbp
jae 0x18003efa4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.18001e2d0
jmp 0x18003efa4
cmp r8d, 4
jle 0x18003efa4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x18003efa4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.18001e070
mov esi, eax
test eax, eax
je 0x18003ef83
mov edx, 5
mov rcx, rbx
call fcn.18003fa70
mov eax, esi
jmp 0x18003ee4a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.180028520
mov rcx, r14
call fcn.180028800
test eax, eax
je 0x18003ee48
mov edx, 5
mov rcx, rbx
call fcn.18003fa70
mov eax, Ordinal_46
jmp 0x18003ee4a
Function at 0x180051700
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x180051742
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x180051789
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1800517e2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1800517a0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x180051823
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x18006071a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x18006071b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1800517f0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x10040135b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov rax, qword [rbp + 0x20]
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::size() const
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1004013cb
lea rax, str.VirtualAlloc_failed.
mov rdx, rax
mov rax, qword [sym.imp.cygstdc_6.dll_std::cerr]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x100446c30]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
jmp 0x1004013ff
mov rax, qword [rbp + 0x20]
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::size() const
mov rbx, rax
mov rax, qword [rbp + 0x20]
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::data() const
mov rdx, rax
mov rax, qword [rbp - 8]
mov r8, rbx
mov rcx, rax
call sym.memcpy
mov rax, qword [rbp - 8]
call rax
nop
add rsp, 0x38
pop rbx
pop rbp
ret
Function at 0x405240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4052ca
push rbp
mov rbp, rsp
sub rsp, 0x28
test rax, rax
je 0x40528c
mov rdx, qword [rax + 0x18]
nop dword [rax + rax]
test rdx, rdx
je 0x405297
movzx esi, byte [rax + 0x17]
test sil, 0x20
je 0x40527b
cmp rcx, rbx
sete al
add rsp, 0x28
pop rbp
ret
mov rsi, qword [rdx]
mov rax, rbx
mov rbx, rcx
call rsi
add rsp, 0x28
pop rbp
ret
mov eax, 1
add rsp, 0x28
pop rbp
ret
call fcn.00461260
mov ecx, 0x1c
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006daea5]
call fcn.004534e0
call fcn.0040bb80
mov rbx, rax
lea rax, [0x0068b540]
call fcn.004389a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00405240

Function at 0x405300
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40538a
push rbp
mov rbp, rsp
sub rsp, 0x28
test rax, rax
je 0x40534c
mov rax, qword [rax + 8]
mov rdx, qword [rax + 0x18]
nop
test rdx, rdx
je 0x405357
movzx esi, byte [rax + 0x17]
test sil, 0x20
je 0x40533b
cmp rcx, rbx
sete al
add rsp, 0x28
pop rbp
ret
mov rsi, qword [rdx]
mov rax, rbx
mov rbx, rcx
call rsi
add rsp, 0x28
pop rbp
ret
mov eax, 1
add rsp, 0x28
pop rbp
ret
call fcn.00461260
mov ecx, 0x1c
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x006daea5]
call fcn.004534e0
call fcn.0040bb80
mov rbx, rax
lea rax, [0x0068b540]
call fcn.004389a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00405300

Function at 0x40c720
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c7d7
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov rdx, rax
xor ebx, ebx
mov rcx, rbx
mov rax, rdx
call fcn.00415240
test rax, rax
jne 0x40c7c5
mov rax, qword [rsp + 0x30]
mov rcx, rax
shl rax, 0x10
or rax, 0x7ffff
sar rax, 0x13
shl rax, 3
nop
nop
cmp rcx, rax
jne 0x40c773
add rsp, 0x20
pop rbp
ret
call fcn.0043b000
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
call fcn.0043b000
lea rax, [0x006daec1]
mov ebx, 0x1c
call fcn.0043b880
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.0043b700
call fcn.0043b240
call fcn.0043b060
lea rax, [0x006d50e5]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.00439560
lea rax, [0x006df911]
mov ebx, 0x24
call fcn.00439560
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.0046a260
mov rax, qword [rsp + 8]
jmp fcn.0040c720
Function at 0x40cc20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40cd46
push rbp
mov rbp, rsp
sub rsp, 0x28
mov rcx, qword [r14 + 0x30]
mov rdx, r14
nop dword [rax]
cmp qword [rcx], rdx
jne 0x40cd34
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x18], rdx
mov rax, rcx
call fcn.00436080
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x38]
lock cmpxchg qword [rbx], rdx
sete dl
nop dword [rax]
test dl, dl
je 0x40ccb4
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x008f4b30]
cmp qword [rdx], 0
nop word [rax + rax]
jne 0x40cd2a
mov rax, 0xffffffffffffffff
call fcn.00435d40
jmp 0x40ccd2
cmp qword [rbx], 1
jne 0x40ccc1
add rsp, 0x28
pop rbp
nop
ret
lea rax, [0x006db7ae]
mov ebx, 0x1d
call fcn.00439560
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
add rsp, 0x28
pop rbp
ret
mov eax, 0x989680
call fcn.00435d40
mov rcx, qword [0x008f4b30]
mov rcx, qword [rcx]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
call fcn.0046bd40
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x38]
mov rdx, qword [rbx]
test rdx, rdx
je 0x40cce8
jmp 0x40ccd2
lea rax, [0x006d5782]
mov ebx, 0x13
call fcn.00439560
nop
mov qword [rsp + 8], rax
call fcn.0046a260
mov rax, qword [rsp + 8]
jmp fcn.0040cc20
Function at 0x415760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415812
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
shr rbx, 3
lea rdx, [rbx + 7]
shr rdx, 3
mov qword [rsp + 0x20], rdx
lea rsi, [rdx + 1]
mov qword [rsp + 0x18], rsi
mov ebx, 1
lea rcx, [0x00991850]
mov rax, rsi
call fcn.0040ed60
mov rcx, qword [rsp + 0x18]
cmp rcx, 0x40000000
ja 0x415807
mov rdx, qword [rsp + 0x20]
cmp rdx, rcx
jae 0x4157ff
mov qword [rsp + 0x28], rax
test byte [rax], al
mov byte [rdx + rax], 0xa1
mov rbx, rax
mov rax, qword [rsp + 0x40]
call fcn.00415840
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + rbx]
cmp cl, 0xa1
jne 0x4157ee
add rsp, 0x30
pop rbp
ret
lea rax, [0x006da566]
mov ebx, 0x1b
call fcn.00439560
mov rax, rdx
call fcn.0046c540
mov edx, 0x40000000
call fcn.0046c5a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415760

Function at 0x417f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4180eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x008ce2f8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436ac0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417fc5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417fd4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417ff3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x418003
cmp rbx, 0x1000
jae 0x417fcb
jmp 0x41806d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x418015
xor edx, edx
jmp 0x418064
mov rcx, qword [0x008ce2f8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436ac0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417ff9
jmp 0x417fe8
call fcn.0046d9c0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043b000
lea rax, [0x006d878c]
mov ebx, 0x18
nop dword [rax]
call fcn.0043b880
mov rax, qword [rsp + 0x38]
call fcn.0043b5c0
lea rax, [0x006d90df]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043b880
mov rax, qword [rsp + 0x30]
call fcn.0043b5c0
call fcn.0043b240
call fcn.0043b060
lea rax, [0x006ddeaf]
mov ebx, 0x21
call fcn.00439560
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417f60
Function at 0x418120
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418346
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x008ce300]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00436b40
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x418193
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4181a2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4181c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4181d5
cmp rbx, 0x1000
jae 0x418199
nop
jmp 0x418258
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4181ed
xor esi, esi
jmp 0x41824a
mov rax, qword [0x008ce300]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00436b40
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4181cb
jmp 0x4181b6
call fcn.0046d9c0
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4182e0
nop dword [rax + rax]
call fcn.0043b000
lea rax, [0x006d90f8]
mov ebx, 0x19
call fcn.0043b880
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.0043b5c0
lea rax, [0x006d90df]
mov ebx, 0x19
call fcn.0043b880
mov eax, dword [rsp + 0x34]
call fcn.0043b5c0
nop
call fcn.0043b240
call fcn.0043b060
lea rax, [0x006d3246]
mov ebx, 0xd
call fcn.00439560
nop dword [rax + rax]
cmp eax, 0x5af
je 0x418280
call fcn.0043b000
lea rax, [0x006d90f8]
mov ebx, 0x19
call fcn.0043b880
mov rax, qword [rsp + 0x38]
call fcn.0043b5c0
lea rax, [0x006d90df]
mov ebx, 0x19
call fcn.0043b880
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.0043b5c0
call fcn.0043b240
call fcn.0043b060
lea rax, [0x006dcd1d]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00439560
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00418120
Function at 0x422120
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x0098c071], 0
jne 0x422210
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x422203
lea rsi, [0x0091e178]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x4221de
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0046c560
lea rax, [0x006e3d4d]
mov ebx, 0x2c
nop dword [rax]
call fcn.00439560
nop
int3

Function at 0x424660
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x424766
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4246a3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42475b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00425440
test rax, rax
je 0x42475b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x004247a0]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0046a140
xorps xmm15, xmm15
mov r14, qword [0x0098c2c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x424749
xor eax, eax
jmp 0x424753
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x424691
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00424660
Function at 0x425ac0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x425b66
push rbp
mov rbp, rsp
sub rsp, 0x18
movzx edx, word [rax]
cmp rbx, rdx
ja 0x425aff
cmp dword [rax + 4], ecx
je 0x425ae6
mov word [rax + 2], dx
mov dword [rax + 4], ecx
movzx ecx, word [rax]
sub ecx, ebx
mov word [rax], cx
movzx ecx, byte [rax + 8]
or ecx, 1
nop
mov byte [rax + 8], cl
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 0x30], rbx
mov word [rsp + 0x16], dx
call fcn.0043b000
lea rax, [0x006d3e25]
mov ebx, 0xf
call fcn.0043b880
movzx eax, word [rsp + 0x16]
call fcn.0043b5c0
lea rax, [0x006d1a15]
mov ebx, 8
call fcn.0043b880
mov rax, qword [rsp + 0x30]
nop
call fcn.0043b5c0
call fcn.0043b240
call fcn.0043b060
lea rax, [0x006da623]
mov ebx, 0x1b
nop dword [rax + rax]
call fcn.00439560
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.00425ac0

Function at 0x425cc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x425d9d
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp qword [rax], rbx
ja 0x425d8b
nop dword [rax + rax]
cmp qword [rax + 8], rbx
jbe 0x425d8b
lea rdx, [rax + 0x18]
test cl, cl
je 0x425cf6
lea rdx, [rax + 0x28]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x10], rdx
mov rsi, qword [rdx]
test rsi, rsi
je 0x425d4b
cmp qword [rsi + 0x10], 0xfc
jne 0x425d65
mov rsi, qword [rax + 0x20]
test rsi, rsi
je 0x425d25
mov qword [rax + 0x20], 0
jmp 0x425d37
call fcn.00428960
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x30]
mov rsi, rax
mov qword [rsi + 0x10], 0
mov rdi, qword [rdx]
mov qword [rsi + 0x18], rdi
mov qword [rdx], rsi
jmp 0x425d65
call fcn.00428960
movups xmmword [rax + 0x10], xmm15
mov rcx, qword [rsp + 0x10]
mov qword [rcx], rax
mov rbx, qword [rsp + 0x30]
mov rsi, rax
mov rax, qword [rsi + 0x10]
cmp rax, 0xfc
jae 0x425d81
mov qword [rsi + rax*8 + 0x20], rbx
inc qword [rsi + 0x10]
add rsp, 0x18
pop rbp
nop
ret
mov ecx, 0xfc
call fcn.0046c540
lea rax, [0x006da63e]
mov ebx, 0x1b
call fcn.00439560
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0046a260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop
jmp fcn.00425cc0