joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140040ef0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140036180
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140036180
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140041040
cmp rax, 0xffffffffffffffff
je 0x140041040
xor edi, edi
test rbp, rbp
jle 0x140040feb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400305a4
mov rbx, rax
test rax, rax
jne 0x140040f78
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140040fe1
mov edx, 0x8000
mov ecx, r14d
call fcn.14002d5a4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14003455c
cmp eax, 0xffffffff
je 0x140040fc1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140040f88
mov edx, r15d
mov ecx, r14d
call fcn.14002d5a4
jmp 0x140040fe1
cmp byte [rsi + 0x38], dil
je 0x140040fd8
cmp dword [rsi + 0x34], 5
jne 0x140040fd8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140040fe1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14003061c
jmp 0x140041054
jns 0x140041054
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140036180
cmp rax, 0xffffffffffffffff
jne 0x14004100c
cmp byte [rsi + 0x30], dil
je 0x140041054
mov edi, dword [rsi + 0x2c]
jmp 0x140041054
mov ecx, r14d
call fcn.14003a0f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140041054
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140041054
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14004104d
mov eax, dword [rsi + 0x2c]
jmp 0x140041052
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140036180
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140041860
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140041888
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140041888
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x407c80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x407d0a
push rbp
mov rbp, rsp
sub rsp, 0x28
test rax, rax
je 0x407ccc
mov rdx, qword [rax + 0x18]
nop dword [rax + rax]
test rdx, rdx
je 0x407cd7
movzx esi, byte [rax + 0x17]
test sil, 0x20
je 0x407cbb
cmp rbx, rcx
sete al
add rsp, 0x28
pop rbp
ret
mov rsi, qword [rdx]
mov rax, rbx
mov rbx, rcx
call rsi
add rsp, 0x28
pop rbp
ret
mov eax, 1
add rsp, 0x28
pop rbp
ret
call fcn.00466120
mov ecx, 0x1c
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x0104e2e2]
call fcn.00457840
call fcn.0040e940
mov rbx, rax
lea rax, [0x00ee20e0]
call fcn.0043d500
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00407c80

Function at 0x407d40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x407dca
push rbp
mov rbp, rsp
sub rsp, 0x28
test rax, rax
je 0x407d8c
mov rax, qword [rax + 8]
mov rdx, qword [rax + 0x18]
nop
test rdx, rdx
je 0x407d97
movzx esi, byte [rax + 0x17]
test sil, 0x20
je 0x407d7b
cmp rbx, rcx
sete al
add rsp, 0x28
pop rbp
ret
mov rsi, qword [rdx]
mov rax, rbx
mov rbx, rcx
call rsi
add rsp, 0x28
pop rbp
ret
mov eax, 1
add rsp, 0x28
pop rbp
ret
call fcn.00466120
mov ecx, 0x1c
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x0104e2e2]
call fcn.00457840
call fcn.0040e940
mov rbx, rax
lea rax, [0x00ee20e0]
call fcn.0043d500
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00407d40
Function at 0x40ef60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40f017
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov rdx, rax
xor ebx, ebx
mov rcx, rbx
mov rax, rdx
call fcn.004184e0
test rax, rax
jne 0x40f005
mov rax, qword [rsp + 0x30]
mov rcx, rax
shl rax, 0x10
or rax, 0x7ffff
sar rax, 0x13
shl rax, 3
nop
nop
cmp rcx, rax
jne 0x40efb3
add rsp, 0x20
pop rbp
ret
call fcn.0043f620
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
call fcn.0043f620
lea rax, [0x0104e2fe]
mov ebx, 0x1c
call fcn.0043fea0
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.0043fd20
call fcn.0043f860
call fcn.0043f680
lea rax, [0x0103e219]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.0043dc80
lea rax, [0x0106049e]
mov ebx, 0x24
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004705e0
mov rax, qword [rsp + 8]
jmp fcn.0040ef60

Function at 0x40f400
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40f526
push rbp
mov rbp, rsp
sub rsp, 0x28
mov rcx, qword [r14 + 0x30]
mov rdx, r14
nop dword [rax]
cmp qword [rcx], rdx
jne 0x40f514
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x18], rdx
mov rax, rcx
call fcn.0043a000
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x38]
lock cmpxchg qword [rbx], rdx
sete dl
nop dword [rax]
test dl, dl
je 0x40f494
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x01b83930]
cmp qword [rdx], 0
nop word [rax + rax]
jne 0x40f50a
mov rax, 0xffffffffffffffff
call fcn.00439cc0
jmp 0x40f4b2
cmp qword [rbx], 1
jne 0x40f4a1
add rsp, 0x28
pop rbp
nop
ret
lea rax, [0x010502e7]
mov ebx, 0x1d
call fcn.0043dc80
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
add rsp, 0x28
pop rbp
ret
mov eax, 0x989680
call fcn.00439cc0
mov rcx, qword [0x01b83930]
mov rcx, qword [rcx]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
call fcn.004720a0
xorps xmm15, xmm15
mov r14, qword [0x01c099d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x38]
mov rdx, qword [rbx]
test rdx, rdx
je 0x40f4c8
jmp 0x40f4b2
lea rax, [0x0103f85b]
mov ebx, 0x13
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
call fcn.004705e0
mov rax, qword [rsp + 8]
jmp fcn.0040f400
Function at 0x40f540
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x20]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
test cl, cl
je 0x40f5d2
mov qword [rsp + 0x30], r14
test rbx, rbx
jge 0x40f59e
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x01b83930]
cmp qword [rcx], 0
jne 0x40f7a3
mov rax, 0xffffffffffffffff
call fcn.00439cc0
jmp 0x40f75a
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x50], rbx
call fcn.00474160
xorps xmm15, xmm15
mov r14, qword [0x01c099d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x50]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40f5fa
cmp qword [rdx], 1
jne 0x40f5e3
mov eax, 1
add rsp, 0x38
pop rbp
ret
lea rax, [0x0105252d]
mov ebx, 0x1e
call fcn.0043dc80
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x01b83930]
cmp qword [rdx], 0
je 0x40f62e
nop word [rax + rax]
cmp rbx, 0x989680
jle 0x40f62e
mov ebx, 0x989680
mov rax, rbx
call fcn.00439cc0
test eax, eax
jge 0x40f6bc
mov rax, qword [0x01b83930]
mov rax, qword [rax]
test rax, rax
je 0x40f671
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.004720a0
xorps xmm15, xmm15
mov r14, qword [0x01c099d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.00474160
xorps xmm15, xmm15
mov r14, qword [0x01c099d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40f5f4
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
jmp 0x40f6d7
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
mov rax, qword [rcx]
mov rsi, qword [rdx + 0x30]
mov rdi, rsi
cmp rax, rsi
jne 0x40f700
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
test dil, dil
je 0x40f6d7
xor eax, eax
add rsp, 0x38
pop rbp
ret
cmp rax, 1
jne 0x40f749
mov byte [rdi + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.00439cc0
test eax, eax
jl 0x40f738
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
lea rax, [0x0107bc07]
mov ebx, 0x32
call fcn.0043dc80
lea rax, [0x0107a4a9]
mov ebx, 0x31
call fcn.0043dc80
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
mov rax, qword [0x01b83930]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.004720a0
xorps xmm15, xmm15
mov r14, qword [0x01c099d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, 0x989680
call fcn.00439cc0
test eax, eax
jl 0x40f775
jmp 0x40f75a
Function at 0x40f940
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40fc6f
push rbp
mov rbp, rsp
sub rsp, 0x28
cmp word [0x01acf2a4], 0x10
nop word [rax + rax]
jne 0x40fc5d
mov rdx, qword [0x01c096a8]
test rdx, rdx
je 0x40fc4c
nop word [rax + rax]
nop
cmp rdx, 0x80000
ja 0x40fbe0
cmp rdx, 0x1000
jb 0x40fb6c
lea rbx, [rdx - 1]
nop
test rdx, rbx
jne 0x40fb20
mov rdx, qword [0x01c096b0]
lea rbx, [rdx - 1]
test rdx, rbx
jne 0x40face
nop dword [rax]
cmp rdx, 0x400000
jbe 0x40f9d4
mov qword [0x01c096b0], 0
cmp qword [0x01c096b0], 0
nop dword [rax]
jne 0x40faa5
lea rax, [0x01bcb7a0]
call fcn.0042bb80
call fcn.00419fe0
mov qword [0x01c09780], rax
xor eax, eax
jmp 0x40fa05
inc rax
cmp rax, 3
jl 0x40fa02
mov eax, 0x7f
jmp 0x40fa44
mov qword [rsp + 0x20], rbx
lea rax, [0x01be2398]
nop
call fcn.0041dfe0
mov rcx, qword [rsp + 0x10]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
mov qword [rax + 0x10], rdx
mov qword [rcx], rax
mov rax, qword [rsp + 0x18]
dec rax
test rax, rax
jl 0x40fa7f
mov qword [rsp + 0x18], rax
mov rcx, rax
shl rax, 0x28
movabs rdx, 0xc000000000
or rax, rdx
mov qword [rsp + 0x10], rax
cmp rcx, 0x3f
jle 0x40fa76
lea rbx, [0x01be23e0]
jmp 0x40fa12
lea rbx, [0x01bdbb60]
jmp 0x40fa12
nop
movabs rax, 0x7fffffffffffffff
lea rcx, [0x01c0b008]
xchg qword [rcx], rax
add rsp, 0x28
pop rbp
ret
lea rdx, [rcx + 1]
mov qword [0x01c096b8], rdx
mov rcx, qword [0x01c096b8]
mov edx, 1
shl rdx, cl
cmp rcx, 0x40
sbb rbx, rbx
and rdx, rbx
nop
cmp qword [0x01c096b0], rdx
jne 0x40fa9a
jmp 0x40f9e6
call fcn.0043f620
lea rax, [0x010456ff]
mov ebx, 0x17
nop
call fcn.0043fea0
mov rax, qword [0x01c096b0]
call fcn.0043fbe0
lea rax, [0x010456e8]
mov ebx, 0x17
nop dword [rax]
call fcn.0043fea0
call fcn.0043f680
lea rax, [0x01048c54]
mov ebx, 0x19
call fcn.0043dc80
nop dword [rax + rax]
call fcn.0043f620
lea rax, [0x0103e22b]
mov ebx, 0x12
call fcn.0043fea0
mov rax, qword [0x01c096a8]
nop dword [rax]
call fcn.0043fbe0
lea rax, [0x010456e8]
mov ebx, 0x17
call fcn.0043fea0
call fcn.0043f680
lea rax, [0x010410d0]
mov ebx, 0x14
call fcn.0043dc80
call fcn.0043f620
lea rax, [0x0103e22b]
mov ebx, 0x12
nop dword [rax]
call fcn.0043fea0
mov rax, qword [0x01c096a8]
call fcn.0043fbe0
lea rax, [0x01062acd]
mov ebx, 0x25
nop dword [rax]
call fcn.0043fea0
mov eax, 0x1000
call fcn.0043fcc0
lea rax, [0x0102bf13]
mov ebx, 2
nop dword [rax + rax]
call fcn.0043fea0
call fcn.0043f680
lea rax, [0x010410d0]
mov ebx, 0x14
call fcn.0043dc80
nop dword [rax + rax]
call fcn.0043f620
lea rax, [0x0103e22b]
mov ebx, 0x12
call fcn.0043fea0
mov rax, qword [0x01c096a8]
nop dword [rax]
call fcn.0043fbe0
lea rax, [0x010604c2]
mov ebx, 0x24
call fcn.0043fea0
mov eax, 0x80000
nop dword [rax + rax]
call fcn.0043fcc0
lea rax, [0x0102bf13]
mov ebx, 2
call fcn.0043fea0
call fcn.0043f680
lea rax, [0x010410d0]
mov ebx, 0x14
call fcn.0043dc80
lea rax, [0x0105254b]
mov ebx, 0x1e
call fcn.0043dc80
lea rax, [0x0103cfaa]
mov ebx, 0x11
call fcn.0043dc80
nop
call fcn.004705e0
jmp fcn.0040f940
Function at 0x411540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4117d1
push rbp
mov rbp, rsp
sub rsp, 0x40
test rax, rax
je 0x4117bf
nop dword [rax + rax]
test rbx, rbx
je 0x411585
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x4117ae
cmp rbx, 0x2000
jbe 0x41158a
nop dword [rax + rax]
jmp 0x41179d
mov ebx, 8
cmp rax, 0x10000
jae 0x41165c
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x4115d5
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x4115d5
test byte [rsi], al
add rsi, 0x11f8
jmp 0x411600
nop
nop
lea rax, [0x01c0a070]
nop
call fcn.0040f080
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x01c0a078]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
lea r9, [rax + rdi]
mov qword [rsi + 8], rdi
cmp r9, 0x40000
ja 0x411633
cmp qword [rsi], 0
jne 0x41166b
mov eax, 0x40000
lea rbx, [0x01c0fc00]
nop
call fcn.0041b0c0
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
je 0x411770
jmp 0x411713
mov rbx, rcx
nop
call fcn.0041b0c0
add rsp, 0x40
pop rbp
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
nop
add rdi, r8
mov dword [rdx + 0xd8], r10d
cmp r9d, 1
jne 0x4116aa
cmp byte [r14 + 0xb1], 0
nop
je 0x4116aa
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdi
lea rdx, [0x01c0a078]
cmp rsi, rdx
jne 0x4116d8
nop
nop
lea rax, [0x01c0a070]
call fcn.0040f2a0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
lea rdx, [0x01c0fc00]
nop
cmp rcx, rdx
je 0x41170a
mov rbx, rax
mov rax, rcx
call fcn.004369a0
mov rbx, qword [rsp + 0x50]
neg rbx
lea rax, [0x01c0fc00]
nop
call fcn.004369a0
mov rdi, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x40
pop rbp
ret
mov rax, qword [0x01c096c0]
mov rdx, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x38]
lea rsi, [0x01c096c0]
lock cmpxchg qword [rsi], rdx
sete dl
nop dword [rax]
test dl, dl
je 0x411713
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x60]
jmp 0x41166b
lea rdx, [0x01c0a078]
cmp rcx, rdx
je 0x41178d
lea rax, [0x01054778]
mov ebx, 0x1f
call fcn.0043dc80
nop
nop
lea rax, [0x01c0a070]
call fcn.0040f2a0
jmp 0x41177c
lea rax, [0x0105dfa5]
mov ebx, 0x23
call fcn.0043dc80
lea rax, [0x0106de22]
mov ebx, 0x2a
call fcn.0043dc80
lea rax, [0x0104a9e9]
mov ebx, 0x1a
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004773e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00411540
Function at 0x4182a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4184a5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x38], rbx
call fcn.0043f620
call fcn.0043f620
lea rax, [0x0103cfcc]
mov ebx, 0x11
nop dword [rax]
call fcn.0043fea0
mov rax, qword [rsp + 0x38]
call fcn.0043fd20
call fcn.0043f680
mov rax, qword [rsp + 0x58]
nop dword [rax]
test rax, rax
je 0x4183ca
nop
nop
mov cl, byte [rax + 0x6b]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x418480
nop dword [rax + rax]
call fcn.0043f620
lea rax, [0x010410e4]
mov ebx, 0x14
call fcn.0043fea0
call fcn.0043f680
movzx eax, byte [rsp + 0x27]
movzx eax, al
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x78]
mov qword [rsp + 0x38], rdx
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x28], rcx
nop
call fcn.0043f620
lea rax, [0x0103807e]
mov ebx, 0xd
call fcn.0043fea0
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.0043fd20
lea rax, [0x0103705e]
mov ebx, 0xc
call fcn.0043fea0
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.0043fd20
lea rax, [0x0103706a]
mov ebx, 0xc
call fcn.0043fea0
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.0043fbe0
call fcn.0043f680
call fcn.0043f620
call fcn.0043f860
call fcn.0043f680
mov rax, qword [rsp + 0x68]
nop
test rax, rax
jne 0x418405
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x0108507c]
mov ebx, 0x3e
nop dword [rax]
call fcn.0043dc80
call fcn.0043f620
lea rax, [0x01052587]
mov ebx, 0x1e
call fcn.0043fea0
mov rax, qword [rsp + 0x68]
call fcn.0043fd20
lea rax, [0x014150a0]
mov ebx, 1
call fcn.0043fea0
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
call fcn.0043fd20
lea rax, [0x0102bf13]
mov ebx, 2
call fcn.0043fea0
call fcn.0043f680
lea rax, [0x0102fe73]
mov ebx, 6
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x40]
call fcn.00424840
jmp 0x4183e5
call fcn.0043f620
lea rax, [0x01048c86]
mov ebx, 0x19
call fcn.0043fea0
call fcn.0043f680
nop dword [rax + rax]
jmp 0x41833b
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004182a0
Function at 0x419a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x419b32
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x30], rax
shr rbx, 3
lea rdx, [rbx + 7]
shr rdx, 3
mov qword [rsp + 0x20], rdx
lea rsi, [rdx + 1]
mov qword [rsp + 0x18], rsi
mov ebx, 1
lea rcx, [0x01c0fbf0]
mov rax, rsi
call fcn.00411440
mov rcx, qword [rsp + 0x18]
cmp rcx, 0x40000000
ja 0x419b27
mov rdx, qword [rsp + 0x20]
cmp rdx, rcx
jae 0x419b1f
mov qword [rsp + 0x28], rax
test byte [rax], al
mov byte [rdx + rax], 0xa1
mov rbx, rax
mov rax, qword [rsp + 0x30]
call fcn.00419b60
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + rbx]
cmp cl, 0xa1
jne 0x419b0e
add rsp, 0x38
pop rbp
ret
lea rax, [0x0104c568]
mov ebx, 0x1b
call fcn.0043dc80
mov rax, rdx
call fcn.004728a0
mov edx, 0x40000000
call fcn.00472900
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00419a80

Function at 0x41a740
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41a7fc
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [0x01bdb8e0]
mov edx, dword [rax + 0x488]
nop
cmp edx, ecx
je 0x41a796
lea ebx, [rcx - 2]
cmp edx, ebx
jne 0x41a79c
mov qword [rsp + 0x28], rax
call fcn.0041a540
mov rax, qword [rsp + 0x28]
call fcn.004547e0
mov ecx, dword [0x01bdb8e0]
mov rdx, qword [rsp + 0x28]
xchg dword [rdx + 0x488], ecx
add rsp, 0x18
pop rbp
ret
add rsp, 0x18
pop rbp
ret
mov dword [rsp + 0x14], ecx
mov dword [rsp + 0x10], edx
call fcn.0043f620
lea rax, [0x0103808b]
mov ebx, 0xd
call fcn.0043fea0
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.0043fbe0
lea rax, [0x010525a5]
mov ebx, 0x1e
call fcn.0043fea0
mov eax, dword [rsp + 0x14]
call fcn.0043fbe0
nop
call fcn.0043f860
call fcn.0043f680
lea rax, [0x01037076]
mov ebx, 0xc
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
call fcn.004705e0
mov rax, qword [rsp + 8]
jmp fcn.0041a740
Function at 0x41aec0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b066
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
nop word [rax + rax]
test dl, sil
je 0x41af72
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
nop
cmp rdx, 0x40
jae 0x41af65
lea rsi, [0x01bdb938]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx esi, ax
shr rcx, 0x16
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x114c0]
test byte [rdx], al
add rdx, rsi
mov bl, byte [rdx]
test dil, bl
je 0x41af59
mov eax, 1
add rsp, 0x30
pop rbp
ret
lock or byte [rdx], dil
xor eax, eax
add rsp, 0x30
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.004728c0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
call fcn.0043f620
call fcn.0043f620
lea rax, [0x0108279d]
mov ebx, 0x39
call fcn.0043fea0
mov rax, qword [rsp + 0x40]
call fcn.0043fd20
call fcn.0043f860
call fcn.0043f680
call fcn.0043f620
lea rax, [0x01047412]
mov ebx, 0x18
call fcn.0043fea0
mov rax, qword [rsp + 0x28]
call fcn.0043fd20
lea rax, [0x014150a0]
mov ebx, 1
nop dword [rax]
call fcn.0043fea0
mov rax, qword [rsp + 0x20]
call fcn.0043fd20
lea rax, [0x0102bf13]
mov ebx, 2
nop dword [rax + rax]
call fcn.0043fea0
call fcn.0043f680
lea rax, [0x0102ce07]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.00424840
lea rax, [0x0102c277]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.00424840
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x01054797]
mov ebx, 0x1f
nop dword [rax]
call fcn.0043dc80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.004705e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0041aec0