joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424940
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x424aaa
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp dword [0x00628680], ebx
je 0x424962
jmp 0x424a98
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
and ecx, 0x7fffffff
dec ecx
cmp ecx, 0x80000000
jae 0x424a87
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x42495f
cmp edx, 0x80000000
jne 0x424a81
cmp dword [0x00696bd8], 0
jle 0x424a7b
nop
mov rax, qword [0x006970c8]
mov rcx, rax
shr rax, 0x14
mov qword [rsp + 0x28], rax
mov rdx, qword [0x006286a8]
mov qword [rsp + 0x10], rdx
mov rbx, qword [0x006286b8]
sub rcx, rbx
shr rcx, 0x14
mov qword [rsp + 0x20], rcx
movsd xmm0, qword [0x006286c0]
movsd qword [rsp + 0x18], xmm0
call fcn.00438ae0
lea rax, [0x004e6cd8]
mov ebx, 0x1f
call fcn.00439360
mov rax, qword [rsp + 0x28]
call fcn.004390a0
lea rax, [0x004e0e8a]
mov ebx, 0xe
call fcn.00439360
mov rax, qword [rsp + 0x20]
nop dword [rax]
call fcn.004390a0
lea rax, [0x004e3f4e]
mov ebx, 0x17
call fcn.00439360
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.004390a0
lea rax, [0x004dfd90]
mov ebx, 0xa
call fcn.00439360
movsd xmm0, qword [rsp + 0x18]
nop dword [rax]
call fcn.00438dc0
lea rax, [0x004e063d]
mov ebx, 0xc
call fcn.00439360
call fcn.00438b40
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
lea rax, [0x004e7bef]
mov ebx, 0x23
call fcn.00437040
lea rax, [0x004ea15f]
mov ebx, 0x31
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.00464520
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.00424940

Function at 0x424ae0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x424be9
push rbp
mov rbp, rsp
sub rsp, 0x30
call fcn.00424e40
cmp rax, 0xffffffffffffffff
jne 0x424af2
nop
mov edx, dword [0x00611b54]
test edx, 0x7fffffff
jne 0x424bd7
mov eax, dword [0x00628680]
mov dword [rsp + 0x14], eax
xor ecx, ecx
jmp 0x424b80
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x28], rdx
lea rcx, [rbx + rbx*4]
mov qword [rsp + 0x20], rcx
lea rax, [rdi + rcx*8]
lea rax, [rax + 8]
call fcn.00431280
mov rcx, qword [rsp + 0x28]
lea rdx, [0x006289c0]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 0x58]
mov rdx, qword [rsp + 0x20]
lea rax, [rcx + rdx*8]
mov rcx, qword [rsp + 0x18]
inc rcx
mov qword [rsp + 0x28], rcx
call fcn.00431280
mov ecx, dword [rsp + 0x14]
mov rdx, qword [rsp + 0x28]
mov eax, ecx
mov rcx, rdx
nop dword [rax + rax]
cmp rcx, 0x88
jge 0x424bb3
lea rdx, [rcx + rcx*2]
shl rdx, 6
mov ebx, eax
shr ebx, 1
and ebx, 1
dec ebx
neg ebx
lea rsi, [0x006289c0]
lea rdi, [rsi + rdx]
cmp rbx, 2
jb 0x424b1e
jmp 0x424bcb
lea rax, [0x00611d80]
call fcn.004226c0
nop
call fcn.0042a560
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 2
call fcn.00466800
lea rax, [0x004e9650]
mov ebx, 0x2c
call fcn.00437040
nop
call fcn.00464520
jmp fcn.00424ae0
Function at 0x4273e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4274c6
push rbp
mov rbp, rsp
sub rsp, 0x10
nop
nop
lea rax, [0x00612230]
nop dword [rax + rax]
call fcn.0040bd80
cmp qword [0x006121a0], 0
jne 0x4274b2
mov qword [0x006121e8], 0
mov rcx, qword [0x00612248]
test rcx, rcx
jne 0x42744c
nop
nop
lea rax, [0x00612230]
call fcn.0040bfe0
add rsp, 0x10
pop rbp
ret
lea rdx, [0x00612238]
mov qword [rcx + 0x10], rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x42743e
mov rcx, qword [0x00612238]
test rcx, rcx
je 0x427489
mov rdx, qword [0x00612250]
mov qword [rdx], rcx
mov rcx, qword [0x00612238]
mov rdx, qword [0x00612250]
mov qword [rcx + 8], rdx
mov rcx, qword [0x00612248]
mov qword [0x00612238], rcx
jmp 0x4274a5
mov rcx, qword [0x00612248]
mov rdx, qword [0x00612250]
mov qword [0x00612238], rcx
mov qword [0x00612240], rdx
movups xmmword [0x00612248], xmm15
jmp 0x42742a
lea rax, [0x004e8bd1]
mov ebx, 0x28
nop
call fcn.00437040
nop
call fcn.00464520
jmp fcn.004273e0

Function at 0x428360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x428391
push rbp
mov rbp, rsp
sub rsp, 0x18
test cl, cl
je 0x42837f
xor edi, edi
call fcn.00428700
add rsp, 0x18
pop rbp
ret
lea rax, [0x004eaa46]
mov ebx, 0x3c
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop
call fcn.0046b0c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00428360

Function at 0x4284a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4285b8
push rbp
mov rbp, rsp
sub rsp, 0x10
xor edx, edx
jmp 0x4284d0
sub r11, rbx
mov rdi, r11
shr r11, 0xd
lea rbx, [rdi + r9]
sub r10, r11
mov rax, rcx
mov rcx, r10
mov edx, r12d
test rcx, rcx
jbe 0x428559
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
nop
cmp rdi, 0x40
jae 0x4285aa
test byte [rax], al
mov rdi, qword [rax + rdi*8 + 0x101d8]
test byte [rdi], al
mov r9, rbx
and ebx, 0x3fffff
mov r10, rcx
shl rcx, 0xd
lea r11, [rcx + rbx]
shr r8, 0x16
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x10c8]
cmp r8, rbx
seta r12b
or r12d, edx
nop dword [rax + rax]
cmp r11, 0x400000
jbe 0x428567
mov r11d, 0x400000
jmp 0x428567
mov rcx, rax
jmp 0x4284b6
mov eax, edx
add rsp, 0x10
pop rbp
ret
mov rax, rcx
mov r8, rdx
cmp r11, r8
jbe 0x428551
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x10c8], r11
sete dl
nop
test dl, dl
jne 0x4284b6
mov rdx, qword [rdi + 0x10c8]
cmp rdx, r11
ja 0x428561
cmp rdx, rbx
jbe 0x428561
lea rax, [0x004ea350]
mov ebx, 0x33
call fcn.00437040
mov rax, rdi
mov ecx, 0x40
call fcn.00466820
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax + rax]
jmp fcn.004284a0
Function at 0x428fa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x429235
push rbp
mov rbp, rsp
sub rsp, 0x70
test byte [rax], al
mov rdx, qword [rax + 0x10470]
mov rsi, qword [0x006966b8]
add rbx, 0x1ff
and rbx, 0xfffffffffffffe00
shl rbx, 0xd
lea r8, [rbx + rdx]
lea r9, [rsi + r8]
lea r9, [r9 - 1]
neg rsi
and rsi, r9
cmp qword [rax + 0x10478], rsi
jb 0x428ff8
cmp rdx, r8
jbe 0x4291a8
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x58], rbx
lea rcx, [rax + 0x10400]
mov edi, 1
call fcn.0040ca20
test rax, rax
je 0x42911c
mov rcx, rax
mov rdx, qword [rsp + 0x80]
mov rsi, qword [rdx + 0x10478]
cmp rax, rsi
jne 0x429048
lea rcx, [rax + rbx]
mov qword [rdx + 0x10478], rcx
xor eax, eax
jmp 0x4290f3
mov rdi, qword [rdx + 0x10470]
sub rsi, rdi
test rsi, rsi
jne 0x42905e
xor eax, eax
jmp 0x4290de
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rsi
lea rcx, [rdx + 8]
mov qword [rsp + 0x60], rcx
nop
lea rax, [0x00697178]
mov rbx, rsi
call fcn.00431520
lea rax, [0x00698440]
call fcn.004315e0
mov rcx, qword [rsp + 0x38]
lock xadd qword [rax + 8], rcx
lea rax, [0x00698440]
call fcn.004316c0
mov rcx, qword [rsp + 0x80]
mov rbx, qword [rcx + 0x10470]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call fcn.0042a8a0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rsi, rcx
mov qword [rdx + 0x10470], rcx
lea rcx, [rsi + rbx]
mov qword [rdx + 0x10478], rcx
mov rsi, qword [0x006966b8]
mov rcx, qword [rdx + 0x10470]
mov rdi, qword [rsp + 0x58]
add rcx, rdi
lea rcx, [rsi + rcx]
lea rcx, [rcx - 1]
neg rsi
and rsi, rcx
jmp 0x4291ad
mov rax, qword [0x00697180]
mov rcx, qword [0x00697178]
add rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, qword [0x00697170]
mov qword [rsp + 0x20], rcx
nop
call fcn.00438ae0
lea rax, [0x004e8bf9]
mov ebx, 0x28
call fcn.00439360
mov rax, qword [rsp + 0x58]
nop dword [rax + rax]
call fcn.004390a0
lea rax, [0x004e0a6e]
mov ebx, 0xd
call fcn.00439360
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
add rax, rcx
call fcn.004390a0
lea rax, [0x004dfa95]
mov ebx, 9
call fcn.00439360
call fcn.00438b40
xor eax, eax
xor ebx, ebx
add rsp, 0x70
pop rbp
ret
mov rdx, rax
xor eax, eax
mov rcx, qword [rdx + 0x10470]
mov qword [rsp + 0x28], rcx
mov qword [rdx + 0x10470], rsi
sub rsi, rcx
mov qword [rsp + 0x40], rsi
add rdx, 8
mov qword [rsp + 0x60], rdx
lea rdi, [rax + rsi]
mov qword [rsp + 0x30], rdi
lea rax, [0x00697178]
mov rbx, rsi
call fcn.00431520
lea rax, [0x00698440]
call fcn.004315e0
mov rcx, qword [rsp + 0x40]
lock xadd qword [rax + 8], rcx
lea rax, [0x00698440]
call fcn.004316c0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
nop dword [rax + rax]
call fcn.0042a8a0
mov rax, qword [rsp + 0x30]
mov ebx, 1
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00428fa0
Function at 0x4296e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x429826
push rbp
mov rbp, rsp
sub rsp, 0x28
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
jne 0x429744
nop dword [rax + rax]
cmp qword [rax], rbx
jne 0x42970d
mov rcx, qword [rbx]
mov qword [rax], rcx
jmp 0x429717
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov qword [rcx], rdx
cmp qword [rax + 8], rbx
jne 0x429727
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
jmp 0x429732
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
movups xmmword [rbx], xmm15
mov qword [rbx + 0x10], 0
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x10], rcx
call fcn.00438ae0
lea rax, [0x004e9838]
mov ebx, 0x2d
call fcn.00439360
mov rax, qword [rsp + 0x18]
call fcn.004390a0
lea rax, [0x004df43b]
mov ebx, 6
call fcn.00439360
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
call fcn.00439320
lea rax, [0x004df441]
mov ebx, 6
call fcn.00439360
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00439320
lea rax, [0x004e0176]
mov ebx, 0xb
call fcn.00439360
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00439320
lea rax, [0x004df447]
mov ebx, 6
call fcn.00439360
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00439320
call fcn.00438d20
call fcn.00438b40
lea rax, [0x004e180a]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004296e0
Function at 0x42a6e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42a866
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdx, qword [0x005fc7e0]
nop dword [rax]
cmp rdx, 0x15
ja 0x42a7e3
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x48], dil
test byte [rax], al
cmp dword [0x00696870], 0
je 0x42a733
nop
call fcn.00466460
mov qword [r11], rcx
mov rdx, qword [rax + 0x10120]
mov qword [r11 + 8], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rcx
mov qword [rax + 0x10120], rcx
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call fcn.00430700
mov rax, qword [rsp + 0x30]
movzx ebx, byte [rsp + 0x48]
call fcn.0042cbc0
mov rcx, qword [0x005fc388]
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x10078], rcx
cmp dword [0x00696870], 0
nop
jne 0x42a789
mov rdx, qword [rsp + 0x38]
jmp 0x42a7a1
call fcn.00466460
mov rdx, qword [rsp + 0x38]
mov qword [r11], rdx
mov rsi, qword [rax + 0x10118]
mov qword [r11 + 8], rsi
mov qword [rax + 0x10118], rdx
lea rdx, [rax + 0x100b8]
movzx ebx, byte [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, rdx
nop dword [rax]
call fcn.00423900
mov rdx, qword [rsp + 0x30]
add qword [rdx + 0x10128], rax
movzx esi, byte [rsp + 0x48]
mov byte [rdx + 0x10131], sil
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x18], rdx
call fcn.00438ae0
lea rax, [0x004e70ea]
mov ebx, 0x20
call fcn.00439360
mov rcx, qword [rsp + 0x18]
mov eax, 1
shl rax, cl
cmp rcx, 0x40
sbb rcx, rcx
and rax, rcx
call fcn.00439180
call fcn.00438d20
nop
call fcn.00438b40
call fcn.00438ae0
lea rax, [0x004e6274]
mov ebx, 0x1d
call fcn.00439360
mov eax, 0x200000
call fcn.00439180
call fcn.00438d20
call fcn.00438b40
lea rax, [0x004e93c3]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0042a6e0
Function at 0x42f820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f919
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x00696bf0]
test ecx, ecx
je 0x42f8f2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x0042f940]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.00464400
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x42f8ec
jae 0x42f90e
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.004441e0]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.00466800
nop
mov qword [rsp + 8], rax
nop
call fcn.00464520
mov rax, qword [rsp + 8]
jmp fcn.0042f820

Function at 0x42fca0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42fce6
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test rcx, rcx
je 0x42fcd0
lea rbx, [0x004ec038]
call fcn.0042fd00
add rsp, 0x10
pop rbp
ret
lea rax, [0x004e967c]
mov ebx, 0x2c
nop dword [rax]
call fcn.00437040
nop
mov qword [rsp + 8], rax
call fcn.00464520
mov rax, qword [rsp + 8]
jmp fcn.0042fca0

Function at 0x4305a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4305e7
push rbp
mov rbp, rsp
sub rsp, 0x10
movabs rcx, 0x800000000000
lea rdx, [rcx + rax]
add rcx, rbx
cmp rax, rdx
setbe dl
cmp rbx, rcx
setbe cl
cmp cl, dl
jne 0x4305d5
add rsp, 0x10
pop rbp
ret
lea rax, [0x004eaa82]
mov ebx, 0x3c
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004305a0
Function at 0x431280
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4313a6
push rbp
mov rbp, rsp
sub rsp, 0x20
nop
mov rcx, qword [rax + 0x20]
mov rdx, rcx
shr rcx, 0x20
nop
nop
cmp edx, ecx
ja 0x431336
shr ecx, 9
mov rdx, qword [rax + 0x10]
cmp rdx, rcx
jbe 0x4312fe
nop
nop
mov rdx, qword [rax + 8]
lea rcx, [rdx + rcx*8]
nop
nop
mov rbx, qword [rcx]
test rbx, rbx
je 0x4312fe
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x431325
mov edx, dword [rbx + 0x10]
cmp edx, 0x200
je 0x431313
mov qword [rsp + 0x30], rax
nop
nop
xor edx, edx
xchg qword [rcx], rdx
nop
nop
xor ecx, ecx
xchg dword [rbx + 0x10], ecx
lea rax, [0x00696728]
call fcn.0040bb00
mov rax, qword [rsp + 0x30]
nop
nop
xor ecx, ecx
xchg qword [rax + 0x20], rcx
nop
xor ecx, ecx
xchg qword [rax + 0x10], rcx
add rsp, 0x20
pop rbp
ret
lea rax, [0x004ea190]
mov ebx, 0x31
nop
call fcn.00437040
lea rax, [0x004ea554]
mov ebx, 0x34
call fcn.00437040
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], rcx
call fcn.00438ae0
lea rax, [0x004df5fe]
mov ebx, 7
call fcn.00439360
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.004390a0
lea rax, [0x004dfab0]
mov ebx, 9
call fcn.00439360
mov rax, qword [rsp + 0x18]
mov eax, eax
nop dword [rax]
call fcn.004390a0
call fcn.00438d20
call fcn.00438b40
lea rax, [0x004e7c35]
mov ebx, 0x23
nop dword [rax + rax]
call fcn.00437040
nop
mov qword [rsp + 8], rax
call fcn.00464520
mov rax, qword [rsp + 8]
jmp fcn.00431280
Function at 0x4318a0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x431b26
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1298]
mov rcx, qword [rax + 0x1288]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x431b1a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1288], 0
cmp byte [0x00696611], 0
jne 0x4318fa
xor edx, edx
xor ebx, ebx
jmp 0x431940
xor edx, edx
jmp 0x431925
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1298]
mov rax, rcx
call fcn.0041ffa0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x4318fe
add rax, 0x1288
call fcn.00431820
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x431ab4
mov rsi, qword [rax + rdx*8 + 0x1298]
cmp rsi, 0x1000
jb 0x43193b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00413880
test rax, rax
jne 0x43198c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43193b
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x4319cc
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43193b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x431b0d
lea r10, [0x00628718]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x431a4f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x431a85
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1270]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1270], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x43193b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x431b05
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1298], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x43193b
cmp rbx, 0x200
ja 0x431af4
lea rdx, [rax + 0x1298]
lea rsi, [rax + 0x1260]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00426a80
mov rax, qword [rsp + 0x48]
add rax, 0x1288
call fcn.00431820
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00466880
mov rax, r8
call fcn.00466800
mov rax, r8
mov ecx, 0x40
call fcn.00466820
mov edx, 0x200
nop
call fcn.00466860
nop
mov qword [rsp + 8], rax
call fcn.0046b0c0
mov rax, qword [rsp + 8]
jmp fcn.004318a0
Function at 0x4321a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43226d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rax, qword [sym.imp.kernel32.dll_CreateIoCompletionPort]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
call fcn.00434ac0
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x005fc390], rax
test rax, rax
je 0x432204
add rsp, 0x38
pop rbp
ret
call fcn.00467c40
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438ae0
lea rax, [0x004e9d6e]
mov ebx, 0x2f
call fcn.00439360
mov rax, qword [rsp + 0x30]
nop
call fcn.004390a0
lea rax, [0x004df050]
mov ebx, 3
call fcn.00439360
call fcn.00438b40
lea rax, [0x004e57f5]
mov ebx, 0x1b
call fcn.00437040
nop
call fcn.00464520
jmp fcn.004321a0

Function at 0x432320
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43240d
push rbp
mov rbp, rsp
sub rsp, 0x38
xor eax, eax
lea rcx, [0x00696640]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
jne 0x432351
add rsp, 0x38
pop rbp
ret
mov rax, qword [0x005fc390]
mov rcx, qword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.00434ac0
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
je 0x4323a0
add rsp, 0x38
pop rbp
ret
call fcn.00467c40
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
nop
call fcn.00438ae0
lea rax, [0x004eaabe]
mov ebx, 0x3c
call fcn.00439360
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.004390a0
lea rax, [0x004df050]
mov ebx, 3
call fcn.00439360
call fcn.00438b40
lea rax, [0x004ea383]
mov ebx, 0x33
call fcn.00437040
nop
call fcn.00464520
jmp fcn.00432320
Function at 0x4327c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x432837
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edx, dword [rbx + 0x28]
cmp edx, 0x72
je 0x4327db
cmp edx, 0x77
jne 0x4327f2
mov dword [rbx + 0x2c], ecx
mov dword [rbx + 0x30], edi
mov rbx, qword [rbx + 0x20]
mov ecx, edx
call fcn.00431d40
add rsp, 0x20
pop rbp
ret
mov dword [rsp + 0x1c], edx
call fcn.00438ae0
lea rax, [0x004eaafa]
mov ebx, 0x3c
call fcn.00439360
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.00439180
call fcn.00438d20
nop dword [rax]
call fcn.00438b40
lea rax, [0x004e3f7c]
mov ebx, 0x17
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.004327c0