joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4448b0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x444a20
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.00444870
mov rax, qword [rsp + 8]
test rax, rax
je 0x4449d0
mov rcx, qword [rax + 0x50]
mov rdx, qword [rsp + 0x20]
mov rbx, rdx
sub rdx, rcx
mov rcx, rdx
shr rdx, 0xc
lea rdx, [rdx + rdx*4]
shl rdx, 2
add rdx, qword [rax + 0x48]
and rcx, 0xfff
shr rcx, 8
mov esi, dword [rdx]
cmp rcx, 0x10
jae 0x444a19
movzx ecx, byte [rdx + rcx + 4]
add ecx, esi
mov rdx, qword [rax + 0x18]
mov rsi, qword [rax + 0x20]
cmp ecx, esi
jb 0x444944
lea rcx, [rsi - 1]
mov edi, ecx
cmp rdi, rsi
jae 0x444a12
shl rdi, 4
mov rdi, qword [rdx + rdi]
cmp rbx, rdi
jb 0x444960
jmp 0x4449b6
dec ecx
mov edi, ecx
cmp rdi, rsi
jae 0x444a0b
shl rdi, 4
mov rdi, qword [rdi + rdx]
cmp rdi, rbx
jbe 0x44497c
test ecx, ecx
ja 0x44495e
test ecx, ecx
je 0x4449f0
mov rbx, qword [rax]
mov rdi, qword [rax + 8]
mov ecx, ecx
cmp rcx, rsi
jae 0x4449e2
shl rcx, 4
mov rcx, qword [rdx + rcx + 8]
cmp rcx, rdi
jae 0x4449e2
add rcx, rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, r8d
lea edi, [rcx + 1]
cmp rdi, rsi
jae 0x4449e9
mov r8d, edi
shl rdi, 4
mov rdi, qword [rdx + rdi]
cmp rdi, rbx
jbe 0x4449b3
jmp 0x444980
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.00429b50
ud2
call fcn.00429b50
ud2
lea rax, [0x006b562b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0042b3a0
ud2
call fcn.00429b50
ud2
call fcn.00429b50
ud2
call fcn.00429b50
ud2
call fcn.00452950
jmp fcn.004448b0
Function at 0x4451e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x445366
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x445332
mov ecx, dword [rax + 0x18]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx ebx, byte [rsp + 0x70]
mov byte [rsp + 0x28], bl
call fcn.00444a30
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
mov edx, dword [rcx + 0x1c]
mov dword [rsp + 0x10], edx
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0x70]
mov byte [rsp + 0x28], dl
call fcn.00444a30
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x4452cd
lea rax, [0x006aafa5]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp eax, 0xffffffff
je 0x4452a0
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rdx + 0x38]
mov rsi, qword [rdx + 0x30]
cmp rcx, rbx
jge 0x4452a0
mov rbx, qword [rdx]
mov rdx, qword [rdx + 8]
jae 0x44535f
mov ecx, dword [rsi + rcx*4]
cmp rcx, rdx
jae 0x44535f
mov dword [rsp + 0x3c], eax
lea rax, [rbx + rcx]
mov qword [rsp], rax
call fcn.00442d00
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x88], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x006aafa5]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00429b50
ud2
call fcn.00452950
jmp fcn.004451e0
Function at 0x4453f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x445552
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rdx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call fcn.00444a30
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x445472
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call fcn.00444ff0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x50], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x48], rdx
call fcn.0042bc80
lea rax, [0x006ae2db]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042c640
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
call fcn.0042c640
call fcn.0042bee0
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0042c4d0
call fcn.0042bee0
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.0042c4d0
call fcn.0042bee0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042c4d0
call fcn.0042bee0
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call fcn.0042c460
call fcn.0042bf30
call fcn.0042bd10
mov eax, dword [rsp + 0x3c]
jmp 0x445461
call fcn.00452950
jmp fcn.004453f0

Function at 0x445920
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x445999
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov eax, dword [rsp + 0x28]
test eax, eax
jl 0x44597e
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx]
cmp eax, edx
jge 0x44597e
mov edx, dword [rcx + 4]
mov dword [rsp + 0x30], edx
add edx, 7
sar edx, 3
imul eax, edx
movsxd rax, eax
lea rax, [rcx + rax + 8]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006b487b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00445920
Function at 0x445de0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
inc dword [rax + 0x2c8]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
lea rdx, [rcx + 0x138]
test byte [rdx], al
mov rdx, rax
mov qword [rcx + 0x138], rax
lea rax, [rdx + 0xe0]
test byte [rax], al
mov rax, qword [rdx + 0x30]
mov qword [rdx + 0xe0], rax
mov dword [rsp], 0
lea rax, fcn.00435590
mov qword [rsp + 8], rax
call fcn.00429e40
test eax, eax
jne 0x445f12
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x18], rax
lea rcx, [rax + 0x358]
test byte [rcx], al
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x358], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x360], rdx
lea rdx, [rsp + 0x40]
mov qword [rax + 0x368], rdx
mov rdx, qword [0x00833b40]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call fcn.00402340
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x370]
mov rdx, qword [rax + 0x378]
mov rax, qword [rax + 0x380]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
nop
call fcn.0042a750
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
call fcn.0042a750
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x449680
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x30]
cmp rax, qword [rcx + 0x10]
jbe 0x449872
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0x50], 0
lea rdi, [rsp + 0x58]
xorps xmm0, xmm0
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004555c5
mov rbp, qword [rbp]
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax + 0x28]
jmp 0x4496f8
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 0x28]
xorps xmm0, xmm0
test rax, rax
je 0x449807
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x449777
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rsp], rax
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0xc0]
mov rbx, qword [rdx]
call rbx
movzx eax, byte [rsp + 0x10]
test al, al
jne 0x4496ec
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0x40], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
call fcn.004448b0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
test rcx, rcx
je 0x449817
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x48]
mov ebx, dword [rdx]
test ebx, ebx
jne 0x449801
xor ebx, ebx
mov qword [rsp + 0x90], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
mov byte [rsp + 0x18], 1
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.0044b560
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
jmp 0x449731
lea rbx, [rdx + 0x30]
jmp 0x4497b3
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
call fcn.0042bc80
lea rax, [0x006b36da]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042c640
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042c4d0
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006ac7ac]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00449680
Function at 0x44bcb0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0xe0]
cmp rax, qword [rcx + 0x10]
jbe 0x44bf08
sub rsp, 0x160
mov qword [rsp + 0x158], rbp
lea rbp, [rsp + 0x158]
movzx eax, byte [0x00850a60]
test al, al
je 0x44befb
mov rax, qword [rsp + 0x180]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x44bd34
mov edx, dword [rcx + 0x108]
test edx, edx
jle 0x44bd34
mov rdx, qword [rax + 0x70]
test rdx, rdx
je 0x44bd34
mov rdx, qword [rcx + 0x110]
test rdx, rdx
je 0x44bd34
mov rdx, qword [rdx]
test rdx, rdx
jne 0x44be92
mov ecx, dword [rax + 0x90]
and ecx, 0xffffefff
cmp ecx, 3
jne 0x44be75
mov rcx, qword [rax + 0x78]
mov rdx, qword [rax + 0x70]
mov rbx, qword [rsp + 0x188]
and rbx, 0xfffffffffffffffd
mov qword [rsp + 0x168], rcx
mov qword [rsp + 0x170], rdx
mov qword [rsp + 0x188], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov rsi, qword [rsp + 0x178]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0x64
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
call fcn.00449880
mov rax, qword [rsp + 0x50]
test rax, rax
jne 0x44bdc8
mov rcx, qword [rsp + 0x188]
bt ecx, 0
jae 0x44be14
cmp rax, 0x64
je 0x44bdef
mov rax, qword [rsp + 0x180]
mov qword [rsp], rax
call fcn.0044b980
mov rbp, qword [rsp + 0x158]
add rsp, 0x160
ret
call fcn.0042bc80
lea rax, [0x006b3e49]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042c640
call fcn.0042bd10
jmp 0x44bdce
mov rax, qword [rsp + 0x168]
mov qword [rsp], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0x64
movups xmmword [rsp + 0x38], xmm0
or rcx, 1
mov qword [rsp + 0x48], rcx
call fcn.00449880
mov rax, qword [rsp + 0x50]
jmp 0x44bdc8
mov rcx, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x188]
jmp 0x44bd5d
mov edx, 1
xchg dword [rcx + 0x10c], edx
mov rcx, qword [rax + 0x30]
mov rsi, qword [rcx + 0x110]
test byte [rcx], al
lea rdi, [rsp + 0x58]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00455890
mov rbp, qword [rbp]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x110]
mov qword [rcx], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0x10c], edx
lea rcx, [rsp + 0x58]
mov qword [rsp], rcx
call fcn.0044cb00
mov rax, qword [rsp + 0x180]
jmp 0x44bd34
mov rax, qword [rsp + 0x180]
jmp 0x44bd34
call fcn.00452950
jmp fcn.0044bcb0
Function at 0x44bf20
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44c000
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x004521b0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004527f0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.00452950
jmp fcn.0044bf20
Function at 0x44c600
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44c8ce
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov ecx, dword [0x007f713c]
mov rax, qword [rax + 0x30]
movzx eax, byte [rax + 0xf9]
test al, al
je 0x44c8c4
movzx eax, al
mov dword [rsp + 0x24], eax
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x90]
test rdx, rdx
je 0x44c8ba
mov rbx, qword [rsp + 0x68]
cmp rbx, rdx
jne 0x44c86a
lea rax, [0x00850b20]
mov qword [rsp], rax
call fcn.0040eda0
mov rax, qword [0x00834f48]
mov qword [rsp + 0x30], rax
mov rcx, qword [0x00834f40]
mov qword [rsp + 0x50], rcx
xor edx, edx
jmp 0x44c6be
inc rdx
cmp rdx, rax
jge 0x44c850
mov rbx, qword [rcx + rdx*8]
mov rsi, qword [rsp + 0x68]
cmp rsi, rbx
je 0x44c6bb
mov rdi, qword [rsp + 0x48]
mov r8, qword [rdi + 0x30]
mov r8, qword [r8 + 0x90]
cmp rbx, r8
je 0x44c6bb
mov r8d, dword [rbx + 0x90]
cmp r8d, 6
je 0x44c6bb
mov r8, qword [rbx + 0x128]
mov r9, qword [0x00850c38]
cmp r9, r8
jne 0x44c71b
movzx r9d, byte [0x00850a59]
test r9b, r9b
je 0x44c845
mov r9, qword [0x00850b38]
cmp r9, r8
jne 0x44c804
mov r8d, 1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rbx
test r8b, r8b
je 0x44c74f
mov r8d, dword [rsp + 0x24]
cmp r8d, 2
jl 0x44c6bb
call fcn.0042bc80
call fcn.0042bf30
call fcn.0042bd10
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0044c360
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x30]
cmp rcx, rbx
je 0x44c794
mov ecx, dword [rax + 0x90]
and ecx, 0xffffefff
cmp ecx, 2
je 0x44c7d1
mov qword [rsp], 0xffffffffffffffff
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], rax
call fcn.0044bbd0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x68]
jmp 0x44c6bb
call fcn.0042bc80
lea rax, [0x006b9b2b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0042c640
call fcn.0042bd10
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0044b980
jmp 0x44c7b8
mov r9, qword [0x00850b98]
cmp r9, r8
jne 0x44c81b
mov r8d, 1
jmp 0x44c731
mov r9, qword [0x00850c90]
cmp r9, r8
jne 0x44c832
mov r8d, 1
jmp 0x44c731
mov r9, qword [0x00850ba0]
cmp r9, r8
sete r8b
jmp 0x44c731
mov r8d, 1
jmp 0x44c731
lea rax, [0x00850b20]
mov qword [rsp], rax
call fcn.0040ef90
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x40], rdx
call fcn.0042bc80
call fcn.0042bf30
call fcn.0042bd10
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0044c360
mov qword [rsp], 0xffffffffffffffff
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x18], rax
call fcn.0044bbd0
jmp 0x44c68f
mov rbx, qword [rsp + 0x68]
jmp 0x44c68f
shr ecx, 2
mov eax, ecx
jmp 0x44c654
call fcn.00452950
jmp fcn.0044c600
Function at 0x44d1b0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44d487
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x44d3ae
mov rcx, qword [rsp + 0x68]
lea rdx, [0x007fe6c0]
jmp 0x44d1f9
mov rdx, qword [rdx + 0x1c0]
test rdx, rdx
je 0x44d234
mov rbx, qword [rdx + 0xc8]
cmp rcx, rbx
jb 0x44d1f2
mov rsi, qword [rdx + 0xd0]
cmp rcx, rsi
jae 0x44d1f2
movsxd rcx, eax
add rcx, rbx
cmp rcx, rsi
ja 0x44d3dc
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x30], rcx
call fcn.0044d110
lea rax, [0x0065c180]
mov qword [rsp], rax
mov rax, qword [0x00835030]
mov qword [rsp + 8], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x10], eax
call fcn.00409e90
mov rax, qword [rsp + 0x18]
movzx ecx, byte [rsp + 0x20]
mov byte [rsp + 0x2f], cl
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
call fcn.0044d160
movzx eax, byte [rsp + 0x2f]
test al, al
jne 0x44d39a
call fcn.0042bc80
lea rax, [0x006ae955]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042c640
mov eax, dword [rsp + 0x70]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042c4d0
lea rax, [0x006ab6f4]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042c640
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042c4d0
lea rax, [0x006ade9b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042c640
call fcn.0042bd10
lea rax, [0x007fe6c0]
jmp 0x44d38f
mov qword [rsp + 0x50], rax
mov rcx, qword [rax + 0xc8]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0xd0]
mov qword [rsp + 0x38], rdx
call fcn.0042bc80
lea rax, [0x006abbfd]
mov qword [rsp], rax
mov qword [rsp + 8], 7
call fcn.0042c640
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c4d0
lea rax, [0x006abcde]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0042c640
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042c4d0
call fcn.0042bf30
call fcn.0042bd10
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x1c0]
test rax, rax
jne 0x44d309
jmp 0x44d3c1
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x78], 0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x006b82d6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2e
call fcn.0042b3a0
ud2
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rsi
call fcn.0042bc80
lea rax, [0x006ae955]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042c640
mov eax, dword [rsp + 0x70]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042c4d0
lea rax, [0x006ad57d]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042c640
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c4d0
lea rax, [0x006ab0a9]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0042c640
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042c4d0
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006b4e9d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0044d1b0
Function at 0x45cd10
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45cde7
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, 0xffffffff
mov rdx, qword [rsp + 0x28]
lock xadd dword [rdx], ecx
lea ebx, [rcx - 1]
bt ecx, 0
jae 0x45cdbc
bt ebx, 2
jae 0x45cd59
jmp 0x45cda0
mov ebx, dword [rdx]
mov eax, ebx
sar ebx, 3
test ebx, ebx
je 0x45cd96
test eax, 7
jne 0x45cd96
lea ecx, [rax - 8]
or ecx, 2
lock cmpxchg dword [rdx], ecx
sete cl
test cl, cl
je 0x45cd57
lea rax, [rdx + 4]
mov qword [rsp], rax
mov byte [rsp + 8], 0
call fcn.0043be20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [rdx + 4]
mov qword [rsp], rax
mov byte [rsp + 8], 1
call fcn.0043be20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x14], ebx
lea rax, [0x006b3dd1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0042b350
mov rdx, qword [rsp + 0x28]
mov ebx, dword [rsp + 0x14]
jmp 0x45cd4f
call fcn.00452950
jmp fcn.0045cd10

Function at 0x45dba0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45dcdc
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
test byte [rax], al
mov rcx, rax
test rax, 7
jne 0x45dc73
mov rax, rcx
mov rdx, qword [rsp + 0x30]
mov rbx, rdx
shl rdx, 0x20
mov rsi, rdx
lock xadd qword [rcx], rdx
add rdx, rsi
mov rsi, rdx
shr rdx, 0x20
test edx, edx
jl 0x45dcbe
test esi, esi
je 0x45dc6f
test rbx, rbx
jle 0x45dc6b
cmp edx, ebx
je 0x45dca0
test edx, edx
jg 0x45dc61
test esi, esi
je 0x45dc61
mov rdx, qword [rcx]
cmp rdx, rsi
jne 0x45dc82
mov qword [rcx], 0
jmp 0x45dc53
mov dword [rsp + 0x14], esi
lea rcx, [rax + 0xc]
mov qword [rsp], rcx
mov byte [rsp + 8], 0
call fcn.0043be20
mov eax, dword [rsp + 0x14]
lea esi, [rax - 1]
mov rax, qword [rsp + 0x28]
test esi, esi
jne 0x45dc31
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
test edx, edx
jmp 0x45dc1a
test edx, edx
jmp 0x45dc1a
lea rdx, [rcx + 4]
mov rax, rcx
mov rcx, rdx
jmp 0x45dbe1
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6f20]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6f10]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6f00]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.0045dba0
Function at 0x45dd40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45de04
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
test byte [rcx], al
mov rdx, rcx
test rcx, 7
jne 0x45ddda
mov rax, rdx
jmp 0x45dd83
mov rax, rsi
mov rcx, qword [rdx]
mov rbx, rcx
shr rcx, 0x20
test ecx, ecx
je 0x45ddd0
lea rcx, [rbx + 1]
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rdx], rcx
sete cl
test cl, cl
je 0x45dd80
mov qword [rsp + 0x10], rdx
lea rax, [rsi + 0xc]
mov qword [rsp], rax
call fcn.0043bd60
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
test rax, rax
jne 0x45dde6
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rcx, [rdx + 4]
mov rax, rdx
mov rdx, rcx
jmp 0x45dd83
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6f30]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.0045dd40