joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4128e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x412a88
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x412a58
cmp qword [rax], 0
nop word [rax + rax]
je 0x412a58
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x412a6e
cmp byte [rax + 9], 0
jne 0x4129c4
mov rax, qword [rax + 0x10]
jmp 0x4129a0
inc rdx
add rcx, 8
cmp rdx, 8
jae 0x412989
mov rbx, qword [rsp + 0x38]
cmp qword [rcx], rbx
jne 0x412943
movzx ebx, byte [rdx + rax]
nop
cmp bl, 1
jbe 0x412943
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x51]
imul rdx, rcx
lea rax, [rdx + rax]
lea rax, [rax + 0x48]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x52]
lea rdx, [rax + rdx]
lea rdx, [rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
nop
test rax, rax
je 0x4129ae
nop
lea rcx, [rax + 8]
xor edx, edx
jmp 0x41294a
lea rax, [0x008123e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x48]
mov rbx, qword [rdx]
mov esi, dword [rax + 0xc]
lea rdi, [rsp + 0x38]
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x52]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
nop dword [rax]
test r8, r8
je 0x412a46
movzx edx, byte [rdx + 8]
test dl, 8
je 0x412a53
and rbx, rax
imul rdi, rbx
lea rax, [r8 + rdi]
movzx edx, byte [r8 + rdi]
add edx, 0xfffffffe
cmp dl, 3
jae 0x412a4e
mov rax, rcx
jmp 0x4129a0
mov rcx, rax
jmp 0x412a46
shr rbx, 1
jmp 0x412a2e
lea rax, [0x008123e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00663ad6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.004128e0
Function at 0x412aa0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x412c53
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x412c1e
cmp qword [rax], 0
nop word [rax + rax]
je 0x412c1e
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x412c39
cmp byte [rax + 9], 0
jne 0x412b8d
mov rax, qword [rax + 0x10]
jmp 0x412b64
inc rdx
add rcx, 8
cmp rdx, 8
jae 0x412b4e
mov rbx, qword [rsp + 0x38]
cmp qword [rcx], rbx
jne 0x412b03
movzx ebx, byte [rdx + rax]
nop
cmp bl, 1
jbe 0x412b03
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x51]
imul rdx, rcx
lea rax, [rdx + rax]
lea rax, [rax + 0x48]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x52]
lea rdx, [rax + rdx]
lea rdx, [rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
test rax, rax
je 0x412b72
nop
lea rcx, [rax + 8]
xor edx, edx
jmp 0x412b0a
lea rax, [0x008123e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x48]
mov rbx, qword [rdx]
mov esi, dword [rax + 0xc]
lea rdi, [rsp + 0x38]
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x52]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x412c0c
movzx edx, byte [rdx + 8]
test dl, 8
je 0x412c19
and rbx, rax
imul rdi, rbx
lea rax, [r8 + rdi]
movzx edx, byte [r8 + rdi]
add edx, 0xfffffffe
cmp dl, 3
jae 0x412c14
mov rax, rcx
jmp 0x412b64
mov rcx, rax
jmp 0x412c0c
shr rbx, 1
jmp 0x412bf4
lea rax, [0x008123e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00663ad6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00412aa0
Function at 0x415880
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x415ac7
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
call fcn.0043aa00
call fcn.0043aa00
lea rax, [0x0065d986]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0043b480
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0043b2a0
call fcn.0043aaa0
mov rax, qword [rsp + 0x48]
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x4159cb
call fcn.0043aa00
lea rax, [0x0065e75c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0043b480
call fcn.0043aaa0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.0043aa00
lea rax, [0x0065c390]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0043b480
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0043b2a0
lea rax, [0x0065be73]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0043b480
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.0043b2a0
lea rax, [0x0065be7f]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0043b480
movzx eax, byte [rsp + 0x27]
movzx eax, al
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
mov rax, qword [rsp + 0x58]
nop
test rax, rax
je 0x415a92
jmp 0x4159f3
call fcn.0043aa00
lea rax, [0x00660898]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0043b480
call fcn.0043aaa0
jmp 0x415916
call fcn.0043aa00
lea rax, [0x00662d2c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0043b480
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0043b2a0
lea rax, [0x0065a2a2]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0043b480
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
call fcn.0043b2a0
lea rax, [0x0065a2d0]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0043b480
nop
call fcn.0043aaa0
lea rax, [0x0065aaa3]
mov qword [rsp], rax
mov qword [rsp + 8], 6
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x18], rax
call fcn.00422aa0
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x00668d30]
mov qword [rsp], rax
mov qword [rsp + 8], 0x3e
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00415880
Function at 0x416440
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rsi, rdx
or rdx, rbx
mov rdi, qword [rsp + 0x78]
or rdx, rdi
test rdx, 7
jne 0x41663e
cmp byte [0x00811464], 0
nop word [rax + rax]
je 0x41662a
mov rdx, qword gs:[0x28]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 0x30]
mov rdx, qword [rdx + 0xa0]
test byte [rdx], al
nop
movabs r8, 0x800000000000
lea rax, [r8 + rbx]
mov r8, rax
shr rax, 0x2a
nop dword [rax]
cmp rax, 0x40
jae 0x416634
lea rcx, [0x007f2f78]
mov rax, qword [rcx + rax*8]
test byte [rax], al
shr r8, 0x16
mov rcx, r8
and r8, 0xfffff
mov rax, qword [rax + r8*8]
test rax, rax
je 0x41661c
mov r9, rbx
shr rbx, 5
and rbx, 0x1ffff
add rbx, rax
shr r9, 3
and r9, 3
add rax, 0x1ffff
mov qword [rsp + 0x50], rdx
xor r8d, r8d
jmp 0x416520
add r8, 8
nop
cmp rdi, r8
jbe 0x416612
mov qword [rsp + 0x38], r8
movzx r10d, byte [rbx]
bt r10d, r9d
jae 0x41656c
lea r10, [r8 + rsi]
mov r11, qword [rdx + 0x16c0]
mov r10, qword [r10]
mov qword [r11], 0
mov qword [r11 + 8], r10
mov r10, qword [rdx + 0x16c0]
add r10, 0x10
mov qword [rdx + 0x16c0], r10
cmp qword [rdx + 0x16c8], r10
je 0x4165c7
cmp r9d, 3
jae 0x416577
inc r9d
jmp 0x41651b
cmp rax, rbx
je 0x416584
inc rbx
xor r9d, r9d
jmp 0x41651b
mov qword [rsp], rbx
mov dword [rsp + 8], r9d
mov dword [rsp + 0xc], ecx
mov qword [rsp + 0x10], rax
call fcn.00415ce0
mov rbx, qword [rsp + 0x18]
mov r9d, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x24]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x38]
jmp 0x41651b
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movups xmmword [rsp], xmm0
call fcn.00431c20
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x38]
mov r9d, dword [rsp + 0x30]
jmp 0x41656c
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
xor ecx, ecx
xor r9d, r9d
xor eax, eax
xor ebx, ebx
jmp 0x416511
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov ecx, 0x40
call fcn.0046cde0
lea rax, [0x00665d1f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.00439220
nop
int3
Function at 0x416820
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x416ac5
mov rcx, qword [rsp + 0x78]
cmp qword [rax], rcx
jne 0x4169ed
movzx ecx, byte [rax + 0x17]
test cl, 0x40
jne 0x416961
cmp byte [0x00811464], 0
nop
je 0x416957
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0xa0]
mov qword [rsp + 0x48], rcx
test byte [rcx], al
mov rdx, qword [rax + 0x20]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
xor edi, edi
xor r8d, r8d
jmp 0x4168a1
add rdi, 8
cmp qword [rax + 8], rdi
jbe 0x41694d
test rdi, 0x3f
jne 0x416945
movzx r8d, byte [rdx]
nop
inc rdx
bt r8d, 0
jae 0x41689d
lea r9, [rdi + rsi]
lea r10, [rdi + rbx]
mov r11, qword [rcx + 0x16c0]
mov r9, qword [r9]
mov r10, qword [r10]
mov qword [r11], r9
mov qword [r11 + 8], r10
mov r9, qword [rcx + 0x16c0]
add r9, 0x10
mov qword [rcx + 0x16c0], r9
cmp qword [rcx + 0x16c8], r9
jne 0x41689d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x1c], r8d
mov qword [rsp + 0x38], rdx
xorps xmm0, xmm0
movups xmmword [rsp], xmm0
call fcn.00431c20
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20]
mov r8d, dword [rsp + 0x1c]
nop dword [rax]
jmp 0x41689d
shr r8d, 1
jmp 0x4168c0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp], rax
call fcn.0045e720
mov rax, qword [rsp + 8]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x30], rcx
nop
call fcn.0043aa00
lea rax, [0x00665fc7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0043b480
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0043b480
lea rax, [0x0065cbf1]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
call fcn.0043b480
call fcn.0043aaa0
lea rax, [0x00664df0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.00439220
mov qword [rsp], rax
call fcn.0045e720
mov rax, qword [rsp + 8]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rdx
call fcn.0043aa00
lea rax, [0x00665fc7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0043b480
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0043b480
lea rax, [0x0065b93e]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0043b480
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x0065da85]
mov qword [rsp], rax
mov qword [rsp + 8], 0x12
call fcn.0043b480
mov rax, qword [rsp + 0x78]
mov qword [rsp], rax
call fcn.0043b100
nop dword [rax + rax]
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x00664df0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
nop
call fcn.00439220
lea rax, [0x00666348]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.00439220
nop
int3
Function at 0x418680
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x418954
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
test byte [rdx], al
movzx eax, byte [rsp + 0x50]
nop word [rax + rax]
nop dword [rax]
cmp rax, 0x88
jae 0x418949
mov rcx, qword [rdx + rax*8 + 0x28]
movzx ebx, word [rcx + 0x60]
cmp qword [rcx + 0x38], rbx
jne 0x418930
lea rbx, [0x00811960]
cmp rcx, rbx
je 0x41871d
mov ebx, dword [0x007f2f08]
add ebx, 3
cmp dword [rcx + 0x58], ebx
jne 0x418917
lea rdx, [rax + rax*2]
shl rdx, 6
lea rbx, [0x007f3210]
add rdx, rbx
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call fcn.00419320
movzx eax, byte [rsp + 0x50]
lea rcx, [rax + rax*2]
shl rcx, 6
lea rdx, [0x007f3210]
add rcx, rdx
mov qword [rsp], rcx
call fcn.00418f60
mov rax, qword [rsp + 8]
test rax, rax
je 0x4188fe
movzx ecx, word [rax + 0x60]
cmp qword [rax + 0x38], rcx
je 0x4188e5
mov qword [rsp + 0x28], rax
mov ecx, dword [0x007f2f08]
add ecx, 3
mov dword [rax + 0x58], ecx
lea rcx, [0x00814f48]
mov qword [rsp], rcx
call fcn.00431940
mov rax, qword [rsp + 8]
test byte [rax], al
movzx ecx, byte [rsp + 0x50]
shr cl, 1
movsx rcx, cl
cmp rcx, 0x44
jae 0x4188d8
lea rax, [rax + rcx*8]
lea rax, [rax + 0x40]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x38]
movzx ebx, word [rcx + 0x60]
sub rdx, rbx
lock xadd qword [rax], rdx
lea rax, [0x00814f48]
mov qword [rsp], rax
nop
call fcn.00431a80
mov rax, qword [rsp + 0x28]
movzx ecx, word [rax + 0x60]
mov rdx, qword [rax + 0x68]
imul rcx, rdx
mov rdx, qword [rax + 0x20]
shl rdx, 0xd
sub rdx, rcx
lea rcx, [0x00814f30]
lock xadd qword [rcx], rdx
movzx ecx, byte [rsp + 0x50]
cmp cl, 5
jne 0x4188ce
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x20]
lea rsi, [0x00814f08]
lock xadd qword [rsi], rbx
mov qword [rdx + 0x20], 0
mov rbx, qword [rdx + 8]
lea rsi, [0x00814f38]
lock xadd qword [rsi], rbx
mov qword [rdx + 8], 0
cmp byte [0x007d2d10], 0
jne 0x418876
cmp dword [0x00811114], 0
jne 0x418851
mov qword [rdx + rcx*8 + 0x28], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00811b40]
mov qword [rsp], rax
nop dword [rax]
call fcn.0041b820
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
jmp 0x418842
nop
mov qword [rsp + 0x30], 0
mov rax, qword [0x00814f30]
mov qword [rsp + 0x30], rax
mov byte [rsp], 0x21
mov qword [rsp + 8], 0xffffffffffffffff
lea rax, [rsp + 0x30]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 1
mov qword [rsp + 0x20], 1
call fcn.00458a40
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
jmp 0x418839
mov rdx, qword [rsp + 0x48]
jmp 0x418818
mov rax, rcx
mov ecx, 0x44
call fcn.0046cdc0
lea rax, [0x0065f996]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.00439220
lea rax, [0x0065c641]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.00439220
lea rax, [0x0065f6ec]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.00439220
lea rax, [0x00665eaf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.00439220
mov ecx, 0x88
call fcn.0046cdc0
nop
call fcn.0046abe0
jmp fcn.00418680
Function at 0x418e40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x418f40
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, dword [0x007f2f08]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0x488]
cmp eax, edx
je 0x418eb6
lea ebx, [rax - 2]
cmp edx, ebx
jne 0x418ec1
mov qword [rsp], rcx
call fcn.00418c60
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0044ec80
mov eax, dword [0x007f2f08]
mov rcx, qword [rsp + 0x28]
xchg dword [rcx + 0x488], eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
mov dword [rsp + 0x10], eax
mov dword [rsp + 0x14], edx
call fcn.0043aa00
lea rax, [0x0065c557]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0043b480
mov eax, dword [rsp + 0x14]
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x006628d6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0043b480
mov eax, dword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
nop
call fcn.0043aaa0
lea rax, [0x0065c09b]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.00439220
nop
nop
call fcn.0046abe0
jmp fcn.00418e40

Function at 0x419320
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x419414
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
cmp word [rax + 0x60], 0
je 0x4193fa
mov ecx, dword [0x007f2f08]
lea edx, [rcx + 1]
mov ebx, dword [rax + 0x58]
cmp ebx, edx
jne 0x4193ee
lea esi, [rcx - 1]
xchg dword [rax + 0x58], esi
cmp ebx, edx
je 0x4193de
mov rdx, qword [rax + 0x38]
movzx ebx, word [rax + 0x60]
sub rdx, rbx
test rdx, rdx
jle 0x4193b6
mov rdx, qword [rsp + 0x28]
test byte [rdx], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rcx, [rdx + rcx*8]
lea rcx, [rcx + 8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00431140
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rsp + 0x28]
test byte [rdx], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rcx, [rdx + rcx*8]
lea rcx, [rcx + 0x58]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00431140
jmp 0x4193ac
mov qword [rsp], rax
mov byte [rsp + 8], 0
call fcn.00425be0
jmp 0x4193ac
mov edx, ecx
xchg dword [rax + 0x58], ecx
mov ecx, edx
jmp 0x419374
lea rax, [0x00664f7c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00419320
Function at 0x4195e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x419717
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, qword [0x007f31b0]
mov qword [rsp + 0x38], rdx
mov rbx, qword [0x007f31b8]
mov qword [rsp + 0x30], rbx
xor eax, eax
jmp 0x419640
mov byte [rdi + rcx], 0
inc rcx
cmp rcx, 0x10000
jl 0x419624
inc rax
nop word [rax + rax]
cmp rax, rbx
jge 0x4196df
mov rsi, qword [rdx + rax*8]
mov rdi, rsi
shr rsi, 0x14
cmp rsi, 0x40
jae 0x419709
lea r8, [0x007f2f78]
mov rsi, qword [r8 + rsi*8]
test byte [rsi], al
and rdi, 0xfffff
mov rsi, qword [rsi + rdi*8]
test byte [rsi], al
mov rdi, qword [rsi + 0x210c0]
nop
test rdi, rdi
je 0x419689
xor ecx, ecx
jmp 0x41962b
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp], 0x10000
mov qword [rsp + 8], 0
lea rax, [0x00813858]
mov qword [rsp + 0x10], rax
call fcn.0040e900
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x4196f0
mov rsi, qword [rsp + 0x20]
mov qword [rsi + 0x210c0], rax
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jmp 0x419634
mov byte [0x008110dc], 1
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0066660c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
call fcn.00439220
mov rax, rsi
mov ecx, 0x40
call fcn.0046cde0
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.004195e0
Function at 0x4197e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4199fa
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
movzx edx, byte [rdx]
movzx ebx, byte [rsp + 0x50]
test dl, bl
je 0x4198b7
nop
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x4198ad
lea rbx, [0x007f2f78]
mov rax, qword [rbx + rax*8]
test byte [rax], al
shr rdx, 0x16
and rdx, 0xfffff
mov rax, qword [rax + rdx*8]
test byte [rax], al
mov rax, qword [rax + 0x210c0]
test byte [rax], al
mov rdx, rcx
shr rcx, 0x19
movzx ebx, cx
add rax, rbx
mov bl, byte [rax]
shr rdx, 0x16
and rdx, 7
mov rcx, rdx
mov esi, 1
shl esi, cl
test sil, bl
je 0x41989a
mov byte [rsp + 0x60], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lock or byte [rax], sil
mov byte [rsp + 0x60], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov ecx, 0x40
call fcn.0046cde0
call fcn.0043aa00
nop dword [rax]
call fcn.0043aa00
lea rax, [0x006689f7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x39
call fcn.0043b480
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0043b2a0
call fcn.0043ace0
call fcn.0043aaa0
call fcn.0043aa00
lea rax, [0x006607bf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0043b480
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
nop dword [rax]
call fcn.0043b2a0
lea rax, [0x0065a2a2]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0043b480
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0043b2a0
lea rax, [0x0065a2d0]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0043b480
call fcn.0043aaa0
lea rax, [0x0065a5e7]
mov qword [rsp], rax
mov qword [rsp + 8], 4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x18], rax
call fcn.00422aa0
lea rax, [0x0065a4c6]
mov qword [rsp], rax
mov qword [rsp + 8], 3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0xffffffffffffffff
nop
call fcn.00422aa0
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x00662feb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.00439220
nop
call fcn.0046abe0
nop
jmp fcn.004197e0
Function at 0x419aa0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x419c30
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [sym.imp.kernel32.dll_VirtualFree]
mov rcx, qword [rsp + 0x58]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x4000
call fcn.00435ae0
cmp qword [rsp + 0x20], 0
nop dword [rax + rax]
jne 0x419b9d
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
jmp 0x419b42
shr rcx, 1
and rcx, 0xfffffffffffff000
mov qword [rsp + 0x28], rcx
cmp rcx, 0x1000
jae 0x419b56
xor ebx, ebx
test bl, bl
jne 0x419b12
cmp rcx, 0x1000
jb 0x419ba7
sub rdx, rcx
add rax, rcx
mov rcx, rdx
test rcx, rcx
jbe 0x419b93
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rax
mov rdx, rcx
jmp 0x419b1c
mov rdx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rdx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], 0x4000
call fcn.00435ae0
cmp qword [rsp + 0x20], 0
sete bl
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
jmp 0x419b2c
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0046e160
mov eax, dword [rsp]
mov qword [rsp + 0x38], rax
call fcn.0043aa00
lea rax, [0x006607a7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0043b480
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.0043b100
lea rax, [0x0066087f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0043b480
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x00663d6a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00419aa0