joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c860
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c818
test byte [rbx + 0x40], 0xc
jne 0x14001c7cf
mov eax, dword [0x140030658]
test eax, eax
jne 0x14001c7e0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.14001a720
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x14001c803
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x14001c803
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001c82c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001aa10
call fcn.14001b550
test rax, rax
mov rbx, rax
jne 0x14001c7bf
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001c84a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.14001aa10
call fcn.14001c6c0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14001c8d0
call fcn.14001d9b0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x14001c908
call fcn.14001b4a0
mov ecx, dword [0x140020678]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c960
test esi, esi
je 0x14001c8e6
call fcn.14001c7a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c940
mov edx, edi
call fcn.14001da60
call fcn.14001c7a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001c950
call fcn.14001c7a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001c7a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b4a0
mov ecx, dword [0x140020678]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x14001c8a5
call fcn.14001b550
mov rbx, rax
jmp 0x14001c8a5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c8be
call fcn.14001b550
jmp 0x14001c8e6
call fcn.14001b550
mov rbx, rax
jmp 0x14001c8a1

Function at 0x14001c970
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c9e0
test esi, esi
je 0x14001c9c0
call fcn.14001c7a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c9f0
mov edx, esi
call fcn.14001da60
call fcn.14001c7a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001c7a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001c7a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001b550
mov rbx, rax
jmp 0x14001c991
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c9aa
Function at 0x401070
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4011a4
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x401186
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
test rcx, rcx
je 0x4010eb
mov rdx, rcx
cmp rcx, 0xffffffffffffffff
je 0x4010a6
mov rcx, qword [rsp + 0x38]
cmp rdx, rcx
jne 0x401168
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 8], rcx
add rax, 8
mov qword [rsp], rax
call fcn.00402270
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00438720
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0xffffffffffffffff
call fcn.004022d0
movzx eax, byte [rsp + 0x18]
test al, al
jne 0x401125
call fcn.00438750
mov rax, qword [rsp + 0x30]
jmp 0x4010a6
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 8]
mov qword [rsp], rcx
call fcn.00402270
mov rax, qword [rsp + 0x38]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.00402270
call fcn.00438750
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6f50]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x00649960]
mov qword [rsp], rax
lea rax, [0x006f6f40]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00401070
Function at 0x4032e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40353e
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
mov rdx, qword [rcx]
cmp rdx, 0x10000
jae 0x403523
movzx ebx, byte [rcx + 0x15]
cmp bl, 8
ja 0x403508
mov rbx, qword [rsp + 0x48]
test rbx, rbx
jl 0x4034ea
cmp rdx, 0x21
jae 0x4034d0
lea rax, [0x007fcb60]
mov rax, qword [rax + rdx*8]
cmp rbx, rax
ja 0x4034ea
mov rax, rdx
imul rdx, rbx
movabs rsi, 0x7ffffff9f
cmp rdx, rsi
ja 0x4034ea
mov qword [rsp + 0x20], rcx
test rbx, rbx
jne 0x403403
mov qword [rsp], 0x60
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.00410030
mov rax, qword [rsp + 0x18]
test byte [rax], al
mov ecx, dword [0x00850df0]
lea rdi, [rax + 0x10]
test ecx, ecx
jne 0x4033fc
mov qword [rax + 0x10], rax
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
mov word [rax + 0x18], dx
mov edx, dword [0x00850df0]
lea rdi, [rax + 0x20]
test edx, edx
jne 0x4033ec
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, rax
mov rax, rcx
call fcn.004553b0
mov rax, rdx
jmp 0x4033d4
call fcn.004553b0
jmp 0x4033b6
test rax, rax
je 0x403382
movzx eax, byte [rcx + 0x17]
test al, 0x80
je 0x403464
lea rax, [rdx + 0x60]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.00410030
mov rax, qword [rsp + 0x18]
test byte [rax], al
mov ecx, dword [0x00850df0]
lea rdi, [rax + 0x10]
lea rdx, [rax + 0x60]
test ecx, ecx
jne 0x403451
mov qword [rax + 0x10], rdx
jmp 0x4033b6
mov rcx, rax
mov rax, rdx
call fcn.004553b0
mov rax, rcx
jmp 0x4033b6
lea rax, [0x00699a60]
mov qword [rsp], rax
call fcn.00410b80
mov rax, qword [rsp + 8]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
mov rbx, qword [rsp + 0x48]
imul rdx, rbx
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 1
call fcn.00410030
mov eax, dword [0x00850df0]
mov rcx, qword [rsp + 0x28]
lea rdi, [rcx + 0x10]
mov rdx, qword [rsp + 0x18]
test eax, eax
jne 0x4034c6
mov qword [rcx + 0x10], rdx
mov rax, rcx
jmp 0x4033b6
mov rax, rdx
call fcn.004553b0
jmp 0x4034be
movabs rax, 0x7ffffffff
mov rsi, rdx
xor edx, edx
div rsi
mov rdx, rsi
jmp 0x403351
lea rax, [0x0065e800]
mov qword [rsp], rax
lea rax, [0x006f6d30]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
lea rax, [0x006b0f4e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042b3a0
ud2
lea rax, [0x006b637a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x26
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.004032e0
Function at 0x407380
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40759f
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x40756e
mov rcx, qword [rax]
test rcx, rcx
je 0x40756e
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x407584
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov qword [rsp + 0x28], rbx
mov rdx, qword [rbx]
mov esi, dword [rax + 0xc]
mov qword [rsp + 8], rsi
mov rsi, qword [rsp + 0x58]
mov qword [rsp], rsi
mov rdi, qword [rdx]
call rdi
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x50]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x48]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x407466
movzx r9d, byte [rdx + 8]
test r9b, 8
je 0x407566
and rbx, rax
imul rdi, rbx
lea rbx, [r8 + rdi]
test byte [rbx], al
movzx edi, byte [r8 + rdi]
dec edi
cmp dil, 3
jae 0x40755e
shr rax, 0x38
cmp al, 4
jae 0x407471
add eax, 4
mov byte [rsp + 0x1f], al
jmp 0x407537
inc rdx
cmp rdx, 8
jae 0x40752b
movzx ebx, byte [rdx + rcx]
cmp al, bl
jne 0x40747a
mov qword [rsp + 0x20], rdx
movzx ebx, byte [rsi + 0x50]
imul rbx, rdx
movzx edi, byte [rsi + 0x51]
lea rcx, [rbx + rcx + 8]
test dil, dil
je 0x4074ad
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 8]
mov rbx, qword [rsp + 0x58]
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x10]
test al, al
jne 0x4074e8
movzx eax, byte [rsp + 0x1f]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
jmp 0x40747a
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x50]
movzx edx, byte [rax + 0x52]
mov rbx, qword [rsp + 0x20]
imul rbx, rdx
lea rcx, [rbx + rcx*8]
movzx eax, byte [rax + 0x53]
mov rdx, qword [rsp + 0x30]
lea rcx, [rdx + rcx + 8]
test al, al
je 0x407526
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, rcx
jmp 0x407517
movzx ebx, word [rsi + 0x54]
lea rbx, [rcx + rbx - 8]
mov rcx, qword [rbx]
test rcx, rcx
je 0x407548
mov qword [rsp + 0x30], rcx
xor edx, edx
jmp 0x40747d
lea rax, [0x008514e0]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
jmp 0x407466
shr rbx, 1
jmp 0x407448
lea rax, [0x008514e0]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006b4b01]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00407380
Function at 0x4075b0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4077de
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x4077a8
mov rcx, qword [rax]
test rcx, rcx
je 0x4077a8
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x4077c3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov qword [rsp + 0x28], rbx
mov rdx, qword [rbx]
mov esi, dword [rax + 0xc]
mov qword [rsp + 8], rsi
mov rsi, qword [rsp + 0x58]
mov qword [rsp], rsi
mov rdi, qword [rdx]
call rdi
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x50]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x48]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
add rcx, qword [rdx + 0x10]
mov r8, qword [rdx + 0x18]
test r8, r8
je 0x407696
movzx r9d, byte [rdx + 8]
test r9b, 8
je 0x4077a0
and rbx, rax
imul rdi, rbx
lea rbx, [r8 + rdi]
test byte [rbx], al
movzx edi, byte [r8 + rdi]
dec edi
cmp dil, 3
jae 0x407798
shr rax, 0x38
cmp al, 4
jae 0x4076a1
add eax, 4
mov byte [rsp + 0x1f], al
jmp 0x40776c
inc rdx
cmp rdx, 8
jae 0x407760
movzx ebx, byte [rdx + rcx]
cmp al, bl
jne 0x4076aa
mov qword [rsp + 0x20], rdx
movzx ebx, byte [rsi + 0x50]
imul rbx, rdx
movzx edi, byte [rsi + 0x51]
lea rcx, [rbx + rcx + 8]
test dil, dil
je 0x4076dd
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 8]
mov rbx, qword [rsp + 0x58]
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x10]
test al, al
jne 0x407718
movzx eax, byte [rsp + 0x1f]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
jmp 0x4076aa
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x50]
movzx edx, byte [rax + 0x52]
mov rbx, qword [rsp + 0x20]
imul rbx, rdx
lea rcx, [rbx + rcx*8]
movzx eax, byte [rax + 0x53]
mov rdx, qword [rsp + 0x30]
lea rcx, [rdx + rcx + 8]
test al, al
je 0x40775b
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, rcx
jmp 0x407747
movzx ebx, word [rsi + 0x54]
lea rbx, [rcx + rbx - 8]
mov rcx, qword [rbx]
test rcx, rcx
je 0x40777d
mov qword [rsp + 0x30], rcx
xor edx, edx
jmp 0x4076ad
lea rax, [0x008514e0]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
jmp 0x407696
shr rbx, 1
jmp 0x407678
lea rax, [0x008514e0]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006b4b01]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.004075b0
Function at 0x409780
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x409a86
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x48]
mov rdx, qword [rdx]
cmp rdx, 0x30
jne 0x409a0a
mov rdx, qword [rcx + 0x30]
mov rbx, qword [rdx + 0x18]
mov rbx, qword [rbx]
test rbx, rbx
je 0x4099ef
mov rax, qword [rdx]
cmp rax, 0x80
jbe 0x4097fc
movzx ebx, byte [rcx + 0x51]
test bl, bl
je 0x4099d4
movzx ebx, byte [rcx + 0x50]
cmp bl, 8
jne 0x4099d4
cmp rax, 0x80
ja 0x409816
movzx ebx, byte [rcx + 0x51]
test bl, bl
jne 0x4099d4
movzx ebx, byte [rcx + 0x50]
cmp al, bl
jne 0x4099d4
mov rbx, qword [rcx + 0x38]
mov rsi, qword [rbx]
cmp rsi, 0x80
jbe 0x409848
movzx edi, byte [rcx + 0x53]
test dil, dil
je 0x4099b9
movzx edi, byte [rcx + 0x52]
cmp dil, 8
jne 0x4099b9
cmp rsi, 0x80
ja 0x409864
movzx edi, byte [rcx + 0x53]
test dil, dil
jne 0x4099b9
movzx edi, byte [rcx + 0x52]
cmp sil, dil
jne 0x4099b9
movzx edx, byte [rdx + 0x15]
cmp dl, 8
ja 0x40999e
movzx ebx, byte [rbx + 0x15]
cmp bl, 8
ja 0x409983
movzx edx, dl
test rdx, rdx
je 0x409961
mov rdi, rdx
xor edx, edx
div rdi
test rdx, rdx
jne 0x409968
movzx edx, bl
test rdx, rdx
je 0x40993f
mov rax, rsi
mov rbx, rdx
xor edx, edx
div rbx
test rdx, rdx
jne 0x409946
mov eax, 8
xor edx, edx
div rdi
test rdx, rdx
jne 0x409924
mov eax, 8
xor edx, edx
div rbx
test rdx, rdx
jne 0x409909
mov qword [rsp], rcx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
call fcn.00407180
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006b3c2d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0042b3a0
ud2
lea rax, [0x006b2fe3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1c
call fcn.0042b3a0
ud2
call fcn.00429c30
ud2
lea rax, [0x006b6de0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042b3a0
ud2
call fcn.00429c30
ud2
lea rax, [0x006b5b6b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042b3a0
ud2
lea rax, [0x006af7e2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.0042b3a0
ud2
lea rax, [0x006ae7ac]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042b3a0
ud2
lea rax, [0x006ae43b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042b3a0
ud2
lea rax, [0x006ad8a9]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042b3a0
ud2
lea rax, [0x006b8dce]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.0042b3a0
ud2
mov qword [rsp + 0x20], rdx
call fcn.0042bc80
lea rax, [0x006b1723]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0042c640
mov qword [rsp], 0x30
call fcn.0042c340
lea rax, [0x006ae46b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042c640
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006ad372]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00409780
Function at 0x409ce0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x409e7d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x409e4c
mov rcx, qword [rax]
test rcx, rcx
je 0x409e4c
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x409e62
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x409db3
mov rax, qword [rax + 0x10]
jmp 0x409d90
inc rdx
add rcx, 4
cmp rdx, 8
jae 0x409d7d
mov ebx, dword [rcx]
mov esi, dword [rsp + 0x38]
cmp ebx, esi
jne 0x409d3d
movzx ebx, byte [rdx + rax]
test bl, bl
je 0x409d3d
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rdx, rcx
lea rax, [rdx + rax + 0x28]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x54]
lea rdx, [rax + rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
test rax, rax
je 0x409d9d
lea rcx, [rax + 8]
xor edx, edx
jmp 0x409d44
lea rax, [0x008514e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov rdx, qword [rbx]
mov ebx, dword [rax + 0xc]
mov qword [rsp + 8], rbx
lea rbx, [rsp + 0x38]
mov qword [rsp], rbx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x409e3a
movzx edx, byte [rdx + 8]
test dl, 8
je 0x409e47
and rbx, rax
imul rbx, rdi
lea rax, [r8 + rbx]
test byte [rax], al
movzx edx, byte [rbx + r8]
dec edx
cmp dl, 3
jae 0x409e42
mov rax, rcx
jmp 0x409d90
mov rcx, rax
jmp 0x409e3a
shr rbx, 1
jmp 0x409e21
lea rax, [0x008514e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006b4b01]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00409ce0
Function at 0x409e90
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40a040
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x40a00a
mov rcx, qword [rax]
test rcx, rcx
je 0x40a00a
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x40a025
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x409f71
mov rax, qword [rax + 0x10]
jmp 0x409f49
inc rdx
add rcx, 4
cmp rdx, 8
jae 0x409f36
mov ebx, dword [rcx]
mov esi, dword [rsp + 0x38]
cmp ebx, esi
jne 0x409ef1
movzx ebx, byte [rdx + rax]
test bl, bl
je 0x409ef1
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rdx, rcx
lea rax, [rdx + rax + 0x28]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x54]
lea rdx, [rax + rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
test rax, rax
je 0x409f56
lea rcx, [rax + 8]
xor edx, edx
jmp 0x409ef8
lea rax, [0x008514e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov rdx, qword [rbx]
mov ebx, dword [rax + 0xc]
mov qword [rsp + 8], rbx
lea rbx, [rsp + 0x38]
mov qword [rsp], rbx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x409ff8
movzx edx, byte [rdx + 8]
test dl, 8
je 0x40a005
and rbx, rax
imul rbx, rdi
lea rax, [r8 + rbx]
test byte [rax], al
movzx edx, byte [rbx + r8]
dec edx
cmp dl, 3
jae 0x40a000
mov rax, rcx
jmp 0x409f49
mov rcx, rax
jmp 0x409ff8
shr rbx, 1
jmp 0x409fdf
lea rax, [0x008514e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006b4b01]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00409e90
Function at 0x40a050
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40a1f0
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x40a1bf
mov rcx, qword [rax]
test rcx, rcx
je 0x40a1bf
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x40a1d5
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x40a126
mov rax, qword [rax + 0x10]
jmp 0x40a103
inc rdx
add rcx, 8
cmp rdx, 8
jae 0x40a0f0
mov rbx, qword [rcx]
mov rsi, qword [rsp + 0x38]
cmp rbx, rsi
jne 0x40a0ad
movzx ebx, byte [rdx + rax]
test bl, bl
je 0x40a0ad
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rdx, rcx
lea rax, [rdx + rax + 0x48]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x54]
lea rdx, [rax + rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
test rax, rax
je 0x40a110
lea rcx, [rax + 8]
xor edx, edx
jmp 0x40a0b4
lea rax, [0x008514e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov rdx, qword [rbx]
mov ebx, dword [rax + 0xc]
mov qword [rsp + 8], rbx
lea rbx, [rsp + 0x38]
mov qword [rsp], rbx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x40a1ad
movzx edx, byte [rdx + 8]
test dl, 8
je 0x40a1ba
and rbx, rax
imul rdi, rbx
lea rax, [r8 + rdi]
test byte [rax], al
movzx edx, byte [r8 + rdi]
dec edx
cmp dl, 3
jae 0x40a1b5
mov rax, rcx
jmp 0x40a103
mov rcx, rax
jmp 0x40a1ad
shr rbx, 1
jmp 0x40a194
lea rax, [0x008514e0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006b4b01]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0040a050
Function at 0x40a200
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40a3b3
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x40a37d
mov rcx, qword [rax]
test rcx, rcx
je 0x40a37d
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x40a398
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x40a2e4
mov rax, qword [rax + 0x10]
jmp 0x40a2bc
inc rdx
add rcx, 8
cmp rdx, 8
jae 0x40a2a9
mov rbx, qword [rcx]
mov rsi, qword [rsp + 0x38]
cmp rbx, rsi
jne 0x40a261
movzx ebx, byte [rdx + rax]
test bl, bl
je 0x40a261
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rdx, rcx
lea rax, [rdx + rax + 0x48]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x54]
lea rdx, [rax + rdx - 8]
test byte [rcx], al
mov rax, qword [rdx]
test rax, rax
je 0x40a2c9
lea rcx, [rax + 8]
xor edx, edx
jmp 0x40a268
lea rax, [0x008514e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rcx + 0x30]
mov rbx, qword [rbx + 0x18]
mov rdx, qword [rbx]
mov ebx, dword [rax + 0xc]
mov qword [rsp + 8], rbx
lea rbx, [rsp + 0x38]
mov qword [rsp], rbx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rcx + 9]
mov rdx, rcx
mov ecx, ebx
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
mov rbx, rcx
and rcx, rax
mov rsi, qword [rsp + 0x28]
movzx edi, word [rsi + 0x54]
imul rcx, rdi
mov r8, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r8, r8
je 0x40a36b
movzx edx, byte [rdx + 8]
test dl, 8
je 0x40a378
and rbx, rax
imul rdi, rbx
lea rax, [r8 + rdi]
test byte [rax], al
movzx edx, byte [r8 + rdi]
dec edx
cmp dl, 3
jae 0x40a373
mov rax, rcx
jmp 0x40a2bc
mov rcx, rax
jmp 0x40a36b
shr rbx, 1
jmp 0x40a352
lea rax, [0x008514e0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006b4b01]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0040a200