joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a020
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42a28c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.00427da0
mov rax, qword [rsp + 8]
nop dword [rax + rax]
test rax, rax
je 0x42a272
mov qword [rsp + 0x18], rax
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
inc dword [rdx + 0xd8]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp], rax
call fcn.00425ac0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x18]
sub rax, qword [rcx + 0x18]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x50]
movzx ebx, byte [rdx + 0xa]
mov byte [rsp + 0x17], bl
lea rsi, [rcx + 0x78]
mov qword [rsp + 0x30], rsi
nop
mov qword [rsp], rsi
call fcn.0040bfe0
mov rax, qword [rsp + 0x18]
lea rcx, [rax + 0x80]
movzx edx, byte [rsp + 0x17]
mov rbx, qword [rsp + 0x20]
jmp 0x42a0e9
mov rcx, rsi
mov rsi, qword [rcx]
test rsi, rsi
je 0x42a115
movzx edi, word [rsi + 8]
cmp rdi, rbx
jne 0x42a10c
nop word [rax + rax]
cmp byte [rsi + 0xa], dl
je 0x42a1fd
cmp rdi, rbx
ja 0x42a115
jne 0x42a0e6
cmp byte [rsi + 0xa], dl
jbe 0x42a0e6
mov rdx, qword [rsp + 0x50]
mov word [rdx + 8], bx
mov rbx, qword [rcx]
mov qword [rdx], rbx
mov qword [rcx], rdx
nop
nop
mov rax, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
cmp rdx, 0x40
jae 0x42a265
lea rsi, [0x007f2f78]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and rbx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
shr rax, 0xd
mov rcx, rax
and rax, 0x1ff
shr rax, 3
nop word [rax + rax]
cmp rax, 0x40
jae 0x42a259
lea rax, [rdx + rax]
lea rax, [rax + 0x21080]
and rcx, 7
mov edx, 1
shl edx, cl
lock or byte [rax], dl
nop
nop
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0040c240
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x28]
mov ebx, dword [rdx + 0xd8]
lea esi, [rbx - 1]
mov dword [rdx + 0xd8], esi
cmp ebx, 1
jne 0x42a1ee
cmp byte [rax + 0xb1], 0
je 0x42a1ee
mov qword [rax + 0x10], 0xfffffffffffffade
mov byte [rsp + 0x58], 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
nop
nop
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0040c240
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x42a24a
cmp byte [rax + 0xb1], 0
nop
je 0x42a24a
mov qword [rax + 0x10], 0xfffffffffffffade
mov byte [rsp + 0x58], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov ecx, 0x40
nop
call fcn.0046cde0
mov rax, rdx
mov ecx, 0x40
call fcn.0046cde0
lea rax, [0x00662382]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0042a020
Function at 0x42a2a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42a4a0
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.00427da0
mov rax, qword [rsp + 8]
nop dword [rax + rax]
test rax, rax
je 0x42a485
mov qword [rsp + 0x10], rax
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
inc dword [rdx + 0xd8]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp], rax
call fcn.00425ac0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x10]
sub rax, qword [rcx + 0x18]
mov qword [rsp + 0x20], rax
lea rdx, [rcx + 0x78]
mov qword [rsp + 0x30], rdx
nop
mov qword [rsp], rdx
nop dword [rax]
call fcn.0040bfe0
mov rax, qword [rsp + 0x10]
lea rcx, [rax + 0x80]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x50]
jmp 0x42a360
mov rcx, rsi
mov rsi, qword [rcx]
test rsi, rsi
je 0x42a466
movzx edi, word [rsi + 8]
cmp rdx, rdi
jne 0x42a35d
cmp byte [rsi + 0xa], bl
jne 0x42a35d
mov rdx, qword [rsi]
mov qword [rcx], rdx
mov qword [rsp + 0x18], rsi
cmp qword [rax + 0x80], 0
je 0x42a3ee
nop
nop
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0040c240
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x42a3da
cmp byte [rax + 0xb1], 0
je 0x42a3da
mov qword [rax + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
nop
mov rax, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
cmp rdx, 0x40
jae 0x42a477
lea rdi, [0x007f2f78]
mov rdx, qword [rdi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and rbx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
shr rax, 0xd
mov rcx, rax
and rax, 0x1ff
shr rax, 3
nop dword [rax]
cmp rax, 0x40
jae 0x42a46d
lea rax, [rdx + rax]
lea rax, [rax + 0x21080]
and rcx, 7
mov edx, 1
shl edx, cl
not edx
lock and byte [rax], dl
jmp 0x42a38f
xor esi, esi
jmp 0x42a380
mov ecx, 0x40
call fcn.0046cde0
mov rax, rdx
mov ecx, 0x40
nop
call fcn.0046cde0
lea rax, [0x0066368e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.00439220
nop
nop
call fcn.0046abe0
jmp fcn.0042a2a0
Function at 0x42a4c0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42a72e
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
nop
lea rax, [0x007f9930]
mov qword [rsp], rax
call fcn.0040bfe0
lea rax, [0x007f98a0]
mov qword [rsp], rax
call fcn.0041b120
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
nop
nop
lea rcx, [0x007f9930]
mov qword [rsp], rcx
call fcn.0040c240
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [0x00811460], 0
jne 0x42a71f
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x00811460], 0
nop dword [rax]
jne 0x42a6f8
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a020
cmp byte [rsp + 0x10], 0
je 0x42a696
cmp dword [0x00811120], 0
jne 0x42a5b4
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call fcn.00415ae0
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rax], al
mov qword [rsp], rdx
lea rax, [rbx + 0x1698]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call fcn.00422020
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, [0x007a3168]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.00421e80
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x42a5a2
cmp byte [rax + 0xb1], 0
je 0x42a5a2
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x42a5a2
nop
nop
lea rax, [0x007f9930]
mov qword [rsp], rax
call fcn.0040bfe0
nop
mov rax, qword [0x007f98d0]
sub rax, qword [0x007f98a0]
mov qword [0x007f98d0], rax
mov rax, qword [0x007f98b8]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x007f98b8], rcx
nop
nop
lea rax, [0x007f9930]
mov qword [rsp], rax
call fcn.0040c240
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, qword [rsp + 0x78]
call fcn.0046ca60
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.0046ca20
jmp 0x42a57b
mov rcx, qword [rsp + 0x68]
call fcn.0046ca20
jmp 0x42a548
call fcn.0046abe0
jmp fcn.0042a4c0
Function at 0x42a800
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42a8b5
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop
lea rax, [0x007f9930]
mov qword [rsp], rax
call fcn.0040bfe0
lea rax, [0x007f98e8]
mov qword [rsp], rax
call fcn.0041b120
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
nop
nop
lea rcx, [0x007f9930]
mov qword [rsp], rcx
call fcn.0040c240
mov rax, qword [rsp + 0x18]
mov byte [rax + 0xa], 2
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a020
cmp byte [rsp + 0x10], 0
je 0x42a89b
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00665362]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0042a800

Function at 0x42af00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42afe6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [0x00811588]
test rax, rax
je 0x42af79
mov qword [rsp + 0x18], rax
mov rcx, qword [rax + 8]
mov qword [0x00811588], rcx
mov qword [rsp], rax
mov qword [rsp + 8], 0x10000
call fcn.0046d420
mov rax, qword [rsp + 0x18]
mov qword [rax + 8], 0
mov qword [rax], 0
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
nop
nop
lea rax, [0x00811580]
mov qword [rsp], rax
call fcn.0040c240
mov qword [rsp], 0x10000
lea rax, [0x00813858]
mov qword [rsp + 8], rax
nop
call fcn.00419a20
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x42afcc
mov qword [rsp + 0x20], rax
nop
lea rax, [0x00811580]
mov qword [rsp], rax
call fcn.0040bfe0
mov rax, qword [rsp + 0x20]
jmp 0x42af5b
lea rax, [0x006631db]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0042af00
Function at 0x42b000
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42b189
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [0x007a4d20]
cmp rax, 0x15
ja 0x42b0ea
mov rax, qword [rsp + 0x28]
test byte [rax], al
cmp dword [0x00811460], 0
jne 0x42b0cf
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10110], rcx
lea rdx, [rax + 0x10090]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call fcn.00430460
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042d4e0
mov rax, qword [0x007a32d0]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10078], rax
cmp dword [0x00811460], 0
jne 0x42b0bc
mov rax, qword [rsp + 0x30]
mov qword [rcx + 0x10108], rax
mov rax, qword [0x007a32d0]
mov qword [rcx + 0x100f8], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rdi, [rcx + 0x10108]
mov rax, qword [rsp + 0x30]
call fcn.0046c920
jmp 0x42b0a4
lea rdi, [rax + 0x10110]
mov rcx, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.0046ca20
jmp 0x42b059
mov qword [rsp + 0x10], rax
call fcn.0043aa00
lea rax, [0x0066374e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0043b480
mov rcx, qword [rsp + 0x10]
cmp rcx, 0x40
sbb rax, rax
mov edx, 1
shl rdx, cl
and rdx, rax
mov qword [rsp], rdx
call fcn.0043b220
call fcn.0043ace0
call fcn.0043aaa0
call fcn.0043aa00
lea rax, [0x00662779]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0043b480
mov qword [rsp], 0x200000
nop dword [rax]
call fcn.0043b220
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x006668b4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0042b000
Function at 0x42d4e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42d629
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword [0x007a4d60]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [0x007a4d68]
movups xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [0x007a4d78]
movups xmmword [rsp + 0x58], xmm0
xor eax, eax
jmp 0x42d534
lea rax, [rbx + 1]
cmp rax, 5
jge 0x42d605
mov qword [rsp + 0x18], rax
mov rdx, qword [rsp + rax*8 + 0x40]
mov rbx, qword [0x00811270]
mov qword [rsp], 0
lea rcx, [rdx - 0x30]
neg rcx
cmp rcx, 0x40
sbb rdx, rdx
mov esi, 1
shl rsi, cl
and rsi, rdx
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + rsi*8]
lea rdx, [rdx - 1]
neg rbx
and rdx, rbx
mov qword [rsp + 8], rdx
call fcn.00419fe0
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x42d60f
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x78]
test byte [rdx], al
mov rbx, qword [rsp + 0x18]
lea rsi, [rbx + rbx*2]
mov r8, qword [rsp + 0x28]
mov qword [rdx + rsi*8 + 8], 0
mov qword [rdx + rsi*8 + 0x10], rax
lea rdi, [rdx + rsi*8]
cmp dword [0x00811460], 0
jne 0x42d5f9
mov qword [rdx + rsi*8], r8
jmp 0x42d530
call fcn.0046caa0
nop
jmp 0x42d530
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x006651f0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0042d4e0
Function at 0x430200
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x430280
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movabs rcx, 0x800000000000
lea rdx, [rcx + rax]
cmp rax, rdx
setbe dl
mov rbx, qword [rsp + 0x28]
add rcx, rbx
cmp rbx, rcx
setbe cl
cmp dl, cl
jne 0x430263
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00668bc6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x3c
call fcn.00439220
nop
nop dword [rax]
call fcn.0046abe0
jmp fcn.00430200
Function at 0x431480
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4315e9
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x20]
nop
mov rdx, rcx
shr rcx, 0x20
nop dword [rax]
cmp edx, ecx
ja 0x431565
shr ecx, 9
cmp qword [rax + 0x10], rcx
jbe 0x431514
shl rcx, 3
add rcx, qword [rax + 8]
mov rdx, qword [rcx]
nop dword [rax]
test rdx, rdx
je 0x431514
mov ebx, dword [rdx + 0x10]
test ebx, ebx
je 0x431549
cmp ebx, 0x200
je 0x431530
xor eax, eax
xchg qword [rcx], rax
nop
xor eax, eax
xchg dword [rdx + 0x10], eax
lea rax, [0x008112a8]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
call fcn.0040bd40
nop
xor eax, eax
mov rcx, qword [rsp + 0x30]
xchg qword [rcx + 0x20], rax
xor eax, eax
xchg qword [rcx + 0x10], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00667933]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.00439220
lea rax, [0x006680d8]
mov qword [rsp], rax
mov qword [rsp + 8], 0x34
nop dword [rax]
call fcn.00439220
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], rcx
call fcn.0043aa00
lea rax, [0x0065ad98]
mov qword [rsp], rax
mov qword [rsp + 8], 7
call fcn.0043b480
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x0065b2bd]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0043b480
mov rax, qword [rsp + 0x18]
mov eax, eax
mov qword [rsp], rax
nop
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x00664535]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00431480

Function at 0x431b80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x431c06
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 0x10]
mov qword [rax], rcx
cmp byte [0x00811465], 0
je 0x431bdb
lea rcx, [rax + 0x20]
mov qword [rax + 8], rcx
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
test rcx, 0xf
jne 0x431be8
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
add rcx, 0x1000
mov qword [rax + 8], rcx
jmp 0x431bc1
lea rax, [0x00662f6f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
nop dword [rax]
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00431b80
Function at 0x432400
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x432670
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
test byte [rax], al
lea rcx, [rax + 8]
mov qword [rsp + 0x20], rcx
nop
mov qword [rsp], rcx
nop dword [rax]
call fcn.0040bfe0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x20]
movzx edx, byte [rsp + 0x50]
test dl, dl
je 0x432631
mov rbx, qword [rsp + 0x48]
cmp rbx, rcx
jne 0x432617
test dl, dl
je 0x432609
cmp qword [rax + 0x78], 0
jle 0x432656
cmp qword [rax + 0x48], 0
je 0x432656
mov qword [rax + 0x78], 0xffffffffffffffff
xor ecx, ecx
xchg qword [rax + 0x48], rcx
jmp 0x43249a
mov rax, rbx
mov rcx, qword [rax + 0x28]
nop
cmp rcx, 1
je 0x4325fd
test rcx, rcx
je 0x4325f1
mov rbx, rax
mov rax, rcx
xor esi, esi
lock cmpxchg qword [rbx + 0x28], rsi
sete dil
test dil, dil
je 0x432497
cmp rcx, 2
cmove rcx, rsi
mov qword [rsp + 0x18], rcx
movzx edi, byte [rsp + 0x51]
nop dword [rax]
test dil, dil
je 0x4325ea
cmp qword [rbx + 0xd8], 0
jle 0x43263d
cmp qword [rbx + 0xa8], 0
nop
je 0x4325e0
mov qword [rbx + 0xd8], 0xffffffffffffffff
xor edx, edx
xchg qword [rbx + 0xa8], rdx
mov rax, qword [rbx + 0x88]
cmp rax, 1
je 0x4325d5
test rax, rax
je 0x4325d1
mov qword [rsp + 0x10], rax
lock cmpxchg qword [rbx + 0x88], rsi
sete dl
test dl, dl
je 0x43251a
mov rax, qword [rsp + 0x10]
cmp rax, 2
cmove rax, rsi
mov qword [rsp + 0x28], rax
nop
nop
mov rcx, qword [rsp + 0x20]
mov qword [rsp], rcx
call fcn.0040c240
mov rax, qword [rsp + 0x18]
test rax, rax
jne 0x4325ad
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x432589
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov ecx, 0xffffffff
lea rdx, [0x00811130]
lock xadd dword [rdx], ecx
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0043bf40
jmp 0x43257f
mov ecx, 0xffffffff
lea rdx, [0x00811130]
lock xadd dword [rdx], ecx
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0043bf40
jmp 0x432575
xor eax, eax
jmp 0x432556
xor eax, eax
jmp 0x432556
test dl, dl
jne 0x432506
jmp 0x43263d
xor eax, eax
jmp 0x432556
mov rbx, rax
xor esi, esi
xor ecx, ecx
jmp 0x4324d2
mov rbx, rax
xor esi, esi
xor ecx, ecx
jmp 0x4324d2
mov rbx, rax
xor esi, esi
xor edx, edx
xor ecx, ecx
jmp 0x4324d2
nop
nop
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0040c240
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, qword [rax + 0x80]
jmp 0x43245b
lea rax, [0x00664da8]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.00439220
lea rax, [0x006647f1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00432400
Function at 0x432940
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x432a26
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [sym.imp.kernel32.dll_CreateIoCompletionPort]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x10], xmm0
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
call fcn.00435b40
mov rax, qword [rsp + 0x28]
mov qword [0x007a32b8], rax
nop
test rax, rax
je 0x4329af
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.0046e160
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
nop dword [rax]
call fcn.0043aa00
lea rax, [0x00667634]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2f
call fcn.0043b480
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x0065a35b]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0043b480
call fcn.0043aaa0
lea rax, [0x00661a8a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1b
nop
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00432940

Function at 0x432ae0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x432bd4
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor eax, eax
lea rcx, [0x00811134]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
nop dword [rax]
test cl, cl
jne 0x432b2e
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, qword [0x007a32b8]
mov rcx, qword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x10], xmm0
mov qword [rsp + 0x20], 0
call fcn.00435b40
cmp qword [rsp + 0x28], 0
jne 0x432b24
call fcn.0046e160
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043aa00
lea rax, [0x00668c7a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x3c
call fcn.0043b480
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x0065a35b]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0043b480
call fcn.0043aaa0
lea rax, [0x00667e9e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x33
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00432ae0
Function at 0x432fc0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x433089
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0x28]
cmp ecx, 0x72
je 0x432ffa
cmp ecx, 0x77
jne 0x43302f
mov edx, dword [rsp + 0x40]
mov dword [rax + 0x2c], edx
mov edx, dword [rsp + 0x44]
mov dword [rax + 0x30], edx
mov rax, qword [rax + 0x20]
mov rdx, qword [rsp + 0x30]
mov qword [rsp], rdx
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ecx
nop
call fcn.00432120
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], ecx
call fcn.0043aa00
lea rax, [0x00668c3e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x3c
call fcn.0043b480
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
mov qword [rsp], rax
nop dword [rax]
call fcn.0043b220
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x006600ff]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00432fc0
Function at 0x433160
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x433360
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
cmp byte [0x008110dd], 0
je 0x4331e2
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jbe 0x433354
mov rax, qword [0x007cc3f8]
mov rcx, qword [rsp + 0x68]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x800
call fcn.00435ae0
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
cmp qword [0x008112c0], 0
je 0x4332d9
mov rcx, qword [0x008112c0]
nop word [rax + rax]
cmp rcx, 0x209
ja 0x433331
mov rax, qword [rsp + 0x70]
lea rdx, [rcx + rax]
mov qword [rsp + 0x40], rdx
nop dword [rax + rax]
cmp rdx, 0x209
ja 0x43328f
lea rbx, [0x00811f80]
mov qword [rsp + 0x50], rbx
add rcx, rbx
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.0046d6c0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jbe 0x43332a
mov rax, qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x50]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00435a20
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x48], rcx
lea rax, [0x00614000]
mov qword [rsp], rax
lea rax, [0x00811f80]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], 0x209
mov qword [rsp + 0x20], rdx
nop
call fcn.0044ddc0
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
jmp 0x433230
mov rax, qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea rcx, [0x00811f80]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x208
call fcn.00435a80
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x43333b
cmp rax, 0x208
ja 0x43333b
lea rbx, [0x00811f80]
mov byte [rbx + rax], 0x5c
inc rax
mov qword [0x008112c0], rax
jmp 0x4331f0
xor eax, eax
call fcn.0046cdc0
mov edx, 0x209
call fcn.0046ce20
lea rax, [0x00664bd4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.00439220
xor eax, eax
call fcn.0046cdc0
nop
nop dword [rax]
call fcn.0046abe0
jmp fcn.00433160