joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d020
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d32f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
cmp word [0x01ac8964], 0x10
jne 0x40d31d
mov rdx, qword [0x01bfaff8]
test rdx, rdx
je 0x40d30c
nop word [rax + rax]
nop
cmp rdx, 0x80000
ja 0x40d2a0
cmp rdx, 0x1000
jb 0x40d22c
lea rbx, [rdx - 1]
nop
test rdx, rbx
jne 0x40d1e0
mov rdx, qword [0x01bfaff0]
lea rbx, [rdx - 1]
test rdx, rbx
jne 0x40d194
nop dword [rax]
cmp rdx, 0x400000
jbe 0x40d0b4
mov qword [0x01bfaff0], 0
cmp qword [0x01bfaff0], 0
nop dword [rax]
jne 0x40d16d
lea rax, [0x01bbcf40]
call fcn.004276a0
call fcn.00416fc0
mov qword [0x01bfafb0], rax
xor eax, eax
jmp 0x40d0e5
inc rax
cmp rax, 3
jl 0x40d0e2
mov eax, 0x7f
jmp 0x40d134
mov qword [rsp + 0x18], rcx
lea rax, [0x01bd3ac0]
nop
call fcn.00419bc0
mov rcx, qword [rsp + 0x10]
mov rdx, rcx
shl rcx, 0x28
movabs rbx, 0xc000000000
or rcx, rbx
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov rsi, qword [rcx]
mov qword [rax + 0x10], rsi
mov qword [rcx], rax
lea rax, [rdx - 1]
test rax, rax
jl 0x40d158
mov qword [rsp + 0x10], rax
nop
cmp rax, 0x3f
jle 0x40d14f
lea rcx, [0x01bd3b08]
jmp 0x40d0f2
lea rcx, [0x01bcd2d0]
jmp 0x40d0f2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [rcx + 1]
mov qword [0x01bfafe8], rdx
mov rcx, qword [0x01bfafe8]
cmp rcx, 0x40
sbb rdx, rdx
mov ebx, 1
shl rbx, cl
and rbx, rdx
cmp qword [0x01bfaff0], rbx
jne 0x40d162
jmp 0x40d0c6
call fcn.0043b740
lea rax, [0x01095fb1]
mov ebx, 0x17
call fcn.0043c040
mov rax, qword [0x01bfaff0]
call fcn.0043bd40
lea rax, [0x010945d1]
mov ebx, 0x17
call fcn.0043c040
call fcn.0043b7c0
lea rax, [0x01098878]
mov ebx, 0x19
call fcn.00439e00
nop dword [rax]
call fcn.0043b740
lea rax, [0x0108df1e]
mov ebx, 0x12
call fcn.0043c040
mov rax, qword [0x01bfaff8]
nop dword [rax]
call fcn.0043bd40
lea rax, [0x010945d1]
mov ebx, 0x17
call fcn.0043c040
call fcn.0043b7c0
lea rax, [0x01090663]
mov ebx, 0x14
call fcn.00439e00
call fcn.0043b740
lea rax, [0x0108df1e]
mov ebx, 0x12
nop dword [rax]
call fcn.0043c040
mov rax, qword [0x01bfaff8]
call fcn.0043bd40
lea rax, [0x010b2dd4]
mov ebx, 0x25
nop dword [rax]
call fcn.0043c040
mov eax, 0x1000
call fcn.0043be40
lea rax, [0x01079bce]
mov ebx, 2
nop dword [rax + rax]
call fcn.0043c040
call fcn.0043b7c0
lea rax, [0x01090663]
mov ebx, 0x14
call fcn.00439e00
nop dword [rax + rax]
call fcn.0043b740
lea rax, [0x0108df1e]
mov ebx, 0x12
call fcn.0043c040
mov rax, qword [0x01bfaff8]
nop dword [rax]
call fcn.0043bd40
lea rax, [0x010b0723]
mov ebx, 0x24
call fcn.0043c040
mov eax, 0x80000
nop dword [rax + rax]
call fcn.0043be40
lea rax, [0x01079bce]
mov ebx, 2
call fcn.0043c040
call fcn.0043b7c0
lea rax, [0x01090663]
mov ebx, 0x14
call fcn.00439e00
lea rax, [0x010a2fe4]
mov ebx, 0x1e
call fcn.00439e00
lea rax, [0x0108bec2]
mov ebx, 0x11
call fcn.00439e00
nop
call fcn.0046b6c0
jmp fcn.0040d020
Function at 0x4151e0
Capabilities:
Reference http user-agent string
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4153cf
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rbx
call fcn.0043b740
call fcn.0043b740
lea rax, [0x0108c731]
mov ebx, 0x11
call fcn.0043c040
mov rax, qword [rsp + 0x30]
call fcn.0043bea0
call fcn.0043b7c0
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x4152f7
nop
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x4153aa
nop dword [rax + rax]
call fcn.0043b740
lea rax, [0x0108fbc3]
mov ebx, 0x14
call fcn.0043c040
call fcn.0043b7c0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.0043b740
lea rax, [0x0108632f]
mov ebx, 0xd
call fcn.0043c040
mov rax, qword [rsp + 0x28]
call fcn.0043bea0
lea rax, [0x0108511a]
mov ebx, 0xc
nop
call fcn.0043c040
mov rax, qword [rsp + 0x30]
call fcn.0043bea0
lea rax, [0x01085126]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.0043c040
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.0043bd40
call fcn.0043b7c0
call fcn.0043b740
nop dword [rax]
call fcn.0043b9a0
call fcn.0043b7c0
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x415330
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x010d9f63]
mov ebx, 0x3e
call fcn.00439e00
call fcn.0043b740
lea rax, [0x010a37be]
mov ebx, 0x1e
call fcn.0043c040
mov rax, qword [rsp + 0x60]
call fcn.0043bea0
lea rax, [0x0142e828]
mov ebx, 1
nop dword [rax]
call fcn.0043c040
mov rax, qword [rsp + 0x38]
call fcn.0043bea0
lea rax, [0x01079bce]
mov ebx, 2
nop dword [rax + rax]
call fcn.0043c040
call fcn.0043b7c0
lea rax, [0x0107eaf6]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x38]
call fcn.00420920
jmp 0x415314
call fcn.0043b740
lea rax, [0x01097b94]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043c040
call fcn.0043b7c0
jmp 0x41527b
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004151e0
Function at 0x417860
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41792a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [0x01bcd058]
mov edx, dword [rax + 0x488]
cmp edx, ecx
je 0x4178c1
lea ebx, [rcx - 2]
cmp edx, ebx
jne 0x4178cb
mov qword [rsp + 0x28], rax
call fcn.00417660
mov rax, qword [rsp + 0x28]
nop
call fcn.0044ff80
mov ecx, dword [0x01bcd058]
mov rdx, qword [rsp + 0x28]
xchg dword [rdx + 0x488], ecx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x14], ecx
mov dword [rsp + 0x10], edx
call fcn.0043b740
lea rax, [0x01086c05]
mov ebx, 0xd
call fcn.0043c040
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.0043bd40
lea rax, [0x010a19fa]
mov ebx, 0x1e
call fcn.0043c040
mov eax, dword [rsp + 0x14]
call fcn.0043bd40
call fcn.0043b9a0
call fcn.0043b7c0
lea rax, [0x0108591e]
mov ebx, 0xc
call fcn.00439e00
nop
mov qword [rsp + 8], rax
call fcn.0046b6c0
mov rax, qword [rsp + 8]
jmp fcn.00417860

Function at 0x4184a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418646
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x01aba6a8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436a00
xorps xmm15, xmm15
mov r14, qword [0x01bfb078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41850b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x418520
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x418545
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x418559
cmp rbx, 0x1000
jae 0x418515
nop dword [rax]
jmp 0x4185c9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41856d
xor edx, edx
jmp 0x4185c0
mov rcx, qword [0x01aba6a8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436a00
xorps xmm15, xmm15
mov r14, qword [0x01bfb078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41854f
jmp 0x418534
call fcn.0046f2c0
xorps xmm15, xmm15
mov r14, qword [0x01bfb078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043b740
lea rax, [0x01097832]
mov ebx, 0x18
call fcn.0043c040
mov rax, qword [rsp + 0x38]
call fcn.0043bd40
lea rax, [0x01097b7b]
mov ebx, 0x19
call fcn.0043c040
mov rax, qword [rsp + 0x30]
nop
call fcn.0043bd40
call fcn.0043b9a0
call fcn.0043b7c0
lea rax, [0x010ab458]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00439e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004184a0
Function at 0x418680
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4188aa
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x01aba6b0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00436a80
xorps xmm15, xmm15
mov r14, qword [0x01bfb078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4186f9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41870c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x418730
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x418744
cmp rbx, 0x1000
jae 0x418703
jmp 0x4187c5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x418756
xor esi, esi
jmp 0x4187b6
mov rax, qword [0x01aba6b0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00436a80
xorps xmm15, xmm15
mov r14, qword [0x01bfb078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41873a
nop
jmp 0x418722
call fcn.0046f2c0
xorps xmm15, xmm15
mov r14, qword [0x01bfb078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x418845
call fcn.0043b740
lea rax, [0x0109958e]
mov ebx, 0x19
call fcn.0043c040
mov rax, qword [rsp + 0x68]
call fcn.0043bd40
lea rax, [0x01097b7b]
mov ebx, 0x19
call fcn.0043c040
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.0043bd40
call fcn.0043b9a0
call fcn.0043b7c0
lea rax, [0x010870ff]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00439e00
cmp eax, 0x5af
je 0x4187e8
call fcn.0043b740
lea rax, [0x0109958e]
mov ebx, 0x19
nop dword [rax]
call fcn.0043c040
mov rax, qword [rsp + 0x38]
call fcn.0043bd40
lea rax, [0x01097b7b]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043c040
mov eax, dword [rsp + 0x34]
call fcn.0043bd40
call fcn.0043b9a0
call fcn.0043b7c0
lea rax, [0x010a5cbc]
mov ebx, 0x1f
call fcn.00439e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418680
Function at 0x41d420
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41d586
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
jmp 0x41d43d
mov rax, rdx
mov rdx, qword [rax]
mov rsi, rdx
shr rdx, 0x3d
cmp bl, dl
jne 0x41d51c
mov rdx, rax
mov rax, rsi
xor edi, edi
lock cmpxchg qword [rdx], rdi
sete r8b
test r8b, r8b
je 0x41d43a
movabs rdx, 0xe000000000000000
and rdx, rcx
movabs rdi, 0x1fffffffffffffff
and rdi, rsi
or rdx, rdi
mov rsi, rcx
sub rcx, rdx
cmp rsi, rdx
mov edx, 0
cmovl rcx, rdx
test rcx, rcx
je 0x41d501
cmp bl, 2
ja 0x41d4c0
nop
cmp bl, 1
jne 0x41d4b4
nop
lea rax, [0x01bfbd38]
lock xadd qword [rax], rcx
jmp 0x41d4f7
cmp bl, 2
je 0x41d4c5
jmp 0x41d50b
cmp bl, 3
jne 0x41d4d4
nop
lea rax, [0x01bfbd28]
lock xadd qword [rax], rcx
jmp 0x41d4f7
cmp bl, 4
jne 0x41d50b
nop
nop
lea rax, [0x01bfbd38]
mov rdx, rcx
lock xadd qword [rax], rcx
nop
lea rax, [0x01ba5590]
lock xadd qword [rax], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x010d018a]
mov ebx, 0x33
call fcn.00439e00
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x10], rdx
call fcn.0043b740
lea rax, [0x01088567]
mov ebx, 0xe
call fcn.0043c040
movzx eax, byte [rsp + 0x30]
movzx eax, al
call fcn.0043bd40
lea rax, [0x0107c268]
mov ebx, 5
call fcn.0043c040
mov rax, qword [rsp + 0x10]
nop
call fcn.0043bd40
call fcn.0043b9a0
call fcn.0043b7c0
lea rax, [0x010da0d7]
mov ebx, 0x3e
nop dword [rax + rax]
call fcn.00439e00
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041d420
Function at 0x420040
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4202e6
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
prefetcht0 byte [rax]
nop
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rsi, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x4202d6
lea rdi, [0x01bcd0b0]
mov rdx, qword [rdi + rdx*8]
shr rsi, 0x16
and esi, 0xfffff
mov rsi, qword [rdx + rsi*8]
mov rdi, rax
shr rax, 0xd
and eax, 0x1ff
mov r8, qword [rsi + rax*8 + 0x10400]
test byte [rdx], al
test byte [rsi], al
mov rdx, qword [r8 + 0x68]
nop
test rdx, rdx
je 0x4202c5
movzx esi, byte [r8 + 0x62]
test sil, 1
jne 0x4202b1
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x98], rbx
cmp rdx, 0x20000
jbe 0x420109
cmp qword [r8 + 0x18], rdi
jne 0x420221
mov qword [rsp + 0x30], r8
lea rdx, [rdi + 0x20000]
jmp 0x42024c
mov qword [rsp + 0x48], rdx
mov rax, rdi
mov rbx, rdx
call fcn.00415580
mov rdx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x48]
xor r8d, r8d
jmp 0x42012c
add r8, 8
test rcx, rcx
jne 0x420136
xor r9d, r9d
jmp 0x420142
bsf r9, rcx
btc rcx, r9
lea r9, [rax + r9*8]
test r9, r9
jne 0x420167
mov qword [rsp + 0x38], r8
call fcn.004156a0
test rsi, rsi
je 0x4201f6
mov rdx, qword [rsp + 0x78]
mov r9, rsi
mov rsi, qword [rsp + 0x48]
mov r8, r9
sub r8, rdx
mov r9, qword [r9]
test r9, r9
je 0x420128
mov r10, r9
sub r9, rdx
nop dword [rax + rax]
cmp rsi, r9
ja 0x420128
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rax
mov rax, r10
mov rbx, rdx
mov rcx, r8
call fcn.00415420
test rax, rax
je 0x4201ce
mov rdi, rbx
mov rsi, qword [rsp + 0x98]
mov r8, rcx
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.00420600
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x70]
jmp 0x420128
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x98]
add qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x38]
add qword [rcx + 0x18], rax
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
nop
ret
mov rdx, qword [r8 + 0x68]
add rdx, qword [r8 + 0x18]
sub rdx, rdi
cmp rdx, 0x20000
mov ecx, 0x20000
cmova rdx, rcx
nop dword [rax]
jmp 0x420109
add rdx, 0x20000
mov rsi, qword [r8 + 0x68]
add rsi, qword [r8 + 0x18]
cmp rdx, rsi
jae 0x420221
mov rsi, qword [rbx]
nop dword [rax]
test rsi, rsi
je 0x42027e
mov rax, qword [rsi + 0x10]
cmp rax, 0xfd
je 0x42027e
jae 0x4202a7
mov qword [rsi + rax*8 + 0x18], rdx
inc qword [rsi + 0x10]
jmp 0x420245
mov qword [rsp + 0x40], rdx
mov rax, rbx
mov rbx, rdx
call fcn.004265e0
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x30]
jmp 0x420245
mov ecx, 0xfd
call fcn.0046dd20
lea rax, [0x010a144c]
mov ebx, 0x1d
nop dword [rax]
call fcn.00439e00
lea rax, [0x0108c786]
mov ebx, 0x11
call fcn.00439e00
mov rax, rdx
mov ecx, 0x40
nop
call fcn.0046dd40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00420040
Function at 0x420d60
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x01bfaca7], 0
jne 0x420e4f
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x420e45
lea rbx, [0x01bcd0b0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x420e27
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0046dd40
lea rax, [0x010c3e5e]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00439e00
nop
int3

Function at 0x4223a0
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422457
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x01083190]
mov ebx, 0xa
call fcn.00408ba0
test rbx, rbx
je 0x4223e2
cmp rbx, 3
jne 0x4223f6
cmp word [rax], 0x666f
jne 0x4223f6
cmp byte [rax + 2], 0x66
nop
jne 0x4223f6
movabs rax, 0x7fffffffffffffff
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x10], rbx
call fcn.00453fc0
test bl, bl
je 0x422413
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043b740
lea rax, [0x010842ce]
mov ebx, 0xb
call fcn.0043c040
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
call fcn.0043c040
call fcn.0043b9a0
nop dword [rax]
call fcn.0043b7c0
lea rax, [0x010daae5]
mov ebx, 0x3f
call fcn.00439e00
nop
call fcn.0046b6c0
nop dword [rax]
jmp fcn.004223a0
Function at 0x423240
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42333e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x423280
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x42332f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00423e00
nop dword [rax]
test rax, rax
je 0x42332f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00423380]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0046b580
xorps xmm15, xmm15
mov r14, qword [0x01bfb078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42331d
xor eax, eax
jmp 0x423327
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x423272
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00423240
Function at 0x4296e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4298ea
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
call fcn.00427600
test rax, rax
je 0x4298d8
mov qword [rsp + 0x18], rax
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x28], rcx
call fcn.00425120
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x18]
sub rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x50]
movzx ebx, byte [rdx + 0xa]
mov byte [rsp + 0x17], bl
lea rsi, [rax + 0x78]
mov qword [rsp + 0x30], rsi
nop
mov rax, rsi
nop dword [rax + rax]
call fcn.0040c680
mov rcx, qword [rsp + 0x18]
lea rdx, [rcx + 0x80]
movzx ebx, byte [rsp + 0x17]
mov rsi, qword [rsp + 0x20]
jmp 0x429780
mov rdx, rdi
mov rdi, qword [rdx]
test rdi, rdi
je 0x4297eb
movzx r8d, word [rdi + 8]
cmp r8, rsi
jne 0x42979a
cmp byte [rdi + 0xa], bl
je 0x4297a7
cmp r8, rsi
ja 0x4297eb
jne 0x42977d
nop
cmp byte [rdi + 0xa], bl
jbe 0x42977d
jmp 0x4297eb
nop
nop
mov rax, qword [rsp + 0x30]
call fcn.0040c8a0
nop
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x4297df
cmp byte [r14 + 0xb1], 0
je 0x4297df
mov qword [r14 + 0x10], 0xfffffffffffffade
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbx, qword [rsp + 0x50]
mov word [rbx + 8], si
mov rsi, qword [rdx]
mov qword [rbx], rsi
mov qword [rdx], rbx
nop
nop
mov rax, qword [rcx + 0x18]
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop word [rax + rax]
cmp rdx, 0x40
jae 0x4298cb
lea rsi, [0x01bcd0b0]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
shr rax, 0xd
mov rcx, rax
and eax, 0x1ff
shr rax, 3
cmp rax, 0x40
jae 0x4298c1
lea rdx, [rdx + rax]
lea rdx, [rdx + 0x11480]
and ecx, 7
mov ebx, 1
shl ebx, cl
lock or byte [rdx], bl
nop
nop
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.0040c8a0
nop
mov rdx, qword [rsp + 0x28]
mov ebx, dword [rdx + 0xd8]
lea esi, [rbx - 1]
mov dword [rdx + 0xd8], esi
cmp ebx, 1
jne 0x4298b1
cmp byte [r14 + 0xb1], 0
je 0x4298b1
mov qword [r14 + 0x10], 0xfffffffffffffade
mov eax, 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
mov ecx, 0x40
call fcn.0046dd40
mov rax, rdx
mov ecx, 0x40
call fcn.0046dd40
lea rax, [0x010a053b]
mov ebx, 0x1d
call fcn.00439e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004296e0
Function at 0x42a4e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42a626
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, qword [0x01abdea0]
nop
cmp rdx, 0x15
ja 0x42a595
mov qword [rsp + 0x38], rbx
test byte [rax], al
cmp dword [0x01bfb600], 0
jne 0x42a523
mov qword [rax + 0x100f8], rcx
jmp 0x42a52f
lea rdi, [rax + 0x100f8]
call fcn.0046d980
mov qword [rsp + 0x30], rax
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call fcn.00430d20
mov rax, qword [rsp + 0x30]
call fcn.0042c7c0
mov rcx, qword [0x01abad98]
mov rdi, qword [rsp + 0x30]
mov qword [rdi + 0x10078], rcx
cmp dword [0x01bfb600], 0
jne 0x42a57a
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x100f0], rax
jmp 0x42a58b
add rdi, 0x100f0
mov rax, qword [rsp + 0x38]
call fcn.0046d880
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rdx
cmp rdx, 0x40
sbb rax, rax
mov qword [rsp + 0x10], rax
call fcn.0043b740
lea rax, [0x010a8ae4]
mov ebx, 0x20
call fcn.0043c040
mov rcx, qword [rsp + 0x18]
mov eax, 1
shl rax, cl
mov rcx, qword [rsp + 0x10]
and rax, rcx
call fcn.0043be40
call fcn.0043b9a0
nop dword [rax + rax]
call fcn.0043b7c0
call fcn.0043b740
lea rax, [0x010a1412]
mov ebx, 0x1d
call fcn.0043c040
mov eax, 0x200000
call fcn.0043be40
call fcn.0043b9a0
call fcn.0043b7c0
lea rax, [0x010c225a]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00439e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0042a4e0