joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433420
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rcx, qword [sym.imp.KERNEL32.DLL_CreateThread]
lea rdx, [0x00467180]
mov qword [rsp], rcx
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm15
call fcn.00433ee0
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x4334a8
mov rcx, qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00433c60
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov ecx, dword [0x013282e8]
test ecx, ecx
jne 0x43354d
mov rax, qword [0x012d4d30]
sub rax, qword [0x012d4d40]
mov qword [rsp + 0x48], rax
call fcn.00466f80
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.004384a0
lea rax, [0x006db806]
mov ebx, 0x2e
call fcn.00438da0
mov rax, qword [rsp + 0x48]
movsxd rax, eax
call fcn.00438ba0
lea rax, [0x006ce9d7]
mov ebx, 0x10
call fcn.00438da0
mov rax, qword [rsp + 0x40]
call fcn.00438aa0
lea rax, [0x006cb2fc]
mov ebx, 2
call fcn.00438da0
call fcn.00438520
lea rax, [0x006cf4cc]
mov ebx, 0x11
call fcn.00436b60
nop
nop
lea rax, [0x013283c0]
call fcn.0040b740
nop
nop
lea rax, [0x013283c0]
call fcn.0040b740
jmp 0x4334b6
Function at 0x437140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4372a1
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x10], r14
cmp qword [0x01300fd8], 0
jne 0x437185
call fcn.004384a0
lea rax, [0x006db862]
mov ebx, 0x2e
call fcn.00438da0
nop dword [rax]
call fcn.00438520
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
nop
jge 0x4371ac
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x437247
nop
cmp edx, 1
je 0x437211
cmp edx, 2
jne 0x4371f9
mov dword [rcx + 0xdc], 3
call fcn.004384a0
lea rax, [0x006d2b00]
mov ebx, 0x18
call fcn.00438da0
call fcn.00438520
mov eax, 4
call fcn.004329a0
mov eax, 5
nop
call fcn.004329a0
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 2
nop dword [rax + rax]
call fcn.004384a0
lea rax, [0x006d03c5]
mov ebx, 0x13
call fcn.00438da0
call fcn.00438520
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 1
nop
mov ecx, 1
lea rdx, [0x01328324]
lock xadd dword [rdx], ecx
nop
nop
lea rax, [0x01328440]
call fcn.0040b740
cmp dword [0x01328a90], 0
jg 0x437282
cmp dword [0x01328a8c], 0
jle 0x43728c
mov eax, 1
call fcn.004446a0
call fcn.0043ab00
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
call fcn.004633c0
jmp fcn.00437140
Function at 0x43b880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43baef
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jg 0x43badd
mov qword [rsp + 0x40], r14
nop
nop
lea rax, [0x012d4d18]
call fcn.0040b740
mov ecx, dword [0x01328308]
mov dword [0x012d4dec], ecx
nop
nop
mov ecx, 1
lea rdx, [0x012d4de8]
xchg byte [rdx], cl
call fcn.00444560
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0xa0]
mov dword [rcx + 4], 3
dec dword [0x012d4dec]
mov rcx, qword [0x012d3a80]
mov qword [rsp + 0x50], rcx
mov rdx, qword [0x012d3a88]
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x43b91a
lea rax, [rsi + 1]
cmp rax, rdx
jge 0x43b99e
mov rbx, qword [rcx + rax*8]
cmp dword [rbx + 4], 2
jne 0x43b942
mov rsi, rax
mov eax, 2
mov edi, 3
lock cmpxchg dword [rbx + 4], edi
sete r8b
nop
jmp 0x43b94d
mov rsi, rax
mov edi, 3
xor r8d, r8d
test r8b, r8b
je 0x43b916
cmp byte [0x012da490], 0
je 0x43b990
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
call fcn.00456c80
mov rax, qword [rsp + 0x38]
call fcn.00456500
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
mov edi, 3
inc dword [rbx + 0x14]
dec dword [0x012d4dec]
jmp 0x43b916
nop
nop
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x18], rax
jmp 0x43b9d4
mov dword [rax + 4], 3
dec dword [0x012d4dec]
mov rax, qword [rsp + 0x18]
call fcn.00445540
test rax, rax
jne 0x43b9c2
nop
nop
mov ecx, dword [0x012d4dec]
mov dword [rsp + 0x14], ecx
lea rax, [0x012d4d18]
call fcn.0040b960
mov ecx, dword [rsp + 0x14]
test ecx, ecx
jle 0x43ba28
nop
jmp 0x43ba07
call fcn.00444560
lea rax, [0x012d4df0]
mov ebx, 0x186a0
call fcn.0040bea0
test al, al
je 0x43ba02
nop
mov qword [0x012d4df0], 0
cmp dword [0x012d4dec], 0
jne 0x43ba4a
mov rcx, qword [0x012d3a80]
mov rdx, qword [0x012d3a88]
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x43bacd
mov eax, 0x29
lea rcx, [0x006da125]
mov dl, byte [0x013282b2]
nop dword [rax]
test dl, dl
je 0x43ba94
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rcx
nop
nop
lea rax, [0x013283c0]
call fcn.0040b740
nop
nop
lea rax, [0x013283c0]
call fcn.0040b740
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
test rax, rax
jne 0x43baa3
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rbx, rax
mov rax, rcx
call fcn.00436b60
mov rdi, qword [rcx + rax*8]
cmp dword [rdi + 4], 3
mov edi, 0x2e
cmovne rbx, rdi
lea r8, [0x006db948]
cmovne rsi, r8
inc rax
cmp rax, rdx
jl 0x43baae
mov rax, rbx
mov rcx, rsi
jmp 0x43ba56
lea rax, [0x006d421a]
mov ebx, 0x1b
call fcn.00436b60
nop
call fcn.004633c0
jmp fcn.0043b880
Function at 0x43bb00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43bcd8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x60], al
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x01328314]
test edx, edx
je 0x43bb54
xor eax, eax
nop dword [rax]
call fcn.00430c00
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.0043f680
nop
nop
lea rax, [0x012d4d18]
nop dword [rax]
call fcn.0040b740
mov ecx, dword [0x01328308]
mov edx, dword [0x01328320]
test edx, edx
je 0x43bb82
mov dword [0x01328320], 0
nop
jmp 0x43bb84
mov edx, ecx
mov eax, edx
call fcn.00442ec0
mov qword [rsp + 0x40], rax
nop
nop
xor ecx, ecx
lea rdx, [0x012d4de8]
xchg byte [rdx], cl
mov cl, byte [0x012d4df8]
test cl, cl
je 0x43bbc5
nop
nop
xor ecx, ecx
lea rdx, [0x012d4df8]
xchg byte [rdx], cl
lea rax, [0x012d4e00]
nop dword [rax + rax]
call fcn.0040ba40
nop
nop
lea rax, [0x012d4d18]
call fcn.0040b960
mov rcx, qword [rsp + 0x40]
jmp 0x43bbe0
mov rcx, qword [rsp + 0x48]
nop
test rcx, rcx
je 0x43bc3a
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rax, rax
je 0x43bc27
nop
mov qword [rcx + 0x38], 0
cmp qword [rax + 0xa8], 0
jne 0x43bcc6
nop
mov qword [rax + 0xa8], rcx
add rax, 0x118
nop dword [rax]
call fcn.0040ba40
jmp 0x43bbda
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
call fcn.0043ce00
jmp 0x43bbda
nop
nop dword [rax + rax]
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x43bc85
nop
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
nop dword [rax]
call fcn.004553c0
call fcn.0043da20
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
nop
cmp ecx, 1
jne 0x43bcb7
cmp byte [r14 + 0xb1], 0
je 0x43bcb7
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x006d8a33]
mov ebx, 0x25
call fcn.00436b60
nop
mov byte [rsp + 8], al
nop dword [rax]
call fcn.004633c0
movzx eax, byte [rsp + 8]
jmp fcn.0043bb00
Function at 0x43ce00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43cf6c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043c5a0
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43cf21
mov rcx, qword [rdx + 0x30]
nop word [rax + rax]
test rcx, rcx
je 0x43cf21
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x238], 0
jne 0x43ce86
cmp byte [rcx + 0xe8], 0
nop
je 0x43cf21
nop
nop
lea rax, [0x013288c0]
call fcn.0040b740
cmp dword [0x013288e0], 0
nop dword [rax + rax]
je 0x43cf5a
mov rcx, qword [0x013288c8]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x128], rcx
nop
mov qword [0x013288c8], rdx
cmp byte [0x013288d0], 0
je 0x43cedd
mov byte [0x013288d0], 0
lea rax, [0x013288d8]
call fcn.0040ba40
nop
nop
lea rax, [0x013288c0]
call fcn.0040b960
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43cf17
cmp byte [r14 + 0xb1], 0
je 0x43cf17
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043cfa0
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43cf50
cmp byte [r14 + 0xb1], 0
je 0x43cf50
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006da4ba]
mov ebx, 0x2a
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043ce00
Function at 0x43db80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ddbd
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x130]
test rdx, rdx
je 0x43ddab
mov rdx, qword [rdx + 0xe8]
cmp rdx, rcx
jne 0x43ddab
mov qword [rsp + 0x30], r14
cmp qword [rcx + 0xa0], 0
je 0x43dbd5
call fcn.004438c0
call fcn.0043d6e0
mov eax, 1
call fcn.00443a20
nop
call fcn.0043bee0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x130]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43dc34
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.00443740
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov dword [rsp + 0x1c], ebx
call fcn.004384a0
lea rax, [0x006daa66]
mov ebx, 0x2b
call fcn.00438da0
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.00438aa0
lea rax, [0x006d7eae]
mov ebx, 0x24
call fcn.00438da0
call fcn.00438520
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x130]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
nop
call fcn.004384a0
lea rax, [0x006cfb99]
mov ebx, 0x12
call fcn.00438da0
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00438d20
lea rax, [0x006cbd88]
mov ebx, 7
call fcn.00438da0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438aa0
lea rax, [0x006cfd2a]
mov ebx, 0x13
call fcn.00438da0
mov eax, dword [rsp + 0x18]
mov eax, eax
nop dword [rax]
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.004384a0
lea rax, [0x006cfbab]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.00438da0
mov rax, qword [rsp + 0x28]
call fcn.00438d20
lea rax, [0x006cbd88]
mov ebx, 7
nop dword [rax + rax]
call fcn.00438da0
mov rax, qword [rsp + 0x20]
call fcn.00438aa0
lea rax, [0x006cfd17]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00438da0
mov eax, dword [rsp + 0x14]
mov eax, eax
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
lea rax, [0x006d32ae]
mov ebx, 0x19
call fcn.00436b60
lea rax, [0x006d6f23]
mov ebx, 0x21
call fcn.00436b60
nop
nop dword [rax]
call fcn.004633c0
jmp fcn.0043db80
Function at 0x43f960
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43fb9a
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jne 0x43fb88
mov qword [rsp + 0x18], rcx
cmp qword [rcx + 0x130], 0
je 0x43f9b8
call fcn.0043db80
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x130]
xor ebx, ebx
mov rax, rcx
call fcn.0043dfa0
mov rcx, qword [rsp + 0x18]
cmp byte [rcx + 0xe8], 0
nop
je 0x43f9d1
jmp 0x43fb77
call fcn.0043dde0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0xa0]
test byte [rdx], al
mov byte [rdx + 0x22c0], 0
cmp byte [rcx + 0xe4], 0
je 0x43fa0c
cmp qword [rdx + 0x998], 0
jne 0x43fb66
mov esi, dword [rdx + 0x190]
nop
cmp dword [rdx + 0x194], esi
jne 0x43fb66
call fcn.0043e120
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x17], bl
mov byte [rsp + 0x16], cl
mov rdx, qword [rsp + 0x18]
cmp byte [rdx + 0xe4], 0
je 0x43fa45
call fcn.0043f600
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
cmp byte [0x012d4d80], 0
jne 0x43fa52
xor esi, esi
jmp 0x43fa75
mov ebx, 1
call fcn.0045ab00
xor eax, 1
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
mov esi, eax
mov rax, qword [rsp + 0x20]
test sil, sil
je 0x43fb31
nop
nop
lea rax, [0x012d4d18]
call fcn.0040b740
cmp byte [0x012d4d80], 0
jne 0x43fa9c
mov eax, 1
jmp 0x43faab
mov rax, qword [rsp + 0x20]
mov ebx, 1
call fcn.0045ab00
test al, al
jne 0x43fb0f
nop
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0xa0], 0
mov rdx, qword [0x012d4d90]
test rdx, rdx
je 0x43fad8
mov rbx, rcx
mov qword [rdx + 0xa0], rcx
jmp 0x43fae6
nop
mov rdx, rcx
mov qword [0x012d4d88], rcx
mov rbx, rdx
nop
mov qword [0x012d4d90], rbx
inc dword [0x012d4d98]
nop
nop
lea rax, [0x012d4d18]
nop dword [rax]
call fcn.0040b960
mov rcx, qword [rsp + 0x18]
jmp 0x43f9d1
nop
nop
lea rax, [0x012d4d18]
call fcn.0040b960
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
test cl, cl
je 0x43fb49
call fcn.0043da20
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
cmp qword [rax + 0xe8], 0
jne 0x43f9c7
call fcn.0043dfa0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006d761c]
mov ebx, 0x22
call fcn.00436b60
lea rax, [0x006cefd7]
mov ebx, 0x10
call fcn.00436b60
lea rax, [0x006d23af]
mov ebx, 0x17
call fcn.00436b60
nop
call fcn.004633c0
nop
jmp fcn.0043f960
Function at 0x440340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4405ac
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
cmp byte [0x012da490], 0
je 0x440377
mov eax, 0x14
xor ebx, ebx
call fcn.00456a20
mov rax, qword [rsp + 0x48]
nop
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
jne 0x440485
cmp byte [rax + 0xb4], 0
je 0x4403bc
mov rcx, qword [rax + 0x40]
mov rax, rcx
nop dword [rax + rax]
call fcn.004512a0
test rax, rax
je 0x44046f
movzx edx, byte [rax + 0x29]
test dl, 2
jne 0x440414
mov rax, qword [rsp + 0x48]
mov ebx, 2
mov ecx, 0x1009
call fcn.0043b480
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop
nop
xor esi, esi
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
nop
xor esi, esi
mov qword [rdx + 0x90], rsi
mov rax, qword [rsp + 0x48]
mov ebx, 0x1009
mov ecx, 9
nop dword [rax + rax]
call fcn.0043aba0
call fcn.0043f960
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00451a40
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.004384a0
lea rax, [0x006d89e9]
mov ebx, 0x25
call fcn.00438da0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
call fcn.00438da0
lea rax, [0x006cf677]
mov ebx, 0x12
call fcn.00438da0
call fcn.00438520
lea rax, [0x006ce8ab]
mov ebx, 0xf
call fcn.00436b60
lea rax, [0x006d1219]
mov ebx, 0x15
nop dword [rax + rax]
call fcn.00436b60
nop
mov qword [rsp + 0x28], r14
nop
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.004384a0
lea rax, [0x006cfb99]
mov ebx, 0x12
call fcn.00438da0
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.00438d20
lea rax, [0x006cbd88]
mov ebx, 7
call fcn.00438da0
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00438aa0
lea rax, [0x006cfd2a]
mov ebx, 0x13
call fcn.00438da0
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x10], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.004384a0
lea rax, [0x006cfbab]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.00438da0
mov rax, qword [rsp + 0x28]
call fcn.00438d20
lea rax, [0x006cbd88]
mov ebx, 7
nop dword [rax + rax]
call fcn.00438da0
mov rax, qword [rsp + 0x18]
call fcn.00438aa0
lea rax, [0x006cfd17]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00438da0
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
lea rax, [0x006cd7b3]
mov ebx, 0xc
call fcn.00436b60
nop
mov qword [rsp + 8], rax
call fcn.00467e40
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.00440340
Function at 0x443a80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x443d86
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp byte [0x013282b7], 0
nop
jne 0x443c59
cmp byte [0x013282b5], 0
jne 0x443c59
mov ecx, dword [0x01328324]
nop dword [rax]
test ecx, ecx
ja 0x443c4f
cmp byte [0x013282b6], 0
je 0x443ad5
xor ecx, ecx
jmp 0x443b05
cmp byte [0x013282b0], 0
jne 0x443ae2
xor ecx, ecx
jmp 0x443b05
mov eax, 1
call fcn.0043cd00
cmp dword [0x013282ec], 0
seta cl
nop
nop
lea rdx, [0x013283d0]
xchg qword [rdx], rax
movzx ecx, cl
mov edx, dword [0x012d4d28]
mov rbx, qword [0x012d4d30]
sub rbx, qword [0x012d4d40]
mov rsi, rbx
sub ebx, edx
mov edi, dword [0x012d4d2c]
sub ebx, edi
mov r8d, dword [0x012d4d3c]
sub ebx, r8d
cmp ecx, ebx
jl 0x443c45
nop dword [rax + rax]
test ebx, ebx
jl 0x443cd0
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00443da0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x30]
call fcn.0043a1a0
cmp qword [rsp + 0x20], 0
jne 0x443b9e
nop
nop
lea rax, [0x012d4d18]
call fcn.0040b960
lea rax, [0x006dd6db]
mov ebx, 0x36
call fcn.00436c60
cmp qword [0x013283d8], 0
je 0x443bbc
call fcn.00454cc0
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jl 0x443bd1
mov rcx, qword [0x012d3a80]
mov rdx, qword [0x012d3a88]
xor eax, eax
jmp 0x443c88
mov qword [0x013283d8], rax
call fcn.00445540
nop dword [rax]
test rax, rax
je 0x443c74
nop
mov rcx, qword [0x012d4d20]
test rcx, rcx
je 0x443c0d
mov rdx, qword [rcx + 0x128]
mov qword [0x012d4d20], rdx
dec dword [0x012d4d28]
test rcx, rcx
je 0x443c63
nop
mov edx, 1
lea rbx, [0x012d4d5c]
lock xadd dword [rbx], edx
mov byte [rcx + 0xe4], 1
nop
mov qword [rcx + 0xa8], rax
lea rax, [rcx + 0x118]
call fcn.0040ba40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006d2ead]
mov ebx, 0x19
call fcn.00436b60
lea rax, [0x006d2ec6]
mov ebx, 0x19
call fcn.00436b60
inc rax
cmp rax, rdx
jge 0x443ca7
mov rbx, qword [rcx + rax*8]
test byte [rbx], al
cmp qword [rbx + 0x2288], 0
je 0x443c85
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
nop
nop
lea rax, [0x012d4d18]
call fcn.0040b960
lea rax, [0x006d8602]
mov ebx, 0x25
call fcn.00436c60
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x14], r8d
call fcn.004384a0
lea rax, [0x006d415d]
mov ebx, 0x1b
call fcn.00438da0
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
nop
call fcn.00438ba0
lea rax, [0x006cdfa7]
mov ebx, 0xe
call fcn.00438da0
mov eax, dword [rsp + 0x18]
movsxd rax, eax
nop dword [rax]
call fcn.00438ba0
lea rax, [0x006cc0f2]
mov ebx, 8
call fcn.00438da0
mov rax, qword [rsp + 0x28]
movsxd rax, eax
nop
call fcn.00438ba0
lea rax, [0x006cbd57]
mov ebx, 7
call fcn.00438da0
mov eax, dword [rsp + 0x14]
movsxd rax, eax
nop dword [rax]
call fcn.00438ba0
call fcn.00438700
call fcn.00438520
lea rax, [0x006d54c3]
mov ebx, 0x1e
nop dword [rax + rax]
call fcn.00436b60
nop
call fcn.004633c0
jmp fcn.00443a80
Function at 0x4453a0
Capabilities:
Encode data using base64
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44550a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4453b8
cmp edx, ecx
jne 0x4454f8
nop dword [rax]
test rsi, rsi
jne 0x4454f8
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x445414
nop
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004452a0
mov rcx, qword [0x012d3b08]
mov rdx, qword [0x012d3b00]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x4454f3
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x4454e8
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x012d4d50]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x012d4d50], rbx
nop
mov edx, 1
lea rsi, [0x012d4d58]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x4454d7
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d9acc]
mov ebx, 0x28
call fcn.00436b60
mov rcx, rax
mov rax, rsi
call fcn.00465a20
call fcn.00435020
lea rax, [0x006d7bf0]
mov ebx, 0x23
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004453a0