joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4124d0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x412703
mov ecx, dword [esp + 0x38]
cmp dword [eax], ecx
jne 0x41263e
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x4125c6
movzx ecx, byte [0xcc7b44]
test cl, cl
je 0x4125c2
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x24], ecx
test byte [ecx], al
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor esi, esi
xor edi, edi
jmp 0x412540
add esi, 4
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
cmp dword [eax + 4], esi
jbe 0x4125be
test esi, 0x1f
jne 0x4125ba
movzx edi, byte [edx]
nop
inc edx
test edi, 1
je 0x412531
add ebp, esi
add ebx, esi
mov eax, dword [ecx + 0xbe4]
mov ebp, dword [ebp]
mov ebx, dword [ebx]
mov dword [eax], ebp
mov dword [eax + 4], ebx
mov eax, dword [ecx + 0xbe4]
add eax, 8
mov dword [ecx + 0xbe4], eax
cmp dword [ecx + 0xbe8], eax
jne 0x412531
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edx
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.0042a760
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
jmp 0x412531
shr edi, 1
jmp 0x412552
add esp, 0x28
ret
add esp, 0x28
ret
mov dword [esp], eax
call fcn.004527b0
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x20], ecx
call fcn.00432ad0
lea eax, [0x87b5d9]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433370
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00433370
lea eax, [0x86bbdd]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00433370
call fcn.00432b40
lea eax, [0x8794c4]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00431250
mov dword [esp], eax
call fcn.004527b0
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x2c]
mov edx, dword [edx]
mov dword [esp + 0x14], edx
call fcn.00432ad0
lea eax, [0x87b5d9]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433370
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00433370
lea eax, [0x869e93]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433370
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433080
lea eax, [0x86d4be]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00433370
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433080
call fcn.00432cf0
call fcn.00432b40
lea eax, [0x8794c4]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00431250
lea eax, [0x87bdd0]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00431250
nop
int3
Function at 0x414ec0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4150dc
sub esp, 0x18
mov eax, dword [0xcc7888]
test eax, eax
jne 0x4150c5
lea eax, [0xcc7874]
mov dword [esp], eax
call fcn.00408fa0
mov eax, dword [0xcb40d8]
test eax, eax
je 0x414f0c
cmp dword [eax + 8], 0xcc
jne 0x414fd4
mov edx, dword [0xcb40d0]
test edx, edx
jne 0x414fb6
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0xcc9a98]
mov dword [esp + 8], eax
call fcn.0040b380
mov eax, dword [esp + 0xc]
mov dword [0xcb40d0], eax
mov ecx, dword [0xcb40ac]
mov dword [eax], ecx
mov eax, dword [0xcb40d0]
mov dword [0xcb40ac], eax
movzx eax, byte [0xcc7d60]
test al, al
jne 0x414fb6
xor eax, eax
jmp 0x414f73
lea esi, [0xcc7d60]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x414fb6
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x4150bb
lea edx, [0xc64254]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x414f65
jmp 0x4150af
mov edx, dword [0xcb40d0]
mov ebx, dword [edx + 4]
mov dword [0xcb40d0], ebx
mov ebx, dword [0xcb40d8]
mov dword [edx + 4], ebx
mov dword [0xcb40d8], edx
mov edx, dword [0xcb40d8]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4150a5
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004023a0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0xcc7b40]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x415096
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0xcc7b40]
test edx, edx
jne 0x415073
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0xcc77db], 1
lea eax, [0xcc7874]
mov dword [esp], eax
call fcn.00409180
add esp, 0x18
ret
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045a0b0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045a0b0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045a0b0
jmp 0x41505a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045a0b0
mov eax, edx
jmp 0x415030
mov ecx, 0xcc
call fcn.0045a140
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.0045a130
mov ecx, 5
call fcn.0045a130
lea eax, [0x871959]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00431250
nop
call fcn.00458870
jmp fcn.00414ec0
Function at 0x41e5a0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41e739
sub esp, 0x2c
call fcn.00432ad0
lea eax, [0xcc9a50]
mov dword [esp], eax
call fcn.00402480
mov eax, dword [esp + 8]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x18], ecx
lea edx, [0xcc9a48]
mov dword [esp], edx
call fcn.00402480
mov eax, dword [esp + 4]
mov ecx, eax
mov eax, 0x64
mul ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x20], ecx
call fcn.0041ded0
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov edx, dword [esp + 0x20]
imul edx, edx, 0x64
mov ebx, dword [esp + 0x28]
add edx, ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.00454d60
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
call fcn.00432ad0
lea eax, [0x868137]
mov dword [esp], eax
mov dword [esp + 4], 5
call fcn.00433370
mov eax, dword [esp + 0x30]
shr eax, 0xa
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433080
lea eax, [0x869ebf]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433370
mov eax, dword [esp + 0x18]
shr eax, 0xa
mov ecx, dword [esp + 0x1c]
mov edx, ecx
shl ecx, 0x16
or eax, ecx
mov dword [esp], eax
shr edx, 0xa
mov dword [esp + 4], edx
call fcn.00433080
lea eax, [0x86a595]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00433370
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.00433080
lea eax, [0x868219]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00433370
call fcn.00432b40
movzx eax, byte [esp + 0x34]
test al, al
jne 0x41e717
call fcn.00432ad0
call fcn.00432cf0
call fcn.00432b40
call fcn.00432b40
add esp, 0x2c
ret
call fcn.00432ad0
lea eax, [0x8690be]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00433370
call fcn.00432b40
jmp 0x41e6ff
call fcn.00458870
jmp fcn.0041e5a0
Function at 0x425f50
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4261ca
sub esp, 0x24
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0x34]
mov ebx, eax
shr eax, 0x16
cmp dword [edx + 0x44], eax
jbe 0x4260c1
and ebx, 0x3fffff
shr ebx, 0xd
lea ebp, [ebx - 0x200]
xchg ebp, ebx
neg ebx
xchg ebp, ebx
mov esi, dword [esp + 0x2c]
cmp ebp, esi
jb 0x425fcb
mov ecx, dword [edx + 0x28]
mov ebp, dword [edx + 0x24]
cmp eax, ecx
jae 0x4261c4
lea ecx, [ebp + eax*8]
mov ebp, dword [ecx + 4]
mov ecx, dword [ecx]
test ebp, 0x80000000
je 0x4260ae
mov ecx, 0x40000
cmp ecx, esi
jae 0x426067
mov dword [esp], edx
mov dword [esp + 4], esi
call fcn.004253f0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test eax, eax
jne 0x42600b
mov eax, dword [esp + 0x2c]
cmp eax, 1
jne 0x425ff7
mov eax, dword [esp + 0x28]
mov dword [eax + 0x34], 0xffffffff
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x24
ret
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x28]
mov dword [esp], edx
mov dword [esp + 4], eax
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebx
call fcn.00425180
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x34]
mov ebx, dword [esp + 0x1c]
cmp ebx, edx
jae 0x42605a
mov edx, 0xffffffff
test edx, edx
jle 0x42604a
mov dword [ecx + 0x34], ebx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
add esp, 0x24
ret
jbe 0x426063
mov edx, 1
jmp 0x426043
xor edx, edx
jmp 0x426043
mov ebp, dword [edx + 0x30]
test byte [ebp], al
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
shl eax, 7
lea eax, [ebp + eax]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
call fcn.00427f50
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test eax, eax
jb 0x4260d5
shl eax, 0xd
mov edx, dword [esp + 0x20]
shl edx, 0x16
add eax, edx
shl ecx, 0xd
add ecx, edx
jmp 0x42600b
shl ebp, 0xe
shr ecx, 0x12
or ecx, ebp
and ecx, 0x3ffff
jmp 0x425fc3
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x24
ret
call fcn.00432ad0
lea eax, [0x86c26d]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00433370
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433080
lea eax, [0x869f85]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433370
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433080
call fcn.00432cf0
call fcn.00432b40
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x34]
mov dword [esp + 0x14], eax
call fcn.00432ad0
lea eax, [0x86fa9c]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00433370
mov eax, dword [esp + 0x14]
and eax, 0x3fffff
shr eax, 0xd
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433080
lea eax, [0x86cd1b]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00433370
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433240
call fcn.00432cf0
call fcn.00432b40
lea eax, [0x86c866]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00431250
call fcn.0045a140
nop
call fcn.00458870
jmp fcn.00425f50
Function at 0x429c00
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x429d37
sub esp, 0x1c
lea eax, [0xcc78e4]
mov dword [esp], eax
call fcn.00408fa0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x99], 2
call fcn.00432ad0
lea eax, [0x869dfa]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00433370
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00433330
lea eax, [0x8676be]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00433370
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433240
lea eax, [0x8676b4]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00433370
call fcn.00432b40
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00451b50
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
lea eax, [0x456b70]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00458750
call fcn.00432ad0
call fcn.00432cf0
call fcn.00432b40
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x99], 0
lea eax, [0xcc78e4]
mov dword [esp], eax
call fcn.00409180
add esp, 0x1c
ret
call fcn.00458870
jmp fcn.00429c00
Function at 0x430250
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x14]
test edx, edx
je 0x430392
lea ebx, [esp + 0x24]
cmp dword [edx + 8], ebx
jne 0x43038e
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], edx
lea edi, [ecx + 0x14]
mov dword [esp + 0x14], edi
movzx ebx, byte [edx + 6]
test bl, bl
jne 0x430348
mov ebx, dword [edx]
test ebx, ebx
jne 0x430308
mov ebx, dword [edx + 0x10]
mov ebp, dword [0xcc7b40]
test ebp, ebp
jne 0x4302f4
mov dword [edx + 0x10], 0
mov dword [esp + 0x10], ebx
test byte [ecx], al
mov ebp, dword [0xcc7b40]
mov eax, dword [edx + 0x18]
test ebp, ebp
jne 0x4302ed
mov dword [ecx + 0x14], eax
mov dword [esp], edx
call fcn.0042ffe0
mov eax, dword [esp + 0x10]
test byte [eax], al
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.00459a40
add esp, 0x20
ret
call fcn.0045a0b0
jmp 0x4302c3
lea ebp, [edx + 0x10]
mov eax, edi
mov edi, ebp
mov esi, eax
xor eax, eax
call fcn.0045a0b0
mov edi, esi
jmp 0x4302ad
cmp ebx, 4
jne 0x43031f
lea ebx, [edx + 0x28]
test byte [ebx], al
mov ebx, dword [edx + 0x28]
nop
mov dword [esp + 0x24], ebx
jmp 0x430299
nop
lea eax, [esp + 0x24]
mov dword [esp], eax
lea ecx, [edx + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.0045aa60
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
jmp 0x430299
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00430760
movzx eax, byte [esp + 8]
test al, al
je 0x430396
mov ecx, dword [esp + 0xc]
test byte [ecx], al
mov edx, dword [0xcc7b40]
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
test edx, edx
jne 0x430383
mov dword [ecx + 0x14], eax
mov dword [esp], ebx
call fcn.0042ffe0
add esp, 0x20
ret
mov edi, dword [esp + 0x14]
call fcn.0045a0b0
jmp 0x430377
add esp, 0x20
ret
add esp, 0x20
ret
lea eax, [0x87d045]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00431250
nop
int3
Function at 0x439c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
call fcn.00439c40
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x1c]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.00435250
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
jbe 0x439e66
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea ecx, [0x457a60]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
mov dword [esp], ecx
call fcn.00458750
movzx eax, byte [0xcbf728]
test al, al
jne 0x439e3f
lea eax, [0xcb5eec]
mov dword [esp], eax
call fcn.00402270
mov eax, dword [esp + 4]
test eax, eax
jne 0x439e18
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
test byte [ecx], al
mov ecx, dword [ecx + 0x13f0]
test ecx, ecx
jne 0x439ded
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x164], edx
mov byte [eax + 0x6e], 1
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0xbc], 0
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [ecx + 0x2c], 0
mov edx, dword [eax + 0x18]
mov ebx, ecx
mov dword [edx + 0x5c], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x54], 0
lea ecx, [ebx + 4]
mov dword [esp], ecx
mov dword [esp + 4], 2
call fcn.00402460
mov eax, dword [0xcb5ee0]
test eax, eax
jne 0x439dc9
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
add esp, 0x18
ret
lea eax, [0x937464]
mov dword [esp], eax
call fcn.00458750
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00439c40
jmp 0x439dbb
lea eax, [0x937568]
mov dword [esp], eax
call fcn.00458750
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00439c40
mov eax, dword [esp + 0xc]
jmp 0x439d5f
lea eax, [0x937468]
mov dword [esp], eax
call fcn.00458750
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00439c40
jmp 0x439d45
lea eax, [0x9375b0]
mov dword [esp], eax
call fcn.00458750
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00439c40
jmp 0x439d2b
cmp dword [eax + 4], ecx
jb 0x439cf2
jmp 0x439d1c
Function at 0x43c200
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43c3d9
sub esp, 0x24
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
test edx, edx
je 0x43c3c2
mov ebx, dword [ecx + 0xbc]
test ebx, ebx
je 0x43c3c2
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edx
nop
mov ebp, dword [edx + 0x2c]
mov dword [esp + 8], ebp
cmp ebp, ecx
jne 0x43c2b3
cmp dword [edx + 0x30], ebx
jne 0x43c2b3
cmp dword [edx + 4], 1
jne 0x43c2b3
movzx ecx, byte [0xcbf728]
test cl, cl
jne 0x43c29d
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x54], 0
mov eax, dword [eax + 0x18]
mov dword [eax + 0xbc], 0
mov dword [edx + 0x2c], 0
mov dword [edx + 4], 0
mov dword [esp + 0x28], edx
add esp, 0x24
ret
mov dword [esp + 0x10], eax
mov dword [esp], edx
call fcn.0044e7b0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
jmp 0x43c270
mov eax, dword [edx + 0x30]
mov dword [esp + 0x14], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0xc], ecx
call fcn.00432ad0
lea eax, [0x86acd9]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00433370
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00433330
lea eax, [0x8681fb]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00433370
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00433330
lea eax, [0x868207]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00433370
mov eax, dword [esp + 8]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433240
lea eax, [0x869ef6]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433370
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00433330
lea eax, [0x869f22]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433370
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00433330
lea eax, [0x869f2d]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433370
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433080
call fcn.00432cf0
call fcn.00432b40
lea eax, [0x872399]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00431250
lea eax, [0x86fa48]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00431250
nop
call fcn.00458870
jmp fcn.0043c200
Function at 0x441b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x441d77
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.004023a0
mov eax, dword [esp + 0x20]
shr eax, 3
mov ecx, eax
mov eax, 0x828cbfbf
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
shl ecx, 6
mov dword [esp + 0x1c], ecx
lea eax, [0xcbb860]
lea edx, [eax + ecx + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
call fcn.00402270
mov eax, dword [esp + 4]
test eax, eax
je 0x441d5c
mov eax, dword [esp + 0x1c]
lea ecx, [0xcbb860]
lea edx, [ecx + eax]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.00408fa0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00402270
mov eax, dword [esp + 4]
test eax, eax
je 0x441d4c
mov eax, dword [esp + 0x1c]
lea ecx, [0xcbb860]
lea eax, [ecx + eax]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.004421d0
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test eax, eax
jne 0x441d33
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00409180
mov eax, dword [esp + 0x24]
test eax, eax
je 0x441cdc
mov ecx, dword [eax + 0x18]
test ecx, ecx
setne dl
mov ebx, dword [eax + 0x14]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or edx, ebp
test dl, dl
jne 0x441d07
mov ecx, dword [eax + 0x24]
test ecx, ecx
jne 0x441d60
movzx ecx, byte [esp + 0x38]
test cl, cl
jne 0x441cf0
xor ecx, ecx
test cl, cl
je 0x441ca8
mov dword [eax + 0x24], 1
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov dword [esp + 4], ecx
call fcn.004417f0
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x24], 1
jne 0x441cdc
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x78]
test eax, eax
je 0x441ce0
add esp, 0x30
ret
lea eax, [0x9374cc]
mov dword [esp], eax
call fcn.004586f0
jmp 0x441cdc
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00441d90
movzx ecx, byte [esp + 4]
mov eax, dword [esp + 0x24]
jmp 0x441c9d
mov eax, dword [esp + 0x14]
sub eax, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x18]
sbb eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 3]
mov dword [esp + 8], ecx
call fcn.00429780
mov eax, dword [esp + 0x24]
jmp 0x441c87
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.004023a0
jmp 0x441c55
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00409180
add esp, 0x30
ret
add esp, 0x30
ret
lea eax, [0x872a84]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00431250
nop
call fcn.00458870
jmp fcn.00441b70