joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454240
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x50]
cmp r12, qword [r14 + 0x10]
jbe 0x454480
push rbp
mov rbp, rsp
sub rsp, 0xc8
mov rdx, r14
nop dword [rax]
cmp rdx, rsi
jne 0x454276
mov rdi, qword [rdx + 0x30]
cmp qword [rdi + 0x90], rdx
je 0x45446e
cmp rbx, 0xffffffffffffffff
jne 0x4542a4
nop dword [rax]
cmp rcx, 0xffffffffffffffff
jne 0x45429f
mov rcx, qword [rsi + 0x70]
test rcx, rcx
je 0x454295
mov rdx, qword [rsi + 0x78]
jmp 0x4542a7
mov rdx, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x38]
jmp 0x4542a7
mov rdx, rbx
jmp 0x4542a7
mov rdx, rbx
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xf8], rsi
mov byte [rsp + 0x100], r8b
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x38], rcx
test rdx, rdx
jne 0x45430a
mov rbx, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rcx
lea rcx, [rbx + 8]
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x20]
call fcn.0044d260
test rax, rax
je 0x454419
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rbx
mov rdx, qword [rsp + 0xf8]
mov r8, qword [rdx + 0x148]
dec r8
mov r9, rdx
lea rdi, [rsp + 0x68]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004604cb
mov rbp, qword [rbp]
mov r10, qword [rsp + 0x10]
mov qword [rsp + 0x68], r10
movups xmm0, xmmword [rsp + 0x18]
movups xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xb8], r8
movzx edx, byte [rsp + 0x100]
mov byte [rsp + 0xc1], dl
mov rdi, qword [rsp + 0xd8]
lea rsi, [rsp + 0x68]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046082c
mov rbp, qword [rbp]
mov rdx, qword [rsp + 0x60]
cmp qword [rsp + 0x20], rdx
jne 0x4543fa
mov rsi, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rsi
jne 0x4543fa
cmp qword [r9 + 0x78], rdx
jne 0x4543fa
cmp qword [r9 + 0x70], rsi
sete dl
jmp 0x4543fc
xor edx, edx
mov rax, qword [rsp + 0xd8]
mov ebx, 1
mov ecx, edx
call fcn.004544e0
add rsp, 0xc8
pop rbp
ret
movzx ecx, byte [rsp + 0x100]
test cl, 2
jne 0x454430
mov rdx, qword [rsp + 0xf8]
test byte [rdx], al
test cl, 3
je 0x45445d
mov rdi, qword [rsp + 0xd8]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004604cb
mov rbp, qword [rbp]
add rsp, 0xc8
pop rbp
ret
lea rax, [0x006c5bf7]
mov ebx, 0xa
call fcn.004341e0
lea rax, [0x006d3861]
mov ebx, 0x2c
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x30], r8b
nop
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movzx r8d, byte [rsp + 0x30]
jmp fcn.00454240
Function at 0x455020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4550cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00455120]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045dde0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00455020

Function at 0x4556a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455797
push rbp
mov rbp, rsp
sub rsp, 0x28
test ebx, ebx
je 0x4556bf
lea rcx, [0x00874ea0]
jmp 0x4556ce
xor eax, eax
add rsp, 0x28
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x455701
mov rdx, qword [rcx + 0x128]
cmp rax, rdx
jb 0x4556c7
mov rsi, qword [rcx + 0x130]
cmp rax, rsi
jae 0x4556c7
movsxd rcx, ebx
lea rax, [rdx + rcx]
cmp rsi, rax
jb 0x455785
add rsp, 0x28
pop rbp
ret
mov dword [rsp + 0x40], ebx
nop
nop
nop
lea rax, [0x008a7200]
call fcn.0040b500
mov rbx, qword [0x008a7210]
lea rax, [0x0067d5a0]
mov ecx, dword [rsp + 0x40]
call fcn.00410480
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
nop
nop
nop
lea rax, [0x008a7200]
call fcn.0040b760
movzx ecx, byte [rsp + 0x1f]
test cl, cl
jne 0x455758
lea rax, [0x00874ea0]
jmp 0x45576a
mov rax, qword [rsp + 0x20]
add rsp, 0x28
pop rbp
ret
mov rax, qword [rax + 0x248]
test rax, rax
jne 0x455763
lea rax, [0x006d41ed]
mov ebx, 0x2e
nop dword [rax + rax]
call fcn.004341e0
lea rax, [0x006cf5d8]
mov ebx, 0x21
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.004556a0
Function at 0x4557c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455908
push rbp
mov rbp, rsp
sub rsp, 0x28
test ebx, ebx
je 0x4557e4
cmp ebx, 0xffffffff
je 0x4557e4
lea rcx, [0x00874ea0]
jmp 0x4557f3
xor eax, eax
add rsp, 0x28
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x455814
nop dword [rax + rax]
cmp qword [rcx + 0x128], rax
ja 0x4557ec
cmp qword [rcx + 0x130], rax
jbe 0x4557ec
jmp 0x455816
xor ecx, ecx
mov dword [rsp + 0x40], ebx
test rcx, rcx
je 0x455879
mov qword [rsp + 0x18], rcx
mov rdx, qword [rcx + 0x238]
lea rax, [0x0067d4e0]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
call fcn.00410300
mov rax, qword [rax]
test rax, rax
jne 0x455873
mov ecx, dword [rsp + 0x40]
movsxd rax, ecx
mov rcx, qword [rsp + 0x18]
add rax, qword [rcx + 0x128]
nop dword [rax]
cmp qword [rcx + 0x130], rax
jb 0x4558f6
add rsp, 0x28
pop rbp
ret
add rsp, 0x28
pop rbp
ret
nop
nop
nop
lea rax, [0x008a7200]
call fcn.0040b500
mov rbx, qword [0x008a7210]
lea rax, [0x0067d5a0]
mov ecx, dword [rsp + 0x40]
call fcn.00410300
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
nop
nop
nop
lea rax, [0x008a7200]
call fcn.0040b760
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
test rax, rax
jne 0x4558ce
lea rax, [0x00874ea0]
jmp 0x4558e0
add rsp, 0x28
pop rbp
ret
mov rax, qword [rax + 0x248]
nop dword [rax + rax]
test rax, rax
jne 0x4558d4
lea rax, [0x006d421b]
mov ebx, 0x2e
call fcn.004341e0
lea rax, [0x006cf5f9]
mov ebx, 0x21
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop
jmp fcn.004557c0

Function at 0x455940
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455a26
push rbp
mov rbp, rsp
sub rsp, 0x20
cmp ebx, 0xffffffff
je 0x455962
lea rcx, [0x00874ea0]
nop
jmp 0x455976
lea rax, [0x0040b340]
add rsp, 0x20
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x455994
nop dword [rax + rax]
cmp qword [rcx + 0x128], rax
ja 0x45596f
cmp qword [rcx + 0x130], rax
jbe 0x45596f
jmp 0x455996
xor ecx, ecx
test rcx, rcx
jne 0x4559f5
mov dword [rsp + 0x38], ebx
nop
nop
nop
lea rax, [0x008a7200]
call fcn.0040b500
mov rbx, qword [0x008a7210]
lea rax, [0x0067d5a0]
mov ecx, dword [rsp + 0x38]
call fcn.00410300
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
nop
nop
nop
lea rax, [0x008a7200]
call fcn.0040b760
mov rax, qword [rsp + 0x18]
test rax, rax
jne 0x4559ef
lea rax, [0x00874ea0]
jmp 0x455a0a
add rsp, 0x20
pop rbp
ret
mov rax, rcx
call fcn.0044ce20
add rsp, 0x20
pop rbp
ret
mov rax, qword [rax + 0x248]
test rax, rax
jne 0x455a03
lea rax, [0x006d4249]
mov ebx, 0x2e
nop dword [rax + rax]
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.00455940
Function at 0x459520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459711
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax + 0x30]
cmp qword [rdx + 0x18], 0
nop dword [rax + rax]
je 0x4596ff
mov rsi, qword [rdx]
cmp rsi, 0x80
jbe 0x459572
mov edi, dword [rax + 0x54]
bt edi, 0
jae 0x4596ee
cmp byte [rax + 0x50], 8
jne 0x4596ee
cmp rsi, 0x80
ja 0x45958a
mov edi, dword [rax + 0x54]
bt edi, 0
jb 0x4596ee
nop
cmp byte [rax + 0x50], sil
jne 0x4596ee
mov rdi, qword [rax + 0x38]
mov r8, qword [rdi]
cmp r8, 0x80
jbe 0x4595bc
mov r9d, dword [rax + 0x54]
bt r9d, 1
jae 0x4596dd
cmp byte [rax + 0x51], 8
jne 0x4596dd
cmp r8, 0x80
ja 0x4595d5
mov r9d, dword [rax + 0x54]
bt r9d, 1
jb 0x4596dd
cmp byte [rax + 0x51], r8b
jne 0x4596dd
movzx edx, byte [rdx + 0x15]
nop dword [rax]
cmp dl, 8
ja 0x4596cc
movzx edi, byte [rdi + 0x15]
cmp dil, 8
ja 0x4596bb
nop word [rax + rax]
test rdx, rdx
je 0x4596b6
mov rcx, rax
mov rax, rsi
mov r9d, edx
xor edx, edx
div r9
nop word [rax + rax]
test rdx, rdx
jne 0x4596a5
test rdi, rdi
je 0x4596a0
mov rax, r8
xor edx, edx
div rdi
test rdx, rdx
jne 0x45968d
mov eax, 8
xor edx, edx
div r9
test rdx, rdx
jne 0x45967c
mov eax, 8
xor edx, edx
div rdi
test rdx, rdx
jne 0x45966b
mov rax, rcx
xor ecx, ecx
nop
call fcn.0040df40
add rsp, 0x18
pop rbp
ret
lea rax, [0x006cd72c]
mov ebx, 0x1d
call fcn.004341e0
lea rax, [0x006ccf23]
mov ebx, 0x1c
call fcn.004341e0
lea rax, [0x006d155d]
mov ebx, 0x26
call fcn.004341e0
nop
call fcn.00432ee0
lea rax, [0x006d075e]
mov ebx, 0x24
call fcn.004341e0
call fcn.00432ee0
lea rax, [0x006c8416]
mov ebx, 0x12
call fcn.004341e0
lea rax, [0x006c7dfa]
mov ebx, 0x11
call fcn.004341e0
lea rax, [0x006c7289]
mov ebx, 0xf
call fcn.004341e0
lea rax, [0x006c6dc4]
mov ebx, 0xe
call fcn.004341e0
lea rax, [0x006d4eef]
mov ebx, 0x31
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00459520
Function at 0x459ca0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459ddf
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
nop
xor edi, edi
mov esi, 0x12
lea rax, [0x008711d8]
mov ebx, 1
xor ecx, ecx
call fcn.00445b00
nop dword [rax]
call fcn.00416aa0
mov rbx, qword [0x008a6668]
lea rax, [0x0067d6c0]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
nop dword [rax]
call fcn.00412560
mov rdx, qword [rax]
test bl, bl
je 0x459dbc
mov qword [rsp + 0x28], rdx
lea rax, [0x0068bba0]
nop dword [rax]
call fcn.0040d480
lea rcx, [0x00464600]
mov qword [rax], rcx
cmp dword [0x0092d940], 0
jne 0x459d40
mov rdx, qword [rsp + 0x58]
jmp 0x459d4d
call fcn.0045fe20
mov rdx, qword [rsp + 0x58]
mov qword [r11], rdx
mov qword [rsp + 0x30], rax
mov qword [rax + 8], rdx
mov rbx, qword [0x008a6668]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
lea rax, [0x0067d6c0]
call fcn.00412940
mov rdx, qword [rsp + 0x28]
mov qword [rax], rdx
cmp dword [0x0092d940], 0
jne 0x459d8b
mov rdx, qword [rsp + 0x30]
jmp 0x459da0
call fcn.0045fe40
mov rdx, qword [rsp + 0x30]
mov qword [r11], rdx
mov rsi, qword [rax + 8]
mov qword [r11 + 8], rsi
mov qword [rax + 8], rdx
nop
nop
lea rax, [0x008711d8]
xor ebx, ebx
xor ecx, ecx
call fcn.00445e60
add rsp, 0x38
pop rbp
ret
xor eax, eax
lea rbx, [0x006d3785]
mov ecx, 0x2c
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
call fcn.0044abe0
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00459ca0

Function at 0x45a120
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a19f
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [rax + 0x38], 0
je 0x45a18d
nop
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x45a146
nop
cmp rcx, 1
jne 0x45a17c
nop
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x45a156
cmp rcx, 1
jne 0x45a16b
mov rbx, rax
lea rax, [0x0092d950]
call fcn.0042eca0
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d2886]
mov ebx, 0x29
call fcn.004341e0
lea rax, [0x006d2d16]
mov ebx, 0x2a
call fcn.004341e0
lea rax, [0x006d01b0]
mov ebx, 0x23
call fcn.004341e0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.0045a120
Function at 0x45ad20
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x70]
nop word [rax + rax]
cmp qword [r14 + 0x70], rcx
jb 0x45af86
mov qword [rsp + 0x20], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rcx + 0xb0], 0
call fcn.0043e4e0
nop word [rax + rax]
test al, al
je 0x45af43
cmp byte [0x008a1284], 0
je 0x45adcd
movups xmmword [rsp + 0x50], xmm15
lea rax, [0x0043e4a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
mov qword [rsp], rcx
call fcn.0045dde0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [0x0092d490]
test rdx, rdx
jne 0x45ade0
xor ebx, ebx
xor eax, eax
jmp 0x45ade5
call fcn.004520a0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rax
test rbx, rbx
je 0x45ae6f
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x28]
cmp rsi, rdi
je 0x45ae15
mov edx, 1
jmp 0x45ae21
mov edx, dword [rdx + 0x388]
cmp dword [rsi + 0x14], edx
setne dl
movups xmmword [rsp + 0x30], xmm15
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x48], 0
lea rcx, [0x0043e440]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x48], dl
lea rcx, [rsp + 0x30]
mov qword [rsp], rcx
call fcn.0045dde0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
call fcn.00437960
mov rdx, qword [rsp + 0x10]
test rdx, rdx
je 0x45aed7
nop
mov ecx, 1
mov rdx, qword [rsp + 0x18]
lock xadd qword [rdx + 0x398], rcx
mov ecx, dword [rdx + 0xd8]
lea esi, [rcx - 1]
nop
mov dword [rdx + 0xd8], esi
nop
cmp ecx, 1
jne 0x45aed7
cmp byte [r14 + 0xb1], 0
je 0x45aed7
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], 0
mov rcx, qword [rax + 0x30]
dec dword [rcx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x45af02
mov qword [rax + 0x10], 0xfffffffffffffade
nop
jmp 0x45af10
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x008a9b00], 0
nop
je 0x45af3d
mov ebx, 1
call fcn.00455300
test al, al
jne 0x45af3d
nop
lea rax, [0x006f4bf0]
call fcn.0045dd60
add rsp, 0x60
pop rbp
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x006f4b68]
call fcn.0045dd60
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
add rsp, 0x60
pop rbp
ret
lea rax, [0x006d3c36]
mov ebx, 0x2d
call fcn.004341e0
nop
int3
Function at 0x45cba0
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
movq qword [rsp + 0x60], xmm15
mov byte [rsp + 0x1f], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
cmp rcx, 4
jge 0x45cc2b
lea rdx, [rsp + 0x20]
cmp rbx, rdx
je 0x45cc1f
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
mov rsi, rcx
shl rsi, 3
mov rax, rdx
mov rcx, rsi
call fcn.00460ba0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov edx, 4
lea rbx, [rsp + 0x20]
jmp 0x45cc38
cmp rcx, 0x2a
jg 0x45ccf9
mov rdx, rcx
mov rsi, qword [r14 + 0x30]
nop
inc dword [rsi + 0x234]
mov rsi, qword [r14 + 0x30]
mov rdi, r14
nop
mov qword [rsi + 0x128], rdi
mov rsi, qword [r14 + 0x30]
mov qword [r14 + 0xd0], rsi
lea rsi, fcn.0043fa60
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x1f], 1
mov rsi, qword [r14 + 0x30]
mov qword [rsi + 0x400], rax
mov qword [rsi + 0x408], rcx
test rdx, rdx
jbe 0x45ccef
mov qword [rsp + 0x58], rsi
lea rcx, [rsi + 0x400]
mov qword [rsi + 0x410], rbx
mov rax, qword [0x008a66d8]
mov rbx, rcx
call fcn.00405740
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x418]
mov rsi, qword [rcx + 0x420]
mov rcx, qword [rcx + 0x428]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x1f], 0
call fcn.0043fa60
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rsp, 0x68
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.004601e0
lea rax, [0x0066d140]
lea rbx, [0x00740c90]
call fcn.004337c0
nop
call fcn.00433720
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
add rsp, 0x68
pop rbp
ret
Function at 0x45fd00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404623
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409460
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x404600
cmp byte [0x0092d4d8], 0
je 0x45fd15
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45cf40
jmp 0x404600

Function at 0x45fd20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0092da20]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0092d4d8], 0
je 0x45fd55
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0092dda0]
aesenc xmm0, xmmword [0x0092ddb0]
aesenc xmm0, xmmword [0x0092ddc0]
movq rax, xmm0
ret
jmp 0x409680

Function at 0x45fd60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0092da20]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0092d4d8], 0
je 0x45fd96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0092dda0]
aesenc xmm0, xmmword [0x0092ddb0]
aesenc xmm0, xmmword [0x0092ddc0]
movq rax, xmm0
ret
jmp 0x4096e0

Function at 0x460340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x432e5d
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov ecx, 0x3e
mov rax, qword [rsp + 0x38]
lea rbx, [0x006d71f0]
call fcn.004325e0
movups xmmword [rsp + 0x18], xmm15
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], 0
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x18], rdx
mov byte [rsp + 0x28], 1
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov byte [rsp + 0x29], 8
lea rax, [0x006a9fe0]
lea rbx, [rsp + 0x18]
call fcn.0040a760
mov rbx, rax
lea rax, [0x006a9fe0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x432de0
mov rax, rdx
jmp 0x432de0

Function at 0x461b60
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x461b94
mov rcx, 0x28
jmp 0x461b9f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0092d718], rcx
pop rbp
ret
Function at 0x464960
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x436eeb
push rbp
mov rbp, rsp
sub rsp, 0x28
nop
mov qword [0x0092dbd0], 0xf
nop
mov qword [0x0092dc10], 0x10
mov qword [rsp + 0x20], r14
mov dword [0x008a9ab8], 0x2710
lea rax, [0x0092daa0]
call fcn.00443280
lea rax, [0x00874ea0]
jmp 0x436c84
mov qword [rsp + 0x18], rax
call fcn.0044caa0
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx + 0x248]
test rax, rax
jne 0x436c6e
xor eax, eax
jmp 0x436caa
mov rcx, rax
shl rcx, 6
lea rdx, [0x0092de20]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 8]
inc rax
movups xmmword [rcx], xmm15
cmp rax, 2
jl 0x436c8d
xor eax, eax
jmp 0x436ccc
mov rcx, rax
shl rcx, 4
lea rdx, [0x0092ea88]
add rcx, rdx
inc rax
movups xmmword [rcx], xmm15
cmp rax, 0x23
jl 0x436cb4
call fcn.0040be20
nop
xor eax, eax
xor ebx, ebx
nop dword [rax]
call fcn.00401bc0
movzx eax, byte [0x0092df8d]
mov byte [0x0092d4db], al
movzx eax, byte [0x0092df92]
mov byte [0x0092d4dc], al
movzx eax, byte [0x0092df8a]
mov byte [0x0092d4dd], al
call fcn.00442d80
call fcn.00405340
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rcx
call fcn.00436fc0
call fcn.0044c880
call fcn.00455ba0
call fcn.0040a400
nop dword [rax]
call fcn.0044a8a0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x30]
test byte [rax], al
call fcn.00430820
nop
mov dword [0x0092dd20], 1
mov dword [0x0092dd48], 1
mov dword [0x0092dd6c], 1
mov dword [0x0092dd74], 0x3b9aca00
nop
call fcn.004194c0
mov eax, 0x4000
call fcn.00448980
mov qword [0x008a7c40], rax
mov qword [0x008a7c48], rbx
add rax, 0x3e8
mov qword [0x008a7c50], rax
mov qword [0x008a7c58], rax
cmp byte [0x008992e0], 0
je 0x436dc5
mov qword [0x00871270], 0
nop
nop
lea rax, [0x008a9a98]
call fcn.0040b500
nop
call fcn.00461b20
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp]
nop
lea rdx, [0x008a9a88]
xchg qword [rdx], rcx
mov ecx, dword [0x0092d544]
mov dword [rsp + 0x14], ecx
lea rax, [0x006c5b75]
mov ebx, 0xa
call fcn.004081a0
call fcn.0044b9a0
movsxd rcx, eax
cmp rax, rcx
sete cl
mov edx, 0
cmove edx, eax
and ecx, ebx
test cl, cl
je 0x436e35
test edx, edx
jg 0x436e39
mov edx, dword [rsp + 0x14]
mov eax, edx
nop dword [rax + rax]
call fcn.00440160
test rax, rax
jne 0x436ed9
nop
nop
lea rax, [0x008a9a98]
call fcn.0040b760
cmp qword [0x0089a208], 0
jne 0x436e97
mov qword [0x0089a208], 7
cmp dword [0x0092d940], 0
je 0x436e89
mov rax, qword [str.unknown]
call fcn.0045fe20
mov qword [r11], rax
lea rax, [0x006c534b]
mov qword [str.unknown], rax
cmp qword [0x008a6ac8], 1
nop
jne 0x436ed3
mov qword [0x008a6ac8], 0
cmp dword [0x0092d940], 0
je 0x436ec8
mov rax, qword [0x008a6ac0]
nop dword [rax]
call fcn.0045fe20
mov qword [r11], rax
mov qword [0x008a6ac0], 0
add rsp, 0x28
pop rbp
ret
lea rax, [0x006d3397]
mov ebx, 0x2b
call fcn.004341e0
nop
call fcn.0045df00
jmp 0x436c20
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x436c20