joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420b80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x420c20
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x00835c90]
mov qword [rsp], rax
call fcn.0040eda0
mov rax, qword [0x00835c40]
test rax, rax
jne 0x420c05
mov qword [0x00835c48], 0
lea rax, [0x00835c98]
mov qword [rsp], rax
lea rax, [0x00835ca8]
mov qword [rsp + 8], rax
call fcn.00423490
lea rax, [0x00835c90]
mov qword [rsp], rax
call fcn.0040ef90
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006b6ac0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00420b80
Function at 0x4221e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x422440
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x60]
add rax, 7
and rax, 0xfffffffffffffff8
shl rax, 0xd
mov qword [rsp + 0x38], rax
cmp rax, 0x100000
jae 0x422431
mov ecx, 0x100000
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0040fb60
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x422362
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x58]
test byte [rdx], al
lea rbx, [rdx + 0x34d0]
mov qword [rsp], rbx
call fcn.00416660
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
shr rcx, 0xd
mov qword [rax + 0x20], rcx
mov dword [rax + 0x60], 0
mov qword [rax + 0x68], 0
mov byte [rax + 0x64], 0
movups xmmword [rax + 0x70], xmm0
movups xmmword [rax + 0x88], xmm0
mov byte [rax + 0x65], 0
mov qword [rax + 0x30], 0
movups xmmword [rax + 0x48], xmm0
mov rcx, qword [rax + 0x18]
mov rdx, qword [rsp + 0x58]
sub rcx, qword [rdx + 0x1328]
shr rcx, 0xd
mov rbx, rcx
jmp 0x4222f2
mov qword [rdi + rcx*8], rax
inc rcx
mov rsi, qword [rax + 0x20]
add rsi, rbx
cmp rcx, rsi
jae 0x422316
mov rsi, qword [rdx + 0x1050]
mov rdi, qword [rdx + 0x1048]
cmp rcx, rsi
jb 0x4222eb
jmp 0x422439
mov ecx, dword [rdx + 0x1020]
xchg dword [rax + 0x58], ecx
mov byte [rax + 0x64], 1
mov rcx, qword [rdx + 0x10b8]
add rcx, qword [rax + 0x20]
mov qword [rdx + 0x10b8], rcx
mov qword [rsp], rdx
mov qword [rsp + 8], rax
mov word [rsp + 0x10], 0x100
mov qword [rsp + 0x18], 0
call fcn.00422580
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
cmp rcx, rdx
ja 0x42240f
test rax, rax
jne 0x42225a
mov qword [rsp + 0x30], rcx
mov rax, qword [0x008528f8]
mov qword [rsp + 0x28], rax
call fcn.0042bc80
lea rax, [0x006b6d18]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042c640
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006ad177]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042c640
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006ac10a]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c640
call fcn.0042bd10
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
call fcn.0040fb60
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x38]
jmp 0x422375
mov rcx, rax
jmp 0x42222f
call fcn.00429b50
ud2
call fcn.00452950
jmp fcn.004221e0
Function at 0x4230a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42322f
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rsp + 0x38]
cmp rcx, rdx
jne 0x42312b
mov rcx, qword [rdx]
cmp rcx, rax
jne 0x42311f
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rcx, qword [rdx + 8]
cmp rax, rcx
jne 0x423112
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rcx + 8], rdx
jmp 0x4230fa
mov rcx, qword [rax + 8]
mov rbx, qword [rax]
mov qword [rcx], rbx
jmp 0x4230e9
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x18], rdx
call fcn.0042bc80
lea rax, [0x006b7ffc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2d
call fcn.0042c640
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006ab72a]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042c640
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c5f0
lea rax, [0x006ab724]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042c640
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c5f0
lea rax, [0x006ac879]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042c640
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042c5f0
lea rax, [0x006ab712]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042c640
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042c5f0
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006ae05b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.004230a0
Function at 0x423240
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x423356
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x4232ba
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x4232ba
mov rdx, qword [rax + 0x10]
test rdx, rdx
jne 0x4232ba
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rdx, qword [rcx]
test rdx, rdx
je 0x4232b4
mov qword [rdx + 8], rax
mov qword [rcx], rax
mov qword [rax + 0x10], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rcx + 8], rax
jmp 0x4232a3
mov rcx, qword [rax + 8]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x10], rdx
call fcn.0042bc80
lea rax, [0x006b4e3a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042c640
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c5f0
call fcn.0042bee0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042c5f0
call fcn.0042bee0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c5f0
call fcn.0042bee0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c5f0
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006ae04b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00423240

Function at 0x423360
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x423478
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x4233dc
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x4233dc
mov rdx, qword [rax + 0x10]
test rdx, rdx
jne 0x4233dc
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x4233d7
mov qword [rdx], rax
mov qword [rcx + 8], rax
mov qword [rax + 0x10], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rcx], rax
jmp 0x4233c5
mov rcx, qword [rax + 8]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x10], rdx
call fcn.0042bc80
lea rax, [0x006b60fa]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0042c640
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c5f0
call fcn.0042bee0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042c5f0
call fcn.0042bee0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c5f0
call fcn.0042bee0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c5f0
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006af9fc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00423360
Function at 0x4234f0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42372e
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rcx, rax
mov rdx, qword [0x0083a728]
cmp rax, rdx
jae 0x4236ac
xor eax, eax
test rax, rax
je 0x42370c
mov qword [rsp + 0x20], rax
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xd0]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp], rax
call fcn.0041edf0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
lea rdx, [rcx + 0x18]
sub rax, qword [rdx]
mov qword [rsp + 0x18], rax
mov rdx, qword [rsp + 0x50]
movzx ebx, byte [rdx + 0xa]
mov byte [rsp + 0x17], bl
lea rsi, [rcx + 0x88]
mov qword [rsp + 0x30], rsi
mov qword [rsp], rsi
call fcn.0040eda0
mov rax, qword [rsp + 0x20]
add rax, 0x90
movzx ecx, byte [rsp + 0x17]
mov rdx, qword [rsp + 0x18]
jmp 0x4235be
mov rax, rbx
mov rbx, qword [rax]
test rbx, rbx
je 0x4235e8
movzx esi, word [rbx + 8]
cmp rdx, rsi
jne 0x4235db
movzx edi, byte [rbx + 0xa]
cmp cl, dil
je 0x423653
cmp rdx, rsi
jb 0x4235e8
jne 0x4235bb
movzx esi, byte [rbx + 0xa]
cmp cl, sil
jae 0x4235bb
mov rcx, qword [rsp + 0x50]
mov word [rcx + 8], dx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0040ef90
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd0]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd0], ebx
cmp edx, 1
jne 0x423644
movzx ecx, byte [rax + 0xc0]
test cl, cl
je 0x423644
mov qword [rax + 0x10], 0xfffffffffffffade
mov byte [rsp + 0x58], 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0040ef90
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd0]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd0], ebx
cmp edx, 1
jne 0x42369d
movzx ecx, byte [rax + 0xc0]
test cl, cl
je 0x42369d
mov qword [rax + 0x10], 0xfffffffffffffade
mov byte [rsp + 0x58], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbx, qword [0x0083a730]
cmp rax, rbx
jae 0x423530
mov rbx, qword [0x0083a450]
mov rsi, qword [0x0083a448]
mov rdi, rax
sub rax, rdx
shr rax, 0xd
cmp rax, rbx
jae 0x423727
mov rax, qword [rsi + rax*8]
test rax, rax
je 0x4236eb
mov rdx, qword [rax + 0x18]
cmp rdi, rdx
jae 0x4236f2
xor eax, eax
jmp 0x423532
mov rdx, qword [rax + 0x80]
cmp rdi, rdx
jae 0x4236eb
movzx edx, byte [rax + 0x64]
cmp dl, 1
jne 0x4236eb
jmp 0x423532
lea rax, [0x006b331d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042b3a0
ud2
call fcn.00429b50
ud2
call fcn.00452950
jmp fcn.004234f0
Function at 0x423cc0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x423d75
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x0083ca38]
mov qword [rsp], rax
call fcn.0040eda0
lea rax, [0x0083c9f0]
mov qword [rsp], rax
call fcn.00416660
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
lea rcx, [0x0083ca38]
mov qword [rsp], rcx
call fcn.0040ef90
mov rax, qword [rsp + 0x18]
mov byte [rax + 0xa], 2
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.004234f0
movzx eax, byte [rsp + 0x10]
test al, al
je 0x423d5a
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006b611f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00423cc0

Function at 0x424310
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4243f3
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [0x00835268]
test rax, rax
je 0x424389
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 8]
mov qword [0x00835268], rcx
mov qword [rsp], rax
mov qword [rsp + 8], 0x10000
call fcn.00455980
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov qword [rax], 0
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00835260]
mov qword [rsp], rax
call fcn.0040ef90
mov qword [rsp], 0x10000
lea rax, [0x00852958]
mov qword [rsp + 8], rax
call fcn.00414e20
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x4243d8
mov qword [rsp + 0x18], rax
lea rax, [0x00835260]
mov qword [rsp], rax
call fcn.0040eda0
mov rax, qword [rsp + 0x18]
jmp 0x42436b
lea rax, [0x006b42e3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00424310
Function at 0x425690
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, 0xfffffffffffffade
je 0x42575a
lea rax, [rsp + 0x370]
sub rax, rsi
cmp rax, 0x1998
jbe 0x42575a
sub rsp, 0x16a8
mov qword [rsp + 0x16a0], rbp
lea rbp, [rsp + 0x16a0]
lea rdi, [rsp + 0x10]
mov ecx, 0x2d2
xor eax, eax
rep stosq qword [rdi], rax
mov rdx, qword [0x007f7280]
cmp rdx, 0x1690
jne 0x42570e
mov rbp, qword [rsp + 0x16a0]
add rsp, 0x16a8
ret
call fcn.0042bc80
mov rax, qword [0x007f7280]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bee0
mov qword [rsp], 0x1690
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006b5ab7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00425690

Function at 0x425a20
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
mov rcx, rax
neg rax
mov rdx, qword [rsp + 0x28]
lock xadd qword [rdx], rax
sub rax, rcx
lea rdx, [rax + rcx]
cmp rdx, rcx
jb 0x425a59
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rax
call fcn.0042bc80
lea rax, [0x006b36a0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042c640
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006ab2c8]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042c640
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
mov dword [rsp], 2
call fcn.00428b40
jmp 0x425a4f

Function at 0x425ad0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x425b60
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 0x10]
mov qword [rax], rcx
movzx edx, byte [0x00850a5c]
test dl, dl
je 0x425b2d
lea rcx, [rax + 0x20]
mov qword [rax + 8], rcx
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
test rcx, 0xf
jne 0x425b45
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, byte [0x00850df5]
test dl, dl
jne 0x425b0b
add rcx, 0x1000
mov qword [rax + 8], rcx
jmp 0x425b13
lea rax, [0x006b3fbd]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00425ad0
Function at 0x425f70
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x426092
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
lea rax, [0x00834b90]
mov qword [rsp], rax
call fcn.004271e0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
test byte [rax], al
lea rcx, [rax + 8]
mov qword [rsp + 0x20], rcx
mov qword [rsp], rcx
call fcn.0040eda0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x78]
test rcx, rcx
je 0x425fde
cmp rcx, 1
jne 0x426077
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x425fed
cmp rcx, 1
jne 0x42605c
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], 0
inc qword [rax + 0x20]
mov qword [rax + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0xc0], 0
mov rdx, qword [rsp + 0x20]
mov qword [rsp], rdx
call fcn.0040ef90
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 8], rax
call fcn.004273b0
movsxd rax, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006b6412]
mov qword [rsp], rax
mov qword [rsp + 8], 0x26
call fcn.0042b3a0
ud2
lea rax, [0x006b67d4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00425f70

Function at 0x4260a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x426163
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x18]
test cl, cl
je 0x426148
mov rcx, qword [rax + 0x78]
test rcx, rcx
je 0x4260e4
cmp rcx, 1
jne 0x42612d
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x4260f3
cmp rcx, 1
jne 0x426112
lea rcx, [0x00834b90]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00426170
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006b710f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0042b3a0
ud2
lea rax, [0x006b756e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
call fcn.0042b3a0
ud2
lea rax, [0x006b585b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.004260a0
Function at 0x426850
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x426a3c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
test byte [rax], al
lea rcx, [rax + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp], rcx
call fcn.0040eda0
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x18]
test cl, cl
jne 0x426a21
mov byte [rax + 0x18], 1
inc qword [rax + 0x20]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
call fcn.004021e0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
mov dword [rsp + 8], 0x72
mov byte [rsp + 0xc], 0
call fcn.00426d80
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
mov dword [rsp + 8], 0x77
mov byte [rsp + 0xc], 0
call fcn.00426d80
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx + 0x50]
lea rbx, [rcx + 0x50]
test rdx, rdx
jne 0x4269d6
mov rdx, qword [rcx + 0xa0]
lea rbx, [rcx + 0xa0]
test rdx, rdx
jne 0x426991
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0040ef90
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x42697d
mov rax, qword [rsp + 0x18]
test rax, rax
jne 0x426969
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.00426bb0
jmp 0x42695f
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.00426bb0
jmp 0x426955
mov qword [rsp + 0x28], rbx
lea rax, [rcx + 0x80]
mov qword [rsp], rax
call fcn.00446930
mov eax, dword [0x00850df0]
test eax, eax
jne 0x4269c5
mov rax, qword [rsp + 0x48]
mov qword [rax + 0xa0], 0
jmp 0x42693d
mov rdi, qword [rsp + 0x28]
xor eax, eax
call fcn.004553b0
jmp 0x42693d
mov qword [rsp + 0x28], rbx
lea rax, [rcx + 0x30]
mov qword [rsp], rax
call fcn.00446930
mov eax, dword [0x00850df0]
test eax, eax
jne 0x426a0e
mov rax, qword [rsp + 0x48]
mov qword [rax + 0x50], 0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x48]
jmp 0x42692a
mov rdi, qword [rsp + 0x28]
xor eax, eax
call fcn.004553b0
mov rax, qword [rsp + 0x48]
jmp 0x4269ff
lea rax, [0x006b5d63]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00426850
Function at 0x427930
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x427a3b
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x4279fd
mov ecx, dword [rax + 0x28]
cmp ecx, 0x72
je 0x427973
cmp ecx, 0x77
jne 0x4279a6
mov edx, dword [rsp + 0x40]
mov dword [rax + 0x2c], edx
mov edx, dword [rsp + 0x44]
mov dword [rax + 0x30], edx
mov rax, qword [rax + 0x20]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 0x10], ecx
call fcn.00426a50
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], ecx
call fcn.0042bc80
lea rax, [0x006ba5c0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x3a
call fcn.0042c640
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042c460
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006b1103]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042b3a0
ud2
call fcn.0042bc80
lea rax, [0x006b9ca5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0042c640
call fcn.0042bd10
lea rax, [0x006b1103]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00427930
Function at 0x4285b0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x28]
cmp rax, qword [rcx + 0x10]
jbe 0x428897
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
lea rax, [rsp + 0x80]
mov qword [rsp], rax
lea rax, [0x006b1363]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x18
call fcn.00441fb0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0xb0]
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.00427a50
mov eax, dword [0x00850df0]
mov rcx, qword [rsp + 0x20]
test eax, eax
jne 0x428817
mov qword [0x00833af8], rcx
test rcx, rcx
je 0x42887c
lea rax, [rsp + 0x60]
mov qword [rsp], rax
lea rax, [0x006b13f3]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x18
call fcn.00441fb0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0xb0]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
call fcn.00427a50
mov eax, dword [0x00850df0]
mov rcx, qword [rsp + 0x20]
test eax, eax
jne 0x428803
mov qword [0x00833b10], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
lea rax, [0x006b20a0]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x1a
call fcn.00441fb0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0xb0]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
call fcn.00427a50
mov eax, dword [0x00850df0]
mov rcx, qword [rsp + 0x20]
test eax, eax
jne 0x4287ef
mov qword [0x00833b18], rcx
mov rax, qword [0x00833b10]
test rax, rax
je 0x428861
test rcx, rcx
je 0x428861
mov qword [rsp + 0x30], 0
mov rax, qword [0x00833b18]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.00429600
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x428846
cmp rax, 0x7fffffff
jg 0x42882b
mov qword [rsp + 0x38], rax
mov rax, qword [0x00833b10]
mov qword [rsp], rax
lea rax, [0x00850c28]
mov qword [rsp + 8], rax
call fcn.00429600
mov qword [rsp], 0x3b9aca00
mov rax, qword [rsp + 0x38]
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], 0
call fcn.00439690
movsxd rax, dword [rsp + 0x18]
mov qword [0x00850c20], rax
mov byte [0x00850a75], 1
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
lea rdi, [0x00833b18]
mov rax, rcx
call fcn.004553b0
jmp 0x428736
lea rdi, [0x00833b10]
mov rax, rcx
call fcn.004553b0
jmp 0x4286ca
lea rdi, [0x00833af8]
mov rax, rcx
call fcn.004553b0
jmp 0x428655
lea rax, [0x006bb92f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x56
call fcn.0042b3a0
ud2
lea rax, [0x006bb64b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x50
call fcn.0042b3a0
ud2
lea rax, [0x006b2781]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1b
call fcn.0042b3a0
ud2
lea rax, [0x006b8852]
mov qword [rsp], rax
mov qword [rsp + 8], 0x30
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.004285b0