joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180024510
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x298
mov rax, qword [0x18004b0d0]
xor rax, rsp
mov qword [rsp + 0x280], rax
cmp qword [rsp + 0x2b0], 0
je 0x180024563
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180024563
xor edx, edx
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rax, qword [rsp + 0x2b8]
movsx eax, byte [rax]
test eax, eax
jne 0x180024577
jmp 0x180024743
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
movsx eax, byte [rax]
test eax, eax
je 0x1800245e3
mov rax, qword [rsp + 0x148]
movsx eax, byte [rax]
cmp eax, 0x2f
je 0x1800245c0
mov rax, qword [rsp + 0x148]
movsx eax, byte [rax]
cmp eax, 0x5c
jne 0x1800245cd
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x148]
add rax, 1
mov qword [rsp + 0x148], rax
jmp 0x180024591
mov rax, qword [rsp + 0x20]
mov qword [rsp + reloc.mfc90.dll_Ordinal_320], rax
mov rax, qword [rsp + 0x2b8]
cmp qword [rsp + 0x20], rax
je 0x180024662
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
lea rdi, [rsp + 0x150]
mov rsi, qword [rsp + 0x2b8]
rep movsb byte [rdi], byte [rsi]
mov rdx, qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x20]
sub rax, rdx
mov byte [rsp + rax + 0x150], 0
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x2b0]
call fcn.180024510
mov rax, qword [rsp + reloc.mfc90.dll_Ordinal_320]
add rax, 1
mov qword [rsp + reloc.mfc90.dll_Ordinal_320], rax
mov byte [rsp + 0x30], 0
cmp qword [rsp + 0x2b0], 0
je 0x1800246f9
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x260]
movzx eax, byte [rax]
mov byte [rsp + 0x278], al
mov rcx, qword [rsp + 0x268]
movzx eax, byte [rsp + 0x278]
mov byte [rcx], al
mov rax, qword [rsp + 0x260]
add rax, 1
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x268]
add rax, 1
mov qword [rsp + 0x268], rax
cmp byte [rsp + 0x278], 0
jne 0x1800246a3
lea rdi, [rsp + 0x30]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
mov rdx, qword [rsp + 0x2b8]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, 1
test al, al
jne 0x180024717
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180024743
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180032590
add rsp, 0x298
pop rdi
pop rsi
ret
Function at 0x180032ce3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18004b0d0]
jne 0x1800325aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1800325a6
repz ret
ror rcx, 0x10
jmp 0x180032c3c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18004b780]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18004b878]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180032cc1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18004b780]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180032ce3
mov rax, qword [rsp + 0x88]
mov qword [0x18004b878], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18004b818], rax
mov rax, qword [0x18004b878]
mov qword [0x18004b6f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18004b800], rax
mov dword [0x18004b6e0], 0xc0000409
mov dword [0x18004b6e4], 1
mov rax, qword [0x18004b0d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18004b0d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18004b778], eax
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180038cf8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18004b778], 0
jne 0x180032d6a
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
invalid
Function at 0x18005b790
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x18005b7bd
xor al, al
jmp 0x18005b91f
mov rax, qword [0x18007b670]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x18007b678]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x18007b680]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x18007b688]
mov qword [rcx + 0x18], rax
mov rax, qword [0x18007b690]
mov qword [rcx + 0x20], rax
mov rax, qword [0x18007b698]
mov qword [rcx + 0x28], rax
mov rax, qword [0x18007b6a0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x18007b6a8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x18007b6b0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x18005b911
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x18005b869
mov r11d, 2
jmp 0x18005b88d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x18005b883
mov r11d, 1
jmp 0x18005b88d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x18005b935
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x18005b8d2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x18005b8ea
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x18005b8fa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x18005b908
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x18005b850
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x18005b91a
Function at 0x404160
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4042f0
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
cmp byte [rax + 0x65], 0
nop dword [rax]
je 0x4042de
mov rcx, qword [rax + 0x20]
shl rcx, 0xd
cmp rcx, 0x400000
jne 0x4042cd
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x1f], 1
movzx ecx, byte [rsp + 0x1f]
mov byte [rax + 0x62], cl
mov rcx, qword [rax + 0x18]
mov rbx, qword [rax + 0x20]
shl rbx, 0xd
mov rdx, rbx
neg rbx
lea rsi, [0x01329320]
lock xadd qword [rsi], rbx
nop
mov rbx, rdx
mov rax, rcx
call fcn.00417560
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
neg rbx
lea rax, [0x013292f8]
call fcn.0042fa20
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
lea rsi, [0x01329318]
lock xadd qword [rsi], rdx
lea rax, [0x0132cbe0]
call fcn.0042fae0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
neg rdx
lock xadd qword [rax], rdx
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
neg rdx
lock xadd qword [rax + 0x10], rdx
mov edx, 1
lock xadd qword [rax + 0x270], rdx
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
lock xadd qword [rax + 0x268], rdx
lea rax, [0x0132cbe0]
call fcn.0042fbc0
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
neg rbx
lea rax, [0x01329200]
xor ecx, ecx
call fcn.00420d40
movups xmmword [rsp + 0x20], xmm15
lea rcx, [0x00404320]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00463280
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006daf04]
mov ebx, 0x2c
call fcn.00436b60
lea rax, [0x006d9a2c]
mov ebx, 0x28
call fcn.00436b60
nop
mov qword [rsp + 8], rax
call fcn.004633c0
mov rax, qword [rsp + 8]
nop
jmp fcn.00404160
Function at 0x405060
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rdx, qword [rax + 8]
cmp rcx, rdx
jae 0x4050c1
sub rdx, rcx
cmp rdi, rdx
cmova rdi, rdx
movzx edx, byte [rax + 0x17]
test dl, 0x40
je 0x4050a8
mov rdx, qword [0x012d21e0]
test rdx, rdx
je 0x40509f
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
jmp 0x4050a3
xor edx, edx
xor esi, esi
xor r8d, r8d
jmp 0x4050d1
mov rdx, qword [rax + 0x20]
mov rax, rbx
mov rbx, rdx
call fcn.004052e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
inc r8
mov rbx, r12
cmp rdx, r8
jle 0x405165
mov r9, qword [rsi + r8*8]
mov r10, qword [r9 + 0xd0]
mov r11, qword [r9 + 0xd8]
mov r12, rbx
cmp rbx, r10
jb 0x4050f9
cmp rbx, r11
jb 0x405113
mov r10, qword [r9 + 0xe0]
mov r11, qword [r9 + 0xe8]
cmp rbx, r10
jb 0x4050cb
cmp rbx, r11
jae 0x4050cb
jmp 0x40513c
mov rdx, rbx
sub rbx, r10
sub r10, rdx
mov rdx, qword [r9 + 0x208]
add rcx, rbx
lea rax, [r10 + r12]
mov rbx, rdx
call fcn.004052e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rdx, rbx
sub rbx, r10
sub r10, rdx
mov rdx, qword [r9 + 0x218]
add rcx, rbx
lea rax, [r10 + r12]
mov rbx, rdx
call fcn.004052e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rdx, rbx
nop
movabs rsi, 0x800000000000
add rsi, rbx
mov r8, rsi
shr rsi, 0x2a
nop dword [rax]
cmp rsi, 0x40
jae 0x40528a
lea r9, [0x012fa6f0]
mov rsi, qword [r9 + rsi*8]
shr r8, 0x16
and r8d, 0xfffff
mov r8, qword [rsi + r8*8]
shr rbx, 0xd
and ebx, 0x1ff
mov r9, qword [r8 + rbx*8 + 0x10400]
test byte [rsi], al
test byte [r8], al
nop
mov sil, byte [r9 + 0x63]
cmp sil, 2
je 0x4051d3
mov rax, rdx
mov rbx, rdi
call fcn.00414640
jmp 0x405243
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
lea rbx, [0x004052a0]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.00463280
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x38]
call fcn.00414760
test rsi, rsi
je 0x40526f
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
mov rax, qword [rsi]
call fcn.00404c60
test al, al
je 0x40522f
jmp 0x405279
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x006d7f1a]
mov ebx, 0x24
call fcn.00436b60
mov rax, rsi
mov ecx, 0x40
call fcn.00465a40
nop
int3
Function at 0x4052e0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, rcx
shr rcx, 6
mov rsi, rcx
shl rcx, 6
nop
nop
sub rdx, rcx
add rdi, rdx
mov qword [rsp + 0x28], rdi
add rbx, rsi
add rcx, rax
mov qword [rsp + 0x30], rcx
xor eax, eax
xor esi, esi
jmp 0x405320
add rax, 8
nop
cmp rax, rdi
jae 0x40538a
test rax, 0x3f
jne 0x405335
movzx esi, byte [rbx]
inc rbx
jmp 0x405337
shr esi, 1
test rdx, rdx
jbe 0x405342
add rdx, 0xfffffffffffffff8
jmp 0x40531a
bt esi, 0
jae 0x40531a
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x14], esi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rcx + rax]
mov rax, rdx
call fcn.00404c60
test al, al
jne 0x405394
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
mov esi, dword [rsp + 0x14]
mov rdi, qword [rsp + 0x28]
jmp 0x40531a
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006d7f1a]
mov ebx, 0x24
call fcn.00436b60
nop
int3

Function at 0x40a480
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a5a6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, qword [r14 + 0x30]
cmp dword [rdx + 0xc0], 0
jne 0x40a590
mov rdx, qword [0x012c82b8]
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
mov r8, rdi
shr rdi, 2
lea rdi, [rdi + rdi*2]
cmp rsi, rdi
jb 0x40a56a
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x28], rax
lea rax, [r8 + r8]
lea rax, [rax + 2]
shl rax, 3
xor ebx, ebx
mov ecx, 1
call fcn.0040cf40
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x18]
mov rsi, qword [rdx]
shl rsi, 1
mov qword [rax], rsi
movups xmmword [rsp + 0x30], xmm15
lea rsi, [0x00467840]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
nop dword [rax]
call fcn.0040b400
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x18]
cmp qword [rsi + 8], rdx
jne 0x40a57f
nop
cmp byte [0x01328750], 0
je 0x40a554
lea rax, [0x012c82b8]
call fcn.00404400
mov rbx, qword [rsp + 0x20]
lea rcx, [0x012c82b8]
xchg qword [rcx], rbx
mov rdx, qword [0x012c82b8]
mov rax, qword [rsp + 0x28]
mov rbx, rax
mov rax, rdx
call fcn.0040a5c0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006d944d]
mov ebx, 0x27
call fcn.00436b60
lea rax, [0x006ce824]
mov ebx, 0xf
nop dword [rax]
call fcn.00436b60
nop
mov qword [rsp + 8], rax
call fcn.004633c0
mov rax, qword [rsp + 8]
jmp fcn.0040a480
Function at 0x40b4c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40b5e6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rbx + 8]
inc rcx
mov qword [rbx + 8], rcx
nop
mov rdx, rbx
shl rbx, 0x10
mov rsi, rcx
and ecx, 0x7ffff
or rbx, rcx
mov rcx, rbx
sar rbx, 0x13
shl rbx, 3
cmp rdx, rbx
je 0x40b50c
jmp 0x40b52e
mov rax, rsi
mov rbx, qword [rax]
mov qword [rdx], rbx
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rsi], rcx
sete bl
test bl, bl
je 0x40b509
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x20], rbx
call fcn.004384a0
lea rax, [0x006daed8]
mov ebx, 0x2c
call fcn.00438da0
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.00438d20
lea rax, [0x006cb7b9]
mov ebx, 5
call fcn.00438da0
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00438c00
lea rax, [0x006cc122]
mov ebx, 8
call fcn.00438da0
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00438c00
lea rax, [0x006cc573]
mov ebx, 9
call fcn.00438da0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438d20
call fcn.00438700
call fcn.00438520
lea rax, [0x006cd91b]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0040b4c0

Function at 0x40b620
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40b6d7
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
xor ebx, ebx
mov rcx, rbx
call fcn.004144e0
test rax, rax
jne 0x40b6c5
mov rax, qword [rsp + 0x30]
mov rcx, rax
shl rax, 0x10
or rax, 0x7ffff
sar rax, 0x13
shl rax, 3
cmp rcx, rax
jne 0x40b675
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.004384a0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
call fcn.004384a0
lea rax, [0x006d492d]
mov ebx, 0x1c
call fcn.00438da0
mov rax, qword [rsp + 0x18]
nop
call fcn.00438c00
call fcn.00438700
call fcn.00438520
lea rax, [0x006cf935]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.00436b60
lea rax, [0x006d817e]
mov ebx, 0x24
call fcn.00436b60
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004633c0
mov rax, qword [rsp + 8]
jmp fcn.0040b620
Function at 0x40bc00
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
nop
test cl, cl
je 0x40bc8f
mov qword [rsp + 0x28], r14
test rbx, rbx
jge 0x40bc5b
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x012c82b0]
cmp qword [rcx], 0
jne 0x40be77
mov rax, 0xffffffffffffffff
call fcn.00432f40
jmp 0x40be25
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x48], rbx
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x48]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40bcbb
cmp qword [rdx], 1
jne 0x40bca4
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006d56df]
mov ebx, 0x1e
call fcn.00436b60
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x012c82b0]
cmp qword [rdx], 0
je 0x40bcee
nop dword [rax + rax]
cmp rbx, 0x989680
jle 0x40bcee
mov ebx, 0x989680
mov rax, rbx
call fcn.00432f40
test eax, eax
jge 0x40bd7c
mov rax, qword [0x012c82b0]
mov rax, qword [rax]
test rax, rax
je 0x40bd31
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00465180
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40bcb5
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x40bd9b
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rcx]
mov rsi, qword [rdx + 0x30]
mov rdi, rsi
cmp rax, rsi
jne 0x40bdc6
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
test dil, dil
je 0x40bd9b
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp rax, 1
jne 0x40be14
mov byte [rdi + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.00432f40
nop
test eax, eax
jl 0x40be03
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006dcc44]
mov ebx, 0x32
call fcn.00436b60
lea rax, [0x006dc73a]
mov ebx, 0x31
call fcn.00436b60
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [0x012c82b0]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
nop dword [rax + rax]
call fcn.00465180
xorps xmm15, xmm15
mov r14, qword [0x013284d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, 0x989680
nop dword [rax]
call fcn.00432f40
test eax, eax
jl 0x40be44
jmp 0x40be25
Function at 0x40c0e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c3ef
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
cmp word [0x009492c4], 0x10
jne 0x40c3dd
mov rdx, qword [0x01328460]
test rdx, rdx
je 0x40c3cc
nop word [rax + rax]
nop
cmp rdx, 0x80000
ja 0x40c360
cmp rdx, 0x1000
jb 0x40c2ec
lea rbx, [rdx - 1]
nop
test rdx, rbx
jne 0x40c2a0
mov rdx, qword [0x01328458]
lea rbx, [rdx - 1]
test rdx, rbx
jne 0x40c254
nop dword [rax]
cmp rdx, 0x400000
jbe 0x40c174
mov qword [0x01328458], 0
cmp qword [0x01328458], 0
nop dword [rax]
jne 0x40c22d
lea rax, [0x012ea580]
call fcn.00426560
call fcn.00416080
mov qword [0x01328418], rax
xor eax, eax
jmp 0x40c1a5
inc rax
cmp rax, 3
jl 0x40c1a2
mov eax, 0x7f
jmp 0x40c1f4
mov qword [rsp + 0x18], rcx
lea rax, [0x01301100]
nop
call fcn.00418c80
mov rcx, qword [rsp + 0x10]
mov rdx, rcx
shl rcx, 0x28
movabs rbx, 0xc000000000
or rcx, rbx
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov rsi, qword [rcx]
mov qword [rax + 0x10], rsi
mov qword [rcx], rax
lea rax, [rdx - 1]
test rax, rax
jl 0x40c218
mov qword [rsp + 0x10], rax
nop
cmp rax, 0x3f
jle 0x40c20f
lea rcx, [0x01301148]
jmp 0x40c1b2
lea rcx, [0x012fa910]
jmp 0x40c1b2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [rcx + 1]
mov qword [0x01328450], rdx
mov rcx, qword [0x01328450]
cmp rcx, 0x40
sbb rdx, rdx
mov ebx, 1
shl rbx, cl
and rbx, rdx
cmp qword [0x01328458], rbx
jne 0x40c222
jmp 0x40c186
call fcn.004384a0
lea rax, [0x006d2450]
mov ebx, 0x17
call fcn.00438da0
mov rax, qword [0x01328458]
call fcn.00438aa0
lea rax, [0x006d1c23]
mov ebx, 0x17
call fcn.00438da0
call fcn.00438520
lea rax, [0x006d2e7b]
mov ebx, 0x19
call fcn.00436b60
nop dword [rax]
call fcn.004384a0
lea rax, [0x006cfc5f]
mov ebx, 0x12
call fcn.00438da0
mov rax, qword [0x01328460]
nop dword [rax]
call fcn.00438aa0
lea rax, [0x006d1c23]
mov ebx, 0x17
call fcn.00438da0
call fcn.00438520
lea rax, [0x006d08b8]
mov ebx, 0x14
call fcn.00436b60
call fcn.004384a0
lea rax, [0x006cfc5f]
mov ebx, 0x12
nop dword [rax]
call fcn.00438da0
mov rax, qword [0x01328460]
call fcn.00438aa0
lea rax, [0x006d856e]
mov ebx, 0x25
nop dword [rax]
call fcn.00438da0
mov eax, 0x1000
call fcn.00438ba0
lea rax, [0x006cb2fc]
mov ebx, 2
nop dword [rax + rax]
call fcn.00438da0
call fcn.00438520
lea rax, [0x006d08b8]
mov ebx, 0x14
call fcn.00436b60
nop dword [rax + rax]
call fcn.004384a0
lea rax, [0x006cfc5f]
mov ebx, 0x12
call fcn.00438da0
mov rax, qword [0x01328460]
nop dword [rax]
call fcn.00438aa0
lea rax, [0x006d7e8a]
mov ebx, 0x24
call fcn.00438da0
mov eax, 0x80000
nop dword [rax + rax]
call fcn.00438ba0
lea rax, [0x006cb2fc]
mov ebx, 2
call fcn.00438da0
call fcn.00438520
lea rax, [0x006d08b8]
mov ebx, 0x14
call fcn.00436b60
lea rax, [0x006d551d]
mov ebx, 0x1e
call fcn.00436b60
lea rax, [0x006cf29b]
mov ebx, 0x11
call fcn.00436b60
nop
call fcn.004633c0
jmp fcn.0040c0e0
Function at 0x40cbc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40cce6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
xor edx, edx
jmp 0x40cbfe
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x10], rdx
lea rsi, [rcx + rbx]
mov qword [rsp + 0x20], rsi
mov rbx, rsi
call fcn.00417ae0
mov rcx, rax
nop word [rax + rax]
test rax, rax
je 0x40ccc1
mov rdx, qword [rsp + 0x50]
lea rsi, [rdx - 1]
test rax, rsi
je 0x40ccaf
mov qword [rsp + 0x18], rax
mov rax, rcx
mov rbx, qword [rsp + 0x20]
call fcn.004179a0
nop
nop
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x50]
lea rcx, [rax + rcx]
lea rcx, [rcx - 1]
neg rax
and rax, rcx
mov qword [rsp + 0x18], rax
mov rbx, qword [rsp + 0x48]
call fcn.00417ae0
mov rcx, rax
mov rdx, qword [rsp + 0x18]
cmp rax, rdx
je 0x40cc9d
mov rax, rcx
mov rbx, qword [rsp + 0x48]
call fcn.004179a0
mov rcx, qword [rsp + 0x10]
cmp rcx, 0x63
jne 0x40cbeb
jmp 0x40cccf
mov rax, rcx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rcx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006ddc36]
mov ebx, 0x38
nop dword [rax + rax]
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040cbc0