joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f66d
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop
mov rcx, qword [rax + 0x20]
nop
nop
mov rdx, rcx
shr rcx, 0x20
cmp edx, ecx
ja 0x42f607
mov rdx, qword [rax + 0x10]
shr ecx, 9
cmp rdx, rcx
jbe 0x42f5cc
nop
nop
mov rdx, qword [rax + 8]
nop
nop
lea rcx, [rdx + rcx*8]
mov rbx, qword [rcx]
test rbx, rbx
je 0x42f5cc
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x42f5f6
mov edx, dword [rbx + 0x10]
nop dword [rax + rax]
cmp edx, 0x200
je 0x42f5e5
mov qword [rsp + 0x30], rax
nop
nop
xor edx, edx
xchg qword [rcx], rdx
nop
nop
xor ecx, ecx
xchg dword [rbx + 0x10], ecx
lea rax, [0x009187f0]
call fcn.0040b5e0
mov rax, qword [rsp + 0x30]
nop
nop
xor ecx, ecx
xchg qword [rax + 0x20], rcx
nop
xor ecx, ecx
xchg qword [rax + 0x10], rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006c990e]
mov ebx, 0x31
call fcn.00436a00
lea rax, [0x006ca59b]
mov ebx, 0x34
call fcn.00436a00
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], rcx
call fcn.00438340
lea rax, [0x006b9301]
mov ebx, 7
call fcn.00438c40
mov rax, qword [rsp + 0x10]
call fcn.00438940
lea rax, [0x006b991a]
mov ebx, 9
nop dword [rax]
call fcn.00438c40
mov rax, qword [rsp + 0x18]
mov eax, eax
call fcn.00438940
call fcn.004385a0
call fcn.004383c0
lea rax, [0x006c4a36]
mov ebx, 0x23
call fcn.00436a00
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.0042f540
Function at 0x42fba0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42fe46
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42fe3a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x00918602], 0
jne 0x42fc02
xor edx, edx
xor ebx, ebx
nop
jmp 0x42fc4a
xor edx, edx
jmp 0x42fc2d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041f540
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42fc06
add rax, 0x1260
call fcn.0042fa60
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42fdd4
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42fc47
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.004145e0
test rax, rax
jne 0x42fca2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42fc47
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x42fce9
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42fc47
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42fe2d
lea r10, [0x008eaa30]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r11, [rcx + 0x11440]
add r9, r11
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42fd6e
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42fda5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42fc47
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42fe25
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42fc47
cmp rbx, 0x200
ja 0x42fe18
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00425660
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.0042fa60
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.00465b20
mov rax, r8
call fcn.00465aa0
mov rax, r8
mov ecx, 0x40
call fcn.00465ac0
mov edx, 0x200
nop
call fcn.00465b00
nop
mov qword [rsp + 8], rax
call fcn.00467ec0
mov rax, qword [rsp + 8]
jmp fcn.0042fba0
Function at 0x430720
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4307fc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [sym.imp.kernel32.dll_CreateIoCompletionPort]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.00433be0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x00883558], rax
test rax, rax
je 0x430792
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00467020
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438340
lea rax, [0x006c9191]
mov ebx, 0x2f
call fcn.00438c40
mov rax, qword [rsp + 0x30]
call fcn.00438940
lea rax, [0x006b86ee]
mov ebx, 3
nop dword [rax]
call fcn.00438c40
call fcn.004383c0
lea rax, [0x006c13ab]
mov ebx, 0x1b
call fcn.00436a00
nop
nop dword [rax]
call fcn.00463440
jmp fcn.00430720

Function at 0x4308e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4309dc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor eax, eax
lea rcx, [0x0091865c]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
jne 0x43091b
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, qword [0x00883558]
mov rcx, qword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.00433be0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
nop
je 0x43096c
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00467020
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438340
lea rax, [0x006cb925]
mov ebx, 0x3c
nop dword [rax]
call fcn.00438c40
mov rax, qword [rsp + 0x30]
call fcn.00438940
lea rax, [0x006b86ee]
mov ebx, 3
nop dword [rax + rax]
call fcn.00438c40
call fcn.004383c0
lea rax, [0x006ca2c7]
mov ebx, 0x33
call fcn.00436a00
nop
nop dword [rax]
call fcn.00463440
jmp fcn.004308e0
Function at 0x430d80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430e07
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov edx, dword [rbx + 0x28]
nop dword [rax + rax]
cmp edx, 0x72
je 0x430daa
cmp edx, 0x77
jne 0x430dc5
mov dword [rbx + 0x2c], ecx
mov dword [rbx + 0x30], edi
mov rbx, qword [rbx + 0x20]
mov ecx, edx
call fcn.0042ff60
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edx
call fcn.00438340
lea rax, [0x006cb8e9]
mov ebx, 0x3c
call fcn.00438c40
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.00438a40
call fcn.004385a0
call fcn.004383c0
lea rax, [0x006bf46c]
mov ebx, 0x17
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.00430d80
Function at 0x430f00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4310f1
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
cmp qword [0x00918808], 0
jne 0x430f9e
mov rax, qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea rcx, [0x00919440]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x104
call fcn.00433ae0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x4310df
cmp rax, 0x104
ja 0x4310df
lea r8, [0x00919440]
mov byte [r8 + rax], 0x5c
lea r9, [rax + 1]
mov qword [0x00918808], r9
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
cmp byte [0x00918603], 0
je 0x430ff8
test rbx, rbx
jbe 0x4310d5
mov rcx, qword [0x008c35c0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x800
call fcn.00433b60
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [0x00918808]
nop
cmp rcx, 0x105
ja 0x4310cb
lea rdx, [rcx + rbx]
cmp rdx, 0x105
ja 0x431023
lea rsi, [0x00919440]
jmp 0x43105b
mov qword [rsp + 0x30], rcx
lea rax, [0x00919440]
mov ecx, 0x105
mov rdi, rbx
lea rsi, [0x00667c00]
mov rbx, rdx
call fcn.0044a700
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
mov rsi, rax
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rsi
lea rdi, [rsi + rcx]
mov rcx, rbx
mov rbx, rax
mov rax, rdi
call fcn.00466460
mov rdx, qword [rsp + 0x28]
nop dword [rax]
test rdx, rdx
jbe 0x4310c1
mov rax, qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433a60
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
xor eax, eax
mov rcx, rax
call fcn.00465aa0
mov edx, 0x105
call fcn.00465b00
xor eax, eax
mov rcx, rax
call fcn.00465aa0
lea rax, [0x006c5020]
mov ebx, 0x24
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00430f00
Function at 0x431c60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x431ee6
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x008c35f8]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.00433b60
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x431d5f
jne 0x431cf3
cmp dword [rsp + 0x4c], 0
jne 0x431cf3
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x431d5f
mov rax, qword [0x008c35f0]
call fcn.00433a00
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x00919aca]
mov ebx, 0x20
mov ecx, 0x21
call fcn.004324c0
mov rcx, qword [0x00918808]
cmp rcx, 0x105
ja 0x431ed7
mov qword [rsp + 0x58], rcx
lea rax, [0x009198e0]
lea rbx, [0x00919440]
call fcn.00466460
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x431d71
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rdx + rbx + 1], dil
inc rax
cmp rax, 0x20
jge 0x431dd8
lea rdx, [rcx + rax*2]
lea rbx, [0x009198e0]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x006bbc61]
movzx esi, byte [rdi + rsi]
nop dword [rax]
cmp rdx, 0x20b
jae 0x431eca
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
inc rsi
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
cmp rsi, 0x20b
jb 0x431d69
jmp 0x431ebd
lea rdx, [rcx + 0x40]
jmp 0x431dec
lea rbx, [0x009198e0]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x431e05
cmp rdx, 0x20b
jb 0x431dde
nop
jmp 0x431eb0
mov rax, qword [sym.imp.kernel32.dll_CreateFileA]
lea rcx, [0x009198e0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.00433d60
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00467020
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x431e9f
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.00438340
lea rax, [0x006cd6b1]
mov ebx, 0x5f
call fcn.00438c40
call fcn.004383c0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [0x009185f4], 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.00465aa0
mov rax, rsi
mov ecx, 0x20b
call fcn.00465aa0
mov rax, rdx
mov ecx, 0x20b
call fcn.00465aa0
mov edx, 0x105
nop dword [rax]
call fcn.00465b00
nop
call fcn.00463440
jmp fcn.00431c60
Function at 0x432200
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4324a9
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.00430e40
cmp dword [0x00918a90], 0
jne 0x43227c
mov qword [0x008c35b8], rax
jmp 0x432288
lea rdi, [0x008c35b8]
call fcn.00465600
test rax, rax
je 0x432497
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.00430e40
cmp dword [0x00918a90], 0
jne 0x4322e7
mov qword [0x008c35d8], rax
jmp 0x4322f3
lea rdi, [0x008c35d8]
call fcn.00465600
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.00430e40
cmp dword [0x00918a90], 0
jne 0x43235b
mov qword [0x008c35e0], rax
jmp 0x432367
lea rdi, [0x008c35e0]
call fcn.00465600
cmp qword [0x008c35d8], 0
je 0x432486
test rax, rax
je 0x432486
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433a60
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x432475
nop word [rax + rax]
cmp rax, 0x7fffffff
jg 0x432464
mov qword [rsp + 0x28], rax
mov rax, qword [0x008c35d8]
lea rcx, [0x009187e0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433a60
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x432418
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x432435
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x432412
sub rbx, rsi
bts edi, ecx
jmp 0x432412
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x009187d8], rax
mov byte [0x00918604], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x006cd49c]
mov ebx, 0x56
call fcn.00436a00
lea rax, [0x006cd0c5]
mov ebx, 0x50
call fcn.00436a00
lea rax, [0x006c0f73]
mov ebx, 0x1b
call fcn.00436a00
lea rax, [0x006c9426]
mov ebx, 0x30
call fcn.00436a00
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00432200
Function at 0x433220
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rcx, qword [sym.imp.kernel32.dll_CreateThread]
lea rdx, [0x00467220]
mov qword [rsp], rcx
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm15
call fcn.00433ce0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x4332a8
mov rcx, qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00433a60
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov ecx, dword [0x00918628]
test ecx, ecx
jne 0x43334d
mov rax, qword [0x008c5070]
sub rax, qword [0x008c5080]
mov qword [rsp + 0x48], rax
call fcn.00467020
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.00438340
lea rax, [0x006c8b64]
mov ebx, 0x2e
call fcn.00438c40
mov rax, qword [rsp + 0x48]
movsxd rax, eax
call fcn.00438a40
lea rax, [0x006bbbd1]
mov ebx, 0x10
call fcn.00438c40
mov rax, qword [rsp + 0x40]
call fcn.00438940
lea rax, [0x006b863d]
mov ebx, 2
call fcn.00438c40
call fcn.004383c0
lea rax, [0x006bc673]
mov ebx, 0x11
call fcn.00436a00
nop
nop
lea rax, [0x00918708]
call fcn.0040b860
nop
nop
lea rax, [0x00918708]
call fcn.0040b860
jmp 0x4332b6
Function at 0x434fe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4350be
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rcx, qword [r14 + 0x30]
mov rdx, r14
nop
cmp qword [rcx + 0x90], rdx
jne 0x4350ac
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x28], rax
call fcn.00435180
cmp qword [rax + 0x20], 0
jne 0x43509b
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x28]
cmp dword [0x00918a90], 0
jne 0x435048
mov qword [rax + 0x28], rdx
mov qword [rcx + 0x28], rax
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
jmp 0x435068
lea rdi, [rax + 0x28]
call fcn.00465720
lea rdi, [rcx + 0x28]
call fcn.00465600
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465700
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x28]
mov qword [rax + 8], rcx
call fcn.004655a0
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006c6b76]
mov ebx, 0x28
call fcn.00436a00
lea rax, [0x006be1dc]
mov ebx, 0x15
call fcn.00436a00
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00434fe0

Function at 0x435700
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x435826
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x10], r14
mov rcx, qword [rsp + 0x10]
jmp 0x435738
call fcn.004353a0
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rdx]
call rcx
mov rcx, qword [rsp + 0x10]
mov rax, qword [rcx + 0x28]
nop dword [rax]
test rax, rax
je 0x435809
lea rdx, [rsp + 0x40]
cmp qword [rax + 8], rdx
jne 0x4357ff
lea rdi, [rcx + 0x28]
cmp byte [rax + 2], 0
jne 0x4357b5
mov rbx, qword [rax + 0x18]
cmp dword [0x00918a90], 0
jne 0x435779
mov qword [rax + 0x18], 0
jmp 0x43578e
lea rsi, [rax + 0x18]
mov r8, rdi
mov rdi, rsi
xor r9d, r9d
call fcn.004657a0
mov rdi, r8
mov qword [rsp + 0x18], rbx
mov rsi, qword [rax + 0x28]
cmp dword [0x00918a90], 0
nop
jne 0x4357ab
mov qword [rcx + 0x28], rsi
jmp 0x435724
call fcn.00465760
jmp 0x435724
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
nop
call fcn.00435e80
test al, al
je 0x435813
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x28]
cmp dword [0x00918a90], 0
jne 0x4357e6
mov rdx, qword [rsp + 0x10]
mov qword [rdx + 0x28], rcx
jmp 0x4357f0
mov rdi, qword [rsp + 0x28]
call fcn.00465700
call fcn.004353a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006c7dc3]
mov ebx, 0x2b
nop
call fcn.00436a00
nop
call fcn.00463440
jmp fcn.00435700
Function at 0x436fe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x437141
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x10], r14
cmp qword [0x008f1318], 0
jne 0x437025
call fcn.00438340
lea rax, [0x006c8bc0]
mov ebx, 0x2e
call fcn.00438c40
nop dword [rax]
call fcn.004383c0
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
nop
jge 0x43704c
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x4370e7
nop
cmp edx, 1
je 0x4370b1
cmp edx, 2
jne 0x437099
mov dword [rcx + 0xdc], 3
call fcn.00438340
lea rax, [0x006bfc93]
mov ebx, 0x18
call fcn.00438c40
call fcn.004383c0
mov eax, 4
call fcn.004327a0
mov eax, 5
nop
call fcn.004327a0
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 2
nop dword [rax + rax]
call fcn.00438340
lea rax, [0x006bd4c5]
mov ebx, 0x13
call fcn.00438c40
call fcn.004383c0
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 1
nop
mov ecx, 1
lea rdx, [0x00918664]
lock xadd dword [rdx], ecx
lea rax, [0x00918788]
call fcn.0040b820
cmp dword [0x00918df0], 0
jg 0x437122
cmp dword [0x00918dec], 0
nop
jle 0x43712c
mov eax, 1
call fcn.004444c0
call fcn.0043a980
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
call fcn.00463440
jmp fcn.00436fe0
Function at 0x43b700
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43b96f
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jg 0x43b95d
mov qword [rsp + 0x40], r14
nop
nop
lea rax, [0x008c5058]
call fcn.0040b860
mov ecx, dword [0x00918648]
mov dword [0x008c512c], ecx
nop
nop
mov ecx, 1
lea rdx, [0x008c5128]
xchg byte [rdx], cl
call fcn.00444380
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0xa0]
mov dword [rcx + 4], 3
dec dword [0x008c512c]
mov rcx, qword [0x008c3e10]
mov qword [rsp + 0x50], rcx
mov rdx, qword [0x008c3e18]
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x43b79a
lea rax, [rsi + 1]
cmp rax, rdx
jge 0x43b81e
mov rbx, qword [rcx + rax*8]
cmp dword [rbx + 4], 2
jne 0x43b7c2
mov rsi, rax
mov eax, 2
mov edi, 3
lock cmpxchg dword [rbx + 4], edi
sete r8b
nop
jmp 0x43b7cd
mov rsi, rax
mov edi, 3
xor r8d, r8d
test r8b, r8b
je 0x43b796
cmp byte [0x008ca7d0], 0
je 0x43b810
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
call fcn.00456d40
mov rax, qword [rsp + 0x38]
call fcn.004565c0
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
mov edi, 3
inc dword [rbx + 0x14]
dec dword [0x008c512c]
jmp 0x43b796
nop
nop
call fcn.00467480
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x18], rax
jmp 0x43b854
mov dword [rax + 4], 3
dec dword [0x008c512c]
mov rax, qword [rsp + 0x18]
call fcn.00445360
test rax, rax
jne 0x43b842
nop
nop
mov ecx, dword [0x008c512c]
mov dword [rsp + 0x14], ecx
lea rax, [0x008c5058]
call fcn.0040ba80
mov ecx, dword [rsp + 0x14]
test ecx, ecx
jle 0x43b8a8
nop
jmp 0x43b887
call fcn.00444380
lea rax, [0x008c5130]
mov ebx, 0x186a0
call fcn.0040bfc0
test al, al
je 0x43b882
nop
mov qword [0x008c5130], 0
cmp dword [0x008c512c], 0
jne 0x43b8ca
mov rcx, qword [0x008c3e10]
mov rdx, qword [0x008c3e18]
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x43b94d
mov eax, 0x29
lea rcx, [0x006c73d7]
mov dl, byte [0x009185f8]
nop dword [rax]
test dl, dl
je 0x43b914
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rcx
nop
nop
lea rax, [0x00918708]
call fcn.0040b860
nop
nop
lea rax, [0x00918708]
call fcn.0040b860
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
test rax, rax
jne 0x43b923
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rbx, rax
mov rax, rcx
call fcn.00436a00
mov rdi, qword [rcx + rax*8]
cmp dword [rdi + 4], 3
mov edi, 0x2e
cmovne rbx, rdi
lea r8, [0x006c8ca6]
cmovne rsi, r8
inc rax
cmp rax, rdx
jl 0x43b92e
mov rax, rbx
mov rcx, rsi
jmp 0x43b8d6
lea rax, [0x006c144d]
mov ebx, 0x1b
call fcn.00436a00
nop
call fcn.00463440
jmp fcn.0043b700