joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431900
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x431bb9
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.00430480
cmp dword [0x009d0300], 0
jne 0x43197c
mov qword [0x00978d38], rax
jmp 0x431988
lea rdi, [0x00978d38]
call fcn.00462fc0
test rax, rax
je 0x431ba7
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.00430480
cmp dword [0x009d0300], 0
jne 0x4319e7
mov qword [0x00978d58], rax
jmp 0x4319f3
lea rdi, [0x00978d58]
call fcn.00462fc0
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.00430480
cmp dword [0x009d0300], 0
jne 0x431a5b
mov qword [0x00978d60], rax
jmp 0x431a67
lea rdi, [0x00978d60]
call fcn.00462fc0
cmp qword [0x00978d58], 0
je 0x431b96
test rax, rax
je 0x431b96
mov qword [rsp + 0x20], 0
mov rax, qword [0x00978d60]
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop dword [rax]
call fcn.00433400
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x431b85
cmp rax, 0x7fffffff
jg 0x431b71
mov qword [rsp + 0x28], rax
mov rax, qword [0x00978d58]
lea rcx, [0x009d00f8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433400
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x431b23
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x431b42
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x431b1d
sub rbx, rsi
bts edi, ecx
nop
jmp 0x431b1d
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x009d00f0], rax
mov byte [0x009cff08], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x0073cac0]
mov ebx, 0x56
nop dword [rax]
call fcn.00436360
lea rax, [0x0073c691]
mov ebx, 0x50
call fcn.00436360
lea rax, [0x0072fcb0]
mov ebx, 0x1b
call fcn.00436360
lea rax, [0x00738a72]
mov ebx, 0x30
call fcn.00436360
nop
mov qword [rsp + 8], rax
nop
call fcn.00460d80
mov rax, qword [rsp + 8]
jmp fcn.00431900
Function at 0x432bc0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rcx, qword [0x00920308]
lea rdx, [0x00464b20]
mov qword [rsp], rcx
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm15
call fcn.00433680
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x432c4c
mov rcx, qword [0x00920328]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00433400
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov ecx, dword [0x009cff38]
test ecx, ecx
jne 0x432cfb
mov rax, qword [0x0097ca90]
sub rax, qword [0x0097caa0]
mov qword [rsp + 0x48], rax
call fcn.00464920
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.00437b00
lea rax, [0x0073823d]
mov ebx, 0x2e
nop
call fcn.00438400
mov rax, qword [rsp + 0x48]
movsxd rax, eax
call fcn.00438200
lea rax, [0x0072a31f]
mov ebx, 0x10
nop
call fcn.00438400
mov rax, qword [rsp + 0x40]
call fcn.00438100
lea rax, [0x00726ac2]
mov ebx, 2
nop dword [rax + rax]
call fcn.00438400
call fcn.00437b80
lea rax, [0x0072ae97]
mov ebx, 0x11
call fcn.00436360
nop
nop
lea rax, [0x009d0020]
call fcn.0040b340
nop
nop
lea rax, [0x009d0020]
call fcn.0040b340
jmp 0x432c5a
Function at 0x436880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4369dd
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x10], r14
cmp qword [0x009a8c40], 0
jne 0x4368c5
call fcn.00437b00
lea rax, [0x00738299]
mov ebx, 0x2e
call fcn.00438400
nop dword [rax]
call fcn.00437b80
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
nop
jge 0x4368ec
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x436987
nop
cmp edx, 1
je 0x436951
cmp edx, 2
jne 0x436939
mov dword [rcx + 0xdc], 3
call fcn.00437b00
lea rax, [0x0072e8fe]
mov ebx, 0x18
call fcn.00438400
call fcn.00437b80
mov eax, 4
call fcn.00431ee0
mov eax, 5
nop
call fcn.00431ee0
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 2
nop dword [rax + rax]
call fcn.00437b00
lea rax, [0x0072be0f]
mov ebx, 0x13
call fcn.00438400
call fcn.00437b80
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 1
mov ecx, 1
lea rdx, [0x009cff74]
lock xadd dword [rdx], ecx
lea rax, [0x009d00b0]
call fcn.0040b300
cmp dword [0x009d05f0], 0
jg 0x4369bf
cmp dword [0x009d05ec], 0
jle 0x4369c9
mov eax, 1
call fcn.00443aa0
call fcn.0043a180
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
nop dword [rax]
call fcn.00460d80
jmp fcn.00436880
Function at 0x43b1c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43b386
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x60], al
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x009cff64]
test edx, edx
je 0x43b214
xor eax, eax
nop dword [rax]
call fcn.00430020
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.0043e840
nop
nop
lea rax, [0x0097ca78]
nop dword [rax]
call fcn.0040b340
mov ecx, dword [0x009cff5c]
mov edx, dword [0x009cff70]
test edx, edx
je 0x43b242
mov dword [0x009cff70], 0
nop
jmp 0x43b244
mov edx, ecx
mov eax, edx
call fcn.00442180
mov qword [rsp + 0x40], rax
mov dword [0x0097cb40], 0
cmp dword [0x0097cb50], 0
je 0x43b279
mov dword [0x0097cb50], 0
lea rax, [0x0097cb58]
call fcn.0040b640
nop
nop
lea rax, [0x0097ca78]
call fcn.0040b560
mov rcx, qword [rsp + 0x40]
jmp 0x43b293
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x43b2ef
mov rdx, qword [rcx + 8]
mov rsi, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rsi, rsi
je 0x43b2dc
nop
mov qword [rcx + 0x38], 0
cmp qword [rsi + 0xa8], 0
nop dword [rax + rax]
jne 0x43b374
nop
mov qword [rsi + 0xa8], rcx
lea rax, [rsi + 0x118]
call fcn.0040b640
jmp 0x43b28e
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
call fcn.0043c440
jmp 0x43b28e
nop
call fcn.00464d80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x43b334
nop
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.00454140
call fcn.0043cfc0
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43b365
cmp byte [r14 + 0xb1], 0
je 0x43b365
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x00735093]
mov ebx, 0x25
call fcn.00436360
nop
mov byte [rsp + 8], al
call fcn.00460d80
movzx eax, byte [rsp + 8]
jmp fcn.0043b1c0
Function at 0x43c440
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c5ac
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043bc40
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43c561
mov rcx, qword [rdx + 0x30]
nop word [rax + rax]
test rcx, rcx
je 0x43c561
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x238], 0
jne 0x43c4c6
cmp byte [rcx + 0xe8], 0
nop
je 0x43c561
nop
nop
lea rax, [0x009d0460]
call fcn.0040b340
cmp dword [0x009d0480], 0
nop dword [rax + rax]
je 0x43c59a
mov rcx, qword [0x009d0468]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x128], rcx
nop
mov qword [0x009d0468], rdx
cmp byte [0x009d0470], 0
je 0x43c51d
mov byte [0x009d0470], 0
lea rax, [0x009d0478]
call fcn.0040b640
nop
nop
lea rax, [0x009d0460]
call fcn.0040b560
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43c557
cmp byte [r14 + 0xb1], 0
je 0x43c557
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043c5e0
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43c590
cmp byte [r14 + 0xb1], 0
je 0x43c590
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00736d68]
mov ebx, 0x2a
call fcn.00436360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00460d80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043c440
Function at 0x43d040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43d27d
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x130]
test rdx, rdx
je 0x43d26b
mov rdx, qword [rdx + 0xe8]
cmp rdx, rcx
jne 0x43d26b
mov qword [rsp + 0x30], r14
cmp qword [rcx + 0xa0], 0
je 0x43d095
call fcn.00442b40
call fcn.0043cce0
mov eax, 1
call fcn.00442ca0
nop
call fcn.0043b580
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x130]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43d0f4
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.004429c0
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov dword [rsp + 0x1c], ebx
call fcn.00437b00
lea rax, [0x0073733e]
mov ebx, 0x2b
call fcn.00438400
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.00438100
lea rax, [0x0073435b]
mov ebx, 0x24
call fcn.00438400
call fcn.00437b80
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x130]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
nop
call fcn.00437b00
lea rax, [0x0072a91f]
mov ebx, 0x10
call fcn.00438400
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00438380
lea rax, [0x007275a5]
mov ebx, 7
call fcn.00438400
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438200
lea rax, [0x0072b74e]
mov ebx, 0x13
call fcn.00438400
mov eax, dword [rsp + 0x18]
mov eax, eax
nop dword [rax]
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.00437b00
lea rax, [0x0072a8ef]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00438400
mov rax, qword [rsp + 0x28]
call fcn.00438380
lea rax, [0x007275a5]
mov ebx, 7
nop dword [rax + rax]
call fcn.00438400
mov rax, qword [rsp + 0x20]
call fcn.00438200
lea rax, [0x0072b73b]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00438400
mov eax, dword [rsp + 0x14]
mov eax, eax
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
lea rax, [0x0072f0e0]
mov ebx, 0x19
call fcn.00436360
lea rax, [0x007331ee]
mov ebx, 0x21
call fcn.00436360
nop
nop dword [rax]
call fcn.00460d80
jmp fcn.0043d040
Function at 0x43f700
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x43f96c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
cmp byte [0x009820f0], 0
je 0x43f737
mov eax, 0x14
xor ebx, ebx
call fcn.00455520
mov rax, qword [rsp + 0x48]
nop
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
jne 0x43f845
mov byte [rax + 0xb0], 0x19
cmp byte [rax + 0xb4], 0
je 0x43f77e
mov rcx, qword [rax + 0x40]
mov rax, rcx
call fcn.0044fea0
test rax, rax
je 0x43f82f
movzx edx, byte [rax + 0x25]
test dl, 2
jne 0x43f7d4
mov rax, qword [rsp + 0x48]
mov ebx, 2
mov ecx, 0x1009
call fcn.0043ab00
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop
nop
xor esi, esi
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
nop
xor esi, esi
mov qword [rdx + 0x90], rsi
mov rax, qword [rsp + 0x48]
mov ebx, 0x1009
mov ecx, 9
nop dword [rax]
call fcn.0043a220
call fcn.0043eb60
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00450620
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.00437b00
lea rax, [0x00734fff]
mov ebx, 0x25
call fcn.00438400
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
call fcn.00438400
lea rax, [0x0072b064]
mov ebx, 0x12
call fcn.00438400
call fcn.00437b80
lea rax, [0x0072a1f3]
mov ebx, 0xf
call fcn.00436360
lea rax, [0x0072cd7d]
mov ebx, 0x15
nop dword [rax + rax]
call fcn.00436360
nop
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00437b00
lea rax, [0x0072a91f]
mov ebx, 0x10
call fcn.00438400
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.00438380
lea rax, [0x007275a5]
mov ebx, 7
call fcn.00438400
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00438200
lea rax, [0x0072b74e]
mov ebx, 0x13
call fcn.00438400
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x10], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00437b00
lea rax, [0x0072a8ef]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00438400
mov rax, qword [rsp + 0x28]
call fcn.00438380
lea rax, [0x007275a5]
mov ebx, 7
nop dword [rax + rax]
call fcn.00438400
mov rax, qword [rsp + 0x18]
call fcn.00438200
lea rax, [0x0072b73b]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00438400
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.00438100
call fcn.00437d60
call fcn.00437b80
lea rax, [0x0072903a]
mov ebx, 0xc
call fcn.00436360
nop
mov qword [rsp + 8], rax
call fcn.004654c0
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.0043f700
Function at 0x442d00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x442fcd
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp byte [0x009cff01], 0
nop
jne 0x442d2b
cmp byte [0x009cfeff], 0
je 0x442d35
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp dword [0x009cff74], 0
nop dword [rax]
ja 0x442e30
cmp byte [0x009cff00], 0
jne 0x442d58
cmp byte [0x009cfef8], 0
jne 0x442d5c
xor ecx, ecx
jmp 0x442d7e
mov eax, 1
call fcn.0043c340
nop
cmp dword [0x009cff3c], 0
lea rcx, [0x009d0030]
xchg qword [rcx], rax
seta cl
movzx ecx, cl
mov edx, dword [0x0097ca88]
mov rbx, qword [0x0097ca90]
sub rbx, qword [0x0097caa0]
mov rsi, rbx
sub ebx, edx
mov edi, dword [0x0097ca8c]
sub ebx, edi
mov r8d, dword [0x0097ca9c]
sub ebx, r8d
cmp ecx, ebx
jge 0x442db7
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test ebx, ebx
jl 0x442f25
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00442fe0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x30]
call fcn.004397c0
cmp qword [rsp + 0x20], 0
je 0x442f05
cmp qword [0x009d0038], 0
je 0x442e1e
call fcn.00453a80
test rbx, rbx
je 0x442e1e
mov qword [0x009d0038], rax
lea rax, [0x0097cab0]
jmp 0x442e92
mov rcx, qword [0x0097a6b0]
mov rdx, qword [0x0097a6b8]
xor eax, eax
jmp 0x442e40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
inc rax
nop dword [rax]
cmp rax, rdx
jge 0x442e5f
mov rbx, qword [rcx + rax*8]
test byte [rbx], al
cmp qword [rbx + 0x2288], 0
je 0x442e3a
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [r14 + 0x30]
mov dword [rcx + 0xc4], 0xffffffff
nop
nop
lea rax, [0x0097ca78]
call fcn.0040b560
lea rax, [0x00734bf3]
mov ebx, 0x25
call fcn.00436360
test byte [rcx], al
lea rax, [rcx + 8]
mov rcx, qword [rax]
test rcx, rcx
je 0x442ea6
cmp rbx, rcx
jne 0x442e8c
mov rcx, qword [rbx + 8]
mov qword [rax], rcx
nop
mov rcx, qword [0x0097ca80]
test rcx, rcx
je 0x442eca
mov rdx, qword [rcx + 0x128]
mov qword [0x0097ca80], rdx
dec dword [0x0097ca88]
test rcx, rcx
je 0x442eef
nop
mov qword [rcx + 0xa8], rbx
lea rax, [rcx + 0x118]
nop dword [rax + rax]
call fcn.0040b640
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0072ec94]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436360
nop
nop
lea rax, [0x0097ca78]
call fcn.0040b560
lea rax, [0x0073a2a7]
mov ebx, 0x36
nop
call fcn.00436360
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x14], r8d
call fcn.00437b00
lea rax, [0x007300b2]
mov ebx, 0x1b
call fcn.00438400
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.00438200
lea rax, [0x007298c3]
mov ebx, 0xe
call fcn.00438400
mov eax, dword [rsp + 0x18]
movsxd rax, eax
call fcn.00438200
lea rax, [0x00727955]
mov ebx, 8
call fcn.00438400
mov rax, qword [rsp + 0x28]
movsxd rax, eax
call fcn.00438200
lea rax, [0x00727574]
mov ebx, 7
call fcn.00438400
mov eax, dword [rsp + 0x14]
movsxd rax, eax
call fcn.00438200
call fcn.00437d60
call fcn.00437b80
lea rax, [0x007315d6]
mov ebx, 0x1e
call fcn.00436360
nop
call fcn.00460d80
jmp fcn.00442d00
Function at 0x444680
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44477c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x444698
cmp edx, ecx
jne 0x44476a
nop dword [rax]
test rsi, rsi
jne 0x44476a
mov qword [rsp + 0x20], rax
call fcn.00444580
mov rcx, qword [0x0097a718]
mov rdx, qword [0x0097a710]
mov rbx, qword [rsp + 0x20]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
nop dword [rax]
test edi, edi
jl 0x444765
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
nop dword [rax]
cmp rax, rsi
jbe 0x44475a
lea rax, [rdx + rsi*4]
lock or dword [rax], r9d
mov rax, qword [0x0097cab0]
mov qword [rbx + 8], rax
nop
mov qword [0x0097cab0], rbx
mov eax, 1
lea rcx, [0x0097cab8]
lock xadd dword [rcx], eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov rax, rsi
call fcn.00463460
call fcn.00434820
lea rax, [0x00733fa8]
mov ebx, 0x23
call fcn.00436360
nop
mov qword [rsp + 8], rax
call fcn.00460d80
mov rax, qword [rsp + 8]
jmp fcn.00444680
Function at 0x449040
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x48], r14
cmp dword [0x009cff74], 0
je 0x44907f
mov qword [rsp + 0x60], rax
mov eax, 2
call fcn.00431ee0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov dword [0x009cff74], 1
mov rcx, qword [rsp + 0x48]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x38], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x30], rsi
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbx + 0xf8]
mov qword [rsp + 0x20], rdi
call fcn.00437b00
lea rax, [0x007283cc]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00438400
mov rax, qword [rsp + 0x38]
call fcn.00438260
call fcn.00437d20
mov rax, qword [rsp + 0x30]
call fcn.00438260
nop
call fcn.00437d20
mov rax, qword [rsp + 0x28]
call fcn.00438260
call fcn.00437d20
mov rax, qword [rsp + 0x20]
call fcn.00438260
nop
call fcn.00437d60
call fcn.00437b80
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
call fcn.00437b00
lea rax, [0x00726cc9]
mov ebx, 3
call fcn.00438400
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438260
call fcn.00437d60
call fcn.00437b80
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe8], 0
nop
je 0x4491cd
mov rdx, qword [rsp + 0x70]
cmp qword [rcx], rdx
jne 0x4491d2
cmp qword [rcx + 0x90], 0
je 0x4491d2
cmp byte [0x009cff00], 0
je 0x4491c0
nop
call fcn.00437b00
lea rax, [0x00738323]
mov ebx, 0x2e
call fcn.00438400
call fcn.00437b80
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x90]
jmp 0x4491d5
mov rdx, qword [rsp + 0x70]
mov rcx, rdx
mov qword [rsp + 0x40], rcx
call fcn.00437b00
nop
call fcn.00437d60
call fcn.00437b80
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 1
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
mov qword [rax + 0x98], rdi
mov eax, dword [0x00920368]
mov rdx, qword [r14 + 0x30]
movzx edx, byte [rdx + 0xf9]
shr eax, 2
test dl, dl
cmovne eax, edx
test eax, eax
jle 0x44925e
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
mov rdi, rcx
xor ecx, ecx
call fcn.004583a0
mov rax, qword [rsp + 0x40]
call fcn.00459320
mov rax, qword [rsp + 0x68]
call fcn.00407720
mov eax, 2
call fcn.00431ee0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x44cf40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x44d066
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
lea rdi, [rsp + 0x20]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046370b
mov rbp, qword [rbp]
lea rcx, [0x007038c0]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + 0x17]
test dl, 0x40
jne 0x44d050
lea rdx, [0x009d02e0]
lea rax, [0x0092ac20]
jmp 0x44cfd2
mov rax, qword [rax + 0x220]
test rax, rax
je 0x44cff4
nop word [rax + rax]
cmp qword [rax + 0x130], rdx
ja 0x44cfcb
cmp qword [rax + 0x100], rdx
jbe 0x44cfcb
jmp 0x44cff6
xor eax, eax
test rax, rax
je 0x44d03f
mov rdx, qword [rcx]
lea rbx, [rdx + 7]
and rbx, 0xfffffffffffffff8
neg ebx
mov rsi, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rax + 0x128]
mov dword [0x009d02e0], ebx
mov dword [0x009d02e4], edx
mov dword [0x009d02e8], esi
mov dword [0x009d02ec], ecx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
lea rax, [0x0073713a]
mov ebx, 0x2b
call fcn.00436360
lea rax, [0x0073b29d]
mov ebx, 0x3d
nop dword [rax]
call fcn.00436360
nop
call fcn.00460d80
jmp fcn.0044cf40