joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42138e
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x70], rax
movsd qword [rsp + 0x78], xmm0
test byte [rax], al
nop
call fcn.0040b500
mov rcx, r14
mov rax, qword [rsp + 0x70]
cmp qword [rax + 8], rcx
jne 0x42137c
movsd xmm0, qword [0x0073fe80]
movsd xmm1, qword [rsp + 0x78]
ucomisd xmm0, xmm1
jbe 0x421193
movsd xmm1, qword [0x0073fe80]
movsd qword [rsp + 0x58], xmm1
movsd xmm0, qword [rax + 0x30]
divsd xmm1, xmm0
cvttsd2si rcx, xmm1
mov qword [rsp + 0x48], rcx
cmp qword [rax + 0x80], 0
je 0x4211d8
nop
nop
call fcn.0040b760
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x80]
mov rbx, qword [rdx]
mov rax, qword [rsp + 0x48]
call rbx
jmp 0x4212ae
nop
call fcn.00461b20
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rsp]
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x48]
add rbx, rdx
mov rsi, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov r10, qword [rcx + 0x30]
nop
mov rax, rcx
mov rcx, rsi
mov rsi, r8
mov r8, r9
mov r9, r10
call fcn.0044f460
mov rbx, qword [rsp + 0x70]
mov byte [rbx + 0x10], 1
nop
lea rax, [0x006f4e60]
mov ecx, 0x13
mov edi, 0xe
mov esi, 2
call fcn.00436100
call fcn.00461b20
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x38]
sub rax, rcx
mov qword [rsp + 0x40], rax
nop
nop
mov rax, qword [rsp + 0x70]
call fcn.0040b500
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
mov rax, rcx
call fcn.0044ee20
nop
nop
mov rax, qword [rsp + 0x70]
call fcn.0040b760
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rcx + 0x70]
test rbx, rbx
jle 0x4212e6
movsd xmm0, qword [rsp + 0x58]
cvttsd2si rdx, xmm0
add rax, rdx
cmp rbx, rax
jge 0x4212d9
mov qword [rcx + 0x70], 0
jmp 0x4212e0
sub rbx, rax
mov qword [rcx + 0x70], rbx
add rsp, 0x60
pop rbp
ret
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
movsd xmm1, qword [rsp + 0x58]
addsd xmm0, xmm1
movsd qword [rsp + 0x50], xmm0
mov rdx, qword [rcx + 0x98]
mov rax, qword [rdx]
call rax
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm2, qword [rsp + 0x50]
mulsd xmm0, xmm2
movsd xmm1, qword [rsp + 0x58]
divsd xmm1, xmm0
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 0x38]
movups xmm0, xmm1
movsd xmm1, qword [0x0073fe28]
mov rax, rcx
nop dword [rax]
call fcn.004228c0
mov rcx, qword [rsp + 0x70]
movsd qword [rcx + 0x30], xmm0
test al, al
jne 0x421376
movsd xmm0, qword [0x0073fe20]
movsd qword [rcx + 0x30], xmm0
movabs rdx, 0x12a05f200
mov qword [rcx + 0x70], rdx
mov rax, rcx
call fcn.004213c0
add rsp, 0x60
pop rbp
ret
lea rax, [0x006d4708]
mov ebx, 0x2f
call fcn.004341e0
nop
mov qword [rsp + 8], rax
movsd qword [rsp + 0x10], xmm0
call fcn.0045df00
mov rax, qword [rsp + 8]
movsd xmm0, qword [rsp + 0x10]
jmp fcn.00421140
Function at 0x421420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4215ae
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
test byte [rax], al
nop
call fcn.0040b500
mov rcx, r14
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], rcx
jne 0x42159c
nop
call fcn.0040b760
xorps xmm0, xmm0
xor eax, eax
jmp 0x421464
movups xmm0, xmm1
mov rax, rcx
movsd xmm1, qword [0x0073fe80]
ucomisd xmm1, xmm0
jbe 0x421566
movsd qword [rsp + 0x18], xmm0
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x90]
mov rcx, qword [rdx]
call rcx
test al, al
jne 0x421559
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x88]
mov rbx, qword [rdx]
mov eax, 0x10000
call rbx
test rbx, rbx
jne 0x421513
mov rcx, qword [0x0092d5e0]
nop dword [rax]
test rcx, rcx
je 0x421597
mov rdx, rax
mov rbx, rdx
xor edx, edx
div rcx
test rax, rax
jl 0x4214e3
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
jmp 0x4214fb
mov rcx, rax
and eax, 1
shr rcx, 1
or rcx, rax
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
movsd xmm2, qword [0x0073fe68]
mulsd xmm1, xmm2
movsd xmm3, qword [rsp + 0x18]
addsd xmm1, xmm3
jmp 0x421530
xorps xmm1, xmm1
cvtsi2sd xmm1, rbx
movsd xmm2, qword [rsp + 0x18]
addsd xmm1, xmm2
mov rbx, rax
movsd xmm2, qword [0x0073fe68]
mov rcx, qword [rsp + 0x10]
add rcx, rbx
nop dword [rax + rax]
cmp rbx, 0x10000
jb 0x42156c
cmp qword [0x0092d6f8], 0
je 0x42145e
jmp 0x42156c
mov rcx, qword [rsp + 0x10]
movsd xmm1, qword [rsp + 0x18]
jmp 0x42156c
mov rcx, rax
movups xmm1, xmm0
test rcx, rcx
jbe 0x42157a
cmp qword [0x0092d5e0], rcx
ja 0x421586
mov rax, rcx
movups xmm0, xmm1
add rsp, 0x20
pop rbp
ret
lea rax, [0x006d4135]
mov ebx, 0x2e
call fcn.004341e0
call fcn.00432ee0
lea rax, [0x006d3c09]
mov ebx, 0x2d
call fcn.004341e0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00421420
Function at 0x421680
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421786
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x4216c3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x42177b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00422220
test rax, rax
je 0x42177b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x004217c0]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0045dde0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x421769
xor eax, eax
jmp 0x421773
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x4216b1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00421680
Function at 0x422c20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422d53
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x38]
test rdx, rdx
jne 0x422c76
call fcn.00425140
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x422ce8
mov rdi, qword [rax]
lea r8, [rsi - 1]
mov r9, rbx
sub rbx, rdi
cmp r8, 0x3f
jae 0x422d45
shl r8, 5
mov edi, dword [rdx + r8 + 0x20]
add edi, dword [rdx + r8 + 0x24]
cmp edi, ebx
ja 0x422d32
cmp rsi, 0x3f
jne 0x422ceb
mov qword [rsp + 0x10], rdx
call fcn.00425140
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x38], rax
mov r9, qword [rsp + 0x30]
mov rdx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
jmp 0x422ceb
mov r9, rbx
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x3f
jae 0x422d25
mov rsi, rbx
shl rbx, 5
inc rsi
mov qword [rdx + 0x10], rsi
mov rsi, qword [rax]
sub r9, rsi
mov dword [rdx + rbx + 0x20], r9d
mov esi, dword [rcx + 4]
mov dword [rdx + rbx + 0x24], esi
nop
mov qword [rdx + rbx + 0x28], rcx
inc qword [rax + 0x40]
add rsp, 0x18
pop rbp
ret
mov rax, rbx
mov ecx, 0x3f
call fcn.004601e0
lea rax, [0x006d27e2]
mov ebx, 0x29
nop
call fcn.004341e0
mov rax, r8
mov ecx, 0x3f
call fcn.004601e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00422c20

Function at 0x423040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4230d7
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp dword [0x008bf540], ebx
je 0x42305f
jmp 0x4230c5
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
and ecx, 0x7fffffff
dec ecx
cmp ecx, 0x80000000
jae 0x4230b3
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x42305c
cmp edx, 0x80000000
jne 0x4230ad
cmp dword [0x0092dd38], 0
jle 0x4230a7
nop
mov rax, qword [0x0092e528]
nop
mov rax, qword [0x008bf568]
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d0147]
mov ebx, 0x23
nop
call fcn.004341e0
lea rax, [0x006d4f20]
mov ebx, 0x31
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.0045df00
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.00423040
Function at 0x423100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423209
push rbp
mov rbp, rsp
sub rsp, 0x30
call fcn.00423460
cmp rax, 0xffffffffffffffff
jne 0x423112
nop
mov edx, dword [0x008a71d4]
test edx, 0x7fffffff
jne 0x4231f7
mov eax, dword [0x008bf540]
mov dword [rsp + 0x14], eax
xor ecx, ecx
jmp 0x4231a0
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x28], rdx
lea rcx, [rbx + rbx*4]
mov qword [rsp + 0x20], rcx
lea rax, [rdi + rcx*8]
lea rax, [rax + 8]
call fcn.0042e420
mov rcx, qword [rsp + 0x28]
lea rdx, [0x008bf880]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 0x58]
mov rdx, qword [rsp + 0x20]
lea rax, [rcx + rdx*8]
mov rcx, qword [rsp + 0x18]
inc rcx
mov qword [rsp + 0x28], rcx
call fcn.0042e420
mov ecx, dword [rsp + 0x14]
mov rdx, qword [rsp + 0x28]
mov eax, ecx
mov rcx, rdx
nop dword [rax + rax]
cmp rcx, 0x88
jge 0x4231d3
lea rdx, [rcx + rcx*2]
shl rdx, 6
mov ebx, eax
shr ebx, 1
and ebx, 1
dec ebx
neg ebx
lea rsi, [0x008bf880]
lea rdi, [rsi + rdx]
cmp rbx, 2
jb 0x42313e
jmp 0x4231eb
lea rax, [0x008a7720]
call fcn.004210c0
nop
call fcn.00428480
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 2
call fcn.004601e0
lea rax, [0x006d37dd]
mov ebx, 0x2c
call fcn.004341e0
nop
call fcn.0045df00
jmp fcn.00423100
Function at 0x4255a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x425686
push rbp
mov rbp, rsp
sub rsp, 0x10
nop
nop
lea rax, [0x008a7e90]
nop dword [rax + rax]
call fcn.0040b500
cmp qword [0x008a7e00], 0
jne 0x425672
mov qword [0x008a7e48], 0
mov rcx, qword [0x008a7ea8]
test rcx, rcx
jne 0x42560c
nop
nop
lea rax, [0x008a7e90]
call fcn.0040b760
add rsp, 0x10
pop rbp
ret
lea rdx, [0x008a7e98]
mov qword [rcx + 0x10], rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x4255fe
mov rcx, qword [0x008a7e98]
test rcx, rcx
je 0x425649
mov rdx, qword [0x008a7eb0]
mov qword [rdx], rcx
mov rcx, qword [0x008a7e98]
mov rdx, qword [0x008a7eb0]
mov qword [rcx + 8], rdx
mov rcx, qword [0x008a7ea8]
mov qword [0x008a7e98], rcx
jmp 0x425665
mov rcx, qword [0x008a7ea8]
mov rdx, qword [0x008a7eb0]
mov qword [0x008a7e98], rcx
mov qword [0x008a7ea0], rdx
movups xmmword [0x008a7ea8], xmm15
jmp 0x4255ea
lea rax, [0x006d21b4]
mov ebx, 0x28
nop
call fcn.004341e0
nop
call fcn.0045df00
jmp fcn.004255a0

Function at 0x426520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x426551
push rbp
mov rbp, rsp
sub rsp, 0x18
test cl, cl
je 0x42653f
xor edi, edi
call fcn.004268c0
add rsp, 0x18
pop rbp
ret
lea rax, [0x006d6e58]
mov ebx, 0x3c
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop
call fcn.00464ae0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00426520

Function at 0x426660
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x426778
push rbp
mov rbp, rsp
sub rsp, 0x10
xor edx, edx
jmp 0x426690
sub r11, rbx
mov rdi, r11
shr r11, 0xd
lea rbx, [rdi + r9]
sub r10, r11
mov rax, rcx
mov rcx, r10
mov edx, r12d
test rcx, rcx
jbe 0x426719
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
nop
cmp rdi, 0x40
jae 0x42676a
test byte [rax], al
mov rdi, qword [rax + rdi*8 + 0x101d8]
test byte [rdi], al
mov r9, rbx
and ebx, 0x3fffff
mov r10, rcx
shl rcx, 0xd
lea r11, [rcx + rbx]
shr r8, 0x16
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x10c8]
cmp r8, rbx
seta r12b
or r12d, edx
nop dword [rax + rax]
cmp r11, 0x400000
jbe 0x426727
mov r11d, 0x400000
jmp 0x426727
mov rcx, rax
jmp 0x426676
mov eax, edx
add rsp, 0x10
pop rbp
ret
mov rax, rcx
mov r8, rdx
cmp r11, r8
jbe 0x426711
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x10c8], r11
sete dl
nop
test dl, dl
jne 0x426676
mov rdx, qword [rdi + 0x10c8]
cmp rdx, r11
ja 0x426721
cmp rdx, rbx
jbe 0x426721
lea rax, [0x006d57eb]
mov ebx, 0x33
call fcn.004341e0
mov rax, rdi
mov ecx, 0x40
call fcn.00460200
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax + rax]
jmp fcn.00426660
Function at 0x428600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428715
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp qword [0x00871da0], 0x15
nop word [rax + rax]
ja 0x428703
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x40], dil
test byte [rax], al
cmp dword [0x0092d940], 0
je 0x428653
nop dword [rax + rax]
call fcn.0045fe40
mov qword [r11], rcx
mov rdx, qword [rax + 0x10120]
mov qword [r11 + 8], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rcx
mov qword [rax + 0x10120], rcx
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call fcn.0042d900
mov rax, qword [rsp + 0x28]
movzx ebx, byte [rsp + 0x40]
call fcn.0042a360
mov rcx, qword [0x00871280]
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x10078], rcx
cmp dword [0x0092d940], 0
nop
jne 0x4286a9
mov rdx, qword [rsp + 0x30]
jmp 0x4286c1
call fcn.0045fe40
mov rdx, qword [rsp + 0x30]
mov qword [r11], rdx
mov rsi, qword [rax + 0x10118]
mov qword [r11 + 8], rsi
mov qword [rax + 0x10118], rdx
lea rdx, [rax + 0x100b8]
movzx ebx, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rax, rdx
nop dword [rax]
call fcn.004220c0
mov rdx, qword [rsp + 0x28]
add qword [rdx + 0x10128], rax
movzx esi, byte [rsp + 0x40]
mov byte [rdx + 0x10131], sil
add rsp, 0x18
pop rbp
ret
lea rax, [0x006d3341]
mov ebx, 0x2b
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00428600
Function at 0x42cf20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42d019
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x0092dd50]
test ecx, ecx
je 0x42cff2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x0042d040]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.0045dde0
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x42cfec
jae 0x42d00e
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.0043fb20]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.004601e0
nop
mov qword [rsp + 8], rax
nop
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.0042cf20

Function at 0x42d3a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42d3e6
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test rcx, rcx
je 0x42d3d0
lea rbx, [0x006f4e48]
call fcn.0042d400
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d3809]
mov ebx, 0x2c
nop dword [rax]
call fcn.004341e0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.0042d3a0

Function at 0x42d7a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42d7e7
push rbp
mov rbp, rsp
sub rsp, 0x10
movabs rcx, 0x800000000000
lea rdx, [rcx + rax]
add rcx, rbx
cmp rax, rdx
setbe dl
cmp rbx, rcx
setbe cl
cmp cl, dl
jne 0x42d7d5
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d6e94]
mov ebx, 0x3c
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0042d7a0
Function at 0x42e420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42e4e8
push rbp
mov rbp, rsp
sub rsp, 0x10
nop
mov rcx, qword [rax + 0x20]
mov rdx, rcx
shr rcx, 0x20
nop
nop
cmp edx, ecx
ja 0x42e4d6
shr ecx, 9
mov rdx, qword [rax + 0x10]
cmp rdx, rcx
jbe 0x42e49e
nop
nop
mov rdx, qword [rax + 8]
lea rcx, [rdx + rcx*8]
nop
nop
mov rbx, qword [rcx]
test rbx, rbx
je 0x42e49e
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x42e4c5
mov edx, dword [rbx + 0x10]
cmp edx, 0x200
je 0x42e4b3
mov qword [rsp + 0x20], rax
nop
nop
xor edx, edx
xchg qword [rcx], rdx
nop
nop
xor ecx, ecx
xchg dword [rbx + 0x10], ecx
lea rax, [0x0092d648]
call fcn.0040b380
mov rax, qword [rsp + 0x20]
nop
nop
xor ecx, ecx
xchg qword [rax + 0x20], rcx
nop
xor ecx, ecx
xchg qword [rax + 0x10], rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d4f51]
mov ebx, 0x31
nop
call fcn.004341e0
lea rax, [0x006d5a89]
mov ebx, 0x34
call fcn.004341e0
lea rax, [0x006d018d]
mov ebx, 0x23
call fcn.004341e0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.0042e420
Function at 0x42e8c0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42eb46
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1298]
mov rcx, qword [rax + 0x1288]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42eb3a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1288], 0
cmp byte [0x0092d4df], 0
jne 0x42e91a
xor edx, edx
xor ebx, ebx
jmp 0x42e960
xor edx, edx
jmp 0x42e945
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1298]
mov rax, rcx
call fcn.0041f260
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42e91e
add rax, 0x1288
call fcn.0042e840
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42ead4
mov rsi, qword [rax + rdx*8 + 0x1298]
cmp rsi, 0x1000
jb 0x42e95b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00413aa0
test rax, rax
jne 0x42e9ac
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42e95b
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42e9ec
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42e95b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42eb2d
lea r10, [0x008bf5d8]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x42ea6f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42eaa5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1270]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1270], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42e95b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42eb25
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1298], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42e95b
cmp rbx, 0x200
ja 0x42eb14
lea rdx, [rax + 0x1298]
lea rsi, [rax + 0x1260]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00424c40
mov rax, qword [rsp + 0x48]
add rax, 0x1288
call fcn.0042e840
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00460260
mov rax, r8
call fcn.004601e0
mov rax, r8
mov ecx, 0x40
call fcn.00460200
mov edx, 0x200
nop
call fcn.00460240
nop
mov qword [rsp + 8], rax
call fcn.00464ae0
mov rax, qword [rsp + 8]
jmp fcn.0042e8c0
Function at 0x42f6e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f789
push rbp
mov rbp, rsp
sub rsp, 0x30
xor eax, eax
lea rcx, [0x0092d51c]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
jne 0x42f711
add rsp, 0x30
pop rbp
ret
mov rax, qword [0x00871288]
mov rcx, qword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.00431c20
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
je 0x42f760
add rsp, 0x30
pop rbp
ret
call fcn.00461660
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x006d581e]
mov ebx, 0x33
call fcn.004341e0
nop
call fcn.0045df00
jmp fcn.0042f6e0
Function at 0x431e20
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x60], 0
mov rcx, qword [0x0092d718]
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x3c0], 8
lea rdx, [rsp + 0x20]
mov qword [rcx + 0x3c8], rdx
mov rax, qword [rsp + 0x18]
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.004319c0
mov qword [rsp + 0x60], rax
add rsp, 8
pop rbp
ret
Function at 0x432de0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x432e5d
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov ecx, 0x3e
mov rax, qword [rsp + 0x38]
lea rbx, [0x006d71f0]
call fcn.004325e0
movups xmmword [rsp + 0x18], xmm15
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], 0
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x18], rdx
mov byte [rsp + 0x28], 1
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov byte [rsp + 0x29], 8
lea rax, [0x006a9fe0]
lea rbx, [rsp + 0x18]
call fcn.0040a760
mov rbx, rax
lea rax, [0x006a9fe0]
call fcn.004337c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x432de0
mov rax, rdx
jmp 0x432de0