joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4356c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43573d
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov ecx, 0x3e
mov rax, qword [rsp + 0x38]
lea rbx, [0x006c3af3]
call fcn.00434d80
movups xmmword [rsp + 0x18], xmm15
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], 0
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x18], rdx
mov byte [rsp + 0x28], 1
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov byte [rsp + 0x29], 8
lea rax, [0x006965a0]
lea rbx, [rsp + 0x18]
call fcn.0040ac60
mov rbx, rax
lea rax, [0x006965a0]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4356c0
mov rax, rdx
jmp 0x4356c0

Function at 0x435880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43596d
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rcx, qword [r14 + 0x30]
mov rdx, r14
nop dword [rax]
cmp qword [rcx + 0x90], rdx
jne 0x43595b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x28], rax
call fcn.00435a40
cmp qword [rax + 0x20], 0
jne 0x43594a
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x28]
cmp dword [0x00921500], 0
jne 0x4358e2
mov rbx, qword [rsp + 0x28]
nop
jmp 0x43590f
call fcn.00466640
mov qword [r11], rdx
mov rbx, qword [rax + 0x28]
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rax
mov rbx, qword [rcx + 0x28]
mov qword [r11 + 0x18], rbx
mov rbx, qword [rsp + 0x28]
mov qword [r11 + 0x20], rbx
mov rsi, qword [rax + 0x18]
mov qword [r11 + 0x28], rsi
mov qword [rax + 0x28], rdx
mov qword [rcx + 0x28], rax
mov qword [rax + 0x18], rbx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x28]
mov qword [rax + 8], rcx
call fcn.00466540
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x18
pop rbp
ret
lea rax, [0x006bebf5]
mov ebx, 0x28
call fcn.00437240
lea rax, [0x006b605b]
mov ebx, 0x15
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00435880
Function at 0x435fa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4360af
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x10], r14
mov rcx, qword [rsp + 0x10]
jmp 0x435fd6
mov qword [rcx + 0x28], rbx
call fcn.00435c40
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rdx]
call rcx
mov rcx, qword [rsp + 0x10]
mov rax, qword [rcx + 0x28]
nop word [rax + rax]
test rax, rax
je 0x436097
lea rdx, [rsp + 0x38]
cmp qword [rax + 8], rdx
jne 0x436091
cmp byte [rax + 2], 0
jne 0x436046
mov rdx, qword [rax + 0x18]
cmp dword [0x00921500], 0
je 0x436017
mov rbx, qword [rax + 0x18]
call fcn.004665a0
mov qword [r11], rbx
mov qword [rsp + 0x18], rdx
mov qword [rax + 0x18], 0
mov rbx, qword [rax + 0x28]
cmp dword [0x00921500], 0
je 0x435fbe
call fcn.004665c0
mov qword [r11], rbx
mov rsi, qword [rcx + 0x28]
mov qword [r11 + 8], rsi
jmp 0x435fbe
mov qword [rsp + 0x20], rax
call fcn.004366c0
test al, al
je 0x43609d
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x28]
cmp dword [0x00921500], 0
jne 0x43606d
mov rdx, qword [rsp + 0x10]
jmp 0x436082
call fcn.004665c0
mov qword [r11], rcx
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rdx + 0x28]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x28], rcx
call fcn.00435c40
add rsp, 0x28
pop rbp
ret
add rsp, 0x28
pop rbp
ret
add rsp, 0x28
pop rbp
ret
lea rax, [0x006bfb19]
mov ebx, 0x2b
call fcn.00437240
nop
call fcn.004646a0
jmp fcn.00435fa0

Function at 0x4377c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x437907
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x10], r14
cmp qword [0x008f9d88], 0
nop
jne 0x4377fd
call fcn.00438be0
lea rax, [0x006c09c8]
mov ebx, 0x2e
call fcn.00439460
call fcn.00438c40
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
jge 0x437823
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x4378b2
cmp edx, 1
je 0x437881
cmp edx, 2
jne 0x43786f
mov dword [rcx + 0xdc], 3
call fcn.00438be0
lea rax, [0x006b79ea]
mov ebx, 0x18
call fcn.00439460
nop
call fcn.00438c40
mov eax, 4
call fcn.004331e0
mov eax, 5
call fcn.004331e0
xor eax, eax
add rsp, 0x18
pop rbp
ret
mov dword [rcx + 0xdc], 2
call fcn.00438be0
lea rax, [0x006b5191]
mov ebx, 0x13
nop dword [rax]
call fcn.00439460
call fcn.00438c40
xor eax, eax
add rsp, 0x18
pop rbp
ret
mov dword [rcx + 0xdc], 1
nop
mov ecx, 1
lea rdx, [0x00921104]
lock xadd dword [rdx], ecx
nop
nop
lea rax, [0x00921218]
call fcn.0040b580
cmp dword [0x00921914], 0
jg 0x4378ed
cmp dword [0x00921910], 0
jle 0x4378f7
mov eax, 1
call fcn.00445140
call fcn.0043b100
mov eax, 1
add rsp, 0x18
pop rbp
ret
call fcn.004646a0
jmp fcn.004377c0
Function at 0x43a960
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43abcb
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], r14
mov dword [0x008cdab8], 0x2710
lea rax, [0x008938e0]
jmp 0x43a9a0
mov qword [rsp + 0x20], rax
call fcn.00451560
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x248]
test rax, rax
jne 0x43a98a
xor eax, eax
jmp 0x43a9c6
mov rcx, rax
shl rcx, 6
lea rdx, [0x009219c0]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 8]
inc rax
movups xmmword [rcx], xmm15
cmp rax, 2
jl 0x43a9a9
xor eax, eax
jmp 0x43a9e8
mov rcx, rax
shl rcx, 4
lea rdx, [0x00922588]
add rcx, rdx
inc rax
movups xmmword [rcx], xmm15
cmp rax, 0x23
jl 0x43a9d0
call fcn.0040be40
nop
xor eax, eax
xor ebx, ebx
call fcn.00401020
movzx eax, byte [0x00921b2a]
mov byte [0x009210af], al
movzx eax, byte [0x00921b2f]
mov byte [0x009210b0], al
movzx eax, byte [0x00921b27]
mov byte [0x009210b1], al
call fcn.00404a00
nop
lea rax, [0x00921260]
mov ebx, 8
mov rcx, rbx
call fcn.00432f00
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rcx
call fcn.0043ace0
call fcn.00451340
nop dword [rax + rax]
call fcn.0045c240
call fcn.0040a980
call fcn.0044f2c0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
test byte [rax], al
call fcn.00432fa0
nop
call fcn.00447600
call fcn.00419a20
cmp byte [0x008bcfa0], 0
je 0x43aa9e
mov qword [0x0088c520], 0
nop
nop
lea rax, [0x008cda98]
call fcn.0040b580
nop
call fcn.00468220
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp]
nop
lea rdx, [0x008cda88]
xchg qword [rdx], rcx
mov ecx, dword [0x00921120]
mov dword [rsp + 0x1c], ecx
lea rax, [0x006b1d4c]
mov ebx, 0xa
call fcn.00407ca0
call fcn.004503e0
movsxd rcx, eax
cmp rax, rcx
sete cl
mov edx, 0
cmove edx, eax
and ecx, ebx
test cl, cl
je 0x43ab0e
test edx, edx
jg 0x43ab12
mov edx, dword [rsp + 0x1c]
mov eax, edx
call fcn.00443840
nop dword [rax]
test rax, rax
jne 0x43abb9
nop
nop
lea rax, [0x008cda98]
call fcn.0040b7a0
cmp qword [0x008bdbd8], 0
nop
jne 0x43ab76
mov qword [0x008bdbd8], 7
cmp dword [0x00921500], 0
je 0x43ab68
mov rax, qword [str.go1.21.1]
nop dword [rax]
call fcn.004665a0
mov qword [r11], rax
lea rax, [0x006b1052]
mov qword [str.go1.21.1], rax
cmp qword [0x008bdc98], 1
nop
jne 0x43abb3
mov qword [0x008bdc98], 0
cmp dword [0x00921500], 0
je 0x43aba8
mov rax, qword [0x008bdc90]
nop dword [rax]
call fcn.004665a0
mov qword [r11], rax
mov qword [0x008bdc90], 0
add rsp, 0x30
pop rbp
ret
lea rax, [0x006bfb6f]
mov ebx, 0x2b
call fcn.00437240
nop
call fcn.004646a0
jmp 0x43a960
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x43a960
Function at 0x43c320
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c599
push rbp
mov rbp, rsp
sub rsp, 0x58
cmp byte [0x008d3208], 0
je 0x43c345
nop dword [rax + rax]
call fcn.004572e0
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jg 0x43c587
mov qword [rsp + 0x40], r14
nop
nop
lea rax, [0x008cda98]
call fcn.0040b580
mov ecx, dword [0x0092111c]
mov dword [0x008cdb6c], ecx
nop
nop
mov ecx, 1
lea rdx, [0x008cdb68]
xchg byte [rdx], cl
call fcn.00445020
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0xa0]
mov dword [rcx + 4], 3
dec dword [0x008cdb6c]
mov rcx, qword [0x008cc590]
mov qword [rsp + 0x50], rcx
mov rdx, qword [0x008cc598]
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x43c3c7
lea rax, [rsi + 1]
cmp rax, rdx
jge 0x43c456
mov rbx, qword [rcx + rax*8]
cmp dword [rbx + 4], 2
jne 0x43c3f2
mov rsi, rax
mov eax, 2
mov edi, 3
lock cmpxchg dword [rbx + 4], edi
sete r8b
jmp 0x43c400
mov rsi, rax
mov edi, 3
xor r8d, r8d
nop dword [rax]
test r8b, r8b
je 0x43c3c3
cmp byte [0x008d3208], 0
je 0x43c448
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
nop dword [rax + rax]
call fcn.00457940
mov rax, qword [rsp + 0x38]
call fcn.00457220
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
mov edi, 3
inc dword [rbx + 0x14]
dec dword [0x008cdb6c]
jmp 0x43c3c3
nop
call fcn.00468220
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x18], rax
jmp 0x43c48b
mov dword [rax + 4], 3
dec dword [0x008cdb6c]
mov rax, qword [rsp + 0x18]
call fcn.00445f80
test rax, rax
jne 0x43c479
nop
nop
mov ecx, dword [0x008cdb6c]
mov dword [rsp + 0x14], ecx
lea rax, [0x008cda98]
call fcn.0040b7a0
mov ecx, dword [rsp + 0x14]
test ecx, ecx
jle 0x43c4dd
jmp 0x43c4bc
call fcn.00445020
lea rax, [0x008cdb70]
mov ebx, 0x186a0
call fcn.0040bcc0
test al, al
je 0x43c4b7
nop
mov qword [0x008cdb70], 0
cmp dword [0x008cdb6c], 0
jne 0x43c4ff
mov rcx, qword [0x008cc590]
mov rdx, qword [0x008cc598]
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x43c57a
mov eax, 0x29
lea rcx, [0x006bf1f3]
mov dl, byte [0x009210b9]
test dl, dl
je 0x43c545
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rcx
nop
nop
lea rax, [0x00921220]
call fcn.0040b580
nop
nop
lea rax, [0x00921220]
call fcn.0040b580
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
test rax, rax
jne 0x43c550
add rsp, 0x58
pop rbp
ret
mov rbx, rax
mov rax, rcx
call fcn.00437240
mov rdi, qword [rcx + rax*8]
inc rax
cmp dword [rdi + 4], 3
mov edi, 0x2e
cmovne rbx, rdi
lea r8, [0x006c09f6]
cmovne rsi, r8
cmp rax, rdx
jl 0x43c55b
mov rax, rbx
mov rcx, rsi
jmp 0x43c50b
lea rax, [0x006b90fc]
mov ebx, 0x1b
call fcn.00437240
nop
mov byte [rsp + 8], al
nop dword [rax]
call fcn.004646a0
movzx eax, byte [rsp + 8]
jmp fcn.0043c320
Function at 0x43c5c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c794
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x009210ec]
test edx, edx
je 0x43c606
xor eax, eax
call fcn.00431760
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.004401a0
nop
nop
lea rax, [0x008cda98]
call fcn.0040b580
mov ecx, dword [0x00921124]
mov edx, dword [0x0092111c]
test ecx, ecx
je 0x43c630
mov dword [0x00921124], 0
jmp 0x43c632
mov ecx, edx
mov eax, ecx
call fcn.00443840
mov qword [rsp + 0x40], rax
nop
nop
xor ecx, ecx
lea rdx, [0x008cdb68]
xchg byte [rdx], cl
mov cl, byte [0x008cdb78]
test cl, cl
je 0x43c66e
nop
nop
xor ecx, ecx
lea rdx, [0x008cdb78]
xchg byte [rdx], cl
lea rax, [0x008cdb80]
call fcn.0040b880
nop
nop
lea rax, [0x008cda98]
call fcn.0040b7a0
mov rcx, qword [rsp + 0x40]
jmp 0x43c688
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x43c6e7
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rax, rax
je 0x43c6cf
nop
mov qword [rcx + 0x38], 0
cmp qword [rax + 0xa8], 0
jne 0x43c782
lea rdx, [rax + 0x118]
nop
mov qword [rax + 0xa8], rcx
mov rax, rdx
call fcn.0040b880
jmp 0x43c683
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
call fcn.0043d920
jmp 0x43c683
nop
call fcn.00468220
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
cmp byte [0x008d3208], 0
je 0x43c743
mov rdx, qword [r14 + 0x30]
nop
cmp byte [rdx + 0x279], 0
je 0x43c743
mov byte [rdx + 0x279], 0
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.004560c0
mov rax, qword [rsp + 0x28]
call fcn.0043e4c0
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
nop
mov dword [rax + 0xd8], edx
nop dword [rax]
cmp ecx, 1
jne 0x43c777
cmp byte [r14 + 0xb1], 0
je 0x43c777
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
add rsp, 0x50
pop rbp
ret
lea rax, [0x006bd83b]
mov ebx, 0x25
call fcn.00437240
nop
call fcn.004646a0
jmp fcn.0043c5c0
Function at 0x43d280
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
mov byte [rsp + 0x48], al
cmp byte [0x009210ae], 0
jne 0x43d2b6
nop
mov eax, 2
lea rbx, [0x006bf6f6]
mov ecx, 0x2a
call fcn.00455ee0
mov eax, 1
call fcn.004331e0
call fcn.0043d860
mov qword [rsp + 0x28], rax
mov byte [rax + 0xf8], bl
mov qword [rsp], rax
call fcn.00468260
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp], rcx
call fcn.004663a0
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov qword [rsp + 0x30], r14
lea rax, [rsp + 0x48]
add rax, 0x400
mov qword [r14 + 8], rax
lea rax, [rsp + 0x48]
add rax, 0xffffffffffff8000
mov qword [r14], rax
movzx eax, byte [rsp + 0x48]
test al, al
jne 0x43d339
cmp qword [0x008cc220], 0
jne 0x43d342
mov rcx, qword [rsp + 0x30]
nop
jmp 0x43d39d
movups xmmword [rsp + 0x18], xmm15
mov rax, qword [0x008cc220]
mov qword [rsp], rax
lea rax, [rsp + 0x18]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00466160
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
nop dword [rax]
test rax, rax
je 0x43d398
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rcx + 8], rax
jmp 0x43d39d
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
add rax, 0x13a0
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x28]
mov byte [rax + 0xea], 0
call fcn.00464480
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00433d40
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x90]
mov ebx, 6
mov ecx, 3
call fcn.0043bae0
nop
mov eax, 0xffffffff
lea rcx, [0x008cdac8]
lock xadd dword [rcx], eax
add rsp, 0x38
pop rbp
ret
Function at 0x43d920
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43da6f
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043cfa0
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43da27
mov rcx, qword [rdx + 0x30]
test rcx, rcx
je 0x43da27
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x238], 0
jne 0x43d995
cmp byte [rcx + 0xe8], 0
je 0x43da27
nop
nop
lea rax, [0x009216e0]
nop
call fcn.0040b580
cmp dword [0x00921700], 0
je 0x43da5d
mov rcx, qword [0x009216e8]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x128], rcx
nop
mov qword [0x009216e8], rdx
cmp byte [0x009216f0], 0
je 0x43d9e9
mov byte [0x009216f0], 0
lea rax, [0x009216f8]
call fcn.0040b880
nop
nop
lea rax, [0x009216e0]
call fcn.0040b7a0
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43da21
cmp byte [r14 + 0xb1], 0
je 0x43da21
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x20
pop rbp
ret
call fcn.0043daa0
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43da57
cmp byte [r14 + 0xb1], 0
je 0x43da57
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x20
pop rbp
ret
lea rax, [0x006bf720]
mov ebx, 0x2a
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043d920
Function at 0x43e600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43e85c
push rbp
mov rbp, rsp
sub rsp, 0x48
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x130]
nop dword [rax]
test rdx, rdx
je 0x43e84a
mov rdx, qword [rdx + 0xd0]
cmp rdx, rcx
jne 0x43e84a
mov qword [rsp + 0x38], r14
cmp qword [rcx + 0xa0], 0
je 0x43e652
call fcn.00444260
call fcn.0043e1a0
mov eax, 1
call fcn.004443c0
mov qword [rsp + 0x30], r14
mov rax, qword [r14 + 0x30]
test byte [rax], al
add rax, 0x118
nop
call fcn.0040b900
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x118], 0
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x130]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43e6d2
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.004440c0
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
add rsp, 0x48
pop rbp
ret
mov dword [rsp + 0x14], ebx
call fcn.00438be0
lea rax, [0x006bfbc5]
mov ebx, 0x2b
call fcn.00439460
mov eax, dword [rsp + 0x14]
mov eax, eax
call fcn.004391a0
lea rax, [0x006bd26b]
mov ebx, 0x24
call fcn.00439460
call fcn.00438c40
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x130]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x20], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00438be0
lea rax, [0x006b4a40]
mov ebx, 0x12
call fcn.00439460
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
call fcn.004393e0
lea rax, [0x006b108a]
mov ebx, 7
call fcn.00439460
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.004391a0
lea rax, [0x006b509a]
mov ebx, 0x13
call fcn.00439460
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x20], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00438be0
lea rax, [0x006b4a52]
mov ebx, 0x12
nop
call fcn.00439460
mov rax, qword [rsp + 0x28]
call fcn.004393e0
lea rax, [0x006b108a]
mov ebx, 7
nop dword [rax + rax]
call fcn.00439460
mov rax, qword [rsp + 0x18]
call fcn.004391a0
lea rax, [0x006b51a4]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00439460
mov rax, qword [rsp + 0x20]
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006b7fb2]
mov ebx, 0x19
call fcn.00437240
lea rax, [0x006bbd66]
mov ebx, 0x21
call fcn.00437240
nop
nop dword [rax]
call fcn.004646a0
jmp fcn.0043e600
Function at 0x440e20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x44108b
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
cmp byte [0x008d3208], 0
nop
je 0x440e5c
nop
mov eax, 0x14
xor ebx, ebx
xor ecx, ecx
mov rdi, rbx
mov rsi, rbx
call fcn.004560c0
mov rax, qword [rsp + 0x60]
nop
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
jne 0x440f67
cmp byte [rax + 0xb4], 0
je 0x440e9c
mov rcx, qword [rax + 0x40]
mov rax, rcx
call fcn.00452260
test rax, rax
je 0x440f56
movzx edx, byte [rax + 0x29]
test dl, 2
jne 0x440ef0
mov rax, qword [rsp + 0x60]
mov ebx, 2
mov ecx, 0x1009
call fcn.0043bf20
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
xor esi, esi
nop
nop
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
xor esi, esi
nop
mov qword [rdx + 0x90], rsi
mov rax, qword [rsp + 0x60]
mov ebx, 0x1009
mov ecx, 9
nop dword [rax + rax]
call fcn.0043b640
call fcn.00440480
add rsp, 0x50
pop rbp
ret
mov ecx, dword [rax + 4]
mov rax, rbx
mov ebx, ecx
call fcn.00451ec0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rbx
call fcn.00438be0
lea rax, [0x006bd860]
mov ebx, 0x25
call fcn.00439460
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
call fcn.00439460
lea rax, [0x006b4a76]
mov ebx, 0x12
call fcn.00439460
nop dword [rax]
call fcn.00438c40
lea rax, [0x006b38a4]
mov ebx, 0xf
call fcn.00437240
lea rax, [0x006b60d9]
mov ebx, 0x15
call fcn.00437240
mov qword [rsp + 0x48], r14
nop
nop
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x30], rdx
call fcn.00438be0
lea rax, [0x006b4a40]
mov ebx, 0x12
call fcn.00439460
mov rax, qword [rsp + 0x60]
call fcn.004393e0
lea rax, [0x006b108a]
mov ebx, 7
call fcn.00439460
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.004391a0
lea rax, [0x006b509a]
mov ebx, 0x13
call fcn.00439460
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x30], rdx
call fcn.00438be0
lea rax, [0x006b4a52]
mov ebx, 0x12
nop
call fcn.00439460
mov rax, qword [rsp + 0x48]
call fcn.004393e0
lea rax, [0x006b108a]
mov ebx, 7
nop dword [rax + rax]
call fcn.00439460
mov rax, qword [rsp + 0x30]
call fcn.004391a0
lea rax, [0x006b51a4]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00439460
mov rax, qword [rsp + 0x38]
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006b2969]
mov ebx, 0xc
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.0046b280
mov rax, qword [rsp + 8]
jmp fcn.00440e20
Function at 0x445de0
Capabilities:
Encode data using base64
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x445f47
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x445df2
cmp edx, ecx
jne 0x445f35
nop word [rax + rax]
test rsi, rsi
jne 0x445f35
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x445e54
nop
call fcn.00468220
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00445d00
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x445f30
mov rdx, qword [0x008cc5b8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x445f25
mov rcx, qword [0x008cc5b0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x008cdad0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x008cdad0], rax
nop
mov edx, 1
lea rsi, [0x008cdad8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x445f13
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x006bec1d]
mov ebx, 0x28
nop
call fcn.00437240
mov rax, rsi
mov rcx, rdx
call fcn.00466960
call fcn.00435760
lea rax, [0x006bcb18]
mov ebx, 0x23
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00445de0