joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4212b6
push rbp
mov rbp, rsp
sub rsp, 0x28
cmp dword [0x009210e0], 0
je 0x4212a4
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rcx, rcx
jne 0x421094
nop
call fcn.00468220
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x10], rcx
mov rdx, qword [0x009218c0]
mov rsi, rcx
sub rcx, rdx
cmp rcx, 0x989680
jle 0x4210cd
lea rax, [0x00921880]
mov rbx, rsi
call fcn.0041c780
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x10]
test rbx, rbx
je 0x4210fa
mov rdx, qword [rbx + 0x1240]
test rdx, rdx
je 0x4210fa
cmp qword [rdx + 0x10], 0
jne 0x4210f3
mov rdx, qword [rbx + 0x1248]
cmp qword [rdx + 0x10], 0
je 0x4210fa
mov ecx, 1
jmp 0x421124
mov rdx, qword [0x008cd440]
test rdx, rdx
jne 0x42111f
mov edx, dword [0x008cd508]
cmp dword [0x008cd50c], edx
jbe 0x42111b
mov ecx, 1
jmp 0x421124
xor ecx, ecx
jmp 0x421124
mov ecx, 1
test cl, cl
je 0x42112b
nop
jmp 0x421139
xor eax, eax
mov rbx, rsi
add rsp, 0x28
pop rbp
ret
mov rax, rcx
mov rdx, qword [0x00921290]
test rdx, rdx
je 0x421172
mov rdi, rdx
sar rdx, 0x13
shl rdx, 3
nop
nop
mov r8, qword [rdx]
mov rcx, rax
mov rax, rdi
lea r9, [0x00921290]
lock cmpxchg qword [r9], r8
sete dil
test dil, dil
je 0x421136
jmp 0x421180
mov rcx, rax
lea r9, [0x00921290]
xor edx, edx
nop
test rdx, rdx
je 0x421189
test byte [rcx], al
jmp 0x421194
xor eax, eax
mov rbx, rsi
add rsp, 0x28
pop rbp
ret
nop
mov rax, qword [rcx + 0xe8]
nop dword [rax]
test rax, rax
jle 0x4211cd
mov qword [rsp + 0x18], rax
lea rdi, [rax - 1]
lock cmpxchg qword [rcx + 0xe8], rdi
sete dil
nop dword [rax + rax]
test dil, dil
je 0x421194
mov rdi, qword [rsp + 0x18]
test rdi, rdi
jg 0x42125a
movsd xmm0, qword [rcx + 0x108]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x4211e6
jnp 0x421242
mov rdi, qword [rcx + 0xe0]
mov r8, rsi
sub rsi, rdi
test rsi, rsi
jle 0x421233
test byte [rbx], al
mov rdi, qword [rbx + 0x1220]
xorps xmm1, xmm1
cvtsi2sd xmm1, rdi
xorps xmm2, xmm2
cvtsi2sd xmm2, rsi
divsd xmm1, xmm2
ucomisd xmm1, xmm0
jbe 0x421233
mov rax, r9
mov rbx, rdx
call fcn.0040b300
xor eax, eax
mov rbx, qword [rsp + 0x10]
add rsp, 0x28
pop rbp
ret
test byte [rbx], al
mov qword [rbx + 0x1230], 2
jmp 0x421267
mov rax, r9
mov rbx, rdx
call fcn.0040b300
xor eax, eax
mov rbx, qword [rsp + 0x10]
add rsp, 0x28
pop rbp
ret
test byte [rbx], al
mov qword [rbx + 0x1230], 1
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x20], rax
mov ebx, 4
mov ecx, 1
call fcn.0043bae0
cmp byte [0x008d3208], 0
je 0x421294
mov rax, qword [rsp + 0x20]
xor ebx, ebx
call fcn.00457740
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
add rsp, 0x28
pop rbp
ret
lea rax, [0x006c2958]
mov ebx, 0x36
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00421040
Function at 0x4213a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42140c
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp rbx, 1
jne 0x4213cd
lock xadd qword [rax + 0xc8], rcx
mov ecx, 1
lock xadd qword [rax + 0xe8], rcx
jmp 0x4213f4
cmp rbx, 2
jne 0x4213e0
lock xadd qword [rax + 0xd0], rcx
jmp 0x4213f4
cmp rbx, 3
jne 0x4213fa
lock xadd qword [rax + 0xd8], rcx
call fcn.00421b00
add rsp, 0x10
pop rbp
ret
lea rax, [0x006beb55]
mov ebx, 0x28
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004213a0

Function at 0x421660
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4217cb
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
call fcn.00421520
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x98]
cmp rax, rdx
jbe 0x421706
mov rsi, rax
sub rsi, rdx
shr rsi, 6
lea rdi, [rsi + rsi*4]
lea rdi, [rdi + rdi*8]
add rdi, rdx
imul rsi, rsi, 0x3d
add rsi, rdx
cmp rbx, rdx
cmovb rbx, rdx
cmp rbx, rdi
cmovb rbx, rdi
cmp rax, 0x400000
jbe 0x4216cb
lea rdx, [rax - 0x400000]
cmp rdx, rsi
ja 0x4216ce
mov rdx, rsi
nop
mov rcx, qword [rcx + 0x18]
mov rsi, rax
sub rsi, rcx
cmp rdx, rbx
cmovb rdx, rbx
cmp rax, rcx
cmovb rsi, rbx
cmp rsi, rbx
cmovb rsi, rbx
cmp rdx, rsi
cmovb rsi, rdx
cmp rax, rsi
jb 0x42170f
mov rbx, rax
mov rax, rsi
add rsp, 0x30
pop rbp
ret
mov rbx, rax
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], rbx
call fcn.00438be0
lea rax, [0x006b1549]
mov ebx, 8
call fcn.00439460
mov rax, qword [rsp + 0x10]
nop
call fcn.004391a0
lea rax, [0x006b1db0]
mov ebx, 0xa
call fcn.00439460
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
call fcn.00438be0
lea rax, [0x006b2312]
mov ebx, 0xb
call fcn.00439460
mov rax, qword [rsp + 0x18]
call fcn.004391a0
lea rax, [0x006b28fd]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00439460
mov rax, qword [rsp + 0x20]
call fcn.004391a0
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006c041f]
mov ebx, 0x2d
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.00421660
Function at 0x421960
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421a10
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rax, [0x006b1dba]
mov ebx, 0xa
nop
call fcn.00407ca0
test rbx, rbx
je 0x42199d
cmp rbx, 3
jne 0x4219ad
cmp word [rax], 0x666f
jne 0x4219ad
cmp byte [rax + 2], 0x66
jne 0x4219ad
movabs rax, 0x7fffffffffffffff
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rax
call fcn.004504c0
nop dword [rax]
test bl, bl
je 0x4219ca
add rsp, 0x20
pop rbp
ret
call fcn.00438be0
lea rax, [0x006b231d]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.00439460
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
call fcn.00439460
call fcn.00438e20
call fcn.00438c40
lea rax, [0x006c3ce3]
mov ebx, 0x3f
call fcn.00437240
nop
call fcn.004646a0
jmp fcn.00421960

Function at 0x422100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422166
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
test byte [rax], al
nop
call fcn.0040b580
mov rcx, r14
mov rbx, qword [rsp + 0x30]
cmp qword [rbx + 8], rcx
jne 0x42214f
mov byte [rbx + 0x10], 1
nop
lea rax, [0x006e0e00]
mov ecx, 0xd
mov edi, 0x14
mov esi, 2
call fcn.00439e40
add rsp, 0x20
pop rbp
ret
lea rax, [0x006c08e2]
mov ebx, 0x2e
nop dword [rax + rax]
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.00422100
Function at 0x422200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42244e
push rbp
mov rbp, rsp
sub rsp, 0x60
movsd qword [rsp + 0x78], xmm0
mov qword [rsp + 0x70], rax
test byte [rax], al
nop
call fcn.0040b580
mov rcx, r14
mov rax, qword [rsp + 0x70]
cmp qword [rax + 8], rcx
jne 0x42243c
movsd xmm0, qword [0x00727290]
movsd xmm1, qword [rsp + 0x78]
ucomisd xmm0, xmm1
jbe 0x422253
movsd xmm1, qword [0x00727290]
movsd qword [rsp + 0x58], xmm1
movsd xmm0, qword [rax + 0x30]
divsd xmm1, xmm0
cvttsd2si rcx, xmm1
mov qword [rsp + 0x48], rcx
cmp qword [rax + 0x80], 0
je 0x422298
nop
nop
call fcn.0040b7a0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x80]
mov rbx, qword [rdx]
mov rax, qword [rsp + 0x48]
call rbx
jmp 0x42236e
nop
call fcn.00468220
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rsp]
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x48]
add rbx, rdx
mov rsi, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov r10, qword [rcx + 0x30]
nop
mov rax, rcx
mov rcx, rsi
mov rsi, r8
mov r8, r9
mov r9, r10
call fcn.004544c0
mov rbx, qword [rsp + 0x70]
mov byte [rbx + 0x10], 1
nop
lea rax, [0x006e0e00]
mov ecx, 0x13
mov edi, 0x13
mov esi, 2
call fcn.00439e40
call fcn.00468220
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x38]
sub rax, rcx
mov qword [rsp + 0x40], rax
nop
nop
mov rax, qword [rsp + 0x70]
call fcn.0040b580
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
mov rax, rcx
call fcn.00453e80
nop
nop
mov rax, qword [rsp + 0x70]
call fcn.0040b7a0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rcx + 0x70]
test rbx, rbx
jle 0x4223a6
movsd xmm0, qword [rsp + 0x58]
cvttsd2si rdx, xmm0
add rax, rdx
cmp rbx, rax
jge 0x422399
mov qword [rcx + 0x70], 0
jmp 0x4223a0
sub rbx, rax
mov qword [rcx + 0x70], rbx
add rsp, 0x60
pop rbp
ret
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
movsd xmm1, qword [rsp + 0x58]
addsd xmm0, xmm1
movsd qword [rsp + 0x50], xmm0
mov rdx, qword [rcx + 0x98]
mov rax, qword [rdx]
call rax
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm2, qword [rsp + 0x50]
mulsd xmm0, xmm2
movsd xmm1, qword [rsp + 0x58]
divsd xmm1, xmm0
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 0x38]
movups xmm0, xmm1
movsd xmm1, qword [0x00727218]
mov rax, rcx
nop dword [rax]
call fcn.00423d80
mov rcx, qword [rsp + 0x70]
movsd qword [rcx + 0x30], xmm0
test al, al
jne 0x422436
movsd xmm0, qword [0x00727210]
movsd qword [rcx + 0x30], xmm0
movabs rdx, 0x12a05f200
mov qword [rcx + 0x70], rdx
mov rax, rcx
call fcn.00422480
add rsp, 0x60
pop rbp
ret
lea rax, [0x006c0f5f]
mov ebx, 0x2f
call fcn.00437240
nop
mov qword [rsp + 8], rax
movsd qword [rsp + 0x10], xmm0
call fcn.004646a0
mov rax, qword [rsp + 8]
movsd xmm0, qword [rsp + 0x10]
jmp fcn.00422200
Function at 0x4224e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42266e
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
test byte [rax], al
nop
call fcn.0040b580
mov rcx, r14
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], rcx
jne 0x42265c
nop
call fcn.0040b7a0
xorps xmm0, xmm0
xor eax, eax
jmp 0x422524
movups xmm0, xmm1
mov rax, rcx
movsd xmm1, qword [0x00727290]
ucomisd xmm1, xmm0
jbe 0x422626
movsd qword [rsp + 0x18], xmm0
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x90]
mov rcx, qword [rdx]
call rcx
test al, al
jne 0x422619
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x88]
mov rbx, qword [rdx]
mov eax, 0x10000
call rbx
test rbx, rbx
jne 0x4225d3
mov rcx, qword [0x00921168]
nop dword [rax]
test rcx, rcx
je 0x422657
mov rdx, rax
mov rbx, rdx
xor edx, edx
div rcx
test rax, rax
jl 0x4225a3
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
jmp 0x4225bb
mov rcx, rax
and eax, 1
shr rcx, 1
or rcx, rax
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
movsd xmm2, qword [0x00727278]
mulsd xmm1, xmm2
movsd xmm3, qword [rsp + 0x18]
addsd xmm1, xmm3
jmp 0x4225f0
xorps xmm1, xmm1
cvtsi2sd xmm1, rbx
movsd xmm2, qword [rsp + 0x18]
addsd xmm1, xmm2
mov rbx, rax
movsd xmm2, qword [0x00727278]
mov rcx, qword [rsp + 0x10]
add rcx, rbx
nop dword [rax + rax]
cmp rbx, 0x10000
jb 0x42262c
cmp qword [0x009212b0], 0
je 0x42251e
jmp 0x42262c
mov rcx, qword [rsp + 0x10]
movsd xmm1, qword [rsp + 0x18]
jmp 0x42262c
mov rcx, rax
movups xmm1, xmm0
test rcx, rcx
jbe 0x42263a
cmp qword [0x00921168], rcx
ja 0x422646
mov rax, rcx
movups xmm0, xmm1
add rsp, 0x20
pop rbp
ret
lea rax, [0x006c0910]
mov ebx, 0x2e
call fcn.00437240
call fcn.004357c0
lea rax, [0x006c044c]
mov ebx, 0x2d
call fcn.00437240
nop
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.004224e0
Function at 0x422740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422846
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x422783
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42283b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00423520
test rax, rax
je 0x42283b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x00422880]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00464560
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x422829
xor eax, eax
jmp 0x422833
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x422771
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00422740
Function at 0x424100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x424257
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x138]
test rdx, rdx
jne 0x42415f
call fcn.00426920
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x130], rax
mov qword [rcx + 0x138], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x4241e7
mov rdi, qword [rax + 0x100]
lea r8, [rsi - 1]
mov r9, rbx
sub rbx, rdi
nop dword [rax]
cmp r8, 0x3f
jae 0x424249
shl r8, 5
mov edi, dword [rdx + r8 + 0x20]
add edi, dword [rdx + r8 + 0x24]
nop dword [rax + rax]
cmp edi, ebx
ja 0x424238
cmp rsi, 0x3f
jne 0x4241ea
mov qword [rsp + 0x10], rdx
call fcn.00426920
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x138], rax
mov r9, qword [rsp + 0x30]
mov rdx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
jmp 0x4241ea
mov r9, rbx
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x3f
jae 0x42422b
mov rsi, rbx
shl rbx, 5
inc rsi
mov qword [rdx + 0x10], rsi
mov rsi, qword [rax + 0x100]
sub r9, rsi
mov dword [rdx + rbx + 0x20], r9d
mov esi, dword [rcx + 4]
mov dword [rdx + rbx + 0x24], esi
nop
mov qword [rdx + rbx + 0x28], rcx
inc qword [rax + 0x140]
add rsp, 0x18
pop rbp
ret
mov rax, rbx
mov ecx, 0x3f
call fcn.00466960
lea rax, [0x006bf126]
mov ebx, 0x29
call fcn.00437240
mov rax, r8
mov ecx, 0x3f
call fcn.00466960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00424100
Function at 0x424540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4246aa
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp dword [0x008f3440], ebx
je 0x424562
jmp 0x424698
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
btr ecx, 0x1f
dec ecx
cmp ecx, 0x80000000
jae 0x424687
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x42455f
cmp edx, 0x80000000
jne 0x424681
cmp dword [0x009218f4], 0
nop
jle 0x42467b
nop
mov rax, qword [0x00922028]
mov rcx, rax
shr rax, 0x14
mov qword [rsp + 0x28], rax
mov rdx, qword [0x008f3468]
mov qword [rsp + 0x10], rdx
mov rbx, qword [0x008f3478]
sub rcx, rbx
shr rcx, 0x14
mov qword [rsp + 0x20], rcx
movsd xmm0, qword [0x008f3480]
movsd qword [rsp + 0x18], xmm0
call fcn.00438be0
lea rax, [0x006bae57]
mov ebx, 0x1f
call fcn.00439460
mov rax, qword [rsp + 0x28]
call fcn.004391a0
lea rax, [0x006b3396]
mov ebx, 0xe
call fcn.00439460
mov rax, qword [rsp + 0x20]
nop dword [rax]
call fcn.004391a0
lea rax, [0x006b70ad]
mov ebx, 0x17
call fcn.00439460
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.004391a0
lea rax, [0x006b1dce]
mov ebx, 0xa
call fcn.00439460
movsd xmm0, qword [rsp + 0x18]
nop dword [rax]
call fcn.00438ec0
lea rax, [0x006b2909]
mov ebx, 0xc
call fcn.00439460
call fcn.00438c40
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
lea rax, [0x006bca46]
mov ebx, 0x23
call fcn.00437240
lea rax, [0x006c1910]
mov ebx, 0x31
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.004646a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.00424540

Function at 0x4246e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4247ee
push rbp
mov rbp, rsp
sub rsp, 0x30
jmp 0x4246fa
inc dword [0x008ccaf8]
call fcn.00424a40
nop
cmp rax, 0xffffffffffffffff
jne 0x4246f4
mov edx, dword [0x008ccafc]
btr edx, 0x1f
test edx, edx
jne 0x4247dc
mov eax, dword [0x008f3440]
mov dword [rsp + 0x14], eax
xor ecx, ecx
jmp 0x424783
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x28], rdx
lea rcx, [rbx + rbx*4]
mov qword [rsp + 0x20], rcx
lea rax, [rdi + rcx*8]
lea rax, [rax + 8]
call fcn.00430200
mov rcx, qword [rsp + 0x28]
lea rdx, [0x008f3740]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 0x58]
mov rdx, qword [rsp + 0x20]
lea rax, [rcx + rdx*8]
mov rcx, qword [rsp + 0x18]
inc rcx
mov qword [rsp + 0x28], rcx
call fcn.00430200
mov ecx, dword [rsp + 0x14]
mov rdx, qword [rsp + 0x28]
mov eax, ecx
mov rcx, rdx
cmp rcx, 0x88
jge 0x4247b6
lea rdx, [rcx + rcx*2]
shl rdx, 6
mov ebx, eax
shr ebx, 1
and ebx, 1
dec ebx
neg ebx
lea rsi, [0x008f3740]
lea rdi, [rsi + rdx]
cmp rbx, 2
jb 0x424726
jmp 0x4247d0
lea rax, [0x008ccf80]
nop dword [rax]
call fcn.00422180
call fcn.00429d80
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 2
call fcn.00466960
lea rax, [0x006c0056]
mov ebx, 0x2c
call fcn.00437240
nop
call fcn.004646a0
jmp fcn.004246e0
Function at 0x426d80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x426e66
push rbp
mov rbp, rsp
sub rsp, 0x10
nop
nop
lea rax, [0x008cd4d0]
nop dword [rax + rax]
call fcn.0040b580
cmp qword [0x008cd440], 0
jne 0x426e52
mov qword [0x008cd488], 0
mov rcx, qword [0x008cd4e8]
test rcx, rcx
jne 0x426dec
nop
nop
lea rax, [0x008cd4d0]
call fcn.0040b7a0
add rsp, 0x10
pop rbp
ret
lea rdx, [0x008cd4d8]
mov qword [rcx + 0x10], rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x426dde
mov rcx, qword [0x008cd4d8]
test rcx, rcx
je 0x426e29
mov rdx, qword [0x008cd4f0]
mov qword [rdx], rcx
mov rcx, qword [0x008cd4d8]
mov rdx, qword [0x008cd4f0]
mov qword [rcx + 8], rdx
mov rcx, qword [0x008cd4e8]
mov qword [0x008cd4d8], rcx
jmp 0x426e45
mov rcx, qword [0x008cd4f0]
mov rdx, qword [0x008cd4e8]
mov qword [0x008cd4d8], rdx
mov qword [0x008cd4e0], rcx
movups xmmword [0x008cd4e8], xmm15
jmp 0x426dca
lea rax, [0x006beb7d]
mov ebx, 0x28
nop
call fcn.00437240
nop
call fcn.004646a0
jmp fcn.00426d80

Function at 0x427ba0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x427bd1
push rbp
mov rbp, rsp
sub rsp, 0x18
test cl, cl
je 0x427bbf
xor edi, edi
call fcn.00427f40
add rsp, 0x18
pop rbp
ret
lea rax, [0x006c3675]
mov ebx, 0x3c
call fcn.00437240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop
call fcn.0046b280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00427ba0

Function at 0x427ce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x427df8
push rbp
mov rbp, rsp
sub rsp, 0x10
xor edx, edx
jmp 0x427d10
sub r11, rbx
mov rdi, r11
shr r11, 0xd
lea rbx, [rdi + r9]
sub r10, r11
mov rax, rcx
mov rcx, r10
mov edx, r12d
test rcx, rcx
jbe 0x427d99
test byte [rax], al
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
nop
cmp rdi, 0x40
jae 0x427dea
mov rdi, qword [rax + rdi*8 + 0x10198]
test byte [rdi], al
mov r9, rbx
and ebx, 0x3fffff
mov r10, rcx
shl rcx, 0xd
lea r11, [rcx + rbx]
shr r8, 0x16
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x114c8]
cmp r8, rbx
seta r12b
or r12d, edx
nop dword [rax + rax]
cmp r11, 0x400000
jbe 0x427da7
mov r11d, 0x400000
jmp 0x427da7
mov rcx, rax
jmp 0x427cf6
mov eax, edx
add rsp, 0x10
pop rbp
ret
mov rax, rcx
mov r8, rdx
cmp r11, r8
jbe 0x427d91
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x114c8], r11
sete dl
nop
test dl, dl
jne 0x427cf6
mov rdx, qword [rdi + 0x114c8]
cmp rdx, r11
ja 0x427da1
cmp rdx, rbx
jbe 0x427da1
lea rax, [0x006c2101]
mov ebx, 0x33
call fcn.00437240
mov rax, rdi
mov ecx, 0x40
call fcn.00466980
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax + rax]
jmp fcn.00427ce0
Function at 0x4287a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428a35
push rbp
mov rbp, rsp
sub rsp, 0x70
test byte [rax], al
mov rdx, qword [rax + 0x10430]
mov rsi, qword [0x00921168]
add rbx, 0x1ff
and rbx, 0xfffffffffffffe00
shl rbx, 0xd
lea r8, [rbx + rdx]
lea r9, [rsi + r8]
lea r9, [r9 - 1]
neg rsi
and rsi, r9
cmp qword [rax + 0x10438], rsi
jb 0x4287f8
cmp rdx, r8
jbe 0x4289a8
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x58], rbx
lea rcx, [rax + 0x103c0]
mov edi, 1
call fcn.0040c180
test rax, rax
je 0x42891c
mov rcx, rax
mov rdx, qword [rsp + 0x80]
mov rsi, qword [rdx + 0x10438]
cmp rax, rsi
jne 0x428848
lea rcx, [rax + rbx]
mov qword [rdx + 0x10438], rcx
xor eax, eax
jmp 0x4288f3
mov rdi, qword [rdx + 0x10430]
sub rsi, rdi
test rsi, rsi
jne 0x42885e
xor eax, eax
jmp 0x4288de
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rsi
lea rcx, [rdx + 8]
mov qword [rsp + 0x60], rcx
nop
lea rax, [0x009220d8]
mov rbx, rsi
call fcn.004304a0
lea rax, [0x009259c0]
call fcn.00430560
mov rcx, qword [rsp + 0x38]
lock xadd qword [rax + 8], rcx
lea rax, [0x009259c0]
call fcn.00430640
mov rcx, qword [rsp + 0x80]
mov rbx, qword [rcx + 0x10430]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call fcn.0042a0c0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rsi, rcx
mov qword [rdx + 0x10430], rcx
lea rcx, [rsi + rbx]
mov qword [rdx + 0x10438], rcx
mov rsi, qword [0x00921168]
mov rcx, qword [rdx + 0x10430]
mov rdi, qword [rsp + 0x58]
add rcx, rdi
lea rcx, [rsi + rcx]
lea rcx, [rcx - 1]
neg rsi
and rsi, rcx
jmp 0x4289ad
mov rax, qword [0x009220e0]
mov rcx, qword [0x009220d8]
add rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, qword [0x009220d0]
mov qword [rsp + 0x20], rcx
nop
call fcn.00438be0
lea rax, [0x006beba5]
mov ebx, 0x28
call fcn.00439460
mov rax, qword [rsp + 0x58]
nop dword [rax + rax]
call fcn.004391a0
lea rax, [0x006b2ebc]
mov ebx, 0xd
call fcn.00439460
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
add rax, rcx
call fcn.004391a0
lea rax, [0x006b19b7]
mov ebx, 9
call fcn.00439460
call fcn.00438c40
xor eax, eax
xor ebx, ebx
add rsp, 0x70
pop rbp
ret
mov rdx, rax
xor eax, eax
mov rcx, qword [rdx + 0x10430]
mov qword [rsp + 0x28], rcx
mov qword [rdx + 0x10430], rsi
sub rsi, rcx
mov qword [rsp + 0x40], rsi
add rdx, 8
mov qword [rsp + 0x60], rdx
lea rdi, [rax + rsi]
mov qword [rsp + 0x30], rdi
lea rax, [0x009220d8]
mov rbx, rsi
call fcn.004304a0
lea rax, [0x009259c0]
call fcn.00430560
mov rcx, qword [rsp + 0x40]
lock xadd qword [rax + 8], rcx
lea rax, [0x009259c0]
call fcn.00430640
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
nop dword [rax + rax]
call fcn.0042a0c0
mov rax, qword [rsp + 0x30]
mov ebx, 1
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004287a0