joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419ff0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41a263
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movzx eax, byte [0x00898498]
test al, al
jne 0x41a248
mov eax, dword [0x0089de88]
mov dword [rsp + 0x28], eax
shr eax, 1
and eax, 1
lea rax, [rax + rax*4]
lea rdx, [0x0089dec0]
lea rax, [rdx + rax*8]
mov qword [rsp], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 8], rax
call fcn.0041ee00
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x30], rcx
xor edx, edx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x58], rax
cmp rdx, rcx
jge 0x41a0a0
mov rbx, qword [rax]
mov qword [rsp + 0x40], rbx
movzx esi, byte [rbx + 0x64]
cmp sil, 1
je 0x41a0aa
add rax, 8
inc rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x58], rax
cmp rdx, rcx
jl 0x41a078
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
movzx esi, byte [0x008b402f]
test sil, sil
je 0x41a1a6
mov rsi, qword [rbx + 0x90]
test rsi, rsi
jne 0x41a0c8
jmp 0x41a08a
lea rsi, [rbx + 0x88]
mov qword [rsp + 0x50], rsi
mov qword [rsp], rsi
call fcn.0040d6a0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x90]
mov qword [rsp + 0x48], rcx
test rcx, rcx
je 0x41a109
movzx edx, byte [rcx + 0xa]
cmp dl, 1
je 0x41a12b
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
test rcx, rcx
jne 0x41a0f3
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0040d8b0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
jmp 0x41a08a
movzx edx, word [rcx + 8]
mov rbx, qword [rax + 0x18]
mov rsi, qword [rax + 0x68]
test rsi, rsi
je 0x41a19f
mov rax, rdx
xor edx, edx
div rsi
imul rsi, rax
lea rdx, [rbx + rsi]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 8], rdx
call fcn.0041c4a0
mov rcx, qword [rsp + 0x48]
lea rdx, [rcx + 0x10]
lea rbx, [0x007e3145]
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdx
mov qword [rsp + 8], 8
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x18], rdx
call fcn.0041c300
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jmp 0x41a0fc
call fcn.004294c0
ud2
mov esi, dword [rbx + 0x58]
mov dword [rsp + 0x2c], esi
mov edi, dword [rsp + 0x28]
cmp edi, esi
jne 0x41a1ba
jmp 0x41a0ba
call fcn.0042b850
lea rax, [0x006cfe34]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042c220
mov eax, dword [rsp + 0x2c]
mov eax, eax
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006cf290]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
mov eax, dword [rsp + 0x28]
mov eax, eax
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006d2be9]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042aea0
ud2
lea rax, [0x006d9e84]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00419ff0
Function at 0x41d390
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b402f]
test al, al
je 0x41d3b8
movzx eax, byte [0x008b4023]
test al, al
je 0x41d45b
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.00410d20
mov rax, qword [rsp + 0x18]
movzx ecx, byte [rsp + 0x10]
mov rdx, qword [rsp + 8]
mov qword [rsp], rdx
mov byte [rsp + 8], cl
mov qword [rsp + 0x10], rax
call fcn.00410e30
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
lea rcx, [rax + 0x1228]
test byte [rcx], al
mov rdx, qword [rax + 0x1238]
mov rbx, qword [rsp + 0x38]
add rdx, rbx
mov qword [rax + 0x1238], rdx
test byte [rcx], al
mov rdx, qword [rax + 0x1240]
mov rbx, qword [rsp + 0x40]
add rdx, rbx
mov qword [rax + 0x1240], rdx
movzx eax, byte [0x008b4023]
test al, al
jne 0x41d450
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rcx
call fcn.0041f290
jmp 0x41d446
lea rax, [0x006dbc6b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.0042aea0
ud2
Function at 0x41dda0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41de83
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rdx + 0xd0]
test ebx, ebx
jne 0x41ddf8
mov ebx, dword [rdx + 0xb4]
test ebx, ebx
jne 0x41ddf8
mov rdx, qword [rdx]
cmp rcx, rdx
jne 0x41de68
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0x58]
mov ebx, dword [0x0089de88]
mov dword [rsp + 0x1c], ebx
cmp ebx, edx
je 0x41de5e
lea eax, [rbx - 2]
lea edx, [rbx - 1]
lock cmpxchg dword [rcx + 0x58], edx
sete dl
test dl, dl
jne 0x41de46
mov eax, dword [rcx + 0x58]
cmp ebx, eax
je 0x41de3c
call fcn.00428dc0
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x1c]
mov eax, dword [rcx + 0x58]
cmp ebx, eax
jne 0x41de27
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rcx
mov byte [rsp + 8], 0
call fcn.0041de90
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006d949a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.0041dda0
Function at 0x420e40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x420f27
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx]
cmp rax, rcx
jne 0x420f0c
mov rax, qword [rsp + 0x30]
test byte [rax], al
mov qword [rsp], rax
call fcn.0040d6a0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
call fcn.00420f40
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x18], rax
test rax, rax
je 0x420eea
mov byte [rax + 0x64], 2
mov qword [rax + 0x28], 0
mov word [rax + 0x60], 0
mov rcx, qword [0x008b5f20]
mov rdx, qword [rax + 0x20]
shl rdx, 0xd
add rcx, rdx
mov qword [0x008b5f20], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
call fcn.0040d8b0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006d8a4b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00420e40
Function at 0x421880
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x421953
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx]
cmp rax, rcx
jne 0x421938
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x65], 1
mov rcx, qword [rsp + 0x30]
test byte [rcx], al
mov qword [rsp], rcx
call fcn.0040d6a0
mov rax, qword [0x008b5f20]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
sub rax, rdx
mov qword [0x008b5f20], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov word [rsp + 0x10], 0x101
mov qword [rsp + 0x18], 0
call fcn.00421960
mov rax, qword [rsp + 0x30]
test byte [rax], al
mov qword [rsp], rax
call fcn.0040d8b0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006d869d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00421880
Function at 0x422340
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x422471
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rsp + 0x30]
cmp rdx, rcx
jne 0x4223d9
mov rcx, qword [rdx]
cmp rax, rcx
jne 0x4223cd
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rcx, qword [rdx + 8]
cmp rax, rcx
jne 0x4223c0
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rcx + 8], rdx
jmp 0x42239f
mov rcx, qword [rax + 8]
mov rbx, qword [rax]
mov qword [rcx], rbx
jmp 0x42238e
mov rbx, qword [rax + 8]
mov qword [rsp + 0x10], rbx
call fcn.0042b850
lea rax, [0x006d8bab]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042c220
call fcn.0042bad0
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042c1d0
call fcn.0042bad0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c1d0
call fcn.0042bad0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c1d0
call fcn.0042bad0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042c1d0
call fcn.0042bb30
call fcn.0042b8f0
lea rax, [0x006d29e9]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00422340

Function at 0x422480
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42259b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x4224fa
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x4224fa
mov rdx, qword [rax + 0x10]
test rdx, rdx
jne 0x4224fa
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rdx, qword [rcx]
test rdx, rdx
je 0x4224f4
mov qword [rdx + 8], rax
mov qword [rcx], rax
mov qword [rax + 0x10], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rcx + 8], rax
jmp 0x4224e3
mov rdx, qword [rax + 8]
mov qword [rsp + 0x18], rdx
mov rbx, qword [rax + 0x10]
mov qword [rsp + 0x10], rbx
call fcn.0042b850
lea rax, [0x006d8b8b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042c220
call fcn.0042bad0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c1d0
call fcn.0042bad0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042c1d0
call fcn.0042bad0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c1d0
call fcn.0042bad0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c1d0
call fcn.0042bb30
call fcn.0042b8f0
lea rax, [0x006d29d9]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00422480
Function at 0x4226e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x422941
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov rcx, rax
mov rdx, qword [0x0089e170]
cmp rcx, rdx
jae 0x4228d9
xor ecx, ecx
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x4228be
mov rdx, qword gs:[0x28]
mov rdx, qword [rdx]
mov rbx, qword [rdx + 0x30]
mov esi, dword [rbx + 0xd0]
inc esi
mov dword [rbx + 0xd0], esi
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x30], rdx
mov qword [rsp], rcx
call fcn.0041dda0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov rbx, qword [rsp + 0x58]
movzx esi, byte [rbx + 0xa]
mov byte [rsp + 0x17], sil
lea rdi, [rax + 0x88]
mov qword [rsp + 0x38], rdi
mov qword [rsp], rdi
call fcn.0040d6a0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
sub rax, rcx
mov rcx, qword [rsp + 0x28]
add rcx, 0x90
movzx edx, byte [rsp + 0x17]
mov rbx, qword [rcx]
test rbx, rbx
je 0x4227f6
movzx esi, word [rbx + 8]
cmp rax, rsi
jne 0x4227de
movzx edi, byte [rbx + 0xa]
cmp dl, dil
je 0x422863
cmp rax, rsi
jb 0x4227f6
jne 0x4227eb
movzx esi, byte [rbx + 0xa]
cmp dl, sil
jb 0x4227f6
mov rcx, rbx
mov rbx, qword [rcx]
test rbx, rbx
jne 0x4227c5
mov rdx, qword [rsp + 0x58]
mov word [rdx + 8], ax
mov rax, qword [rcx]
mov qword [rdx], rax
mov qword [rcx], rdx
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0040d8b0
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 0xd0]
mov rdx, qword gs:[0x28]
mov rdx, qword [rdx]
lea ebx, [rcx - 1]
mov dword [rax + 0xd0], ebx
test byte [rax], al
cmp ecx, 1
jne 0x422854
movzx eax, byte [rdx + 0xe8]
test al, al
je 0x422854
mov qword [rdx + 0x10], 0xfffffffffffffade
mov byte [rsp + 0x60], 1
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0040d8b0
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 0xd0]
mov rdx, qword gs:[0x28]
mov rdx, qword [rdx]
lea ebx, [rcx - 1]
mov dword [rax + 0xd0], ebx
test byte [rax], al
cmp ecx, 1
jne 0x4228af
movzx eax, byte [rdx + 0xe8]
test al, al
je 0x4228af
mov qword [rdx + 0x10], 0xfffffffffffffade
mov byte [rsp + 0x60], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006d795b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042aea0
ud2
mov rbx, qword [0x0089e178]
cmp rcx, rbx
jae 0x422720
mov rbx, rcx
sub rcx, rdx
mov rdx, qword [0x0089dea8]
mov rsi, qword [0x0089deb0]
shr rcx, 0xd
cmp rcx, rsi
jae 0x42293a
mov rcx, qword [rdx + rcx*8]
test rcx, rcx
je 0x422918
mov rdx, qword [rcx + 0x18]
cmp rbx, rdx
jae 0x42291f
xor ecx, ecx
jmp 0x422722
mov rdx, qword [rcx + 0x80]
cmp rbx, rdx
jae 0x422918
movzx edx, byte [rcx + 0x64]
cmp dl, 1
je 0x422722
jmp 0x422918
call fcn.004293e0
ud2
call fcn.00452210
jmp fcn.004226e0
Function at 0x422f50
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x423007
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x008a0000]
mov qword [rsp], rax
call fcn.0040d6a0
lea rax, [0x0089ffb8]
mov qword [rsp], rax
call fcn.004156e0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
lea rcx, [0x008a0000]
mov qword [rsp], rcx
call fcn.0040d8b0
mov rax, qword [rsp + 0x18]
mov byte [rax + 0xa], 2
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
test byte [rax], al
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.004226e0
movzx eax, byte [rsp + 0x10]
test al, al
je 0x422fec
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006da385]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00422f50

Function at 0x4231a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4232f2
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
lea rax, [0x00897b40]
mov qword [rsp], rax
call fcn.0040d6a0
mov rax, qword [rsp + 0x38]
add rax, 0x3f
shr rax, 6
shl rax, 3
mov qword [rsp + 0x18], rax
mov rcx, qword [0x00897b50]
test rcx, rcx
je 0x423209
mov rcx, qword [rcx]
add rcx, rax
cmp rcx, 0xfff0
jbe 0x423224
call fcn.00423420
mov rax, qword [rsp]
mov rcx, qword [0x00897b50]
mov qword [rax + 8], rcx
mov qword [0x00897b50], rax
mov rax, qword [0x00897b50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rax]
mov qword [rsp + 0x10], rcx
cmp rcx, 0x10000
jae 0x42328a
cmp rcx, 0xfff0
jae 0x423283
mov rdx, qword [rsp + 0x18]
add rdx, rcx
mov qword [rax], rdx
lea rdx, [0x00897b40]
mov qword [rsp], rdx
call fcn.0040d8b0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x10]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004293e0
ud2
call fcn.0042b850
lea rax, [0x006d8beb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042c220
call fcn.0042bad0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c020
call fcn.0042bad0
mov qword [rsp], 0x10000
call fcn.0042c020
call fcn.0042bb30
call fcn.0042b8f0
lea rax, [0x006d31d1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.004231a0
Function at 0x423420
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4234d9
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [0x00897b48]
mov qword [rsp + 0x18], rax
test rax, rax
je 0x423499
mov rcx, qword [rax + 8]
mov qword [0x00897b48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], 0x10000
call fcn.004551f0
mov rax, qword [rsp + 0x18]
mov qword [rax + 8], 0
mov qword [rax], 0
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], 0x10000
lea rax, [0x008b5f58]
mov qword [rsp + 8], rax
call fcn.00413cb0
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x4234be
jmp 0x42347b
lea rax, [0x006d87d3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00423420
Function at 0x424730
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, 0xfffffffffffffade
je 0x4247fc
lea rax, [rsp + 0x370]
sub rax, rsi
cmp rax, 0x1998
jbe 0x4247fc
sub rsp, 0x16a8
mov qword [rsp + 0x16a0], rbp
lea rbp, [rsp + 0x16a0]
lea rdi, [rsp + 0x10]
mov rcx, 0x2d2
xor eax, eax
rep stosq qword [rdi], rax
mov rdx, qword [0x007e32e8]
cmp rdx, 0x1690
jne 0x4247b0
mov rbp, qword [rsp + 0x16a0]
add rsp, 0x16a8
ret
call fcn.0042b850
mov rax, qword [0x007e32e8]
mov qword [rsp], rax
call fcn.0042c020
call fcn.0042bad0
mov qword [rsp], 0x1690
call fcn.0042c020
call fcn.0042bb30
call fcn.0042b8f0
lea rax, [0x006d9d88]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00424730

Function at 0x424af0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
mov rcx, rax
neg rax
mov rdx, qword [rsp + 0x28]
mov rbx, rax
lock xadd qword [rdx], rax
add rax, rbx
mov qword [rsp + 0x10], rax
lea rdx, [rcx + rax]
cmp rdx, rcx
jb 0x424b31
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.0042b850
lea rax, [0x006d7d35]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042c220
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006cf619]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042c220
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
mov dword [rsp], 2
call fcn.00427f10
jmp 0x424b27
Function at 0x427160
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42724d
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x427232
mov ecx, dword [rax + 0x28]
mov dword [rsp + 0x1c], ecx
cmp ecx, 0x72
je 0x4271a7
cmp ecx, 0x77
jne 0x4271da
mov edx, dword [rsp + 0x40]
mov dword [rax + 0x2c], edx
mov edx, dword [rsp + 0x44]
mov dword [rax + 0x30], edx
mov rax, qword [rax + 0x20]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 0x10], ecx
call fcn.00426240
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0042b850
lea rax, [0x006de1f2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x39
call fcn.0042c220
call fcn.0042bad0
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042c020
call fcn.0042bb30
call fcn.0042b8f0
lea rax, [0x006de0d8]
mov qword [rsp], rax
mov qword [rsp + 8], 0x38
call fcn.0042aea0
ud2
lea rax, [0x006dd7ba]
mov qword [rsp], rax
mov qword [rsp + 8], 0x35
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00427160

Function at 0x428600
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
lea rax, [0x0067a4c0]
mov qword [rsp + 0x50], rax
lea rax, [0x006e08b8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
test byte [rax], al
lea rax, [rsp + 0x50]
mov rcx, 8
mov rax, qword [rcx + rax]
mov rax, qword [rax]
mov rcx, qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0x20000
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x10000
mov qword [rsp + 0x30], 0
call fcn.00428d00
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x428697
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, dword [0x008b4058]
test eax, eax
jne 0x42874a
movsxd rax, dword [0x00897fe8]
mov qword [rsp + 0x48], rax
call fcn.00455c70
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.0042b850
lea rax, [0x006dc39e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2e
call fcn.0042c220
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006d27f9]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042c220
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006cf2d7]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006d328c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042aea0
ud2
lea rax, [0x008b4138]
mov qword [rsp], rax
call fcn.0040d6a0
lea rax, [0x008b4138]
mov qword [rsp], rax
call fcn.0040d6a0
jmp 0x4286a5
Function at 0x4290f0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42930f
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rax, [0x008b4130]
mov qword [rsp], rax
call fcn.0040d6a0
mov rax, qword [0x008b41d8]
test rax, rax
je 0x42921a
lea rax, [0x008b4130]
mov qword [rsp], rax
call fcn.0040d8b0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x70]
test eax, eax
jle 0x429211
mov ecx, eax
mov eax, 0x3e8
cmp ecx, 0xffffffff
je 0x429207
cdq
idiv ecx
test eax, eax
jne 0x429187
mov eax, 1
movsxd rdx, eax
imul rdx, rdx, 0xffffffffffffd8f0
mov qword [rsp + 0x48], rdx
mov rdx, qword [sym.imp.KERNEL32.DLL_SetWaitableTimer]
mov qword [rsp], rdx
mov rdx, qword [0x008b41d8]
mov qword [rsp + 8], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x10], rdx
movsxd rax, eax
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call fcn.00428d00
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rsp + 0x70]
xchg dword [rax + 0xdc], ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
neg rax
xor edx, edx
jmp 0x42917e
mov ecx, eax
xor eax, eax
jmp 0x429196
mov rax, qword [sym.imp.KERNEL32.DLL_CreateWaitableTimerA]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
call fcn.00428be0
mov rax, qword [rsp + 0x20]
lea rcx, [0x008b41d8]
xchg qword [rcx], rax
lea rax, [0x0066d300]
mov qword [rsp + 0x50], rax
lea rax, [0x006e07e8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
test byte [rax], al
lea rax, [rsp + 0x50]
mov rcx, 8
mov rax, qword [rcx + rax]
mov rax, qword [rax]
mov rcx, qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call fcn.00428d00
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 2
call fcn.00428b80
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
call fcn.00428b20
jmp 0x429140
call fcn.00452210
jmp fcn.004290f0