joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430ae0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430bbc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [sym.imp.kernel32.dll_CreateIoCompletionPort]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.00433fa0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x009715e0], rax
test rax, rax
je 0x430b52
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00467420
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438660
lea rax, [0x0072d548]
mov ebx, 0x2f
call fcn.00438f60
mov rax, qword [rsp + 0x30]
call fcn.00438c60
lea rax, [0x007198c2]
mov ebx, 3
nop dword [rax]
call fcn.00438f60
call fcn.004386e0
lea rax, [0x0072478e]
mov ebx, 0x1b
call fcn.00436d20
nop
nop dword [rax]
call fcn.00463860
jmp fcn.00430ae0

Function at 0x430ca0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430d9c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor eax, eax
lea rcx, [0x00a04a5c]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
jne 0x430cdb
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, qword [0x009715e0]
mov rcx, qword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.00433fa0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
nop
je 0x430d2c
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00467420
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438660
lea rax, [0x0073002e]
mov ebx, 0x3c
nop dword [rax]
call fcn.00438f60
mov rax, qword [rsp + 0x30]
call fcn.00438c60
lea rax, [0x007198c2]
mov ebx, 3
nop dword [rax + rax]
call fcn.00438f60
call fcn.004386e0
lea rax, [0x0072e7d4]
mov ebx, 0x33
call fcn.00436d20
nop
nop dword [rax]
call fcn.00463860
jmp fcn.00430ca0
Function at 0x431140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4311c7
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov edx, dword [rbx + 0x28]
nop dword [rax + rax]
cmp edx, 0x72
je 0x43116a
cmp edx, 0x77
jne 0x431185
mov dword [rbx + 0x2c], ecx
mov dword [rbx + 0x30], edi
mov rbx, qword [rbx + 0x20]
mov ecx, edx
call fcn.00430320
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edx
call fcn.00438660
lea rax, [0x0072fff2]
mov ebx, 0x3c
call fcn.00438f60
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.00438d60
call fcn.004388c0
call fcn.004386e0
lea rax, [0x0072227e]
mov ebx, 0x17
call fcn.00436d20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.00431140
Function at 0x4312c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4314b1
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
cmp qword [0x00a04c28], 0
jne 0x43135e
mov rax, qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea rcx, [0x00a059e0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x104
call fcn.00433ea0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x43149f
cmp rax, 0x104
ja 0x43149f
lea r8, [0x00a059e0]
mov byte [r8 + rax], 0x5c
lea r9, [rax + 1]
mov qword [0x00a04c28], r9
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
cmp byte [0x00a04a05], 0
je 0x4313b8
test rbx, rbx
jbe 0x431495
mov rcx, qword [0x009ae890]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x800
call fcn.00433f20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [0x00a04c28]
nop
cmp rcx, 0x105
ja 0x43148b
lea rdx, [rcx + rbx]
cmp rdx, 0x105
ja 0x4313e3
lea rsi, [0x00a059e0]
jmp 0x43141b
mov qword [rsp + 0x30], rcx
lea rax, [0x00a059e0]
mov ecx, 0x105
mov rdi, rbx
lea rsi, [0x006bb680]
mov rbx, rdx
call fcn.0044aa20
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
mov rsi, rax
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rsi
lea rdi, [rsi + rcx]
mov rcx, rbx
mov rbx, rax
mov rax, rdi
call fcn.00466860
mov rdx, qword [rsp + 0x28]
nop dword [rax]
test rdx, rdx
jbe 0x431481
mov rax, qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433e20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
xor eax, eax
mov rcx, rax
call fcn.00465ec0
mov edx, 0x105
call fcn.00465f20
xor eax, eax
mov rcx, rax
call fcn.00465ec0
lea rax, [0x00728d66]
mov ebx, 0x24
call fcn.00436d20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004312c0
Function at 0x432020
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4322a6
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x009ae8c8]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.00433f20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x43211f
jne 0x4320b3
cmp dword [rsp + 0x4c], 0
jne 0x4320b3
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x43211f
mov rax, qword [0x009ae8c0]
call fcn.00433dc0
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x00a0606a]
mov ebx, 0x20
mov ecx, 0x21
call fcn.00432880
mov rcx, qword [0x00a04c28]
cmp rcx, 0x105
ja 0x432297
mov qword [rsp + 0x58], rcx
lea rax, [0x00a05e80]
lea rbx, [0x00a059e0]
call fcn.00466860
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x432131
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rdx + rbx + 1], dil
inc rax
cmp rax, 0x20
jge 0x432199
lea rdx, [rcx + rax*2]
lea rbx, [0x00a05e80]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x0071dba9]
movzx esi, byte [rdi + rsi]
nop dword [rax]
cmp rdx, 0x20b
jae 0x43228a
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
cmp rsi, 0x20b
jb 0x432129
jmp 0x43227d
lea rdx, [rcx + 0x40]
jmp 0x4321ad
lea rbx, [0x00a05e80]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x4321c5
cmp rdx, 0x20b
jb 0x43219f
nop
jmp 0x432270
mov rax, qword [sym.imp.kernel32.dll_CreateFileA]
lea rcx, [0x00a05e80]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.00434120
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00467420
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x43225f
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.00438660
lea rax, [0x007329f0]
mov ebx, 0x5f
call fcn.00438f60
call fcn.004386e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [0x00a049f5], 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.00465ec0
mov rax, rsi
mov ecx, 0x20b
call fcn.00465ec0
mov rax, rdx
mov ecx, 0x20b
call fcn.00465ec0
mov edx, 0x105
nop dword [rax]
call fcn.00465f20
nop
call fcn.00463860
jmp fcn.00432020
Function at 0x4325c0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x432869
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.00431200
cmp dword [0x00a04ed0], 0
jne 0x43263c
mov qword [0x009ae888], rax
jmp 0x432648
lea rdi, [0x009ae888]
call fcn.00465a20
test rax, rax
je 0x432857
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.00431200
cmp dword [0x00a04ed0], 0
jne 0x4326a7
mov qword [0x009ae8a8], rax
jmp 0x4326b3
lea rdi, [0x009ae8a8]
call fcn.00465a20
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.00431200
cmp dword [0x00a04ed0], 0
jne 0x43271b
mov qword [0x009ae8b0], rax
jmp 0x432727
lea rdi, [0x009ae8b0]
call fcn.00465a20
cmp qword [0x009ae8a8], 0
je 0x432846
test rax, rax
je 0x432846
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433e20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x432835
nop word [rax + rax]
cmp rax, 0x7fffffff
jg 0x432824
mov qword [rsp + 0x28], rax
mov rax, qword [0x009ae8a8]
lea rcx, [0x00a04c00]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433e20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x4327d8
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x4327f5
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x4327d2
sub rbx, rsi
bts edi, ecx
jmp 0x4327d2
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x00a04bf8], rax
mov byte [0x00a04a06], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x00731bc6]
mov ebx, 0x56
call fcn.00436d20
lea rax, [0x0073179c]
mov ebx, 0x50
call fcn.00436d20
lea rax, [0x00724305]
mov ebx, 0x1b
call fcn.00436d20
lea rax, [0x0072d7dd]
mov ebx, 0x30
call fcn.00436d20
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.004325c0
Function at 0x4335e0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rcx, qword [sym.imp.kernel32.dll_CreateThread]
lea rdx, [0x00467620]
mov qword [rsp], rcx
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm15
call fcn.004340a0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x433668
mov rcx, qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00433e20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov ecx, dword [0x00a04a28]
test ecx, ecx
jne 0x43370d
mov rax, qword [0x009b1470]
sub rax, qword [0x009b1480]
mov qword [rsp + 0x48], rax
call fcn.00467420
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.00438660
lea rax, [0x0072cebd]
mov ebx, 0x2e
call fcn.00438f60
mov rax, qword [rsp + 0x48]
movsxd rax, eax
call fcn.00438d60
lea rax, [0x0071db19]
mov ebx, 0x10
call fcn.00438f60
mov rax, qword [rsp + 0x40]
call fcn.00438c60
lea rax, [0x007197fa]
mov ebx, 2
call fcn.00438f60
call fcn.004386e0
lea rax, [0x0071e88d]
mov ebx, 0x11
call fcn.00436d20
nop
nop
lea rax, [0x00a04b28]
call fcn.0040b8e0
nop
nop
lea rax, [0x00a04b28]
call fcn.0040b8e0
jmp 0x433676
Function at 0x435300
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4353de
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rcx, qword [r14 + 0x30]
mov rdx, r14
nop
cmp qword [rcx + 0x90], rdx
jne 0x4353cc
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x28], rax
call fcn.004354a0
cmp qword [rax + 0x20], 0
jne 0x4353bb
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x28]
cmp dword [0x00a04ed0], 0
jne 0x435368
mov qword [rax + 0x28], rdx
mov qword [rcx + 0x28], rax
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
jmp 0x435388
lea rdi, [rax + 0x28]
call fcn.00465b40
lea rdi, [rcx + 0x28]
call fcn.00465a20
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00465b20
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x28]
mov qword [rax + 8], rcx
call fcn.004659c0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0072abf9]
mov ebx, 0x28
call fcn.00436d20
lea rax, [0x00720d23]
mov ebx, 0x15
call fcn.00436d20
nop
mov qword [rsp + 8], rax
call fcn.00463860
mov rax, qword [rsp + 8]
jmp fcn.00435300

Function at 0x435a20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x435b46
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x10], r14
mov rcx, qword [rsp + 0x10]
jmp 0x435a58
call fcn.004356c0
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rdx]
call rcx
mov rcx, qword [rsp + 0x10]
mov rax, qword [rcx + 0x28]
nop dword [rax]
test rax, rax
je 0x435b29
lea rdx, [rsp + 0x40]
cmp qword [rax + 8], rdx
jne 0x435b1f
lea rdi, [rcx + 0x28]
cmp byte [rax + 2], 0
jne 0x435ad5
mov rbx, qword [rax + 0x18]
cmp dword [0x00a04ed0], 0
jne 0x435a99
mov qword [rax + 0x18], 0
jmp 0x435aae
lea rsi, [rax + 0x18]
mov r8, rdi
mov rdi, rsi
xor r9d, r9d
call fcn.00465bc0
mov rdi, r8
mov qword [rsp + 0x18], rbx
mov rsi, qword [rax + 0x28]
cmp dword [0x00a04ed0], 0
nop
jne 0x435acb
mov qword [rcx + 0x28], rsi
jmp 0x435a44
call fcn.00465b80
jmp 0x435a44
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
nop
call fcn.004361a0
test al, al
je 0x435b33
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x28]
cmp dword [0x00a04ed0], 0
jne 0x435b06
mov rdx, qword [rsp + 0x10]
mov qword [rdx + 0x28], rcx
jmp 0x435b10
mov rdi, qword [rsp + 0x28]
call fcn.00465b20
call fcn.004356c0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0072c091]
mov ebx, 0x2b
nop
call fcn.00436d20
nop
call fcn.00463860
jmp fcn.00435a20
Function at 0x437300
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x437461
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x10], r14
cmp qword [0x009dd718], 0
jne 0x437345
call fcn.00438660
lea rax, [0x0072cf19]
mov ebx, 0x2e
call fcn.00438f60
nop dword [rax]
call fcn.004386e0
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
nop
jge 0x43736c
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x437407
nop
cmp edx, 1
je 0x4373d1
cmp edx, 2
jne 0x4373b9
mov dword [rcx + 0xdc], 3
call fcn.00438660
lea rax, [0x00722b34]
mov ebx, 0x18
call fcn.00438f60
call fcn.004386e0
mov eax, 4
call fcn.00432b60
mov eax, 5
nop
call fcn.00432b60
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 2
nop dword [rax + rax]
call fcn.00438660
lea rax, [0x0071fc37]
mov ebx, 0x13
call fcn.00438f60
call fcn.004386e0
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 1
nop
mov ecx, 1
lea rdx, [0x00a04a64]
lock xadd dword [rdx], ecx
lea rax, [0x00a04ba8]
call fcn.0040b8a0
cmp dword [0x00a05390], 0
jg 0x437442
cmp dword [0x00a0538c], 0
nop
jle 0x43744c
mov eax, 1
call fcn.004447e0
call fcn.0043aca0
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
call fcn.00463860
jmp fcn.00437300
Function at 0x43ba20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43bc8f
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jg 0x43bc7d
mov qword [rsp + 0x40], r14
nop
nop
lea rax, [0x009b1458]
call fcn.0040b8e0
mov ecx, dword [0x00a04a48]
mov dword [0x009b152c], ecx
nop
nop
mov ecx, 1
lea rdx, [0x009b1528]
xchg byte [rdx], cl
call fcn.004446a0
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0xa0]
mov dword [rcx + 4], 3
dec dword [0x009b152c]
mov rcx, qword [0x009b0140]
mov qword [rsp + 0x50], rcx
mov rdx, qword [0x009b0148]
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x43baba
lea rax, [rsi + 1]
cmp rax, rdx
jge 0x43bb3e
mov rbx, qword [rcx + rax*8]
cmp dword [rbx + 4], 2
jne 0x43bae2
mov rsi, rax
mov eax, 2
mov edi, 3
lock cmpxchg dword [rbx + 4], edi
sete r8b
nop
jmp 0x43baed
mov rsi, rax
mov edi, 3
xor r8d, r8d
test r8b, r8b
je 0x43bab6
cmp byte [0x009b6bd0], 0
je 0x43bb30
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
call fcn.00456ca0
mov rax, qword [rsp + 0x38]
call fcn.00456520
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
mov edi, 3
inc dword [rbx + 0x14]
dec dword [0x009b152c]
jmp 0x43bab6
nop
nop
call fcn.00467880
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x18], rax
jmp 0x43bb74
mov dword [rax + 4], 3
dec dword [0x009b152c]
mov rax, qword [rsp + 0x18]
call fcn.00445680
test rax, rax
jne 0x43bb62
nop
nop
mov ecx, dword [0x009b152c]
mov dword [rsp + 0x14], ecx
lea rax, [0x009b1458]
call fcn.0040bb00
mov ecx, dword [rsp + 0x14]
test ecx, ecx
jle 0x43bbc8
nop
jmp 0x43bba7
call fcn.004446a0
lea rax, [0x009b1530]
mov ebx, 0x186a0
call fcn.0040c040
test al, al
je 0x43bba2
nop
mov qword [0x009b1530], 0
cmp dword [0x009b152c], 0
jne 0x43bbea
mov rcx, qword [0x009b0140]
mov rdx, qword [0x009b0148]
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x43bc6d
mov eax, 0x29
lea rcx, [0x0072b4fd]
mov dl, byte [0x00a049fa]
nop dword [rax]
test dl, dl
je 0x43bc34
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rcx
nop
nop
lea rax, [0x00a04b28]
call fcn.0040b8e0
nop
nop
lea rax, [0x00a04b28]
call fcn.0040b8e0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
test rax, rax
jne 0x43bc43
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rbx, rax
mov rax, rcx
call fcn.00436d20
mov rdi, qword [rcx + rax*8]
cmp dword [rdi + 4], 3
mov edi, 0x2e
cmovne rbx, rdi
lea r8, [0x0072cfff]
cmovne rsi, r8
inc rax
cmp rax, rdx
jl 0x43bc4e
mov rax, rbx
mov rcx, rsi
jmp 0x43bbf6
lea rax, [0x00724815]
mov ebx, 0x1b
call fcn.00436d20
nop
call fcn.00463860
jmp fcn.0043ba20
Function at 0x43bca0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43be78
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x60], al
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x00a04a54]
test edx, edx
je 0x43bcf4
xor eax, eax
nop dword [rax]
call fcn.00430dc0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.0043f7c0
nop
nop
lea rax, [0x009b1458]
nop dword [rax]
call fcn.0040b8e0
mov ecx, dword [0x00a04a48]
mov edx, dword [0x00a04a60]
test edx, edx
je 0x43bd22
mov dword [0x00a04a60], 0
nop
jmp 0x43bd24
mov edx, ecx
mov eax, edx
call fcn.00443000
mov qword [rsp + 0x40], rax
nop
nop
xor ecx, ecx
lea rdx, [0x009b1528]
xchg byte [rdx], cl
mov cl, byte [0x009b1538]
test cl, cl
je 0x43bd65
nop
nop
xor ecx, ecx
lea rdx, [0x009b1538]
xchg byte [rdx], cl
lea rax, [0x009b1540]
nop dword [rax + rax]
call fcn.0040bbe0
nop
nop
lea rax, [0x009b1458]
call fcn.0040bb00
mov rcx, qword [rsp + 0x40]
jmp 0x43bd80
mov rcx, qword [rsp + 0x48]
nop
test rcx, rcx
je 0x43bdda
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rax, rax
je 0x43bdc7
nop
mov qword [rcx + 0x38], 0
cmp qword [rax + 0xa8], 0
jne 0x43be66
nop
mov qword [rax + 0xa8], rcx
add rax, 0x118
nop dword [rax]
call fcn.0040bbe0
jmp 0x43bd7a
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
call fcn.0043cfa0
jmp 0x43bd7a
nop
nop dword [rax + rax]
call fcn.00467880
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x43be25
nop
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
nop dword [rax]
call fcn.004553e0
call fcn.0043db60
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
nop
cmp ecx, 1
jne 0x43be57
cmp byte [r14 + 0xb1], 0
je 0x43be57
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x007299ef]
mov ebx, 0x25
call fcn.00436d20
nop
mov byte [rsp + 8], al
nop dword [rax]
call fcn.00463860
movzx eax, byte [rsp + 8]
jmp fcn.0043bca0
Function at 0x43cfa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43d10c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043c740
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43d0c1
mov rcx, qword [rdx + 0x30]
nop word [rax + rax]
test rcx, rcx
je 0x43d0c1
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x238], 0
jne 0x43d026
cmp byte [rcx + 0xe8], 0
nop
je 0x43d0c1
nop
nop
lea rax, [0x00a05200]
call fcn.0040b8e0
cmp dword [0x00a05220], 0
nop dword [rax + rax]
je 0x43d0fa
mov rcx, qword [0x00a05208]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x128], rcx
nop
mov qword [0x00a05208], rdx
cmp byte [0x00a05210], 0
je 0x43d07d
mov byte [0x00a05210], 0
lea rax, [0x00a05218]
call fcn.0040bbe0
nop
nop
lea rax, [0x00a05200]
call fcn.0040bb00
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43d0b7
cmp byte [r14 + 0xb1], 0
je 0x43d0b7
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043d140
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43d0f0
cmp byte [r14 + 0xb1], 0
je 0x43d0f0
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0072b964]
mov ebx, 0x2a
call fcn.00436d20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00463860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043cfa0