joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414e20
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test rax, rax
je 0x415045
mov qword [rsp + 0x58], rax
nop dword [rax]
cmp qword [rax], rdi
jne 0x414f9b
movzx edx, byte [rax + 0x17]
test dl, 0x40
jne 0x414f3d
cmp byte [0x0092b0b4], 0
je 0x414e86
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0xa0]
mov qword [rsp + 0x40], rdx
test byte [rdx], al
mov rsi, qword [rax + 0x20]
xor edi, edi
xor r8d, r8d
jmp 0x414e94
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rdi, 8
cmp qword [rax + 8], rdi
jbe 0x414f33
nop
test rdi, 0x3f
jne 0x414eb2
movzx r8d, byte [rsi]
inc rsi
jmp 0x414eb5
shr r8d, 1
bt r8d, 0
jae 0x414e90
lea r9, [rdi + rbx]
lea r10, [rdi + rcx]
mov r11, qword [rdx + 0x1260]
mov r9, qword [r9]
mov r10, qword [r10]
mov qword [r11], r9
mov qword [r11 + 8], r10
mov r9, qword [rdx + 0x1260]
add r9, 0x10
mov qword [rdx + 0x1260], r9
cmp qword [rdx + 0x1268], r9
jne 0x414e90
mov qword [rsp + 0x18], rdi
mov dword [rsp + 0x14], r8d
mov qword [rsp + 0x30], rsi
xor eax, eax
xor ebx, ebx
call fcn.0042fd40
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x18]
mov r8d, dword [rsp + 0x14]
jmp 0x414e90
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
nop dword [rax]
call fcn.0045afe0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
call fcn.00438500
lea rax, [0x006d8298]
mov ebx, 0x28
call fcn.00438e00
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.00438e00
lea rax, [0x006cc4ff]
mov ebx, 0xf
call fcn.00438e00
call fcn.00438580
lea rax, [0x006d6819]
mov ebx, 0x24
call fcn.00436bc0
mov qword [rsp + 0x70], rdi
call fcn.0045afe0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rcx
nop dword [rax]
call fcn.00438500
lea rax, [0x006d8298]
mov ebx, 0x28
call fcn.00438e00
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.00438e00
lea rax, [0x006caf18]
mov ebx, 0xb
call fcn.00438e00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438b00
lea rax, [0x006cd683]
mov ebx, 0x12
call fcn.00438e00
mov rax, qword [rsp + 0x70]
nop dword [rax + rax]
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006d6819]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00436bc0
lea rax, [0x006d8789]
mov ebx, 0x29
call fcn.00436bc0
nop
int3
Function at 0x416360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416595
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x416587
mov rcx, qword [rax + rdx*8 + 0x28]
movzx esi, word [rcx + 0x60]
nop word [rax + rax]
nop
cmp qword [rcx + 0x38], rsi
jne 0x416576
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdx
lea rsi, [0x0092b7e0]
nop dword [rax + rax]
cmp rcx, rsi
je 0x41649a
mov esi, dword [0x008fcff8]
add esi, 3
cmp dword [rcx + 0x58], esi
jne 0x416565
mov byte [rsp + 0x48], bl
mov qword [rsp + 0x20], rcx
lea rsi, [rdx + rdx*2]
shl rsi, 6
lea rdi, [0x008fd2f0]
lea rax, [rsi + rdi]
mov rbx, rcx
call fcn.00416dc0
lea rax, [0x0092f540]
call fcn.0042fb40
test byte [rax], al
mov rcx, qword [rsp + 0x20]
movzx edx, word [rcx + 0x60]
movzx esi, word [rcx + 0x66]
sub rdx, rsi
movzx esi, byte [rsp + 0x48]
mov edi, esi
shr sil, 1
movsx rsi, sil
cmp rsi, 0x44
jae 0x416556
mov qword [rsp + 0x18], rdx
lea rbx, [rax + rsi*8]
lea rbx, [rbx + 0x48]
lock xadd qword [rbx], rdx
cmp dil, 5
jne 0x416464
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rdx + 0x20]
lock xadd qword [rax + 0x30], rbx
mov qword [rdx + 0x20], 0
lea rax, [0x0092f540]
call fcn.0042fc20
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x68]
mov rbx, qword [rsp + 0x18]
imul rbx, rdx
nop
lea rdx, [0x0092bc70]
lock xadd qword [rdx], rbx
mov word [rcx + 0x66], 0
mov rdx, qword [rsp + 0x28]
lea rcx, [rdx + rdx*2]
shl rcx, 6
lea rbx, [0x008fd2f0]
lea rax, [rcx + rbx]
call fcn.00416a60
test rax, rax
je 0x416545
movzx edx, word [rax + 0x60]
nop
cmp qword [rax + 0x38], rdx
je 0x416531
mov qword [rsp + 0x20], rax
mov edx, dword [0x008fcff8]
add edx, 3
mov dword [rax + 0x58], edx
movzx edx, word [rax + 0x60]
mov word [rax + 0x66], dx
movzx edx, word [rax + 0x60]
mov rsi, qword [rax + 0x68]
imul rdx, rsi
mov rbx, qword [rax + 0x20]
shl rbx, 0xd
sub rbx, rdx
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx + 8]
lea rax, [0x0092bb60]
call fcn.00420da0
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 8], 0
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov qword [rdx + rsi*8 + 0x28], rdi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006cfcd2]
mov ebx, 0x16
nop dword [rax]
call fcn.00436bc0
lea rax, [0x006cbf0b]
mov ebx, 0xd
call fcn.00436bc0
mov rax, rsi
mov ecx, 0x44
nop
call fcn.00465da0
lea rax, [0x006cf89c]
mov ebx, 0x16
call fcn.00436bc0
lea rax, [0x006d8158]
mov ebx, 0x28
call fcn.00436bc0
mov rax, rdx
mov ecx, 0x88
call fcn.00465da0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop
call fcn.00463740
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00416360
Function at 0x416dc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416e86
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x416e6f
mov ecx, dword [0x008fcff8]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x416e02
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x416e09
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x416e4f
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
test rdx, rdx
jle 0x416e35
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.0042f4a0
jmp 0x416e65
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
call fcn.0042f4a0
jmp 0x416e65
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
nop dword [rax + rax]
call fcn.004241a0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d69a5]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416dc0

Function at 0x416fa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4170a6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rdx, qword [0x008fd298]
mov qword [rsp + 0x30], rdx
mov rsi, qword [0x008fd2a0]
mov qword [rsp + 0x28], rsi
xor eax, eax
jmp 0x416fe6
mov rax, qword [rsp + 0x20]
inc rax
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
cmp rax, rsi
jge 0x417076
mov rdi, qword [rdx + rax*8]
mov r8, rdi
shr rdi, 0x14
nop word [rax + rax]
cmp rdi, 0x40
jae 0x417098
mov qword [rsp + 0x20], rax
lea r9, [0x008fd050]
mov rdi, qword [r9 + rdi*8]
test byte [rdi], al
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x114c0]
test r8, r8
je 0x417047
mov rax, r8
mov ebx, 0x10000
nop dword [rax]
call fcn.00466440
jmp 0x416fd4
mov qword [rsp + 0x18], rdi
mov eax, 0x10000
xor ebx, ebx
lea rcx, [0x00930338]
call fcn.0040dcc0
nop
test rax, rax
je 0x417087
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x114c0], rax
jmp 0x416fd4
mov byte [0x0092ac22], 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006d8b47]
mov ebx, 0x2a
call fcn.00436bc0
mov rax, rdi
mov ecx, 0x40
call fcn.00465dc0
nop
call fcn.00463740
jmp fcn.00416fa0
Function at 0x417140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4172e6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x4171fa
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x4171ed
lea rsi, [0x008fd050]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x114c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and ecx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x4171dd
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00465dc0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.00438500
call fcn.00438500
lea rax, [0x006dc675]
mov ebx, 0x39
nop
call fcn.00438e00
mov rax, qword [rsp + 0x40]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
call fcn.00438500
lea rax, [0x006d0c8a]
mov ebx, 0x18
call fcn.00438e00
mov rax, qword [rsp + 0x28]
call fcn.00438c60
lea rax, [0x006c935a]
mov ebx, 1
call fcn.00438e00
mov rax, qword [rsp + 0x20]
call fcn.00438c60
lea rax, [0x006c937c]
mov ebx, 2
call fcn.00438e00
call fcn.00438580
lea rax, [0x006c975a]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.0041f840
lea rax, [0x006c95eb]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.0041f840
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x006d3fe4]
mov ebx, 0x1f
nop dword [rax]
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00417140
Function at 0x4175c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417766
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433dc0
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41762b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417640
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x417665
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417679
cmp rbx, 0x1000
jae 0x417635
nop dword [rax]
jmp 0x4176e9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41768d
xor edx, edx
jmp 0x4176e0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433dc0
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41766f
jmp 0x417654
call fcn.00467300
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438500
lea rax, [0x006d0c72]
mov ebx, 0x18
call fcn.00438e00
mov rax, qword [rsp + 0x38]
call fcn.00438b00
lea rax, [0x006d0daa]
mov ebx, 0x19
call fcn.00438e00
mov rax, qword [rsp + 0x30]
nop
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006d5282]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004175c0
Function at 0x4177a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4179ca
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433e40
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417819
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41782c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417850
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x417864
cmp rbx, 0x1000
jae 0x417823
jmp 0x4178e5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417876
xor esi, esi
jmp 0x4178d6
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433e40
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41785a
nop
jmp 0x417842
call fcn.00467300
xorps xmm15, xmm15
mov r14, qword [0x0092ae40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417965
call fcn.00438500
lea rax, [0x006d14cb]
mov ebx, 0x19
call fcn.00438e00
mov rax, qword [rsp + 0x68]
call fcn.00438b00
lea rax, [0x006d0daa]
mov ebx, 0x19
call fcn.00438e00
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006cbf0b]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00436bc0
cmp eax, 0x5af
je 0x417908
call fcn.00438500
lea rax, [0x006d14cb]
mov ebx, 0x19
nop dword [rax]
call fcn.00438e00
mov rax, qword [rsp + 0x38]
call fcn.00438b00
lea rax, [0x006d0daa]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438e00
mov eax, dword [rsp + 0x34]
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006d4329]
mov ebx, 0x1f
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004177a0
Function at 0x418ce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418dee
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rsi, qword [rax]
nop dword [rax + rax]
test rsi, rsi
je 0x418dc1
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x418d48
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x418d3b
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.00466440
mov rdi, qword [rsp + 0x18]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x418d78
mov edx, dword [rax + 0x2c]
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov rax, rdx
call fcn.0040dcc0
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov esi, dword [rdx + 0x2c]
mov dword [rdx + 0x28], esi
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x418da0
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00438500
lea rax, [0x006db834]
mov ebx, 0x34
call fcn.00438e00
call fcn.00438580
lea rax, [0x006d04f5]
mov ebx, 0x17
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
call fcn.00463740
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00418ce0
Function at 0x41b5e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x41b7b5
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp dword [0x0092ac64], 0
nop
jne 0x41b7a3
mov qword [rsp + 0x28], rax
nop
nop
lea rax, [0x008ecee0]
call fcn.0040b7a0
add dword [0x008fcff8], 2
nop
nop
xor ecx, ecx
lea rdx, [0x008d67bc]
xchg dword [rdx], ecx
nop
xor ecx, ecx
lea rdx, [0x008fd020]
xchg qword [rdx], rcx
mov rcx, qword [0x008fd298]
mov rdx, qword [0x008fd2a0]
mov rbx, qword [0x008fd2a8]
mov qword [0x008fd2b8], rdx
mov qword [0x008fd2c0], rbx
cmp dword [0x0092b0b0], 0
jne 0x41b66f
mov qword [0x008fd2b0], rcx
jmp 0x41b67b
lea rdi, [0x008fd2b0]
call fcn.00465a00
nop
xor ecx, ecx
lea rdx, [0x008fd040]
xchg qword [rdx], rcx
nop
xor ecx, ecx
lea rdx, [0x008fd048]
xchg qword [rdx], rcx
nop
nop
lea rax, [0x008ecee0]
nop
call fcn.0040b9c0
nop
xor ecx, ecx
lea rdx, [0x008d67c0]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x28]
cmp rcx, 2
jne 0x41b6e7
nop
nop
lea rax, [0x008ecee0]
call fcn.0040b7a0
xorps xmm0, xmm0
movsd qword [0x008fd038], xmm0
nop
nop
lea rax, [0x008ecee0]
nop
call fcn.0040b9c0
jmp 0x41b736
nop
nop
lea rax, [0x008d67a0]
call fcn.0040b7a0
cmp byte [0x008d67b0], 0
je 0x41b718
mov byte [0x008d67b0], 0
mov rax, qword [0x008d67a8]
xor ebx, ebx
mov ecx, 1
call fcn.0043a920
nop
nop
lea rax, [0x008d67a0]
call fcn.0040b9c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
inc dword [0x008d67b8]
call fcn.00423dc0
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
jne 0x41b730
call fcn.00426020
xor eax, eax
call fcn.00426120
test al, al
jne 0x41b74b
nop
nop
nop
mov eax, dword [0x0092ac6c]
mov ecx, eax
shr eax, 1
lea edx, [rax + 1]
mov ebx, 0xaaaaaaab
imul rdx, rbx
shr rdx, 0x3a
lea edx, [rdx + rdx*2]
shl edx, 0x19
sub eax, edx
lea edx, [rax + 1]
shl edx, 1
mov eax, ecx
lea rcx, [0x0092ac6c]
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
je 0x41b758
call fcn.0042d720
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d8574]
mov ebx, 0x29
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
call fcn.004681c0
mov rax, qword [rsp + 8]
jmp fcn.0041b5e0
Function at 0x41baa0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
cmp rdi, 0x989680
jb 0x41badf
mov rdx, rax
movabs rax, 0x8637bd05af6c69b6
mov rsi, rdx
mul rdi
shr rdx, 0x13
lea rdi, [rbx - 1]
mov rax, rdi
jmp 0x41bc17
shr rdi, 1
mov rdx, rax
movabs rax, 0x83126e978d4fdf3c
mov rsi, rdx
mul rdi
shr rdx, 8
test rdx, rdx
je 0x41bb05
mov eax, 3
jmp 0x41bb53
test rbx, rbx
jbe 0x41bb31
mov byte [rsi], 0x30
cmp rcx, 1
jb 0x41bb25
mov rax, rsi
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 1
xor edx, edx
call fcn.00465e20
xor eax, eax
mov rcx, rax
call fcn.00465da0
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mul rdx
shr rdx, 3
lea rax, [rdi - 1]
cmp rdx, 0x64
jae 0x41bb3b
lea rdi, [rbx - 1]
mov r8, rbx
sub rbx, rax
lea r9, [rbx - 1]
jmp 0x41bb6c
mov rdi, rax
cmp rdx, 0xa
jae 0x41bb77
cmp rdi, r9
jl 0x41bbc0
movabs rax, 0xcccccccccccccccd
mov rbx, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub rbx, r10
cmp r8, rdi
jbe 0x41bc06
lea r10, [rbx + 0x30]
mov byte [rsi + rdi], r10b
lea rax, [rdi - 1]
cmp rax, r9
jne 0x41bb69
cmp r8, rax
jbe 0x41bbfe
mov byte [rdi + rsi - 1], 0x2e
lea rax, [rdi - 2]
jmp 0x41bb69
cmp r8, rdi
jbe 0x41bbf3
add rdx, 0x30
mov byte [rsi + rdi], dl
sub rcx, rdi
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdi
lea rax, [rcx + rsi]
sub r8, rdi
mov rbx, r8
mov rcx, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdi
mov rcx, r8
call fcn.00465da0
mov rcx, r8
call fcn.00465da0
mov rax, rdi
mov rcx, r8
call fcn.00465da0
mov rdi, rax
mov rax, r8
cmp rdx, 0xa
jae 0x41bc25
nop dword [rax]
cmp rdi, rax
jl 0x41bc70
mov r8, rax
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, rdi
jbe 0x41bcb4
add r9, 0x30
mov byte [rsi + rdi], r9b
lea rax, [rdi - 1]
cmp rax, r8
jne 0x41bc11
nop dword [rax]
cmp rbx, rax
jbe 0x41bcac
mov byte [rdi + rsi - 1], 0x2e
lea rax, [rdi - 2]
jmp 0x41bc11
cmp rbx, rdi
jbe 0x41bca1
add rdx, 0x30
mov byte [rsi + rdi], dl
sub rcx, rdi
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdi
lea rax, [rsi + rcx]
sub rbx, rdi
mov rcx, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
mov rax, rdi
mov rcx, rbx
call fcn.00465da0
mov rcx, rbx
call fcn.00465da0
mov rax, rdi
mov rcx, rbx
call fcn.00465da0
nop
Function at 0x41bcc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41bd46
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41bd34
cmp byte [rdx + 0x20], bl
je 0x41bd23
mov qword [rsp + 0x10], rdx
mov byte [rsp + 0x30], bl
mov rax, rdx
mov rbx, rcx
call fcn.0041bec0
movzx ecx, byte [rsp + 0x30]
mov rdx, qword [rsp + 0x10]
mov byte [rdx + 0x20], cl
mov byte [rdx + 0x21], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d9a1e]
mov ebx, 0x2d
call fcn.00436bc0
lea rax, [0x006da31b]
mov ebx, 0x2f
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.00463740
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041bcc0

Function at 0x41bd80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41bdf9
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp byte [rax + 0x21], 0
je 0x41bde7
mov rdx, qword [rax + 0x40]
nop
cmp rdx, rbx
jg 0x41bdcf
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov rcx, rbx
sub rcx, rdx
movsxd rdx, dword [rax + 0x4c]
imul rcx, rdx
xor ebx, ebx
nop
call fcn.0041c0c0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
nop
xchg qword [rax + 0x40], rbx
mov byte [rax + 0x21], 0
call fcn.0041c160
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006da34a]
mov ebx, 0x2f
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041bd80

Function at 0x41c1c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c273
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41c261
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x10], rdx
mov rax, rdx
nop dword [rax + rax]
call fcn.0041bec0
mov ecx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x10]
mov dword [rax + 0x4c], ecx
movsxd rcx, ecx
imul rcx, rcx, 0x3b9aca00
mov qword [rax + 0x10], rcx
mov rdx, qword [rax + 8]
cmp rdx, rcx
jbe 0x41c246
mov qword [rax + 8], rcx
nop
nop
lea rcx, [rax + 4]
mov edx, 1
xchg byte [rcx], dl
mov ecx, dword [0x00931358]
inc ecx
xchg dword [rax + 0x48], ecx
jmp 0x41c252
jae 0x41c252
nop
nop
lea rcx, [rax + 4]
xor edx, edx
xchg byte [rcx], dl
call fcn.0041c160
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d7fc8]
mov ebx, 0x28
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.00463740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.0041c1c0