joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4142a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41448f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rbx
call fcn.004384a0
call fcn.004384a0
lea rax, [0x006cf7e7]
mov ebx, 0x11
call fcn.00438da0
mov rax, qword [rsp + 0x30]
call fcn.00438c00
call fcn.00438520
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x4143b7
nop
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x41446a
nop dword [rax + rax]
call fcn.004384a0
lea rax, [0x006d0923]
mov ebx, 0x14
call fcn.00438da0
call fcn.00438520
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.004384a0
lea rax, [0x006cddcb]
mov ebx, 0xd
call fcn.00438da0
mov rax, qword [rsp + 0x28]
call fcn.00438c00
lea rax, [0x006cd7b3]
mov ebx, 0xc
nop
call fcn.00438da0
mov rax, qword [rsp + 0x30]
call fcn.00438c00
lea rax, [0x006cd7bf]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00438da0
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.00438aa0
call fcn.00438520
call fcn.004384a0
nop dword [rax]
call fcn.00438700
call fcn.00438520
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x4143f0
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x006deb81]
mov ebx, 0x3e
call fcn.00436b60
call fcn.004384a0
lea rax, [0x006d5ae7]
mov ebx, 0x1e
call fcn.00438da0
mov rax, qword [rsp + 0x60]
call fcn.00438c00
lea rax, [0x006cb59a]
mov ebx, 1
nop dword [rax]
call fcn.00438da0
mov rax, qword [rsp + 0x38]
call fcn.00438c00
lea rax, [0x006cb5bc]
mov ebx, 2
nop dword [rax + rax]
call fcn.00438da0
call fcn.00438520
lea rax, [0x006cbf30]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x38]
call fcn.0041f7e0
jmp 0x4143d4
call fcn.004384a0
lea rax, [0x006d2eb0]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438da0
call fcn.00438520
jmp 0x41433b
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004142a0
Function at 0x414ae0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rdx, rax
or rax, rbx
or rax, rcx
nop word [rax + rax]
test rax, 7
jne 0x414bef
cmp byte [0x013760e4], 0
je 0x414b3e
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], rdx
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
mov qword [rsp + 0x48], rsi
test byte [rsi], al
mov rax, rdx
mov rbx, rcx
call fcn.00414640
jmp 0x414b48
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.00414760
test rsi, rsi
je 0x414be5
mov rdx, qword [rsp + 0x40]
sub rsi, rdx
mov r8, qword [rsp + 0x68]
add rsi, r8
mov r9, qword [rsp + 0x48]
mov r10, qword [r9 + 0x1260]
mov rsi, qword [rsi]
mov qword [r10], 0
mov qword [r10 + 8], rsi
mov rsi, qword [r9 + 0x1260]
add rsi, 0x10
mov qword [r9 + 0x1260], rsi
cmp qword [r9 + 0x1268], rsi
jne 0x414b48
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor eax, eax
xor ebx, ebx
call fcn.0042fce0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x48]
nop dword [rax + rax]
jmp 0x414b48
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x006d9ad8]
mov ebx, 0x28
nop dword [rax + rax]
call fcn.00436b60
nop
int3
Function at 0x416300
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416535
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x416527
mov rcx, qword [rax + rdx*8 + 0x28]
movzx esi, word [rcx + 0x60]
nop word [rax + rax]
nop
cmp qword [rcx + 0x38], rsi
jne 0x416516
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdx
lea rsi, [0x01376820]
nop dword [rax + rax]
cmp rcx, rsi
je 0x41643a
mov esi, dword [0x01348018]
add esi, 3
cmp dword [rcx + 0x58], esi
jne 0x416505
mov byte [rsp + 0x48], bl
mov qword [rsp + 0x20], rcx
lea rsi, [rdx + rdx*2]
shl rsi, 6
lea rdi, [0x01348310]
lea rax, [rsi + rdi]
mov rbx, rcx
call fcn.00416d60
lea rax, [0x0137a580]
call fcn.0042fae0
test byte [rax], al
mov rcx, qword [rsp + 0x20]
movzx edx, word [rcx + 0x60]
movzx esi, word [rcx + 0x66]
sub rdx, rsi
movzx esi, byte [rsp + 0x48]
mov edi, esi
shr sil, 1
movsx rsi, sil
cmp rsi, 0x44
jae 0x4164f6
mov qword [rsp + 0x18], rdx
lea rbx, [rax + rsi*8]
lea rbx, [rbx + 0x48]
lock xadd qword [rbx], rdx
cmp dil, 5
jne 0x416404
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rdx + 0x20]
lock xadd qword [rax + 0x30], rbx
mov qword [rdx + 0x20], 0
lea rax, [0x0137a580]
call fcn.0042fbc0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x68]
mov rbx, qword [rsp + 0x18]
imul rbx, rdx
nop
lea rdx, [0x01376cb0]
lock xadd qword [rdx], rbx
mov word [rcx + 0x66], 0
mov rdx, qword [rsp + 0x28]
lea rcx, [rdx + rdx*2]
shl rcx, 6
lea rbx, [0x01348310]
lea rax, [rcx + rbx]
call fcn.00416a00
test rax, rax
je 0x4164e5
movzx edx, word [rax + 0x60]
nop
cmp qword [rax + 0x38], rdx
je 0x4164d1
mov qword [rsp + 0x20], rax
mov edx, dword [0x01348018]
add edx, 3
mov dword [rax + 0x58], edx
movzx edx, word [rax + 0x60]
mov word [rax + 0x66], dx
movzx edx, word [rax + 0x60]
mov rsi, qword [rax + 0x68]
imul rdx, rsi
mov rbx, qword [rax + 0x20]
shl rbx, 0xd
sub rbx, rdx
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx + 8]
lea rax, [0x01376ba0]
call fcn.00420d40
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 8], 0
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov qword [rdx + rsi*8 + 0x28], rdi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006d1e08]
mov ebx, 0x16
nop dword [rax]
call fcn.00436b60
lea rax, [0x006ce180]
mov ebx, 0xd
call fcn.00436b60
mov rax, rsi
mov ecx, 0x44
nop
call fcn.00465a20
lea rax, [0x006d1a40]
mov ebx, 0x16
call fcn.00436b60
lea rax, [0x006d9df8]
mov ebx, 0x28
call fcn.00436b60
mov rax, rdx
mov ecx, 0x88
call fcn.00465a20
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop
call fcn.004633c0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00416300
Function at 0x416d60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416e26
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x416e0f
mov ecx, dword [0x01348018]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x416da2
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x416da9
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x416def
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
test rdx, rdx
jle 0x416dd5
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.0042f440
jmp 0x416e05
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
call fcn.0042f440
jmp 0x416e05
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
nop dword [rax + rax]
call fcn.00424140
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d874e]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416d60
Function at 0x4170e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417286
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x41719a
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x41718d
lea rsi, [0x01348070]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x114c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and ecx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x41717d
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00465a40
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.004384a0
call fcn.004384a0
lea rax, [0x006de1fe]
mov ebx, 0x39
nop
call fcn.00438da0
mov rax, qword [rsp + 0x40]
call fcn.00438c00
call fcn.00438700
call fcn.00438520
call fcn.004384a0
lea rax, [0x006d2d5f]
mov ebx, 0x18
call fcn.00438da0
mov rax, qword [rsp + 0x28]
call fcn.00438c00
lea rax, [0x006cb59a]
mov ebx, 1
call fcn.00438da0
mov rax, qword [rsp + 0x20]
call fcn.00438c00
lea rax, [0x006cb5bc]
mov ebx, 2
call fcn.00438da0
call fcn.00438520
lea rax, [0x006cb999]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.0041f7e0
lea rax, [0x006cb82d]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.0041f7e0
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x006d5f16]
mov ebx, 0x1f
nop dword [rax]
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004170e0
Function at 0x417560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417706
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00944068]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433d60
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4175cb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4175e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x417605
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417619
cmp rbx, 0x1000
jae 0x4175d5
nop dword [rax]
jmp 0x417689
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41762d
xor edx, edx
jmp 0x417680
mov rcx, qword [0x00944068]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433d60
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41760f
jmp 0x4175f4
call fcn.00466f80
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004384a0
lea rax, [0x006d2d47]
mov ebx, 0x18
call fcn.00438da0
mov rax, qword [rsp + 0x38]
call fcn.00438aa0
lea rax, [0x006d2e97]
mov ebx, 0x19
call fcn.00438da0
mov rax, qword [rsp + 0x30]
nop
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
lea rax, [0x006d70b5]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00417560
Function at 0x417740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41796a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00944070]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433de0
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4177b9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4177cc
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4177f0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x417804
cmp rbx, 0x1000
jae 0x4177c3
jmp 0x417885
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417816
xor esi, esi
jmp 0x417876
mov rax, qword [0x00944070]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433de0
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4177fa
nop
jmp 0x4177e2
call fcn.00466f80
xorps xmm15, xmm15
mov r14, qword [0x01375e58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417905
call fcn.004384a0
lea rax, [0x006d34d7]
mov ebx, 0x19
call fcn.00438da0
mov rax, qword [rsp + 0x68]
call fcn.00438aa0
lea rax, [0x006d2e97]
mov ebx, 0x19
call fcn.00438da0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
lea rax, [0x006ce180]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00436b60
cmp eax, 0x5af
je 0x4178a8
call fcn.004384a0
lea rax, [0x006d34d7]
mov ebx, 0x19
nop dword [rax]
call fcn.00438da0
mov rax, qword [rsp + 0x38]
call fcn.00438aa0
lea rax, [0x006d2e97]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438da0
mov eax, dword [rsp + 0x34]
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
lea rax, [0x006d61fe]
mov ebx, 0x1f
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417740
Function at 0x418c80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418d8e
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rsi, qword [rax]
nop dword [rax + rax]
test rsi, rsi
je 0x418d61
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x418ce8
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x418cdb
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.004660c0
mov rdi, qword [rsp + 0x18]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x418d18
mov edx, dword [rax + 0x2c]
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov rax, rdx
call fcn.0040dc60
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov esi, dword [rdx + 0x2c]
mov dword [rdx + 0x28], esi
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x418d40
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004384a0
lea rax, [0x006dd3f4]
mov ebx, 0x34
call fcn.00438da0
call fcn.00438520
lea rax, [0x006d262a]
mov ebx, 0x17
call fcn.00436b60
nop
mov qword [rsp + 8], rax
call fcn.004633c0
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00418c80
Function at 0x41bc60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41bce6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41bcd4
cmp byte [rdx + 0x20], bl
je 0x41bcc3
mov qword [rsp + 0x10], rdx
mov byte [rsp + 0x30], bl
mov rax, rdx
mov rbx, rcx
call fcn.0041be60
movzx ecx, byte [rsp + 0x30]
mov rdx, qword [rsp + 0x10]
mov byte [rdx + 0x20], cl
mov byte [rdx + 0x21], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006db643]
mov ebx, 0x2d
call fcn.00436b60
lea rax, [0x006dbf40]
mov ebx, 0x2f
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041bc60

Function at 0x41bd20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41bd99
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp byte [rax + 0x21], 0
je 0x41bd87
mov rdx, qword [rax + 0x40]
nop
cmp rdx, rbx
jg 0x41bd6f
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov rcx, rbx
sub rcx, rdx
movsxd rdx, dword [rax + 0x4c]
imul rcx, rdx
xor ebx, ebx
nop
call fcn.0041c060
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
nop
xchg qword [rax + 0x40], rbx
mov byte [rax + 0x21], 0
call fcn.0041c100
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006dbf6f]
mov ebx, 0x2f
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041bd20

Function at 0x41c160
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c213
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41c201
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x10], rdx
mov rax, rdx
nop dword [rax + rax]
call fcn.0041be60
mov ecx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x10]
mov dword [rax + 0x4c], ecx
movsxd rcx, ecx
imul rcx, rcx, 0x3b9aca00
mov qword [rax + 0x10], rcx
mov rdx, qword [rax + 8]
cmp rdx, rcx
jbe 0x41c1e6
mov qword [rax + 8], rcx
nop
nop
lea rcx, [rax + 4]
mov edx, 1
xchg byte [rcx], dl
mov ecx, dword [0x0137c398]
inc ecx
xchg dword [rax + 0x48], ecx
jmp 0x41c1f2
jae 0x41c1f2
nop
nop
lea rcx, [rax + 4]
xor edx, edx
xchg byte [rcx], dl
call fcn.0041c100
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d9c68]
mov ebx, 0x28
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.004633c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.0041c160
Function at 0x41c2e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c446
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
jmp 0x41c2fd
mov rax, rdx
mov rdx, qword [rax]
mov rsi, rdx
shr rdx, 0x3d
cmp bl, dl
jne 0x41c3dc
mov rdx, rax
mov rax, rsi
xor edi, edi
lock cmpxchg qword [rdx], rdi
sete r8b
test r8b, r8b
je 0x41c2fa
movabs rdx, 0xe000000000000000
and rdx, rcx
movabs rdi, 0x1fffffffffffffff
and rdi, rsi
or rdx, rdi
mov rsi, rcx
sub rcx, rdx
cmp rsi, rdx
mov edx, 0
cmovl rcx, rdx
test rcx, rcx
je 0x41c3c1
cmp bl, 2
ja 0x41c380
nop
cmp bl, 1
jne 0x41c374
nop
lea rax, [0x01376498]
lock xadd qword [rax], rcx
jmp 0x41c3b7
cmp bl, 2
je 0x41c385
jmp 0x41c3cb
cmp bl, 3
jne 0x41c394
nop
lea rax, [0x01376488]
lock xadd qword [rax], rcx
jmp 0x41c3b7
cmp bl, 4
jne 0x41c3cb
nop
nop
lea rax, [0x01376498]
mov rdx, rcx
lock xadd qword [rax], rcx
nop
lea rax, [0x01322cd0]
lock xadd qword [rax], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006dd123]
mov ebx, 0x33
call fcn.00436b60
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x10], rdx
call fcn.004384a0
lea rax, [0x006ce640]
mov ebx, 0xe
call fcn.00438da0
movzx eax, byte [rsp + 0x30]
movzx eax, al
call fcn.00438aa0
lea rax, [0x006cba81]
mov ebx, 5
call fcn.00438da0
mov rax, qword [rsp + 0x10]
nop
call fcn.00438aa0
call fcn.00438700
call fcn.00438520
lea rax, [0x006debfd]
mov ebx, 0x3e
nop dword [rax + rax]
call fcn.00436b60
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.004633c0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041c2e0
Function at 0x41fc20
Capabilities:
Hash data using murmur3
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x01375c42], 0
jne 0x41fd0f
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41fd05
lea rbx, [0x01348070]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41fce7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00465a40
lea rax, [0x006dafa8]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00436b60
nop
int3