joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414e90
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41501f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x4000
call fcn.004296c0
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x414f90
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
jmp 0x414f72
mov rax, qword [rsp + 0x28]
shr rax, 1
and rax, 0xfffffffffffff000
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, 0x1000
jb 0x414f5c
mov rdx, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x4000
call fcn.004296c0
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x414eff
mov rax, qword [rsp + 0x28]
cmp rax, 0x1000
jb 0x414f9a
mov rdx, qword [rsp + 0x30]
sub rdx, rax
mov rbx, qword [rsp + 0x40]
lea rcx, [rbx + rax]
mov rax, rdx
test rax, rax
jbe 0x414f86
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rcx
mov rdx, rax
jmp 0x414f17
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.004563c0
mov eax, dword [rsp]
mov qword [rsp + 0x38], rax
call fcn.0042bc80
lea rax, [0x006b16f3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0042c640
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006b17fb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c640
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006b4e5b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00414e90
Function at 0x415030
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4151d4
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00429720
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov rdx, rcx
cmp rcx, rax
je 0x415145
mov rax, qword [rsp + 0x68]
jmp 0x415127
mov rax, qword [rsp + 0x30]
shr rax, 1
and rax, 0xfffffffffffff000
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp rax, 0x1000
jb 0x415111
mov rcx, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00429720
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x4150ab
mov rax, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x41514f
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rbx, qword [rsp + 0x48]
lea rdx, [rbx + rax]
mov rax, rcx
test rax, rax
jbe 0x41513b
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rdx
mov rcx, rax
jmp 0x4150c3
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.004563c0
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.0042bc80
lea rax, [0x006b1d8c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c640
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006b17fb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c640
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006b4302]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00415030

Function at 0x4151e0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.00425a20
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x8000
call fcn.004296c0
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x415246
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.004563c0
mov eax, dword [rsp]
mov qword [rsp + 0x28], rax
call fcn.0042bc80
lea rax, [0x006b16f3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0042c640
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006b17fb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c640
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006b473b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042b3a0
ud2
Function at 0x415400
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41553d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.00425970
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00429720
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, rcx
jne 0x41548f
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.004563c0
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
call fcn.0042bc80
lea rax, [0x006b1d8c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c640
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006b17fb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c640
mov eax, dword [rsp + 0x34]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
mov eax, dword [rsp + 0x34]
cmp eax, 8
je 0x415522
cmp eax, 0x5af
je 0x415522
lea rax, [0x006b88e2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x30
call fcn.0042b3a0
ud2
lea rax, [0x006ad49d]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00415400
Function at 0x416660
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4167ca
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x41678c
mov rbx, qword [rax + 0x18]
test rbx, rbx
je 0x4166e8
mov rcx, qword [rbx]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add rcx, qword [rax + 0x30]
mov qword [rax + 0x30], rcx
movzx ecx, byte [rax + 0x40]
test cl, cl
jne 0x4166cb
mov qword [rsp + 0x48], rbx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x28], rbx
mov rax, qword [rax]
mov qword [rsp + 8], rax
mov qword [rsp], rbx
call fcn.00455980
mov rbx, qword [rsp + 0x28]
jmp 0x4166bc
mov ebx, dword [rax + 0x28]
cmp rbx, rcx
jb 0x416750
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x41672d
mov rdx, qword [rax]
add rdx, qword [rax + 0x20]
mov qword [rax + 0x20], rdx
mov edx, dword [rax + 0x28]
mov rbx, qword [rax]
sub edx, ebx
mov dword [rax + 0x28], edx
mov rdx, qword [rax]
add rdx, qword [rax + 0x30]
mov qword [rax + 0x30], rdx
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x20], rcx
mov rbx, qword [rax + 0x10]
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
jmp 0x4166fd
mov rcx, qword [rax + 0x38]
mov qword [rsp + 0x10], rcx
mov qword [rsp], 0x4000
mov qword [rsp + 8], 0
call fcn.00410fe0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x20], rax
mov dword [rcx + 0x28], 0x4000
mov rax, rcx
jmp 0x4166f0
call fcn.0042bc80
lea rax, [0x006b9741]
mov qword [rsp], rax
mov qword [rsp + 8], 0x34
call fcn.0042c640
call fcn.0042bd10
lea rax, [0x006b10d5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00416660
Function at 0x417690
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x417902
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, dword [0x00850ab0]
test eax, eax
je 0x4178e7
mov rax, qword [rsp + 0x30]
test byte [rax], al
mov rcx, qword [rax + 0x1258]
test rcx, rcx
je 0x4178d4
lea rcx, [rax + 0x1270]
test byte [rcx], al
mov rcx, qword [rax + 0x1270]
test rcx, rcx
je 0x4178ca
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x4178c3
mov rcx, qword [rax + 0x1278]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
sete cl
test cl, cl
je 0x4178b9
mov rcx, qword [0x00835c40]
test rcx, rcx
jne 0x4178af
mov ecx, dword [0x00835cc8]
mov edx, dword [0x00835ccc]
cmp ecx, edx
jae 0x4178a8
mov ecx, 1
test cl, cl
je 0x417895
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 0x38]
test byte [rdx], al
mov rdx, qword [rcx + 0x38]
test rdx, rdx
jle 0x41788e
mov rdx, 0xffffffffffffffff
lock xadd qword [rcx + 0x38], rdx
dec rdx
test rdx, rdx
jl 0x417883
mov edx, 1
test dl, dl
je 0x4177ee
mov qword [rax + 0x1260], 0
mov rax, qword [rax + 0x1258]
mov qword [rsp + 0x10], rax
mov qword [rsp], rax
movabs rcx, 0x100000004
mov qword [rsp + 8], rcx
call fcn.0042ecf0
movzx eax, byte [0x00840930]
test al, al
jne 0x4177d5
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00448db0
jmp 0x4177c1
movsd xmm0, qword [rcx + 0x50]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x4177fe
jnp 0x417870
call fcn.00456740
mov rax, qword [rsp]
sub rax, qword [0x00851170]
test rax, rax
jle 0x417869
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x1250]
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
mov rax, qword [rsp + 0x28]
movsd xmm1, qword [rax + 0x50]
ucomisd xmm0, xmm1
ja 0x417856
mov qword [rcx + 0x1260], 1
mov rax, rcx
jmp 0x417792
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x30]
jmp 0x417843
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov edx, 1
lock xadd qword [rcx + 0x38], rdx
xor edx, edx
jmp 0x417783
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor ecx, ecx
jmp 0x417745
mov ecx, 1
jmp 0x417745
mov ecx, 1
jmp 0x417745
xor ecx, ecx
jmp 0x417714
mov ecx, 1
jmp 0x417714
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006b9b97]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00417690
Function at 0x4197f0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x419aed
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, dword [0x00850ec0]
test eax, eax
jg 0x419a77
mov eax, dword [0x00850ab8]
cmp eax, 2
jne 0x419ad2
mov rax, qword [rsp + 0x28]
mov qword [0x00835cd8], rax
call fcn.0041abb0
mov qword [0x00835ce0], 0
call fcn.0042e410
mov eax, dword [rsp]
mov dword [0x00835cd0], eax
mov rax, qword [0x00835c40]
test rax, rax
jne 0x419a6b
mov rax, qword [0x00835d00]
add rax, qword [0x00835d08]
add rax, qword [0x00835d10]
add rax, qword [0x00835d18]
test rax, rax
jne 0x419a6b
mov byte [0x00835cf0], 0
mov eax, dword [0x00835cd0]
cmp eax, 1
ja 0x419a44
call fcn.0041a060
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 0xa0]
test byte [rcx], al
test byte [rax], al
lea rax, [rcx + 0x1270]
mov qword [rsp + 0x10], rax
movzx ecx, byte [0x00835cf0]
test cl, cl
je 0x419a2d
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.0041cd30
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.004201e0
mov eax, dword [0x00850ecc]
test eax, eax
jg 0x419a23
mov rax, qword [0x00835c40]
test rax, rax
jne 0x419ab7
mov eax, dword [0x00835cd0]
cmp eax, 1
ja 0x419a0e
mov byte [0x00835d20], 1
mov rax, qword [0x00834f60]
mov rcx, qword [0x00834f68]
xor edx, edx
jmp 0x419952
inc rdx
cmp rdx, rcx
jge 0x4199c3
mov rbx, qword [rax + rdx*8]
test byte [rbx], al
lea rsi, [rbx + 0x1270]
test byte [rsi], al
mov rsi, qword [rbx + 0x1270]
test rsi, rsi
je 0x4199bc
mov rsi, qword [rsi + 0x10]
test rsi, rsi
jne 0x4199b8
mov rsi, qword [rbx + 0x1278]
mov rsi, qword [rsi + 0x10]
test rsi, rsi
sete sil
test sil, sil
je 0x419a9c
mov rsi, qword [rbx + 0x1288]
test rsi, rsi
jne 0x419a81
mov rbx, qword [rbx + 0x1280]
test rbx, rbx
jne 0x419a81
jmp 0x41994f
xor esi, esi
jmp 0x41998d
mov esi, 1
jmp 0x41998d
call fcn.00425770
mov rax, qword [0x00835cc0]
mov qword [0x00854010], rax
mov rax, qword [0x00835cc0]
mov qword [0x00854000], rax
mov rax, qword [0x00851140]
mov qword [0x00854008], rax
movzx eax, byte [0x00840930]
test al, al
jne 0x419a07
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00449100
jmp 0x4199fd
lea rax, [0x00835ce8]
mov qword [rsp], rax
call fcn.0040f110
jmp 0x419936
call fcn.0041ad50
jmp 0x419917
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0041cd30
jmp 0x4198fb
lea rax, [0x00835ce8]
test byte [rax], al
mov qword [0x00835ce8], 0
mov eax, dword [0x00835cd0]
mov dword [rsp], eax
call fcn.0042e550
jmp 0x4198aa
mov byte [0x00835cf0], 1
jmp 0x41989b
call fcn.004255a0
jmp 0x419826
lea rax, [0x006b8792]
mov qword [rsp], rax
mov qword [rsp + 8], 0x30
call fcn.0042b3a0
ud2
lea rax, [0x006b84a2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2f
call fcn.0042b3a0
ud2
lea rax, [0x006ad9eb]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042b3a0
ud2
lea rax, [0x006ba2a4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x38
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.004197f0
Function at 0x419b00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x419c9e
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, dword [0x00850ab8]
test eax, eax
jne 0x419c83
lea rax, [0x00839400]
mov qword [rsp], rax
call fcn.0040eda0
add dword [0x0083a420], 2
mov dword [0x0083a424], 0
mov eax, dword [0x0083a420]
shr eax, 1
and eax, 1
lea rax, [rax + rax*4]
lea rcx, [0x0083a460]
mov eax, dword [rcx + rax*8 + 0x20]
test eax, eax
jne 0x419c68
mov qword [0x0083a4c0], 0
lea rax, [0x00839400]
mov qword [rsp], rax
call fcn.0040ef90
mov rax, qword [rsp + 0x28]
cmp rax, 2
jne 0x419c0c
lea rax, [0x00839400]
mov qword [rsp], rax
call fcn.0040eda0
xorps xmm0, xmm0
movsd qword [0x0083a4d8], xmm0
lea rax, [0x00839400]
mov qword [rsp], rax
call fcn.0040ef90
jmp 0x419bd2
inc dword [0x00835098]
call fcn.0041e9c0
mov rax, qword [rsp]
cmp rax, 0xffffffffffffffff
jne 0x419bcc
call fcn.00420b80
mov byte [rsp], 0
call fcn.00420c30
movzx eax, byte [rsp + 8]
test al, al
jne 0x419be6
call fcn.00424990
call fcn.00424a10
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00835080]
mov qword [rsp], rax
call fcn.0040eda0
movzx eax, byte [0x00835090]
test al, al
jne 0x419c41
lea rax, [0x00835080]
mov qword [rsp], rax
call fcn.0040ef90
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov byte [0x00835090], 0
mov rax, qword [0x00835088]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.0042e170
jmp 0x419c27
lea rax, [0x006afcf4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0042b3a0
ud2
lea rax, [0x006b6ff0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00419b00

Function at 0x41a060
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41a0eb
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov edx, dword [rcx + 0xe0]
cmp edx, 0x20
jae 0x41a0d0
mov rcx, qword [rcx]
cmp rax, rcx
jne 0x41a0b5
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006b451b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042b3a0
ud2
lea rax, [0x006b2e3f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1c
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0041a060
Function at 0x41a670
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41a7a3
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rax + 0x18]
cmp rcx, rdx
jne 0x41a788
jmp 0x41a6b9
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
test rcx, rcx
je 0x41a700
je 0x41a6d6
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x41a6eb
mov edx, dword [rdx + 0x28]
mov ecx, dword [rcx + 0x28]
cmp edx, ecx
jae 0x41a6eb
mov rcx, qword [rsp + 0x20]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0041aae0
jmp 0x41a6b4
mov rcx, qword [rsp + 0x20]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0041aa10
jmp 0x41a6b4
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x41a70e
test rcx, rcx
jmp 0x41a6c1
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x41a77a
mov rdx, qword [rcx + 8]
cmp rdx, rax
jne 0x41a771
mov qword [rcx + 8], 0
mov qword [rax + 0x20], 0
mov qword [rax + 0x18], 0
lea rcx, [0x0083c960]
test byte [rcx], al
mov rcx, qword [0x0083c990]
sub rcx, qword [0x0083c960]
mov qword [0x0083c990], rcx
mov rcx, qword [0x0083c978]
mov qword [rax], rcx
mov qword [0x0083c978], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rcx], 0
jmp 0x41a728
mov rcx, qword [rsp + 0x20]
mov qword [rcx], 0
jmp 0x41a728
lea rax, [0x006b6849]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0041a670

Function at 0x41a7b0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41a86d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x30]
test rcx, rcx
je 0x41a83f
mov rbx, qword [rcx + 0x20]
test rbx, rbx
je 0x41a852
mov rsi, qword [rcx + 0x18]
cmp rsi, rdx
jae 0x41a801
mov rcx, qword [rcx]
jmp 0x41a7e5
mov qword [rsp + 0x10], rbx
mov rsi, qword [rcx + 8]
test rsi, rsi
je 0x41a81d
mov rdi, qword [rsi + 0x18]
cmp rdi, rdx
jb 0x41a81d
mov rcx, rsi
jmp 0x41a7e5
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0041a670
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006b5008]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0041a7b0
Function at 0x41b570
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41b7a9
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movzx eax, byte [0x00835d20]
test al, al
jne 0x41b78e
mov eax, dword [0x0083a420]
mov dword [rsp + 0x28], eax
shr eax, 1
and eax, 1
lea rax, [rax + rax*4]
lea rdx, [0x0083a460]
lea rax, [rdx + rax*8]
mov qword [rsp], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 8], rax
call fcn.0041fb90
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x40], rcx
xor edx, edx
jmp 0x41b5f3
inc rdx
cmp rdx, rax
jge 0x41b717
mov rbx, qword [rcx + rdx*8]
movzx esi, byte [rbx + 0x64]
cmp sil, 1
jne 0x41b5f0
movzx esi, byte [0x00850a73]
test sil, sil
je 0x41b707
mov rsi, qword [rbx + 0x90]
test rsi, rsi
je 0x41b5f0
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x48], rbx
lea rax, [rbx + 0x88]
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
call fcn.0040eda0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x90]
jmp 0x41b656
mov rcx, qword [rcx]
test rcx, rcx
je 0x41b6e5
movzx edx, byte [rcx + 0xa]
cmp dl, 1
jne 0x41b653
movzx edx, word [rcx + 8]
mov rbx, qword [rax + 0x68]
mov rsi, qword [rax + 0x18]
test rbx, rbx
je 0x41b721
mov qword [rsp + 0x50], rcx
mov rax, rdx
xor edx, edx
div rbx
imul rax, rbx
lea rcx, [rsi + rax]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 8], rcx
call fcn.0041d560
mov rcx, qword [rsp + 0x50]
lea rdx, [rcx + 0x10]
lea rbx, [0x007f7121]
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdx
mov qword [rsp + 8], 8
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x18], rdx
call fcn.0041d3c0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
jmp 0x41b653
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0040ef90
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
jmp 0x41b5f0
mov esi, dword [rbx + 0x58]
mov edi, dword [rsp + 0x28]
cmp esi, edi
jne 0x41b728
jmp 0x41b61a
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.00429c30
ud2
mov dword [rsp + 0x2c], esi
call fcn.0042bc80
lea rax, [0x006ab98e]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042c640
mov eax, dword [rsp + 0x2c]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bee0
mov eax, dword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006ae26b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042b3a0
ud2
lea rax, [0x006b5bb3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0041b570
Function at 0x41e400
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x00850a73]
test al, al
je 0x41e428
movzx eax, byte [0x00850a5c]
test al, al
je 0x41e4b1
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.00411f80
movzx eax, byte [rsp + 0x10]
mov rcx, qword [rsp + 8]
lock or byte [rcx], al
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 0xa0]
test byte [rcx], al
test byte [rax], al
lea rax, [rcx + 0x1270]
test byte [rax], al
mov rdx, qword [rsp + 0x38]
add rdx, qword [rcx + 0x1280]
mov qword [rcx + 0x1280], rdx
mov rdx, qword [rsp + 0x40]
add rdx, qword [rcx + 0x1288]
mov qword [rcx + 0x1288], rdx
movzx ecx, byte [0x00850a5c]
test cl, cl
jne 0x41e4a6
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rax
call fcn.004201e0
jmp 0x41e49c
lea rax, [0x006b7b78]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.0042b3a0
ud2
Function at 0x41edf0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41eece
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rdx + 0xd0]
test ebx, ebx
jne 0x41ee48
mov ebx, dword [rdx + 0xb8]
test ebx, ebx
jne 0x41ee48
mov rdx, qword [rdx]
cmp rcx, rdx
jne 0x41eeb3
mov ecx, dword [0x0083a420]
mov rdx, qword [rsp + 0x30]
mov ebx, dword [rdx + 0x58]
cmp ebx, ecx
je 0x41eea9
lea eax, [rcx - 2]
lea ebx, [rcx - 1]
lock cmpxchg dword [rdx + 0x58], ebx
sete bl
test bl, bl
jne 0x41ee91
mov dword [rsp + 0x1c], ecx
jmp 0x41ee80
call fcn.004298a0
mov ecx, dword [rsp + 0x1c]
mov rdx, qword [rsp + 0x30]
mov eax, dword [rdx + 0x58]
cmp eax, ecx
jne 0x41ee72
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rdx
mov byte [rsp + 8], 0
call fcn.0041eee0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006b50b0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0041edf0