joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x455db9
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rdx]
test ebx, ebx
jne 0x455c36
movzx esi, byte [rsp + 0x48]
test sil, sil
je 0x455d67
bt ebx, 7
nop word [rax + rax]
jae 0x455d59
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x455c60
lea esi, [rcx + 7]
mov rcx, rax
mov eax, r8d
nop word [rax + rax]
cmp rcx, rax
jbe 0x455db4
movzx edi, byte [rax + rdx]
lea r8d, [rax + 1]
mov r9d, edi
and edi, 0x7f
mov rax, rcx
mov ecx, esi
shl edi, cl
or ebx, edi
test r9b, 0x80
jne 0x455c4e
mov esi, ebx
and ebx, 1
neg ebx
shr esi, 1
xor ebx, esi
mov rsi, qword [rsp + 0x40]
add dword [rsi], ebx
nop dword [rax + rax]
cmp rax, r8
jb 0x455da9
sub rax, r8
mov rbx, qword [rsp + 0x30]
sub rbx, r8
mov rsi, rbx
neg rbx
sar rbx, 0x3f
and r8, rbx
lea rbx, [rdx + r8]
test rax, rax
jbe 0x455d9f
movzx edx, byte [rdx + r8]
bt edx, 7
jae 0x455d51
xor ecx, ecx
xor edx, edx
xor edi, edi
nop
jmp 0x455ce8
lea edi, [rcx + 7]
mov ecx, r9d
cmp rax, rcx
jbe 0x455d92
movzx r8d, byte [rcx + rbx]
lea r9d, [rcx + 1]
mov r10d, r8d
and r8d, 0x7f
mov ecx, edi
shl r8d, cl
or edx, r8d
test r10b, 0x80
jne 0x455ce2
cmp rax, r9
jb 0x455d87
mov rcx, qword [rsp + 0x38]
add qword [rcx], rdx
sub rsi, r9
mov rcx, rsi
neg rsi
sar rsi, 0x3f
and rsi, r9
lea rdx, [rbx + rsi]
mov qword [rsp + 0x50], rdx
sub rax, r9
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov r9d, 1
jmp 0x455d0f
mov rax, rcx
mov r8d, 1
jmp 0x455c86
mov qword [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov eax, r9d
call fcn.0046ce80
mov rdx, rax
mov eax, ecx
mov rcx, rdx
call fcn.0046cdc0
mov rcx, rax
xor eax, eax
call fcn.0046cdc0
mov rcx, rax
mov eax, r8d
call fcn.0046ce80
call fcn.0046cdc0
xor eax, eax
nop dword [rax + rax]
call fcn.0046cdc0
nop
int3
Function at 0x4560c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x456258
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
jle 0x45623e
cmp qword [rax + 0x10], 0
nop dword [rax]
jl 0x456225
cmp dword [rax + 0x40], 0
jne 0x45620a
mov dword [rax + 0x40], 1
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
mov rbx, qword [rax + 8]
mov qword [rsp + 0x10], rbx
nop
inc dword [rdx + 0xd8]
mov rdx, qword gs:[0x28]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 0x30]
mov rdx, qword [rdx + 0xa0]
mov qword [rsp + 0x28], rdx
test byte [rdx], al
lea rsi, [rdx + 0x26d8]
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x18], rcx
nop
mov qword [rsp], rsi
call fcn.0040bfe0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.00457100
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00456280
nop
nop
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0040c240
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
nop
call fcn.00441fc0
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x456200
cmp byte [rax + 0xb1], 0
je 0x456200
mov qword [rax + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0066556d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x26
nop
call fcn.00439220
lea rax, [0x00663ef6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
lea rax, [0x00661b7d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1b
call fcn.00439220
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.004560c0
Function at 0x456280
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x456446
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
cmp dword [0x0081112c], 0
je 0x456416
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
nop
jne 0x45642c
nop
mov rcx, qword [rsp + 0x58]
mov rdx, rcx
mov qword [rax], rcx
test byte [rdx], al
mov rcx, qword [rdx + 0x26e8]
mov rbx, qword [rdx + 0x26e0]
mov rsi, qword [rdx + 0x26f0]
lea r8, [rcx + 1]
cmp r8, rsi
ja 0x45639f
mov rsi, rcx
lea r8, [rcx + 1]
mov qword [rdx + 0x26e8], r8
lea rdi, [rbx + rcx*8]
cmp dword [0x00811460], 0
jne 0x456395
mov qword [rbx + rcx*8], rax
mov rax, qword [rdx + 0x26e0]
mov rcx, qword [rdx + 0x26e8]
mov rbx, qword [rdx + 0x26f0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
call fcn.004583e0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x26e8]
mov rdx, qword [rax + 0x26e0]
nop dword [rax]
test rcx, rcx
jbe 0x456425
mov rcx, qword [rsp + 0x60]
cmp qword [rdx], rcx
jne 0x45637e
mov rcx, qword [rcx + 8]
xchg qword [rax + 0x1668], rcx
mov ecx, 1
lock xadd dword [rax + 0x26f8], ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0046c920
jmp 0x456319
mov qword [rsp + 0x40], rcx
lea rax, [0x0060e700]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r8
call fcn.0044ddc0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x58]
mov qword [rbx + 0x26f0], rdx
cmp dword [0x00811460], 0
jne 0x456408
mov qword [rbx + 0x26e0], rax
mov rdx, rbx
mov rsi, qword [rsp + 0x40]
mov rbx, rax
mov rax, qword [rsp + 0x60]
jmp 0x4562f9
lea rdi, [rbx + 0x26e0]
call fcn.0046c920
jmp 0x4563f3
call fcn.00432000
nop dword [rax + rax]
jmp 0x4562b5
xor eax, eax
call fcn.0046cdc0
lea rax, [0x00664134]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00456280
Function at 0x45a600
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x30]
cmp rax, qword [rcx + 0x10]
jbe 0x45a839
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0x50], 0
lea rdi, [rsp + 0x58]
xorps xmm0, xmm0
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046d055
mov rbp, qword [rbp]
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax + 0x28]
jmp 0x45a680
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 0x28]
xorps xmm0, xmm0
nop dword [rax + rax]
test rax, rax
je 0x45a7cf
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x45a701
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0xc0]
mov rax, qword [rdx]
lea rcx, [rsp + 0x50]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 8], rcx
call rax
cmp byte [rsp + 0x10], 0
jne 0x45a66c
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0x40], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
call fcn.004548a0
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
test rax, rax
je 0x45a7df
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov rbx, qword [rsp + 0x48]
cmp dword [rbx], 0
nop dword [rax]
jne 0x45a7c5
xor edx, edx
mov qword [rsp + 0x90], rdx
mov esi, dword [rax + 0xc]
movsxd rdi, esi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], 0
cmp esi, 0x80000000
jne 0x45a6b9
lea rdx, [rsp + 0x50]
mov qword [rsp], rdx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov byte [rsp + 0x18], 1
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.0045c340
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov rbx, qword [rsp + 0x48]
nop dword [rax]
jmp 0x45a6b9
nop
lea rdx, [rbx + 0x48]
jmp 0x45a748
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
call fcn.0043aa00
lea rax, [0x00662796]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0043b480
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0043b2a0
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x0065b920]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.00439220
nop
call fcn.0046abe0
nop
jmp fcn.0045a600
Function at 0x45cf20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45d114
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
call fcn.0043aa00
lea rax, [0x00661daa]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1c
call fcn.0043b480
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
nop dword [rax]
call fcn.0043b220
lea rax, [0x0065a493]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0043b480
nop
call fcn.0043aaa0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], rcx
xor edx, edx
jmp 0x45cfd0
mov rbx, qword [rsp + 0x28]
lea rdx, [rbx + 1]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jge 0x45d053
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x20], rcx
mov qword [rsp], rcx
call fcn.004548a0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x28]
test rdx, rdx
sete byte [rsp + 0x10]
mov word [rsp + 0x11], 0
nop dword [rax]
call fcn.0045d740
cmp byte [rsp + 0x18], 0
je 0x45cfbd
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x10], rax
call fcn.0045d120
jmp 0x45cfbd
cmp qword [rsp + 0x70], 0x64
je 0x45d0ec
mov rax, qword [rsp + 0x88]
mov qword [rsp], rax
call fcn.004548a0
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
test rax, rax
jne 0x45d0b7
xor edx, edx
test dl, dl
je 0x45d090
cmp qword [rsp + 0x80], 1
jne 0x45d09a
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rdx, qword [rsp + 0x88]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
call fcn.0045c8a0
jmp 0x45d090
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov word [rsp + 0x10], 0
mov byte [rsp + 0x12], 0
call fcn.0045d740
movzx edx, byte [rsp + 0x18]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
jmp 0x45d081
call fcn.0043aa00
lea rax, [0x00662e77]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0043b480
call fcn.0043aaa0
jmp 0x45d05f
call fcn.0046abe0
jmp fcn.0045cf20
Function at 0x45d4a0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45d581
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00465460]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046aa80
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.0046abe0
jmp fcn.0045d4a0
Function at 0x45dc20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45ded5
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov ecx, dword [0x007a3170]
mov rdx, qword gs:[0x28]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 0x30]
mov rax, qword [rax + 0x30]
movzx eax, byte [rax + 0xf9]
shr ecx, 2
test al, al
cmovne ecx, eax
mov dword [rsp + 0x2c], ecx
mov rax, qword [rdx + 0x90]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x45decb
mov rdx, qword [rsp + 0x68]
cmp rdx, rax
jne 0x45de67
mov rbx, qword [0x00811190]
mov qword [rsp + 0x38], rbx
mov rsi, qword [0x007cc440]
mov qword [rsp + 0x50], rsi
xor edi, edi
jmp 0x45dccb
inc rdi
cmp rbx, rdi
jbe 0x45de5d
nop
mov r8, qword [rsi + rdi*8]
nop dword [rax]
cmp rdx, r8
jne 0x45de39
mov r9d, 1
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r8
nop dword [rax]
test r9b, r9b
je 0x45dde8
mov r9d, 1
test r9b, r9b
jne 0x45dcc8
call fcn.0043aa00
call fcn.0043ace0
nop
call fcn.0043aaa0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0045d940
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x40]
cmp qword [rcx + 0x30], rax
je 0x45dd65
mov eax, dword [rcx + 0x90]
btr eax, 0xc
nop dword [rax]
cmp eax, 2
je 0x45ddb5
nop
mov qword [rsp], 0xffffffffffffffff
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0
call fcn.0045cbc0
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x30]
jmp 0x45dcc8
call fcn.0043aa00
lea rax, [0x00668352]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0043b480
call fcn.0043aaa0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0045c7c0
jmp 0x45dd93
mov qword [rsp], r8
mov byte [rsp + 8], 0
call fcn.0045e0e0
cmp byte [rsp + 0x10], 0
je 0x45de31
mov eax, dword [rsp + 0x2c]
cmp eax, 2
setl cl
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov r9d, ecx
mov ecx, dword [rsp + 0x2c]
jmp 0x45dd0f
mov eax, dword [rsp + 0x2c]
xor ecx, ecx
jmp 0x45de07
cmp rax, r8
jne 0x45de49
mov r9d, 1
jmp 0x45dcef
mov r10d, dword [r8 + 0x90]
cmp r10d, 6
sete r9b
jmp 0x45dcef
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.0043aa00
call fcn.0043ace0
call fcn.0043aaa0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
nop
call fcn.0045d940
nop
mov qword [rsp], 0xffffffffffffffff
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.0045cbc0
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x68]
jmp 0x45dcac
mov rdx, qword [rsp + 0x68]
jmp 0x45dcac
call fcn.0046abe0
jmp fcn.0045dc20
Function at 0x4640c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x464120
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
lea rax, [rsp + 0x28]
mov qword [rsp], rax
call fcn.004391c0
cmp qword [rsp + 8], 0
jne 0x464104
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0066360e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.00439220
nop
nop
call fcn.0046abe0
jmp fcn.004640c0

Function at 0x465c80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x465dc6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
cmp byte [0x00811464], 0
je 0x465d8e
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov rdx, qword [rsp + 0x50]
cmp rdx, rcx
jae 0x465d87
mov rbx, qword [rsp + 0x58]
cmp rbx, 8
jb 0x465d19
nop word [rax + rax]
test rdx, 7
jne 0x465da5
nop
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
sub rcx, rdx
and rbx, 0xfffffffffffffff8
cmp rbx, rcx
cmova rbx, rcx
mov qword [rsp + 0x10], rbx
call fcn.00415f60
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
call fcn.0046d6c0
cmp byte [0x00811465], 0
jne 0x465d4e
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
nop
call fcn.00404ec0
jmp 0x465d44
mov rbx, qword [rsp + 0x58]
jmp 0x465d19
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
nop dword [rax]
jmp 0x465d19
lea rax, [0x00613e40]
mov qword [rsp], rax
lea rax, [0x006a1950]
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00438920
nop
call fcn.0046abe0
jmp fcn.00465c80
Function at 0x466140
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x46628e
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
lea rax, [0x00811450]
mov qword [rsp], rax
call fcn.00432860
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
test byte [rax], al
lea rcx, [rax + 8]
mov qword [rsp + 0x20], rcx
nop
mov qword [rsp], rcx
call fcn.0040bfe0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x88]
test rcx, rcx
je 0x4661b2
cmp rcx, 1
jne 0x466274
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x4661ca
nop dword [rax + rax]
cmp rcx, 1
jne 0x46625b
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], 0
inc qword [rax + 0x20]
mov qword [rax + 0x28], 0
mov qword [rax + 0x78], 0
inc qword [rax + 0x80]
mov qword [rax + 0x88], 0
mov qword [rax + 0xd8], 0
mov qword [rax + 0xe0], rax
nop
nop
mov rdx, qword [rsp + 0x20]
mov qword [rsp], rdx
nop dword [rax]
call fcn.0040c240
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 8], rax
call fcn.00432a40
movsxd rax, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006657a7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x26
call fcn.00439220
lea rax, [0x00665a83]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00466140

Function at 0x4662a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x466360
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
cmp byte [rax + 0x18], 0
je 0x466346
mov rcx, qword [rax + 0x88]
test rcx, rcx
je 0x4662e6
nop
cmp rcx, 1
jne 0x46632d
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x4662f5
cmp rcx, 1
jne 0x466314
lea rcx, [0x00811450]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004320a0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0066631f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.00439220
lea rax, [0x006666b4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
call fcn.00439220
lea rax, [0x006647ab]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.004662a0
Function at 0x466d00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x466f57
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
test byte [rax], al
lea rcx, [rax + 8]
mov qword [rsp + 0x20], rcx
nop
mov qword [rsp], rcx
nop dword [rax]
call fcn.0040bfe0
mov rax, qword [rsp + 0x40]
cmp byte [rax + 0x18], 0
jne 0x466f3d
mov byte [rax + 0x18], 1
inc qword [rax + 0x20]
inc qword [rax + 0x80]
mov qword [rsp + 0x18], 0
xor ecx, ecx
xchg qword [rsp + 0x18], rcx
jmp 0x466d78
mov rax, rdx
mov rcx, qword [rax + 0x28]
nop dword [rax]
cmp rcx, 1
je 0x466f31
test rcx, rcx
je 0x466f25
mov rdx, rax
mov rax, rcx
xor ebx, ebx
lock cmpxchg qword [rdx + 0x28], rbx
sete sil
test sil, sil
je 0x466d75
cmp rcx, 2
cmove rcx, rbx
mov qword [rsp + 0x18], rcx
mov rax, qword [rdx + 0x88]
nop
cmp rax, 1
je 0x466f1e
test rax, rax
je 0x466f17
mov qword [rsp + 0x10], rax
lock cmpxchg qword [rdx + 0x88], rbx
sete cl
test cl, cl
je 0x466db7
mov rax, qword [rsp + 0x10]
cmp rax, 2
cmove rax, rbx
mov qword [rsp + 0x28], rax
cmp qword [rdx + 0x48], 0
nop
jne 0x466ed1
cmp qword [rdx + 0xa8], 0
jne 0x466e8b
nop
nop
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.0040c240
mov rax, qword [rsp + 0x18]
test rax, rax
jne 0x466e67
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x466e43
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov ecx, 0xffffffff
lea rdx, [0x00811130]
lock xadd dword [rdx], ecx
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0043bf40
jmp 0x466e39
mov ecx, 0xffffffff
lea rdx, [0x00811130]
lock xadd dword [rdx], ecx
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0043bf40
jmp 0x466e2f
lea rax, [rdx + 0x90]
mov qword [rsp], rax
call fcn.00456460
cmp dword [0x00811460], 0
jne 0x466eb9
mov rax, qword [rsp + 0x40]
mov qword [rax + 0xa8], 0
jmp 0x466e10
mov rax, qword [rsp + 0x40]
lea rdi, [rax + 0xa8]
xor eax, eax
call fcn.0046c920
jmp 0x466e10
lea rax, [rdx + 0x30]
mov qword [rsp], rax
call fcn.00456460
cmp dword [0x00811460], 0
jne 0x466f05
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x48], 0
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
nop
jmp 0x466e06
mov rax, qword [rsp + 0x40]
lea rdi, [rax + 0x48]
xor ecx, ecx
call fcn.0046ca20
jmp 0x466ef4
xor eax, eax
jmp 0x466df5
xor eax, eax
jmp 0x466df5
mov rdx, rax
xor ebx, ebx
xor ecx, ecx
jmp 0x466db2
mov rdx, rax
xor ebx, ebx
xor ecx, ecx
jmp 0x466db2
lea rax, [0x00664e80]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.00439220
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.00466d00