joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4342e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x10]
cmp rax, qword [rcx + 0x10]
jbe 0x434618
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rax, 0x6574737953746547
mov qword [rsp + 0x56], rax
movabs rax, 0x467341656d69546d
mov qword [rsp + 0x5e], rax
movabs rax, 0x656d6954656c69
mov qword [rsp + 0x66], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp], rax
lea rcx, [rsp + 0x56]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x18
mov qword [rsp + 0x18], 0x18
call fcn.004330a0
mov rax, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop dword [rax]
jne 0x43459e
mov qword [0x007cc3f0], rax
test rax, rax
je 0x4345fe
movabs rax, 0x7265507972657551
mov qword [rsp + 0x3e], rax
movabs rcx, 0x65636e616d726f66
mov qword [rsp + 0x46], rcx
movabs rdx, 0x7265746e756f43
mov qword [rsp + 0x4e], rdx
mov rdx, qword [rsp + 0x98]
mov qword [rsp], rdx
lea rbx, [rsp + 0x3e]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], 0x18
mov qword [rsp + 0x18], 0x18
call fcn.004330a0
mov rax, qword [rsp + 0x20]
cmp dword [0x00811460], 0
nop dword [rax]
jne 0x43458d
mov qword [0x007cc410], rax
movabs rax, 0x7265507972657551
mov qword [rsp + 0x6e], rax
movabs rax, 0x65636e616d726f66
mov qword [rsp + 0x76], rax
movabs rax, 0x724665636e616d72
mov qword [rsp + 0x78], rax
movabs rax, 0x79636e65757165
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp], rax
lea rax, [rsp + 0x6e]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x1a
mov qword [rsp + 0x18], 0x1a
call fcn.004330a0
mov rax, qword [rsp + 0x20]
cmp dword [0x00811460], 0
jne 0x43457c
mov qword [0x007cc418], rax
cmp qword [0x007cc410], 0
nop word [rax + rax]
je 0x4345e5
test rax, rax
je 0x4345e5
mov qword [rsp + 0x28], 0
mov rax, qword [0x007cc418]
lea rcx, [rsp + 0x28]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00435a20
mov rax, qword [rsp + 0x28]
nop word [rax + rax]
test rax, rax
je 0x4345c8
cmp rax, 0x7fffffff
jg 0x4345af
mov qword [rsp + 0x30], rax
mov rax, qword [0x007cc410]
lea rcx, [0x00811298]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00435a20
mov rax, qword [rsp + 0x30]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x43452f
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x43454d
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
nop
cmp rsi, rbx
jg 0x434529
sub rbx, rsi
bts edi, ecx
jmp 0x434529
movsxd rax, eax
cmp rax, rbx
mov eax, 0x7fffffff
cmovle ecx, eax
movsxd rax, ecx
mov qword [0x00811290], rax
mov byte [0x008110de], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rdi, [0x007cc418]
call fcn.0046c920
jmp 0x434492
lea rdi, [0x007cc410]
call fcn.0046c920
jmp 0x43440d
lea rdi, [0x007cc3f0]
call fcn.0046c920
jmp 0x43438d
lea rax, [0x00669547]
mov qword [rsp], rax
mov qword [rsp + 8], 0x56
call fcn.00439220
lea rax, [0x006693fd]
mov qword [rsp], rax
mov qword [rsp + 8], 0x50
nop dword [rax]
call fcn.00439220
lea rax, [0x0066181d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1b
call fcn.00439220
lea rax, [0x006676f2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x30
call fcn.00439220
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.004342e0
Function at 0x4351e0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
lea rax, [0x0066aec0]
test byte [rax], al
mov rax, qword [sym.imp.kernel32.dll_CreateThread]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [0x0066aec0]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rcx
movups xmmword [rsp + 0x28], xmm0
call fcn.00435c00
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x435253
mov rcx, qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00435a20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, dword [0x008110fc]
test eax, eax
je 0x435285
nop
nop
lea rax, [0x008111d0]
mov qword [rsp], rax
call fcn.0040bfe0
nop
nop
lea rax, [0x008111d0]
mov qword [rsp], rax
nop dword [rax]
call fcn.0040bfe0
mov rax, qword [0x007cdb30]
sub rax, qword [0x007cdb40]
mov qword [rsp + 0x48], rax
call fcn.0046e160
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.0043aa00
lea rax, [0x00667320]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2e
nop
call fcn.0043b480
mov rax, qword [rsp + 0x48]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0043b220
lea rax, [0x0065d00b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0043b480
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x0065a2d0]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0043b480
call fcn.0043aaa0
lea rax, [0x0065d931]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.00439220
nop
int3
Function at 0x436f20
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x437065
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x18], rax
mov ecx, dword [rsp + 0x38]
mov dword [rsp], ecx
call fcn.00437460
mov rax, qword [rsp + 8]
cmp qword [rax + 0x20], 0
jne 0x43704a
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x28]
cmp dword [0x00811460], 0
jne 0x437031
mov qword [rax + 0x28], rdx
mov qword [rcx + 0x28], rax
mov rcx, qword [rsp + 0x40]
cmp dword [0x00811460], 0
jne 0x437023
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x38]
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x38]
test ecx, ecx
jne 0x436fd3
call fcn.0046c8e0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, qword [rsp + 0x18]
add rdx, 8
nop dword [rax]
cmp ecx, 8
jne 0x436ffb
cmp dword [rax], 0
jne 0x436ff4
xor eax, eax
mov rcx, qword [rdx]
mov qword [rax], rcx
jmp 0x436fc4
nop
add rax, 0x48
jmp 0x436fec
cmp dword [rax], 0
nop
jne 0x43701c
xor eax, eax
mov qword [rsp], rax
mov qword [rsp + 8], rdx
movsxd rax, ecx
mov qword [rsp + 0x10], rax
call fcn.0046d6c0
jmp 0x436fc4
nop
add rax, 0x48
jmp 0x437004
lea rdi, [rax + 0x18]
call fcn.0046ca20
jmp 0x436faa
lea rdi, [rax + 0x28]
call fcn.0046ca40
lea rdi, [rcx + 0x28]
nop
call fcn.0046c920
jmp 0x436f98
lea rax, [0x00665e0f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
nop
call fcn.00439220
lea rax, [0x0065f177]
mov qword [rsp], rax
mov qword [rsp + 8], 0x15
call fcn.00439220
nop
int3
Function at 0x437960
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x437af4
lea rdx, [rsp + 0x50]
cmp qword [rcx + 8], rdx
jne 0x437aea
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x30], rcx
lea rdi, [rax + 0x28]
mov qword [rsp + 0x28], rdi
cmp byte [rcx + 6], 0
jne 0x437a99
mov edx, dword [rcx]
nop dword [rax]
test edx, edx
jne 0x437a4a
mov rdx, qword [rcx + 0x18]
cmp dword [0x00811460], 0
jne 0x437a2e
mov qword [rcx + 0x18], 0
mov qword [rsp + 0x20], rdx
test byte [rax], al
mov rbx, qword [rcx + 0x28]
cmp dword [0x00811460], 0
jne 0x437a27
mov qword [rax + 0x28], rbx
mov qword [rsp], rcx
call fcn.00437640
mov rax, qword [rsp + 0x20]
test byte [rax], al
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0046c480
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.0046ca60
jmp 0x4379f5
lea rbx, [rcx + 0x18]
mov rsi, rdi
mov rdi, rbx
xor r8d, r8d
nop dword [rax + rax]
call fcn.0046caa0
mov rdi, rsi
jmp 0x4379dd
cmp edx, 8
jne 0x437a65
lea rdx, [rcx + 0x48]
test byte [rdx], al
mov rdx, qword [rcx + 0x48]
nop
mov qword [rsp + 0x50], rdx
nop
jmp 0x4379c8
nop
lea rax, [rsp + 0x50]
mov qword [rsp], rax
lea rbx, [rcx + 0x48]
mov qword [rsp + 8], rbx
movsxd rdx, edx
mov qword [rsp + 0x10], rdx
call fcn.0046d6c0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
jmp 0x4379c8
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00437f00
cmp byte [rsp + 0x10], 0
je 0x437afe
mov rax, qword [rsp + 0x18]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x28]
cmp dword [0x00811460], 0
jne 0x437ade
mov qword [rax + 0x28], rdx
mov qword [rsp], rcx
call fcn.00437640
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdi, qword [rsp + 0x28]
call fcn.0046ca40
jmp 0x437acb
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00666a37]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.00439220
nop
int3
Function at 0x439540
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4396ef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
cmp qword [0x007f9858], 0
je 0x4396b6
mov rcx, qword [rax + 0x30]
inc dword [rcx + 0xc0]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0xd8], 0
jge 0x4395a7
mov dword [rcx + 0xd8], 1
mov rax, qword [rax + 0x30]
mov ecx, dword [rax + 0xdc]
test ecx, ecx
je 0x439659
cmp ecx, 1
je 0x43961c
nop
cmp ecx, 2
je 0x4395e1
mov dword [rsp], 5
call fcn.00434900
mov byte [rsp + 0x28], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
mov dword [rax + 0xdc], 3
call fcn.0043aa00
lea rax, [0x00660837]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0043b480
call fcn.0043aaa0
mov dword [rsp], 4
call fcn.00434900
jmp 0x4395c5
mov dword [rax + 0xdc], 2
call fcn.0043aa00
lea rax, [0x0065e534]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
nop
call fcn.0043b480
call fcn.0043aaa0
mov byte [rsp + 0x28], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rax + 0xdc], 1
mov eax, 1
lea rcx, [0x0081113c]
lock xadd dword [rcx], eax
lea rax, [0x00811250]
mov qword [rsp], rax
nop
call fcn.0040bf80
cmp dword [0x00811714], 0
jle 0x4396ab
mov byte [rsp], 1
call fcn.004474e0
call fcn.0043d460
mov byte [rsp + 0x28], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp dword [0x00811710], 0
jg 0x43968e
jmp 0x439697
mov qword [rsp + 0x10], rax
nop dword [rax + rax]
call fcn.0043aa00
lea rax, [0x0066737c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2e
call fcn.0043b480
nop
call fcn.0043aaa0
mov rax, qword [rsp + 0x10]
jmp 0x439586
call fcn.0046abe0
jmp fcn.00439540
Function at 0x43cb40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x43ce00
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov dword [0x007cdb38], 0x2710
nop
lea rcx, [0x007ab560]
jmp 0x43cbb0
mov qword [rsp + 0x38], rcx
mov qword [rsp], rcx
call fcn.00453e80
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x210]
mov rax, qword [rsp + 0x40]
test rcx, rcx
jne 0x43cb91
call fcn.0044e620
call fcn.0040caa0
nop
lea rax, [0x008111f0]
mov qword [rsp], rax
mov qword [rsp + 8], 8
mov qword [rsp + 0x10], 8
nop dword [rax]
call fcn.00434640
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x30]
mov qword [rsp], rcx
mov qword [rsp + 8], 0xffffffffffffffff
nop dword [rax + rax]
call fcn.0043cf80
call fcn.0043caa0
call fcn.00404440
call fcn.00453be0
call fcn.0045f680
call fcn.0040b1a0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
test byte [rax], al
call fcn.004346e0
call fcn.00449cc0
call fcn.0041b2a0
nop
nop
lea rax, [0x007cdb18]
mov qword [rsp], rax
call fcn.0040bfe0
call fcn.0046e5a0
mov rax, qword [rsp]
mov qword [0x007cdb08], rax
mov eax, dword [0x00811128]
mov dword [rsp + 0x24], eax
lea rcx, [0x0065b6c8]
mov qword [rsp], rcx
mov qword [rsp + 8], 0xa
call fcn.00407d80
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00452c00
mov rax, qword [rsp + 0x10]
movsxd rcx, eax
cmp rax, rcx
mov ecx, 0
cmove ecx, eax
sete al
movzx edx, byte [rsp + 0x18]
and eax, edx
test al, al
je 0x43cddc
nop word [rax + rax]
test ecx, ecx
jle 0x43cddc
mov dword [rsp], ecx
call fcn.004459a0
cmp qword [rsp + 8], 0
jne 0x43cde5
nop
nop
lea rax, [0x007cdb18]
mov qword [rsp], rax
call fcn.0040c240
cmp dword [0x008116e0], 1
jle 0x43cd55
mov byte [0x00811465], 1
mov byte [0x00811460], 1
mov rax, qword [0x007cd5e0]
mov qword [rsp + 0x48], rax
mov rcx, qword [0x007cd5e8]
mov qword [rsp + 0x30], rcx
xor edx, edx
nop
jmp 0x43cd50
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8]
test byte [rcx], al
add rcx, 0x16c0
mov qword [rsp], rcx
call fcn.00431b80
mov rax, qword [rsp + 0x28]
lea rdx, [rax + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rcx, rdx
jg 0x43cd22
cmp qword [0x007c4018], 0
jne 0x43cd81
mov qword [0x007c4018], 7
cmp dword [0x00811460], 0
jne 0x43cdc7
lea rax, [0x0065adfa]
mov qword [0x007c4010], rax
cmp qword [0x007cd1c8], 1
jne 0x43cdaa
mov qword [0x007cd1c8], 0
cmp dword [0x00811460], 0
jne 0x43cdb4
mov qword [0x007cd1c0], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rdi, [0x007cd1c0]
xor eax, eax
nop dword [rax]
call fcn.0046c920
jmp 0x43cdaa
lea rdi, [0x007c4010]
lea rax, [0x0065adfa]
call fcn.0046c920
jmp 0x43cd81
mov ecx, dword [rsp + 0x24]
jmp 0x43ccc8
lea rax, [0x00666a62]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.00439220
nop
nop
call fcn.0046abe0
jmp fcn.0043cb40
Function at 0x43d9c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x43daa0
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov eax, dword [rsp + 0x28]
lea ecx, [rax - 1]
cmp ecx, 3
ja 0x43da24
mov ecx, eax
bts eax, 0xc
mov edx, dword [rsp + 0x2c]
nop
cmp edx, eax
jne 0x43da24
mov eax, ecx
mov rbx, qword [rsp + 0x20]
lock cmpxchg dword [rbx + 0x90], edx
sete cl
mov byte [rsp + 0x30], cl
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.0043aa00
lea rax, [0x00663d28]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
nop dword [rax]
call fcn.0043b480
mov eax, dword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0043b2a0
lea rax, [0x0065ae4e]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0043b480
mov eax, dword [rsp + 0x2c]
mov qword [rsp], rax
call fcn.0043b2a0
call fcn.0043ace0
nop dword [rax]
call fcn.0043aaa0
lea rax, [0x0065d34b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.00439220
nop
nop
call fcn.0046abe0
jmp fcn.0043d9c0

Function at 0x43dac0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov eax, dword [rsp + 0x50]
bt eax, 0xc
jae 0x43dc21
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rcx, [0x00464920]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], eax
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x34], ecx
lea rdx, [rsp + 0x28]
mov qword [rsp], rdx
call fcn.0046aa80
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x48]
xor ebx, ebx
xor esi, esi
jmp 0x43db72
mov qword [rsp + 0x10], rbx
mov dword [rsp], 1
call fcn.0046c440
mov rax, qword [rsp + 0x10]
lea rbx, [rax + 1]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
cmp rbx, 0xa
jge 0x43db5c
cmp dword [rdx + 0x90], ecx
jne 0x43db1d
mov rdi, qword [rsp + 0x20]
lea rbx, [rdi + 1]
mov edi, dword [rsp + 0x54]
mov ecx, edi
mov rsi, rax
mov eax, dword [rsp + 0x50]
lock cmpxchg dword [rdx + 0x90], ecx
sete dil
nop
test dil, dil
jne 0x43dc17
mov eax, dword [rsp + 0x50]
cmp eax, 4
jne 0x43db9f
cmp dword [rdx + 0x90], 1
je 0x43dc3c
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x43dc05
mov qword [rsp + 0x18], rsi
call fcn.0046e5a0
mov rax, qword [rsp + 0x18]
cmp qword [rsp], rax
jge 0x43dbcb
mov ecx, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
xor ebx, ebx
jmp 0x43db4e
nop
mov rax, qword [0x007cc4b8]
mov qword [rsp], rax
mov dword [rsp + 8], 0
nop
call fcn.0046e420
call fcn.0046e5a0
mov rax, qword [rsp]
add rax, 0x9c4
mov ecx, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
nop dword [rax]
jmp 0x43db5c
call fcn.0046e5a0
mov rax, qword [rsp]
lea rsi, [rax + 0x1388]
jmp 0x43dba9
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov ecx, dword [rsp + 0x54]
bt ecx, 0xc
jb 0x43dadc
cmp eax, ecx
je 0x43dadc
jmp 0x43db0a
lea rax, [0x00667902]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.00439220
nop
int3
Function at 0x43e040
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x43e2e7
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0xd8], 0
jg 0x43e2cd
mov qword [rsp + 0x48], rax
nop
nop
lea rax, [0x007cdb18]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.0040bfe0
mov eax, dword [0x00811124]
mov dword [0x007cdc04], eax
mov eax, 1
lea rcx, [0x007cdc00]
xchg dword [rcx], eax
nop
call fcn.00447380
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
mov dword [rax + 4], 3
dec dword [0x007cdc04]
mov rax, qword [0x007cd5e0]
mov qword [rsp + 0x50], rax
mov rcx, qword [0x007cd5e8]
mov qword [rsp + 0x30], rcx
xor edx, edx
jmp 0x43e104
inc rdx
mov rax, rdi
cmp rdx, rcx
jge 0x43e19e
mov rbx, qword [rax + rdx*8]
mov esi, dword [rbx + 4]
cmp esi, 2
jne 0x43e184
mov rdi, rax
mov eax, esi
mov r8d, 3
lock cmpxchg dword [rbx + 4], r8d
sete sil
test sil, sil
je 0x43e0fe
cmp byte [0x007d2d10], 0
jne 0x43e147
inc dword [rbx + 0x14]
dec dword [0x007cdc04]
jmp 0x43e0fe
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp], rbx
call fcn.0045a420
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.00459a40
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x50]
mov r8d, 3
jmp 0x43e13c
mov rdi, rax
mov r8d, 3
xor esi, esi
jmp 0x43e12e
mov dword [rax + 4], 3
dec dword [0x007cdc04]
nop
call fcn.004485e0
mov rax, qword [rsp]
test rax, rax
jne 0x43e191
nop
nop
mov eax, dword [0x007cdc04]
mov dword [rsp + 0x1c], eax
lea rcx, [0x007cdb18]
mov qword [rsp], rcx
call fcn.0040c240
mov eax, dword [rsp + 0x1c]
test eax, eax
jg 0x43e28e
cmp dword [0x007cdc04], 0
nop dword [rax]
jne 0x43e27b
mov rax, qword [0x007cd5e0]
mov rcx, qword [0x007cd5e8]
xor edx, edx
xor ebx, ebx
xor esi, esi
jmp 0x43e220
mov rdi, qword [rax + rdx*8]
cmp dword [rdi + 4], 3
mov edi, 0x2e
cmovne rbx, rdi
lea r8, [0x00667490]
cmovne rsi, r8
inc rdx
nop dword [rax + rax]
cmp rcx, rdx
jg 0x43e1fc
mov eax, dword [0x0081110c]
test eax, eax
jne 0x43e242
test rbx, rbx
jne 0x43e2bf
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rsi
nop
nop
lea rax, [0x008111d0]
mov qword [rsp], rax
call fcn.0040bfe0
nop
lea rax, [0x008111d0]
mov qword [rsp], rax
call fcn.0040bfe0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
jmp 0x43e22f
mov ebx, 0x29
lea rsi, [0x0066639a]
jmp 0x43e225
call fcn.00447380
lea rax, [0x007cdc08]
mov qword [rsp], rax
mov qword [rsp + 8], 0x186a0
call fcn.0040c7e0
cmp byte [rsp + 0x10], 0
je 0x43e289
nop
mov qword [0x007cdc08], 0
jmp 0x43e1d6
mov qword [rsp], rsi
mov qword [rsp + 8], rbx
call fcn.00439220
lea rax, [0x00661b47]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1b
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0043e040
Function at 0x43e300
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x43e540
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
nop
inc dword [rcx + 0xd8]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
mov ecx, dword [0x0081112c]
test ecx, ecx
jne 0x43e4f7
nop
nop
lea rax, [0x007cdb18]
mov qword [rsp], rax
call fcn.0040bfe0
mov eax, dword [0x00811124]
mov ecx, dword [0x00811138]
nop dword [rax + rax]
test ecx, ecx
je 0x43e4f0
mov dword [0x00811138], 0
mov dword [rsp], ecx
call fcn.004459a0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x38], rax
mov dword [0x007cdc00], 0
cmp dword [0x007cdc10], 0
jne 0x43e4d1
nop
nop
lea rax, [0x007cdb18]
mov qword [rsp], rax
call fcn.0040c240
mov rax, qword [rsp + 0x38]
jmp 0x43e3d9
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x43e43f
mov rcx, qword [rax + 8]
mov rdx, qword [rax + 0x38]
mov qword [rsp + 0x48], rcx
test rdx, rdx
je 0x43e422
nop
mov qword [rax + 0x38], 0
cmp qword [rdx + 0xa8], 0
jne 0x43e525
nop
mov qword [rdx + 0xa8], rax
lea rax, [rdx + 0x120]
mov qword [rsp], rax
call fcn.0040c340
nop
jmp 0x43e3d4
mov qword [rsp], 0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0xffffffffffffffff
call fcn.0043f760
jmp 0x43e3d4
nop
call fcn.0046e5a0
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
jne 0x43e4ab
call fcn.00440580
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43e497
cmp byte [rax + 0xb1], 0
je 0x43e497
mov qword [rax + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
nop
mov byte [rsp], 0xa
mov qword [rsp + 8], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x10], xmm0
mov qword [rsp + 0x20], 0
call fcn.00458a40
jmp 0x43e457
mov dword [0x007cdc10], 0
lea rax, [0x007cdc18]
mov qword [rsp], rax
call fcn.0040c340
jmp 0x43e3bb
mov ecx, eax
jmp 0x43e392
mov qword [rsp], 0
nop
call fcn.00432be0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp], rax
call fcn.00442100
nop dword [rax]
jmp 0x43e35a
lea rax, [0x006653d1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.00439220
nop
nop
call fcn.0046abe0
jmp fcn.0043e300