joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bc60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42bd8e
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov rdx, qword [0x0092e620]
mov qword [rsp + 0x38], rdx
movups xmm0, xmmword [0x0092e628]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x0092e638]
movups xmmword [rsp + 0x50], xmm0
xor ecx, ecx
jmp 0x42bcac
lea rcx, [r8 + 1]
mov rax, rsi
cmp rcx, 5
jge 0x42bd72
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + rcx*8 + 0x38]
add rdx, 0xffffffffffffffd0
neg rdx
cmp rdx, 0x40
sbb rsi, rsi
mov rcx, rdx
mov edi, 1
shl rdi, cl
and rdi, rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [0x011544b0]
lea rdx, [rbx + rdi*8]
lea rdx, [rdx - 1]
neg rbx
and rbx, rdx
xor eax, eax
call fcn.00419660
nop dword [rax]
test rax, rax
je 0x42bd7c
movups xmmword [rsp + 0x20], xmm15
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x30], rdx
mov rsi, qword [rsp + 0x70]
test byte [rsi], al
mov r8, qword [rsp + 0x10]
lea r9, [r8 + r8*2]
mov r10, qword [rsp + 0x20]
mov qword [rsi + r9*8 + 8], 0
mov qword [rsi + r9*8 + 0x10], rdx
lea rdi, [rsi + r9*8]
cmp dword [0x011546d0], 0
jne 0x42bd65
mov qword [rsi + r9*8], r10
jmp 0x42bca5
mov rdx, r10
call fcn.004657e0
jmp 0x42bca5
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x00ad4b10]
mov ebx, 0x25
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.0042bc60
Function at 0x42e9c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42ea11
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
movabs rcx, 0x800000000000
lea rdx, [rcx + rax]
cmp rax, rdx
setbe dl
add rcx, rbx
cmp rbx, rcx
setbe cl
cmp cl, dl
jne 0x42e9ff
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00addf4e]
mov ebx, 0x3c
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0042e9c0
Function at 0x42ffc0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430026
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rcx, [rax + 0x10]
mov qword [rax], rcx
cmp byte [0x011546d5], 0
je 0x42ffee
lea rcx, [rax + 0x20]
mov qword [rax + 8], rcx
jmp 0x42fff9
add rcx, 0x1000
mov qword [rax + 8], rcx
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
test rcx, 0xf
jne 0x430013
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00acfc26]
mov ebx, 0x1f
nop
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0042ffc0
Function at 0x430100
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4303a6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x16d0]
mov rcx, qword [rax + 0x16c0]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x43039a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x16c0], 0
cmp byte [0x01154111], 0
jne 0x430162
xor edx, edx
xor ebx, ebx
nop
jmp 0x4301ab
xor edx, edx
jmp 0x43018e
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x16d0]
mov rax, rcx
call fcn.004203e0
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x430166
add rax, 0x16c0
call fcn.0042ffc0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x430332
mov rsi, qword [rax + rdx*8 + 0x16d0]
nop dword [rax]
cmp rsi, 0x1000
jb 0x4301a8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00415120
test rax, rax
jne 0x430202
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x4301a8
nop
mov rsi, rcx
shr rcx, 3
and rsi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x430245
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x4301a8
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x43038d
lea r10, [0x01126558]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x4302cc
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x430305
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x16a8]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x16a8], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x4301a8
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x430385
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x16d0], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x4301a8
cmp rbx, 0x200
ja 0x430377
lea rdx, [rax + 0x16d0]
lea rsi, [rax + 0x1698]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00425aa0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x16c0]
call fcn.0042ffc0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.00465be0
mov rax, r8
call fcn.00465b60
mov rax, r8
mov ecx, 0x40
call fcn.00465b80
mov edx, 0x200
nop
call fcn.00465bc0
nop
mov qword [rsp + 8], rax
call fcn.00467b60
mov rax, qword [rsp + 8]
jmp fcn.00430100
Function at 0x430c00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430cdd
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [0x00976d80]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.00434100
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x0092c3e8], rax
test rax, rax
je 0x430c74
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00467000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004392e0
lea rax, [0x00ada21b]
mov ebx, 0x2f
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.004398e0
lea rax, [0x00abc11f]
mov ebx, 3
call fcn.00439be0
call fcn.00439360
lea rax, [0x00acc4ce]
mov ebx, 0x1b
call fcn.00437b60
nop
nop dword [rax]
call fcn.00463440
jmp fcn.00430c00

Function at 0x430dc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430ead
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor eax, eax
lea rcx, [0x0115416c]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
je 0x430e38
mov rax, qword [0x0092c3e8]
mov rcx, qword [0x00976e08]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.00434100
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
je 0x430e42
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00467000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004392e0
lea rax, [0x00ade12e]
mov ebx, 0x3c
call fcn.00439be0
mov rax, qword [rsp + 0x30]
nop
call fcn.004398e0
lea rax, [0x00abc11f]
mov ebx, 3
call fcn.00439be0
call fcn.00439360
lea rax, [0x00adbb4c]
mov ebx, 0x33
call fcn.00437b60
nop
call fcn.00463440
jmp fcn.00430dc0
Function at 0x431260
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4312e7
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov edx, dword [rbx + 0x28]
nop dword [rax + rax]
cmp edx, 0x72
je 0x43128a
cmp edx, 0x77
jne 0x4312a5
mov dword [rbx + 0x2c], ecx
mov dword [rbx + 0x30], edi
mov rbx, qword [rbx + 0x20]
mov ecx, edx
call fcn.004304c0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edx
call fcn.004392e0
lea rax, [0x00ade0f2]
mov ebx, 0x3c
call fcn.00439be0
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.004399e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ac84e8]
mov ebx, 0x17
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.00431260
Function at 0x4313e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4315cf
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
cmp qword [0x01154500], 0
jne 0x43147f
mov rax, qword [0x00976de0]
lea rcx, [0x01155100]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x104
call fcn.00434000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x4315bd
cmp rax, 0x104
ja 0x4315bd
lea rbx, [0x01155100]
mov byte [rbx + rax], 0x5c
lea r8, [rax + 1]
mov qword [0x01154500], r8
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
cmp byte [0x01154112], 0
je 0x4314db
test rbx, rbx
jbe 0x4315b3
mov rcx, qword [0x010fc530]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x800
call fcn.00434080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [0x01154500]
cmp rcx, 0x105
ja 0x4315a9
lea rsi, [rcx + rbx]
mov qword [rsp + 0x28], rsi
nop dword [rax + rax]
cmp rsi, 0x105
ja 0x431512
lea rdx, [0x01155100]
jmp 0x431541
mov qword [rsp + 0x30], rcx
lea rax, [0x009e4e00]
lea rbx, [0x01155100]
mov edi, 0x105
call fcn.0044b060
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
mov rdx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rdx
lea rsi, [rdx + rcx]
mov rcx, rbx
mov rbx, rax
mov rax, rsi
call fcn.004664e0
mov rcx, qword [rsp + 0x28]
nop dword [rax]
test rcx, rcx
jbe 0x4315a2
mov rax, qword [0x00976df8]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433f80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
call fcn.00465b60
mov edx, 0x105
call fcn.00465bc0
xor eax, eax
mov rcx, rbx
call fcn.00465b60
lea rax, [0x00ad3cad]
mov ebx, 0x24
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004313e0
Function at 0x432140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4323dd
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x010fc568]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.00434080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x43224e
nop
jne 0x4321d6
cmp dword [rsp + 0x4c], 0
jne 0x4321d6
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x43224e
mov rax, qword [0x010fc560]
nop dword [rax]
call fcn.00433f20
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x011557aa]
mov ebx, 0x20
mov ecx, 0x21
call fcn.00432980
mov rcx, qword [0x01154500]
nop word [rax + rax]
cmp rcx, 0x105
ja 0x4323d2
mov qword [rsp + 0x58], rcx
lea rax, [0x011555c0]
lea rbx, [0x01155100]
call fcn.004664e0
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x432260
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rdx + rbx + 1], dil
inc rax
cmp rax, 0x20
jge 0x4322ce
lea rdx, [rcx + rax*2]
lea rbx, [0x011555c0]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x00ac1721]
movzx esi, byte [rdi + rsi]
cmp rdx, 0x20b
jae 0x4323c5
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
nop word [rax + rax]
cmp rsi, 0x20b
jb 0x432258
jmp 0x4323b5
lea rdx, [rcx + 0x40]
jmp 0x4322e2
lea rbx, [0x011555c0]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x4322f9
cmp rdx, 0x20b
jb 0x4322d4
jmp 0x4323a8
mov rax, qword [0x00976d78]
lea rcx, [0x011555c0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.00434280
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.00467000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x432397
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.004392e0
lea rax, [0x00ae0c56]
mov ebx, 0x5f
call fcn.00439be0
call fcn.00439360
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [0x011540fe], 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.00465b60
mov rax, rsi
mov ecx, 0x20b
nop dword [rax]
call fcn.00465b60
mov rax, rdx
mov ecx, 0x20b
call fcn.00465b60
mov edx, 0x105
call fcn.00465bc0
nop
nop dword [rax]
call fcn.00463440
jmp fcn.00432140
Function at 0x4326a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x432959
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.00431320
cmp dword [0x011546d0], 0
jne 0x43271c
mov qword [0x010fc528], rax
jmp 0x432728
lea rdi, [0x010fc528]
call fcn.004656c0
test rax, rax
je 0x432947
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.00431320
cmp dword [0x011546d0], 0
jne 0x432787
mov qword [0x010fc548], rax
jmp 0x432793
lea rdi, [0x010fc548]
call fcn.004656c0
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.00431320
cmp dword [0x011546d0], 0
jne 0x4327fb
mov qword [0x010fc550], rax
jmp 0x432807
lea rdi, [0x010fc550]
call fcn.004656c0
cmp qword [0x010fc548], 0
je 0x432936
test rax, rax
je 0x432936
mov qword [rsp + 0x20], 0
mov rax, qword [0x010fc550]
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop dword [rax]
call fcn.00433f80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x432925
cmp rax, 0x7fffffff
jg 0x432911
mov qword [rsp + 0x28], rax
mov rax, qword [0x010fc548]
lea rcx, [0x011544d8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433f80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x4328c3
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x4328e2
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x4328bd
sub rbx, rsi
bts edi, ecx
nop
jmp 0x4328bd
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x011544d0], rax
mov byte [0x01154113], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x00ae0773]
mov ebx, 0x56
nop dword [rax]
call fcn.00437b60
lea rax, [0x00ae01a6]
mov ebx, 0x50
call fcn.00437b60
lea rax, [0x00acc102]
mov ebx, 0x1b
call fcn.00437b60
lea rax, [0x00ada74f]
mov ebx, 0x30
call fcn.00437b60
nop
mov qword [rsp + 8], rax
nop
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004326a0
Function at 0x433720
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
lea rcx, [0x00c28290]
test byte [rcx], al
mov rcx, qword [0x00976d88]
nop
mov rdx, qword [0x00c28290]
mov qword [rsp], rcx
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm15
call fcn.00434200
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
nop
test rax, rax
je 0x4337b8
mov rcx, qword [0x00976d68]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00433f80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov ecx, dword [0x01154138]
nop
test ecx, ecx
jne 0x43386c
mov rax, qword [0x01100c50]
sub rax, qword [0x01100c60]
mov qword [rsp + 0x48], rax
nop dword [rax + rax]
call fcn.00467000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.004392e0
lea rax, [0x00ad9a79]
mov ebx, 0x2e
call fcn.00439be0
mov rax, qword [rsp + 0x48]
movsxd rax, eax
nop
call fcn.004399e0
lea rax, [0x00ac1691]
mov ebx, 0x10
call fcn.00439be0
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
call fcn.004398e0
lea rax, [0x00abc021]
mov ebx, 2
call fcn.00439be0
call fcn.00439360
lea rax, [0x00ac2cca]
mov ebx, 0x11
call fcn.00437b60
nop
nop
lea rax, [0x01154400]
call fcn.0040c5e0
nop
nop
lea rax, [0x01154400]
call fcn.0040c5e0
jmp 0x4337c8
Function at 0x436260
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [r14 + 0x28]
test rax, rax
je 0x4363c1
lea rdx, [rsp + 0x48]
cmp qword [rax + 8], rdx
jne 0x4363b6
mov qword [rsp + 0x18], r14
mov qword [rsp + 0x28], rax
mov rsi, r14
lea rdi, [rsi + 0x28]
mov qword [rsp + 0x30], rdi
cmp byte [rax + 6], 0
jne 0x43636f
mov r8d, dword [rax]
test r8d, r8d
je 0x4362e7
cmp r8d, 8
jne 0x4362c8
lea rcx, [rax + 0x48]
test byte [rcx], al
mov rcx, qword [rax + 0x48]
nop
mov qword [rdx], rcx
jmp 0x4362e7
movsxd rcx, r8d
nop
lea rbx, [rax + 0x48]
mov rax, rdx
call fcn.004664e0
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rax + 0x18]
cmp dword [0x011546d0], 0
jne 0x4362fe
mov qword [rax + 0x18], 0
jmp 0x436313
lea rdx, [rax + 0x18]
mov rbx, rdi
mov rdi, rdx
xor r8d, r8d
call fcn.00465840
mov rdi, rbx
mov qword [rsp + 0x20], rcx
test byte [rsi], al
mov rdx, qword [rax + 0x28]
cmp dword [0x011546d0], 0
jne 0x43632d
mov qword [rsi + 0x28], rdx
jmp 0x436332
call fcn.004657e0
call fcn.00435e60
mov rcx, qword [rsp + 0x20]
test byte [rcx], al
mov qword [rsp], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 8], rcx
call fcn.00465260
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbx, rax
mov rax, rsi
call fcn.00436a80
test al, al
je 0x4363cb
mov rcx, qword [rsp + 0x18]
test byte [rcx], al
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x28]
cmp dword [0x011546d0], 0
jne 0x43639d
mov qword [rcx + 0x28], rdx
jmp 0x4363a7
mov rdi, qword [rsp + 0x30]
call fcn.004657e0
call fcn.00435e60
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00ad8761]
mov ebx, 0x2b
call fcn.00437b60
nop
int3
Function at 0x438040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43819d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x10], r14
cmp qword [0x0112ce48], 0
jne 0x438085
call fcn.004392e0
lea rax, [0x00ad9ad5]
mov ebx, 0x2e
call fcn.00439be0
nop dword [rax]
call fcn.00439360
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
nop
jge 0x4380ac
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x438147
nop
cmp edx, 1
je 0x438111
cmp edx, 2
jne 0x4380f9
mov dword [rcx + 0xdc], 3
call fcn.004392e0
lea rax, [0x00ac945c]
mov ebx, 0x18
call fcn.00439be0
call fcn.00439360
mov eax, 4
call fcn.00432c80
mov eax, 5
nop
call fcn.00432c80
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 2
nop dword [rax + rax]
call fcn.004392e0
lea rax, [0x00ac4525]
mov ebx, 0x13
call fcn.00439be0
call fcn.00439360
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 1
mov ecx, 1
lea rdx, [0x01154174]
lock xadd dword [rdx], ecx
lea rax, [0x01154490]
call fcn.0040c5a0
cmp dword [0x01154990], 0
jg 0x43817f
cmp dword [0x0115498c], 0
jle 0x438189
mov eax, 1
call fcn.00445100
call fcn.0043b8e0
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
nop dword [rax]
call fcn.00463440
jmp fcn.00438040
Function at 0x43bd40
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43bdec
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x2c], ecx
lea edx, [rbx - 1]
cmp edx, 3
ja 0x43bd8e
mov edx, ebx
bts ebx, 0xc
cmp ecx, ebx
jne 0x43bd8e
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx + 0x90], ecx
sete cl
mov eax, ecx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.004392e0
lea rax, [0x00ad193d]
mov ebx, 0x21
nop
call fcn.00439be0
mov eax, dword [rsp + 0x28]
mov eax, eax
call fcn.00439a40
lea rax, [0x00abd4ba]
mov ebx, 8
nop dword [rax]
call fcn.00439be0
mov eax, dword [rsp + 0x2c]
mov eax, eax
call fcn.00439a40
call fcn.00439540
call fcn.00439360
lea rax, [0x00ac1ee1]
mov ebx, 0x10
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x14], ecx
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov ecx, dword [rsp + 0x14]
jmp fcn.0043bd40