joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b870
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40ba7e
sub esp, 0x1c
movzx edx, byte [esp + 0x24]
movzx eax, dl
cmp eax, 0x88
jae 0x40ba73
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [ecx + eax*4 + 0x14]
mov dword [esp + 0x14], edx
mov dword [esp], edx
call fcn.00411e00
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x1c]
cmp edx, eax
jne 0x40b919
mov dword [esp + 0x10], edx
movzx ecx, word [ecx + 0x3c]
movzx ebx, cx
cmp edx, ebx
jne 0x40b9f1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
movzx ecx, byte [esp + 0x24]
mov byte [esp + 4], cl
call fcn.00413e40
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + eax*4 + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp], eax
call fcn.00411e00
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
jmp 0x40b91b
mov ebx, eax
cmp dword [ecx + 0x1c], eax
jbe 0x40b9db
mov ebp, dword [ecx + 0x44]
imul eax, ebp
movzx ebp, word [ecx + 0x3c]
inc ebp
movzx esi, bp
add eax, dword [ecx + 0xc]
mov word [ecx + 0x3c], bp
mov edi, dword [ecx + 0x1c]
cmp edi, esi
jb 0x40b955
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
cmp edx, ebx
sete al
mov byte [esp + 0x30], al
add esp, 0x1c
ret
mov word [esp + 0xa], bp
mov dword [esp + 0x10], edi
call fcn.0043af60
lea eax, [0x73d5a3]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043b7e0
mov dword [esp + 4], 0
movzx eax, word [esp + 0xa]
movzx eax, ax
mov dword [esp], eax
call fcn.0043b4c0
lea eax, [0x73c2fb]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0043b4c0
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x7417d9]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00439230
lea eax, [0x740e30]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00439230
mov word [esp + 0xa], cx
call fcn.0043af60
lea eax, [0x7417c2]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.0043b7e0
mov dword [esp + 4], 0
movzx eax, word [esp + 0xa]
movzx eax, ax
mov dword [esp], eax
call fcn.0043b4c0
lea eax, [0x73c2fb]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0043b4c0
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x74da3a]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00439230
mov ecx, 0x88
call fcn.00468ed0
nop
call fcn.00467a60
jmp fcn.0040b870
Function at 0x40c5e0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40c663
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x58]
test eax, eax
je 0x40c603
mov eax, dword [eax + 0x30]
jmp 0x40c609
mov eax, dword [0x994fbc]
test eax, eax
je 0x40c64c
mov ecx, dword [0x93725c]
cmp ecx, 1
jne 0x40c61c
xor ecx, ecx
jmp 0x40c632
mov dword [esp + 8], eax
mov dword [esp], ecx
call fcn.0040c670
mov eax, dword [esp + 4]
mov ecx, eax
mov eax, dword [esp + 8]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00430610
add esp, 0xc
ret
lea eax, [0x74f7c3]
mov dword [esp], eax
mov dword [esp + 4], 0x38
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.0040c5e0

Function at 0x40c670
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40c83b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40c699
mov eax, 0x7000000
jmp 0x40c6a1
test eax, eax
je 0x40c816
mov dword [esp + 0x14], eax
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x94], ebx
mov dword [ecx + 0x98], ebp
mov dword [esp], edx
call fcn.00468e10
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x28]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x93c2c0]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40c82e
cmp edx, 0x21
jae 0x40c822
movsd qword [esp + 0x18], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], ebp
mov dword [esp], ecx
call fcn.00460480
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00460550
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x7affcc]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x7b0034]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40c7f1
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x7b0084]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.00468ee0
mov eax, edx
mov ecx, 0x21
call fcn.00468fc0
nop
call fcn.00467a60
jmp fcn.0040c670
Function at 0x411fc0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41220c
sub esp, 0x20
call fcn.0043af60
call fcn.0043af60
lea eax, [0x73e845]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0043b670
call fcn.0043afc0
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4120fd
call fcn.0043af60
call fcn.0043b170
call fcn.0043afc0
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x41205e
mov eax, dword [0x99504c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x9d], 2
lea eax, [0x75061c]
mov dword [esp], eax
mov dword [esp + 4], 0x3e
call fcn.00439230
call fcn.0043af60
lea eax, [0x7456aa]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0043b670
lea eax, str.___1SMOM_____________n__s____Pn___n__n:_i____n__t___x_s_i_:__01__n__.__ip53no25000sen__tidiv__:___h280_v_r_nOK0b0x0X0oLlLtLuMnCcCfCoCsLmLoMcMeNdNlNoPcPdPePfPiPoPsScSkSmSoZlZpZsYiE:__idD_sSwW___ToA4V1V6V2V3V5A3.OUCNST
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.0043b670
lea eax, [0x73a4cc]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.0043b7e0
call fcn.0043afc0
lea eax, [0x73ac33]
mov dword [esp], eax
mov dword [esp + 4], 6
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], eax
call fcn.0041fd50
jmp 0x412033
lea ecx, [eax + 0x3f]
nop
nop
mov dword [esp], ecx
call fcn.00402aa0
movzx eax, byte [esp + 4]
mov byte [esp + 0x13], al
cmp al, 1
je 0x4121e7
call fcn.0043af60
lea eax, [0x73ff16]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.0043b7e0
call fcn.0043afc0
movzx eax, byte [esp + 0x13]
movzx eax, al
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x48]
mov dword [esp + 0x18], edx
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x14], ecx
call fcn.0043af60
lea eax, [0x73cfc5]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0043b670
lea eax, [0x73c936]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0043b670
lea eax, [0x73c942]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0043b4c0
call fcn.0043afc0
jmp 0x41201c
call fcn.0043af60
lea eax, [0x7428fa]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.0043b7e0
call fcn.0043afc0
jmp 0x41213c
call fcn.00467a60
jmp fcn.00411fc0
Function at 0x4127c0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x40
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
or eax, ecx
mov ebx, dword [esp + 0x4c]
or eax, ebx
test eax, 3
jne 0x4128cf
movzx eax, byte [0x995314]
test al, al
je 0x41281e
mov eax, dword [0x99504c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x58]
mov dword [esp + 0x3c], eax
test byte [eax], al
mov dword [esp], ecx
mov dword [esp + 4], ebx
call fcn.00412330
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
jmp 0x412847
add esp, 0x40
ret
mov esi, dword [edi + 0x978]
mov dword [esp + 0x24], esi
mov ebp, dword [esp + 0x24]
add ebp, 4
mov dword [edi + 0x978], ebp
mov ebp, dword [eax]
mov dword [esi], ebp
mov eax, ecx
mov ecx, edx
mov edx, ebx
mov ebx, dword [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.00412400
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
test eax, eax
je 0x4128cb
mov dword [esp + 0x34], ebp
mov esi, dword [esp + 0x44]
sub eax, esi
mov edi, dword [esp + 0x48]
add eax, edi
mov edi, dword [esp + 0x3c]
mov esi, dword [edi + 0x978]
add esi, 4
nop
cmp dword [edi + 0x97c], esi
jae 0x412822
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
call fcn.00432ec0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x3c]
jmp 0x412822
add esp, 0x40
ret
lea eax, [0x74a4af]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00439230
nop
int3
Function at 0x412a50
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x34]
test eax, eax
je 0x412c91
mov ecx, dword [esp + 0x40]
cmp dword [eax], ecx
jne 0x412bcc
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x412b54
movzx ecx, byte [0x995314]
test cl, cl
je 0x412aab
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x2c], ecx
test byte [ecx], al
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
xor esi, esi
xor edi, edi
jmp 0x412ab2
add esp, 0x30
ret
add esi, 4
cmp dword [eax + 4], esi
jbe 0x412b50
test esi, 0x1f
jne 0x412ac9
movzx edi, byte [edx]
inc edx
jmp 0x412acb
shr edi, 1
test edi, 1
je 0x412aaf
mov dword [esp + 0x1c], edx
add ebp, esi
add ebx, esi
mov eax, dword [ecx + 0x978]
add eax, 8
nop
cmp dword [ecx + 0x97c], eax
jae 0x412b1a
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebx
call fcn.00432ec0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [ecx + 0x978]
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
add edx, 8
mov dword [ecx + 0x978], edx
mov edx, dword [ebp]
mov dword [eax], edx
mov edx, dword [ebx]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
jmp 0x412aaf
add esp, 0x30
ret
mov dword [esp], eax
call fcn.0045e1d0
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
call fcn.0043af60
lea eax, [0x74a4d7]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.0043b7e0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043b7e0
lea eax, [0x73db4c]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043b7e0
call fcn.0043afc0
lea eax, [0x7485cf]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00439230
mov dword [esp], eax
call fcn.0045e1d0
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x34]
mov edx, dword [edx]
mov dword [esp + 0x18], edx
call fcn.0043af60
lea eax, [0x74a4d7]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.0043b7e0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043b7e0
lea eax, [0x73c306]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0043b4c0
lea eax, [0x73ee9c]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.0043b4c0
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x7485cf]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00439230
lea eax, [0x74ac7f]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00439230
nop
int3
Function at 0x414b90
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x414c75
sub esp, 0x20
mov edx, dword [0x975020]
mov dword [esp + 0x1c], edx
mov ebx, dword [0x975024]
mov dword [esp + 0x18], ebx
xor eax, eax
jmp 0x414bce
mov ebp, dword [esp + 0x14]
lea eax, [ebp + 1]
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
cmp eax, ebx
jge 0x414c47
mov ebp, dword [edx + eax*4]
cmp ebp, 0x400
jae 0x414c68
mov dword [esp + 0x14], eax
mov ecx, dword [0x974ff4]
test byte [ecx], al
mov ecx, dword [ecx + ebp*4]
test byte [ecx], al
mov ebp, dword [ecx + 0x218c0]
test ebp, ebp
je 0x414c0e
mov dword [esp], ebp
mov dword [esp + 4], 0x20000
call fcn.00469620
jmp 0x414bbf
mov dword [esp + 0x10], ecx
mov dword [esp], 0x20000
mov dword [esp + 4], 0
lea eax, [0x99c250]
mov dword [esp + 8], eax
call fcn.0040c850
mov eax, dword [esp + 0xc]
test eax, eax
je 0x414c52
mov edx, dword [esp + 0x10]
mov dword [edx + 0x218c0], eax
jmp 0x414bbf
mov byte [0x994f0a], 1
add esp, 0x20
ret
lea eax, [0x74b311]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.00439230
mov eax, ebp
mov ecx, 0x400
call fcn.00468ee0
nop
call fcn.00467a60
jmp fcn.00414b90
Function at 0x414ce0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x414ea5
sub esp, 0x18
mov eax, dword [esp + 0x28]
movzx eax, byte [eax]
movzx edx, byte [esp + 0x2c]
test al, dl
je 0x414d7b
nop
mov eax, dword [0x974ff4]
test byte [eax], al
mov ecx, dword [esp + 0x1c]
mov edx, ecx
shr edx, 0x19
and edx, 0x1ffff
shr ecx, 0x16
mov eax, dword [eax + ecx*4]
test byte [eax], al
and ecx, 7
mov ebx, 1
shl ebx, cl
mov byte [esp + 0x13], bl
mov eax, dword [eax + 0x218c0]
test byte [eax], al
add eax, edx
mov dword [esp + 0x14], eax
mov dword [esp], eax
call fcn.00402aa0
movzx eax, byte [esp + 4]
movzx edx, byte [esp + 0x13]
test dl, al
je 0x414d62
mov byte [esp + 0x34], 1
add esp, 0x18
ret
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov byte [esp + 4], dl
call fcn.00402df0
mov byte [esp + 0x34], 0
add esp, 0x18
ret
call fcn.0043af60
call fcn.0043af60
lea eax, [0x74fb0b]
mov dword [esp], eax
mov dword [esp + 4], 0x39
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0043b670
call fcn.0043b170
call fcn.0043afc0
call fcn.0043af60
lea eax, [0x7421bd]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0043b670
lea eax, str.___1SMOM_____________n__s____Pn___n__n:_i____n__t___x_s_i_:__01__n__.__ip53no25000sen__tidiv__:___h280_v_r_nOK0b0x0X0oLlLtLuMnCcCfCoCsLmLoMcMeNdNlNoPcPdPePfPiPoPsScSkSmSoZlZpZsYiE:__idD_sSwW___ToA4V1V6V2V3V5A3.OUCNST
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.0043b670
lea eax, [0x73a4cc]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.0043b7e0
call fcn.0043afc0
lea eax, [0x73a7ae]
mov dword [esp], eax
mov dword [esp + 4], 4
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
call fcn.0041fd50
lea eax, [0x73a5a7]
mov dword [esp], eax
mov dword [esp + 4], 3
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
call fcn.0041fd50
mov eax, dword [0x99504c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x9d], 2
lea eax, [0x745e4d]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00414ce0
Function at 0x417030
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41723e
sub esp, 0x18
mov eax, dword [0x994f54]
test eax, eax
jne 0x417227
nop
nop
lea eax, [0x994f44]
mov dword [esp], eax
call fcn.0040a350
mov eax, dword [0x994f48]
test eax, eax
je 0x417078
cmp dword [eax + 8], 0xcc
jne 0x4170ee
mov edx, dword [0x994f4c]
test edx, edx
jne 0x4170d0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x99c250]
mov dword [esp + 8], eax
call fcn.0040c850
mov eax, dword [esp + 0xc]
mov dword [0x994f4c], eax
mov ecx, dword [0x994f50]
mov dword [eax], ecx
mov eax, dword [0x994f4c]
mov dword [0x994f50], eax
movzx eax, byte [0x9956c0]
test al, al
jne 0x4170d0
xor eax, eax
jmp 0x4171f8
mov edx, dword [0x994f4c]
mov ebx, dword [edx + 4]
mov dword [0x994f4c], ebx
mov ebx, dword [0x994f48]
mov dword [edx + 4], ebx
mov dword [0x994f48], edx
mov edx, dword [0x994f48]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4171d7
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402ca0
mov eax, dword [0x995310]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x417138
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x41714e
call fcn.00468e70
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x995310]
test eax, eax
jne 0x417172
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x4171a0
call fcn.00468eb0
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x994f44]
mov dword [esp], eax
call fcn.0040a550
nop
lea eax, [0x994f40]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402e20
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00468ee0
lea edx, [0x9372e4]
movzx ebx, byte [edx + eax]
lea ebp, [0x9956c0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x4170d0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x4171e1
mov ecx, 5
call fcn.00468ed0
lea eax, [0x742235]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00417030
Function at 0x417fc0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4180c3
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
test ecx, ecx
je 0x41808c
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x41801c
mov ecx, dword [ebx]
mov dword [eax + 0xc], ecx
mov ecx, dword [eax]
add dword [eax + 0x1c], ecx
movzx ecx, byte [eax + 0x24]
test cl, cl
je 0x418014
mov dword [esp + 0x10], ebx
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00469620
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
add esp, 0x18
ret
cmp dword [eax + 0x14], ecx
jae 0x41804e
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], edx
call fcn.0040c850
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x14], eax
mov eax, ecx
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 4]
test edx, edx
je 0x418072
mov dword [esp + 0x14], ecx
mov ebx, dword [edx]
mov ebp, dword [eax + 8]
mov dword [esp], ebp
mov dword [esp + 4], ecx
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
add dword [eax + 0x10], edx
mov edx, dword [eax + 0x14]
sub edx, dword [eax]
mov dword [eax + 0x14], edx
mov edx, dword [eax]
add dword [eax + 0x1c], edx
mov dword [esp + 0x20], ecx
add esp, 0x18
ret
call fcn.0043af60
lea eax, [0x74e7dd]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.0043b7e0
call fcn.0043afc0
lea eax, [0x74181e]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00417fc0