joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f8f0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40f9d2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jl 0x40f96f
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rdx]
cmp rbx, 0x21
jae 0x40f9b8
lea rax, [0x007ec7a0]
mov rax, qword [rax + rbx*8]
cmp rcx, rax
ja 0x40f96f
imul rcx, rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 1
call fcn.0040ec80
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006da360]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x25
lea rax, [0x00684a60]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
movabs rax, 0x7ffffffff
mov rsi, rdx
xor edx, edx
div rbx
mov rdx, rsi
jmp 0x40f93f
call fcn.00452210
jmp fcn.0040f8f0
Function at 0x410e40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x410ece
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [0x0089e170]
mov rcx, qword [rsp + 0x20]
cmp rcx, rax
jb 0x410eb3
mov rdx, qword [0x0089e178]
cmp rcx, rdx
jae 0x410eb3
sub rcx, rax
mov rax, qword [0x0089e160]
mov rdx, rcx
shr rcx, 5
sub rax, rcx
dec rax
mov qword [rsp + 0x28], rax
shr rdx, 3
and rdx, 3
mov dword [rsp + 0x30], edx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006d9566]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00410e40
Function at 0x411890
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x411af8
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jne 0x411a0c
movzx ecx, byte [rax + 0x17]
test cl, 0x40
jne 0x411971
movzx ecx, byte [0x008b4344]
test cl, cl
je 0x411967
mov rcx, qword [rax + 0x20]
xor edx, edx
xor ebx, ebx
mov qword [rsp + 0x20], rdx
mov rsi, qword [rax + 8]
cmp rdx, rsi
jae 0x411921
test rdx, 0x3f
jne 0x411963
movzx ebx, byte [rcx]
inc rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x1c], ebx
test ebx, 1
jne 0x41192b
add rdx, 8
mov qword [rsp + 0x20], rdx
mov rsi, qword [rax + 8]
cmp rdx, rsi
jb 0x4118ef
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rsi, qword [rsp + 0x68]
lea rdi, [rsi + rdx]
mov r8, qword [rsp + 0x60]
lea r9, [r8 + rdx]
mov rdi, qword [rdi]
mov qword [rsp + 8], rdi
mov qword [rsp], r9
call fcn.00410320
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x20]
mov ebx, dword [rsp + 0x1c]
jmp 0x41190f
shr ebx, 1
jmp 0x4118fe
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rax
call fcn.0044c4c0
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x40], rcx
call fcn.0042b850
lea rax, [0x006daa84]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042c220
call fcn.0042bad0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0042c220
call fcn.0042bad0
lea rax, [0x006d1aa9]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042c220
call fcn.0042bb30
call fcn.0042b8f0
lea rax, [0x006d9f5c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042aea0
ud2
mov qword [rsp], rax
call fcn.0044c4c0
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x30], rdx
call fcn.0042b850
lea rax, [0x006daa84]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042c220
call fcn.0042bad0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0042c220
call fcn.0042bad0
lea rax, [0x006d06bd]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c220
call fcn.0042bad0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042c020
call fcn.0042bad0
lea rax, [0x006d2809]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042c220
call fcn.0042bad0
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
call fcn.0042c020
call fcn.0042bb30
call fcn.0042b8f0
lea rax, [0x006d9f5c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042aea0
ud2
lea rax, [0x006db2ab]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0042aea0
ud2
Function at 0x413230
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x413382
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x18], rax
mov rcx, qword [rax + 0x30]
mov edx, dword [rcx + 0xd0]
inc edx
mov dword [rcx + 0xd0], edx
mov rcx, qword [rsp + 0x30]
test byte [rcx], al
mov edx, dword [rsp + 0x38]
movsxd rdx, edx
mov qword [rsp + 0x10], rdx
cmp rdx, 0x43
jae 0x41337b
mov rbx, qword [rcx + rdx*8 + 0x28]
mov rsi, qword [rbx + 0x38]
movzx edi, word [rbx + 0x60]
cmp rdi, rsi
jne 0x413360
lea rsi, [0x00897f20]
cmp rbx, rsi
je 0x4132c2
mov byte [rbx + 0x63], 0
imul rdx, rdx, 0x70
lea rsi, [0x0089ce60]
lea rdx, [rsi + rdx + 0x1330]
mov qword [rsp], rdx
call fcn.00413450
mov rax, qword [rsp + 8]
test rax, rax
je 0x413345
movzx ecx, word [rax + 0x60]
mov rdx, qword [rax + 0x38]
cmp rcx, rdx
je 0x41332a
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x30]
mov qword [rdx + rcx*8 + 0x28], rax
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xd0]
dec edx
mov dword [rcx + 0xd0], edx
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006d51d2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.0042aea0
ud2
lea rax, [0x006d1e2a]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042aea0
ud2
lea rax, [0x006dadeb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042aea0
ud2
call fcn.004293e0
ud2
call fcn.00452210
jmp fcn.00413230

Function at 0x4138d0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4139dd
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
test byte [rax], al
mov qword [rsp], rax
call fcn.0040d6a0
mov rax, qword [rsp + 0x30]
mov byte [rax + 0x63], 0
movzx ecx, word [rax + 0x60]
test cx, cx
je 0x4139c2
mov rdx, qword [rax + 0x20]
mov rbx, qword [rax + 0x68]
test rbx, rbx
je 0x4139bb
shl rdx, 0xd
mov rsi, rax
mov rax, rdx
xor edx, edx
div rbx
movzx ecx, cx
sub eax, ecx
mov dword [rsp + 0x14], eax
test eax, eax
jg 0x413963
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0040d8b0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 0x20]
mov qword [rsp], rdx
mov qword [rsp + 8], rsi
call fcn.00422340
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 0x10]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 8], rcx
call fcn.00422480
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x68]
mov ecx, dword [rsp + 0x14]
movsxd rcx, ecx
neg rcx
imul rcx, rax
lea rax, [0x008b75f0]
lock xadd qword [rax], rcx
jmp 0x41394b
call fcn.004294c0
ud2
lea rax, [0x006da010]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.004138d0
Function at 0x413d20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x413ef2
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
mov rcx, rax
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], 0x4000
call fcn.00428be0
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x413ee8
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rcx
test rax, rax
jbe 0x413e35
mov rdx, rax
mov qword [rsp + 0x28], rax
cmp rax, 0x1000
jb 0x413e0c
mov rbx, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rbx
mov rbx, rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x4000
call fcn.00428be0
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x413ed8
mov rax, qword [rsp + 0x28]
shr rax, 1
and rax, 0xfffffffffffff000
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, 0x1000
jae 0x413db3
jb 0x413e3f
mov rdx, qword [rsp + 0x40]
lea rcx, [rax + rdx]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
mov rax, rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rcx
test rax, rax
ja 0x413da3
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00455c70
mov eax, dword [rsp]
mov qword [rsp + 0x38], rax
call fcn.0042b850
lea rax, [0x006d5e34]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0042c220
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006d5f3c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c220
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006d9288]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aea0
ud2
mov rax, qword [rsp + 0x28]
cmp rax, 0x1000
jmp 0x413e0c
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00452210
jmp fcn.00413d20
Function at 0x413f00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4140e7
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rax
mov rax, qword [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00428c40
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov rdx, rcx
cmp rax, rdx
je 0x4140dd
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
test rax, rax
jbe 0x41402a
mov rdx, rax
mov qword [rsp + 0x30], rax
cmp rax, 0x1000
jb 0x414001
mov rbx, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rbx
mov rbx, rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00428c40
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x4140cd
mov rax, qword [rsp + 0x30]
shr rax, 1
and rax, 0xfffffffffffff000
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp rax, 0x1000
jae 0x413f9f
jb 0x414034
mov rdx, qword [rsp + 0x48]
lea rcx, [rax + rdx]
mov rdx, qword [rsp + 0x38]
sub rdx, rax
mov rax, rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
test rax, rax
ja 0x413f8f
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.00455c70
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.0042b850
lea rax, [0x006d6482]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c220
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006d5f3c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c220
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006d87f2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042aea0
ud2
mov rax, qword [rsp + 0x30]
cmp rax, 0x1000
jmp 0x414001
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.00452210
jmp fcn.00413f00
Function at 0x414100
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.00424af0
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x8000
call fcn.00428be0
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x414166
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00455c70
mov eax, dword [rsp]
mov qword [rsp + 0x28], rax
call fcn.0042b850
lea rax, [0x006d5e34]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0042c220
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006d5f3c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c220
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006d8bcb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042aea0
ud2

Function at 0x414330
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41445b
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.00424a30
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov rcx, rax
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00428c40
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, rcx
jne 0x4143c2
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00455c70
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0042b850
lea rax, [0x006d6482]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c220
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006d5f3c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042c220
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042c020
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006dc949]
mov qword [rsp], rax
mov qword [rsp + 8], 0x30
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00414330
Function at 0x4156e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4158a2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x415864
mov rbx, qword [rax + 0x18]
mov qword [rsp + 0x28], rbx
test rbx, rbx
je 0x41576b
mov rcx, qword [rbx]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax + 0x30]
mov rdx, qword [rax]
add rcx, rdx
mov qword [rax + 0x30], rcx
movzx ecx, byte [rax + 0x40]
test cl, cl
jne 0x415753
mov qword [rsp + 0x48], rbx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rax]
mov qword [rsp + 8], rax
mov qword [rsp], rbx
call fcn.004551f0
mov rbx, qword [rsp + 0x28]
jmp 0x415744
mov ebx, dword [rax + 0x28]
cmp rbx, rcx
jb 0x415805
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x20], rcx
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x4157e7
mov edx, dword [0x008b4340]
mov rbx, qword [rax]
mov rsi, qword [rax + 0x20]
add rbx, rsi
lea rsi, [rax + 0x20]
test edx, edx
jne 0x4157cd
mov qword [rax + 0x20], rbx
mov edx, dword [rax + 0x28]
mov rbx, qword [rax]
sub edx, ebx
mov dword [rax + 0x28], edx
mov rdx, qword [rax + 0x30]
mov rbx, qword [rax]
add rdx, rbx
mov qword [rax + 0x30], rdx
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp], rsi
mov qword [rsp + 8], rbx
call fcn.00410240
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
jmp 0x4157a5
mov rbx, qword [rax + 0x10]
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
mov rbx, qword [rdx]
call rbx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
jmp 0x415789
mov rcx, qword [rax + 0x38]
mov qword [rsp + 0x10], rcx
mov qword [rsp], 0x4000
mov qword [rsp + 8], 0
call fcn.0040fc30
mov rax, qword [rsp + 0x18]
mov ecx, dword [0x008b4340]
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + 0x20]
test ecx, ecx
jne 0x41584f
mov qword [rdx + 0x20], rax
mov dword [rdx + 0x28], 0x4000
mov rax, rdx
jmp 0x415777
mov qword [rsp], rbx
mov qword [rsp + 8], rax
call fcn.00410240
mov rdx, qword [rsp + 0x40]
jmp 0x415840
call fcn.0042b850
lea rax, [0x006dd5ae]
mov qword [rsp], rax
mov qword [rsp + 8], 0x34
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006d5843]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.004156e0
Function at 0x4166f0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4168dc
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, dword [0x008b406c]
test eax, eax
je 0x4168c1
mov rax, qword [rsp + 0x30]
test byte [rax], al
mov rcx, qword [rax + 0x1218]
test rcx, rcx
je 0x4168ae
mov qword [rsp], rax
call fcn.004182e0
movzx eax, byte [rsp + 8]
test al, al
je 0x41689b
mov rax, qword [rsp + 0x28]
test byte [rax], al
lea rcx, [rax + 0x38]
mov qword [rsp], rcx
mov rcx, qword [0x006e0508]
lea rdx, [0x006e0508]
call rcx
movzx eax, byte [rsp + 8]
test al, al
je 0x4167e7
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x1220], 0
mov rax, qword [rax + 0x1218]
mov qword [rsp + 0x10], rax
mov qword [rsp], rax
movabs rcx, 0x100000004
mov qword [rsp + 8], rcx
call fcn.0042e780
movzx eax, byte [0x008a3ef0]
test al, al
jne 0x4167ce
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00448560
jmp 0x4167ba
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 0xa0]
mov qword [rsp], rcx
mov rcx, qword [0x006e0508]
lea rdx, [0x006e0508]
call rcx
movzx eax, byte [rsp + 8]
test al, al
je 0x416888
call fcn.004289c0
mov rax, qword [rsp]
mov rcx, qword [0x007eba90]
sub rax, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x20]
test rax, rax
jle 0x416850
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
movsd xmm1, qword [rcx + 0x50]
ucomisd xmm0, xmm1
ja 0x416865
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x1220], 1
jmp 0x41678b
mov rax, 1
lock xadd qword [rcx + 0xa0], rax
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006dda37]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.004166f0
Function at 0x418950
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x418b9b
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov eax, dword [0x008b4074]
test eax, eax
jne 0x418b80
lea rax, [0x0089ce60]
mov qword [rsp], rax
call fcn.0040d6a0
mov eax, dword [0x0089de88]
add eax, 2
mov dword [0x0089de88], eax
mov dword [0x0089de8c], 0
mov eax, dword [0x0089de88]
shr eax, 1
and eax, 1
lea rax, [rax + rax*4]
shl rax, 3
lea rcx, [0x0089dec0]
mov eax, dword [rcx + rax + 0x20]
test eax, eax
jne 0x418b65
lea rax, [0x0089ce60]
mov qword [rsp], rax
call fcn.0040d8b0
mov rax, qword [rsp + 0x30]
cmp rax, 2
jne 0x418a59
lea rax, [0x0089ce60]
mov qword [rsp], rax
call fcn.0040d6a0
xorps xmm0, xmm0
movsd qword [0x0089df30], xmm0
mov qword [0x0089df28], 0
lea rax, [0x0089ce60]
mov qword [rsp], rax
call fcn.0040d8b0
call fcn.0041d9c0
mov rax, qword [rsp]
cmp rax, 0xffffffffffffffff
je 0x418a45
mov eax, dword [0x00897b18]
inc eax
mov dword [0x00897b18], eax
jmp 0x418a26
call fcn.00423b90
call fcn.00423b90
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [0x008b75e8]
mov rcx, qword [0x008b75f0]
sub rax, rcx
add rax, 0xfffffffffff00000
cmp rax, 0x2000
jge 0x418a7f
mov rax, 0x2000
mov qword [rsp + 0x18], rax
lea rcx, [0x0089ce60]
mov qword [rsp], rcx
call fcn.0040d6a0
mov rax, qword [0x0089df18]
test rax, rax
jl 0x418b47
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mov rax, qword [rsp + 0x18]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
movsd qword [0x0089df30], xmm0
mov qword [0x0089df28], 0
mov qword [0x0089df20], 0
lea rax, [0x0089ce60]
mov qword [rsp], rax
call fcn.0040d8b0
lea rax, [0x00897b00]
mov qword [rsp], rax
call fcn.0040d6a0
movzx eax, byte [0x00897b10]
test al, al
jne 0x418b20
lea rax, [0x00897b00]
mov qword [rsp], rax
call fcn.0040d8b0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov byte [0x00897b10], 0
mov rax, qword [0x00897b08]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.0042df50
jmp 0x418b06
mov rcx, rax
and rax, 1
shr rcx, 1
or rax, rcx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
jmp 0x418aac
lea rax, [0x006d448d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0042aea0
ud2
lea rax, [0x006db18c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00418950

Function at 0x419060
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4190eb
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov edx, dword [rcx + 0xe0]
cmp edx, 0x20
jae 0x4190d0
mov rcx, qword [rcx]
cmp rax, rcx
jne 0x4190b5
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x006d89eb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042aea0
ud2
lea rax, [0x006d747e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1c
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.00419060