joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419c40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x419e6f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00435b40
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x419d5b
mov rax, qword [rsp + 0x68]
mov rdx, rax
jmp 0x419cf1
shr rax, 1
and rax, 0xfffffffffffff000
mov qword [rsp + 0x38], rax
cmp rax, 0x1000
jae 0x419d05
xor esi, esi
test sil, sil
jne 0x419cbb
nop dword [rax + rax]
cmp rax, 0x1000
jb 0x419d65
sub rbx, rax
add rcx, rax
mov rax, rbx
test rax, rax
jbe 0x419d51
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbx, rax
jmp 0x419cc4
mov rdx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00435b40
cmp qword [rsp + 0x28], 0
sete sil
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x40]
jmp 0x419cd3
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.0046e160
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
je 0x419df5
cmp eax, 0x5af
je 0x419df5
nop dword [rax]
call fcn.0043aa00
lea rax, [0x00660df7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0043b480
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x0066087f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0043b480
mov eax, dword [rsp + 0x34]
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x006631fa]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.00439220
call fcn.0043aa00
lea rax, [0x00660df7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0043b480
mov rax, qword [rsp + 0x68]
mov qword [rsp], rax
nop dword [rax]
call fcn.0043b100
lea rax, [0x0066087f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0043b480
mov eax, dword [rsp + 0x34]
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x0065c641]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00419c40
Function at 0x419e80
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
neg rax
mov qword [rsp + 8], rax
call fcn.00431860
mov rax, qword [sym.imp.kernel32.dll_VirtualFree]
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x8000
call fcn.00435ae0
cmp qword [rsp + 0x20], 0
je 0x419ee7
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.0046e160
mov eax, dword [rsp]
mov qword [rsp + 0x28], rax
call fcn.0043aa00
lea rax, [0x006607a7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
call fcn.0043b480
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.0043b100
lea rax, [0x0066087f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0043b480
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x006636ee]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.00439220
nop
int3
Function at 0x41b120
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41b286
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x41b245
mov rbx, qword [rax + 0x18]
nop dword [rax]
test rbx, rbx
je 0x41b1a5
mov rcx, qword [rbx]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
jne 0x41b188
mov qword [rsp + 0x48], rbx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x20], rbx
mov rax, qword [rax]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
call fcn.0046d420
mov rbx, qword [rsp + 0x20]
jmp 0x41b179
mov ebx, dword [rax + 0x28]
cmp rcx, rbx
ja 0x41b202
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x41b1dd
mov rdx, qword [rax]
add qword [rax + 0x20], rdx
mov rdx, qword [rax]
sub dword [rax + 0x28], edx
mov rdx, qword [rax]
add qword [rax + 0x30], rdx
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x28], rcx
mov rbx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov qword [rsp], rsi
mov qword [rsp + 8], rcx
call rbx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
nop
jmp 0x41b1ba
mov rcx, qword [rax + 0x38]
mov qword [rsp], 0x4000
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
nop dword [rax]
call fcn.0040e900
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x20], rax
mov dword [rcx + 0x28], 0x4000
mov rax, rcx
nop dword [rax]
jmp 0x41b1ad
call fcn.0043aa00
lea rax, [0x006680a4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x34
nop
call fcn.0043b480
call fcn.0043aaa0
lea rax, [0x006600d1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
nop
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0041b120
Function at 0x41bfe0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41c293
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp dword [0x00811114], 0
je 0x41c279
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x41c048
mov rdx, qword [rcx + 0x1698]
test rdx, rdx
je 0x41c048
cmp qword [rdx + 0x10], 0
jne 0x41c26f
mov rdx, qword [rcx + 0x16a0]
cmp qword [rdx + 0x10], 0
jne 0x41c26f
mov rdx, qword [0x00811be0]
test rdx, rdx
jne 0x41c265
mov edx, dword [0x00811c6c]
nop
cmp dword [0x00811c68], edx
jae 0x41c25e
mov eax, 1
test al, al
je 0x41c24b
mov rdx, qword [0x00811210]
test rdx, rdx
je 0x41c23d
mov rax, rdx
sar rdx, 0x13
shl rdx, 3
nop
mov rbx, qword [rdx]
lea rsi, [0x00811210]
lock cmpxchg qword [rsi], rbx
sete bl
test bl, bl
je 0x41c079
test rdx, rdx
je 0x41c22a
mov rbx, qword [rsp + 0x28]
test byte [rbx], al
mov rdi, qword [rbx + 0x38]
nop
test rdi, rdi
jle 0x41c223
lea r8, [rdi - 1]
mov rax, rdi
lock cmpxchg qword [rbx + 0x38], r8
sete dil
test dil, dil
je 0x41c0bb
mov eax, 1
test al, al
je 0x41c14c
test byte [rcx], al
mov qword [rcx + 0x1688], 1
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x10], rax
mov qword [rsp], rax
movabs rcx, 0x100000004
mov qword [rsp + 8], rcx
call fcn.0043dac0
cmp byte [0x007d2d10], 0
jne 0x41c133
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.0045a1a0
jmp 0x41c11f
movsd xmm0, qword [rbx + 0x50]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x41c166
nop word [rax + rax]
jnp 0x41c202
mov qword [rsp + 0x10], rdx
call fcn.0046e5a0
mov rax, qword [rsp]
sub rax, qword [0x00811b70]
nop dword [rax + rax]
test rax, rax
jle 0x41c1fb
mov rcx, qword [rsp + 0x30]
test byte [rcx], al
mov rdx, qword [rcx + 0x1680]
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
mov rax, qword [rsp + 0x28]
movsd xmm1, qword [rax + 0x50]
ucomisd xmm0, xmm1
ja 0x41c1ce
test byte [rcx], al
mov qword [rcx + 0x1688], 2
mov rdx, qword [rsp + 0x10]
jmp 0x41c0f5
lea rax, [0x00811210]
mov qword [rsp], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 8], rax
call fcn.0040bd40
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x30]
jmp 0x41c1b7
mov qword [rsp], rsi
mov qword [rsp + 8], rdx
call fcn.0040bd40
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
jmp 0x41c0e4
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rsi, [0x00811210]
xor edx, edx
jmp 0x41c0ab
mov qword [rsp + 0x38], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
jmp 0x41c071
mov eax, 1
jmp 0x41c071
mov eax, 1
jmp 0x41c071
lea rax, [0x006683f4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.0041bfe0
Function at 0x41eda0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x18]
jbe 0x41ef66
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp dword [0x00811120], 0
jne 0x41ef4a
nop
nop
lea rax, [0x007e2de0]
mov qword [rsp], rax
call fcn.0040bfe0
add dword [0x007f2f08], 2
mov dword [0x007f2f0c], 0
mov qword [0x007f2f40], 0
mov rax, qword [0x007f31b0]
mov rcx, qword [0x007f31b8]
mov rdx, qword [0x007f31c0]
mov qword [0x007f31d0], rcx
mov qword [0x007f31d8], rdx
cmp dword [0x00811460], 0
jne 0x41ef36
mov qword [0x007f31c8], rax
xorps xmm0, xmm0
movups xmmword [0x007f2f68], xmm0
nop
nop
lea rax, [0x007e2de0]
mov qword [rsp], rax
call fcn.0040c240
nop
xor eax, eax
lea rcx, [0x007cd75c]
xchg dword [rcx], eax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jne 0x41eed9
nop
nop
lea rax, [0x007e2de0]
mov qword [rsp], rax
call fcn.0040bfe0
xorps xmm0, xmm0
movsd qword [0x007f2f58], xmm0
nop
nop
lea rax, [0x007e2de0]
mov qword [rsp], rax
call fcn.0040c240
jmp 0x41eea4
inc dword [0x007cd758]
call fcn.00425700
cmp qword [rsp], 0xffffffffffffffff
jne 0x41ee9e
call fcn.00427920
mov byte [rsp], 0
call fcn.00427a40
cmp byte [rsp + 8], 0
jne 0x41eeb5
call fcn.0042f3a0
call fcn.0042f440
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
nop
nop
lea rax, [0x007cd740]
mov qword [rsp], rax
call fcn.0040bfe0
cmp byte [0x007cd750], 0
jne 0x41ef0f
nop
lea rax, [0x007cd740]
mov qword [rsp], rax
call fcn.0040c240
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov byte [0x007cd750], 0
mov rax, qword [0x007cd748]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.0043d1a0
jmp 0x41eef4
lea rdi, [0x007f31c8]
nop dword [rax]
call fcn.0046c920
jmp 0x41ee3a
lea rax, [0x00666200]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
nop
call fcn.00439220
nop
call fcn.004686e0
jmp fcn.0041eda0
Function at 0x422f80
Capabilities:
Hash data using murmur3
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x008110dc], 0
jne 0x4230e5
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x42308e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x4230da
lea rbx, [0x007f2f78]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x42304f
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x4230aa
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x422fb5
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x422fb5
mov ecx, 0x40
nop
call fcn.0046cde0
lea rax, [0x00666bc0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.00439220
nop
int3

Function at 0x423e20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x18]
jbe 0x423ee0
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x800000000000
lea rbx, [rdx + rcx]
mov rsi, qword [rsp + 0x38]
add rdx, rsi
cmp rbx, rdx
jae 0x423ebd
nop
mov rdx, rsi
sub rsi, rcx
test rsi, rsi
jne 0x423e85
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov ebx, dword [rsp + 0x40]
cmp dword [rax + 0x100e0], ebx
jne 0x423e7b
test rcx, 0x3fffff
jne 0x423ec4
add rax, 0x100b8
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
call fcn.00430780
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, rsi
xor esi, esi
jmp 0x423e76
lea rax, [0x006621ee]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1c
call fcn.00439220
nop
nop
call fcn.004686e0
jmp fcn.00423e20
Function at 0x4247c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x424917
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
lea rcx, [rax - 1]
test rax, rcx
jne 0x4248c5
nop word [rax + rax]
test rax, rax
je 0x4248c5
cmp rax, 0x40
ja 0x424872
mov ecx, 7
jmp 0x424824
mov rdx, qword [rsp + 0x18]
lea rcx, [rdx - 1]
mov rax, qword [rsp + 0x38]
test rcx, rcx
jl 0x424863
mov qword [rsp + 0x18], rcx
mov rdx, qword [rsp + 0x30]
test byte [rdx], al
mov rbx, qword [rdx + rcx*8 + 0x40]
or rbx, qword [rdx + rcx*8]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
call fcn.004245c0
cmp qword [rsp + 0x10], 0xffffffffffffffff
je 0x424816
mov byte [rsp + 0x40], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov byte [rsp + 0x40], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043aa00
lea rax, [0x0065cf84]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
call fcn.0043b480
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0043b100
nop
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x0065c627]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
nop
call fcn.00439220
call fcn.0043aa00
lea rax, [0x0065cf84]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
nop
call fcn.0043b480
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x00663c20]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.00439220
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.004247c0
Function at 0x424fa0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x425109
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rdx + 0x138]
test rbx, rbx
je 0x4250ae
mov rsi, qword [rbx + 0x10]
test rsi, rsi
jle 0x4250a4
mov rdi, qword [rdx + 0x100]
mov r8, qword [rsp + 0x30]
mov r9, r8
sub r8, rdi
lea rax, [rsi - 1]
cmp rax, 0x3f
jae 0x4250fe
shl rax, 5
mov edi, dword [rbx + rax + 0x20]
add edi, dword [rbx + rax + 0x24]
cmp r8d, edi
jb 0x4250e5
nop
cmp rsi, 0x3f
je 0x425072
mov rax, qword [rbx + 0x10]
cmp rax, 0x3f
jae 0x4250d7
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
shl rax, 5
mov rcx, qword [rdx + 0x100]
sub r9, rcx
mov dword [rbx + rax + 0x20], r9d
mov rcx, qword [rsp + 0x38]
mov rsi, qword [rcx]
mov dword [rbx + rax + 0x24], esi
nop
mov qword [rbx + rax + 0x28], rcx
inc qword [rdx + 0x140]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rbx
call fcn.00427460
mov rbx, qword [rsp]
mov qword [rbx + 0x18], 0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x18], rbx
mov rdx, qword [rsp + 0x28]
mov qword [rdx + 0x138], rbx
mov r9, qword [rsp + 0x30]
jmp 0x425026
mov r9, qword [rsp + 0x30]
jmp 0x425020
call fcn.00427460
mov rbx, qword [rsp]
mov qword [rbx + 0x18], 0
mov rdx, qword [rsp + 0x28]
mov qword [rdx + 0x130], rbx
mov qword [rdx + 0x138], rbx
jmp 0x424fdd
mov ecx, 0x3f
nop dword [rax]
call fcn.0046cdc0
lea rax, [0x0066627b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.00439220
mov ecx, 0x3f
call fcn.0046cdc0
nop
call fcn.0046abe0
jmp fcn.00424fa0
Function at 0x425ac0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x425bca
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
jne 0x425b17
cmp dword [rdx + 0xc0], 0
jne 0x425b17
cmp qword [rdx], rcx
jne 0x425bb0
mov ecx, dword [0x007f2f08]
mov rdx, qword [rsp + 0x30]
mov ebx, dword [rdx + 0x58]
cmp ecx, ebx
je 0x425ba6
lea esi, [rcx + 3]
cmp ebx, esi
je 0x425ba6
lea eax, [rcx - 2]
lea ebx, [rcx - 1]
lock cmpxchg dword [rdx + 0x58], ebx
sete bl
nop
test bl, bl
jne 0x425b8e
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], esi
jmp 0x425b75
mov rax, qword [0x007cc4b8]
mov qword [rsp], rax
mov dword [rsp + 8], 0
call fcn.0046e420
mov eax, dword [rsp + 0x1c]
mov ecx, dword [rsp + 0x18]
mov rdx, qword [rsp + 0x30]
mov esi, eax
mov eax, dword [rdx + 0x58]
cmp ecx, eax
je 0x425b84
nop dword [rax]
cmp esi, eax
jne 0x425b4e
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rdx
mov byte [rsp + 8], 0
call fcn.00425be0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00664200]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00425ac0
Function at 0x427920
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x427a2c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
nop
lea rax, [0x00811c30]
mov qword [rsp], rax
call fcn.0040bfe0
cmp qword [0x00811be0], 0
jne 0x427a12
mov qword [0x00811be8], 0
nop
mov rax, qword [0x00811c48]
test rax, rax
jne 0x427990
nop
jmp 0x4279d9
lea rcx, [0x00811c38]
mov qword [rax + 0x10], rcx
mov rax, qword [rax]
test rax, rax
jne 0x427982
mov rax, qword [0x00811c38]
nop dword [rax]
test rax, rax
je 0x4279f4
mov rcx, qword [0x00811c50]
mov qword [rcx], rax
mov rax, qword [0x00811c38]
mov rcx, qword [0x00811c50]
mov qword [rax + 8], rcx
mov rax, qword [0x00811c48]
mov qword [0x00811c38], rax
xorps xmm0, xmm0
movups xmmword [0x00811c48], xmm0
nop
lea rax, [0x00811c30]
mov qword [rsp], rax
call fcn.0040c240
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [0x00811c50]
mov rcx, qword [0x00811c48]
mov qword [0x00811c38], rcx
mov qword [0x00811c40], rax
jmp 0x4279cf
lea rax, [0x00665d47]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00427920

Function at 0x428960
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x18]
jbe 0x4289e0
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [rsp + 0x40]
test al, al
je 0x4289c2
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], al
mov byte [rsp + 0x11], 0
call fcn.00428da0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00668c02]
mov qword [rsp], rax
mov qword [rsp + 8], 0x3c
call fcn.00439220
nop
nop dword [rax]
call fcn.004686e0
jmp fcn.00428960
Function at 0x428b00
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x428c5a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
xor eax, eax
jmp 0x428b8f
mov rax, rcx
mov r9, rsi
cmp r9, rax
jae 0x428c13
mov rcx, rax
mov rax, r9
lock cmpxchg qword [r8 + 0x210c8], rcx
sete sil
nop dword [rax]
test sil, sil
jne 0x428b7b
mov rsi, qword [r8 + 0x210c8]
cmp rsi, rcx
ja 0x428b3b
cmp rbx, rsi
jae 0x428b3b
jmp 0x428c33
sub rcx, rbx
lea rbx, [rcx + r10]
shr rcx, 0xd
sub r12, rcx
mov rsi, r12
mov eax, r11d
test rsi, rsi
jbe 0x428c25
test byte [rdx], al
nop
movabs rdi, 0x800000000000
lea r8, [rdi + rbx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x428c4c
mov r8, qword [rdx + r8*8 + 0x10198]
test byte [r8], al
shr r9, 0x16
and r9, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
mov r9, qword [r8 + 0x210c8]
mov r10, rbx
and rbx, 0x3fffff
cmp r9, rbx
seta r11b
mov r12, rsi
shl rsi, 0xd
add rsi, rbx
or r11d, eax
nop dword [rax]
cmp rsi, 0x400000
jbe 0x428c1b
mov eax, 0x400000
jmp 0x428b41
mov rcx, rax
jmp 0x428b7b
mov rax, rsi
nop
jmp 0x428b41
mov byte [rsp + 0x38], al
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00667e6b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x33
call fcn.00439220
mov rax, r8
mov ecx, 0x40
call fcn.0046cde0
nop
call fcn.0046abe0
nop
jmp fcn.00428b00
Function at 0x429d40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x429ed0
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rsp + 0x38]
cmp rdx, rcx
jne 0x429dca
nop dword [rax + rax]
cmp qword [rdx], rax
jne 0x429dbe
mov rcx, qword [rax]
mov qword [rdx], rcx
cmp qword [rdx + 8], rax
jne 0x429db1
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rcx + 8], rdx
jmp 0x429d99
mov rcx, qword [rax + 8]
mov rbx, qword [rax]
mov qword [rcx], rbx
jmp 0x429d8b
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x10], rdx
call fcn.0043aa00
lea rax, [0x00666feb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2d
call fcn.0043b480
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0043b100
lea rax, [0x0065a91d]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0043b480
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0043b420
lea rax, [0x0065a917]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0043b480
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0043b420
lea rax, [0x0065b9e3]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0043b480
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
nop dword [rax]
call fcn.0043b420
lea rax, [0x0065a8ff]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0043b480
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0043b420
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x0065d41b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.00439220
nop
call fcn.0046abe0
jmp fcn.00429d40
Function at 0x429ee0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x429ff7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x429f57
cmp qword [rax + 8], 0
nop
jne 0x429f57
cmp qword [rax + 0x10], 0
jne 0x429f57
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rdx, qword [rcx]
test rdx, rdx
je 0x429f51
mov qword [rdx + 8], rax
mov qword [rcx], rax
mov qword [rax + 0x10], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rcx + 8], rax
jmp 0x429f40
mov rcx, qword [rax + 8]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x10], rdx
call fcn.0043aa00
lea rax, [0x00663d49]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0043b480
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0043b420
call fcn.0043ac80
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0043b420
call fcn.0043ac80
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0043b420
nop dword [rax + rax]
call fcn.0043ac80
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0043b420
call fcn.0043ace0
call fcn.0043aaa0
lea rax, [0x0065d40b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.00439220
nop
call fcn.0046abe0
nop dword [rax]
jmp fcn.00429ee0