joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x408079
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x408063
mov rcx, qword [rax]
test rcx, rcx
je 0x408063
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x408048
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rcx]
mov ebx, dword [rax + 0xc]
mov qword [rsp + 8], rbx
mov rbx, qword [rsp + 0x58]
mov qword [rsp], rbx
mov rsi, qword [rdx]
call rsi
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rbx + 9]
mov rdx, rcx
mov ecx, esi
mov rdi, 1
shl rdi, cl
cmp cl, 0x40
sbb rcx, rcx
and rcx, rdi
dec rcx
movzx eax, word [rax + 0x54]
mov rsi, rdx
and rdx, rcx
imul rdx, rax
mov rdi, qword [rbx + 0x10]
add rdi, rdx
mov r8, qword [rbx + 0x18]
test r8, r8
je 0x407f0f
movzx ebx, byte [rbx + 8]
test bl, 8
je 0x408040
and rcx, rsi
imul rax, rcx
lea rcx, [r8 + rax]
test byte [rcx], al
movzx eax, byte [r8 + rax]
dec eax
cmp al, 3
jae 0x408038
shr rsi, 0x38
cmp sil, 4
jae 0x408030
lea eax, [rsi + 4]
mov byte [rsp + 0x1f], al
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov qword [rsp + 0x20], rcx
cmp rcx, 8
jae 0x407f4e
test byte [rdi], al
movzx ebx, byte [rdi + rcx]
cmp bl, al
je 0x407f83
inc rcx
mov qword [rsp + 0x20], rcx
cmp rcx, 8
jb 0x407f36
mov rcx, qword [rsp + 0x48]
movzx ecx, word [rcx + 0x54]
lea rbx, [rcx + rdi - 8]
test byte [rbx], al
mov rcx, qword [rcx + rdi - 8]
test rcx, rcx
je 0x407f6d
mov rdi, rcx
jmp 0x407f24
lea rax, [0x008b4ae0]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbx, qword [rsp + 0x48]
movzx esi, byte [rbx + 0x50]
imul rsi, rcx
lea r8, [rsi + rdi + 8]
movzx ebx, byte [rbx + 0x51]
test bl, bl
je 0x408028
test byte [r8], al
mov rbx, qword [rsi + rdi + 8]
mov rsi, qword [rsp + 0x30]
mov rdx, qword [rsi + 8]
mov r8, qword [rsp + 0x58]
mov qword [rsp], r8
mov qword [rsp + 8], rbx
mov rbx, qword [rdx]
call rbx
movzx eax, byte [rsp + 0x10]
test al, al
jne 0x407fe2
movzx eax, byte [rsp + 0x1f]
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
jmp 0x407f40
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x52]
movzx edx, byte [rax + 0x50]
mov rbx, qword [rsp + 0x20]
imul rcx, rbx
lea rcx, [rcx + rdx*8 + 8]
mov rdx, qword [rsp + 0x28]
lea rbx, [rcx + rdx]
movzx eax, byte [rax + 0x53]
test al, al
je 0x408023
test byte [rbx], al
mov rax, qword [rcx + rdx]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, rbx
jmp 0x408014
mov rbx, r8
jmp 0x407fa9
mov rax, rsi
jmp 0x407f20
mov rdi, rcx
jmp 0x407f0f
shr rcx, 1
jmp 0x407ef3
lea rax, [0x006d8f70]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aea0
ud2
lea rax, [0x008b4ae0]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00452210
jmp fcn.00407e20
Function at 0x408090
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4082f8
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x4082dd
mov rcx, qword [rax]
test rcx, rcx
je 0x4082dd
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x4082c2
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rcx]
mov ebx, dword [rax + 0xc]
mov qword [rsp + 8], rbx
mov rbx, qword [rsp + 0x58]
mov qword [rsp], rbx
mov rsi, qword [rdx]
call rsi
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rbx + 9]
mov rdx, rcx
mov ecx, esi
mov rdi, 1
shl rdi, cl
cmp cl, 0x40
sbb rcx, rcx
and rcx, rdi
dec rcx
movzx eax, word [rax + 0x54]
mov rsi, qword [rbx + 0x10]
mov rdi, rdx
and rdx, rcx
imul rdx, rax
add rsi, rdx
mov r8, qword [rbx + 0x18]
test r8, r8
je 0x40817f
movzx ebx, byte [rbx + 8]
test bl, 8
je 0x4082ba
and rcx, rdi
imul rax, rcx
lea rcx, [r8 + rax]
test byte [rcx], al
movzx eax, byte [r8 + rax]
dec eax
cmp al, 3
jae 0x4082b2
shr rdi, 0x38
cmp dil, 4
jae 0x4082aa
lea eax, [rdi + 4]
mov byte [rsp + 0x1f], al
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov qword [rsp + 0x20], rcx
cmp rcx, 8
jae 0x4081be
test byte [rsi], al
movzx ebx, byte [rsi + rcx]
cmp bl, al
je 0x4081f8
inc rcx
mov qword [rsp + 0x20], rcx
cmp rcx, 8
jb 0x4081a6
mov rcx, qword [rsp + 0x48]
movzx ecx, word [rcx + 0x54]
lea rbx, [rcx + rsi - 8]
test byte [rbx], al
mov rcx, qword [rcx + rsi - 8]
test rcx, rcx
je 0x4081dd
mov rsi, rcx
jmp 0x408194
lea rax, [0x008b4ae0]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbx, qword [rsp + 0x48]
movzx edi, byte [rbx + 0x50]
imul rdi, rcx
lea r8, [rdi + rsi + 8]
movzx ebx, byte [rbx + 0x51]
test bl, bl
je 0x4082a2
test byte [r8], al
mov rbx, qword [rdi + rsi + 8]
mov rdi, qword [rsp + 0x30]
mov rdx, qword [rdi + 8]
mov r8, qword [rsp + 0x58]
mov qword [rsp], r8
mov qword [rsp + 8], rbx
mov rbx, qword [rdx]
call rbx
movzx eax, byte [rsp + 0x10]
test al, al
jne 0x408257
movzx eax, byte [rsp + 0x1f]
mov rcx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp 0x4081b0
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x52]
movzx edx, byte [rax + 0x50]
mov rbx, qword [rsp + 0x20]
imul rcx, rbx
lea rcx, [rcx + rdx*8 + 8]
mov rdx, qword [rsp + 0x28]
lea rbx, [rcx + rdx]
movzx eax, byte [rax + 0x53]
test al, al
je 0x40829d
test byte [rbx], al
mov rax, qword [rcx + rdx]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, rbx
jmp 0x408289
mov rbx, r8
jmp 0x40821e
mov rax, rdi
jmp 0x408190
mov rsi, rcx
jmp 0x40817f
shr rcx, 1
jmp 0x408163
lea rax, [0x006d8f70]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aea0
ud2
lea rax, [0x008b4ae0]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00452210
jmp fcn.00408090
Function at 0x40ac80
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40ae44
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x40ae2e
mov rcx, qword [rax]
test rcx, rcx
je 0x40ae2e
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x40ae13
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x40ad6e
mov rax, qword [rax + 0x10]
xor ecx, ecx
cmp rcx, 8
jae 0x40ad0b
lea rdx, [rax + rcx*4 + 8]
test byte [rdx], al
mov rdx, rcx
shl rcx, 2
mov ecx, dword [rcx + rax + 8]
mov ebx, dword [rsp + 0x38]
cmp ecx, ebx
je 0x40ad3d
lea rcx, [rdx + 1]
cmp rcx, 8
jb 0x40ace7
mov rcx, qword [rsp + 0x28]
movzx ecx, word [rcx + 0x54]
lea rdx, [rcx + rax - 8]
test byte [rdx], al
mov rax, qword [rcx + rax - 8]
test rax, rax
je 0x40ad27
jmp 0x40acdf
lea rax, [0x008b4ae0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rcx, [rdx + rax]
test byte [rcx], al
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x40ad4d
jmp 0x40ad01
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rcx, rdx
lea rax, [rcx + rax + 0x28]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x18]
mov ebx, dword [rax + 0xc]
mov rdx, qword [rcx]
mov qword [rsp + 8], rbx
lea rcx, [rsp + 0x38]
mov qword [rsp], rcx
mov rcx, qword [rdx]
call rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rbx + 9]
mov rdx, rcx
mov ecx, esi
mov rdi, 1
shl rdi, cl
cmp cl, 0x40
sbb rcx, rcx
and rcx, rdi
dec rcx
movzx eax, word [rax + 0x54]
mov rsi, rdx
and rdx, rcx
imul rdx, rax
mov rdi, qword [rbx + 0x10]
add rdi, rdx
mov r8, qword [rbx + 0x18]
test r8, r8
je 0x40ae01
movzx edx, byte [rbx + 8]
test dl, 8
je 0x40ae0e
and rsi, rcx
imul rax, rsi
lea rcx, [r8 + rax]
test byte [rcx], al
movzx eax, byte [r8 + rax]
dec eax
cmp al, 3
jae 0x40ae09
mov rax, rdi
jmp 0x40acdf
mov rdi, rcx
jmp 0x40ae01
shr rcx, 1
jmp 0x40ade9
lea rax, [0x006d8f70]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aea0
ud2
lea rax, [0x008b4ae0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00452210
jmp fcn.0040ac80
Function at 0x40ae50
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40b023
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x40b008
mov rcx, qword [rax]
test rcx, rcx
je 0x40b008
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x40afed
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x40af48
mov rax, qword [rax + 0x10]
xor ecx, ecx
cmp rcx, 8
jae 0x40aedb
lea rdx, [rax + rcx*4 + 8]
test byte [rdx], al
mov rdx, rcx
shl rcx, 2
mov ecx, dword [rcx + rax + 8]
mov ebx, dword [rsp + 0x38]
cmp ecx, ebx
je 0x40af12
lea rcx, [rdx + 1]
cmp rcx, 8
jb 0x40aeb7
mov rcx, qword [rsp + 0x28]
movzx ecx, word [rcx + 0x54]
lea rdx, [rcx + rax - 8]
test byte [rdx], al
mov rax, qword [rcx + rax - 8]
test rax, rax
je 0x40aef7
jmp 0x40aeaf
lea rax, [0x008b4ae0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rcx, [rdx + rax]
test byte [rcx], al
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x40af22
jmp 0x40aed1
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rcx, rdx
lea rax, [rcx + rax + 0x28]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x18]
mov ebx, dword [rax + 0xc]
mov rdx, qword [rcx]
mov qword [rsp + 8], rbx
lea rcx, [rsp + 0x38]
mov qword [rsp], rcx
mov rcx, qword [rdx]
call rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rbx + 9]
mov rdx, rcx
mov ecx, esi
mov rdi, 1
shl rdi, cl
cmp cl, 0x40
sbb rcx, rcx
and rcx, rdi
dec rcx
movzx eax, word [rax + 0x54]
mov rsi, rdx
and rdx, rcx
imul rdx, rax
mov rdi, qword [rbx + 0x10]
add rdi, rdx
mov r8, qword [rbx + 0x18]
test r8, r8
je 0x40afdb
movzx edx, byte [rbx + 8]
test dl, 8
je 0x40afe8
and rsi, rcx
imul rax, rsi
lea rcx, [r8 + rax]
test byte [rcx], al
movzx eax, byte [r8 + rax]
dec eax
cmp al, 3
jae 0x40afe3
mov rax, rdi
jmp 0x40aeaf
mov rdi, rcx
jmp 0x40afdb
shr rcx, 1
jmp 0x40afc3
lea rax, [0x006d8f70]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aea0
ud2
lea rax, [0x008b4ae0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00452210
jmp fcn.0040ae50
Function at 0x40b030
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40b1f7
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x40b1e1
mov rcx, qword [rax]
test rcx, rcx
je 0x40b1e1
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x40b1c6
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x40b121
mov rax, qword [rax + 0x10]
xor ecx, ecx
cmp rcx, 8
jae 0x40b0be
lea rdx, [rax + rcx*8 + 8]
test byte [rdx], al
mov rdx, rcx
shl rcx, 3
mov rcx, qword [rcx + rax + 8]
mov rbx, qword [rsp + 0x38]
cmp rcx, rbx
je 0x40b0f0
lea rcx, [rdx + 1]
cmp rcx, 8
jb 0x40b097
mov rcx, qword [rsp + 0x28]
movzx ecx, word [rcx + 0x54]
lea rdx, [rcx + rax - 8]
test byte [rdx], al
mov rax, qword [rcx + rax - 8]
test rax, rax
je 0x40b0da
jmp 0x40b08f
lea rax, [0x008b4ae0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rcx, [rdx + rax]
test byte [rcx], al
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x40b100
jmp 0x40b0b4
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rcx, rdx
lea rax, [rcx + rax + 0x48]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x18]
mov ebx, dword [rax + 0xc]
mov rdx, qword [rcx]
mov qword [rsp + 8], rbx
lea rcx, [rsp + 0x38]
mov qword [rsp], rcx
mov rcx, qword [rdx]
call rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rbx + 9]
mov rdx, rcx
mov ecx, esi
mov rdi, 1
shl rdi, cl
cmp cl, 0x40
sbb rcx, rcx
and rcx, rdi
dec rcx
movzx eax, word [rax + 0x54]
mov rsi, rdx
and rdx, rcx
imul rdx, rax
mov rdi, qword [rbx + 0x10]
add rdi, rdx
mov r8, qword [rbx + 0x18]
test r8, r8
je 0x40b1b4
movzx edx, byte [rbx + 8]
test dl, 8
je 0x40b1c1
and rsi, rcx
imul rax, rsi
lea rcx, [r8 + rax]
test byte [rcx], al
movzx eax, byte [r8 + rax]
dec eax
cmp al, 3
jae 0x40b1bc
mov rax, rdi
jmp 0x40b08f
mov rdi, rcx
jmp 0x40b1b4
shr rcx, 1
jmp 0x40b19c
lea rax, [0x006d8f70]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aea0
ud2
lea rax, [0x008b4ae0]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00452210
jmp fcn.0040b030
Function at 0x40b210
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40b3e6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x40b3cb
mov rcx, qword [rax]
test rcx, rcx
je 0x40b3cb
movzx ecx, byte [rax + 8]
test cl, 4
jne 0x40b3b0
movzx ecx, byte [rax + 9]
test cl, cl
jne 0x40b30b
mov rax, qword [rax + 0x10]
xor ecx, ecx
cmp rcx, 8
jae 0x40b29e
lea rdx, [rax + rcx*8 + 8]
test byte [rdx], al
mov rdx, rcx
shl rcx, 3
mov rcx, qword [rcx + rax + 8]
mov rbx, qword [rsp + 0x38]
cmp rcx, rbx
je 0x40b2d5
lea rcx, [rdx + 1]
cmp rcx, 8
jb 0x40b277
mov rcx, qword [rsp + 0x28]
movzx ecx, word [rcx + 0x54]
lea rdx, [rcx + rax - 8]
test byte [rdx], al
mov rax, qword [rcx + rax - 8]
test rax, rax
je 0x40b2ba
jmp 0x40b26f
lea rax, [0x008b4ae0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rcx, [rdx + rax]
test byte [rcx], al
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x40b2e5
jmp 0x40b294
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x52]
imul rcx, rdx
lea rax, [rcx + rax + 0x48]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x18]
mov ebx, dword [rax + 0xc]
mov rdx, qword [rcx]
mov qword [rsp + 8], rbx
lea rcx, [rsp + 0x38]
mov qword [rsp], rcx
mov rcx, qword [rdx]
call rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rbx + 9]
mov rdx, rcx
mov ecx, esi
mov rdi, 1
shl rdi, cl
cmp cl, 0x40
sbb rcx, rcx
and rcx, rdi
dec rcx
movzx eax, word [rax + 0x54]
mov rsi, rdx
and rdx, rcx
imul rdx, rax
mov rdi, qword [rbx + 0x10]
add rdi, rdx
mov r8, qword [rbx + 0x18]
test r8, r8
je 0x40b39e
movzx edx, byte [rbx + 8]
test dl, 8
je 0x40b3ab
and rsi, rcx
imul rax, rsi
lea rcx, [r8 + rax]
test byte [rcx], al
movzx eax, byte [r8 + rax]
dec eax
cmp al, 3
jae 0x40b3a6
mov rax, rdi
jmp 0x40b26f
mov rdi, rcx
jmp 0x40b39e
shr rcx, 1
jmp 0x40b386
lea rax, [0x006d8f70]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aea0
ud2
lea rax, [0x008b4ae0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00452210
jmp fcn.0040b210
Function at 0x40d4e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40d64c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 8]
inc rdx
mov qword [rsp + 0x18], rdx
mov qword [rcx + 8], rdx
test byte [rcx], al
mov rbx, rcx
and rdx, 0x7ffff
shl rbx, 0x10
or rdx, rbx
mov qword [rsp + 0x10], rdx
mov rbx, rdx
sar rdx, 0x13
shl rdx, 3
mov qword [rsp + 0x20], rdx
cmp rcx, rdx
jne 0x40d572
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rdx]
mov qword [rcx], rsi
mov rax, rsi
lock cmpxchg qword [rdx], rbx
sete sil
test sil, sil
jne 0x40d568
jmp 0x40d54f
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0042b850
lea rax, [0x006dbae5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0042c220
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c1d0
lea rax, [0x006cf8dc]
mov qword [rsp], rax
mov qword [rsp + 8], 5
call fcn.0042c220
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c0a0
lea rax, [0x006d0212]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0042c220
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c0a0
lea rax, [0x006d0663]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c220
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042c1d0
lea rax, [0x006cf2b1]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c220
call fcn.0042b8f0
lea rax, [0x006d139e]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.0040d4e0

Function at 0x40da40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40db35
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x10], rax
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx]
cmp rax, rdx
jne 0x40db1a
mov qword [rsp], rcx
call fcn.00428570
mov rax, qword [rsp + 0x10]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x18], rcx
mov rdx, rax
xor eax, eax
mov rbx, qword [rsp + 0x30]
lock cmpxchg qword [rbx], rcx
sete al
test al, al
jne 0x40dae8
mov rax, qword [rbx]
cmp rax, 1
jne 0x40dacd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006d7bf6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042aea0
ud2
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe5], 1
mov qword [rsp], 0xffffffffffffffff
call fcn.004283d0
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006d3d8d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.0042aea0
ud2
call fcn.00452210
jmp fcn.0040da40
Function at 0x40db40
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rcx + 0x30]
mov qword [rsp + 0x10], rdx
xor eax, eax
mov rbx, qword [rsp + 0x28]
lock cmpxchg qword [rbx], rdx
sete dl
test dl, dl
je 0x40dd02
mov rax, qword [rsp + 0x30]
test rax, rax
jl 0x40dccb
call fcn.004289c0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rdx + 0x30]
mov byte [rbx + 0xe5], 1
mov qword [rsp], rcx
call fcn.004283d0
mov eax, dword [rsp + 8]
test eax, eax
jge 0x40dcac
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.004289c0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jle 0x40dbfa
mov rax, rdx
jmp 0x40dba7
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rdx]
mov rsi, qword [rcx + 0x30]
mov rdi, rsi
cmp rbx, rdi
jne 0x40dc35
mov rax, rbx
xor esi, esi
lock cmpxchg qword [rdx], rsi
sete bl
test bl, bl
jne 0x40dc26
jmp 0x40dc04
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rbx, 1
jne 0x40dc91
mov byte [rsi + 0xe5], 1
mov qword [rsp], 0xffffffffffffffff
call fcn.004283d0
mov eax, dword [rsp + 8]
test eax, eax
jl 0x40dc76
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006dd215]
mov qword [rsp], rax
mov qword [rsp + 8], 0x32
call fcn.0042aea0
ud2
lea rax, [0x006dcdd6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.0042aea0
ud2
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rcx + 0x30]
mov byte [rax + 0xe5], 1
mov qword [rsp], 0xffffffffffffffff
call fcn.004283d0
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rbx]
cmp rax, 1
jne 0x40dd1a
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d8211]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0042aea0
ud2
Function at 0x40e9f0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40ec6d
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test byte [rax], al
movzx ecx, byte [rsp + 0x60]
movzx edx, cl
mov qword [rsp + 0x20], rdx
cmp rdx, 0x43
jae 0x40ec66
mov rbx, qword [rax + rdx*8 + 0x28]
mov qword [rsp + 0x28], rbx
mov qword [rsp], rbx
call fcn.00410b90
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x38]
mov qword [rsp + 0x18], rdx
cmp rax, rdx
jne 0x40ec5f
movzx eax, word [rcx + 0x60]
mov word [rsp + 0x16], ax
movzx ecx, ax
cmp rcx, rdx
jne 0x40ebd5
mov qword [rsp + 0x30], 0
lea rax, [0x0044f140]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
movzx ecx, byte [rsp + 0x60]
mov byte [rsp + 0x40], cl
lea rcx, [rsp + 0x30]
mov qword [rsp], rcx
call fcn.004520b0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + rax*8 + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp], rax
call fcn.00410b90
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
mov edx, 1
mov rbx, qword [rcx + 0x38]
cmp rax, rbx
jae 0x40ebba
mov rbx, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x68]
movzx edi, word [rcx + 0x60]
inc edi
mov word [rsp + 0x16], di
mov word [rcx + 0x60], di
imul rax, rsi
add rax, rbx
mov rbx, qword [rcx + 0x38]
mov qword [rsp + 0x18], rbx
movzx esi, di
cmp rsi, rbx
ja 0x40eb30
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x78], dl
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0042b850
lea rax, [0x006d1e44]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042c220
call fcn.0042bad0
movzx eax, word [rsp + 0x16]
movzx eax, ax
mov qword [rsp], rax
call fcn.0042c020
call fcn.0042bad0
lea rax, [0x006d0a80]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c220
call fcn.0042bad0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c020
call fcn.0042bb30
call fcn.0042b8f0
lea rax, [0x006d5871]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042aea0
ud2
lea rax, [0x006d4ed0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.0042aea0
ud2
call fcn.0042b850
lea rax, [0x006d5164]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.0042c220
call fcn.0042bad0
movzx eax, word [rsp + 0x16]
movzx eax, ax
mov qword [rsp], rax
call fcn.0042c020
call fcn.0042bad0
lea rax, [0x006d0a80]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c220
call fcn.0042bad0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c020
call fcn.0042bb30
call fcn.0042b8f0
lea rax, [0x006dce07]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.0042aea0
ud2
xor edx, edx
jmp 0x40eadc
call fcn.004293e0
ud2
call fcn.00452210
jmp fcn.0040e9f0