joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418900
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4189c6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x4189af
mov ecx, dword [0x0080a370]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x418942
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x418949
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x41898b
mov qword [rsp + 0x30], rbx
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
nop dword [rax + rax]
test rdx, rdx
jle 0x418978
mov ebx, ecx
call fcn.004185c0
mov rbx, qword [rsp + 0x30]
call fcn.0042fb60
jmp 0x4189a5
mov ebx, ecx
call fcn.00418600
mov rbx, qword [rsp + 0x30]
call fcn.0042fb60
jmp 0x4189a5
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
call fcn.004248e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006521e1]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00418900

Function at 0x418b00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418c05
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
call fcn.0040bb40
mov rax, qword [0x0080a618]
mov qword [rsp + 0x40], rax
mov rcx, qword [0x0080a620]
mov qword [rsp + 0x38], rcx
xor edx, edx
jmp 0x418b4c
mov rbx, qword [rsp + 0x30]
lea rdx, [rbx + 1]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
cmp rdx, rcx
jge 0x418bcc
mov qword [rsp + 0x30], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x20], rcx
mov rax, rcx
call fcn.00426ac0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
call fcn.00426ae0
mov rcx, qword [rsp + 0x28]
lea rdx, [0x0080a3d0]
mov rcx, qword [rdx + rcx*8]
test byte [rcx], al
mov rcx, qword [rcx + rax*8]
test byte [rcx], al
mov rdx, qword [rcx + 0x210c0]
test rdx, rdx
je 0x418b9e
xor eax, eax
jmp 0x418bf5
mov qword [rsp + 0x18], rcx
mov eax, 0x10000
xor ebx, ebx
lea rcx, [0x0083c798]
call fcn.0040d4c0
test rax, rax
je 0x418bdd
mov rcx, qword [rsp + 0x18]
mov qword [rcx + 0x210c0], rax
jmp 0x418b39
mov byte [0x00837f85], 1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0065408d]
mov ebx, 0x2a
call fcn.00436d80
mov byte [rdx + rax], 0
inc rax
cmp rax, 0x10000
jl 0x418bee
nop dword [rax]
jmp 0x418b39
call fcn.0045f280
jmp fcn.00418b00
Function at 0x418c80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418e46
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rcx
mov rax, rdi
mov ebx, esi
mov rcx, r8
call fcn.00414b80
nop dword [rax]
test al, al
je 0x418d58
mov rax, qword [rsp + 0x50]
call fcn.00426aa0
mov qword [rsp + 0x20], rax
call fcn.00426ac0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
call fcn.00426ae0
mov rcx, qword [rsp + 0x28]
lea rdx, [0x0080a3d0]
mov rcx, qword [rdx + rcx*8]
test byte [rcx], al
mov rcx, qword [rcx + rax*8]
test byte [rcx], al
mov rcx, qword [rcx + 0x210c0]
test byte [rcx], al
mov rdx, qword [rsp + 0x50]
mov rbx, rdx
shr rdx, 0x19
movzx edx, dx
add rcx, rdx
mov dl, byte [rcx]
shr rbx, 0x16
and ebx, 7
mov rax, rcx
mov rcx, rbx
mov esi, 1
shl esi, cl
test sil, dl
je 0x418d48
mov eax, 1
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lock or byte [rax], sil
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00438460
nop dword [rax]
call fcn.00438460
lea rax, [0x006576bc]
mov ebx, 0x39
call fcn.00438d00
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
call fcn.00438b80
call fcn.004386a0
call fcn.004384e0
call fcn.00438460
lea rax, [0x0064c5ad]
mov ebx, 0x18
call fcn.00438d00
mov rax, qword [rsp + 0x38]
call fcn.00438b80
lea rax, [0x00644395]
mov ebx, 1
nop dword [rax + rax]
call fcn.00438d00
mov rax, qword [rsp + 0x30]
call fcn.00438b80
lea rax, [0x006443cf]
mov ebx, 2
nop dword [rax + rax]
call fcn.00438d00
call fcn.004384e0
lea rax, [0x006447a5]
mov ebx, 4
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
call fcn.0041ff80
lea rax, [0x00644643]
mov ebx, 3
mov rcx, qword [rsp + 0x50]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.0041ff80
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x0064fc3d]
mov ebx, 0x1f
nop dword [rax]
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00418c80
Function at 0x418f20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4190cb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004349a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x418f8e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x418faa
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0044dae0
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
test rbx, rbx
jbe 0x418fce
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x418fe2
cmp rbx, 0x1000
jae 0x418f98
jmp 0x41904e
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x418ff4
xor edx, edx
jmp 0x419045
mov rcx, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004349a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x418fd8
jmp 0x418fc0
call fcn.00462ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438460
lea rax, [0x0064c595]
mov ebx, 0x18
call fcn.00438d00
mov rax, qword [rsp + 0x38]
call fcn.00438a40
lea rax, [0x0064c69d]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438d00
mov rax, qword [rsp + 0x30]
call fcn.00438a40
call fcn.004386a0
call fcn.004384e0
lea rax, [0x00650ced]
mov ebx, 0x21
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418f20
Function at 0x419100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x419346
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434a40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41917b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4191a2
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.0044dae0
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x4191c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4191d9
cmp rbx, 0x1000
jae 0x419185
nop
jmp 0x41925a
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4191ed
xor esi, esi
jmp 0x41924c
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434a40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4191cf
jmp 0x4191b6
call fcn.00462ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4192e0
nop
call fcn.00438460
lea rax, [0x0064ce3b]
mov ebx, 0x19
call fcn.00438d00
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00438a40
lea rax, [0x0064c69d]
mov ebx, 0x19
call fcn.00438d00
mov eax, dword [rsp + 0x34]
call fcn.00438a40
nop
call fcn.004386a0
call fcn.004384e0
lea rax, [0x00647179]
mov ebx, 0xd
call fcn.00436d80
nop dword [rax + rax]
cmp eax, 0x5af
je 0x419280
call fcn.00438460
lea rax, [0x0064ce3b]
mov ebx, 0x19
call fcn.00438d00
mov rax, qword [rsp + 0x38]
call fcn.00438a40
lea rax, [0x0064c69d]
mov ebx, 0x19
call fcn.00438d00
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438a40
call fcn.004386a0
call fcn.004384e0
lea rax, [0x0064fe4c]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00419100
Function at 0x41a440
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41a54e
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rsi, qword [rax]
nop dword [rax + rax]
test rsi, rsi
je 0x41a521
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x41a4a8
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x41a49b
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.00461cc0
mov rdi, qword [rsp + 0x18]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x41a4d8
mov edx, dword [rax + 0x2c]
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov rax, rdx
call fcn.0040d4c0
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov esi, dword [rdx + 0x2c]
mov dword [rdx + 0x28], esi
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x41a500
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00438460
lea rax, [0x006569fd]
mov ebx, 0x34
call fcn.00438d00
call fcn.004384e0
lea rax, [0x0064bd25]
mov ebx, 0x17
call fcn.00436d80
nop
mov qword [rsp + 8], rax
call fcn.0045f280
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.0041a440
Function at 0x41ca20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x41cba6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
nop dword [rax]
call fcn.0040bb40
cmp dword [0x00837fcc], 0
jne 0x41cb8f
lea rax, [0x007fa240]
call fcn.0040b060
add dword [0x0080a370], 2
lea rax, [0x007e0c7c]
call fcn.00424200
lea rax, [0x0080a398]
xor ebx, ebx
call fcn.00401ce0
mov rcx, qword [0x0080a618]
mov rdx, qword [0x0080a620]
mov rbx, qword [0x0080a628]
mov qword [0x0080a638], rdx
mov qword [0x0080a640], rbx
mov qword [0x0080a630], rcx
lea rax, [0x0080a3c0]
xor ebx, ebx
call fcn.00401ce0
lea rax, [0x0080a3c8]
xor ebx, ebx
call fcn.00401d40
lea rax, [0x007fa240]
call fcn.0040b280
lea rax, [0x007e0c80]
call fcn.00423d80
mov rcx, qword [rsp + 0x28]
cmp rcx, 2
jne 0x41cb0d
lea rax, [0x007fa240]
call fcn.0040b060
xorps xmm0, xmm0
movsd qword [0x0080a3b0], xmm0
lea rax, [0x007fa240]
call fcn.0040b280
jmp 0x41cb58
lea rax, [0x007e0c60]
call fcn.0040b060
cmp byte [0x007e0c70], 0
je 0x41cb3c
mov byte [0x007e0c70], 0
mov rax, qword [0x007e0c68]
xor ebx, ebx
mov ecx, 1
call fcn.0043a7e0
lea rax, [0x007e0c60]
call fcn.0040b280
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
inc dword [0x007e0c78]
call fcn.00424560
nop dword [rax]
cmp rax, 0xffffffffffffffff
jne 0x41cb52
call fcn.004265a0
xor eax, eax
call fcn.00426620
test al, al
jne 0x41cb6b
call fcn.0042de60
nop dword [rax + rax]
call fcn.0042dee0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00653abb]
mov ebx, 0x29
nop dword [rax + rax]
call fcn.00436d80
nop
mov qword [rsp + 8], rax
call fcn.00463620
mov rax, qword [rsp + 8]
jmp fcn.0041ca20
Function at 0x41fcc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41ff37
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
nop dword [rax + rax]
test rax, 7
jne 0x41ff25
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x40], r8
mov rax, rdi
mov rbx, r8
call fcn.00414b00
cmp byte [0x00837f85], 0
jne 0x41fdf9
mov byte [rsp + 0x37], bl
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], rcx
cmp dword [0x0083860c], 0
jle 0x41fd68
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x40]
call fcn.00414a20
test al, al
jne 0x41fe59
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
movzx ebx, byte [rsp + 0x37]
call fcn.00414b80
test al, al
jne 0x41fdef
mov rax, qword [rsp + 0x58]
movzx ebx, byte [rsp + 0x37]
mov rcx, qword [rsp + 0x38]
call fcn.00414ba0
mov rax, qword [rsp + 0x88]
call fcn.00426820
call fcn.00426d60
test byte [rax], al
movzx edx, byte [rax + rbx + 0x21040]
lea rsi, [rax + rbx]
lea rsi, [rsi + 0x21040]
test cl, dl
jne 0x41fdb3
lock or byte [rsi], cl
mov rcx, qword [rsp + 0x88]
movzx eax, byte [rcx + 0x62]
nop
call fcn.00426a80
test al, al
je 0x41fe19
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rsp + 0x88]
add rcx, qword [rdx + 0x68]
mov qword [rax + 0x10], rcx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rdi, rax
mov esi, ebx
mov r8, rcx
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call fcn.00418c80
test al, al
jne 0x41fe4f
mov rbx, qword [rsp + 0x70]
prefetcht0 byte [rbx]
mov rax, qword [rsp + 0x90]
call fcn.00425b80
test al, al
jne 0x41fe45
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x70]
nop
call fcn.00425a40
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.00438460
lea rax, [0x0064ef36]
mov ebx, 0x1d
call fcn.00438d00
mov rax, qword [rsp + 0x70]
call fcn.00438b80
lea rax, [0x00646591]
mov ebx, 0xc
call fcn.00438d00
mov rax, qword [rsp + 0x48]
call fcn.00438b80
lea rax, [0x00644395]
mov ebx, 1
call fcn.00438d00
mov rax, qword [rsp + 0x50]
call fcn.00438b80
lea rax, [0x006443cf]
mov ebx, 2
nop dword [rax + rax]
call fcn.00438d00
call fcn.004384e0
lea rax, [0x006447a5]
mov ebx, 4
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
call fcn.0041ff80
lea rax, [0x00644643]
mov ebx, 3
mov rcx, qword [rsp + 0x70]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.0041ff80
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x00649973]
mov ebx, 0x13
nop dword [rax]
call fcn.00436d80
lea rax, [0x006518b5]
mov ebx, 0x23
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0041fcc0
Function at 0x4203a0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
cmp byte [0x00837f85], 0
jne 0x42042f
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x18], rax
call fcn.00414aa0
mov rbx, rax
mov rax, qword [rsp + 0x18]
call fcn.00414b00
call fcn.00414ba0
mov rax, qword [rsp + 0x18]
nop dword [rax]
call fcn.00426820
call fcn.00426d60
test byte [rax], al
movzx edx, byte [rax + rbx + 0x21040]
lea rsi, [rax + rbx]
lea rsi, [rsi + 0x21040]
nop
test cl, dl
jne 0x420407
lock or byte [rsi], cl
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xa0]
call fcn.00445fe0
test byte [rax], al
mov rcx, qword [rsp + 0x40]
add qword [rax + 0x1248], rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006548c9]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00436d80
nop
int3

Function at 0x421100
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4212bb
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
cmp dword [0x00837fc4], 0
nop
je 0x4212a9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, rbx
call fcn.0041c520
nop dword [rax + rax]
test al, al
je 0x42129d
lea rax, [0x008380f0]
call fcn.0040aec0
test rax, rax
je 0x421291
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
test byte [rcx], al
mov rbx, qword [0x00675018]
lea rax, [rcx + 0xf8]
lea rdx, [0x00675018]
nop
call rbx
test al, al
je 0x42119d
mov rcx, qword [rsp + 0x38]
test byte [rcx], al
mov qword [rcx + 0x1228], 1
jmp 0x42122e
mov rcx, qword [rsp + 0x30]
movsd xmm0, qword [rcx + 0x110]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x4211b9
jnp 0x421274
call fcn.00452f40
mov rcx, qword [rsp + 0x30]
sub rax, qword [rcx + 0xf0]
test rax, rax
jle 0x42121c
mov rdx, qword [rsp + 0x38]
test byte [rdx], al
mov rsi, qword [rdx + 0x1220]
xorps xmm0, xmm0
cvtsi2sd xmm0, rsi
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
movsd xmm1, qword [rcx + 0x110]
ucomisd xmm0, xmm1
jbe 0x421221
lea rax, [0x008380f0]
mov rbx, qword [rsp + 0x18]
call fcn.0040ad60
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rdx, qword [rsp + 0x38]
test byte [rdx], al
mov qword [rdx + 0x1228], 2
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx + 0x10]
call fcn.00445f60
mov qword [rsp + 0x10], rax
mov ebx, 4
mov ecx, 1
call fcn.0043ac40
cmp byte [0x007ea170], 0
je 0x421265
mov rax, qword [rsp + 0x10]
xor ebx, ebx
call fcn.00454800
mov rax, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x008380f0]
mov rbx, qword [rsp + 0x18]
call fcn.0040ad60
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00656e20]
mov ebx, 0x36
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00421100
Function at 0x4229a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x422be0
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x48], rbx
mov rax, rbx
mov rbx, rcx
call fcn.0042eb60
nop dword [rax]
test rax, rax
jne 0x4229fb
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, qword [rsp + 0x48]
call fcn.0042ef40
test rax, 0x3fffff
jne 0x422bce
mov rdi, qword [0x00838160]
shr rdi, 0xd
cmp rdi, 1
mov edx, 1
cmovb rdi, rdx
mov qword [rsp + 0x30], rdi
mov rsi, qword [rsp + 0x98]
mov rdx, rsi
shr rsi, 0xd
lea r8, [rsi + 1]
test rdx, 0x1fff
cmovne rsi, r8
mov qword [rsp + 0x38], rsi
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call fcn.00422d60
test rax, rax
jne 0x422aa6
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x58], xmm15
mov qword [rsp + 0x68], 0
lea rdx, [0x00422c20]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x60], rdx
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x68], rsi
jmp 0x422ad7
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx + 0x10110]
nop
call fcn.0040b280
mov rax, qword [rsp + 0x40]
call fcn.00429bc0
mov rbx, qword [rsp + 0x50]
mov rcx, rax
mov qword [rsp + 0x48], rcx
mov rax, rbx
mov rbx, rcx
call fcn.0042eb60
test rax, rax
je 0x422bb5
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
lea rdx, [rsp + 0x58]
call rcx
test bl, bl
je 0x422bae
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x80]
test byte [rcx], al
mov rax, qword [rcx + 0x10110]
call fcn.0040b060
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x40]
call fcn.00429f00
mov ebx, 0x1ff
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
call fcn.004233c0
test rbx, rbx
jbe 0x422ab0
mov qword [rsp + 0x28], rbx
mov rcx, rax
mov rdi, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x40]
call fcn.00422f00
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx + 0x10110]
mov rax, rdx
call fcn.0040b280
mov rax, qword [rsp + 0x28]
shl rax, 0xd
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, qword [rsp + 0x50]
jmp 0x422bba
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rax, [0x00654e86]
mov ebx, 0x2d
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004229a0
Function at 0x4239c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423afb
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x138]
test rdx, rdx
jne 0x423a25
call fcn.00426160
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x130], rax
mov qword [rcx + 0x138], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x423a97
mov rdi, qword [rax + 0x100]
mov r8, rbx
sub rbx, rdi
lea rdi, [rsi - 1]
shl rdi, 5
mov r9d, dword [rdx + rdi + 0x20]
add r9d, dword [rdx + rdi + 0x24]
cmp r9d, ebx
ja 0x423ae9
cmp rsi, 0x3f
jne 0x423a9a
mov qword [rsp + 0x10], rdx
call fcn.00426160
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x138], rax
mov rcx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
jmp 0x423a9a
mov r8, rbx
mov rsi, qword [rdx + 0x10]
lea rdi, [rsi + 1]
mov qword [rdx + 0x10], rdi
shl rsi, 5
mov rdi, qword [rax + 0x100]
sub r8, rdi
mov dword [rdx + rsi + 0x20], r8d
mov edi, dword [rcx + 4]
mov dword [rdx + rsi + 0x24], edi
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x20]
mov rbx, rcx
mov rax, rdx
call fcn.00423740
mov rcx, qword [rsp + 0x28]
inc qword [rcx + 0x140]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00653c03]
mov ebx, 0x29
call fcn.00436d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.004239c0