joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428630
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42872c
sub esp, 8
nop
nop
lea eax, [0x96f750]
mov dword [esp], eax
call fcn.0040a350
mov eax, dword [0x96f6c0]
mov ecx, dword [0x96f6c4]
test eax, eax
setne al
test ecx, ecx
setne cl
or ecx, eax
test cl, cl
jne 0x428715
mov dword [0x96f708], 0
mov dword [0x96f70c], 0
mov eax, dword [0x96f75c]
test eax, eax
jne 0x4286b4
nop
nop
lea eax, [0x96f750]
mov dword [esp], eax
call fcn.0040a550
add esp, 8
ret
lea ecx, [0x96f754]
mov dword [eax + 8], ecx
mov eax, dword [eax]
test eax, eax
jne 0x4286a9
mov eax, dword [0x96f754]
test eax, eax
je 0x4286e7
mov ecx, dword [0x96f760]
mov dword [ecx], eax
mov eax, dword [0x96f754]
mov ecx, dword [0x96f760]
mov dword [eax + 4], ecx
mov eax, dword [0x96f75c]
mov dword [0x96f754], eax
jmp 0x4286ff
mov eax, dword [0x96f75c]
mov ecx, dword [0x96f760]
mov dword [0x96f754], eax
mov dword [0x96f758], ecx
mov dword [0x96f75c], 0
mov dword [0x96f760], 0
jmp 0x428695
lea eax, [0x74a5c7]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00428630

Function at 0x4293a0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x4293fc
sub esp, 0x10
movzx eax, byte [esp + 0x1c]
test al, al
je 0x4293e5
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov byte [esp + 8], al
mov byte [esp + 9], 0
call fcn.004296d0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x750128]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.00439230
nop
call fcn.004663e0
jmp fcn.004293a0
Function at 0x4294a0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4295df
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
xor edx, edx
jmp 0x4294d8
sub ebx, ecx
mov ebp, ebx
shr ebx, 0xd
mov esi, dword [esp + 0x14]
lea ecx, [ebp + esi]
mov eax, dword [esp + 0x20]
sub eax, ebx
test eax, eax
jbe 0x429568
mov dword [esp + 0x20], eax
mov byte [esp + 0x13], dl
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x2c]
mov ebx, dword [edx + 0xf4]
test byte [ebx], al
mov ebp, ecx
and ecx, 0x3fffff
mov dword [esp + 0x1c], ecx
shl eax, 0xd
add eax, ecx
mov dword [esp + 0x18], eax
shr ebp, 0x16
mov ebx, dword [ebx + ebp*4]
test byte [ebx], al
add ebx, 0x218c4
mov dword [esp + 0x24], ebx
mov dword [esp], ebx
call fcn.00402bb0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
seta dl
movzx ebx, byte [esp + 0x13]
or edx, ebx
mov ebx, dword [esp + 0x18]
cmp ebx, 0x400000
jbe 0x42954c
mov ebx, 0x400000
mov dword [esp + 0x18], ebx
mov byte [esp + 0x13], dl
jmp 0x42957b
mov ecx, dword [esp + 0x1c]
movzx edx, byte [esp + 0x13]
mov ebx, dword [esp + 0x18]
jmp 0x4294c3
mov byte [esp + 0x38], dl
add esp, 0x28
ret
mov ecx, edx
movzx edx, byte [esp + 0x13]
mov ebx, dword [esp + 0x18]
cmp ebx, eax
jbe 0x4294c3
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
call fcn.00402b90
movzx eax, byte [esp + 0xc]
test al, al
jne 0x429556
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00402bb0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jb 0x4295c2
mov edx, dword [esp + 0x1c]
cmp eax, edx
jbe 0x429570
jmp 0x4295c8
mov edx, dword [esp + 0x1c]
jmp 0x429570
lea eax, [0x74e478]
mov dword [esp], eax
mov dword [esp + 4], 0x33
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.004294a0
Function at 0x42a890
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42a9de
sub esp, 0x14
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x18]
cmp edx, ecx
jne 0x42a8f4
cmp dword [edx], eax
jne 0x42a8c0
mov ecx, dword [eax]
mov dword [edx], ecx
jmp 0x42a8c7
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
mov dword [ecx], ebx
cmp dword [edx + 4], eax
jne 0x42a8d4
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x42a8dc
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
add esp, 0x14
ret
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
call fcn.0043af60
lea eax, [0x74c440]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0043b4c0
lea eax, [0x73ac6f]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.0043b7e0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0043b7a0
lea eax, [0x73ac75]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.0043b7e0
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.0043b7a0
lea eax, [0x73c37f]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043b7e0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0043b7a0
lea eax, [0x73ac7b]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.0043b7e0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0043b7a0
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x73e1cc]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.0042a890
Function at 0x42abe0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42ad24
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00428a60
mov eax, dword [esp + 4]
test eax, eax
je 0x42ad0d
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x99504c]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call fcn.00426690
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call fcn.0040a350
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x42ac77
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42aca2
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x42ac8c
cmp byte [ebp + 6], bl
je 0x42ac97
cmp esi, edx
ja 0x42ac9e
jne 0x42ac75
cmp byte [ebp + 6], bl
jbe 0x42ac75
jmp 0x42ac9e
mov ebx, 1
jmp 0x42aca4
xor ebx, ebx
jmp 0x42aca4
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x42acc2
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call fcn.0042aae0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040a550
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x99504c]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x42acfd
movzx eax, byte [ebx + 0x65]
test al, al
je 0x42acfd
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x744d77]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.0042abe0
Function at 0x42b1b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42b320
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42b2b0
cmp cl, 1
je 0x42b242
cmp cl, 2
jne 0x42b309
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00430810
nop
nop
lea eax, [0x979540]
mov dword [esp], eax
call fcn.0040a350
mov eax, dword [0x9794e4]
sub eax, dword [0x9794c8]
nop
mov dword [0x9794e4], eax
mov eax, dword [0x9794d4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x9794d4], ecx
nop
lea eax, [0x979540]
mov dword [esp], eax
call fcn.0040a550
jmp 0x42b305
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00417030
nop
nop
lea eax, [0x979540]
mov dword [esp], eax
call fcn.0040a350
mov eax, dword [0x9794bc]
sub eax, dword [0x9794a0]
nop
mov dword [0x9794bc], eax
mov eax, dword [0x9794ac]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x9794ac], ecx
nop
lea eax, [0x979540]
mov dword [esp], eax
call fcn.0040a550
jmp 0x42b305
cmp cl, 3
jne 0x42b2bb
mov byte [eax + 8], 1
jmp 0x42b305
cmp cl, 4
jne 0x42b309
nop
nop
lea eax, [0x979540]
mov dword [esp], eax
call fcn.0040a350
mov eax, dword [0x979534]
sub eax, dword [0x979518]
nop
mov dword [0x979534], eax
mov eax, dword [0x979524]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x979524], ecx
nop
nop
lea eax, [0x979540]
mov dword [esp], eax
call fcn.0040a550
add esp, 0x14
ret
lea eax, [0x73e1ec]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.0042b1b0
Function at 0x42b6d0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42b85c
sub esp, 0x14
mov eax, dword [0x937bd0]
cmp eax, 0x12
ja 0x42b7c0
mov eax, dword [esp + 0x18]
test byte [eax], al
mov ecx, dword [0x995310]
test ecx, ecx
jne 0x42b70c
mov ecx, dword [esp + 0x20]
jmp 0x42b720
call fcn.00468e70
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov edx, dword [eax + 0x9c]
mov dword [edi + 4], edx
mov dword [eax + 0x9c], ecx
lea edx, [eax + 0x40]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00431a50
mov eax, dword [esp + 0x18]
mov dword [esp], eax
movzx ecx, byte [esp + 0x24]
mov byte [esp + 4], cl
call fcn.0042d740
mov eax, dword [0x937260]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x34], eax
mov eax, dword [0x995310]
test eax, eax
jne 0x42b767
mov eax, dword [esp + 0x1c]
jmp 0x42b77b
call fcn.00468e70
mov eax, dword [esp + 0x1c]
mov dword [edi], eax
mov edx, dword [ecx + 0x98]
mov dword [edi + 4], edx
mov dword [ecx + 0x98], eax
lea eax, [ecx + 0x58]
mov dword [esp], eax
movzx eax, byte [esp + 0x24]
mov byte [esp + 4], al
mov edx, dword [esp + 0x20]
mov dword [esp + 8], edx
call fcn.00424c60
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xa0]
add ecx, dword [esp + 0xc]
mov dword [eax + 0xa0], ecx
movzx ecx, byte [esp + 0x24]
mov byte [eax + 0xa5], cl
add esp, 0x14
ret
mov dword [esp + 0x10], eax
call fcn.0043af60
lea eax, [0x7466d2]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.0043b7e0
mov ecx, dword [esp + 0x10]
mov eax, 1
shl eax, cl
cmp ecx, 0x20
sbb ecx, ecx
and eax, ecx
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043b600
call fcn.0043b170
call fcn.0043afc0
call fcn.0043af60
lea eax, [0x744d94]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.0043b7e0
mov dword [esp + 4], 0
mov dword [esp], 0x40000
call fcn.0043b600
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x74b8ab]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.0042b6d0
Function at 0x42d8b0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42da27
sub esp, 0x18
mov ebx, dword [esp + 0x20]
test ebx, 0x3fffff
jne 0x42d9ad
mov ebp, dword [esp + 0x24]
test ebp, 0x3fffff
jne 0x42d9ad
mov ebx, dword [esp + 0x1c]
mov eax, 3
jmp 0x42d8fb
dec eax
mov esi, dword [esp + 0x24]
mov ebx, ebp
mov ebp, esi
test eax, eax
jl 0x42d99a
nop
cmp eax, 4
jae 0x42d9a3
test byte [ebx], al
lea esi, [eax + eax*2]
mov dword [esp + 0x10], esi
lea edi, [ebx + esi*4]
mov dword [esp + 0x14], edi
lea ecx, [ebp - 1]
mov dword [esp + 0xc], ecx
lea ebp, [0x937bc0]
mov ebp, dword [ebp + eax*4]
mov dword [esp + 8], ebp
mov ecx, ebp
mov edi, dword [esp + 0xc]
shr edi, cl
mov dword [esp + 0xc], edi
lea edi, [0x937bb0]
mov edi, dword [edi + eax*4]
mov ecx, edi
mov ebp, 1
shl ebp, cl
nop
mov edx, dword [ebx + esi*4 + 8]
nop
mov ebx, dword [esp + 8]
cmp ebx, 0x20
sbb ebx, ebx
mov esi, dword [esp + 0xc]
and esi, ebx
cmp ecx, 0x20
sbb ecx, ecx
and ecx, ebp
lea ebx, [ecx + esi]
neg ecx
and ecx, ebx
mov ebx, dword [esp + 0x14]
cmp dword [ebx + 4], ecx
jge 0x42d991
cmp edx, ecx
jb 0x42d99e
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x1c]
mov dword [ebp + ebx*4 + 4], ecx
jmp 0x42d8f2
mov ebp, dword [esp + 0x1c]
jmp 0x42d8f2
add esp, 0x18
ret
call fcn.00468f10
mov ecx, 4
call fcn.00468ed0
call fcn.0043af60
lea eax, [0x73e21c]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0043b670
lea eax, [0x73bd6e]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.0043b670
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x74ca13]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.0042d8b0

Function at 0x4311c0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x431281
sub esp, 0x2c
movzx ecx, byte [esp + 0x3c]
test cl, cl
je 0x4311ee
mov byte [esp], 6
call fcn.0043e260
movzx ecx, byte [esp + 0x3c]
mov dword [esp + 4], 0
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x431202
test cl, cl
jmp 0x43126e
mov ebx, dword [0x99504c]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
lea ebp, [esp + 0x30]
lea edi, [esp + 8]
xor eax, eax
call fcn.004690f7
lea ecx, [0x431290]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebp
movzx ecx, byte [esp + 0x3c]
mov byte [esp + 0x24], cl
lea edx, [esp + 4]
mov dword [esp + 0x28], edx
lea edx, [esp + 8]
mov dword [esp], edx
call fcn.00467970
movzx ecx, byte [esp + 0x3c]
test cl, cl
je 0x431275
call fcn.0043e3c0
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
add esp, 0x2c
ret
call fcn.00467a60
jmp fcn.004311c0
Function at 0x4318d0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43191c
sub esp, 8
mov eax, dword [esp + 0xc]
cmp eax, eax
setbe cl
mov edx, dword [esp + 0x10]
cmp edx, edx
setbe bl
cmp bl, cl
jne 0x431905
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
add esp, 8
ret
lea eax, [0x750164]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.004318d0
Function at 0x432560
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43273e
sub esp, 0x2c
mov eax, dword [esp + 0x30]
test byte [eax], al
lea ecx, [eax + 0x10]
mov dword [esp + 0x28], ecx
nop
mov dword [esp], ecx
call fcn.00402da0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
nop
cmp eax, ecx
jb 0x4326bc
shr eax, 9
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x30]
lea edx, [ecx + 8]
mov dword [esp + 0x24], edx
mov dword [esp], edx
call fcn.00402bb0
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jbe 0x432659
mov eax, dword [esp + 0x30]
add eax, 4
nop
nop
mov dword [esp], eax
call fcn.00402b40
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
lea eax, [eax + ecx*4]
mov dword [esp + 0x20], eax
nop
nop
mov dword [esp], eax
call fcn.00402b40
mov eax, dword [esp + 4]
test eax, eax
je 0x432659
mov dword [esp + 0x18], eax
lea ecx, [eax + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp], ecx
call fcn.00402b30
mov eax, dword [esp + 4]
test eax, eax
je 0x4326a6
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00402b30
cmp dword [esp + 4], 0x200
je 0x432690
nop
nop
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00402d60
lea eax, [0x995070]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.004327c0
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00402dc0
nop
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00402bf0
add esp, 0x2c
ret
lea eax, [0x74dacd]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00439230
lea eax, [0x74e811]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00439230
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
call fcn.0043af60
lea eax, [0x73afb3]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0043b4c0
lea eax, [0x73b8bd]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0043b4c0
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x747ef7]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00432560
Function at 0x433910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x433adf
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
nop
mov dword [esp], ecx
call fcn.0040a350
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x24]
movzx edx, byte [esp + 0x28]
test dl, dl
jne 0x433950
mov ecx, dword [eax + 0x60]
mov ebx, dword [esp + 0x24]
cmp ebx, ecx
jne 0x433aa0
test dl, dl
je 0x4339d0
mov ecx, dword [eax + 0x58]
mov ebx, dword [eax + 0x5c]
test ebx, ebx
sete bl
xchg ebp, ebx
setl bl
xchg ebp, ebx
test ecx, ecx
setbe cl
and ecx, ebx
or ebp, ecx
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x433ac8
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x433ac8
mov dword [eax + 0x58], 0xffffffff
mov dword [eax + 0x5c], 0xffffffff
mov dword [esp], eax
call fcn.00433170
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
call fcn.00433850
mov eax, dword [esp + 0xc]
movzx edx, byte [esp + 0x28]
mov ecx, eax
mov eax, dword [esp + 0x20]
jmp 0x4339d2
xor ecx, ecx
mov dword [esp + 0x14], ecx
movzx ebx, byte [esp + 0x29]
test bl, bl
je 0x433a58
mov ebx, dword [eax + 0x94]
mov ebp, dword [eax + 0x98]
test ebp, ebp
xchg ebp, ebx
setl bl
xchg ebp, ebx
xchg esi, ebx
sete bl
xchg esi, ebx
test ebx, ebx
setbe bl
and esi, ebx
or esi, ebp
xchg esi, eax
test al, al
xchg esi, eax
jne 0x433ab2
mov ebx, dword [eax + 0x78]
test ebx, ebx
jne 0x433a1d
test dl, dl
je 0x433ab2
mov dword [eax + 0x94], 0xffffffff
mov dword [eax + 0x98], 0xffffffff
mov dword [esp], eax
call fcn.00433170
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
call fcn.00433850
mov eax, dword [esp + 0xc]
jmp 0x433a5a
xor eax, eax
mov dword [esp + 0x10], eax
nop
nop
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
call fcn.0040a550
mov eax, dword [esp + 0x14]
test eax, eax
je 0x433a84
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433630
mov eax, dword [esp + 0x10]
test eax, eax
je 0x433a9c
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00433630
add esp, 0x1c
ret
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040a550
add esp, 0x1c
ret
lea eax, [0x7486a7]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00439230
lea eax, [0x747f3d]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00433910
Function at 0x433cf0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x433db4
sub esp, 0x1c
mov eax, dword [sym.imp.kernel32.dll_CreateIoCompletionPort]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0xffffffff
call fcn.00436730
mov eax, dword [esp + 0x14]
mov dword [0x937264], eax
test eax, eax
je 0x433d47
add esp, 0x1c
ret
call fcn.00469b00
mov eax, dword [esp]
mov dword [esp + 0x18], eax
call fcn.0043af60
lea eax, [0x74d0be]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0043b4c0
lea eax, [0x73a5bc]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.0043b7e0
call fcn.0043afc0
lea eax, [0x743c34]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00433cf0

Function at 0x433e30
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x433f1b
sub esp, 0x1c
lea eax, [0x994f84]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.00402b50
movzx eax, byte [esp + 0xc]
test al, al
jne 0x433e72
add esp, 0x1c
ret
mov eax, dword [0x937264]
mov ecx, dword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00436730
mov eax, dword [esp + 0x14]
test eax, eax
je 0x433eae
add esp, 0x1c
ret
call fcn.00469b00
mov eax, dword [esp]
mov dword [esp + 0x18], eax
call fcn.0043af60
lea eax, [0x7501a0]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0043b4c0
lea eax, [0x73a5bc]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.0043b7e0
call fcn.0043afc0
lea eax, [0x74e4ab]
mov dword [esp], eax
mov dword [esp + 4], 0x33
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00433e30
Function at 0x4342f0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x434396
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x18]
cmp ecx, 0x72
je 0x434318
cmp ecx, 0x77
jne 0x434341
mov edx, dword [esp + 0x1c]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 0x20], edx
mov eax, dword [eax + 0x14]
mov edx, dword [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00433460
add esp, 0x10
ret
mov dword [esp + 0xc], ecx
call fcn.0043af60
lea eax, [0x7501dc]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.0043b7e0
mov eax, dword [esp + 0xc]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043b600
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x741891]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.004342f0