joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b980
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43bb58
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x60], al
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x00918654]
test edx, edx
je 0x43b9d4
xor eax, eax
nop dword [rax]
call fcn.00430a00
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.0043f4a0
nop
nop
lea rax, [0x008c5058]
nop dword [rax]
call fcn.0040b860
mov ecx, dword [0x00918648]
mov edx, dword [0x00918660]
test edx, edx
je 0x43ba02
mov dword [0x00918660], 0
nop
jmp 0x43ba04
mov edx, ecx
mov eax, edx
call fcn.00442ce0
mov qword [rsp + 0x40], rax
nop
nop
xor ecx, ecx
lea rdx, [0x008c5128]
xchg byte [rdx], cl
mov cl, byte [0x008c5138]
test cl, cl
je 0x43ba45
nop
nop
xor ecx, ecx
lea rdx, [0x008c5138]
xchg byte [rdx], cl
lea rax, [0x008c5140]
nop dword [rax + rax]
call fcn.0040bb60
nop
nop
lea rax, [0x008c5058]
call fcn.0040ba80
mov rcx, qword [rsp + 0x40]
jmp 0x43ba60
mov rcx, qword [rsp + 0x48]
nop
test rcx, rcx
je 0x43baba
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rax, rax
je 0x43baa7
nop
mov qword [rcx + 0x38], 0
cmp qword [rax + 0xa8], 0
jne 0x43bb46
nop
mov qword [rax + 0xa8], rcx
add rax, 0x118
nop dword [rax]
call fcn.0040bb60
jmp 0x43ba5a
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
call fcn.0043cc80
jmp 0x43ba5a
nop
nop dword [rax + rax]
call fcn.00467480
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x43bb05
nop
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
nop dword [rax]
call fcn.00455480
call fcn.0043d840
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
nop
cmp ecx, 1
jne 0x43bb37
cmp byte [r14 + 0xb1], 0
je 0x43bb37
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x006c5bd0]
mov ebx, 0x25
call fcn.00436a00
nop
mov byte [rsp + 8], al
nop dword [rax]
call fcn.00463440
movzx eax, byte [rsp + 8]
jmp fcn.0043b980
Function at 0x43cc80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43cdec
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043c420
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43cda1
mov rcx, qword [rdx + 0x30]
nop word [rax + rax]
test rcx, rcx
je 0x43cda1
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x238], 0
jne 0x43cd06
cmp byte [rcx + 0xe8], 0
nop
je 0x43cda1
nop
nop
lea rax, [0x00918c60]
call fcn.0040b860
cmp dword [0x00918c80], 0
nop dword [rax + rax]
je 0x43cdda
mov rcx, qword [0x00918c68]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x128], rcx
nop
mov qword [0x00918c68], rdx
cmp byte [0x00918c70], 0
je 0x43cd5d
mov byte [0x00918c70], 0
lea rax, [0x00918c78]
call fcn.0040bb60
nop
nop
lea rax, [0x00918c60]
call fcn.0040ba80
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43cd97
cmp byte [r14 + 0xb1], 0
je 0x43cd97
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043ce20
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43cdd0
cmp byte [r14 + 0xb1], 0
je 0x43cdd0
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006c776c]
mov ebx, 0x2a
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043cc80
Function at 0x43d260
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43d4db
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x58], bl
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
nop
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rcx
nop
lea rax, [0x008c5058]
nop
call fcn.0040b860
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x43d2b4
mov rax, rcx
jmp 0x43d2d8
movzx ecx, byte [rsp + 0x58]
nop dword [rax]
test cl, cl
jne 0x43d4c9
xor eax, eax
call fcn.00445360
test rax, rax
je 0x43d3d3
nop
mov rcx, qword [0x008c5060]
test rcx, rcx
je 0x43d2fc
mov rdx, qword [rcx + 0x128]
mov qword [0x008c5060], rdx
dec dword [0x008c5068]
test rcx, rcx
mov qword [rsp + 0x28], rax
jne 0x43d389
call fcn.0043a520
mov qword [rsp + 0x18], rax
movzx ecx, byte [rsp + 0x58]
movzx ecx, cl
test rcx, rcx
mov ecx, 0
lea rdx, [0x006e9948]
cmovne rcx, rdx
mov qword [rsp + 0x30], rcx
nop
nop
lea rax, [0x008c5058]
call fcn.0040ba80
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
call fcn.0043cc80
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43d37f
cmp byte [r14 + 0xb1], 0
je 0x43d37f
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rcx
nop
nop
lea rax, [0x008c5058]
call fcn.0040ba80
mov rax, qword [rsp + 0x38]
cmp byte [rax + 0xe4], 0
jne 0x43d4b8
cmp qword [rax + 0xa8], 0
jne 0x43d4a7
movzx ecx, byte [rsp + 0x58]
test cl, cl
je 0x43d3cf
mov rdx, qword [rsp + 0x28]
jmp 0x43d46e
xor ecx, ecx
jmp 0x43d41b
nop
nop
lea rax, [0x008c5058]
nop dword [rax]
call fcn.0040ba80
nop
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43d411
cmp byte [r14 + 0xb1], 0
je 0x43d411
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov byte [rax + 0xe4], cl
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0xa8], rcx
add rax, 0x118
call fcn.0040bb60
nop
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43d464
cmp byte [r14 + 0xb1], 0
je 0x43d464
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov esi, dword [rdx + 0x190]
mov edi, dword [rdx + 0x194]
mov r8, qword [rdx + 0x998]
mov r9d, dword [rdx + 0x194]
cmp r9d, edi
jne 0x43d46e
cmp edi, esi
jne 0x43d496
test r8, r8
je 0x43d41b
lea rax, [0x006c03f7]
mov ebx, 0x19
call fcn.00436a00
lea rax, [0x006bbb1d]
mov ebx, 0xf
call fcn.00436a00
lea rax, [0x006be413]
mov ebx, 0x15
call fcn.00436a00
lea rax, [0x006c54a0]
mov ebx, 0x24
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00463440
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0043d260
Function at 0x43d9a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43dbdd
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x130]
test rdx, rdx
je 0x43dbcb
mov rdx, qword [rdx + 0xe8]
cmp rdx, rcx
jne 0x43dbcb
mov qword [rsp + 0x30], r14
cmp qword [rcx + 0xa0], 0
je 0x43d9f5
call fcn.004436e0
call fcn.0043d500
mov eax, 1
call fcn.00443840
nop
call fcn.0043bd60
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x130]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43da54
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.00443560
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov dword [rsp + 0x1c], ebx
call fcn.00438340
lea rax, [0x006c7d6d]
mov ebx, 0x2b
call fcn.00438c40
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.00438940
lea rax, [0x006c4f24]
mov ebx, 0x24
call fcn.00438c40
call fcn.004383c0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x130]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
nop
call fcn.00438340
lea rax, [0x006bcd0a]
mov ebx, 0x12
call fcn.00438c40
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00438bc0
lea rax, [0x006b9076]
mov ebx, 7
call fcn.00438c40
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438940
lea rax, [0x006bce89]
mov ebx, 0x13
call fcn.00438c40
mov eax, dword [rsp + 0x18]
mov eax, eax
nop dword [rax]
call fcn.00438940
call fcn.004385a0
call fcn.004383c0
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.00438340
lea rax, [0x006bcd1c]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.00438c40
mov rax, qword [rsp + 0x28]
call fcn.00438bc0
lea rax, [0x006b9076]
mov ebx, 7
nop dword [rax + rax]
call fcn.00438c40
mov rax, qword [rsp + 0x20]
call fcn.00438940
lea rax, [0x006bce76]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00438c40
mov eax, dword [rsp + 0x14]
mov eax, eax
call fcn.00438940
call fcn.004385a0
call fcn.004383c0
lea rax, [0x006c0410]
mov ebx, 0x19
call fcn.00436a00
lea rax, [0x006c40ae]
mov ebx, 0x21
call fcn.00436a00
nop
nop dword [rax]
call fcn.00463440
jmp fcn.0043d9a0
Function at 0x43f780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43f9ba
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jne 0x43f9a8
mov qword [rsp + 0x18], rcx
cmp qword [rcx + 0x130], 0
je 0x43f7d8
call fcn.0043d9a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x130]
xor ebx, ebx
mov rax, rcx
call fcn.0043ddc0
mov rcx, qword [rsp + 0x18]
cmp byte [rcx + 0xe8], 0
nop
je 0x43f7f1
jmp 0x43f997
call fcn.0043dc00
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0xa0]
test byte [rdx], al
mov byte [rdx + 0x22c0], 0
cmp byte [rcx + 0xe4], 0
je 0x43f82c
cmp qword [rdx + 0x998], 0
jne 0x43f986
mov esi, dword [rdx + 0x190]
nop
cmp dword [rdx + 0x194], esi
jne 0x43f986
call fcn.0043df40
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x17], bl
mov byte [rsp + 0x16], cl
mov rdx, qword [rsp + 0x18]
cmp byte [rdx + 0xe4], 0
je 0x43f865
call fcn.0043f420
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
cmp byte [0x008c50c0], 0
jne 0x43f872
xor esi, esi
jmp 0x43f895
mov ebx, 1
call fcn.0045ab00
xor eax, 1
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
mov esi, eax
mov rax, qword [rsp + 0x20]
test sil, sil
je 0x43f951
nop
nop
lea rax, [0x008c5058]
call fcn.0040b860
cmp byte [0x008c50c0], 0
jne 0x43f8bc
mov eax, 1
jmp 0x43f8cb
mov rax, qword [rsp + 0x20]
mov ebx, 1
call fcn.0045ab00
test al, al
jne 0x43f92f
nop
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0xa0], 0
mov rdx, qword [0x008c50d0]
test rdx, rdx
je 0x43f8f8
mov rbx, rcx
mov qword [rdx + 0xa0], rcx
jmp 0x43f906
nop
mov rdx, rcx
mov qword [0x008c50c8], rcx
mov rbx, rdx
nop
mov qword [0x008c50d0], rbx
inc dword [0x008c50d8]
nop
nop
lea rax, [0x008c5058]
nop dword [rax]
call fcn.0040ba80
mov rcx, qword [rsp + 0x18]
jmp 0x43f7f1
nop
nop
lea rax, [0x008c5058]
call fcn.0040ba80
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
test cl, cl
je 0x43f969
call fcn.0043d840
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x17]
cmp qword [rax + 0xe8], 0
jne 0x43f7e7
call fcn.0043ddc0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006c4763]
mov ebx, 0x22
call fcn.00436a00
lea rax, [0x006bc1a1]
mov ebx, 0x10
call fcn.00436a00
lea rax, [0x006bf4b1]
mov ebx, 0x17
call fcn.00436a00
nop
call fcn.00463440
nop
jmp fcn.0043f780
Function at 0x440160
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4403cc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
cmp byte [0x008ca7d0], 0
je 0x440197
mov eax, 0x14
xor ebx, ebx
call fcn.00456ae0
mov rax, qword [rsp + 0x48]
nop
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
jne 0x4402a5
cmp byte [rax + 0xb4], 0
je 0x4401dc
mov rcx, qword [rax + 0x40]
mov rax, rcx
nop dword [rax + rax]
call fcn.00451360
test rax, rax
je 0x44028f
movzx edx, byte [rax + 0x29]
test dl, 2
jne 0x440234
mov rax, qword [rsp + 0x48]
mov ebx, 2
mov ecx, 0x1009
call fcn.0043b300
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop
nop
xor esi, esi
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
nop
xor esi, esi
mov qword [rdx + 0x90], rsi
mov rax, qword [rsp + 0x48]
mov ebx, 0x1009
mov ecx, 9
nop dword [rax + rax]
call fcn.0043aa20
call fcn.0043f780
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00451b00
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.00438340
lea rax, [0x006c5b86]
mov ebx, 0x25
call fcn.00438c40
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
call fcn.00438c40
lea rax, [0x006bc81e]
mov ebx, 0x12
call fcn.00438c40
call fcn.004383c0
lea rax, [0x006bba78]
mov ebx, 0xf
call fcn.00436a00
lea rax, [0x006be2ed]
mov ebx, 0x15
nop dword [rax + rax]
call fcn.00436a00
nop
mov qword [rsp + 0x28], r14
nop
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00438340
lea rax, [0x006bcd0a]
mov ebx, 0x12
call fcn.00438c40
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.00438bc0
lea rax, [0x006b9076]
mov ebx, 7
call fcn.00438c40
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00438940
lea rax, [0x006bce89]
mov ebx, 0x13
call fcn.00438c40
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.00438940
call fcn.004385a0
call fcn.004383c0
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x10], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00438340
lea rax, [0x006bcd1c]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.00438c40
mov rax, qword [rsp + 0x28]
call fcn.00438bc0
lea rax, [0x006b9076]
mov ebx, 7
nop dword [rax + rax]
call fcn.00438c40
mov rax, qword [rsp + 0x18]
call fcn.00438940
lea rax, [0x006bce76]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00438c40
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.00438940
call fcn.004385a0
call fcn.004383c0
lea rax, [0x006ba9b4]
mov ebx, 0xc
call fcn.00436a00
nop
mov qword [rsp + 8], rax
call fcn.00467ec0
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.00440160
Function at 0x4438a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x443ba6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp byte [0x009185fd], 0
nop
jne 0x443a79
cmp byte [0x009185fb], 0
jne 0x443a79
mov ecx, dword [0x00918664]
nop dword [rax]
test ecx, ecx
ja 0x443a6f
cmp byte [0x009185fc], 0
je 0x4438f5
xor ecx, ecx
jmp 0x443925
cmp byte [0x009185f6], 0
jne 0x443902
xor ecx, ecx
jmp 0x443925
mov eax, 1
call fcn.0043cb80
cmp dword [0x0091862c], 0
seta cl
nop
nop
lea rdx, [0x00918718]
xchg qword [rdx], rax
movzx ecx, cl
mov edx, dword [0x008c5068]
mov rbx, qword [0x008c5070]
sub rbx, qword [0x008c5080]
mov rsi, rbx
sub ebx, edx
mov edi, dword [0x008c506c]
sub ebx, edi
mov r8d, dword [0x008c507c]
sub ebx, r8d
cmp ecx, ebx
jl 0x443a65
nop dword [rax + rax]
test ebx, ebx
jl 0x443af0
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00443bc0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x30]
call fcn.0043a020
cmp qword [rsp + 0x20], 0
jne 0x4439be
nop
nop
lea rax, [0x008c5058]
call fcn.0040ba80
lea rax, [0x006cab37]
mov ebx, 0x36
call fcn.00436b00
cmp qword [0x00918720], 0
je 0x4439dc
call fcn.00454d80
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jl 0x4439f1
mov rcx, qword [0x008c3e10]
mov rdx, qword [0x008c3e18]
xor eax, eax
jmp 0x443aa8
mov qword [0x00918720], rax
call fcn.00445360
nop dword [rax]
test rax, rax
je 0x443a94
nop
mov rcx, qword [0x008c5060]
test rcx, rcx
je 0x443a2d
mov rdx, qword [rcx + 0x128]
mov qword [0x008c5060], rdx
dec dword [0x008c5068]
test rcx, rcx
je 0x443a83
nop
mov edx, 1
lea rbx, [0x008c509c]
lock xadd dword [rbx], edx
mov byte [rcx + 0xe4], 1
nop
mov qword [rcx + 0xa8], rax
lea rax, [rcx + 0x118]
call fcn.0040bb60
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006c0028]
mov ebx, 0x19
call fcn.00436a00
lea rax, [0x006c0041]
mov ebx, 0x19
call fcn.00436a00
inc rax
cmp rax, rdx
jge 0x443ac7
mov rbx, qword [rcx + rax*8]
test byte [rbx], al
cmp qword [rbx + 0x2288], 0
je 0x443aa5
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
nop
nop
lea rax, [0x008c5058]
call fcn.0040ba80
lea rax, [0x006c570b]
mov ebx, 0x25
call fcn.00436b00
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x14], r8d
call fcn.00438340
lea rax, [0x006c1375]
mov ebx, 0x1b
call fcn.00438c40
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
nop
call fcn.00438a40
lea rax, [0x006bb190]
mov ebx, 0xe
call fcn.00438c40
mov eax, dword [rsp + 0x18]
movsxd rax, eax
nop dword [rax]
call fcn.00438a40
lea rax, [0x006b93d9]
mov ebx, 8
call fcn.00438c40
mov rax, qword [rsp + 0x28]
movsxd rax, eax
nop
call fcn.00438a40
lea rax, [0x006b9045]
mov ebx, 7
call fcn.00438c40
mov eax, dword [rsp + 0x14]
movsxd rax, eax
nop dword [rax]
call fcn.00438a40
call fcn.004385a0
call fcn.004383c0
lea rax, [0x006c27f6]
mov ebx, 0x1e
nop dword [rax + rax]
call fcn.00436a00
nop
call fcn.00463440
jmp fcn.004438a0
Function at 0x4451c0
Capabilities:
Encode data using base64
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44532a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4451d8
cmp edx, ecx
jne 0x445318
nop dword [rax]
test rsi, rsi
jne 0x445318
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x445234
nop
call fcn.00467480
xorps xmm15, xmm15
mov r14, qword [0x00918820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004450c0
mov rcx, qword [0x008c3e98]
mov rdx, qword [0x008c3e90]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x445313
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x445308
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x008c5090]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x008c5090], rbx
nop
mov edx, 1
lea rsi, [0x008c5098]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x4452f7
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006c6d2e]
mov ebx, 0x28
call fcn.00436a00
mov rcx, rax
mov rax, rsi
call fcn.00465aa0
call fcn.00434ec0
lea rax, [0x006c4c66]
mov ebx, 0x23
call fcn.00436a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004451c0
Function at 0x449e20
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], r14
mov edx, dword [0x00918664]
test edx, edx
je 0x449e60
mov qword [rsp + 0x60], rax
mov eax, 2
call fcn.004327a0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
nop
mov ecx, 1
lea rdx, [0x00918664]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x40]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x38], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x30], rsi
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbx + 0xf8]
mov qword [rsp + 0x20], rdi
call fcn.00438340
lea rax, [0x006b9dbf]
mov ebx, 0xa
call fcn.00438c40
mov rax, qword [rsp + 0x38]
call fcn.00438aa0
call fcn.00438560
mov rax, qword [rsp + 0x30]
call fcn.00438aa0
nop
call fcn.00438560
mov rax, qword [rsp + 0x28]
call fcn.00438aa0
call fcn.00438560
mov rax, qword [rsp + 0x20]
call fcn.00438aa0
nop
call fcn.004385a0
call fcn.004383c0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
call fcn.00438340
lea rax, [0x006b881d]
mov ebx, 3
call fcn.00438c40
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438aa0
call fcn.004385a0
call fcn.004383c0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe8], 0
nop
je 0x449fb7
mov rdx, qword [rsp + 0x70]
cmp qword [rcx], rdx
jne 0x449fb2
cmp qword [rcx + 0x90], 0
je 0x449fad
cmp byte [0x009185fc], 0
je 0x449fa0
nop
call fcn.00438340
lea rax, [0x006c8c4a]
mov ebx, 0x2e
call fcn.00438c40
call fcn.004383c0
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x90]
jmp 0x449fbc
mov rcx, rdx
jmp 0x449fbc
mov rcx, rdx
jmp 0x449fbc
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x48], rcx
call fcn.00438340
call fcn.004385a0
call fcn.004383c0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 2
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov qword [rax + 0x98], rdi
mov eax, dword [0x008833c8]
mov rdx, qword [r14 + 0x30]
mov ebx, dword [rdx + 0xc4]
movzx edx, byte [rdx + 0xf9]
test dl, dl
jne 0x44a021
shr eax, 2
cmp ebx, 2
mov esi, 2
cmovae eax, esi
mov edx, eax
test edx, edx
jle 0x44a059
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
mov rdi, rcx
xor ecx, ecx
nop dword [rax]
call fcn.00459720
mov rax, qword [rsp + 0x48]
call fcn.0045a6a0
mov rax, qword [rsp + 0x68]
call fcn.004079c0
mov eax, 2
nop
call fcn.004327a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x44e1c0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x44e2e6
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
lea rdi, [rsp + 0x20]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d4b
mov rbp, qword [rbp]
lea rcx, [0x00699300]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + 0x17]
test dl, 0x40
jne 0x44e2d0
lea rdx, [0x00918a70]
lea rax, [0x0088d440]
jmp 0x44e252
mov rax, qword [rax + 0x230]
test rax, rax
je 0x44e274
nop word [rax + rax]
cmp qword [rax + 0x140], rdx
ja 0x44e24b
cmp qword [rax + 0x110], rdx
jbe 0x44e24b
jmp 0x44e276
xor eax, eax
test rax, rax
je 0x44e2bf
mov rdx, qword [rcx]
lea rbx, [rdx + 7]
and rbx, 0xfffffffffffffff8
neg ebx
mov rsi, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rax + 0x138]
mov dword [0x00918a70], ebx
mov dword [0x00918a74], edx
mov dword [0x00918a78], esi
mov dword [0x00918a7c], ecx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
lea rax, [0x006c7b69]
mov ebx, 0x2b
call fcn.00436a00
lea rax, [0x006cb9d9]
mov ebx, 0x3d
nop dword [rax]
call fcn.00436a00
nop
call fcn.00463440
jmp fcn.0044e1c0