joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dde0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40e077
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rax, rax
je 0x40e065
test rbx, rbx
je 0x40de2e
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40e050
nop dword [rax + rax]
cmp rbx, 0x2000
jbe 0x40de33
jmp 0x40e03f
mov ebx, 8
cmp rax, 0x10000
jae 0x40df05
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40de7e
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40de7e
test byte [rsi], al
add rsi, 0x11f0
jmp 0x40dea7
nop
nop
lea rax, [0x01295a20]
call fcn.0040b7a0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x01295a28]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
mov qword [rsi + 8], rdi
add rdi, rax
cmp rdi, 0x40000
ja 0x40ded9
cmp qword [rsi], 0
jne 0x40df17
mov eax, 0x40000
lea rbx, [0x0129ac60]
call fcn.00417340
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
jne 0x40dfc3
nop dword [rax]
jmp 0x40e012
mov rbx, rcx
call fcn.00417340
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
nop
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
mov dword [rdx + 0xd8], r10d
lea rdx, [rdi + r8]
nop dword [rax]
cmp r9d, 1
jne 0x40df58
cmp byte [r14 + 0xb1], 0
je 0x40df58
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdx
lea rdi, [0x01295a28]
cmp rsi, rdi
jne 0x40df86
nop
nop
lea rax, [0x01295a20]
call fcn.0040b9c0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
lea rsi, [0x0129ac60]
cmp rcx, rsi
je 0x40dfb6
mov rbx, rax
mov rax, rcx
call fcn.0042fa80
mov rbx, qword [rsp + 0x48]
neg rbx
lea rax, [0x0129ac60]
call fcn.0042fa80
mov rdx, qword [rsp + 0x30]
mov rax, rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rcx]
mov rax, qword [0x012956d0]
mov qword [rdx], rax
mov rdx, qword [rcx]
lea rsi, [0x012956d0]
lock cmpxchg qword [rsi], rdx
sete dl
test dl, dl
je 0x40dfc3
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x58]
jmp 0x40df17
lea rdx, [0x01295a28]
cmp rcx, rdx
je 0x40e02f
lea rax, [0x006d2ba3]
mov ebx, 0x1f
call fcn.00436bc0
nop
nop
lea rax, [0x01295a20]
call fcn.0040b9c0
jmp 0x40e01e
lea rax, [0x006d486d]
mov ebx, 0x23
call fcn.00436bc0
lea rax, [0x006d71ae]
mov ebx, 0x2a
nop dword [rax]
call fcn.00436bc0
lea rax, [0x006d060f]
mov ebx, 0x1a
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00467dc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040dde0
Function at 0x414300
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4144ef
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rbx
call fcn.00438500
call fcn.00438500
lea rax, [0x006cc1b0]
mov ebx, 0x11
call fcn.00438e00
mov rax, qword [rsp + 0x30]
call fcn.00438c60
call fcn.00438580
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x414417
nop
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x4144ca
nop dword [rax + rax]
call fcn.00438500
lea rax, [0x006cd2ec]
mov ebx, 0x14
call fcn.00438e00
call fcn.00438580
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.00438500
lea rax, [0x006ca7a7]
mov ebx, 0xd
call fcn.00438e00
mov rax, qword [rsp + 0x28]
call fcn.00438c60
lea rax, [0x006ca18f]
mov ebx, 0xc
nop
call fcn.00438e00
mov rax, qword [rsp + 0x30]
call fcn.00438c60
lea rax, [0x006ca19b]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00438e00
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.00438b00
call fcn.00438580
call fcn.00438500
nop dword [rax]
call fcn.00438760
call fcn.00438580
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x414450
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x006db56d]
mov ebx, 0x3e
call fcn.00436bc0
call fcn.00438500
lea rax, [0x006d24ab]
mov ebx, 0x1e
call fcn.00438e00
mov rax, qword [rsp + 0x60]
call fcn.00438c60
lea rax, [0x006c7f7a]
mov ebx, 1
nop dword [rax]
call fcn.00438e00
mov rax, qword [rsp + 0x38]
call fcn.00438c60
lea rax, [0x006c7f9c]
mov ebx, 2
nop dword [rax + rax]
call fcn.00438e00
call fcn.00438580
lea rax, [0x006c890d]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x38]
call fcn.0041f840
jmp 0x414434
call fcn.00438500
lea rax, [0x006cf891]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438e00
call fcn.00438580
jmp 0x41439b
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00414300
Function at 0x414b40
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rdx, rax
or rax, rbx
or rax, rcx
nop word [rax + rax]
test rax, 7
jne 0x414c4f
cmp byte [0x012959d4], 0
je 0x414b9e
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], rdx
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
mov qword [rsp + 0x48], rsi
test byte [rsi], al
mov rax, rdx
mov rbx, rcx
call fcn.004146a0
jmp 0x414ba8
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.004147c0
test rsi, rsi
je 0x414c45
mov rdx, qword [rsp + 0x40]
sub rsi, rdx
mov r8, qword [rsp + 0x68]
add rsi, r8
mov r9, qword [rsp + 0x48]
mov r10, qword [r9 + 0x1260]
mov rsi, qword [rsi]
mov qword [r10], 0
mov qword [r10 + 8], rsi
mov rsi, qword [r9 + 0x1260]
add rsi, 0x10
mov qword [r9 + 0x1260], rsi
cmp qword [r9 + 0x1268], rsi
jne 0x414ba8
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor eax, eax
xor ebx, ebx
call fcn.0042fd40
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x48]
nop dword [rax + rax]
jmp 0x414ba8
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x006d64c4]
mov ebx, 0x28
nop dword [rax + rax]
call fcn.00436bc0
nop
int3
Function at 0x416360
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416595
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x416587
mov rcx, qword [rax + rdx*8 + 0x28]
movzx esi, word [rcx + 0x60]
nop word [rax + rax]
nop
cmp qword [rcx + 0x38], rsi
jne 0x416576
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdx
lea rsi, [0x01296100]
nop dword [rax + rax]
cmp rcx, rsi
je 0x41649a
mov esi, dword [0x01267918]
add esi, 3
cmp dword [rcx + 0x58], esi
jne 0x416565
mov byte [rsp + 0x48], bl
mov qword [rsp + 0x20], rcx
lea rsi, [rdx + rdx*2]
shl rsi, 6
lea rdi, [0x01267c10]
lea rax, [rsi + rdi]
mov rbx, rcx
call fcn.00416dc0
lea rax, [0x01299e60]
call fcn.0042fb40
test byte [rax], al
mov rcx, qword [rsp + 0x20]
movzx edx, word [rcx + 0x60]
movzx esi, word [rcx + 0x66]
sub rdx, rsi
movzx esi, byte [rsp + 0x48]
mov edi, esi
shr sil, 1
movsx rsi, sil
cmp rsi, 0x44
jae 0x416556
mov qword [rsp + 0x18], rdx
lea rbx, [rax + rsi*8]
lea rbx, [rbx + 0x48]
lock xadd qword [rbx], rdx
cmp dil, 5
jne 0x416464
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rdx + 0x20]
lock xadd qword [rax + 0x30], rbx
mov qword [rdx + 0x20], 0
lea rax, [0x01299e60]
call fcn.0042fc20
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x68]
mov rbx, qword [rsp + 0x18]
imul rbx, rdx
nop
lea rdx, [0x01296590]
lock xadd qword [rdx], rbx
mov word [rcx + 0x66], 0
mov rdx, qword [rsp + 0x28]
lea rcx, [rdx + rdx*2]
shl rcx, 6
lea rbx, [0x01267c10]
lea rax, [rcx + rbx]
call fcn.00416a60
test rax, rax
je 0x416545
movzx edx, word [rax + 0x60]
nop
cmp qword [rax + 0x38], rdx
je 0x416531
mov qword [rsp + 0x20], rax
mov edx, dword [0x01267918]
add edx, 3
mov dword [rax + 0x58], edx
movzx edx, word [rax + 0x60]
mov word [rax + 0x66], dx
movzx edx, word [rax + 0x60]
mov rsi, qword [rax + 0x68]
imul rdx, rsi
mov rbx, qword [rax + 0x20]
shl rbx, 0xd
sub rbx, rdx
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx + 8]
lea rax, [0x01296480]
call fcn.00420da0
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 8], 0
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov qword [rdx + rsi*8 + 0x28], rdi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006ce7d1]
mov ebx, 0x16
nop dword [rax]
call fcn.00436bc0
lea rax, [0x006cab69]
mov ebx, 0xd
call fcn.00436bc0
mov rax, rsi
mov ecx, 0x44
nop
call fcn.004659a0
lea rax, [0x006ce409]
mov ebx, 0x16
call fcn.00436bc0
lea rax, [0x006d67e4]
mov ebx, 0x28
call fcn.00436bc0
mov rax, rdx
mov ecx, 0x88
call fcn.004659a0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop
call fcn.00463340
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00416360
Function at 0x416dc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416e86
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x416e6f
mov ecx, dword [0x01267918]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x416e02
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x416e09
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x416e4f
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
test rdx, rdx
jle 0x416e35
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.0042f4a0
jmp 0x416e65
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
call fcn.0042f4a0
jmp 0x416e65
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
nop dword [rax + rax]
call fcn.004241a0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x006d5112]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416dc0
Function at 0x417140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4172e6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x4171fa
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x4171ed
lea rsi, [0x01267970]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x114c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and ecx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x4171dd
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.004659c0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.00438500
call fcn.00438500
lea rax, [0x006dabea]
mov ebx, 0x39
nop
call fcn.00438e00
mov rax, qword [rsp + 0x40]
call fcn.00438c60
call fcn.00438760
call fcn.00438580
call fcn.00438500
lea rax, [0x006cf740]
mov ebx, 0x18
call fcn.00438e00
mov rax, qword [rsp + 0x28]
call fcn.00438c60
lea rax, [0x006c7f7a]
mov ebx, 1
call fcn.00438e00
mov rax, qword [rsp + 0x20]
call fcn.00438c60
lea rax, [0x006c7f9c]
mov ebx, 2
call fcn.00438e00
call fcn.00438580
lea rax, [0x006c8376]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.0041f840
lea rax, [0x006c820a]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.0041f840
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x006d28da]
mov ebx, 0x1f
nop dword [rax]
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.00463340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00417140
Function at 0x4175c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417766
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433dc0
xorps xmm15, xmm15
mov r14, qword [0x01295760]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41762b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417640
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x417665
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417679
cmp rbx, 0x1000
jae 0x417635
nop dword [rax]
jmp 0x4176e9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41768d
xor edx, edx
jmp 0x4176e0
mov rcx, qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433dc0
xorps xmm15, xmm15
mov r14, qword [0x01295760]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41766f
jmp 0x417654
call fcn.00466f00
xorps xmm15, xmm15
mov r14, qword [0x01295760]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438500
lea rax, [0x006cf728]
mov ebx, 0x18
call fcn.00438e00
mov rax, qword [rsp + 0x38]
call fcn.00438b00
lea rax, [0x006cf878]
mov ebx, 0x19
call fcn.00438e00
mov rax, qword [rsp + 0x30]
nop
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006d3a79]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004175c0
Function at 0x4177a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4179ca
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433e40
xorps xmm15, xmm15
mov r14, qword [0x01295760]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417819
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41782c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417850
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x417864
cmp rbx, 0x1000
jae 0x417823
jmp 0x4178e5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417876
xor esi, esi
jmp 0x4178d6
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433e40
xorps xmm15, xmm15
mov r14, qword [0x01295760]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41785a
nop
jmp 0x417842
call fcn.00466f00
xorps xmm15, xmm15
mov r14, qword [0x01295760]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417965
call fcn.00438500
lea rax, [0x006cfeb8]
mov ebx, 0x19
call fcn.00438e00
mov rax, qword [rsp + 0x68]
call fcn.00438b00
lea rax, [0x006cf878]
mov ebx, 0x19
call fcn.00438e00
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006cab69]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00436bc0
cmp eax, 0x5af
je 0x417908
call fcn.00438500
lea rax, [0x006cfeb8]
mov ebx, 0x19
nop dword [rax]
call fcn.00438e00
mov rax, qword [rsp + 0x38]
call fcn.00438b00
lea rax, [0x006cf878]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438e00
mov eax, dword [rsp + 0x34]
call fcn.00438b00
call fcn.00438760
call fcn.00438580
lea rax, [0x006d2bc2]
mov ebx, 0x1f
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004177a0
Function at 0x418ce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418dee
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rsi, qword [rax]
nop dword [rax + rax]
test rsi, rsi
je 0x418dc1
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x418d48
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x418d3b
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.00466040
mov rdi, qword [rsp + 0x18]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x418d78
mov edx, dword [rax + 0x2c]
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov rax, rdx
call fcn.0040dcc0
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov esi, dword [rdx + 0x2c]
mov dword [rdx + 0x28], esi
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x418da0
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00438500
lea rax, [0x006d9de0]
mov ebx, 0x34
call fcn.00438e00
call fcn.00438580
lea rax, [0x006ceff3]
mov ebx, 0x17
call fcn.00436bc0
nop
mov qword [rsp + 8], rax
call fcn.00463340
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00418ce0
Function at 0x41baa0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
cmp rdi, 0x989680
jb 0x41badf
mov rdx, rax
movabs rax, 0x8637bd05af6c69b6
mov rsi, rdx
mul rdi
shr rdx, 0x13
lea rdi, [rbx - 1]
mov rax, rdi
jmp 0x41bc17
shr rdi, 1
mov rdx, rax
movabs rax, 0x83126e978d4fdf3c
mov rsi, rdx
mul rdi
shr rdx, 8
test rdx, rdx
je 0x41bb05
mov eax, 3
jmp 0x41bb53
test rbx, rbx
jbe 0x41bb31
mov byte [rsi], 0x30
cmp rcx, 1
jb 0x41bb25
mov rax, rsi
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 1
xor edx, edx
call fcn.00465a20
xor eax, eax
mov rcx, rax
call fcn.004659a0
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mul rdx
shr rdx, 3
lea rax, [rdi - 1]
cmp rdx, 0x64
jae 0x41bb3b
lea rdi, [rbx - 1]
mov r8, rbx
sub rbx, rax
lea r9, [rbx - 1]
jmp 0x41bb6c
mov rdi, rax
cmp rdx, 0xa
jae 0x41bb77
cmp rdi, r9
jl 0x41bbc0
movabs rax, 0xcccccccccccccccd
mov rbx, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub rbx, r10
cmp r8, rdi
jbe 0x41bc06
lea r10, [rbx + 0x30]
mov byte [rsi + rdi], r10b
lea rax, [rdi - 1]
cmp rax, r9
jne 0x41bb69
cmp r8, rax
jbe 0x41bbfe
mov byte [rdi + rsi - 1], 0x2e
lea rax, [rdi - 2]
jmp 0x41bb69
cmp r8, rdi
jbe 0x41bbf3
add rdx, 0x30
mov byte [rsi + rdi], dl
sub rcx, rdi
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdi
lea rax, [rcx + rsi]
sub r8, rdi
mov rbx, r8
mov rcx, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdi
mov rcx, r8
call fcn.004659a0
mov rcx, r8
call fcn.004659a0
mov rax, rdi
mov rcx, r8
call fcn.004659a0
mov rdi, rax
mov rax, r8
cmp rdx, 0xa
jae 0x41bc25
nop dword [rax]
cmp rdi, rax
jl 0x41bc70
mov r8, rax
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, rdi
jbe 0x41bcb4
add r9, 0x30
mov byte [rsi + rdi], r9b
lea rax, [rdi - 1]
cmp rax, r8
jne 0x41bc11
nop dword [rax]
cmp rbx, rax
jbe 0x41bcac
mov byte [rdi + rsi - 1], 0x2e
lea rax, [rdi - 2]
jmp 0x41bc11
cmp rbx, rdi
jbe 0x41bca1
add rdx, 0x30
mov byte [rsi + rdi], dl
sub rcx, rdi
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdi
lea rax, [rsi + rcx]
sub rbx, rdi
mov rcx, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
mov rax, rdi
mov rcx, rbx
call fcn.004659a0
mov rcx, rbx
call fcn.004659a0
mov rax, rdi
mov rcx, rbx
call fcn.004659a0
nop