joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b070
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x41b25c
sub esp, 0xc
mov eax, dword [0x994f54]
test eax, eax
jne 0x41b245
nop
nop
lea eax, [0x974f00]
mov dword [esp], eax
call fcn.0040a350
add dword [0x974fb0], 2
nop
nop
lea eax, [0x96f0f4]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00402d70
nop
lea eax, [0x974fc8]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00402dc0
mov eax, dword [0x975024]
mov ecx, dword [0x975028]
mov edx, dword [0x975020]
mov dword [0x975030], eax
mov dword [0x975034], ecx
mov eax, dword [0x995310]
test eax, eax
je 0x41b11b
call fcn.00468e70
mov dword [edi], edx
mov eax, dword [0x97502c]
mov dword [edi + 4], eax
mov dword [0x97502c], edx
nop
lea eax, [0x974fe8]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00402dc0
nop
lea eax, [0x974ff0]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00402bf0
nop
nop
lea eax, [0x974f00]
mov dword [esp], eax
call fcn.0040a550
nop
lea eax, [0x96f0f8]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00402d70
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x41b1b4
nop
nop
lea eax, [0x974f00]
mov dword [esp], eax
call fcn.0040a350
xorps xmm0, xmm0
movsd qword [0x974fe0], xmm0
nop
nop
lea eax, [0x974f00]
mov dword [esp], eax
call fcn.0040a550
jmp 0x41b20b
nop
nop
lea eax, [0x96f0e0]
mov dword [esp], eax
call fcn.0040a350
movzx eax, byte [0x96f0e8]
test al, al
je 0x41b1f1
mov byte [0x96f0e8], 0
mov eax, dword [0x96f0e4]
mov dword [esp], eax
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.0043d510
nop
nop
lea eax, [0x96f0e0]
mov dword [esp], eax
call fcn.0040a550
add esp, 0xc
ret
inc dword [0x96f0f0]
call fcn.00426420
cmp dword [esp], 0xffffffff
jne 0x41b205
call fcn.00428630
mov byte [esp], 0
call fcn.00428740
movzx eax, byte [esp + 4]
test al, al
jne 0x41b21b
nop
lea eax, [0x994f6c]
mov dword [esp], eax
call fcn.0042fe30
call fcn.004303c0
add esp, 0xc
ret
lea eax, [0x74acfa]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00439230
nop
call fcn.004663e0
jmp fcn.0041b070

Function at 0x41b930
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41b9d5
sub esp, 0x10
mov eax, dword [esp + 0x14]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.00402b50
movzx eax, byte [esp + 0xc]
test al, al
je 0x41b9be
movzx eax, byte [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp byte [ecx + 0x20], al
je 0x41b9a8
mov dword [esp], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.0041bb80
movzx eax, byte [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov byte [ecx + 0x20], al
mov byte [ecx + 0x21], 1
add esp, 0x10
ret
lea eax, [0x74c3b9]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.00439230
lea eax, [0x74d031]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.0041b930
Function at 0x41b9e0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41bace
sub esp, 0x18
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 0x21]
test cl, cl
je 0x41bab7
lea ecx, [eax + 0x40]
mov dword [esp + 0x14], ecx
mov dword [esp], ecx
call fcn.00402c20
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x24]
cmp edx, ecx
sete bl
xchg ebp, ebx
setg bl
xchg ebp, ebx
mov esi, dword [esp + 0x20]
cmp esi, eax
xchg edi, ebx
setae bl
xchg edi, ebx
and ebx, edi
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x41ba8a
mov ebx, dword [esp + 0x1c]
mov ebp, dword [ebx + 0x4c]
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov edi, ebp
sar ebp, 0x1f
sub esi, eax
sbb edx, ecx
mov eax, esi
mov ecx, edx
mul edi
imul esi, ebp
imul edi, ecx
lea ecx, [edi + edx]
add ecx, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
call fcn.0041bf70
mov esi, dword [esp + 0x20]
nop
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call fcn.00402be0
mov eax, dword [esp + 0x1c]
mov byte [eax + 0x21], 0
mov dword [esp], eax
call fcn.0041c150
add esp, 0x18
ret
lea eax, [0x74d060]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.0041b9e0
Function at 0x41c1b0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41c2e4
sub esp, 0x14
mov eax, dword [esp + 0x18]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.00402b50
movzx eax, byte [esp + 0xc]
test al, al
je 0x41c2cd
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
call fcn.0041bb80
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x4c], eax
mov edx, eax
sar edx, 0x1f
mov ebx, 0x3b9aca00
mov ebp, edx
mul ebx
mov dword [ecx + 0x10], eax
imul ebx, ebp, 0x3b9aca00
add edx, ebx
mov dword [ecx + 0x14], edx
mov ebx, dword [ecx + 8]
mov ebp, dword [ecx + 0xc]
cmp ebp, edx
xchg esi, ebx
sete bl
xchg esi, ebx
xchg edi, ebx
seta bl
xchg edi, ebx
cmp eax, ebx
setb cl
and ecx, esi
or ecx, edi
test cl, cl
jne 0x41c283
cmp eax, ebx
seta al
cmp ebp, edx
setb cl
and esi, eax
or esi, ecx
xchg esi, eax
test al, al
xchg esi, eax
je 0x41c2bd
mov eax, dword [esp + 0x18]
lea ecx, [eax + 4]
nop
mov dword [esp], ecx
mov byte [esp + 4], 0
call fcn.00402e10
jmp 0x41c2bd
mov ecx, dword [esp + 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
lea eax, [ecx + 0x48]
mov dword [esp + 0x10], eax
lea edx, [ecx + 4]
nop
nop
mov dword [esp], edx
mov byte [esp + 4], 1
call fcn.00402e10
mov eax, dword [0x99d270]
inc eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00402d70
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0041c150
add esp, 0x14
ret
lea eax, [0x74a577]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.0041c1b0
Function at 0x41c4b0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41c6a6
sub esp, 0x28
mov eax, dword [esp + 0x2c]
test byte [eax], al
mov dword [esp], eax
call fcn.00402da0
mov eax, dword [esp + 8]
mov ecx, eax
shr eax, 0x1d
mov edx, dword [esp + 4]
movzx ebx, byte [esp + 0x30]
cmp bl, al
jne 0x41c624
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.00402c50
movzx eax, byte [esp + 0x14]
test al, al
je 0x41c4c7
mov eax, dword [esp + 0x38]
mov ecx, eax
and eax, 0xe0000000
mov edx, dword [esp + 0x24]
and edx, 0x1fffffff
or eax, edx
cmp ecx, eax
sete dl
setl bl
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x20]
cmp ebp, esi
xchg edi, ebx
setb bl
xchg edi, ebx
and edi, edx
or ebx, edi
test bl, bl
je 0x41c55a
xor ecx, ecx
xor ebp, ebp
jmp 0x41c55e
sub ebp, esi
sbb ecx, eax
test ebp, ebp
sete al
test ecx, ecx
sete dl
and edx, eax
test dl, dl
jne 0x41c60a
movzx eax, byte [esp + 0x30]
cmp al, 2
ja 0x41c5a4
cmp al, 1
je 0x41c58b
cmp al, 2
je 0x41c5a9
jmp 0x41c60e
nop
lea eax, [0x9955b8]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], ebp
call fcn.00402c40
jmp 0x41c606
cmp al, 3
jne 0x41c5c2
nop
lea eax, [0x9955a8]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], ebp
call fcn.00402c40
jmp 0x41c606
cmp al, 4
jne 0x41c60e
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebp
nop
nop
lea eax, [0x9955b8]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], ebp
call fcn.00402c40
nop
lea eax, [0x970800]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00402c40
add esp, 0x28
ret
add esp, 0x28
ret
lea eax, [0x74e445]
mov dword [esp], eax
mov dword [esp + 4], 0x33
call fcn.00439230
mov dword [esp + 0x24], eax
call fcn.0043af60
lea eax, [0x73d5e9]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043b7e0
mov dword [esp + 4], 0
movzx eax, byte [esp + 0x30]
movzx eax, al
mov dword [esp], eax
call fcn.0043b4c0
lea eax, [0x73a9ea]
mov dword [esp], eax
mov dword [esp + 4], 5
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.0043b4c0
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x75065a]
mov dword [esp], eax
mov dword [esp + 4], 0x3e
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.0041c4b0
Function at 0x420160
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 8
movzx edx, byte [0x994f0a]
test dl, dl
jne 0x42023a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub eax, dword [edx + 0xc]
mov ebx, dword [edx + 0x2c]
test byte [ebx], al
mov ebp, dword [edx + 0x38]
mul ebp
mov ebp, edx
shr edx, 3
and ebp, 7
mov ecx, ebp
mov esi, 1
shl esi, cl
add edx, ebx
nop
nop
nop
nop
mov dword [esp], edx
xchg esi, eax
mov byte [esp + 4], al
xchg esi, eax
call fcn.00402df0
nop
nop
nop
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [0x974ff4]
test byte [eax], al
mov edx, ecx
shr edx, 0x10
and edx, 0x3f
mov ebx, ecx
shr ebx, 0xd
and ebx, 7
mov ebp, ecx
mov ecx, ebx
mov esi, 1
shl esi, cl
shr ebp, 0x16
mov eax, dword [eax + ebp*4]
test byte [eax], al
movzx ebx, byte [eax + edx + 0x21840]
lea eax, [eax + edx + 0x21840]
xchg esi, eax
test al, bl
xchg esi, eax
jne 0x420204
mov dword [esp], eax
xchg esi, eax
mov byte [esp + 4], al
xchg esi, eax
call fcn.00402df0
mov eax, dword [0x99504c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x58]
mov ecx, dword [eax + 0x964]
mov edx, dword [eax + 0x968]
mov ebx, dword [esp + 0x14]
add ecx, ebx
mov dword [eax + 0x964], ecx
adc edx, 0
mov dword [eax + 0x968], edx
add esp, 8
ret
lea eax, [0x74be65]
mov dword [esp], eax
mov dword [esp + 4], 0x2c
call fcn.00439230
nop
int3
Function at 0x421c80
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x421d6a
sub esp, 0x18
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x421d05
cmp eax, 2
je 0x421ce0
cmp eax, 3
jne 0x421d53
mov eax, dword [esp + 0x1c]
test byte [eax], al
lea ecx, [eax + 0xd8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
call fcn.00402c40
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00422e50
jmp 0x421d4f
mov eax, dword [esp + 0x1c]
test byte [eax], al
add eax, 0xd0
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00402c40
jmp 0x421d4f
mov eax, dword [esp + 0x1c]
test byte [eax], al
lea ecx, [eax + 0xc8]
add eax, 0xe8
mov dword [esp + 0x14], eax
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
call fcn.00402c40
nop
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
call fcn.00402c40
add esp, 0x18
ret
lea eax, [0x74a59f]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00421c80
Function at 0x422c50
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x422d30
sub esp, 0x1c
lea eax, [0x73bd32]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00406760
mov eax, dword [esp + 0xc]
test eax, eax
je 0x422c9b
mov ecx, dword [esp + 8]
cmp eax, 3
jne 0x422caf
cmp word [ecx], 0x666f
jne 0x422caf
cmp byte [ecx + 2], 0x66
jne 0x422caf
mov dword [esp + 0x24], 0x7fffffff
mov dword [esp + 0x20], 0xffffffff
add esp, 0x1c
ret
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00452e80
movzx eax, byte [esp + 0x10]
test al, al
je 0x422ce0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
add esp, 0x1c
ret
call fcn.0043af60
lea eax, [0x73c353]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043b7e0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043b7e0
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x750942]
mov dword [esp], eax
mov dword [esp + 4], 0x3f
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00422c50

Function at 0x4235e0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423657
sub esp, 0x10
mov eax, dword [esp + 0x14]
test byte [eax], al
nop
mov dword [esp], eax
call fcn.0040a350
mov eax, dword [0x99504c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 4], eax
jne 0x423640
mov byte [ecx + 8], 1
nop
lea eax, [0x7586c8]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov word [esp + 8], 0x140d
mov dword [esp + 0xc], 2
call fcn.0043c1d0
add esp, 0x10
ret
lea eax, [0x74c989]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.004235e0
Function at 0x423a90
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423c38
sub esp, 0x20
mov eax, dword [esp + 0x24]
test byte [eax], al
nop
mov dword [esp], eax
call fcn.0040a350
mov eax, dword [0x99504c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 4], eax
jne 0x423c21
nop
mov dword [esp], ecx
call fcn.0040a550
xorps xmm0, xmm0
xor eax, eax
jmp 0x423ae0
mov eax, ecx
movsd xmm1, qword [0x7b005c]
ucomisd xmm1, xmm0
jbe 0x423bea
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x6c]
mov ecx, dword [edx]
call ecx
movzx eax, byte [esp]
test al, al
jne 0x423bde
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x68]
mov ecx, dword [edx]
mov dword [esp], 0x10000
call ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov ebx, dword [esp + 4]
mov dword [esp + 0x10], ebx
test eax, eax
xchg ebp, ebx
sete bl
xchg ebp, ebx
test ecx, ecx
sete cl
and ecx, ebp
test cl, cl
je 0x423b83
mov ecx, dword [0x994f30]
test ecx, ecx
je 0x423c1c
mov eax, ebx
xor edx, edx
div ecx
mov dword [esp], eax
call fcn.00468e10
movsd xmm0, qword [esp + 4]
movsd xmm1, qword [0x7b004c]
mulsd xmm0, xmm1
movsd xmm2, qword [esp + 0x18]
addsd xmm0, xmm2
jmp 0x423bab
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00460480
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm1, qword [0x7b004c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add ecx, eax
cmp eax, 0x10000
jb 0x423bec
mov eax, dword [0x9950b8]
mov ebx, dword [0x9950bc]
test eax, eax
setne al
test ebx, ebx
setne bl
or ebx, eax
test bl, bl
je 0x423ade
jmp 0x423bec
mov ecx, dword [esp + 0x14]
movsd xmm0, qword [esp + 0x18]
jmp 0x423bec
mov ecx, eax
test ecx, ecx
jbe 0x423bf8
cmp dword [0x994f30], ecx
ja 0x423c06
mov dword [esp + 0x28], ecx
movsd qword [esp + 0x2c], xmm0
add esp, 0x20
ret
lea eax, [0x74c9b7]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.00439230
call fcn.004379d0
lea eax, [0x74c413]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00423a90
Function at 0x424f70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x425058
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x425052
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.004253b0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00425490
movzx eax, byte [esp + 0x18]
test al, 2
je 0x425006
cmp word [esp + 0x10], 0x1f0
jbe 0x425006
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x42504d
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call fcn.00425420
add esp, 0x1c
ret
call fcn.00468ee0
call fcn.00468ee0
nop
call fcn.00467a60
jmp fcn.00424f70
Function at 0x425070
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4251a4
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jae 0x42519e
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.004253b0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00425580
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jae 0x425197
mov ecx, dword [eax]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call fcn.00425420
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax - 1]
shl eax, 0xd
mov ecx, dword [esp + 0x28]
shl ecx, 0x16
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x28], eax
jae 0x42515a
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x20]
mov dword [esp], eax
call fcn.00431a00
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jae 0x425193
mov ecx, dword [esp + 0x24]
add ecx, 0x20
nop
mov dword [esp], ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0
sbb eax, 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.00402be0
add esp, 0x20
ret
mov eax, edx
call fcn.00468ee0
call fcn.00468ee0
nop
call fcn.00467a60
jmp fcn.00425070
Function at 0x425e40
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42604f
sub esp, 0x38
mov eax, dword [esp + 0x40]
cmp dword [0x974fb0], eax
jne 0x426038
mov eax, dword [esp + 0x3c]
test byte [eax], al
mov dword [esp], eax
call fcn.00402b30
mov eax, dword [esp + 4]
mov ecx, eax
and eax, 0x7fffffff
dec eax
cmp eax, 0x80000000
jae 0x426022
mov dword [esp + 0x2c], ecx
lea eax, [ecx - 1]
mov edx, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 8], eax
call fcn.00402b50
movzx eax, byte [esp + 0xc]
test al, al
je 0x425e67
mov eax, dword [esp + 0x2c]
cmp eax, 0x80000000
jne 0x42601e
mov eax, dword [0x995658]
test eax, eax
jle 0x42601a
nop
lea eax, [0x995d08]
mov dword [esp], eax
call fcn.00402da0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
shr eax, 0x14
mov edx, dword [esp + 8]
mov dword [esp + 0x1c], edx
mov ebx, edx
shl edx, 0xc
or edx, eax
mov dword [esp + 0x2c], edx
shr ebx, 0x14
mov dword [esp + 0x28], ebx
lea ebp, [0x974fc8]
mov dword [esp], ebp
call fcn.00402da0
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x10], ecx
mov edx, dword [0x974fd8]
mov dword [esp + 0x24], edx
mov ebx, dword [0x974fdc]
mov dword [esp + 0x20], ebx
movsd xmm0, qword [0x974fe0]
movsd qword [esp + 0x30], xmm0
call fcn.0043af60
lea eax, [0x745ec9]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.0043b7e0
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0043b4c0
lea eax, [0x73d5f7]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043b7e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
sub eax, ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sbb ecx, edx
mov edx, ecx
shl ecx, 0xc
shr eax, 0x14
or ecx, eax
shr edx, 0x14
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.0043b4c0
lea eax, [0x74187a]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.0043b7e0
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0043b4c0
lea eax, [0x73bd46]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.0043b7e0
movsd xmm0, qword [esp + 0x30]
movsd qword [esp], xmm0
call fcn.0043b210
lea eax, [0x73c9f6]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043b7e0
call fcn.0043afc0
add esp, 0x38
ret
add esp, 0x38
ret
lea eax, [0x747eb1]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00439230
lea eax, [0x74da9c]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.00425e40
Function at 0x4260d0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4261d1
sub esp, 0x18
jmp 0x4260ef
inc dword [0x96f0f0]
call fcn.00426420
cmp dword [esp], 0xffffffff
jne 0x4260e9
nop
lea eax, [0x96f0f4]
mov dword [esp], eax
call fcn.00402b30
mov eax, dword [esp + 4]
test eax, 0x7fffffff
jne 0x4261ba
mov edx, dword [0x974fb0]
mov dword [esp + 8], edx
xor eax, eax
jmp 0x426173
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
lea eax, [edx + edx*2]
mov dword [esp + 0xc], eax
lea ecx, [edi + eax*8 + 8]
mov dword [esp], ecx
call fcn.00432560
mov eax, dword [esp + 0x10]
lea ecx, [0x975050]
lea eax, [ecx + eax + 0x38]
mov ecx, dword [esp + 0xc]
lea eax, [eax + ecx*8]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.00432560
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
mov edx, eax
mov eax, ecx
cmp eax, 0x88
jge 0x426197
mov ebx, eax
shl eax, 7
shr edx, 1
and edx, 1
dec edx
neg edx
lea esi, [0x975050]
lea edi, [esi + eax]
cmp edx, 2
jb 0x426126
jmp 0x4261ae
lea eax, [0x96f440]
mov dword [esp], eax
call fcn.00423660
call fcn.0042b560
add esp, 0x18
ret
mov eax, edx
mov ecx, 2
call fcn.00468ee0
lea eax, [0x74be91]
mov dword [esp], eax
mov dword [esp + 4], 0x2c
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.004260d0