joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d5e0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40d6f4
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [0x0082a6f8]
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
mov rbx, rdx
shr rdx, 2
lea rdx, [rdx + rdx*2]
cmp rcx, rdx
jae 0x40d643
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.0040d700
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x20], rax
shl rbx, 1
lea rax, [rbx + 2]
shl rax, 3
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov byte [rsp + 0x10], 1
call fcn.00410030
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
shl rdx, 1
mov qword [rax], rdx
lea rdx, [0x00456820]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
mov qword [rsp], rdx
call fcn.0040eb70
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 8]
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx + 8]
cmp rcx, rdx
jne 0x40d6d9
lea rcx, [0x0082a6f8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004021e0
mov rax, qword [0x0082a6f8]
jmp 0x40d626
lea rax, [0x006b6711]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0040d5e0

Function at 0x40ebf0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40ed47
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 8]
inc rdx
mov qword [rcx + 8], rdx
mov rbx, rcx
shl rcx, 0x10
mov rsi, rdx
and rdx, 0x7ffff
or rcx, rdx
mov rdx, rcx
sar rcx, 0x13
shl rcx, 3
cmp rcx, rbx
jne 0x40ec72
mov rcx, qword [rsp + 0x38]
mov rsi, qword [rcx]
mov qword [rbx], rsi
mov rax, rsi
lock cmpxchg qword [rcx], rdx
sete sil
test sil, sil
je 0x40ec51
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x20], rcx
call fcn.0042bc80
lea rax, [0x006b7cd8]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.0042c640
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042c5f0
lea rax, [0x006ab4cb]
mov qword [rsp], rax
mov qword [rsp + 8], 5
call fcn.0042c640
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c4d0
lea rax, [0x006abd2e]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0042c640
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c4d0
lea rax, [0x006ac0ef]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042c640
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042c5f0
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006acfda]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0040ebf0
Function at 0x40f110
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40f257
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx]
cmp rax, rdx
jne 0x40f23c
mov qword [rsp + 0x18], rax
mov qword [rsp], rcx
call fcn.00429180
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x20], rcx
mov rdx, rax
xor eax, eax
mov rbx, qword [rsp + 0x38]
lock cmpxchg qword [rbx], rcx
sete al
test al, al
je 0x40f20e
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe5], 1
mov rax, qword [0x0082a6f0]
mov rax, qword [rax]
test rax, rax
jne 0x40f1dd
jmp 0x40f1fa
mov qword [rsp], 0x989680
call fcn.00428ff0
mov rax, qword [0x0082a6f0]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00454050
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
test rax, rax
je 0x40f1aa
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe5], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp], 0xffffffffffffffff
call fcn.00428ff0
mov rdx, qword [rsp + 0x18]
jmp 0x40f1e5
mov rax, qword [rbx]
cmp rax, 1
jne 0x40f221
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x006b3544]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042b3a0
ud2
lea rax, [0x006af5ce]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0040f110
Function at 0x40f270
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
mov qword [rsp + 0x18], rdx
xor eax, eax
mov rbx, qword [rsp + 0x30]
lock cmpxchg qword [rbx], rdx
sete dl
test dl, dl
je 0x40f489
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x38]
test rax, rax
jge 0x40f338
mov rax, qword [rcx + 0x30]
mov byte [rax + 0xe5], 1
mov rax, qword [0x0082a6f0]
mov rax, qword [rax]
test rax, rax
jne 0x40f2f5
jmp 0x40f329
mov rax, qword [0x0082a6f0]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00454050
mov qword [rsp], 0x989680
call fcn.00428ff0
mov eax, dword [rsp + 8]
test eax, eax
jl 0x40f2d9
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x50], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], 0xffffffffffffffff
call fcn.00428ff0
jmp 0x40f30a
call fcn.00456740
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x38]
add rax, rcx
mov qword [rsp + 0x48], rax
jmp 0x40f353
mov rax, rdx
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rdx + 0x30]
mov byte [rbx + 0xe5], 1
mov rbx, qword [0x0082a6f0]
mov rbx, qword [rbx]
test rbx, rbx
je 0x40f380
cmp rcx, 0x989680
jle 0x40f380
mov ecx, 0x989680
mov qword [rsp], rcx
call fcn.00428ff0
mov eax, dword [rsp + 8]
test eax, eax
jge 0x40f46a
mov rax, qword [0x0082a6f0]
mov rax, qword [rax]
test rax, rax
jne 0x40f453
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.00456740
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40f350
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rcx]
mov rsi, qword [rdx + 0x30]
mov rdi, rsi
cmp rsi, rbx
jne 0x40f40e
mov rax, rbx
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete bl
test bl, bl
je 0x40f3df
mov byte [rsp + 0x50], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rbx, 1
jne 0x40f4bc
mov byte [rdi + 0xe5], 1
mov qword [rsp], 0xffffffffffffffff
call fcn.00428ff0
mov eax, dword [rsp + 8]
test eax, eax
jl 0x40f4a1
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x50], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00454050
jmp 0x40f3a8
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov byte [rsp + 0x50], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rbx]
cmp rax, 1
jne 0x40f4d7
mov byte [rsp + 0x50], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006b9240]
mov qword [rsp], rax
mov qword [rsp + 8], 0x32
call fcn.0042b3a0
ud2
lea rax, [0x006b8dff]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.0042b3a0
ud2
lea rax, [0x006b3c4b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0042b3a0
ud2
Function at 0x40fb60
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x40fdbd
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x50]
test byte [rax], al
mov rcx, qword [rax + 0x1340]
mov rdx, qword [rax + 0x1338]
mov rbx, rcx
sub rcx, rdx
mov rdx, qword [rsp + 0x58]
cmp rdx, rcx
jbe 0x40fbe8
lea rcx, [rdx + 0x10001fff]
and rcx, 0xfffffffff0000000
lea rsi, [rcx + rbx]
cmp rbx, rsi
ja 0x40fbe8
mov rbx, qword [rax + 0x1328]
mov rdi, rsi
sub rsi, rbx
lea rbx, [rsi - 1]
movabs rsi, 0x7ffffffff
cmp rbx, rsi
jbe 0x40fc97
mov rcx, qword [rax + 0x1340]
mov rbx, qword [rax + 0x1338]
sub rcx, rbx
cmp rdx, rcx
jbe 0x40fc11
mov qword [rsp + 0x60], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rbx
movzx ecx, byte [rax + 0x1348]
mov byte [rsp + 0x10], cl
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
lea rbx, [0x008528f8]
mov qword [rsp + 0x18], rbx
call fcn.00415400
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x1338]
mov rdx, qword [rsp + 0x58]
add rcx, rdx
mov qword [rax + 0x1338], rcx
mov rdx, qword [rax + 0x1330]
cmp rcx, rdx
ja 0x40fc82
mov rax, qword [rsp + 0x38]
test rax, 0x1fff
jne 0x40fda2
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rcx
mov qword [rsp], rax
mov byte [rsp + 0x10], 1
call fcn.00421400
jmp 0x40fc62
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x27], 0
mov rdx, qword [rax + 0x1340]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
lea rdx, [rsp + 0x27]
mov qword [rsp + 0x10], rdx
call fcn.00415320
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x40fbfe
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x1340]
cmp rax, rdx
jne 0x40fd08
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x1340], rax
movzx eax, byte [rsp + 0x27]
mov byte [rcx + 0x1348], al
mov rax, rcx
mov rdx, qword [rsp + 0x58]
jmp 0x40fbe8
mov rbx, qword [rcx + 0x1328]
cmp rbx, rax
ja 0x40fd9b
mov rsi, qword [rsp + 0x30]
lea rdi, [rax + rsi]
mov r8, rdi
sub rdi, rbx
lea rbx, [rdi - 1]
movabs rdi, 0x7ffffffff
cmp rbx, rdi
ja 0x40fd74
mov rbx, qword [rcx + 0x1338]
sub rdx, rbx
cmp rdx, 0x1000000
jae 0x40fd74
mov qword [rcx + 0x1340], r8
add rax, 0x1fff
and rax, 0xffffffffffffe000
mov qword [rcx + 0x1338], rax
movzx eax, byte [rsp + 0x27]
mov byte [rcx + 0x1348], al
jmp 0x40fcfb
mov qword [rsp + 0x28], rsi
mov qword [rsp], rax
mov qword [rsp + 8], rsi
lea rax, [rsp + 0x28]
mov qword [rsp + 0x10], rax
call fcn.004151e0
mov rcx, qword [rsp + 0x50]
jmp 0x40fcfb
mov rsi, qword [rsp + 0x30]
jmp 0x40fd74
lea rax, [0x006b6738]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.0040fb60
Function at 0x40fdd0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x410026
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test byte [rax], al
movzx ecx, byte [rsp + 0x60]
movzx edx, cl
cmp rdx, 0x86
jae 0x41001f
mov qword [rsp + 0x20], rdx
mov rcx, qword [rax + rdx*8 + 0x28]
mov qword [rsp + 0x28], rcx
mov qword [rsp], rcx
call fcn.00411e00
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x38]
cmp rax, rdx
jne 0x40fef6
movzx eax, word [rcx + 0x60]
movzx ecx, ax
cmp rcx, rdx
jne 0x40ff9a
lea rax, [0x0044fae0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
movzx ecx, byte [rsp + 0x60]
mov byte [rsp + 0x40], cl
lea rcx, [rsp + 0x30]
mov qword [rsp], rcx
call fcn.004527f0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + rax*8 + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp], rax
call fcn.00411e00
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
mov edx, 1
mov rbx, qword [rcx + 0x38]
cmp rax, rbx
jae 0x40ff7f
mov rbx, qword [rcx + 0x68]
imul rax, rbx
lea rbx, [rcx + 0x18]
add rax, qword [rbx]
movzx ebx, word [rcx + 0x60]
inc ebx
mov word [rcx + 0x60], bx
movzx esi, bx
mov rdi, qword [rcx + 0x38]
cmp rsi, rdi
ja 0x40fefa
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x78], dl
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor edx, edx
jmp 0x40feac
mov word [rsp + 0x16], bx
mov qword [rsp + 0x18], rdi
call fcn.0042bc80
lea rax, [0x006ad927]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042c640
movzx eax, word [rsp + 0x16]
movzx eax, ax
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006ac863]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042c640
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006b1131]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042b3a0
ud2
lea rax, [0x006b074a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.0042b3a0
ud2
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x16], ax
call fcn.0042bc80
lea rax, [0x006b111a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042c640
movzx eax, word [rsp + 0x16]
movzx eax, ax
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006ac863]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042c640
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006b8e30]
mov qword [rsp], rax
mov qword [rsp + 8], 0x31
call fcn.0042b3a0
ud2
call fcn.00429b50
ud2
call fcn.00452950
jmp fcn.0040fdd0
Function at 0x410c30
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x410d19
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
cmp rcx, 1
je 0x410ccc
test rcx, rcx
jl 0x410cfb
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rdx]
cmp rbx, 0x21
jae 0x410cb5
lea rax, [0x007fcb60]
mov rax, qword [rax + rbx*8]
cmp rcx, rax
ja 0x410cfb
imul rbx, rcx
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 1
call fcn.00410030
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
movabs rax, 0x7ffffffff
mov rsi, rdx
xor edx, edx
div rbx
mov rdx, rsi
jmp 0x410c85
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], 1
call fcn.00410030
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0065e800]
mov qword [rsp], rax
lea rax, [0x006f6d90]
mov qword [rsp + 8], rax
call fcn.0042aba0
ud2
call fcn.00452950
jmp fcn.00410c30
Function at 0x411090
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x18]
jbe 0x411377
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x41135c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x411301
lea rdx, [rcx - 1]
test rcx, rdx
jne 0x411341
cmp rcx, 0x2000
ja 0x411326
cmp rax, 0x10000
jae 0x4112da
mov qword [rsp + 0x18], rcx
mov rdx, qword gs:[0x28]
mov rdx, qword [rdx]
mov rbx, qword [rdx + 0x30]
inc dword [rbx + 0xd0]
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x28], rdx
test rdx, rdx
je 0x4112af
mov rbx, qword [rdx + 0xa0]
test rbx, rbx
je 0x4112af
test byte [rbx], al
add rbx, 0x1238
mov qword [rsp + 0x20], rbx
mov rsi, qword [rbx + 8]
lea rsi, [rcx + rsi - 1]
dec rcx
not rcx
and rcx, rsi
mov qword [rbx + 8], rcx
add rcx, rax
cmp rcx, 0x40000
jbe 0x41129b
mov qword [rsp], 0x40000
lea rax, [0x00852960]
mov qword [rsp + 8], rax
call fcn.00414e20
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
test rax, rax
je 0x411279
mov qword [rcx + 8], 0
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
mov rbx, qword [rsp + 0x48]
lea rsi, [rbx + rdx]
mov qword [rcx + 8], rsi
mov rsi, qword gs:[0x28]
mov rsi, qword [rsi]
mov rdi, qword [rsp + 0x28]
mov r8d, dword [rdi + 0xd0]
lea r9d, [r8 - 1]
mov dword [rdi + 0xd0], r9d
add rax, rdx
cmp r8d, 1
jne 0x4111fd
movzx edx, byte [rsi + 0xc0]
test dl, dl
je 0x4111fd
mov qword [rsi + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rax
lea rdx, [0x00834fc8]
cmp rcx, rdx
je 0x41125d
mov rcx, qword [rsp + 0x58]
lea rdx, [0x00852960]
cmp rcx, rdx
jne 0x41122e
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
call fcn.00425970
lea rax, [0x00852960]
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.00425a20
mov rax, qword [rsp + 0x30]
jmp 0x41121f
lea rax, [0x00834fc0]
mov qword [rsp], rax
call fcn.0040ef90
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
jmp 0x41120e
lea rax, [0x00834fc8]
cmp rcx, rax
jne 0x41130b
lea rax, [0x00834fc0]
mov qword [rsp], rax
call fcn.0040ef90
jmp 0x41130b
mov rcx, qword [rbx]
test rcx, rcx
je 0x41116f
mov rcx, rbx
jmp 0x4111a6
lea rax, [0x00834fc0]
mov qword [rsp], rax
call fcn.0040eda0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x28]
lea rbx, [0x00834fc8]
jmp 0x411144
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 8], rax
call fcn.00414e20
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov ecx, 8
jmp 0x4110ee
lea rax, [0x006b42e3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042b3a0
ud2
lea rax, [0x006b57f2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0042b3a0
ud2
lea rax, [0x006b7544]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
call fcn.0042b3a0
ud2
lea rax, [0x006b23e0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1a
call fcn.0042b3a0
ud2
call fcn.00441950
jmp fcn.00411090
Function at 0x412090
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4121cb
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [0x0083a728]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
jb 0x41210c
mov rdx, qword [0x0083a730]
cmp rcx, rdx
jae 0x41210c
sub rcx, rax
mov rax, qword [0x0083a718]
mov rdx, rcx
shr rcx, 5
sub rax, rcx
dec rax
mov qword [rsp + 0x38], rax
shr rdx, 3
and rdx, 3
mov dword [rsp + 0x40], edx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [0x0083a730]
mov qword [rsp + 0x10], rax
call fcn.0042bc80
lea rax, [0x006ad919]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042c640
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042c4d0
lea rax, [0x006ada25]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
call fcn.0042c640
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042c4d0
lea rax, [0x006aaf99]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042c640
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042c4d0
lea rax, [0x006aafda]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042c640
call fcn.0042bd10
lea rax, [0x006b51c0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00412090
Function at 0x412c60
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x412e92
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jne 0x412dbf
movzx ecx, byte [rax + 0x17]
test cl, 0x40
jne 0x412d33
movzx ecx, byte [0x00850df4]
test cl, cl
je 0x412d29
mov rcx, qword [rax + 0x20]
xor edx, edx
xor ebx, ebx
jmp 0x412cb7
add rdx, 8
mov rsi, qword [rax + 8]
cmp rdx, rsi
jae 0x412d1f
test rdx, 0x3f
jne 0x412d1b
movzx ebx, byte [rcx]
inc rcx
bt ebx, 0
jae 0x412cb3
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x1c], ebx
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x68]
lea rcx, [rdx + rax]
mov rbx, qword [rsp + 0x60]
lea rsi, [rdx + rbx]
mov rcx, qword [rcx]
mov qword [rsp + 8], rcx
mov qword [rsp], rsi
call fcn.00411660
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x20]
mov ebx, dword [rsp + 0x1c]
jmp 0x412cb3
shr ebx, 1
jmp 0x412ccf
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rax
call fcn.0044cfa0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x30], rcx
call fcn.0042bc80
lea rax, [0x006b6d40]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042c640
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0042c640
lea rax, [0x006ada07]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
call fcn.0042c640
call fcn.0042bd10
lea rax, [0x006b5cf7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042b3a0
ud2
mov qword [rsp], rax
call fcn.0044cfa0
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rdx
call fcn.0042bc80
lea rax, [0x006b6d40]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042c640
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0042c640
lea rax, [0x006ac7d4]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042c640
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042c340
lea rax, [0x006aea54]
mov qword [rsp], rax
mov qword [rsp + 8], 0x12
call fcn.0042c640
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
call fcn.0042c340
call fcn.0042bf30
call fcn.0042bd10
lea rax, [0x006b5cf7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042b3a0
ud2
lea rax, [0x006b7138]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0042b3a0
ud2
Function at 0x4143d0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x414512
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
inc dword [rcx + 0xd0]
mov rcx, qword [rsp + 0x30]
test byte [rcx], al
movzx edx, byte [rsp + 0x38]
movzx edx, dl
cmp rdx, 0x86
jae 0x41450b
mov rbx, qword [rcx + rdx*8 + 0x28]
movzx esi, word [rbx + 0x60]
mov rdi, qword [rbx + 0x38]
cmp rsi, rdi
jne 0x4144f0
mov qword [rsp + 0x18], rax
lea rsi, [0x008355e0]
cmp rbx, rsi
je 0x414459
mov byte [rbx + 0x63], 0
mov qword [rsp + 0x10], rdx
shl rdx, 6
lea rcx, [0x00839400]
lea rcx, [rcx + rdx + 0x1350]
mov qword [rsp], rcx
call fcn.004145d0
mov rax, qword [rsp + 8]
test rax, rax
je 0x4144d5
movzx ecx, word [rax + 0x60]
mov rdx, qword [rax + 0x38]
cmp rcx, rdx
je 0x4144ba
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x30]
mov qword [rdx + rcx*8 + 0x28], rax
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
add dword [rax + 0xd0], 0xffffffff
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x006b0a36]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.0042b3a0
ud2
lea rax, [0x006ad49d]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042b3a0
ud2
lea rax, [0x006b6c50]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042b3a0
ud2
call fcn.00429b50
ud2
call fcn.00452950
jmp fcn.004143d0

Function at 0x414a20
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x414b38
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
test byte [rax], al
mov qword [rsp], rax
call fcn.0040eda0
mov rax, qword [rsp + 0x30]
mov byte [rax + 0x63], 0
movzx ecx, word [rax + 0x60]
test cx, cx
je 0x414b1d
mov rdx, qword [rax + 0x20]
mov rbx, qword [rax + 0x68]
test rbx, rbx
je 0x414b16
shl rdx, 0xd
mov rsi, rax
mov rax, rdx
xor edx, edx
div rbx
movzx ecx, cx
sub eax, ecx
test eax, eax
jg 0x414aaf
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0040ef90
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x14], eax
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 0x20]
mov qword [rsp], rcx
mov qword [rsp + 8], rsi
call fcn.004230a0
mov rax, qword [rsp + 0x28]
lea rcx, [rax + 0x10]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 8], rcx
call fcn.00423240
mov eax, dword [rsp + 0x14]
movsxd rax, eax
neg rax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x68]
imul rcx, rax
lea rdx, [0x00854000]
lock xadd qword [rdx], rcx
mov rcx, qword [rsp + 0x28]
lock xadd qword [rcx + 0x30], rax
jmp 0x414a97
call fcn.00429c30
ud2
lea rax, [0x006b5dcf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042b3a0
ud2
call fcn.00452950
jmp fcn.00414a20