joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415ff0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4160f5
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
test ecx, ecx
je 0x4160be
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x41604e
mov ecx, dword [ebx]
mov dword [eax + 0xc], ecx
mov ecx, dword [eax]
add dword [eax + 0x1c], ecx
movzx ecx, byte [eax + 0x24]
test cl, cl
je 0x416046
mov dword [esp + 0x10], ebx
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00462cd0
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
add esp, 0x18
ret
cmp dword [eax + 0x14], ecx
jae 0x416080
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], edx
call fcn.0040baf0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x14], eax
mov eax, ecx
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 4]
test edx, edx
je 0x4160a4
mov dword [esp + 0x14], ecx
mov ebx, dword [edx]
mov ebp, dword [eax + 8]
mov dword [esp], ebp
mov dword [esp + 4], ecx
call ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
add dword [eax + 0x10], edx
mov edx, dword [eax + 0x14]
sub edx, dword [eax]
mov dword [eax + 0x14], edx
mov edx, dword [eax]
add dword [eax + 0x1c], edx
mov dword [esp + 0x20], ecx
add esp, 0x18
ret
call fcn.00437330
lea eax, [0x707f51]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00437f60
call fcn.004373a0
lea eax, [0x6fbf38]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435820
nop
call fcn.00461140
jmp fcn.00415ff0
Function at 0x41f0d0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41f343
sub esp, 0x2c
mov eax, dword [0x92b2f0]
test eax, eax
je 0x41f32c
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00418d30
movzx eax, byte [esp + 4]
test al, al
je 0x41f320
lea eax, [0x92b3b0]
mov dword [esp], eax
call fcn.004094f0
mov eax, dword [esp + 4]
test eax, eax
je 0x41f314
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
test byte [eax], al
mov ecx, dword [0x711d58]
lea ebx, [eax + 0xf0]
mov dword [esp], ebx
lea edx, [0x711d58]
call ecx
movzx eax, byte [esp + 4]
test al, al
je 0x41f167
mov eax, dword [esp + 0x34]
mov dword [eax + 0x948], 1
jmp 0x41f282
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x108]
mov edx, dword [eax + 0x10c]
mov dword [esp + 4], edx
mov dword [esp], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
call fcn.0044bd00
movzx eax, byte [esp + 0x10]
test al, al
jne 0x41f2f2
call fcn.004633d0
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0xe8]
sub eax, edx
mov edx, dword [esp + 4]
mov ebx, dword [ecx + 0xec]
sbb edx, ebx
test eax, eax
seta bl
test edx, edx
xchg ebp, ebx
sete bl
xchg ebp, ebx
xchg esi, ebx
setg bl
xchg esi, ebx
and ebp, ebx
or esi, ebp
xchg esi, eax
test al, al
xchg esi, eax
je 0x41f274
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 0x940]
mov edx, dword [eax + 0x944]
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.0044be70
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x1c]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x18]
mov dword [esp], edx
call fcn.0044be70
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0044abc0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
mov ebx, dword [edx + 0x108]
mov edx, dword [edx + 0x10c]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
call fcn.0044bd60
movzx eax, byte [esp + 0x10]
test al, al
jne 0x41f2d0
mov eax, dword [esp + 0x34]
mov dword [eax + 0x948], 2
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 1
call fcn.0043a0a0
movzx eax, byte [0x90f8e8]
test al, al
je 0x41f2c4
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004569e0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], eax
add esp, 0x2c
ret
lea eax, [0x92b3b0]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.00409470
mov dword [esp + 0x38], 0
add esp, 0x2c
ret
lea eax, [0x92b3b0]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.00409470
mov dword [esp + 0x38], 0
add esp, 0x2c
ret
mov dword [esp + 0x38], 0
add esp, 0x2c
ret
mov dword [esp + 0x38], 0
add esp, 0x2c
ret
lea eax, [0x7083dc]
mov dword [esp], eax
mov dword [esp + 4], 0x36
call fcn.00435820
nop
call fcn.00461140
jmp fcn.0041f0d0
Function at 0x420fd0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4211e2
sub esp, 0x2c
call fcn.00437330
lea eax, [0x92f640]
mov dword [esp], eax
call fcn.00401e90
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x24], ecx
lea edx, [0x92f638]
mov dword [esp], edx
call fcn.00401e90
mov eax, dword [esp + 4]
mov ecx, 0x64
mul ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
call fcn.00420310
mov eax, dword [esp + 0x18]
imul eax, eax, 0x64
mov ecx, dword [esp + 0x20]
add eax, ecx
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
call fcn.0045ce80
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
call fcn.00437330
lea eax, [0x6f434a]
mov dword [esp], eax
mov dword [esp + 4], 5
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.00437c00
call fcn.00437510
mov dword [esp + 4], 0
mov eax, dword [esp + 0x34]
shr eax, 0xa
mov dword [esp], eax
call fcn.00437c00
lea eax, [0x6f5ac6]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00437f60
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0xa
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
shr eax, 0xa
shl ecx, 0x16
or eax, ecx
mov dword [esp], eax
call fcn.00437c00
lea eax, [0x6f60ab]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00437f60
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00437c00
lea eax, [0x6f4417]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00437f60
call fcn.004373a0
movzx eax, byte [esp + 0x38]
test al, al
jne 0x42117a
movzx eax, byte [0x9046e4]
test al, al
je 0x42119a
call fcn.00437330
lea eax, [0x6f9271]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00437f60
call fcn.004373a0
mov byte [0x9046e4], 0
jmp 0x42119a
call fcn.00437330
lea eax, [0x6f4f6c]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00437f60
call fcn.004373a0
call fcn.00437330
call fcn.00437550
call fcn.004373a0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
nop
movzx ecx, byte [eax + 0x87]
lea edx, [ecx - 1]
mov byte [eax + 0x87], dl
cmp cl, 1
jne 0x4211de
nop
lea eax, [0x92b2c0]
mov dword [esp], eax
call fcn.00409800
add esp, 0x2c
ret
call fcn.00461140
jmp fcn.00420fd0
Function at 0x4213e0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x421487
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jbe 0x42140c
nop
mov edx, eax
sub eax, ecx
jmp 0x421410
mov edx, eax
xor eax, eax
test eax, eax
je 0x42146c
test ecx, 0x3fffff
jne 0x421470
mov eax, dword [esp + 0x14]
test byte [eax], al
lea ecx, [eax + 0x54]
mov dword [esp + 0xc], ecx
nop
mov dword [esp], ecx
call fcn.00409600
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x6c], eax
jne 0x42145a
lea eax, [ecx + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.0042ddc0
nop
nop
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00409800
add esp, 0x10
ret
add esp, 0x10
ret
lea eax, [0x6fee3e]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00435820
nop
call fcn.00461140
jmp fcn.004213e0
Function at 0x422c80
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x422e92
sub esp, 0x34
mov eax, dword [esp + 0x3c]
cmp dword [0x90b330], eax
jne 0x422e7b
mov eax, dword [esp + 0x38]
test byte [eax], al
mov dword [esp], eax
call fcn.00401c50
mov eax, dword [esp + 4]
mov ecx, eax
and eax, 0x7fffffff
dec eax
cmp eax, 0x80000000
jae 0x422e65
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea edx, [ecx - 1]
mov dword [esp + 8], edx
call fcn.00401c70
movzx eax, byte [esp + 0xc]
test al, al
je 0x422ca9
mov eax, dword [esp + 0x30]
cmp eax, 0x80000000
jne 0x422e61
mov eax, dword [0x92b770]
test eax, eax
jle 0x422e5d
lea eax, [0x90b348]
mov dword [esp], eax
call fcn.00401e90
mov eax, dword [0x92bef0]
mov dword [esp + 0x30], eax
mov ecx, dword [0x90b358]
mov dword [esp + 0x2c], ecx
sub eax, ecx
mov dword [esp + 0x28], eax
mov ebx, dword [0x92bef4]
mov dword [esp + 0x24], ebx
mov ebp, dword [0x90b35c]
mov dword [esp + 0x20], ebp
mov esi, dword [0x90b360]
mov dword [esp + 0x1c], esi
mov edi, dword [0x90b364]
mov dword [esp + 0x18], edi
mov edi, dword [esp + 8]
mov dword [esp + 0x14], edi
mov esi, dword [esp + 4]
mov dword [esp + 0x10], esi
call fcn.00437330
lea eax, [0x7004f4]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00437f60
mov eax, dword [esp + 0x24]
mov ecx, eax
shr eax, 0x14
mov dword [esp + 4], eax
shl ecx, 0xc
mov edx, dword [esp + 0x30]
shr edx, 0x14
or ecx, edx
mov dword [esp], ecx
call fcn.00437c00
lea eax, [0x6f70fa]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00437f60
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
sub eax, ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
sbb eax, ecx
mov ecx, eax
shr eax, 0x14
mov dword [esp + 4], eax
shl ecx, 0xc
mov eax, dword [esp + 0x28]
shr eax, 0x14
or ecx, eax
mov dword [esp], ecx
call fcn.00437c00
lea eax, [0x6fb87b]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00437f60
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00437c00
lea eax, [0x6f5464]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00437f60
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.004375f0
lea eax, [0x6f6117]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00437f60
call fcn.004373a0
add esp, 0x34
ret
add esp, 0x34
ret
lea eax, [0x70247b]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00435820
lea eax, [0x7074e0]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00435820
nop
call fcn.00461140
jmp fcn.00422c80
Function at 0x423290
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4234e9
sub esp, 0x34
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x30], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
lea ecx, [0x9047e4]
mov dword [esp], ecx
call fcn.00422c00
mov eax, dword [esp + 4]
movzx ecx, byte [esp + 8]
mov dword [esp + 0x28], eax
mov byte [esp + 0x2c], cl
test cl, cl
jne 0x4232f9
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
mov dword [esp + 0x38], 0xffffffff
add esp, 0x34
ret
lea eax, [0x90b2a0]
mov dword [esp], eax
call fcn.00422ab0
mov eax, dword [esp + 4]
test eax, eax
je 0x4233b0
mov dword [esp + 0x18], eax
lea ecx, [eax + 0x3b]
mov dword [esp], ecx
call fcn.00401bc0
movzx eax, byte [esp + 4]
cmp al, 1
je 0x423347
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [esp + 0x28]
cmp edx, ecx
je 0x4232f9
lea ebx, [edx + 3]
cmp ecx, ebx
je 0x4232f9
jmp 0x423435
lea eax, [esp + 0x28]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00423180
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0xc]
mov dword [esp + 0x14], eax
test cl, cl
je 0x4232f9
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x14]
mov dword [esp], ecx
mov byte [esp + 4], 0
call fcn.00423640
movzx eax, byte [esp + 8]
test al, al
jne 0x423391
xor eax, eax
jmp 0x4233ac
nop
lea eax, [0x90b378]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.00401d10
mov eax, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x4233ca
lea eax, [0x9047e4]
mov dword [esp], eax
call fcn.00422ea0
movzx eax, byte [esp + 4]
mov ecx, eax
mov eax, 0xffffffff
mov byte [esp + 0x12], cl
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x28]
movzx ebx, byte [esp + 0x2c]
lea ebp, [0x9047e4]
mov dword [esp], ebp
mov dword [esp + 4], edx
mov byte [esp + 8], bl
call fcn.00422c80
movzx eax, byte [esp + 0x12]
test al, al
je 0x42341f
lea eax, [0x711eb4]
mov dword [esp], eax
call fcn.00461030
nop
lea eax, [0x9046e0]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401e60
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
add esp, 0x34
ret
mov byte [esp + 0x13], al
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
call fcn.00437330
lea eax, [0x6fdb75]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00437f60
mov dword [esp + 4], 0
movzx eax, byte [esp + 0x13]
movzx eax, al
mov dword [esp], eax
call fcn.00437c00
lea eax, [0x6f613b]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00437c00
lea eax, [0x6f54be]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00437c00
call fcn.00437550
call fcn.004373a0
lea eax, [0x7004d5]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00435820
nop
call fcn.00461140
jmp fcn.00423290
Function at 0x425ea0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x425efe
sub esp, 0x10
movzx eax, byte [esp + 0x1c]
test al, al
je 0x425ee7
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov byte [esp + 8], al
mov byte [esp + 9], 0
call fcn.004261f0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
lea eax, [0x709257]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.00435820
nop
call fcn.0045fc00
jmp fcn.00425ea0

Function at 0x425fa0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4260eb
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
xor edx, edx
jmp 0x425fd4
sub ebp, ecx
lea ecx, [ebp + edx]
shr ebp, 0xd
sub esi, ebp
mov eax, esi
mov edx, ebx
test eax, eax
jbe 0x42606c
mov ebx, dword [esp + 0x2c]
mov ebp, dword [ebx + 0xdc]
test byte [ebp], al
mov dword [esp + 0x20], eax
mov byte [esp + 0x13], dl
mov dword [esp + 0x14], ecx
shr ecx, 0x16
mov ecx, dword [ebp + ecx*4]
test byte [ecx], al
add ecx, 0x408c4
mov dword [esp + 0x24], ecx
mov dword [esp], ecx
call fcn.00401cc0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov edx, ecx
and ecx, 0x3fffff
cmp eax, ecx
seta bl
mov ebp, dword [esp + 0x20]
mov esi, ebp
shl ebp, 0xd
add ebp, ecx
movzx edi, byte [esp + 0x13]
or ebx, edi
cmp ebp, 0x400000
jbe 0x426044
mov ebp, 0x400000
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebp
mov byte [esp + 0x13], bl
jmp 0x426087
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0x13]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
jmp 0x425fc5
mov byte [esp + 0x38], dl
add esp, 0x28
ret
mov ecx, edx
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0x13]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp ebp, eax
jbe 0x425fc5
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
call fcn.00401ca0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x426052
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00401cc0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jb 0x4260ce
mov edx, dword [esp + 0x1c]
cmp eax, edx
jbe 0x426074
jmp 0x4260d4
mov edx, dword [esp + 0x1c]
jmp 0x426074
lea eax, [0x707be4]
mov dword [esp], eax
mov dword [esp + 4], 0x33
call fcn.00435820
nop
call fcn.00461140
jmp fcn.00425fa0
Function at 0x427af0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x427c0c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x427b85
cmp cl, 2
je 0x427b2d
cmp cl, 3
jne 0x427bf5
mov byte [eax + 8], 1
jmp 0x427bf1
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042d040
nop
lea eax, [0x90f89c]
mov dword [esp], eax
call fcn.00409600
nop
mov eax, dword [0x90f868]
sub eax, dword [0x90f84c]
mov dword [0x90f868], eax
mov eax, dword [0x90f858]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x90f858], ecx
nop
lea eax, [0x90f89c]
mov dword [esp], eax
call fcn.00409800
jmp 0x427bf1
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00415150
nop
lea eax, [0x90f89c]
mov dword [esp], eax
call fcn.00409600
nop
mov eax, dword [0x90f840]
sub eax, dword [0x90f824]
mov dword [0x90f840], eax
mov eax, dword [0x90f830]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x90f830], ecx
nop
nop
lea eax, [0x90f89c]
mov dword [esp], eax
call fcn.00409800
add esp, 0x14
ret
lea eax, [0x6f80d5]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00435820
nop
call fcn.00461140
jmp fcn.00427af0
Function at 0x42dad0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42db1e
sub esp, 8
mov eax, dword [esp + 0xc]
cmp eax, eax
setbe cl
mov edx, dword [esp + 0x10]
cmp edx, edx
setbe bl
cmp bl, cl
jne 0x42db07
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
add esp, 8
ret
lea eax, [0x7091df]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.00435820
nop
call fcn.00461140
jmp fcn.0042dad0

Function at 0x42e8b0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42ea2f
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp], ecx
call fcn.00401e90
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
cmp ecx, eax
ja 0x42e9ad
shr eax, 9
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 8], eax
jbe 0x42e949
mov edx, dword [ecx + 4]
mov ebx, dword [edx + eax*4]
lea eax, [edx + eax*4]
test ebx, ebx
je 0x42e949
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x42e997
cmp edx, 0x200
je 0x42e981
mov dword [esp + 0x18], ebx
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401e50
lea eax, [0x92b3f8]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0042eab0
mov ecx, dword [esp + 0x20]
nop
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401eb0
mov eax, dword [esp + 0x20]
add eax, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401d00
add esp, 0x1c
ret
lea eax, [0x7071d0]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00435820
lea eax, [0x707f85]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00435820
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
call fcn.00437330
lea eax, [0x6f49df]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00437c00
lea eax, [0x6f5071]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00437c00
call fcn.00437550
call fcn.004373a0
lea eax, [0x702228]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00435820
nop
call fcn.00461140
jmp fcn.0042e8b0
Function at 0x42fde0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42fec9
sub esp, 0x1c
lea eax, [0x92b328]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.00401c70
movzx eax, byte [esp + 0xc]
test al, al
je 0x42fe58
mov eax, dword [0x8cd23c]
mov ecx, dword [sym.imp.KERNEL32.DLL_PostQueuedCompletionStatus]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00432d50
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42fe5c
add esp, 0x1c
ret
call fcn.00463220
mov eax, dword [esp]
mov dword [esp + 0x18], eax
call fcn.00437330
lea eax, [0x70930b]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00437c00
lea eax, [0x6f3d0d]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00437f60
call fcn.004373a0
lea eax, [0x707c4a]
mov dword [esp], eax
mov dword [esp + 4], 0x33
call fcn.00435820
nop
call fcn.00461140
jmp fcn.0042fde0
Function at 0x4302a0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x430348
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x18]
cmp ecx, 0x72
je 0x4302ca
cmp ecx, 0x77
jne 0x4302f3
mov edx, dword [esp + 0x1c]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 0x20], edx
mov eax, dword [eax + 0x14]
mov edx, dword [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0042f480
add esp, 0x10
ret
mov dword [esp + 0xc], ecx
call fcn.00437330
lea eax, [0x7092cf]
mov dword [esp], eax
mov dword [esp + 4], 0x3c
call fcn.00437f60
mov eax, dword [esp + 0xc]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00437d60
call fcn.00437550
call fcn.004373a0
lea eax, [0x6fbf66]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435820
nop
call fcn.00461140
jmp fcn.004302a0

Function at 0x431210
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x431349
sub esp, 0x3c
mov edx, dword [0x92b5b0]
test edx, edx
jne 0x431241
lea edx, [0x463190]
mov dword [0x9037d0], edx
jmp 0x431252
lea edi, [0x9037d0]
lea eax, [0x463190]
call fcn.00462510
xor eax, eax
jmp 0x431267
lea esi, [0x92b820]
mov byte [esi + eax], bl
inc dword [0x92b2a8]
mov eax, ebp
cmp eax, 0x36
jge 0x4312b7
lea edx, [0x708556]
movzx ebx, byte [edx + eax]
cmp ebx, 0x80
jge 0x431283
lea ebp, [eax + 1]
jmp 0x4312ad
mov dword [esp + 0x14], eax
mov dword [esp], edx
mov dword [esp + 4], 0x36
mov dword [esp + 8], eax
call fcn.0045cb50
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea edx, [0x708556]
cmp eax, 0x64
jb 0x431256
jmp 0x43133e
call fcn.00430580
call fcn.00448880
call fcn.004488e0
call fcn.00430f30
mov byte [esp], 0
call fcn.00430eb0
mov eax, dword [esp + 4]
mov dword [0x92b364], eax
call fcn.00430fa0
call fcn.00430de0
mov eax, dword [esp]
mov dword [0x92b318], eax
lea edi, [esp + 0x18]
xor eax, eax
call fcn.004627a7
mov eax, dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
lea ecx, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00432c60
mov eax, dword [esp + 0x1c]
mov dword [0x92b344], eax
mov eax, dword [sym.imp.KERNEL32.DLL_SetProcessPriorityBoost]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 1
call fcn.00432cb0
add esp, 0x3c
ret
mov ecx, 0x64
call fcn.00462590
nop
call fcn.00461140
jmp fcn.00431210