joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430a60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430af9
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdi, qword [0x0203e308]
test rdi, rdi
je 0x430a9f
mov qword [rsp + 0x10], rdi
mov rdx, qword [rdi + 8]
mov qword [0x0203e308], rdx
mov ecx, 0x2000
xor eax, eax
rep stosq qword [rdi], rax
mov rax, qword [rsp + 0x10]
jmp 0x430add
nop
nop
lea rax, [0x0203e300]
call fcn.004107e0
mov eax, 0x10000
lea rbx, [0x02043d58]
call fcn.0041c6a0
nop
test rax, rax
je 0x430ae7
mov qword [rsp + 0x18], rax
nop
nop
lea rax, [0x0203e300]
call fcn.00410580
mov rax, qword [rsp + 0x18]
movups xmmword [rax], xmm15
add rsp, 0x20
pop rbp
ret
lea rax, [0x010b1a39]
mov ebx, 0x1f
call fcn.0043ffc0
nop
call fcn.00477be0
nop
jmp fcn.00430a60

Function at 0x430b20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430ca6
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rdx, qword [0x01ec4f40]
nop dword [rax]
cmp rdx, 0x15
ja 0x430c23
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x48], dil
test byte [rax], al
cmp dword [0x0203dd30], 0
je 0x430b73
nop
call fcn.00479b20
mov qword [r11], rcx
mov rdx, qword [rax + 0x10120]
mov qword [r11 + 8], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rcx
mov qword [rax + 0x10120], rcx
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call fcn.00437d60
mov rax, qword [rsp + 0x30]
movzx ebx, byte [rsp + 0x48]
call fcn.00433000
mov rcx, qword [0x01ec18e8]
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x10078], rcx
cmp dword [0x0203dd30], 0
nop
jne 0x430bc9
mov rdx, qword [rsp + 0x38]
jmp 0x430be1
call fcn.00479b20
mov rdx, qword [rsp + 0x38]
mov qword [r11], rdx
mov rsi, qword [rax + 0x10118]
mov qword [r11 + 8], rsi
mov qword [rax + 0x10118], rdx
lea rdx, [rax + 0x100b8]
movzx ebx, byte [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, rdx
nop dword [rax]
call fcn.00429d20
mov rdx, qword [rsp + 0x30]
add qword [rdx + 0x10128], rax
movzx esi, byte [rsp + 0x48]
mov byte [rdx + 0x10131], sil
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x18], rdx
call fcn.00441a60
lea rax, [0x010b43dd]
mov ebx, 0x20
call fcn.004422e0
mov rcx, qword [rsp + 0x18]
mov eax, 1
shl rax, cl
cmp rcx, 0x40
sbb rcx, rcx
and rax, rcx
call fcn.00442100
call fcn.00441ca0
nop
call fcn.00441ac0
call fcn.00441a60
lea rax, [0x010ad075]
mov ebx, 0x1d
call fcn.004422e0
mov eax, 0x200000
call fcn.00442100
call fcn.00441ca0
call fcn.00441ac0
lea rax, [0x010d1275]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00430b20
Function at 0x434b20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x434b98
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
shl rbx, 3
nop dword [rax]
cmp rax, 1
jne 0x434b4f
lea rsi, [rbx + 0xb0]
jmp 0x434b5d
lea rsi, [rax - 2]
cmp rsi, 1
ja 0x434b86
lea rsi, [rbx + 0x40]
mov rax, rsi
xor ebx, ebx
lea rcx, [0x02043d50]
call fcn.00412aa0
mov rdx, qword [rsp + 0x28]
mov qword [rax + 0x10], rdx
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x28], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x010a8bb9]
mov ebx, 0x1b
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00434b20
Function at 0x435d20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x435e19
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rax + 0x108], 0
mov ecx, dword [0x0203e570]
test ecx, ecx
je 0x435df2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x10], 0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x00435e40]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.00477ac0
xorps xmm15, xmm15
mov r14, qword [0x0203d8d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
cmp rax, 0x20
jge 0x435dec
jae 0x435e0e
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rax*8 + 8], 0
add rsp, 0x50
pop rbp
ret
lea rcx, [fcn.0044d220]
inc rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
add rsp, 0x50
pop rbp
ret
mov ecx, 0x20
call fcn.00479ec0
nop
mov qword [rsp + 8], rax
nop
call fcn.00477be0
mov rax, qword [rsp + 8]
jmp fcn.00435d20

Function at 0x4371e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x437326
push rbp
mov rbp, rsp
sub rsp, 0x30
mov ecx, dword [rax + 0x90]
nop dword [rax + rax]
cmp ecx, 2
je 0x4372d4
nop
mov ecx, 1
lea rdx, [0x01f9ffc8]
lock xadd qword [rdx], rcx
mov rdx, qword [0x01f9ffd8]
cmp rcx, rdx
jge 0x4372c6
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x10], rcx
movups xmmword [rsp + 0x18], xmm15
mov qword [rsp + 0x28], 0
lea rdx, [0x00437340]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp], rdx
call fcn.00477ac0
xorps xmm15, xmm15
mov r14, qword [0x0203d8d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [0x01f9ffe8]
test rax, rax
je 0x4372c0
mov rcx, qword [0x01f9fff0]
mov rdx, qword [rsp + 0x10]
cmp rdx, rcx
jae 0x4372cc
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x158]
cmp dword [0x0203dd30], 0
je 0x4372bc
call fcn.00479b20
mov qword [r11], rcx
mov rbx, qword [rax + rdx*8]
mov qword [r11 + 8], rbx
mov qword [rax + rdx*8], rcx
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov rax, rdx
call fcn.00479ec0
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x10], rax
call fcn.00441a60
lea rax, [0x010ad0af]
mov ebx, 0x1d
call fcn.004422e0
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00442020
call fcn.00441ca0
call fcn.00441ac0
lea rax, [0x010c4abd]
mov ebx, 0x26
nop dword [rax + rax]
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
call fcn.00477be0
mov rax, qword [rsp + 8]
jmp fcn.004371e0
Function at 0x439a00
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x439c86
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
lea rsi, [rax + 0x1298]
mov rcx, qword [rax + 0x1288]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x439c7a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1288], 0
cmp byte [0x0203d479], 0
jne 0x439a5a
xor edx, edx
xor ebx, ebx
jmp 0x439aa0
xor edx, edx
jmp 0x439a85
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1298]
mov rax, rcx
call fcn.004263c0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x439a5e
add rax, 0x1288
call fcn.00439980
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x439c14
mov rsi, qword [rax + rdx*8 + 0x1298]
cmp rsi, 0x1000
jb 0x439a9b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00419a80
test rax, rax
jne 0x439aec
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x439a9b
mov rsi, qword [rbx + 0x48]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x439b2c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x439a9b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x439c6d
lea r10, [0x01fcf578]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x1040]
lea r8, [r8 + r10]
lea r8, [r8 + 0x1040]
test r11b, r9b
jne 0x439baf
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x439be5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1270]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1270], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x439a9b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x439c65
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1298], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x439a9b
cmp rbx, 0x200
ja 0x439c54
lea rdx, [rax + 0x1298]
lea rsi, [rax + 0x1260]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.0042cec0
mov rax, qword [rsp + 0x48]
add rax, 0x1288
call fcn.00439980
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00479f40
mov rax, r8
call fcn.00479ec0
mov rax, r8
mov ecx, 0x40
call fcn.00479ee0
mov edx, 0x200
nop
call fcn.00479f20
nop
mov qword [rsp + 8], rax
call fcn.0047eb20
mov rax, qword [rsp + 8]
jmp fcn.00439a00
Function at 0x43a6e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43a7ad
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rax, qword [0x01ec1498]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
call fcn.0043d000
xorps xmm15, xmm15
mov r14, qword [0x0203d8d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x01ec18f0], rax
test rax, rax
je 0x43a744
add rsp, 0x38
pop rbp
ret
call fcn.0047b360
xorps xmm15, xmm15
mov r14, qword [0x0203d8d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00441a60
lea rax, [0x010d9c33]
mov ebx, 0x2f
call fcn.004422e0
mov rax, qword [rsp + 0x30]
nop
call fcn.00442020
lea rax, [0x01086f7e]
mov ebx, 3
call fcn.004422e0
call fcn.00441ac0
lea rax, [0x010a8bef]
mov ebx, 0x1b
call fcn.0043ffc0
nop
call fcn.00477be0
jmp fcn.0043a6e0
Function at 0x443b20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x443b6c
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rcx, qword [0x01fb7ad0]
lea rdx, [rcx + 1]
cmp rcx, rdx
jg 0x443b5a
mov qword [rsp + 0x10], rcx
mov qword [0x01fb7ad0], rdx
call fcn.00443a80
mov rax, qword [rsp + 0x10]
add rsp, 0x18
pop rbp
ret
lea rax, [0x010a8c25]
mov ebx, 0x1b
call fcn.0043ffc0
nop
call fcn.00477be0
jmp fcn.00443b20
Function at 0x447da0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x447e77
push rbp
mov rbp, rsp
sub rsp, 0x18
mov cl, byte [0x01fb7b88]
nop dword [rax + rax]
test cl, cl
je 0x447e65
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
je 0x447df2
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x01fb7afc]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x447e50
call fcn.0044ea00
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x01fb7ab8]
call fcn.00410580
mov rax, qword [rsp + 0x10]
mov dword [rax + 4], 3
mov eax, dword [0x01fb7b8c]
lea ecx, [rax - 1]
mov dword [0x01fb7b8c], ecx
cmp eax, 1
jne 0x447e36
lea rax, [0x01fb7b90]
call fcn.004108e0
nop
nop
lea rax, [0x01fb7ab8]
nop
call fcn.004107e0
call fcn.004471c0
add rsp, 0x18
pop rbp
ret
lea rax, [0x010aae88]
mov ebx, 0x1c
nop dword [rax]
call fcn.0043ffc0
lea rax, [0x010a8c5b]
mov ebx, 0x1b
call fcn.0043ffc0
nop
call fcn.00477be0
nop dword [rax]
jmp fcn.00447da0
Function at 0x449a20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x449a87
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
je 0x449a75
mov byte [rcx + 0xe4], 0
nop
mov ecx, 0xffffffff
lea rdx, [0x01fb7afc]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x449a64
call fcn.00447940
add rsp, 0x10
pop rbp
ret
lea rax, [0x010b785e]
mov ebx, 0x21
call fcn.0043ffc0
lea rax, [0x010b1b31]
mov ebx, 0x1f
call fcn.0043ffc0
nop
call fcn.00477be0
jmp fcn.00449a20

Function at 0x44b040
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [r14 + 0x30]
mov rdx, r14
cmp qword [rcx], rdx
je 0x44b079
cmp qword [rcx + 0x50], rdx
je 0x44b079
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x38], rbx
movups xmmword [rdx + 0x58], xmm15
cmp qword [rdx + 0x50], 0
je 0x44b073
call fcn.00443520
add rsp, 0x10
pop rbp
ret
lea rax, [0x010aaec0]
mov ebx, 0x1c
call fcn.0043ffc0
nop
int3
Function at 0x4506c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x450827
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4506d2
cmp edx, ecx
jne 0x450815
nop word [rax + rax]
test rsi, rsi
jne 0x450815
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x450734
nop
call fcn.0047b820
xorps xmm15, xmm15
mov r14, qword [0x0203d8d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004505e0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x450810
mov rdx, qword [0x01fb1538]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x450805
mov rcx, qword [0x01fb1530]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x01fb7af0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x01fb7af0], rax
nop
mov edx, 1
lea rsi, [0x01fb7af8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x4507f3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x010c9fc2]
mov ebx, 0x28
nop
call fcn.0043ffc0
mov rax, rsi
mov rcx, rdx
call fcn.00479ec0
call fcn.0043e820
lea rax, [0x010bc68d]
mov ebx, 0x23
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004506c0
Function at 0x450b40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x3b0]
cmp r12, qword [r14 + 0x10]
jbe 0x450cc6
push rbp
mov rbp, rsp
sub rsp, 0x428
movups xmmword [rsp + 0x20], xmm15
mov edx, edi
lea rdi, [rsp + 0x28]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0047a080
mov rbp, qword [rbp]
sub edx, ecx
shr edx, 1
cmp edx, 0x80
jne 0x450cb4
xor edx, edx
jmp 0x450bac
test byte [rax], al
lea esi, [rdx + rcx]
movzx esi, sil
mov rsi, qword [rax + rsi*8 + 0x198]
lea edi, [rdx + 1]
mov qword [rsp + rdx*8 + 0x20], rsi
mov edx, edi
cmp edx, 0x80
jb 0x450b91
lea edx, [rcx + 0x80]
mov rsi, rax
mov eax, ecx
lock cmpxchg dword [rsi + 0x190], edx
sete dl
test dl, dl
je 0x450bda
mov qword [rsp + 0x420], rbx
xor eax, eax
jmp 0x450bf3
xor eax, eax
add rsp, 0x428
pop rbp
ret
mov rsi, qword [rsp + rdx*8 + 0x20]
mov qword [rbx + 0xa0], rsi
mov eax, edx
cmp eax, 0x80
jae 0x450c10
lea edx, [rax + 1]
mov rbx, qword [rsp + rax*8 + 0x20]
cmp rdx, 0x81
jb 0x450be5
jmp 0x450ca8
movups xmmword [rsp + 0x10], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x420]
mov qword [rsp + 0x18], rcx
nop
nop
lea rax, [0x01fb7ab8]
call fcn.00410580
mov rcx, qword [rsp + 0x18]
nop
test rcx, rcx
je 0x450c7c
mov rdx, rcx
mov rbx, qword [rsp + 0x10]
mov qword [rcx + 0xa0], 0
mov rcx, qword [0x01fb7b10]
test rcx, rcx
je 0x450c6e
mov qword [rcx + 0xa0], rbx
jmp 0x450c75
mov qword [0x01fb7b08], rbx
mov qword [0x01fb7b10], rdx
add dword [0x01fb7b18], 0x81
movups xmmword [rsp + 0x10], xmm15
nop
nop
lea rax, [0x01fb7ab8]
call fcn.004107e0
mov eax, 1
add rsp, 0x428
pop rbp
ret
mov eax, edx
mov ecx, 0x81
call fcn.00479ec0
lea rax, [0x010af6a4]
mov ebx, 0x1e
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.00450b40

Function at 0x453dc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453e78
push rbp
mov rbp, rsp
sub rsp, 0x10
mov ecx, 0xffffffff
lock xadd dword [rax + 0x28], ecx
dec ecx
nop
test ecx, ecx
jge 0x453e36
cmp ecx, 0xffffffff
je 0x453e66
cmp ecx, 0xbfffffff
je 0x453e66
mov ecx, 0xffffffff
lock xadd dword [rax + 0x2c], ecx
dec ecx
nop dword [rax]
test ecx, ecx
jne 0x453e36
mov qword [rsp + 0x20], rax
nop
nop
call fcn.00410580
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x453e2f
lea rax, [rcx + 0x110]
call fcn.004108e0
mov rax, qword [rsp + 0x20]
nop
nop
call fcn.004107e0
mov rax, qword [r14 + 0x30]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x453e60
cmp byte [r14 + 0xb1], 0
je 0x453e60
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x10
pop rbp
ret
lea rax, [0x010a8cc7]
mov ebx, 0x1b
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00477be0
mov rax, qword [rsp + 8]
jmp fcn.00453dc0
Function at 0x457600
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x457736
push rbp
mov rbp, rsp
sub rsp, 0x48
cmp rcx, rbx
jae 0x45765d
mov rdx, qword [rax]
mov qword [rsp + 0x30], rdx
mov rsi, rax
mov rax, rbx
mul rdx
jo 0x457721
movabs rdx, 0x1000000000000
nop dword [rax + rax]
cmp rax, rdx
ja 0x457721
test rbx, rbx
jl 0x457721
mov rdx, qword [rsp + 0x30]
imul rcx, rdx
jmp 0x45766a
mov rcx, qword [rax]
imul rcx, rbx
mov rsi, rax
mov rax, rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x28], rcx
cmp qword [rsi + 8], 0
jne 0x4576b8
mov qword [rsp + 0x20], rax
xor ebx, ebx
xor ecx, ecx
call fcn.00411dc0
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
cmp rcx, rbx
jae 0x457707
mov qword [rsp + 0x38], rax
sub rbx, rcx
lea rdx, [rax + rcx]
mov rax, rdx
call fcn.0047a5a0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
jmp 0x457707
mov qword [rsp + 0x40], rsi
mov rbx, rsi
mov ecx, 1
call fcn.00411dc0
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x457707
cmp byte [0x0203dd30], 0
je 0x457707
mov qword [rsp + 0x38], rax
mov rdx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, rbx
mov rdi, qword [rsp + 0x40]
mov rax, rdx
mov rbx, rsi
call fcn.0041aca0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x70]
call fcn.0047a8a0
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbp
ret
nop
lea rax, [0x00f359c0]
lea rbx, [0x0179a1a0]
call fcn.0043f400
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00457600

Function at 0x457780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45781f
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rsi, rax
mov rax, rdx
mov rdi, rax
mul rcx
jo 0x457813
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x4577cf
test rbx, rbx
jl 0x4577cf
cmp rcx, rbx
jl 0x4577cf
mov rbx, rsi
mov ecx, 1
call fcn.00411dc0
add rsp, 0x18
pop rbp
ret
mov rax, rdi
mul rbx
jno 0x4577eb
nop
lea rax, [0x00f359c0]
lea rbx, [0x0179a1a0]
call fcn.0043f400
movabs rcx, 0x1000000000000
cmp rax, rcx
ja 0x4577d7
test rbx, rbx
jl 0x4577d7
nop
lea rax, [0x00f359c0]
lea rbx, [0x0179a1b0]
call fcn.0043f400
movabs rdx, 0x1000000000000
jmp 0x4577cf
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00457780
Function at 0x458d20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458ece
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x38], rsi
mov rdx, rax
mov qword [rsp + 0x30], rax
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
mov r10, qword [rcx + 0x10]
movsxd r11, dword [rbx]
mov qword [rsp + 0x28], r11
mov rcx, qword [rcx + 0x18]
xor r12d, r12d
nop
jmp 0x458d66
lea r12, [r13 + 8]
cmp r12, r11
jae 0x458d82
mov qword [rsp + 0x20], r12
mov r13, r12
shr r12, 3
add r12, qword [rbx + 8]
movzx r12d, byte [r12]
jmp 0x458d92
add rsp, 0x50
pop rbp
ret
mov rbx, qword [rsp + 0x68]
mov r11, qword [rsp + 0x28]
test r12b, r12b
je 0x458d62
bsf r15d, r12d
lea ebx, [r12 - 1]
add r15, r13
and r12d, ebx
lea rbx, [rdx + r15*8]
jmp 0x458dd1
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
jmp 0x458d88
add r11, r10
mov qword [rdx + r15*8], r11
nop
jmp 0x458d88
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r11, qword [rsp + 0x28]
mov r11, qword [rdx + r15*8]
mov qword [rsp + 0x18], r11
test rdi, rdi
je 0x458e01
lea r13, [r11 - 1]
cmp r13, 0xfff
jae 0x458dfc
cmp dword [0x0203e568], 0
jne 0x458e32
mov r13, qword [rsp + 0x20]
jmp 0x458e01
mov r13, qword [rsp + 0x20]
cmp r11, r8
jb 0x458d88
cmp r11, r9
jae 0x458d88
cmp rcx, rax
jbe 0x458db8
mov rsi, qword [rsp + 0x18]
add rsi, r10
mov rax, r11
lock cmpxchg qword [rbx], rsi
sete sil
test sil, sil
je 0x458dc2
jmp 0x458dac
mov qword [rsp + 0x48], rbx
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf1], 2
mov ebx, dword [rdi + 4]
mov rax, rsi
call fcn.0045de00
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x10], rbx
call fcn.00441a60
lea rax, [0x010af6c2]
mov ebx, 0x1e
call fcn.004422e0
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x10]
call fcn.004422e0
lea rax, [0x01087b0d]
mov ebx, 4
call fcn.004422e0
mov rax, qword [rsp + 0x48]
call fcn.00442260
lea rax, [0x01086b54]
mov ebx, 2
call fcn.004422e0
mov rax, qword [rsp + 0x18]
call fcn.00442160
call fcn.00441ca0
call fcn.00441ac0
lea rax, [0x010af6e0]
mov ebx, 0x1e
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00477be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00458d20
Function at 0x45a520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a68a
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [rax], 0
je 0x45a678
nop
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x45a572
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
cmp rax, rdx
jne 0x45a667
mov rsi, r14
cmp rsi, rdx
je 0x45a667
cmp ecx, 2
jne 0x45a667
cmp qword [rax + 0x70], 0
jne 0x45a594
cmp byte [rax + 0xb4], 0
je 0x45a586
xor ecx, ecx
jmp 0x45a596
nop
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x45a596
xor ecx, ecx
test cl, cl
je 0x45a656
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x45a5bd
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x3f0], 0
jne 0x45a645
cmp dword [0x0203e55c], 0
jg 0x45a63f
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x128]
mov rax, rcx
call fcn.0045e220
test rax, rax
je 0x45a5eb
cmp byte [rax + 0x28], 7
jne 0x45a5eb
add rsp, 0x10
pop rbp
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rdx, rcx
mov rcx, rdx
shr rdx, 1
cmp rdx, 0x2000
jb 0x45a639
mov rsi, qword [rax + 0x38]
sub rbx, rsi
lea rsi, [rbx + 0x320]
shr rcx, 2
nop
cmp rcx, rsi
ja 0x45a62b
add rsp, 0x10
pop rbp
ret
mov rbx, rdx
call fcn.00459420
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
lea rax, [0x010a6d0a]
mov ebx, 0x1a
call fcn.0043ffc0
lea rax, [0x010a1500]
mov ebx, 0x17
call fcn.0043ffc0
lea rax, [0x010a4d3f]
mov ebx, 0x19
call fcn.0043ffc0
lea rax, [0x010aaf4c]
mov ebx, 0x1c
call fcn.0043ffc0
nop
mov qword [rsp + 8], rax
call fcn.00477be0
mov rax, qword [rsp + 8]
jmp fcn.0045a520