joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4330e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x433390
push rbp
mov rbp, rsp
sub rsp, 0x68
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x006114a8]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.00434a40
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x43320e
jne 0x433173
cmp dword [rsp + 0x4c], 0
nop
jne 0x433173
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x43320e
mov rax, qword [0x006114a0]
mov rcx, qword [r14 + 0x30]
movups xmmword [rcx + 0x3c0], xmm15
call fcn.00434860
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x006975ea]
mov ebx, 0x20
mov ecx, 0x21
call fcn.004334c0
cmp rax, 0x20
je 0x4331d2
lea rax, [0x006975ea]
mov ebx, 0x20
mov ecx, 0x21
call fcn.004482e0
mov rcx, qword [0x00696738]
nop dword [rax]
cmp rcx, 0x105
ja 0x433385
mov qword [rsp + 0x58], rcx
lea rax, [0x00697400]
lea rbx, [0x00696de0]
call fcn.00467180
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x433220
add rsp, 0x68
pop rbp
ret
mov byte [rdx + rbx + 1], dil
inc rax
nop dword [rax]
cmp rax, 0x20
jge 0x43328e
lea rdx, [rcx + rax*2]
lea rbx, [0x00697400]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x004e14ba]
movzx esi, byte [rdi + rsi]
cmp rdx, 0x20b
jae 0x433377
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
nop word [rax + rax]
cmp rsi, 0x20b
jb 0x433214
jmp 0x43336a
lea rdx, [rcx + 0x40]
jmp 0x4332a2
lea rbx, [0x00697400]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x4332b9
cmp rdx, 0x20b
jb 0x433294
jmp 0x43335d
mov rax, qword [sym.imp.kernel32.dll_CreateFileA]
lea rcx, [0x00697400]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.00434c40
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00467c40
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x433350
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.00438ae0
lea rax, [0x004eb08b]
mov ebx, 0x5f
nop
call fcn.00439360
call fcn.00438b40
add rsp, 0x68
pop rbp
ret
mov byte [0x00696609], 1
add rsp, 0x68
pop rbp
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.00466800
mov rax, rsi
mov ecx, 0x20b
call fcn.00466800
mov rax, rdx
mov ecx, 0x20b
nop
call fcn.00466800
mov edx, 0x105
call fcn.00466860
nop
call fcn.00464520
jmp fcn.004330e0
Function at 0x434cc0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x60], 0
mov rcx, qword [0x00696838]
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x3c0], 8
lea rdx, [rsp + 0x20]
mov qword [rcx + 0x3c8], rdx
mov rax, qword [rsp + 0x18]
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00434860
mov qword [rsp + 0x60], rax
add rsp, 8
pop rbp
ret
Function at 0x437700
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x437847
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x10], r14
cmp qword [0x0062f008], 0
nop
jne 0x43773d
call fcn.00438ae0
lea rax, [0x004e9ae3]
mov ebx, 0x2e
call fcn.00439360
call fcn.00438b40
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
jge 0x437763
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x4377f2
cmp edx, 1
je 0x4377c1
cmp edx, 2
jne 0x4377af
mov dword [rcx + 0xdc], 3
call fcn.00438ae0
lea rax, [0x004e465a]
mov ebx, 0x18
call fcn.00439360
nop
call fcn.00438b40
mov eax, 4
call fcn.004337a0
mov eax, 5
call fcn.004337a0
xor eax, eax
add rsp, 0x18
pop rbp
ret
mov dword [rcx + 0xdc], 2
call fcn.00438ae0
lea rax, [0x004e2707]
mov ebx, 0x13
nop dword [rax]
call fcn.00439360
call fcn.00438b40
xor eax, eax
add rsp, 0x18
pop rbp
ret
mov dword [rcx + 0xdc], 1
nop
mov ecx, 1
lea rdx, [0x00696650]
lock xadd dword [rdx], ecx
nop
nop
lea rax, [0x00696758]
call fcn.0040bd80
cmp dword [0x00696bfc], 0
jg 0x43782d
cmp dword [0x00696bf8], 0
jle 0x437837
mov eax, 1
call fcn.00446440
call fcn.0043afe0
mov eax, 1
add rsp, 0x18
pop rbp
ret
call fcn.00464520
jmp fcn.00437700
Function at 0x43a820
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43aacb
push rbp
mov rbp, rsp
sub rsp, 0x28
nop
mov qword [0x00696a70], 0xf
nop
mov qword [0x00696ab0], 0x10
mov qword [rsp + 0x20], r14
mov dword [0x00612bf8], 0x2710
lea rax, [0x006969a0]
call fcn.00448640
lea rax, [0x005fd3c0]
jmp 0x43a884
mov qword [rsp + 0x18], rax
call fcn.00451120
mov rcx, qword [rsp + 0x18]
mov rax, qword [rcx + 0x248]
test rax, rax
jne 0x43a86e
xor eax, eax
jmp 0x43a8aa
mov rcx, rax
shl rcx, 6
lea rdx, [0x00696cc0]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 8]
inc rax
movups xmmword [rcx], xmm15
cmp rax, 2
jl 0x43a88d
xor eax, eax
jmp 0x43a8cc
mov rcx, rax
shl rcx, 4
lea rdx, [0x00697628]
add rcx, rdx
inc rax
movups xmmword [rcx], xmm15
cmp rax, 0x23
jl 0x43a8b4
call fcn.0040c6a0
nop
xor eax, eax
xor ebx, ebx
nop dword [rax]
call fcn.00401aa0
movzx eax, byte [0x00696d8d]
mov byte [0x0069660d], al
movzx eax, byte [0x00696d92]
mov byte [0x0069660e], al
movzx eax, byte [0x00696d8a]
mov byte [0x0069660f], al
call fcn.00448140
call fcn.00404b60
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rcx
call fcn.0043abe0
call fcn.00450f00
call fcn.0045d3a0
call fcn.0040ab80
nop dword [rax]
call fcn.0044f500
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x30]
test byte [rax], al
call fcn.00433540
call fcn.00448ec0
call fcn.004195c0
mov eax, 0x4000
call fcn.0044c980
mov qword [0x00611fe0], rax
mov qword [0x00611fe8], rbx
add rax, 0x3e8
mov qword [0x00611ff0], rax
mov qword [0x00611ff8], rax
cmp byte [0x00601a40], 0
je 0x43a99f
mov qword [0x005fc378], 0
nop
nop
lea rax, [0x00612bd8]
call fcn.0040bd80
nop
call fcn.00468100
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp]
nop
lea rdx, [0x00612bc8]
xchg qword [rdx], rcx
mov ecx, dword [0x0069666c]
mov dword [rsp + 0x14], ecx
lea rax, [0x004dfd04]
mov ebx, 0xa
call fcn.00407fa0
call fcn.00450020
movsxd rcx, eax
cmp rax, rcx
sete cl
mov edx, 0
cmove edx, eax
and ecx, ebx
test cl, cl
je 0x43aa0f
test edx, edx
jg 0x43aa13
mov edx, dword [rsp + 0x14]
mov eax, edx
call fcn.00444820
nop word [rax + rax]
test rax, rax
jne 0x43aab9
nop
nop
lea rax, [0x00612bd8]
call fcn.0040bfe0
cmp qword [0x00601e08], 0
nop
jne 0x43aa76
mov qword [0x00601e08], 7
cmp dword [0x00696870], 0
je 0x43aa68
mov rax, qword [str.go1.22.0]
nop dword [rax]
call fcn.00466440
mov qword [r11], rax
lea rax, [0x004df58e]
mov qword [str.go1.22.0], rax
cmp qword [0x00601ec8], 1
nop
jne 0x43aab3
mov qword [0x00601ec8], 0
cmp dword [0x00696870], 0
je 0x43aaa8
mov rax, qword [0x00601ec0]
nop dword [rax]
call fcn.00466440
mov qword [r11], rax
mov qword [0x00601ec0], 0
add rsp, 0x28
pop rbp
ret
lea rax, [0x004e9419]
mov ebx, 0x2b
call fcn.00437040
nop
call fcn.00464520
jmp 0x43a820
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x43a820
Function at 0x43d600
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov byte [rsp + 0x40], al
cmp byte [0x0069660c], 0
jne 0x43d636
nop
mov eax, 2
lea rbx, [0x004e9199]
mov ecx, 0x2a
call fcn.00455700
mov eax, 1
call fcn.004337a0
call fcn.0043dd00
mov qword [rsp + 0x28], rax
mov byte [rax + 0xf0], bl
mov qword [rsp], rax
call fcn.00468120
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp], rcx
call fcn.00466240
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rbx, [rsp + 0x40]
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x40]
call fcn.00405040
mov rax, qword [rsp + 0x28]
mov byte [rax + 0xea], 0
call fcn.00464320
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
nop dword [rax + rax]
call fcn.004342e0
movzx eax, byte [rsp + 0x40]
test al, al
je 0x43d6d4
xor ebx, ebx
xor ecx, ecx
jmp 0x43d6f8
mov rdx, qword [0x006965d0]
nop dword [rax + rax]
test rdx, rdx
jne 0x43d6eb
xor ebx, ebx
xor ecx, ecx
jmp 0x43d6f8
call fcn.00456940
mov rcx, rax
movzx eax, byte [rsp + 0x40]
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx + 0x90]
mov ebx, 6
mov ecx, 3
call fcn.0043b9c0
nop
mov edx, 0xffffffff
lea rsi, [0x00612c08]
lock xadd dword [rsi], edx
movzx edx, byte [rsp + 0x40]
test dl, dl
jne 0x43d79c
mov rbx, qword [rsp + 0x18]
nop dword [rax]
test rbx, rbx
je 0x43d79c
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdx + 0x90]
mov rax, qword [rsp + 0x20]
call fcn.00457f20
nop
mov edx, 1
mov rsi, qword [rsp + 0x20]
lock xadd qword [rsi + 0x398], rdx
mov edx, dword [rsi + 0xd8]
lea edi, [rdx - 1]
nop
mov dword [rsi + 0xd8], edi
nop
cmp edx, 1
jne 0x43d797
cmp byte [r14 + 0xb1], 0
je 0x43d797
mov qword [r14 + 0x10], 0xfffffffffffffade
movzx edx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x28]
mov byte [rax + 0xeb], dl
add rsp, 0x30
pop rbp
ret
Function at 0x43ddc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43df0f
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043d2e0
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43dec7
mov rcx, qword [rdx + 0x30]
test rcx, rcx
je 0x43dec7
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x230], 0
jne 0x43de35
cmp byte [rcx + 0xe8], 0
je 0x43dec7
nop
nop
lea rax, [0x00696a00]
nop
call fcn.0040bd80
cmp dword [0x00696a20], 0
je 0x43defd
mov rcx, qword [0x00696a08]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x120], rcx
nop
mov qword [0x00696a08], rdx
cmp byte [0x00696a10], 0
je 0x43de89
mov byte [0x00696a10], 0
lea rax, [0x00696a18]
call fcn.0040c0e0
nop
nop
lea rax, [0x00696a00]
call fcn.0040bfe0
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43dec1
cmp byte [r14 + 0xb1], 0
je 0x43dec1
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x20
pop rbp
ret
call fcn.0043df40
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43def7
cmp byte [r14 + 0xb1], 0
je 0x43def7
mov qword [r14 + 0x10], 0xfffffffffffffade
add rsp, 0x20
pop rbp
ret
lea rax, [0x004e91c3]
mov ebx, 0x2a
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043ddc0
Function at 0x43eae0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ed3c
push rbp
mov rbp, rsp
sub rsp, 0x48
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x128]
nop dword [rax]
test rdx, rdx
je 0x43ed2a
mov rdx, qword [rdx + 0xd0]
cmp rdx, rcx
jne 0x43ed2a
mov qword [rsp + 0x38], r14
cmp qword [rcx + 0xa0], 0
je 0x43eb32
call fcn.00445420
call fcn.0043e640
mov eax, 1
call fcn.00445600
mov qword [rsp + 0x30], r14
mov rax, qword [r14 + 0x30]
test byte [rax], al
add rax, 0x110
nop
call fcn.0040c160
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x110], 0
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x128]
mov edx, dword [rdx + 0x90]
mov ebx, edx
and edx, 0xffffefff
cmp edx, 1
jne 0x43ebb4
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.004451c0
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
add rsp, 0x48
pop rbp
ret
mov dword [rsp + 0x14], ebx
call fcn.00438ae0
lea rax, [0x004e946f]
mov ebx, 0x2b
call fcn.00439360
mov eax, dword [rsp + 0x14]
mov eax, eax
call fcn.004390a0
lea rax, [0x004e8063]
mov ebx, 0x24
call fcn.00439360
call fcn.00438b40
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x128]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x20], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00438ae0
lea rax, [0x004e2123]
mov ebx, 0x12
call fcn.00439360
mov rax, qword [rsp + 0x40]
nop dword [rax]
call fcn.004392e0
lea rax, [0x004df5c6]
mov ebx, 7
call fcn.00439360
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.004390a0
lea rax, [0x004e25fd]
mov ebx, 0x13
call fcn.00439360
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004390a0
call fcn.00438d20
call fcn.00438b40
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x20], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00438ae0
lea rax, [0x004e2135]
mov ebx, 0x12
nop
call fcn.00439360
mov rax, qword [rsp + 0x28]
call fcn.004392e0
lea rax, [0x004df5c6]
mov ebx, 7
nop dword [rax + rax]
call fcn.00439360
mov rax, qword [rsp + 0x18]
call fcn.004390a0
lea rax, [0x004e271a]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00439360
mov rax, qword [rsp + 0x20]
call fcn.004390a0
call fcn.00438d20
call fcn.00438b40
lea rax, [0x004e4c4e]
mov ebx, 0x19
call fcn.00437040
lea rax, [0x004e7621]
mov ebx, 0x21
call fcn.00437040
nop
nop dword [rax]
call fcn.00464520
jmp fcn.0043eae0
Function at 0x442100
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x006965d0]
test rcx, rcx
jne 0x442124
xor ecx, ecx
xor edx, edx
jmp 0x442139
call fcn.00456940
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], r14
mov rsi, qword [r14 + 0x30]
inc dword [rsi + 0xd8]
mov qword [r14 + 0x10], 0xfffffffffffffade
mov byte [r14 + 0xb7], 1
call fcn.004420a0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x78], rdx
mov ebx, 2
mov ecx, 3
call fcn.0043b9c0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x70]
cmp qword [rcx], rdx
ja 0x4421a6
nop dword [rax + rax]
cmp qword [rcx + 8], rdx
jae 0x4421e2
movups xmmword [rsp + 0x40], xmm15
lea rax, [0x00442400]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.00464400
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x44224b
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 0
lea rcx, [0x00442380]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
nop
call fcn.00464400
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.004420a0
mov rcx, qword [rsp + 0x20]
mov al, byte [0x00612cb8]
test al, al
je 0x44228b
lea rax, [0x004ebd58]
mov qword [rsp], rax
call fcn.00464400
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.004420a0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
cmp dword [rax + 0x2298], 0
nop
je 0x4422d8
lea rax, fcn.0043d240
mov qword [rsp], rax
call fcn.00464400
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.004420a0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rax + 0xa0]
mov edx, dword [rdx + 0x14]
mov dword [rax + 0x388], edx
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rax + 0x38], 0
mov rdx, qword [rcx + 0x30]
mov rbx, rax
mov qword [rdx + 0xb0], rax
mov rax, qword [rcx + 0x30]
mov qword [rax + 0xa0], 0
mov eax, 2
xchg dword [rbx + 4], eax
mov al, byte [0x00612ca8]
test al, al
je 0x442364
lea rax, [0x004ebd50]
mov qword [rsp], rax
call fcn.00464400
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.004420a0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x50
pop rbp
ret
Function at 0x4470e0
Capabilities:
Encode data using base64
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x447247
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4470f2
cmp edx, ecx
jne 0x447235
nop word [rax + rax]
test rsi, rsi
jne 0x447235
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x447154
nop
call fcn.00468100
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00447000
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x447230
mov rdx, qword [0x006118e8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x447225
mov rcx, qword [0x006118e0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00612c10]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00612c10], rax
nop
mov edx, 1
lea rsi, [0x00612c18]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x447213
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004e8c71]
mov ebx, 0x28
nop
call fcn.00437040
mov rax, rsi
mov rcx, rdx
call fcn.00466800
call fcn.00435c20
lea rax, [0x004e7c9e]
mov ebx, 0x23
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004470e0
Function at 0x44aec0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x44af08
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x44af08
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x44af18
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.00434a40
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x44aff1
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.00434cc0
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x44aff1
cmp qword [rcx + 8], rax
ja 0x44af13
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x44b120
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x48], r14
mov edx, dword [0x00696650]
test edx, edx
je 0x44b15a
mov eax, 2
call fcn.004337a0
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
nop
mov ecx, 1
lea rdx, [0x00696650]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x48]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x40], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x38], rsi
mov rdi, qword [rax + 0x28]
mov qword [rsp + 0x30], rdi
mov r8, qword [rbx + 0xf8]
mov qword [rsp + 0x28], r8
call fcn.00438ae0
lea rax, [0x004dfe4e]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00439360
mov rax, qword [rsp + 0x40]
call fcn.004391e0
call fcn.00438ce0
mov rax, qword [rsp + 0x38]
call fcn.004391e0
nop
call fcn.00438ce0
mov rax, qword [rsp + 0x30]
call fcn.004391e0
call fcn.00438ce0
mov rax, qword [rsp + 0x28]
call fcn.004391e0
nop
call fcn.00438d20
call fcn.00438b40
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x28], rcx
nop dword [rax + rax]
call fcn.00438ae0
lea rax, [0x004df05f]
mov ebx, 3
call fcn.00439360
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.004391e0
call fcn.00438d20
call fcn.00438b40
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe8], 0
nop
je 0x44b2b7
mov rdx, qword [rsp + 0x78]
cmp qword [rcx], rdx
jne 0x44b2b2
cmp qword [rcx + 0x90], 0
je 0x44b2ad
cmp byte [0x0069660b], 0
je 0x44b2a0
nop
call fcn.00438ae0
lea rax, [0x004e9b3f]
mov ebx, 0x2e
call fcn.00439360
call fcn.00438b40
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x90]
jmp 0x44b2bc
mov rcx, rdx
jmp 0x44b2bc
mov rcx, rdx
jmp 0x44b2bc
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rcx
call fcn.00438ae0
call fcn.00438d20
call fcn.00438b40
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 2
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
mov qword [rax + 0x98], rcx
mov eax, dword [0x005fc330]
mov rcx, qword [r14 + 0x30]
movzx edx, byte [rcx + 0xf1]
test dl, dl
jne 0x44b320
mov edx, eax
shr edx, 2
cmp dword [rcx + 0xc4], 2
mov esi, 2
cmovae edx, esi
nop
test edx, edx
jle 0x44b35d
mov dword [rsp + 0x24], eax
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
xor ecx, ecx
nop dword [rax]
call fcn.0045a520
mov rax, qword [rsp + 0x50]
call fcn.0045c060
mov rax, qword [rsp + 0x70]
call fcn.00407a20
mov eax, dword [rsp + 0x24]
bt eax, 0
jae 0x44b372
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
call fcn.0044b620
mov eax, 2
call fcn.004337a0
add rsp, 0x58
pop rbp
ret