joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c0a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x41c2b8
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp dword [0x00696628], 0
jne 0x41c2a6
mov qword [rsp + 0x40], rax
nop
nop
lea rax, [0x00618540]
call fcn.0040bd80
add dword [0x00628680], 2
nop
nop
xor ecx, ecx
lea rdx, [0x00611b54]
xchg dword [rdx], ecx
nop
xor ecx, ecx
lea rdx, [0x006286a8]
xchg qword [rdx], rcx
mov rcx, qword [0x00628970]
mov rdx, qword [0x00628978]
mov rbx, qword [0x00628968]
mov qword [0x00628988], rcx
mov qword [0x00628990], rdx
cmp dword [0x00696870], 0
je 0x41c133
nop
call fcn.00466460
mov qword [r11], rbx
mov rcx, qword [0x00628980]
mov qword [r11 + 8], rcx
mov qword [0x00628980], rbx
nop
xor ecx, ecx
lea rdx, [0x006286c8]
xchg qword [rdx], rcx
nop
xor ecx, ecx
lea rdx, [0x006286d0]
xchg qword [rdx], rcx
nop
nop
lea rax, [0x00618540]
nop dword [rax]
call fcn.0040bfe0
nop
xor ecx, ecx
lea rdx, [0x00611b58]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x40]
cmp rcx, 2
jne 0x41c1c2
nop
nop
lea rax, [0x00618540]
call fcn.0040bd80
xorps xmm0, xmm0
movsd qword [0x006286c0], xmm0
nop
nop
lea rax, [0x00618540]
nop
call fcn.0040bfe0
mov rcx, qword [0x006118c0]
mov qword [rsp + 0x28], rcx
mov rdx, qword [0x006118c8]
mov qword [rsp + 0x20], rdx
xor eax, eax
nop
jmp 0x41c237
nop
nop
lea rax, [0x00611b40]
call fcn.0040bd80
cmp byte [0x00611b50], 0
je 0x41c1f3
mov byte [0x00611b50], 0
mov rax, qword [0x00611b48]
xor ebx, ebx
mov ecx, 1
call fcn.0043ad60
nop
nop
lea rax, [0x00611b40]
nop dword [rax]
call fcn.0040bfe0
xor eax, eax
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x18], rax
mov rdx, qword [rcx + rax*8]
mov rdx, qword [rdx + 0x40]
mov rax, rdx
nop dword [rax]
call fcn.004159e0
mov rax, qword [rsp + 0x18]
inc rax
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
cmp rax, rdx
jl 0x41c20d
nop dword [rax]
call fcn.00424e40
cmp rax, 0xffffffffffffffff
jne 0x41c23c
call fcn.004273e0
xor eax, eax
call fcn.004274e0
test al, al
jne 0x41c250
nop
nop
nop
mov eax, dword [0x00696634]
mov ecx, eax
shr ecx, 1
lea edx, [rcx + 1]
mov ebx, 0xaaaaaaab
imul rdx, rbx
shr rdx, 0x3a
lea edx, [rdx + rdx*2]
shl edx, 0x19
sub ecx, edx
inc ecx
shl ecx, 1
lea rdx, [0x00696634]
lock cmpxchg dword [rdx], ecx
sete cl
test cl, cl
je 0x41c25d
call fcn.0042eca0
mov eax, 1
add rsp, 0x30
pop rbp
ret
lea rax, [0x004e8e30]
mov ebx, 0x29
call fcn.00437040
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.0046b0c0
mov rax, qword [rsp + 8]
jmp fcn.0041c0a0
Function at 0x41c580
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
cmp rdi, 0x989680
jb 0x41c5b9
mov rdx, rax
movabs rax, 0x8637bd05af6c69b6
mov rsi, rdx
mul rdi
shr rdx, 0x13
lea rdi, [rbx - 1]
mov rax, rdi
jmp 0x41c6e5
shr rdi, 1
mov rdx, rax
movabs rax, 0x83126e978d4fdf3c
mov rsi, rdx
mul rdi
shr rdx, 8
test rdx, rdx
je 0x41c5e0
mov eax, 3
jmp 0x41c62a
test rbx, rbx
jbe 0x41c608
mov byte [rsi], 0x30
cmp rcx, 1
jb 0x41c5fc
mov rax, rsi
mov ebx, 1
add rsp, 0x10
pop rbp
ret
mov ecx, 1
xor edx, edx
call fcn.00466880
xor eax, eax
mov rcx, rax
call fcn.00466800
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mul rdx
shr rdx, 3
lea rax, [rdi - 1]
cmp rdx, 0x64
jae 0x41c612
mov rdi, rbx
sub rdi, rax
lea r8, [rbx - 1]
dec rdi
jmp 0x41c642
mov r8, rax
cmp rdx, 0xa
jae 0x41c64d
cmp r8, rdi
jl 0x41c696
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, r8
jbe 0x41c6d4
add r9, 0x30
mov byte [rsi + r8], r9b
lea rax, [r8 - 1]
nop dword [rax]
cmp rax, rdi
jne 0x41c63f
cmp rbx, rax
jbe 0x41c6cc
mov byte [r8 + rsi - 1], 0x2e
lea rax, [r8 - 2]
jmp 0x41c63f
cmp rbx, r8
jbe 0x41c6c1
add rdx, 0x30
mov byte [rsi + r8], dl
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rdx, r8
lea rax, [rdx + rsi]
sub rbx, r8
add rsp, 0x10
pop rbp
nop
ret
mov rax, r8
mov rcx, rbx
call fcn.00466800
mov rcx, rbx
call fcn.00466800
mov rax, r8
mov rcx, rbx
call fcn.00466800
mov rdi, rax
mov rax, r8
cmp rdx, 0xa
jae 0x41c6f0
cmp rdi, rax
jl 0x41c737
mov r8, rax
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, rdi
jbe 0x41c774
add r9, 0x30
mov byte [rsi + rdi], r9b
lea rax, [rdi - 1]
cmp rax, r8
jne 0x41c6df
cmp rbx, rax
jbe 0x41c76c
mov byte [rdi + rsi - 1], 0x2e
lea rax, [rdi - 2]
jmp 0x41c6df
cmp rbx, rdi
jbe 0x41c761
add rdx, 0x30
mov byte [rsi + rdi], dl
sub rcx, rdi
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rdx, rdi
lea rax, [rsi + rdx]
sub rbx, rdi
add rsp, 0x10
pop rbp
nop
ret
mov rax, rdi
mov rcx, rbx
call fcn.00466800
mov rcx, rbx
call fcn.00466800
mov rax, rdi
mov rcx, rbx
call fcn.00466800
nop

Function at 0x41c780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c7f8
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41c7e6
cmp byte [rdx + 0x20], bl
je 0x41c7d5
mov qword [rsp + 0x10], rdx
mov byte [rsp + 0x30], bl
mov rax, rdx
mov rbx, rcx
call fcn.0041c960
movzx ecx, byte [rsp + 0x30]
mov rdx, qword [rsp + 0x10]
mov byte [rdx + 0x20], cl
mov byte [rdx + 0x21], 1
add rsp, 0x18
pop rbp
ret
lea rax, [0x004e97b1]
mov ebx, 0x2d
call fcn.00437040
lea rax, [0x004e9ce1]
mov ebx, 0x2f
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041c780
Function at 0x41c820
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c88c
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp byte [rax + 0x21], 0
je 0x41c87a
mov rdx, qword [rax + 0x40]
cmp rdx, rbx
jg 0x41c866
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rcx, rbx
sub rcx, rdx
movsxd rdx, dword [rax + 0x4c]
imul rcx, rdx
xor ebx, ebx
call fcn.0041cb60
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
nop
xchg qword [rax + 0x40], rbx
mov byte [rax + 0x21], 0
call fcn.0041cc00
add rsp, 0x18
pop rbp
ret
lea rax, [0x004e9d10]
mov ebx, 0x2f
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041c820

Function at 0x41cc60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41cd06
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41ccf2
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0x38], ecx
mov rax, rdx
call fcn.0041c960
mov ecx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x10]
mov dword [rax + 0x4c], ecx
movsxd rcx, ecx
imul rcx, rcx, 0x3b9aca00
mov qword [rax + 0x10], rcx
mov rdx, qword [rax + 8]
cmp rdx, rcx
jbe 0x41ccdb
mov qword [rax + 8], rcx
lea rcx, [rax + 4]
nop
nop
mov edx, 1
xchg byte [rcx], dl
mov ecx, dword [0x0069a258]
inc ecx
xchg dword [rax + 0x48], ecx
jmp 0x41cce7
jae 0x41cce7
lea rcx, [rax + 4]
nop
nop
xor edx, edx
xchg byte [rcx], dl
call fcn.0041cc00
add rsp, 0x18
pop rbp
ret
lea rax, [0x004e8b81]
mov ebx, 0x28
nop
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.0041cc60
Function at 0x41cde0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41cf2b
push rbp
mov rbp, rsp
sub rsp, 0x18
jmp 0x41cdf7
mov rax, rdx
mov rdx, qword [rax]
mov rsi, rdx
shr rdx, 0x3d
cmp bl, dl
jne 0x41cec7
mov rdx, rax
mov rax, rsi
xor edi, edi
lock cmpxchg qword [rdx], rdi
sete r8b
test r8b, r8b
je 0x41cdf4
movabs rdx, 0xe000000000000000
and rdx, rcx
movabs rdi, 0x1fffffffffffffff
and rdi, rsi
or rdx, rdi
mov rsi, rcx
sub rcx, rdx
cmp rsi, rdx
mov edx, 0
cmovl rcx, rdx
test rcx, rcx
je 0x41ceb0
cmp bl, 2
ja 0x41ce73
cmp bl, 1
jne 0x41ce6c
nop
lea rax, [0x00696b98]
lock xadd qword [rax], rcx
jmp 0x41ceaa
cmp bl, 2
je 0x41ce78
jmp 0x41ceb6
cmp bl, 3
jne 0x41ce87
nop
lea rax, [0x00696b88]
lock xadd qword [rax], rcx
jmp 0x41ceaa
cmp bl, 4
jne 0x41ceb6
nop
nop
lea rax, [0x00696b98]
mov rdx, rcx
lock xadd qword [rax], rcx
nop
lea rax, [0x00613210]
lock xadd qword [rax], rdx
add rsp, 0x18
pop rbp
ret
add rsp, 0x18
pop rbp
ret
lea rax, [0x004ea31d]
mov ebx, 0x33
call fcn.00437040
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x10], rdx
call fcn.00438ae0
lea rax, [0x004e0e7c]
mov ebx, 0xe
call fcn.00439360
movzx eax, byte [rsp + 0x30]
movzx eax, al
call fcn.004390a0
lea rax, [0x004df2e2]
mov ebx, 5
nop
call fcn.00439360
mov rax, qword [rsp + 0x10]
call fcn.004390a0
call fcn.00438d20
call fcn.00438b40
lea rax, [0x004eabed]
mov ebx, 0x3e
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041cde0
Function at 0x420740
Capabilities:
Hash data using murmur3
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00696611], 0
jne 0x420830
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x420823
lea rsi, [0x00628718]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x4207fe
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00466820
lea rax, [0x004e9624]
mov ebx, 0x2c
nop dword [rax]
call fcn.00437040
nop
int3
Function at 0x421840
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4218ac
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp rbx, 1
jne 0x42186d
lock xadd qword [rax + 0xc8], rcx
mov ecx, 1
lock xadd qword [rax + 0xe8], rcx
jmp 0x421894
cmp rbx, 2
jne 0x421880
lock xadd qword [rax + 0xd0], rcx
jmp 0x421894
cmp rbx, 3
jne 0x42189a
lock xadd qword [rax + 0xd8], rcx
call fcn.00421fe0
add rsp, 0x10
pop rbp
ret
lea rax, [0x004e8ba9]
mov ebx, 0x28
call fcn.00437040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00421840

Function at 0x421b40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421cab
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
call fcn.00421a00
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x98]
cmp rax, rdx
jbe 0x421be6
mov rsi, rax
sub rsi, rdx
shr rsi, 6
lea rdi, [rsi + rsi*4]
lea rdi, [rdi + rdi*8]
add rdi, rdx
imul rsi, rsi, 0x3d
add rsi, rdx
cmp rbx, rdx
cmovb rbx, rdx
cmp rbx, rdi
cmovb rbx, rdi
cmp rax, 0x400000
jbe 0x421bab
lea rdx, [rax - 0x400000]
cmp rdx, rsi
ja 0x421bae
mov rdx, rsi
nop
mov rcx, qword [rcx + 0x18]
mov rsi, rax
sub rsi, rcx
cmp rdx, rbx
cmovb rdx, rbx
cmp rax, rcx
cmovb rsi, rbx
cmp rsi, rbx
cmovb rsi, rbx
cmp rsi, rdx
cmova rsi, rdx
cmp rax, rsi
jb 0x421bef
mov rbx, rax
mov rax, rsi
add rsp, 0x30
pop rbp
ret
mov rbx, rax
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rbx
call fcn.00438ae0
lea rax, [0x004df859]
mov ebx, 8
call fcn.00439360
mov rax, qword [rsp + 0x10]
nop
call fcn.004390a0
lea rax, [0x004dfd72]
mov ebx, 0xa
call fcn.00439360
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.004390a0
call fcn.00438d20
call fcn.00438b40
call fcn.00438ae0
lea rax, [0x004e013f]
mov ebx, 0xb
call fcn.00439360
mov rax, qword [rsp + 0x18]
call fcn.004390a0
lea rax, [0x004e0631]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00439360
mov rax, qword [rsp + 0x20]
call fcn.004390a0
call fcn.00438d20
call fcn.00438b40
lea rax, [0x004e97de]
mov ebx, 0x2d
call fcn.00437040
nop
mov qword [rsp + 8], rax
call fcn.00464520
mov rax, qword [rsp + 8]
jmp fcn.00421b40
Function at 0x421e40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421ef0
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rax, [0x004dfd7c]
mov ebx, 0xa
nop
call fcn.00407fa0
test rbx, rbx
je 0x421e7d
cmp rbx, 3
jne 0x421e8d
cmp word [rax], 0x666f
jne 0x421e8d
cmp byte [rax + 2], 0x66
jne 0x421e8d
movabs rax, 0x7fffffffffffffff
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rax
call fcn.00450100
nop dword [rax]
test bl, bl
je 0x421eaa
add rsp, 0x20
pop rbp
ret
call fcn.00438ae0
lea rax, [0x004e014a]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.00439360
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
call fcn.00439360
call fcn.00438d20
call fcn.00438b40
lea rax, [0x004eaca7]
mov ebx, 0x3f
call fcn.00437040
nop
call fcn.00464520
jmp fcn.00421e40

Function at 0x422640
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4226a6
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
test byte [rax], al
nop
call fcn.0040bd80
mov rcx, r14
mov rbx, qword [rsp + 0x30]
cmp qword [rbx + 8], rcx
jne 0x42268f
mov byte [rbx + 0x10], 1
nop
lea rax, [0x004ec050]
mov ecx, 0xd
mov edi, 0xa
mov esi, 2
call fcn.00439d00
add rsp, 0x20
pop rbp
ret
lea rax, [0x004e99fd]
mov ebx, 0x2e
nop dword [rax + rax]
call fcn.00437040
nop
mov qword [rsp + 8], rax
call fcn.00464520
mov rax, qword [rsp + 8]
jmp fcn.00422640
Function at 0x422740
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42298e
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x70], rax
movsd qword [rsp + 0x78], xmm0
test byte [rax], al
nop
call fcn.0040bd80
mov rcx, r14
mov rax, qword [rsp + 0x70]
cmp qword [rax + 8], rcx
jne 0x42297c
movsd xmm0, qword [0x005097f8]
movsd xmm1, qword [rsp + 0x78]
ucomisd xmm0, xmm1
jbe 0x422793
movsd xmm1, qword [0x005097f8]
movsd qword [rsp + 0x58], xmm1
movsd xmm0, qword [rax + 0x30]
divsd xmm1, xmm0
cvttsd2si rcx, xmm1
mov qword [rsp + 0x48], rcx
cmp qword [rax + 0x80], 0
je 0x4227d8
nop
nop
call fcn.0040bfe0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x80]
mov rbx, qword [rdx]
mov rax, qword [rsp + 0x48]
call rbx
jmp 0x4228ae
nop
call fcn.00468100
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rsp]
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x48]
add rbx, rdx
mov rsi, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov r10, qword [rcx + 0x30]
nop
mov rax, rcx
mov rcx, rsi
mov rsi, r8
mov r8, r9
mov r9, r10
call fcn.00453ea0
mov rbx, qword [rsp + 0x70]
mov byte [rbx + 0x10], 1
nop
lea rax, [0x004ec050]
mov ecx, 0x13
mov edi, 0xe
mov esi, 2
call fcn.00439d00
call fcn.00468100
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x38]
sub rax, rcx
mov qword [rsp + 0x40], rax
nop
nop
mov rax, qword [rsp + 0x70]
call fcn.0040bd80
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
mov rax, rcx
call fcn.00453860
nop
nop
mov rax, qword [rsp + 0x70]
call fcn.0040bfe0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rcx + 0x70]
test rbx, rbx
jle 0x4228e6
movsd xmm0, qword [rsp + 0x58]
cvttsd2si rdx, xmm0
add rax, rdx
cmp rbx, rax
jge 0x4228d9
mov qword [rcx + 0x70], 0
jmp 0x4228e0
sub rbx, rax
mov qword [rcx + 0x70], rbx
add rsp, 0x60
pop rbp
ret
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
movsd xmm1, qword [rsp + 0x58]
addsd xmm0, xmm1
movsd qword [rsp + 0x50], xmm0
mov rdx, qword [rcx + 0x98]
mov rax, qword [rdx]
call rax
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm2, qword [rsp + 0x50]
mulsd xmm0, xmm2
movsd xmm1, qword [rsp + 0x58]
divsd xmm1, xmm0
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 0x38]
movups xmm0, xmm1
movsd xmm1, qword [0x00509770]
mov rax, rcx
nop dword [rax]
call fcn.004241c0
mov rcx, qword [rsp + 0x70]
movsd qword [rcx + 0x30], xmm0
test al, al
jne 0x422976
movsd xmm0, qword [0x00509768]
movsd qword [rcx + 0x30], xmm0
movabs rdx, 0x12a05f200
mov qword [rcx + 0x70], rdx
mov rax, rcx
call fcn.004229c0
add rsp, 0x60
pop rbp
ret
lea rax, [0x004e9d3f]
mov ebx, 0x2f
call fcn.00437040
nop
mov qword [rsp + 8], rax
movsd qword [rsp + 0x10], xmm0
call fcn.00464520
mov rax, qword [rsp + 8]
movsd xmm0, qword [rsp + 0x10]
jmp fcn.00422740
Function at 0x422a20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422bae
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
test byte [rax], al
nop
call fcn.0040bd80
mov rcx, r14
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], rcx
jne 0x422b9c
nop
call fcn.0040bfe0
xorps xmm0, xmm0
xor eax, eax
jmp 0x422a64
movups xmm0, xmm1
mov rax, rcx
movsd xmm1, qword [0x005097f8]
ucomisd xmm1, xmm0
jbe 0x422b66
movsd qword [rsp + 0x18], xmm0
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x90]
mov rcx, qword [rdx]
call rcx
test al, al
jne 0x422b59
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x88]
mov rbx, qword [rdx]
mov eax, 0x10000
call rbx
test rbx, rbx
jne 0x422b13
mov rcx, qword [0x006966b8]
nop dword [rax]
test rcx, rcx
je 0x422b97
mov rdx, rax
mov rbx, rdx
xor edx, edx
div rcx
test rax, rax
jl 0x422ae3
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
jmp 0x422afb
mov rcx, rax
and eax, 1
shr rcx, 1
or rcx, rax
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
movsd xmm2, qword [0x005097e0]
mulsd xmm1, xmm2
movsd xmm3, qword [rsp + 0x18]
addsd xmm1, xmm3
jmp 0x422b30
xorps xmm1, xmm1
cvtsi2sd xmm1, rbx
movsd xmm2, qword [rsp + 0x18]
addsd xmm1, xmm2
mov rbx, rax
movsd xmm2, qword [0x005097e0]
mov rcx, qword [rsp + 0x10]
add rcx, rbx
nop dword [rax + rax]
cmp rbx, 0x10000
jb 0x422b6c
cmp qword [0x006967e8], 0
je 0x422a5e
jmp 0x422b6c
mov rcx, qword [rsp + 0x10]
movsd xmm1, qword [rsp + 0x18]
jmp 0x422b6c
mov rcx, rax
movups xmm1, xmm0
test rcx, rcx
jbe 0x422b7a
cmp qword [0x006966b8], rcx
ja 0x422b86
mov rax, rcx
movups xmm0, xmm1
add rsp, 0x20
pop rbp
ret
lea rax, [0x004e9a2b]
mov ebx, 0x2e
call fcn.00437040
call fcn.00435c80
lea rax, [0x004e980b]
mov ebx, 0x2d
call fcn.00437040
nop
mov qword [rsp + 8], rax
call fcn.00464520
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00422a20
Function at 0x422c80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422d86
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x422cc3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x422d7b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00423a60
test rax, rax
je 0x422d7b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00422dc0]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00464400
xorps xmm15, xmm15
mov r14, qword [0x00696838]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x422d69
xor eax, eax
jmp 0x422d73
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x422cb1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00422c80
Function at 0x424520
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x424653
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x38]
test rdx, rdx
jne 0x424576
call fcn.00426f80
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x4245e8
mov rdi, qword [rax]
lea r8, [rsi - 1]
mov r9, rbx
sub rbx, rdi
cmp r8, 0x3f
jae 0x424645
shl r8, 5
mov edi, dword [rdx + r8 + 0x20]
add edi, dword [rdx + r8 + 0x24]
cmp edi, ebx
ja 0x424632
cmp rsi, 0x3f
jne 0x4245eb
mov qword [rsp + 0x10], rdx
call fcn.00426f80
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x38], rax
mov r9, qword [rsp + 0x30]
mov rdx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
jmp 0x4245eb
mov r9, rbx
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x3f
jae 0x424625
mov rsi, rbx
shl rbx, 5
inc rsi
mov qword [rdx + 0x10], rsi
mov rsi, qword [rax]
sub r9, rsi
mov dword [rdx + rbx + 0x20], r9d
mov esi, dword [rcx + 4]
mov dword [rdx + rbx + 0x24], esi
nop
mov qword [rdx + rbx + 0x28], rcx
inc qword [rax + 0x40]
add rsp, 0x18
pop rbp
ret
mov rax, rbx
mov ecx, 0x3f
call fcn.00466800
lea rax, [0x004e8e59]
mov ebx, 0x29
nop
call fcn.00437040
mov rax, r8
mov ecx, 0x3f
call fcn.00466800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00424520