joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416200
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4162f6
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rdx, qword [0x008bf828]
mov qword [rsp + 0x30], rdx
mov rsi, qword [0x008bf830]
mov qword [rsp + 0x28], rsi
xor eax, eax
jmp 0x416232
lea rax, [rbx + 1]
cmp rax, rsi
jge 0x4162ca
mov r8, qword [rdx + rax*8]
mov r9, r8
shr r8, 0x14
cmp r8, 0x40
jae 0x4162e8
lea r10, [0x008bf5d8]
mov r8, qword [r10 + r8*8]
test byte [r8], al
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
mov rdi, qword [r8 + 0x10c0]
test rdi, rdi
je 0x416287
mov ecx, 0x2000
mov rbx, rax
xor eax, eax
rep stosq qword [rdi], rax
jmp 0x41622e
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x18], r8
mov eax, 0x10000
xor ebx, ebx
lea rcx, [0x00932cb8]
nop
call fcn.0040d740
test rax, rax
je 0x4162d7
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x10c0], rax
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp 0x41622e
mov byte [0x0092d4df], 1
add rsp, 0x38
pop rbp
ret
lea rax, [0x006d2c1a]
mov ebx, 0x2a
call fcn.004341e0
mov rax, r8
mov ecx, 0x40
call fcn.00460200
nop
call fcn.0045df00
nop dword [rax + rax]
jmp fcn.00416200

Function at 0x416780
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4168f9
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431c20
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4167f0
mov rbx, qword [rsp + 0x60]
jmp 0x416800
add rsp, 0x48
pop rbp
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
nop
test rbx, rbx
jbe 0x416825
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x416835
cmp rbx, 0x1000
jae 0x4167f6
nop dword [rax]
jmp 0x4168a9
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x416842
xor edx, edx
jmp 0x4168a0
mov qword [rsp + 0x30], rbx
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431c20
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
nop
test dl, dl
jne 0x41682b
jmp 0x416814
call fcn.00461660
xorps xmm15, xmm15
mov r14, qword [0x0092d718]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x4168e0
lea rax, [0x006c68d7]
mov ebx, 0xd
call fcn.004341e0
nop dword [rax]
cmp eax, 0x5af
je 0x4168c8
lea rax, [0x006ce617]
mov ebx, 0x1f
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416780
Function at 0x41b620
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b7f1
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp dword [0x0092d504], 2
jne 0x41b7df
mov qword [0x008a7ed8], rax
cmp qword [0x008a7e00], 0
jne 0x41b7cc
mov ecx, dword [0x008a7ec8]
nop word [rax + rax]
cmp dword [0x008a7ecc], ecx
ja 0x41b7cc
cmp dword [0x0092dd34], 0
jle 0x41b67a
call fcn.0041c8a0
movups xmmword [0x008a7f28], xmm15
cmp dword [0x0092d940], 0
je 0x41b69a
mov rcx, qword [0x008a7f20]
call fcn.0045fe20
mov qword [r11], rcx
mov qword [0x008a7f20], 0
mov rcx, qword [0x008a6f70]
mov qword [rsp + 0x28], rcx
mov rdx, qword [0x008a6f78]
mov qword [rsp + 0x18], rdx
xor eax, eax
nop
jmp 0x41b6e0
add rax, 0x1260
call fcn.00424f20
mov rax, qword [rsp + 0x10]
inc rax
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x18]
nop
cmp rax, rdx
jge 0x41b73f
mov qword [rsp + 0x10], rax
mov rbx, qword [rcx + rax*8]
mov qword [rsp + 0x20], rbx
cmp dword [0x0092dd34], 0
jle 0x41b707
mov rax, rbx
nop
call fcn.0042e8c0
jmp 0x41b715
test byte [rbx], al
lea rax, [rbx + 0x1288]
call fcn.0042e840
mov rax, qword [rsp + 0x20]
test byte [rax], al
mov rcx, qword [rax + 0x1260]
test rcx, rcx
je 0x41b6c2
cmp qword [rcx + 0x10], 0
jne 0x41b78b
mov rcx, qword [rax + 0x1268]
cmp qword [rcx + 0x10], 0
je 0x41b6c2
jmp 0x41b78b
mov rcx, qword [0x008a6f70]
mov rdx, qword [0x008a6f78]
xor eax, eax
jmp 0x41b754
inc rax
cmp rax, rdx
jge 0x41b770
mov rsi, qword [rcx + rax*8]
mov rsi, qword [rsi + 0x40]
test rsi, rsi
je 0x41b751
mov qword [rsi + 8], 0
jmp 0x41b751
mov rbx, qword [0x008a7ec0]
lea rax, [0x0092e4c0]
nop
call fcn.00420340
add rsp, 0x30
pop rbp
ret
call fcn.00435720
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x1260], 0
je 0x41b7a8
mov rcx, qword [rax + 0x1260]
test byte [rcx], al
cmp qword [rax + 0x1268], 0
je 0x41b7bb
mov rcx, qword [rax + 0x1268]
test byte [rcx], al
lea rax, [0x006d467b]
mov ebx, 0x2f
call fcn.004341e0
lea rax, [0x0066d140]
lea rbx, [0x00740bb0]
call fcn.004337c0
lea rax, [0x006d6699]
mov ebx, 0x38
call fcn.004341e0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.0041b620
Function at 0x41b820
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x41ba38
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp dword [0x0092d504], 0
jne 0x41ba26
mov qword [rsp + 0x40], rax
nop
nop
lea rax, [0x008af400]
call fcn.0040b500
add dword [0x008bf540], 2
nop
nop
xor ecx, ecx
lea rdx, [0x008a71d4]
xchg dword [rdx], ecx
nop
xor ecx, ecx
lea rdx, [0x008bf568]
xchg qword [rdx], rcx
mov rcx, qword [0x008bf830]
mov rdx, qword [0x008bf838]
mov rbx, qword [0x008bf828]
mov qword [0x008bf848], rcx
mov qword [0x008bf850], rdx
cmp dword [0x0092d940], 0
je 0x41b8b3
nop
call fcn.0045fe40
mov qword [r11], rbx
mov rcx, qword [0x008bf840]
mov qword [r11 + 8], rcx
mov qword [0x008bf840], rbx
nop
xor ecx, ecx
lea rdx, [0x008bf588]
xchg qword [rdx], rcx
nop
xor ecx, ecx
lea rdx, [0x008bf590]
xchg qword [rdx], rcx
nop
nop
lea rax, [0x008af400]
nop dword [rax]
call fcn.0040b760
nop
xor ecx, ecx
lea rdx, [0x008a71d8]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x40]
cmp rcx, 2
jne 0x41b942
nop
nop
lea rax, [0x008af400]
call fcn.0040b500
xorps xmm0, xmm0
movsd qword [0x008bf580], xmm0
nop
nop
lea rax, [0x008af400]
nop
call fcn.0040b760
mov rcx, qword [0x008a6f70]
mov qword [rsp + 0x28], rcx
mov rdx, qword [0x008a6f78]
mov qword [rsp + 0x20], rdx
xor eax, eax
nop
jmp 0x41b9b7
nop
nop
lea rax, [0x008a71c0]
call fcn.0040b500
cmp byte [0x008a71d0], 0
je 0x41b973
mov byte [0x008a71d0], 0
mov rax, qword [0x008a71c8]
xor ebx, ebx
mov ecx, 1
call fcn.00437140
nop
nop
lea rax, [0x008a71c0]
nop dword [rax]
call fcn.0040b760
xor eax, eax
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x18], rax
mov rdx, qword [rcx + rax*8]
mov rdx, qword [rdx + 0x40]
mov rax, rdx
nop dword [rax]
call fcn.00415b60
mov rax, qword [rsp + 0x18]
inc rax
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
cmp rax, rdx
jl 0x41b98d
nop dword [rax]
call fcn.00423460
cmp rax, 0xffffffffffffffff
jne 0x41b9bc
call fcn.004255a0
xor eax, eax
call fcn.004256a0
test al, al
jne 0x41b9d0
nop
nop
nop
mov eax, dword [0x0092d510]
mov ecx, eax
shr ecx, 1
lea edx, [rcx + 1]
mov ebx, 0xaaaaaaab
imul rdx, rbx
shr rdx, 0x3a
lea edx, [rdx + rdx*2]
shl edx, 0x19
sub ecx, edx
inc ecx
shl ecx, 1
lea rdx, [0x0092d510]
lock cmpxchg dword [rdx], ecx
sete cl
test cl, cl
je 0x41b9dd
call fcn.0042c3a0
mov eax, 1
add rsp, 0x30
pop rbp
ret
lea rax, [0x006d27b9]
mov ebx, 0x29
call fcn.004341e0
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00464ae0
mov rax, qword [rsp + 8]
jmp fcn.0041b820
Function at 0x41bd00
Capabilities:
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
cmp rdi, 0x989680
jb 0x41bd39
mov rdx, rax
movabs rax, 0x8637bd05af6c69b6
mov rsi, rdx
mul rdi
shr rdx, 0x13
lea rdi, [rbx - 1]
mov rax, rdi
jmp 0x41be65
shr rdi, 1
mov rdx, rax
movabs rax, 0x83126e978d4fdf3c
mov rsi, rdx
mul rdi
shr rdx, 8
test rdx, rdx
je 0x41bd60
mov eax, 3
jmp 0x41bdaa
test rbx, rbx
jbe 0x41bd88
mov byte [rsi], 0x30
cmp rcx, 1
jb 0x41bd7c
mov rax, rsi
mov ebx, 1
add rsp, 0x10
pop rbp
ret
mov ecx, 1
xor edx, edx
call fcn.00460260
xor eax, eax
mov rcx, rax
call fcn.004601e0
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mul rdx
shr rdx, 3
lea rax, [rdi - 1]
cmp rdx, 0x64
jae 0x41bd92
mov rdi, rbx
sub rdi, rax
lea r8, [rbx - 1]
dec rdi
jmp 0x41bdc2
mov r8, rax
cmp rdx, 0xa
jae 0x41bdcd
cmp r8, rdi
jl 0x41be16
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, r8
jbe 0x41be54
add r9, 0x30
mov byte [rsi + r8], r9b
lea rax, [r8 - 1]
nop dword [rax]
cmp rax, rdi
jne 0x41bdbf
cmp rbx, rax
jbe 0x41be4c
mov byte [r8 + rsi - 1], 0x2e
lea rax, [r8 - 2]
jmp 0x41bdbf
cmp rbx, r8
jbe 0x41be41
add rdx, 0x30
mov byte [rsi + r8], dl
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rdx, r8
lea rax, [rdx + rsi]
sub rbx, r8
add rsp, 0x10
pop rbp
nop
ret
mov rax, r8
mov rcx, rbx
call fcn.004601e0
mov rcx, rbx
call fcn.004601e0
mov rax, r8
mov rcx, rbx
call fcn.004601e0
mov rdi, rax
mov rax, r8
cmp rdx, 0xa
jae 0x41be70
cmp rdi, rax
jl 0x41beb7
mov r8, rax
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, rdi
jbe 0x41bef4
add r9, 0x30
mov byte [rsi + rdi], r9b
lea rax, [rdi - 1]
cmp rax, r8
jne 0x41be5f
cmp rbx, rax
jbe 0x41beec
mov byte [rdi + rsi - 1], 0x2e
lea rax, [rdi - 2]
jmp 0x41be5f
cmp rbx, rdi
jbe 0x41bee1
add rdx, 0x30
mov byte [rsi + rdi], dl
sub rcx, rdi
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rdx, rdi
lea rax, [rsi + rdx]
sub rbx, rdi
add rsp, 0x10
pop rbp
nop
ret
mov rax, rdi
mov rcx, rbx
call fcn.004601e0
mov rcx, rbx
call fcn.004601e0
mov rax, rdi
mov rcx, rbx
call fcn.004601e0
nop

Function at 0x41bf00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41bf78
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41bf66
cmp byte [rdx + 0x20], bl
je 0x41bf55
mov qword [rsp + 0x10], rdx
mov byte [rsp + 0x30], bl
mov rax, rdx
mov rbx, rcx
call fcn.0041c0e0
movzx ecx, byte [rsp + 0x30]
mov rdx, qword [rsp + 0x10]
mov byte [rdx + 0x20], cl
mov byte [rdx + 0x21], 1
add rsp, 0x18
pop rbp
ret
lea rax, [0x006d3baf]
mov ebx, 0x2d
call fcn.004341e0
lea rax, [0x006d46aa]
mov ebx, 0x2f
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041bf00
Function at 0x41bfa0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c00c
push rbp
mov rbp, rsp
sub rsp, 0x18
cmp byte [rax + 0x21], 0
je 0x41bffa
mov rdx, qword [rax + 0x40]
cmp rdx, rbx
jg 0x41bfe6
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rcx, rbx
sub rcx, rdx
movsxd rdx, dword [rax + 0x4c]
imul rcx, rdx
xor ebx, ebx
call fcn.0041c2e0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
nop
xchg qword [rax + 0x40], rbx
mov byte [rax + 0x21], 0
call fcn.0041c380
add rsp, 0x18
pop rbp
ret
lea rax, [0x006d46d9]
mov ebx, 0x2f
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041bfa0

Function at 0x41c3e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c486
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41c472
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0x38], ecx
mov rax, rdx
call fcn.0041c0e0
mov ecx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x10]
mov dword [rax + 0x4c], ecx
movsxd rcx, ecx
imul rcx, rcx, 0x3b9aca00
mov qword [rax + 0x10], rcx
mov rdx, qword [rax + 8]
cmp rdx, rcx
jbe 0x41c45b
mov qword [rax + 8], rcx
lea rcx, [rax + 4]
nop
nop
mov edx, 1
xchg byte [rcx], dl
mov ecx, dword [0x00933cd8]
inc ecx
xchg dword [rax + 0x48], ecx
jmp 0x41c467
jae 0x41c467
lea rcx, [rax + 4]
nop
nop
xor edx, edx
xchg byte [rcx], dl
call fcn.0041c380
add rsp, 0x18
pop rbp
ret
lea rax, [0x006d2164]
mov ebx, 0x28
nop
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.0041c3e0

Function at 0x41c560
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c659
push rbp
mov rbp, rsp
sub rsp, 0x10
jmp 0x41c577
mov rax, rdx
mov rdx, qword [rax]
mov rsi, rdx
shr rdx, 0x3d
cmp bl, dl
jne 0x41c647
mov rdx, rax
mov rax, rsi
xor edi, edi
lock cmpxchg qword [rdx], rdi
sete r8b
test r8b, r8b
je 0x41c574
movabs rdx, 0xe000000000000000
and rdx, rcx
movabs rdi, 0x1fffffffffffffff
and rdi, rsi
or rdx, rdi
mov rsi, rcx
sub rcx, rdx
cmp rsi, rdx
mov edx, 0
cmovl rcx, rdx
test rcx, rcx
je 0x41c630
cmp bl, 2
ja 0x41c5f3
cmp bl, 1
jne 0x41c5ec
nop
lea rax, [0x0092dcf8]
lock xadd qword [rax], rcx
jmp 0x41c62a
cmp bl, 2
je 0x41c5f8
jmp 0x41c636
cmp bl, 3
jne 0x41c607
nop
lea rax, [0x0092dce8]
lock xadd qword [rax], rcx
jmp 0x41c62a
cmp bl, 4
jne 0x41c636
nop
nop
lea rax, [0x0092dcf8]
mov rdx, rcx
lock xadd qword [rax], rcx
nop
lea rax, [0x008aa0d0]
lock xadd qword [rax], rdx
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d57b8]
mov ebx, 0x33
call fcn.004341e0
lea rax, [0x006d71b2]
mov ebx, 0x3e
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.0045df00
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax + rax]
jmp fcn.0041c560
Function at 0x41d040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41d26e
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rcx, qword [0x008bf860]
nop dword [rax]
cmp rbx, rcx
jae 0x41d265
mov rdx, qword [0x008bf858]
mov rdx, qword [rdx + rbx*8]
mov rsi, rdx
shr rdx, 0x14
nop dword [rax + rax]
cmp rdx, 0x40
jae 0x41d256
mov qword [rsp + 0x70], rax
lea rdi, [0x008bf5d8]
mov rdx, qword [rdi + rdx*8]
test byte [rdx], al
and esi, 0xfffff
mov rdx, qword [rdx + rsi*8]
mov qword [rsp + 0x48], rdx
test byte [rdx], al
mov esi, dword [0x008bf540]
mov dword [rsp + 0x2c], esi
xor ecx, ecx
jmp 0x41d0c0
inc rcx
nop
cmp rcx, 0x40
jge 0x41d0e7
lea rdi, [rdx + rcx]
lea rdi, [rdi + 0x1080]
mov dil, byte [rdi]
test dil, dil
je 0x41d0bb
mov qword [rsp + 0x40], rcx
mov byte [rsp + 0x2b], dil
xor ebx, ebx
jmp 0x41d0f4
add rsp, 0x60
pop rbp
ret
lea rbx, [rcx + 1]
mov rcx, r8
cmp rbx, 8
jae 0x41d0bb
mov r8, rcx
mov rcx, rbx
mov r9d, 1
shl r9d, cl
test dil, r9b
je 0x41d0ed
lea r9, [rcx + r8*8]
cmp r9, 0x200
jae 0x41d249
mov r9, qword [rdx + r9*8]
nop
mov r10b, byte [r9 + 0x63]
cmp r10b, 1
jne 0x41d238
mov qword [rsp + 0x50], rcx
cmp byte [0x0092d4df], 0
nop
jne 0x41d158
mov r10d, dword [r9 + 0x58]
cmp r10d, esi
je 0x41d158
lea r11d, [rsi + 3]
cmp r10d, r11d
jne 0x41d227
mov qword [rsp + 0x38], r9
lea rax, [r9 + 0x78]
mov qword [rsp + 0x58], rax
nop
call fcn.0040b500
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x80]
jmp 0x41d1ad
nop
mov rax, qword [rsp + 0x58]
call fcn.0040b760
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rbx, rcx
mov esi, dword [rsp + 0x2c]
movzx edi, byte [rsp + 0x2b]
mov r8, qword [rsp + 0x40]
jmp 0x41d0ed
mov rdx, qword [rdx]
test rdx, rdx
je 0x41d17a
cmp byte [rdx + 0xa], 1
jne 0x41d1aa
mov r8, qword [rcx + 0x68]
nop dword [rax]
test r8, r8
je 0x41d222
mov qword [rsp + 0x30], rdx
movzx eax, word [rdx + 8]
mov rbx, rdx
xor edx, edx
div r8
imul rax, r8
movzx edx, byte [rcx + 0x62]
mov r8, qword [rcx + 0x18]
add rax, r8
test dl, 1
jne 0x41d1f9
mov rbx, qword [rsp + 0x70]
call fcn.0041ed20
mov rbx, qword [rsp + 0x30]
lea rax, [rbx + 0x10]
lea rcx, [0x008711c3]
mov rdi, qword [rsp + 0x70]
xor esi, esi
mov ebx, 8
call fcn.0041eba0
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
nop
jmp 0x41d1aa
call fcn.00432ee0
lea rax, [0x006c784d]
mov ebx, 0x10
call fcn.004341e0
lea rax, [0x006d32eb]
mov ebx, 0x2b
call fcn.004341e0
mov rax, r9
mov ecx, 0x200
call fcn.00460200
mov rax, rdx
mov ecx, 0x40
nop
call fcn.00460200
mov rax, rbx
call fcn.004601e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041d040
Function at 0x41f2c0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41f4da
push rbp
mov rbp, rsp
sub rsp, 0x30
test rax, 7
jne 0x41f4c8
mov qword [rsp + 0x40], rax
mov rdx, qword [rdi + 0x48]
test byte [rdx], al
mov r9, r8
shr r9, 3
mov r10, r8
and r10d, 7
nop
mov r11, rcx
mov rcx, r10
mov r12d, 1
shl r12d, cl
lea r10, [rdx + r9]
cmp byte [0x0092d4df], 0
jne 0x41f401
cmp dword [0x0092dd34], 0
nop
jle 0x41f349
movzx r13d, word [rdi + 0x34]
cmp r8, r13
jb 0x41f349
mov r8, qword [rdi + 0x40]
test byte [r8], al
movzx r8d, byte [r9 + r8]
nop
nop dword [rax]
test r12b, r8b
je 0x41f478
movzx edx, byte [r9 + rdx]
test r12b, dl
jne 0x41f3fb
nop
lock or byte [r10], r12b
mov rcx, qword [rdi + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov r8, rdx
shr rdx, 0x2a
nop
nop
nop
nop word [rax + rax]
cmp rdx, 0x40
jae 0x41f46b
lea r9, [0x008bf5d8]
mov rdx, qword [r9 + rdx*8]
test byte [rdx], al
mov r9, rcx
shr r9, 0x10
and r9d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r10d, 1
shl r10d, cl
shr r8, 0x16
and r8d, 0xfffff
mov rdx, qword [rdx + r8*8]
test byte [rdx], al
movzx r8d, byte [rdx + r9 + 0x1040]
lea rdx, [rdx + r9]
lea rdx, [rdx + 0x1040]
test r10b, r8b
jne 0x41f3e0
lock or byte [rdx], r10b
movzx edx, byte [rdi + 0x62]
test dl, 1
je 0x41f422
mov rax, qword [rsi + 0x10]
add rax, qword [rdi + 0x68]
mov qword [rsi + 0x10], rax
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x60], rsi
mov rcx, r11
mov rdi, r10
mov esi, r12d
call fcn.004163a0
test al, al
jne 0x41f458
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
prefetcht0 byte [rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x41f447
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfd
je 0x41f447
jae 0x41f45e
mov qword [rdx + rdi*8 + 0x18], rax
inc qword [rdx + 0x10]
jmp 0x41f452
mov rbx, rax
mov rax, rsi
call fcn.00424b20
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov ecx, 0xfd
call fcn.004601e0
mov rax, rdx
mov ecx, 0x40
call fcn.00460200
lea rax, [0x006c4d6a]
mov rcx, rbx
mov rdi, r11
mov ebx, 4
call fcn.0041f540
lea rax, [0x006c4bc8]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
call fcn.0041f540
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf1], 2
lea rax, [0x006c8b6f]
mov ebx, 0x13
call fcn.004341e0
lea rax, [0x006d0124]
mov ebx, 0x23
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax + rax]
jmp fcn.0041f2c0
Function at 0x41f640
Capabilities:
Hash data using murmur3
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x0092d4df], 0
jne 0x41f730
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41f723
lea rsi, [0x008bf5d8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x41f6fe
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00460200
lea rax, [0x006d37b1]
mov ebx, 0x2c
nop dword [rax]
call fcn.004341e0
nop
int3
Function at 0x420440
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4204ac
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp rbx, 1
jne 0x42046d
lock xadd qword [rax + 0xc8], rcx
mov ecx, 1
lock xadd qword [rax + 0xe8], rcx
jmp 0x420494
cmp rbx, 2
jne 0x420480
lock xadd qword [rax + 0xd0], rcx
jmp 0x420494
cmp rbx, 3
jne 0x42049a
lock xadd qword [rax + 0xd8], rcx
call fcn.00420aa0
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d218c]
mov ebx, 0x28
call fcn.004341e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.0045df00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00420440

Function at 0x420740
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420806
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
call fcn.00420600
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x98]
cmp rax, rdx
jbe 0x4207e6
mov rsi, rax
sub rsi, rdx
shr rsi, 6
lea rdi, [rsi + rsi*4]
lea rdi, [rdi + rdi*8]
add rdi, rdx
imul rsi, rsi, 0x3d
add rsi, rdx
cmp rbx, rdx
cmovb rbx, rdx
cmp rbx, rdi
cmovb rbx, rdi
cmp rax, 0x400000
jbe 0x4207ab
lea rdx, [rax - 0x400000]
cmp rdx, rsi
ja 0x4207ae
mov rdx, rsi
nop
mov rcx, qword [rcx + 0x18]
mov rsi, rax
sub rsi, rcx
cmp rdx, rbx
cmovb rdx, rbx
cmp rax, rcx
cmovb rsi, rbx
cmp rsi, rbx
cmovb rsi, rbx
cmp rsi, rdx
cmova rsi, rdx
cmp rax, rsi
jb 0x4207ef
mov rbx, rax
mov rax, rsi
add rsp, 0x10
pop rbp
ret
mov rbx, rax
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d3bdc]
mov ebx, 0x2d
nop dword [rax + rax]
call fcn.004341e0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.00420740

Function at 0x4209a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420a09
push rbp
mov rbp, rsp
sub rsp, 0x10
lea rax, [0x006c5bbb]
mov ebx, 0xa
call fcn.004081a0
nop
test rbx, rbx
je 0x4209d8
cmp rbx, 3
jne 0x4209e8
cmp word [rax], 0x666f
jne 0x4209e8
cmp byte [rax + 2], 0x66
jne 0x4209e8
movabs rax, 0x7fffffffffffffff
add rsp, 0x10
pop rbp
ret
call fcn.0044ba80
test bl, bl
je 0x4209f7
add rsp, 0x10
pop rbp
ret
lea rax, [0x006d7365]
mov ebx, 0x3f
call fcn.004341e0
nop
call fcn.0045df00
jmp fcn.004209a0

Function at 0x421040
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4210a6
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
test byte [rax], al
nop
call fcn.0040b500
mov rcx, r14
mov rbx, qword [rsp + 0x30]
cmp qword [rbx + 8], rcx
jne 0x42108f
mov byte [rbx + 0x10], 1
nop
lea rax, [0x006f4e60]
mov ecx, 0xd
mov edi, 0xa
mov esi, 2
call fcn.00436100
add rsp, 0x20
pop rbp
ret
lea rax, [0x006d4107]
mov ebx, 0x2e
nop dword [rax + rax]
call fcn.004341e0
nop
mov qword [rsp + 8], rax
call fcn.0045df00
mov rax, qword [rsp + 8]
jmp fcn.00421040