joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400480c0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x14004838b
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
nop
mov edx, dword [rax + 0x90]
and edx, 0xffffefff
cmp edx, 2
jne 0x14004825f
cmp byte [rax + 0xb4], 0
je 0x140048120
mov rcx, qword [rax + 0x40]
mov rax, rcx
nop dword [rax]
call fcn.14005a440
test rax, rax
je 0x14004824e
movzx edx, byte [rax + 0x29]
test dl, 2
jne 0x1400481eb
mov rax, qword [rsp + 0x68]
mov ebx, 2
mov ecx, 0x1009
call fcn.140042620
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
xor esi, esi
nop
nop
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
xor esi, esi
nop
mov qword [rdx + 0x90], rsi
mov rdx, qword [0x1416f8eb0]
test rdx, rdx
jne 0x140048162
xor ebx, ebx
xor eax, eax
jmp 0x140048167
call fcn.14005f560
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
test rbx, rbx
je 0x140048185
mov ecx, 0xb
xor edi, edi
nop dword [rax]
call fcn.1400602e0
mov rax, qword [rsp + 0x68]
mov ebx, 0x1009
mov ecx, 9
call fcn.140041ce0
mov rdx, qword [rsp + 0x28]
nop
test rdx, rdx
je 0x1400481e0
nop
mov eax, 1
mov rcx, qword [rsp + 0x40]
lock xadd qword [rcx + 0x398], rax
mov eax, dword [rcx + 0xd8]
lea edx, [rax - 1]
nop
mov dword [rcx + 0xd8], edx
cmp eax, 1
jne 0x1400481e0
cmp byte [r14 + 0xb1], 0
je 0x1400481e0
mov qword [r14 + 0x10], 0xfffffffffffffade
call fcn.140047600
add rsp, 0x58
pop rbp
ret
mov ecx, dword [rax + 4]
mov rax, rbx
mov ebx, ecx
call fcn.14005a020
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
call fcn.14003f2a0
lea rax, [0x140b0df7a]
mov ebx, 0x25
call fcn.14003fb20
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x20]
call fcn.14003fb20
lea rax, [0x140aeef2a]
mov ebx, 0x12
call fcn.14003fb20
call fcn.14003f300
lea rax, [0x140aeac1c]
mov ebx, 0xf
call fcn.14003d800
lea rax, [0x140af33a8]
mov ebx, 0x15
call fcn.14003d800
mov qword [rsp + 0x50], r14
nop
nop
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x30], rdx
nop
call fcn.14003f2a0
lea rax, [0x140aeeef4]
mov ebx, 0x12
call fcn.14003fb20
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.14003faa0
lea rax, [0x140adf5d0]
mov ebx, 7
call fcn.14003fb20
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.14003f860
lea rax, [0x140af0466]
mov ebx, 0x13
call fcn.14003fb20
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.14003f860
call fcn.14003f4e0
call fcn.14003f300
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x30], rdx
call fcn.14003f2a0
lea rax, [0x140aeef06]
mov ebx, 0x12
nop
call fcn.14003fb20
mov rax, qword [rsp + 0x50]
call fcn.14003faa0
lea rax, [0x140adf5d0]
mov ebx, 7
nop dword [rax + rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x30]
call fcn.14003f860
lea rax, [0x140af0583]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x38]
call fcn.14003f860
call fcn.14003f4e0
call fcn.14003f300
lea rax, [0x140ae69ba]
mov ebx, 0xc
call fcn.14003d800
nop
mov qword [rsp + 8], rax
call fcn.140075f00
mov rax, qword [rsp + 8]
jmp fcn.1400480c0
Function at 0x14004a9c0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004ab2a
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rsp + 0x28], ebx
mov dword [rax], ebx
mov dword [rax + 4], 3
mov qword [rax + 0x9b8], 0
mov qword [rax + 0x9c0], 0x80
lea rcx, [rax + 0x9c8]
lea rdx, [rax + 0x80]
cmp dword [0x1416f9860], 0
je 0x14004aa2b
call fcn.140071040
mov qword [r11], rcx
mov rsi, qword [rax + 0x9b0]
mov qword [r11 + 8], rsi
mov qword [r11 + 0x10], rdx
mov rsi, qword [rax + 0x68]
mov qword [r11 + 0x18], rsi
mov qword [rsp + 0x20], rax
mov qword [rax + 0x9b0], rcx
mov qword [rax + 0x70], 0
mov qword [rax + 0x78], 0x20
mov qword [rax + 0x68], rdx
lea rcx, [rax + 0x1288]
mov rax, rcx
call fcn.1400376a0
mov rcx, qword [rsp + 0x20]
cmp qword [rcx + 0x40], 0
je 0x14004aa6c
mov edx, dword [rsp + 0x28]
jmp 0x14004aaa1
mov edx, dword [rsp + 0x28]
test edx, edx
jne 0x14004aa8f
mov rsi, qword [0x1416f91d0]
nop dword [rax + rax]
test rsi, rsi
je 0x14004ab18
mov qword [rcx + 0x40], rsi
jmp 0x14004aaa1
call fcn.14001ab00
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x40], rax
mov edx, dword [rsp + 0x28]
mov ecx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ecx
mov ebx, edx
and edx, 0xffffffe0
sub ecx, edx
test ecx, ecx
jl 0x14004ab13
mov rdx, qword [0x1416700a8]
sar ebx, 5
mov esi, 1
shl esi, cl
movsxd rax, ebx
cmp ecx, 0x20
sbb ebx, ebx
and esi, ebx
cmp rdx, rax
jbe 0x14004ab0b
mov rdx, qword [0x1416700a0]
lea rdx, [rdx + rax*4]
lock or dword [rdx], esi
mov rcx, qword [0x141670088]
cmp rcx, rax
jbe 0x14004ab06
mov rcx, qword [0x141670080]
lea rax, [rcx + rax*4]
not esi
lock and dword [rax], esi
add rsp, 0x10
pop rbp
ret
call fcn.1400713a0
mov rcx, rdx
call fcn.1400713a0
call fcn.14003c060
lea rax, [0x140aeac2b]
mov ebx, 0xf
call fcn.14003d800
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.14006f0a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.14004a9c0
Function at 0x14004bc80
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004bd9c
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xa0]
nop dword [rax]
test rax, rax
je 0x14004bd8a
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x38]
mov qword [rsp + 0x10], rdx
nop
cmp rdx, rcx
jne 0x14004bce3
cmp dword [rax + 4], 1
jne 0x14004bce3
mov qword [rcx + 0xa0], 0
mov qword [rax + 0x38], 0
mov dword [rax + 4], 0
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x20], rax
mov ecx, dword [rax + 4]
mov qword [rsp + 0x18], rcx
call fcn.14003f2a0
lea rax, [0x140ae69ea]
mov ebx, 0xc
call fcn.14003fb20
mov rax, qword [rsp + 0x28]
call fcn.14003faa0
lea rax, [0x140add8f9]
mov ebx, 6
nop dword [rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x20]
call fcn.14003faa0
lea rax, [0x140add8ff]
mov ebx, 6
nop dword [rax + rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x10]
call fcn.14003f9a0
lea rax, [0x140ae51c9]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x18]
call fcn.14003f860
call fcn.14003f4e0
call fcn.14003f300
lea rax, [0x140af916f]
mov ebx, 0x19
call fcn.14003d800
lea rax, [0x140af33bd]
mov ebx, 0x15
call fcn.14003d800
nop
nop dword [rax]
call fcn.14006f0a0
jmp fcn.14004bc80
Function at 0x14004d8a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004da07
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x14004d8b2
cmp edx, ecx
jne 0x14004d9f5
nop word [rax + rax]
test rsi, rsi
jne 0x14004d9f5
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x14004d914
nop
call fcn.140072ce0
xorps xmm15, xmm15
mov r14, qword [0x1416f9498]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.14004d7c0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x14004d9f0
mov rdx, qword [0x141670088]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x14004d9e5
mov rcx, qword [0x141670080]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x1416754f0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x1416754f0], rax
nop
mov edx, 1
lea rsi, [0x1416754f8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x14004d9d3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x140b1465a]
mov ebx, 0x28
nop
call fcn.14003d800
mov rax, rsi
mov rcx, rdx
call fcn.1400713a0
call fcn.14003c060
lea rax, [0x140b0a150]
mov ebx, 0x23
call fcn.14003d800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006f0a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14004d8a0
Function at 0x14004e900
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004ea86
push rbp
mov rbp, rsp
sub rsp, 0x48
nop
nop
lea rax, [0x1416fa6a0]
nop dword [rax + rax]
call fcn.1400104a0
cmp byte [0x1416fa7f8], 0
je 0x14004e93f
lea rax, [0x140ae95e7]
mov ebx, 0xe
call fcn.14003d8e0
mov rdx, qword [0x14166ffe0]
test rdx, rdx
je 0x14004e959
mov rsi, qword [0x14166ffe8]
xor eax, eax
jmp 0x14004ea06
lea rax, [0x1416fa6a8]
mov ebx, 0x20
mov rcx, rbx
call fcn.140039720
cmp rax, 0x20
je 0x14004e98e
mov byte [0x1416f8efd], 1
lea rax, [0x1416fa6a8]
mov ebx, 0x20
mov rcx, rbx
call fcn.14004eaa0
movups xmm0, xmmword [0x1416fa6a8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [0x1416fa6b8]
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x10], xmm0
lea rax, [0x1416fa6c8]
call fcn.1400075e0
movups xmmword [0x1416fa6a8], xmm15
movups xmmword [0x1416fa6b8], xmm15
mov byte [0x1416fa7f8], 1
nop
nop
lea rax, [0x1416fa6a0]
call fcn.140010700
add rsp, 0x48
pop rbp
ret
lea r9, [0x1416fa6a8]
movzx r10d, byte [r8 + r9]
xor r10d, edi
mov byte [r9 + r8], r10b
inc rax
cmp rax, rsi
jge 0x14004ea28
mov rdi, rax
and rdi, 0xffffffffffffffe0
mov r8, rax
sub r8, rdi
movzx edi, byte [rax + rdx]
nop dword [rax]
cmp r8, 0x20
jb 0x14004e9f0
jmp 0x14004ea78
mov rbx, qword [0x14166ffe8]
test rbx, rbx
je 0x14004ea45
mov rax, qword [0x14166ffe0]
nop dword [rax + rax]
call fcn.140071a80
movups xmmword [0x14166ffe8], xmm15
cmp dword [0x1416f9860], 0
je 0x14004ea68
mov rcx, qword [0x14166ffe0]
nop dword [rax]
call fcn.140070fe0
mov qword [r11], rcx
mov qword [0x14166ffe0], 0
jmp 0x14004e98e
mov rax, r8
mov ecx, 0x20
call fcn.1400713a0
nop
call fcn.14006f0a0
jmp fcn.14004e900

Function at 0x14004ebe0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004ec72
push rbp
mov rbp, rsp
sub rsp, 0x18
nop
nop
lea rax, [0x1416fa6a0]
nop dword [rax + rax]
call fcn.1400104a0
cmp byte [0x1416fa7f8], 0
jne 0x14004ec2e
lea rax, [0x140aeac49]
mov ebx, 0xf
call fcn.14003d8e0
nop
jmp 0x14004ec2e
lea rax, [0x1416fa6c8]
call fcn.140007700
mov ecx, dword [0x1416fa7e8]
nop
cmp dword [0x1416fa7ec], ecx
jbe 0x14004ec22
lea edx, [rcx + 1]
mov dword [0x1416fa7e8], edx
and ecx, 0x1f
lea rdx, [0x1416fa6c8]
mov rcx, qword [rdx + rcx*8]
mov qword [rsp + 0x10], rcx
nop
nop
lea rax, [0x1416fa6a0]
call fcn.140010700
mov rax, qword [rsp + 0x10]
add rsp, 0x18
pop rbp
ret
call fcn.14006f0a0
jmp fcn.14004ebe0

Function at 0x14004ec80
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004ecd9
push rbp
mov rbp, rsp
sub rsp, 0x10
nop
nop
lea rax, [0x1416fa6a0]
call fcn.1400104a0
cmp byte [0x1416fa7f8], 0
jne 0x14004ecb6
lea rax, [0x140aeac49]
mov ebx, 0xf
call fcn.14003d8e0
lea rax, [0x1416fa6c8]
nop dword [rax]
call fcn.1400077e0
nop
nop
lea rax, [0x1416fa6a0]
call fcn.140010700
add rsp, 0x10
pop rbp
ret
call fcn.14006f0a0
nop
jmp fcn.14004ec80
Function at 0x14004f0c0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004f2a6
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [0x1416f9200], 0x2a
mov qword [0x1416f9208], 0
xor eax, eax
lea rcx, [0x1416f9200]
mov edx, 1
lock cmpxchg qword [rcx], rdx
sete sil
nop
test sil, sil
jne 0x14004f28f
cmp qword [0x1416f9208], 0
jne 0x14004f27e
mov qword [0x1416f9208], 0x2a
mov eax, 0x2a
lock cmpxchg qword [rcx], rdx
sete dl
test dl, dl
je 0x14004f26d
cmp qword [0x1416f9208], 0x2a
nop
jne 0x14004f25c
cmp qword [0x1416f9200], 1
jne 0x14004f25c
mov rdx, qword [0x1416f9200]
nop dword [rax + rax]
cmp rdx, 1
jne 0x14004f24b
movabs rdx, 0x10000000001
xchg qword [rcx], rdx
mov rdx, qword [0x1416f9200]
movabs rsi, 0x10000000001
cmp rdx, rsi
jne 0x14004f23a
movabs rdx, 0x10000000001
lock xadd qword [rcx], rdx
movabs rsi, 0x10000000001
add rdx, rsi
movabs rsi, 0x20000000002
cmp rsi, rdx
jne 0x14004f229
mov rdx, qword [0x1416f9200]
cmp rdx, rsi
jne 0x14004f218
movabs rdx, 0x30000000003
xchg qword [rcx], rdx
cmp rdx, rsi
jne 0x14004f207
mov rcx, qword [0x1416f9200]
movabs rdx, 0x30000000003
cmp rcx, rdx
jne 0x14004f1f6
add rsp, 0x10
pop rbp
ret
lea rax, [0x140ae803a]
mov ebx, 0xd
call fcn.14003d800
lea rax, [0x140ae803a]
mov ebx, 0xd
call fcn.14003d800
lea rax, [0x140ae802d]
mov ebx, 0xd
call fcn.14003d800
lea rax, [0x140ae802d]
mov ebx, 0xd
call fcn.14003d800
lea rax, [0x140ae95f5]
mov ebx, 0xe
call fcn.14003d800
lea rax, [0x140ae8020]
mov ebx, 0xd
call fcn.14003d800
lea rax, [0x140ae6a0e]
mov ebx, 0xc
call fcn.14003d800
lea rax, [0x140ae6a0e]
mov ebx, 0xc
call fcn.14003d800
lea rax, [0x140ae6a0e]
mov ebx, 0xc
call fcn.14003d800
lea rax, [0x140ae6a0e]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.14003d800
nop
call fcn.14006f0a0
jmp fcn.14004f0c0
Function at 0x1400542e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140054459
push rbp
mov rbp, rsp
sub rsp, 0x30
movzx edx, al
cmp rdx, 2
jae 0x14005444b
shl rdx, 6
lea rsi, [0x1416f9fa0]
mov rdi, qword [rsi + rdx + 8]
lea rdx, [rsi + rdx]
lea rdx, [rdx + 8]
test rdi, rdi
jne 0x14005437e
mov byte [rsp + 0x40], al
mov qword [rsp + 0x28], rdx
lea rax, [0x14167ae20]
mov ebx, 4
mov ecx, 1
call fcn.14002de00
nop dword [rax + rax]
test rax, rax
je 0x14005443a
cmp word [rax + 0x60], 0
jne 0x140054429
mov rdx, qword [rax + 0x28]
nop dword [rax + rax]
test rdx, rdx
jne 0x140054418
movzx ecx, byte [rsp + 0x40]
mov edx, 0x2000
shl rdx, cl
mov qword [rax + 0x68], rdx
xor ecx, ecx
jmp 0x1400543ee
mov rax, qword [rdi + 0x28]
mov rcx, rax
test rcx, rcx
je 0x1400543c1
mov rcx, qword [rcx]
mov qword [rdi + 0x28], rcx
movzx ecx, word [rdi + 0x60]
inc ecx
mov word [rdi + 0x60], cx
mov rcx, qword [rdi + 0x28]
nop
test rcx, rcx
jne 0x1400543ba
mov qword [rsp + 0x18], rax
mov rax, rdx
mov rbx, rdi
call fcn.14002f180
mov rax, qword [rsp + 0x18]
add rsp, 0x30
pop rbp
nop
ret
lea rax, [0x140af640c]
mov ebx, 0x17
call fcn.14003d800
mov rdx, qword [rax + 0x28]
mov rsi, qword [rax + 0x18]
add rsi, rcx
mov rdi, rsi
mov qword [rsi], rdx
mov qword [rax + 0x28], rdi
mov rdx, qword [rax + 0x68]
add rcx, rdx
cmp rcx, 0x8000
jb 0x1400543d2
mov qword [rsp + 0x20], rax
mov rbx, rax
mov rax, qword [rsp + 0x28]
call fcn.14002f300
mov rdx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x14005437e
lea rax, [0x140aeef3c]
mov ebx, 0x12
call fcn.14003d800
lea rax, [0x140ae9611]
mov ebx, 0xe
call fcn.14003d800
lea rax, [0x140ae7ef5]
mov ebx, 0xd
call fcn.14003d800
mov rax, rdx
mov ecx, 2
call fcn.1400713a0
nop
mov byte [rsp + 8], al
nop dword [rax]
call fcn.14006f0a0
movzx eax, byte [rsp + 8]
jmp fcn.1400542e0
Function at 0x140059f00
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov ecx, ebx
mov rdx, qword [rax + 0xb0]
mov rbx, qword [rax + 0x150]
lea rsi, [rdx + rcx]
nop dword [rax]
cmp rbx, 1
jle 0x140059f32
mov rdi, qword [rax + 0x148]
xor r8d, r8d
jmp 0x140059f42
mov rax, rsi
add rsp, 0x28
pop rbp
ret
lea rdi, [r9 + 0x18]
inc r8
cmp r8, rbx
jge 0x140059f75
mov r9, rdi
mov r10, qword [rdi]
mov r11, qword [rdi + 8]
cmp r10, rcx
ja 0x140059f5b
cmp r11, rcx
ja 0x140059f6a
lea r12, [rbx - 1]
nop
cmp r8, r12
jne 0x140059f3b
cmp r11, rcx
jne 0x140059f3b
mov rbx, qword [rdi + 0x10]
lea rsi, [rbx + rcx]
sub rsi, r10
mov rcx, qword [rax + 0xb8]
nop dword [rax]
cmp rsi, rcx
jbe 0x140059f32
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rcx
call fcn.14003f2a0
lea rax, [0x140aeef4e]
mov ebx, 0x12
call fcn.14003fb20
mov rax, qword [rsp + 0x10]
call fcn.14003f9a0
lea rax, [0x140ae9649]
mov ebx, 0xe
call fcn.14003fb20
mov rax, qword [rsp + 0x20]
call fcn.14003f9a0
lea rax, [0x140ada8b5]
mov ebx, 3
nop dword [rax + rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x18]
call fcn.14003f9a0
call fcn.14003f4e0
call fcn.14003f300
lea rax, [0x140b069a6]
mov ebx, 0x21
call fcn.14003d800
nop
int3
Function at 0x14005b240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x14005b3b7
movzx edx, byte [rax]
test edx, edx
jne 0x14005b274
nop dword [rax]
test r8b, r8b
jne 0x14005b274
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x14005b287
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x14005b377
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x14005b365
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x14005b357
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x14005b2dd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x14005b320
mov eax, 1
cmp rax, rbx
ja 0x14005b30b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.140071460
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x14005b34f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x14005b313
mov rcx, r11
mov eax, r12d
jmp 0x14005b2e2
mov rcx, rbx
call fcn.1400713a0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.1400713a0
mov eax, r8d
mov rcx, rbx
call fcn.140071460
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x14005b3ad
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x14005b370
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x14005b28d
mov eax, edx
mov rcx, rbx
call fcn.1400713a0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.1400713a0
nop
int3

Function at 0x14005d5e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x14005d81f
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
jmp 0x14005d601
mov rax, rcx
test byte [rax], al
cmp qword [rax + 0x22b0], 0
jbe 0x14005d814
mov rdx, qword [rax + 0x22a8]
mov rdx, qword [rdx]
mov rsi, qword [rdx]
nop
cmp rax, rsi
jne 0x14005d803
mov esi, dword [rdx + 0x40]
mov edi, esi
cmp rdi, 9
ja 0x14005d7b6
mov qword [rsp + 0x18], rdx
lea rcx, [0x141042760]
jmp qword [rcx + rdi*8]
call fcn.14005e2a0
mov edx, 5
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
mov edi, 2
jmp 0x14005d5fe
lea rax, [0x140aeac85]
mov ebx, 0xf
call fcn.14003d800
xor eax, eax
mov rcx, rax
call fcn.1400713a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140075f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14005d5e0
Function at 0x140060c60
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140060d2d
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov ecx, 1
lock xadd qword [rax + 0x398], rcx
mov qword [rsp + 0x10], rcx
movups xmmword [rsp + 0x18], xmm15
lea rdx, [0x140060d60]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x18]
mov qword [rsp], rdx
call fcn.14006ef80
xorps xmm15, xmm15
mov r14, qword [0x1416f9498]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
add rax, 2
nop
mov ecx, 1
mov rdx, qword [rsp + 0x38]
lock xadd qword [rdx + 0x398], rcx
inc rcx
cmp rcx, rax
jne 0x140060cec
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 0x10], rcx
call fcn.14003f2a0
lea rax, [0x140ae9665]
mov ebx, 0xe
call fcn.14003fb20
mov rax, qword [rsp + 0x10]
call fcn.14003f860
call fcn.14003f4e0
call fcn.14003f300
lea rax, [0x140af7ab3]
mov ebx, 0x18
call fcn.14003d800
nop
mov qword [rsp + 8], rax
call fcn.14006f0a0
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.140060c60

Function at 0x140061140
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14006122e
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x80], rdi
nop
test r8b, r8b
je 0x1400611eb
mov byte [rsp + 0x91], r9b
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
movzx edx, r8b
mov qword [rsp + 0x48], rdx
lea rsi, [rsp + 0x38]
mov r8d, 3
mov r9, r8
mov edi, 0x19
call fcn.14005ed40
movzx edx, byte [rsp + 0x91]
test dl, dl
je 0x1400611e5
mov qword [rsp + 0x50], 0
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x50], rdx
mov edi, 0x22
lea rsi, [rsp + 0x50]
mov r8d, 1
mov r9, r8
nop dword [rax]
call fcn.14005ed40
add rsp, 0x58
pop rbp
ret
call fcn.14003f2a0
lea rax, [0x140ae9673]
mov ebx, 0xe
nop dword [rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x80]
call fcn.14003f860
call fcn.14003f4e0
call fcn.14003f300
lea rax, [0x140b1feee]
mov ebx, 0x2f
call fcn.14003d800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x30], r8b
mov byte [rsp + 0x31], r9b
call fcn.14006f0a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movzx r8d, byte [rsp + 0x30]
movzx r9d, byte [rsp + 0x31]
nop dword [rax + rax]
jmp fcn.140061140
Function at 0x1400613c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140061475
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.14005f040
nop
test bl, bl
je 0x14006146f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x1400614c0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.14006ef80
xorps xmm15, xmm15
mov r14, qword [0x1416f9498]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.14006f0a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.1400613c0