joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412600
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x412777
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x30], rcx
nop dword [rax]
test rbx, rbx
je 0x4126de
cmp qword [rbx], 0
je 0x4126de
movzx ecx, byte [rbx + 8]
nop word [rax + rax]
test cl, 4
jne 0x412765
cmp byte [rbx + 9], 0
jne 0x412658
mov rcx, qword [rbx + 0x10]
jmp 0x412702
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x4126d9
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x4126bd
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx esi, byte [r9 + r8]
add esi, 0xfffffffe
cmp sil, 3
jb 0x4126d9
mov rcx, rdx
mov rax, rdi
jmp 0x412702
lea rax, [0x01155a20]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
test rcx, rcx
je 0x412710
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x41272a
lea rax, [0x01155a20]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 8
cmp rbx, 8
jae 0x4126f1
mov rsi, qword [rdx]
cmp qword [rsp + 0x30], rsi
jne 0x412723
movzx esi, byte [rbx + rcx]
nop
cmp sil, 1
jbe 0x412723
movzx edx, byte [rax + 0x51]
imul rdx, rbx
lea rax, [rdx + rcx]
lea rax, [rax + 0x48]
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00ad153e]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00412600
Function at 0x414ee0
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4150cf
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
call fcn.004392e0
call fcn.004392e0
lea rax, [0x00ac2d0e]
mov ebx, 0x11
call fcn.00439be0
mov rax, qword [rsp + 0x38]
call fcn.00439a40
call fcn.00439360
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x414ff7
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x4150aa
call fcn.004392e0
lea rax, [0x00ac4832]
mov ebx, 0x14
call fcn.00439be0
call fcn.00439360
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.004392e0
lea rax, [0x00abfc7e]
mov ebx, 0xd
nop dword [rax]
call fcn.00439be0
mov rax, qword [rsp + 0x28]
call fcn.00439a40
lea rax, [0x00abf2d6]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x38]
call fcn.00439a40
lea rax, [0x00abf2e2]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00439be0
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.004398e0
call fcn.00439360
call fcn.004392e0
nop dword [rax]
call fcn.00439540
call fcn.00439360
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x415030
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x00ade538]
mov ebx, 0x3e
call fcn.00437b60
call fcn.004392e0
lea rax, [0x00acf1c9]
mov ebx, 0x1e
call fcn.00439be0
mov rax, qword [rsp + 0x60]
call fcn.00439a40
lea rax, [0x00abbfce]
mov ebx, 1
nop dword [rax]
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.00439a40
lea rax, [0x00abc021]
mov ebx, 2
nop dword [rax + rax]
call fcn.00439be0
call fcn.00439360
lea rax, [0x00abce4a]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
call fcn.00420780
jmp 0x415014
call fcn.004392e0
lea rax, [0x00ac9565]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439be0
call fcn.00439360
jmp 0x414f75
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00414ee0
Function at 0x415920
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, rbx
or rbx, rax
or rbx, rcx
nop word [rax + rax]
test rbx, 7
jne 0x415b05
cmp byte [0x011546d4], 0
je 0x4159f0
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
test byte [rsi], al
nop
movabs r8, 0x800000000000
add r8, rax
mov r9, r8
shr r8, 0x2a
nop dword [rax]
cmp r8, 0x40
jae 0x415af5
lea r10, [0x01126558]
mov r8, qword [r10 + r8*8]
test byte [r8], al
shr r9, 0x16
mov r10, r9
and r9, 0xfffff
mov r8, qword [r8 + r9*8]
test r8, r8
je 0x4159d1
mov r11, rax
shr rax, 5
and rax, 0x1ffff
lea r12, [r8 + rax]
shr r11, 3
and r11, 3
add r8, 0x1ffff
jmp 0x4159dd
xor r10d, r10d
xor r11d, r11d
xor r8d, r8d
xor r12d, r12d
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rsi
xor eax, eax
jmp 0x415a01
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rax, 8
mov r11d, r9d
cmp rcx, rax
jbe 0x415aeb
mov qword [rsp + 0x20], rax
movzx r9d, byte [r12]
bt r9d, r11d
jae 0x415a94
lea r9, [rax + rdx]
mov r13, qword [rsi + 0x16c0]
mov r9, qword [r9]
mov qword [r13], 0
mov qword [r13 + 8], r9
mov r9, qword [rsi + 0x16c0]
add r9, 0x10
mov qword [rsi + 0x16c0], r9
cmp qword [rsi + 0x16c8], r9
jne 0x415a94
mov dword [rsp + 0x18], r11d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x1c], r10d
xor eax, eax
xor ebx, ebx
call fcn.00430040
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r10d, dword [rsp + 0x1c]
mov r11d, dword [rsp + 0x18]
mov r12, qword [rsp + 0x38]
cmp r11d, 3
jae 0x415aa5
lea r9d, [r11 + 1]
nop
jmp 0x4159fa
cmp r8, r12
je 0x415ab5
inc r12
xor r9d, r9d
jmp 0x4159fa
mov rax, r12
mov ebx, r11d
mov ecx, r10d
mov rdi, r8
call fcn.00415280
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r10d, ecx
mov r9d, ebx
mov r8, rdi
mov r12, rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
jmp 0x4159fa
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, r8
mov ecx, 0x40
nop dword [rax]
call fcn.00465b80
lea rax, [0x00ad67ef]
mov ebx, 0x28
call fcn.00437b60
nop
int3
Function at 0x415cc0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test rax, rax
je 0x415ee5
mov qword [rsp + 0x58], rax
nop dword [rax]
cmp qword [rax], rdi
jne 0x415e3b
movzx edx, byte [rax + 0x17]
test dl, 0x40
jne 0x415ddd
cmp byte [0x011546d4], 0
je 0x415d26
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0xa0]
mov qword [rsp + 0x40], rdx
test byte [rdx], al
mov rsi, qword [rax + 0x20]
xor edi, edi
xor r8d, r8d
jmp 0x415d34
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rdi, 8
cmp qword [rax + 8], rdi
jbe 0x415dd3
nop
test rdi, 0x3f
jne 0x415d52
movzx r8d, byte [rsi]
inc rsi
jmp 0x415d55
shr r8d, 1
bt r8d, 0
jae 0x415d30
lea r9, [rdi + rbx]
lea r10, [rdi + rcx]
mov r11, qword [rdx + 0x16c0]
mov r9, qword [r9]
mov r10, qword [r10]
mov qword [r11], r9
mov qword [r11 + 8], r10
mov r9, qword [rdx + 0x16c0]
add r9, 0x10
mov qword [rdx + 0x16c0], r9
cmp qword [rdx + 0x16c8], r9
jne 0x415d30
mov qword [rsp + 0x18], rdi
mov dword [rsp + 0x14], r8d
mov qword [rsp + 0x30], rsi
xor eax, eax
xor ebx, ebx
call fcn.00430040
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x18]
mov r8d, dword [rsp + 0x14]
jmp 0x415d30
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
nop dword [rax]
call fcn.0045af40
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
call fcn.004392e0
lea rax, [0x00ad6d17]
mov ebx, 0x28
call fcn.00439be0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.00439be0
lea rax, [0x00ac0ce6]
mov ebx, 0xf
call fcn.00439be0
call fcn.00439360
lea rax, [0x00ad41bd]
mov ebx, 0x24
call fcn.00437b60
mov qword [rsp + 0x70], rdi
call fcn.0045af40
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rcx
nop dword [rax]
call fcn.004392e0
lea rax, [0x00ad6d17]
mov ebx, 0x28
call fcn.00439be0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.00439be0
lea rax, [0x00abe9e1]
mov ebx, 0xb
call fcn.00439be0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004398e0
lea rax, [0x00ac2e73]
mov ebx, 0x12
call fcn.00439be0
mov rax, qword [rsp + 0x70]
nop dword [rax + rax]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ad41bd]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00437b60
lea rax, [0x00ad75b5]
mov ebx, 0x29
call fcn.00437b60
nop
int3
Function at 0x417b40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417dad
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x417d9f
mov rcx, qword [rax + rdx*8 + 0x28]
movzx esi, word [rcx + 0x60]
nop word [rax + rax]
nop
cmp qword [rcx + 0x38], rsi
jne 0x417d8e
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x58], bl
mov qword [rsp + 0x38], rdx
lea rsi, [0x01154be0]
nop
cmp rcx, rsi
je 0x417bd7
mov esi, dword [0x011264e8]
add esi, 3
cmp dword [rcx + 0x58], esi
jne 0x417d7d
lea rsi, [rdx + rdx*2]
shl rsi, 6
lea rdi, [0x01126800]
lea rax, [rsi + rdi]
mov rbx, rcx
call fcn.00418a40
mov rdx, qword [rsp + 0x38]
lea rcx, [rdx + rdx*2]
shl rcx, 6
lea rbx, [0x01126800]
lea rax, [rcx + rbx]
call fcn.00418340
test rax, rax
je 0x417d6c
movzx ecx, word [rax + 0x60]
nop dword [rax]
cmp qword [rax + 0x38], rcx
je 0x417d5b
mov qword [rsp + 0x28], rax
mov ecx, dword [0x011264e8]
add ecx, 3
mov dword [rax + 0x58], ecx
lea rax, [0x0115a368]
call fcn.0042fe00
test byte [rax], al
movzx ecx, byte [rsp + 0x58]
mov edx, ecx
shr cl, 1
movsx rcx, cl
nop word [rax + rax]
nop
cmp rcx, 0x44
jae 0x417d4e
lea rcx, [rax + rcx*8]
lea rcx, [rcx + 0x48]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rbx + 0x38]
movzx edi, word [rbx + 0x60]
sub rsi, rdi
lock xadd qword [rcx], rsi
cmp dl, 5
jne 0x417c83
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x20]
lock xadd qword [rax + 0x30], rdx
mov qword [rcx + 0x20], 0
lea rax, [0x0115a368]
call fcn.0042ff00
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x60]
mov rbx, qword [rcx + 0x68]
imul rdx, rbx
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
sub rbx, rdx
lea rdx, [0x01154f50]
lock xadd qword [rdx], rbx
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 8]
lea rsi, [0x01154f58]
lock xadd qword [rsi], rbx
mov qword [rdx + 8], 0
cmp byte [0x011062f0], 0
je 0x417d1b
nop
mov qword [rsp + 0x30], 0
mov rdx, qword [0x01154f50]
mov qword [rsp + 0x30], rdx
mov eax, 0x21
mov rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
call fcn.00455780
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
cmp dword [0x01154150], 0
je 0x417d3a
lea rax, [0x01154f20]
call fcn.004210c0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov qword [rdx + rax*8 + 0x28], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rcx
mov ecx, 0x44
call fcn.00465b60
lea rax, [0x00ac74f8]
mov ebx, 0x16
call fcn.00437b60
lea rax, [0x00ac02ca]
mov ebx, 0xd
call fcn.00437b60
lea rax, [0x00ac7028]
mov ebx, 0x16
call fcn.00437b60
lea rax, [0x00ad6b37]
mov ebx, 0x28
call fcn.00437b60
mov rax, rdx
mov ecx, 0x88
call fcn.00465b60
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00463440
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00417b40
Function at 0x418260
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41832a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [0x011264e8]
mov edx, dword [rax + 0x488]
cmp edx, ecx
je 0x4182c1
lea ebx, [rcx - 2]
cmp edx, ebx
jne 0x4182cb
mov qword [rsp + 0x28], rax
call fcn.00418080
mov rax, qword [rsp + 0x28]
nop
call fcn.0044be00
mov ecx, dword [0x011264e8]
mov rdx, qword [rsp + 0x28]
xchg dword [rdx + 0x488], ecx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x10], ecx
mov dword [rsp + 0x14], edx
call fcn.004392e0
lea rax, [0x00ac0144]
mov ebx, 0xd
call fcn.00439be0
mov eax, dword [rsp + 0x14]
call fcn.004398e0
lea rax, [0x00ace689]
mov ebx, 0x1e
nop
call fcn.00439be0
mov eax, dword [rsp + 0x10]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00abf83a]
mov ebx, 0xc
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00418260
Function at 0x418a40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418b06
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x418af3
mov ecx, dword [0x011264e8]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x418a82
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x418a89
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x418acf
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
test rdx, rdx
jle 0x418ab5
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.0042f7a0
jmp 0x418ae9
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
call fcn.0042f7a0
jmp 0x418ae9
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
call fcn.00424900
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00ad436d]
mov ebx, 0x24
nop
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00418a40
Function at 0x418e60
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x419006
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x418f1c
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x418f0f
lea rsi, [0x01126558]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and rbx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x210c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and rcx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x418eff
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00465b80
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.004392e0
call fcn.004392e0
lea rax, [0x00add716]
mov ebx, 0x39
call fcn.00439be0
mov rax, qword [rsp + 0x40]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
call fcn.004392e0
lea rax, [0x00ac93fc]
mov ebx, 0x18
call fcn.00439be0
mov rax, qword [rsp + 0x28]
call fcn.00439a40
lea rax, [0x00abbfce]
mov ebx, 1
call fcn.00439be0
mov rax, qword [rsp + 0x20]
call fcn.00439a40
lea rax, [0x00abc021]
mov ebx, 2
call fcn.00439be0
call fcn.00439360
lea rax, [0x00abc5d3]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.00420780
lea rax, [0x00abc344]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop
call fcn.00420780
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x00acfca2]
mov ebx, 0x1f
nop dword [rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00418e60
Function at 0x4190e0
Capabilities:
Access peb ldr_data
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41928b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00976e70]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41914e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x419161
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x419185
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x419199
cmp rbx, 0x1000
jae 0x419158
nop
jmp 0x419209
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4191ad
xor edx, edx
jmp 0x419200
mov rcx, qword [0x00976e70]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41918f
jmp 0x419175
call fcn.00467000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004392e0
lea rax, [0x00ac93e4]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x38]
call fcn.004398e0
lea rax, [0x00ac954c]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ad197f]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004190e0
Function at 0x4192c0
Capabilities:
Access peb ldr_data
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4194ea
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00976e68]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434100
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41933b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41934e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x419370
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x419384
cmp rbx, 0x1000
jae 0x419345
jmp 0x41940e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x419396
xor esi, esi
jmp 0x419400
mov rax, qword [0x00976e68]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00434100
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41937a
jmp 0x419362
call fcn.00467000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x419489
call fcn.004392e0
lea rax, [0x00aca375]
mov ebx, 0x19
call fcn.00439be0
mov rax, qword [rsp + 0x68]
call fcn.004398e0
lea rax, [0x00ac954c]
mov ebx, 0x19
nop
call fcn.00439be0
mov eax, dword [rsp + 0x34]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ac02ca]
mov ebx, 0xd
call fcn.00437b60
cmp eax, 0x5af
je 0x419433
call fcn.004392e0
lea rax, [0x00aca375]
mov ebx, 0x19
call fcn.00439be0
mov rax, qword [rsp + 0x38]
call fcn.004398e0
lea rax, [0x00ac954c]
mov ebx, 0x19
nop dword [rax]
call fcn.00439be0
mov eax, dword [rsp + 0x34]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ad00a1]
mov ebx, 0x1f
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004192c0
Function at 0x419520
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
neg rbx
mov rax, rcx
nop
call fcn.0042fd40
mov rcx, qword [0x00976e70]
mov rdx, qword [rsp + 0x40]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x8000
call fcn.00434080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x419597
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00467000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x28], rax
call fcn.004392e0
lea rax, [0x00ac93e4]
mov ebx, 0x18
call fcn.00439be0
mov rax, qword [rsp + 0x48]
call fcn.004398e0
lea rax, [0x00ac954c]
mov ebx, 0x19
call fcn.00439be0
mov rax, qword [rsp + 0x28]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ad0b2e]
mov ebx, 0x20
call fcn.00437b60
nop
int3

Function at 0x41a6a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41a7ae
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rsi, qword [rax]
nop dword [rax + rax]
test rsi, rsi
je 0x41a781
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x41a708
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x41a6fb
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.00466220
mov rdi, qword [rsp + 0x18]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x41a738
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov eax, 0x4000
call fcn.0040ea00
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov dword [rdx + 0x28], 0x4000
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x41a760
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004392e0
lea rax, [0x00adc059]
mov ebx, 0x34
call fcn.00439be0
call fcn.00439360
lea rax, [0x00ac84ba]
mov ebx, 0x17
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.0041a6a0