joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b120
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b386
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x45b149
mov dword [rsp + 0x60], ebx
lea rcx, [0x00938560]
jmp 0x45b160
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x210]
nop dword [rax]
test rcx, rcx
je 0x45b197
mov rdx, qword [rcx + 0x118]
cmp rax, rdx
jb 0x45b155
mov rsi, qword [rcx + 0x120]
cmp rax, rsi
jae 0x45b155
movsxd rcx, ebx
lea rax, [rdx + rcx]
cmp rsi, rax
jb 0x45b2f6
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rax
nop
nop
nop
lea rax, [0x010fe280]
call fcn.0040c5e0
mov rbx, qword [0x010fe290]
lea rax, [0x00a0d4e0]
mov ecx, dword [rsp + 0x60]
nop dword [rax]
call fcn.00411860
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
nop
nop
nop
lea rax, [0x010fe280]
nop dword [rax + rax]
call fcn.0040c800
movzx ecx, byte [rsp + 0x1f]
test cl, cl
jne 0x45b256
call fcn.004392e0
lea rax, [0x00ac2cfd]
mov ebx, 0x11
nop
call fcn.00439be0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00439a40
lea rax, [0x00abcb02]
mov ebx, 6
nop dword [rax]
call fcn.00439be0
mov rax, qword [rsp + 0x20]
call fcn.00439a40
lea rax, [0x00ac16b1]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00439be0
call fcn.00439360
lea rax, [0x00938560]
jmp 0x45b2e0
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x40], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x28], rdx
call fcn.004392e0
lea rax, [0x00abd27a]
mov ebx, 7
call fcn.00439be0
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00439a40
lea rax, [0x00abd482]
mov ebx, 8
call fcn.00439be0
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x210]
nop dword [rax + rax]
test rax, rax
jne 0x45b265
lea rax, [0x00ad9aa7]
mov ebx, 0x2e
call fcn.00437b60
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
call fcn.004392e0
lea rax, [0x00ac2cfd]
mov ebx, 0x11
call fcn.00439be0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
nop dword [rax]
call fcn.00439a40
lea rax, [0x00ac047a]
mov ebx, 0xe
call fcn.00439be0
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.00439a40
lea rax, [0x00abc125]
mov ebx, 3
call fcn.00439be0
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
lea rax, [0x00ad19e2]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.0045b120
Function at 0x45b3c0
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b64b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x45b3ee
nop dword [rax]
cmp ebx, 0xffffffff
je 0x45b3ee
lea rcx, [0x00938560]
jmp 0x45b401
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x210]
test rcx, rcx
je 0x45b41a
cmp qword [rcx + 0x118], rax
ja 0x45b3fa
cmp qword [rcx + 0x120], rax
jbe 0x45b3fa
jmp 0x45b41c
xor ecx, ecx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x45b488
mov qword [rsp + 0x40], rcx
mov rdx, qword [rcx + 0x200]
lea rax, [0x00a0dde0]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
nop
call fcn.004116c0
mov rax, qword [rax]
test rax, rax
jne 0x45b47e
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x118]
mov ebx, dword [rsp + 0x60]
movsxd rsi, ebx
lea rax, [rdx + rsi]
mov rcx, qword [rcx + 0x120]
cmp rcx, rax
jb 0x45b5c5
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x18], rax
nop
nop
nop
lea rax, [0x010fe280]
call fcn.0040c5e0
mov rbx, qword [0x010fe290]
lea rax, [0x00a0d4e0]
mov ecx, dword [rsp + 0x60]
call fcn.004116c0
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x010fe280]
call fcn.0040c800
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x45b533
call fcn.004392e0
lea rax, [0x00ac2d41]
mov ebx, 0x11
call fcn.00439be0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00439a40
lea rax, [0x00abcb02]
mov ebx, 6
call fcn.00439be0
mov rax, qword [rsp + 0x18]
call fcn.00439a40
lea rax, [0x00ac16b1]
mov ebx, 0x10
nop dword [rax]
call fcn.00439be0
call fcn.00439360
lea rax, [0x00938560]
jmp 0x45b5ab
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x20], rdx
call fcn.004392e0
lea rax, [0x00abd27a]
mov ebx, 7
call fcn.00439be0
mov rax, qword [rsp + 0x28]
call fcn.00439a40
lea rax, [0x00abd482]
mov ebx, 8
call fcn.00439be0
mov rax, qword [rsp + 0x20]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x210]
test rax, rax
jne 0x45b53d
lea rax, [0x00ad9b31]
mov ebx, 0x2e
nop dword [rax]
call fcn.00437b60
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.004392e0
lea rax, [0x00ac2d41]
mov ebx, 0x11
call fcn.00439be0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00439a40
lea rax, [0x00ac047a]
mov ebx, 0xe
nop dword [rax]
call fcn.00439be0
mov rax, qword [rsp + 0x28]
call fcn.00439a40
lea rax, [0x00abc125]
mov ebx, 3
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x20]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
lea rax, [0x00ad1a24]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0045b3c0
Function at 0x45dee0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45df26
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [rsp + 0x20]
call fcn.00437b20
nop
test rax, rax
jne 0x45df0f
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00ad0a0e]
mov ebx, 0x20
nop dword [rax + rax]
call fcn.00437b60
nop
call fcn.00463440
jmp fcn.0045dee0

Function at 0x45e800
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e9fb
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax + 0x30]
cmp qword [rdx + 0x18], 0
je 0x45e9e9
mov rsi, qword [rdx]
cmp rsi, 0x80
jbe 0x45e859
mov edi, dword [rax + 0x54]
bt edi, 0
nop word [rax + rax]
jae 0x45e9d8
cmp byte [rax + 0x50], 8
jne 0x45e9d8
cmp rsi, 0x80
ja 0x45e870
mov edi, dword [rax + 0x54]
bt edi, 0
jb 0x45e9d8
cmp byte [rax + 0x50], sil
jne 0x45e9d8
mov rdi, qword [rax + 0x38]
mov r8, qword [rdi]
nop word [rax + rax]
cmp r8, 0x80
jbe 0x45e8af
mov r9d, dword [rax + 0x54]
bt r9d, 1
jae 0x45e9c7
cmp byte [rax + 0x51], 8
nop dword [rax]
jne 0x45e9c7
cmp r8, 0x80
ja 0x45e8ca
mov r9d, dword [rax + 0x54]
bt r9d, 1
jb 0x45e9c7
nop
cmp byte [rax + 0x51], r8b
jne 0x45e9c7
movzx edx, byte [rdx + 0x15]
cmp dl, 8
ja 0x45e9b6
movzx edi, byte [rdi + 0x15]
nop dword [rax + rax]
cmp dil, 8
ja 0x45e9a5
test rdx, rdx
je 0x45e9a0
mov rcx, rax
mov rax, rsi
mov r9d, edx
xor edx, edx
div r9
test rdx, rdx
jne 0x45e98c
test rdi, rdi
je 0x45e987
mov rax, r8
xor edx, edx
div rdi
test rdx, rdx
jne 0x45e976
mov eax, 8
xor edx, edx
div r9
test rdx, rdx
jne 0x45e965
mov eax, 8
xor edx, edx
div rdi
test rdx, rdx
jne 0x45e94f
mov rax, rcx
xor ecx, ecx
nop
call fcn.0040f240
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00ace1e3]
mov ebx, 0x1d
nop dword [rax + rax]
call fcn.00437b60
lea rax, [0x00acd39b]
mov ebx, 0x1c
call fcn.00437b60
lea rax, [0x00ad5423]
mov ebx, 0x26
call fcn.00437b60
call fcn.00435420
lea rax, [0x00ad4055]
mov ebx, 0x24
call fcn.00437b60
nop dword [rax]
call fcn.00435420
lea rax, [0x00ac35b1]
mov ebx, 0x12
call fcn.00437b60
lea rax, [0x00ac2b54]
mov ebx, 0x11
call fcn.00437b60
lea rax, [0x00ac1439]
mov ebx, 0xf
call fcn.00437b60
lea rax, [0x00ac0b18]
mov ebx, 0xe
call fcn.00437b60
lea rax, [0x00adb002]
mov ebx, 0x31
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0045e800
Function at 0x45fda0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x30]
nop dword [rax]
cmp qword [r14 + 0x70], rcx
jb 0x45ffc5
mov qword [rsp + 0x10], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rax
mov qword [rcx + 0xb0], 0
call fcn.00441e20
test al, al
jne 0x45fe25
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], 0
cmp byte [0x011062f0], 0
je 0x45ff05
mov rax, qword [rsp + 0x18]
jmp 0x45ff80
cmp byte [0x011062f0], 0
je 0x45fe82
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x18]
cmp rsi, rdi
jne 0x45fe53
mov edx, dword [rdx + 0x274]
cmp dword [rsi + 0x14], edx
je 0x45fe87
lea rax, fcn.00456960
mov qword [rsp], rax
nop
call fcn.00463300
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
nop
jmp 0x45fe87
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
nop
call fcn.0043be20
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rdx, qword [rax + 0x30]
dec dword [rdx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x45fecf
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x45fedd
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x01100c98], 0
je 0x45fefb
call fcn.00445a40
test al, al
jne 0x45fefb
call fcn.0043a420
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, vtable.H9.0
call fcn.00463280
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
lea rax, [0x00c28268]
mov qword [rsp], rax
call fcn.00463300
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, rcx
mov rcx, qword [rsp + 0x10]
nop
test rax, rax
je 0x45ff94
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rax + 0x14]
cmp dword [rdx + 0x274], ebx
je 0x45ff47
call fcn.00465540
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], rax
nop dword [rax]
jmp 0x45ff05
lea rax, [0x00ad9083]
mov ebx, 0x2d
call fcn.00437b60
nop
int3
Function at 0x4655e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x01154780]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x01154110], 0
je 0x465616
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x01154a40]
aesenc xmm0, xmmword [0x01154a50]
aesenc xmm0, xmmword [0x01154a60]
movq rax, xmm0
ret
jmp 0x40ae60

Function at 0x4678c0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rbx, qword [0x00977930]
mov rcx, qword [0x00977938]
mov eax, 2
call fcn.00432d00
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x43adc0
Function at 0x4678e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43b3b7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x38], r14
mov dword [0x01100c58], 0x2710
lea rax, [0x00938560]
jmp 0x43b1a6
mov qword [rsp + 0x30], rax
call fcn.00450b40
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + 0x210]
test rax, rax
jne 0x43b190
call fcn.0044b800
call fcn.0040cf80
nop
lea rax, [0x01154420]
mov ebx, 8
mov rcx, rbx
call fcn.00432980
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rcx
nop dword [rax]
call fcn.0043b4e0
call fcn.0043b0e0
call fcn.00404580
call fcn.00450900
call fcn.0045bd40
call fcn.0040b780
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
test byte [rax], al
call fcn.00432a20
call fcn.004473e0
call fcn.0041a7e0
nop
nop
lea rax, [0x01100c38]
call fcn.0040c5e0
call fcn.00467460
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [0x01100c28], rax
mov eax, dword [0x01154160]
mov dword [rsp + 0x1c], eax
mov ebx, 0xa
lea rax, [0x00abe3a1]
call fcn.00408ca0
call fcn.0044fb40
movsxd rcx, eax
cmp rax, rcx
mov ecx, 0
cmove ecx, eax
sete al
and eax, ebx
nop dword [rax]
test al, al
je 0x43b288
test ecx, ecx
jg 0x43b28c
mov ecx, dword [rsp + 0x1c]
mov eax, ecx
call fcn.00443960
test rax, rax
jne 0x43b3a5
nop
nop
lea rax, [0x01100c38]
call fcn.0040c800
cmp dword [0x01154960], 1
jle 0x43b2e5
mov byte [0x011546d5], 1
mov byte [0x011546d0], 1
mov rcx, qword [0x010fe0e0]
mov qword [rsp + 0x40], rcx
mov rdx, qword [0x010fe0e8]
mov qword [rsp + 0x28], rdx
xor eax, eax
nop dword [rax + rax]
jmp 0x43b398
cmp qword [0x00977958], 0
jne 0x43b326
mov qword [0x00977958], 7
cmp dword [0x011546d0], 0
jne 0x43b313
lea rax, [0x00abd43a]
mov qword [str.go1.17.6], rax
jmp 0x43b326
lea rdi, str.go1.17.6
lea rax, [0x00abd43a]
call fcn.004656c0
cmp qword [0x009779a8], 1
jne 0x43b35f
mov qword [0x009779a8], 0
cmp dword [0x011546d0], 0
jne 0x43b351
mov qword [0x009779a0], 0
jmp 0x43b35f
lea rdi, [0x009779a0]
xor eax, eax
call fcn.004656c0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rax
mov rdx, qword [rcx + rax*8]
test byte [rdx], al
add rdx, 0x16c0
mov rax, rdx
nop
call fcn.0042ffc0
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + 1]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
cmp rax, rdx
jl 0x43b369
nop dword [rax]
jmp 0x43b2e5
lea rax, [0x00ad878c]
mov ebx, 0x2b
call fcn.00437b60
nop
call fcn.00463440
nop dword [rax]
jmp 0x43b160
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x43b160
Function at 0x467b60
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x00adb4d2]
mov ebx, 0x32
call fcn.00437b60
nop
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x460f60

Function at 0x46ba20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bb0c
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x46baf8
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
test rcx, rcx
je 0x46ba68
mov rdx, rcx
nop dword [rax + rax]
cmp rcx, 0xffffffffffffffff
je 0x46ba50
jmp 0x46ba95
call fcn.00460020
mov rcx, 0xffffffffffffffff
mov rax, qword [rsp + 0x28]
xor ebx, ebx
nop dword [rax + rax]
call fcn.0045e4a0
test al, al
jne 0x46bab4
call fcn.00460040
mov rax, qword [rsp + 0x28]
jmp 0x46ba50
cmp qword [rsp + 0x30], rdx
jne 0x46bae5
add rax, 8
mov rbx, qword [rsp + 0x38]
call fcn.0045e3e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + 8]
mov rbx, qword [rsp + 0x38]
call fcn.0045e3e0
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
call fcn.0045e3e0
call fcn.00460040
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db59d0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db59c0]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046ba20

Function at 0x46d020
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d133
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop
cmp rcx, 0x12
ja 0x46d0a0
cmp rcx, 0x11
jne 0x46d06f
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x46d05e
lea rax, [0x00dd16e8]
jmp 0x46d062
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp rcx, 0x12
jne 0x46d11f
mov rcx, qword [rax + 0x30]
nop dword [rax]
test rcx, rcx
je 0x46d08e
lea rax, [0x00dd16e8]
jmp 0x46d092
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp rcx, 0x15
jne 0x46d0c9
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x46d0b8
lea rax, [0x00dd16e8]
jmp 0x46d0bc
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp rcx, 0x16
jne 0x46d0f3
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x46d0e2
lea rax, [0x00dd16e8]
nop
jmp 0x46d0e6
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp rcx, 0x17
jne 0x46d11f
mov rcx, qword [rax + 0x30]
nop dword [rax]
test rcx, rcx
je 0x46d10e
lea rax, [0x00dd16e8]
jmp 0x46d112
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db4d60]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0046d020
Function at 0x46e900
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ea46
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and rcx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x46e988
cmp rcx, 0x11
je 0x46e97a
nop word [rax + rax]
cmp rcx, 0x12
jne 0x46e9e8
cmp qword [rax], 8
jne 0x46ea31
cmp qword [rax + 8], 0
je 0x46ea31
bt edx, 7
jae 0x46e968
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045e5e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x15
jne 0x46e9c0
cmp qword [rax], 8
jne 0x46ea1e
cmp qword [rax + 8], 0
je 0x46ea1e
bt edx, 7
jae 0x46e9a8
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045ec80
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
je 0x46e9da
cmp rcx, 0x18
jne 0x46e9e8
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00a4c6a0]
call fcn.0040e6a0
mov qword [rax + 8], 0x11
lea rcx, [0x00ac2c97]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00a07a20]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5270]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5270]
nop
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046e900
Function at 0x4766c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47692c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rdi, rdi
jl 0x476918
cmp rdi, 9
jg 0x476905
test ebx, ebx
jne 0x476706
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov edx, ebx
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
bsr rdx, rdx
cmp rdx, 0x19
jge 0x47673b
lea rsi, [rdx - 0x19]
neg rsi
cmp rsi, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rsi
shl ebx, cl
and ebx, r8d
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x19]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x48], rax
imul rdx, rcx, 0x13441
add rdx, 0x1ce618
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x30], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x1b
jg 0x476772
test rdx, rdx
setge r8b
jmp 0x476775
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x23], r8b
mov dword [rsp + 0x24], ebx
mov eax, ebx
mov rbx, rcx
mov rcx, rdx
call fcn.00477900
test rbx, rbx
jge 0x4768ef
mov rdx, qword [rsp + 0x30]
lea r8, [rdx + 9]
cmp r8, 0xa
jae 0x4767c8
mov r8d, dword [rsp + 0x24]
mov r8d, r8d
test r8, r8
je 0x4768a7
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x4768c1
movzx esi, byte [rsp + 0x23]
neg rbx
cmp rbx, 0x20
sbb r8d, r8d
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9d, cl
and r9d, r8d
dec r9d
mov r10d, eax
shr eax, cl
and eax, r8d
and r9d, r10d
test sil, sil
je 0x476842
dec rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r10d, 1
shl r10d, cl
and r10d, r8d
cmp r10d, r9d
jb 0x476831
jne 0x476838
test dil, dil
je 0x476831
nop dword [rax]
cmp r10d, r9d
jne 0x476838
test dil, dil
je 0x476838
mov ebx, eax
and eax, 1
jmp 0x47683c
mov ecx, 1
jmp 0x476860
mov ebx, eax
xor eax, eax
mov ecx, eax
mov eax, ebx
jmp 0x476860
dec rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r10d, r9d
shr r9d, cl
and r9d, r8d
cmp r9d, 1
sete cl
mov r9d, r10d
nop
test r9d, r9d
je 0x476867
xor edi, edi
xor edi, 1
mov ebx, eax
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov edx, ecx
mov ecx, edi
mov edi, edx
nop dword [rax]
call fcn.00476c00
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x30]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov esi, 1
mov ecx, 1
jmp 0x4767cd
inc rsi
mov eax, edi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x4768a7
mov edi, eax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x4768b6
mov eax, edi
mov rdx, r10
jmp 0x4767c8
lea rax, [0x009e4c00]
lea rbx, [0x00db58f0]
nop dword [rax]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db58e0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db58d0]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00463440
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004766c0