joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d8e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48d95c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x15
jne 0x48d929
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x48d918
lea rax, [0x00e15450]
jmp 0x48d91c
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0048c1e0
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00ada4d6]
call fcn.0044eae0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009ed380]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.0048d8e0

Function at 0x48d980
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48d9e7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x11
jne 0x48d9b4
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0048c1e0
mov ecx, 0x1f
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00adc345]
call fcn.0044eae0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009ed380]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.0048d980

Function at 0x48da80
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48dae7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x13
jne 0x48dab4
movzx eax, word [rax + 0x30]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0048c1e0
mov ecx, 0x20
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00adcdce]
call fcn.0044eae0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009ed380]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.0048da80

Function at 0x48db00
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48db95
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx edx, byte [rax + 0x17]
and edx, 0x1f
nop
cmp rdx, 0x13
jne 0x48db60
movzx edx, word [rax + 0x32]
and edx, 0x7fff
test dx, dx
jne 0x48db39
xor ecx, ecx
jmp 0x48db4a
movzx eax, word [rax + 0x30]
add edx, eax
movzx ecx, dx
cmp rax, rcx
ja 0x48db57
sub rcx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00465d20
nop dword [rax]
call fcn.0048c1e0
mov ecx, 0x21
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00addc7d]
call fcn.0044eae0
nop
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009ed380]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.0048db00
Function at 0x48dbc0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48dcad
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx edx, byte [rax + 0x17]
and edx, 0x1f
nop
cmp rdx, 0x13
jne 0x48dc7a
movzx edx, byte [rax + 0x14]
test dl, 1
je 0x48dbfa
mov ecx, 0x48
jmp 0x48dbff
mov ecx, 0x38
movzx edx, word [rax + 0x32]
and edx, 0x7fff
test dx, dx
jne 0x48dc14
xor edx, edx
xor esi, esi
jmp 0x48dc40
movzx esi, word [rax + 0x30]
add edx, esi
lea rdi, [rax + rcx]
movzx ecx, dx
cmp rsi, rcx
ja 0x48dc73
sub rcx, rsi
mov rdx, rcx
neg rcx
shl rsi, 3
sar rcx, 0x3f
and rsi, rcx
add rsi, rdi
nop dword [rax]
cmp rbx, rdx
jae 0x48dc68
mov rcx, qword [rsi + rbx*8]
test rcx, rcx
je 0x48dc57
lea rax, [0x00e15450]
jmp 0x48dc5b
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rbx
mov rcx, rdx
call fcn.00465ba0
mov eax, esi
call fcn.00465d20
call fcn.0048c1e0
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00adb3b9]
call fcn.0044eae0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009ed380]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0048dbc0
Function at 0x498a00
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498af0
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and rcx, 0x1f
cmp rcx, 0x19
jne 0x498ab4
mov rsi, qword [rax + 0x38]
cmp qword [rax + 0x40], rdi
jbe 0x498aa1
lea rdi, [rdi + rdi*2]
mov rax, qword [rsi + rdi*8 + 8]
mov r8, qword [rsi + rdi*8]
and rdx, 0x1a0
movzx r9d, byte [rax + 0x17]
and r9d, 0x1f
or rdx, r9
movzx r8d, byte [r8]
test r8b, 1
jne 0x498a86
mov r8, rdx
or rdx, 0x40
or r8, 0x20
mov r9, qword [rsi + rdi*8 + 0x10]
test r9, 1
cmovne r8, rdx
nop
mov rdx, r8
nop
nop
mov rsi, qword [rsi + rdi*8 + 0x10]
shr rsi, 1
add rbx, rsi
mov rcx, rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
lea rax, [0x009ed380]
lea rbx, [0x00df4ee0]
call fcn.004373c0
mov qword [rsp + 0x10], rcx
lea rax, [0x00a57e60]
call fcn.0040e6a0
mov qword [rax + 8], 0x13
lea rcx, [0x00ad0013]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00a12340]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00498a00
Function at 0x4992c0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49944c
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and rcx, 0x1f
cmp rcx, 0x11
jne 0x499340
cmp qword [rax + 0x40], rdi
jbe 0x499438
mov rax, qword [rax + 0x30]
test rdx, 0x60
mov ecx, 0
mov esi, 0x20
cmovne rcx, rsi
mov rsi, qword [rax]
imul rdi, rsi
nop
and rdx, 0x180
or rcx, rdx
movzx edx, byte [rax + 0x17]
and edx, 0x1f
or rcx, rdx
add rbx, rdi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
jne 0x499391
cmp qword [rbx + 8], rdi
jbe 0x499425
mov rax, qword [rax + 0x30]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
mov rdx, qword [rax]
movzx esi, byte [rax + 0x17]
and esi, 0x1f
or rcx, rsi
or rcx, 0x180
imul rdi, rdx
add rdi, qword [rbx]
mov rbx, rdi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x18
jne 0x4993e5
cmp qword [rbx + 8], rdi
jbe 0x4993d2
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
mov rdx, qword [rbx]
or rcx, 0x88
mov rax, qword [0x01143648]
nop
lea rbx, [rdx + rdi]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x009ed380]
lea rbx, [0x00df4f10]
call fcn.004373c0
mov qword [rsp + 0x10], rcx
lea rax, [0x00a57e60]
call fcn.0040e6a0
mov qword [rax + 8], 0x13
lea rcx, [0x00ad0039]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00a12340]
nop dword [rax + rax]
call fcn.004373c0
lea rax, [0x009ed380]
lea rbx, [0x00df4c70]
call fcn.004373c0
lea rax, [0x009ed380]
lea rbx, [0x00df4f00]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004992c0

Function at 0x49a3c0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a489
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rax + 0x18]
nop dword [rax]
test rcx, rcx
je 0x49a475
mov qword [rsp + 0x40], rax
mov rax, rcx
call fcn.0045ec60
test rax, rax
je 0x49a462
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x28], rdx
mov rbx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rbx
mov rax, qword [rcx + 0x18]
movzx ecx, byte [rdx + 0x17]
mov byte [rsp + 0x1f], cl
call fcn.0045ec60
mov rcx, qword [rsp + 0x20]
test rcx, 0x60
mov ebx, 0
mov ecx, 0x20
cmovne rbx, rcx
movzx ecx, byte [rsp + 0x1f]
and ecx, 0x1f
or rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x28]
call fcn.0049a7c0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x009ed380]
lea rbx, [0x00df4f40]
call fcn.004373c0
lea rax, [0x009ed380]
lea rbx, [0x00df4f30]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.0049a3c0
Function at 0x49a4a0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a569
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rax + 0x18]
nop dword [rax]
test rcx, rcx
je 0x49a555
mov qword [rsp + 0x40], rax
mov rax, rcx
call fcn.0045ec60
test rax, rax
je 0x49a542
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rdx, qword [rdx + 0x38]
mov qword [rsp + 0x28], rdx
mov rbx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rbx
mov rax, qword [rcx + 0x18]
movzx ecx, byte [rdx + 0x17]
mov byte [rsp + 0x1f], cl
call fcn.0045ec80
mov rcx, qword [rsp + 0x20]
test rcx, 0x60
mov ebx, 0
mov ecx, 0x20
cmovne rbx, rcx
movzx ecx, byte [rsp + 0x1f]
and ecx, 0x1f
or rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x28]
call fcn.0049a7c0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x009ed380]
lea rbx, [0x00df4f60]
call fcn.004373c0
lea rax, [0x009ed380]
lea rbx, [0x00df4f50]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.0049a4a0

Function at 0x49e380
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e4f2
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x98]
mov rax, rbx
call rdx
nop dword [rax + rax]
cmp rax, 0x17
jne 0x49e4de
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jl 0x49e4cb
mov rdx, qword [rsp + 0x48]
nop dword [rax]
test rdx, rdx
jl 0x49e4b8
cmp rcx, rdx
jg 0x49e4a5
lea rax, [0x00a70280]
call fcn.0040e6a0
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x38]
call rdx
lea rcx, [0x00e15450]
cmp rax, rcx
jne 0x49e491
mov rax, rbx
mov rbx, qword [rsp + 0x48]
call fcn.0045e800
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rbx + 0x10], rcx
cmp dword [0x0119ba70], 0
jne 0x49e451
mov qword [rbx], rax
jmp 0x49e459
mov rdi, rbx
call fcn.00465700
mov rax, qword [rsp + 0x30]
lea rdx, [0x00e15450]
cmp rax, rdx
jne 0x49e47e
mov rax, qword [rsp + 0x38]
mov ecx, 0x97
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rbx, [0x00aba100]
lea rcx, [0x00aa9e80]
call fcn.0040b940
lea rbx, [0x00aba100]
lea rcx, [0x00aa9e80]
nop
call fcn.0040b940
lea rax, [0x009ed380]
lea rbx, [0x00df4c20]
call fcn.004373c0
lea rax, [0x009ed380]
lea rbx, [0x00df4c10]
call fcn.004373c0
lea rax, [0x009ed380]
lea rbx, [0x00df4bf0]
call fcn.004373c0
lea rax, [0x009ed380]
lea rbx, [0x00df4be0]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.0049e380
Function at 0x49eb00
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ec3a
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rsi
bt ecx, 9
jae 0x49eb68
mov rdi, rbx
mov rsi, rcx
mov ebx, 7
mov rcx, rax
lea rax, [0x00ac8759]
call fcn.0048b560
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov rdx, qword [rdi + 0x100]
mov rax, rsi
call rdx
mov rbx, qword [rsp + 0x60]
call fcn.0049ede0
test rax, rax
je 0x49ebc4
mov r8, qword [rax]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rdx, rax
mov rax, qword [rsp + 0x60]
call r8
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, qword [rsp + 0x60]
call fcn.0048c1e0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx + 0xf8]
mov rax, qword [rsp + 0xa0]
call rcx
mov ecx, 0x25
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00ad9721]
mov r9d, 0x1d
mov r10, rax
mov r11, rbx
xor eax, eax
lea rbx, [0x00ae12c8]
nop dword [rax]
call fcn.0044ec60
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009ed380]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0049eb00
Function at 0x509b80
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x509cb1
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
nop dword [rax]
test rbx, rbx
je 0x509bb3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
xor ecx, ecx
jmp 0x509bce
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
cmp rbx, rcx
jle 0x509ca2
movzx edx, byte [rax + rcx]
nop dword [rax + rax]
cmp edx, 0x80
jge 0x509bee
lea rsi, [rcx + 1]
jmp 0x509bf8
call fcn.0045d020
mov edx, eax
mov rsi, rbx
mov dword [rsp + 0x1c], edx
mov qword [rsp + 0x20], rsi
lea rax, [0x00ad86f1]
mov ebx, 0x1c
mov ecx, edx
call fcn.004fa8a0
test rax, rax
jge 0x509bbf
mov ebx, dword [rsp + 0x1c]
nop dword [rax]
cmp ebx, 0xff
ja 0x509c3e
movzx edx, bl
lea rsi, [0x0093d740]
movzx edx, byte [rsi + rdx]
test dl, 0x60
setne dl
jmp 0x509c57
mov rax, qword [0x0097f3d8]
call fcn.00475a80
mov ebx, dword [rsp + 0x1c]
lea rsi, [0x0093d740]
mov edx, eax
test dl, dl
jne 0x509bbf
nop
cmp ebx, 0xff
jg 0x509c79
cmp ebx, 0x30
jl 0x509c75
cmp ebx, 0x39
setle dl
jmp 0x509c8e
xor edx, edx
jmp 0x509c8e
mov rax, qword [0x0097f258]
call fcn.00475a80
lea rsi, [0x0093d740]
mov edx, eax
test dl, dl
jne 0x509bbf
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, 1
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00509b80

Function at 0x50d6a0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d783
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x28], 0
nop dword [rax]
jne 0x50d774
cmp byte [rax + 8], 0
jne 0x50d765
mov qword [rsp + 0x20], rax
mov rdx, qword [rax]
mov rcx, qword [rdx]
mov ebx, 0x20
call rcx
mov rcx, qword [rsp + 0x20]
cmp byte [rcx + 8], 0
jne 0x50d756
cmp qword [rcx + 0x28], 0
jne 0x50d747
lea rax, [0x00a50ca0]
nop dword [rax + rax]
call fcn.0040e6a0
mov qword [rax + 8], 0x1c
lea rcx, [0x00ad9625]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x38]
mov qword [rax + 0x10], rdx
lea rdx, [0x00dfe4c0]
mov qword [rcx + 0x28], rdx
cmp dword [0x0119ba70], 0
jne 0x50d73e
mov qword [rcx + 0x30], rax
jmp 0x50d747
lea rdi, [rcx + 0x30]
call fcn.00465700
mov eax, 0xb
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov eax, 0xa
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov eax, 0xa
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov eax, 0xb
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.0050d6a0
Function at 0x511400
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51155e
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rcx, qword [rax + 0x110]
cmp rcx, 3
je 0x5114c8
cmp rcx, 6
jne 0x5114ed
call fcn.00511580
nop dword [rax]
test rbx, rbx
jne 0x5114b8
cmp al, 0x3a
jne 0x511465
mov rcx, qword [rsp + 0x30]
inc qword [rcx + 0xb0]
mov qword [rcx + 0x110], 7
jmp 0x5114ed
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0xb8]
add rdx, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rdx
lea rax, [0x00a50ca0]
call fcn.0040e6a0
mov qword [rax + 8], 0x1f
lea rcx, [0x00adc07c]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00dfe4c0]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rbx
mov rbx, rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00511580
test rbx, rbx
jne 0x51154e
cmp al, 0x2c
jne 0x5114fb
mov rcx, qword [rsp + 0x30]
inc qword [rcx + 0xb0]
mov qword [rcx + 0x110], 2
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0xb8]
add rdx, qword [rcx + 0xb0]
mov qword [rsp + 0x10], rdx
lea rax, [0x00a50ca0]
call fcn.0040e6a0
mov qword [rax + 8], 0x22
lea rcx, [0x00adea06]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00dfe4c0]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rbx
mov rbx, rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.00511400

Function at 0x810120
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x81018f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x10], rax
lea rax, [0x00a97680]
call fcn.0040e6a0
mov word [rax], 1
mov qword [rax + 8], 0
mov qword [rax + 0x18], 0x21
lea rcx, [0x00add290]
mov qword [rax + 0x10], rcx
movups xmmword [rax + 0x28], xmm15
mov qword [rax + 0x20], 0
mov byte [rax + 0x38], 0
mov rbx, rax
mov rax, qword [rsp + 0x10]
nop
call fcn.0080fc80
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
nop
jmp fcn.00810120
Function at 0x878e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movsxd rbp, dword [rdx]
mov rbx, rbp
mov r12, rcx
mov rcx, r8
movzx r8d, byte [r8]
mov r13, rdx
lea rdi, [r12 + rbp]
test r8b, r8b
je 0x878ebd
mov eax, r8d
mov rsi, rcx
lea r10, [0x011330c0]
xor edx, edx
nop word [rax + rax]
movzx r9d, al
test byte [r10 + r9], 6
jne 0x878e9f
cmp al, 0x5f
jne 0x878eae
movzx eax, byte [rsi + 1]
add rsi, 1
add edx, 1
test al, al
jne 0x878e90
movzx eax, r8b
test byte [r10 + rax], 4
je 0x878f50
mov byte [rdi], 0x22
add ebx, 1
movzx eax, byte [rcx]
mov r8d, 1
movsxd rbp, ebx
lea rdi, [r12 + rbp]
test al, al
jne 0x878ef1
jmp 0x878f38
movzx eax, byte [rcx + 1]
add rcx, 1
mov ebx, edx
test al, al
je 0x878f1b
movsxd rbp, ebx
lea edx, [rbx + 1]
mov byte [r12 + rbp], al
movsxd rdi, edx
add rdi, r12
cmp byte [rcx], 0x22
jne 0x878ee0
add rcx, 1
mov byte [rdi], 0x22
add ebx, 2
movzx eax, byte [rcx]
movsxd rbp, ebx
lea rdi, [r12 + rbp]
test al, al
jne 0x878eee
test r8d, r8d
jne 0x878f38
mov byte [rdi], 0
mov dword [r13], ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
add ebx, 1
mov byte [rdi], 0x22
movsxd rdi, ebx
add rdi, r12
jmp 0x878f20
mov dword [rsp + 0x2c], 0x3b
cmp edx, 1
jle 0x878f90
lea r8, [rsp + 0x2c]
call fcn.00878d10
cmp dword [rsp + 0x2c], 0x3b
jne 0x878ebd
cmp byte [rsi], 0
jne 0x878ebd
movzx eax, byte [rcx]
test al, al
je 0x878f20
xor r8d, r8d
jmp 0x878ef1
cmp byte [rsi], 0
setne al
xor edx, 1
and edx, 1
or al, dl
jne 0x878ebd
mov eax, r8d
xor r8d, r8d
jmp 0x878ef1

Function at 0x87c9a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edi, dword [rcx + 0x80]
movsxd rax, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x78]
lea rdx, [rax*8]
mov rbp, rax
sub rdx, rax
shl rdx, 3
call fcn.0087c400
mov r12, rax
test rax, rax
je 0x87cab7
movsxd rdx, edi
lea rax, [rdx*8]
sub rax, rdx
xor edx, edx
lea rbx, [r12 + rax*8]
mov eax, ebp
sub eax, edi
mov rcx, rbx
cdqe
lea r8, [rax*8]
sub r8, rax
shl r8, 3
call sub.msvcrt.dll_memset
mov qword [rsi + 0x78], r12
cmp edi, ebp
jl 0x87ca87
jmp 0x87cad0
mov rax, qword [rsi + 0x60]
test rax, rax
jle 0x87ca99
mov qword [rbx], rax
mov eax, dword [rsi + 0x3c]
mov ecx, 0x200
mov dword [rbx + 0x1c], eax
call fcn.0087bdf0
test rax, rax
je 0x87caa8
mov dword [rax], r12d
mov qword [rbx + 0x10], rax
mov rax, qword [rsi + 0x120]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x87ca76
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add edi, 1
add rbx, 0x38
mov dword [rsi + 0x80], edi
cmp edi, ebp
je 0x87cad0
mov rax, qword [rsi + 0x50]
mov r12d, dword [rsi + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r12d
jne 0x87ca20
mov eax, dword [rsi + 0xb8]
jmp 0x87ca29
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x8836c0
Capabilities:
Create thread

Disassembly:
mov rax, qword [rcx + 0x48]
test rax, rax
je 0x8836f0
mov r8d, dword [rax + 0x20]
test r8d, r8d
je 0x8836e8
mov r8, rcx
mov rcx, qword [rax]
lea rdx, [0x00883880]
jmp fcn.0087c310
jmp fcn.008835a0
xor eax, eax
ret
Function at 0x8dd3e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, dword [rdx + 8]
mov r12, rcx
mov rbx, rdx
mov edi, r8d
test eax, eax
jne 0x8dd4ef
mov rsi, qword [rdx + 0x60]
test rsi, rsi
je 0x8dd4ef
mov eax, dword [rcx + 0x38]
mov r13, qword [rcx + 0x10]
lea ebp, [rax + 1]
mov dword [rcx + 0x38], ebp
mov dword [rdx + 8], ebp
test r13, r13
jne 0x8dd42a
call fcn.0088bf20
mov r13, rax
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x3c]
call fcn.00876cd0
test eax, eax
jne 0x8dd500
cmp qword [r12 + 0x10], 0
je 0x8dd457
mov rdx, qword [rsi + 0x10]
mov r8d, ebp
mov rcx, r12
call fcn.008dc560
xor r9d, r9d
mov r8d, ebp
mov edx, 0xf
mov rcx, r13
mov dword [rsp + 0x20], 0
call fcn.0088b640
mov r9d, edi
mov r8d, ebp
mov edx, 0x14
mov dword [rsp + 0x20], 0
mov rcx, r13
call fcn.0088b640
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x8dd4ef
mov eax, dword [r12 + 0x38]
cmp qword [r12 + 0x10], 0
lea esi, [rax + 1]
mov dword [rbx + 0xc], esi
lea ebx, [rax + 2]
mov dword [r12 + 0x38], ebx
je 0x8dd4bc
mov r8d, esi
mov rcx, r12
call fcn.008dc560
xor r9d, r9d
mov r8d, esi
mov edx, 0xf
mov rcx, r13
mov dword [rsp + 0x20], 0
call fcn.0088b640
mov dword [rsp + 0x20], esi
mov r9d, ebx
mov r8d, ebp
mov edx, 0x9f
mov rcx, r13
call fcn.0088b640
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, dword [rsp + 0x3c]
mov r9d, ebp
mov edx, 0x47
mov rcx, r13
mov dword [rsp + 0x20], 0
call fcn.0088b640
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x8dd5a0
js 0x8dd48d
movzx r9d, word [rbx + 2]
movsxd rdx, eax
cmp eax, 7
jg 0x8dd5c0
cmp eax, 1
je 0x8dd60e
mov rax, rdx
mov ecx, 0x1e
nop dword [rax]
add rax, rax
mov r8d, ecx
sub ecx, 0xa
cmp rax, 7
jbe 0x8dd550
lea r10, [0x0112c980]
and eax, 7
movzx eax, word [r10 + rax*2]
lea r8d, [r8 + rax - 0xa]
cmp r9w, r8w
jle 0x8dd48d
mov ecx, 0x1e
nop word [rax + rax]
mov eax, ecx
add rdx, rdx
lea ecx, [rax - 0xa]
cmp rdx, 7
jbe 0x8dd588
and edx, 7
movzx edx, word [r10 + rdx*2]
jmp 0x8dd5fa
mov r9d, edi
xor r8d, r8d
mov edx, 0xb
mov rcx, r13
mov dword [rsp + 0x20], 0
call fcn.0088b640
jmp 0x8dd48d
bsr rax, rdx
mov ecx, 0x3c
xor rax, 0x3f
sub ecx, eax
shr rdx, cl
lea r8d, [rcx + rcx*4]
lea rcx, [0x0112c980]
and edx, 7
add r8d, r8d
movzx edx, word [rcx + rdx*2]
lea eax, [r8 + 0x28]
lea r8d, [rdx + r8 + 0x1e]
cmp r9w, r8w
jle 0x8dd48d
lea eax, [rax + rdx - 0xa]
or dword [rbx + 4], 0x4000
mov word [rbx + 2], ax
jmp 0x8dd48d
test r9w, r9w
jle 0x8dd48d
xor eax, eax
jmp 0x8dd5fe