joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d0e90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x1400d0ed7
cmp byte [rdi + 0x20], 0
jne 0x1400d0ed7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400d0ecf
mov eax, 0x80004005
jmp 0x1400d1066
mov qword [rdi + 0x18], 0xffffffffffffffff
xor r12d, r12d
mov r15d, r12d
mov ebx, 0xffffffff
mov dword [rsp + 0xa0], ebx
mov eax, dword [rdi + 0x30]
test eax, eax
je 0x1400d0f2b
mov r8d, eax
mov rdx, qword [rdi + 0x28]
mov rcx, rsi
call fcn.1400b3170
test eax, eax
jne 0x1400d1066
mov r8d, dword [rdi + 0x30]
lea r9, [0x14017e1e0]
mov rdx, qword [rdi + 0x28]
mov ecx, ebx
call qword [0x14017de80]
mov ebx, eax
mov dword [rsp + 0xa0], eax
mov r15d, dword [rdi + 0x30]
cmp byte [rdi + 0x48], r12b
je 0x1400d1052
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x1400d1077
cmp r15, qword [rdi + 0x50]
jae 0x1400d1043
mov dword [rsp + 0xb0], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
mov r8d, 0x100000
mov rdx, qword [rdi + 0x28]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400d1077
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x1400d1043
mov r14d, eax
mov ebx, eax
mov rbp, qword [rdi + 0x28]
test rax, rax
je 0x1400d1017
nop
mov eax, 0x80000000
mov r8d, eax
cmp rbx, rax
cmovb r8d, ebx
mov rax, qword [rsi]
lea r9, [rsp + 0xb8]
mov rdx, rbp
mov rcx, rsi
call qword [rax + 0x18]
mov esi, eax
mov ecx, dword [rsp + 0xb8]
add rbp, rcx
sub rbx, rcx
test eax, eax
jne 0x1400d107c
test ecx, ecx
je 0x1400d1077
test rbx, rbx
mov rsi, qword [rsp + 0xa8]
jne 0x1400d0fd0
lea r9, [0x14017e1e0]
mov r8, r14
mov rdx, qword [rdi + 0x28]
mov ecx, dword [rsp + 0xa0]
call qword [0x14017de80]
mov ebx, eax
mov dword [rsp + 0xa0], eax
add r15, r14
jmp 0x1400d0f77
cmp r13, 0xffffffffffffffff
je 0x1400d1052
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rdi + 0x58], ebx
jne 0x1400d105d
cmp r15, qword [rdi + 0x50]
je 0x1400d1063
mov r12d, 0x80004005
mov eax, r12d
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov esi, 0x80004005
cmp r13, 0xffffffffffffffff
je 0x1400d108b
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1400d1066
Function at 0x140118ad0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1401187f6
call fcn.140104728
mov dword [rax], 0x16
call fcn.1400ff650
jmp 0x140118941
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140118941
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140118941
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140118825
lock or dword [rcx + 0x14], 0x10
jmp 0x140118941
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140118839
call fcn.14011910c
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140118849
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14011884c
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14010b1a4
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14011d3e8
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14011892f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1401188dd
mov rcx, rbx
call fcn.14010b1a4
cmp eax, 0xffffffff
je 0x1401188c8
mov rcx, rbx
call fcn.14010b1a4
cmp eax, 0xfffffffe
je 0x1401188c8
mov rcx, rbx
call fcn.14010b1a4
movsxd rdi, eax
lea r14, [0x14017d0d0]
mov rcx, rbx
sar rdi, 6
call fcn.14010b1a4
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1401188cf
lea rdx, [0x1401772d0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401188dd
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140118901
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140118901
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140118901
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14011891f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14011892a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140118946
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1401187c0
Function at 0x4044a0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40453b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
test rax, rax
je 0x4044f9
mov rax, qword [rax + 8]
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x404508
movzx esi, byte [rax + 0x17]
test sil, 0x20
je 0x4044e4
cmp rbx, rcx
sete al
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rsi, qword [rdx]
mov rax, rbx
mov rbx, rcx
call rsi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, 1
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0045af80
mov ecx, 0x1c
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00ad90e5]
call fcn.0044eae0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x00a1aa60]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.004044a0
Function at 0x404840
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], r14
mov rdx, qword [r14 + 0x30]
mov rsi, r14
cmp qword [rdx + 0x90], rsi
je 0x4048aa
nop
call fcn.004392e0
lea rax, [0x00adb431]
mov ebx, 0x1e
call fcn.00439be0
call fcn.00439360
mov eax, 2
call fcn.00432c80
mov rsi, qword [rsp + 0x60]
mov rax, qword [r14 + 0x30]
nop
inc dword [rax + 0x244]
mov rax, qword [r14 + 0x30]
nop
mov rcx, r14
mov qword [rax + 0x138], rcx
mov rax, qword [r14 + 0x30]
mov qword [r14 + 0xe8], rax
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rax + 0x2e0]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x2f0]
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [rax + 0x300]
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rsi + 0x70]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsi + 0x78]
mov qword [rsp + 0x18], rdx
call fcn.0045fde0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0x350], edx
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x78]
call fcn.00404a20
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 1
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x68]
nop
cmp rcx, rdx
jne 0x404a07
mov qword [rsp + 0x70], rcx
nop
jmp 0x4049a3
nop
lea rax, [0x00c56998]
mov qword [rsp], rax
nop dword [rax]
call fcn.00463340
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
xor eax, eax
mov esi, 1
lock cmpxchg dword [rcx + 0x350], esi
sete dil
test dil, dil
je 0x404971
mov rbx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x18]
call fcn.00441560
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x30]
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx + 0x2e0], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rcx + 0x2f0], xmm0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rcx + 0x300], xmm0
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x00ae1c0c]
mov ebx, 0x26
call fcn.00437b60
nop
int3
Function at 0x40c4e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c56c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, rax
shl rax, 0x10
or rax, 0x7ffff
sar rax, 0x13
shl rax, 3
cmp rcx, rax
jne 0x40c51c
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rcx
call fcn.004392e0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x10], rax
call fcn.004392e0
lea rax, [0x00ad957d]
mov ebx, 0x1c
call fcn.00439be0
mov rax, qword [rsp + 0x10]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
lea rax, [0x00acee5f]
mov ebx, 0x12
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.0040c4e0

Function at 0x40c960
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40ca86
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [r14 + 0x30]
mov rdx, r14
nop
cmp qword [rcx], rdx
jne 0x40ca70
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x18], rdx
mov rax, rcx
call fcn.004335c0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x30]
lock cmpxchg qword [rbx], rdx
sete dl
test dl, dl
je 0x40c9e7
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x0097f0e0]
cmp qword [rdx], 0
je 0x40c9d4
jmp 0x40ca66
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
call fcn.00433220
jmp 0x40ca08
cmp qword [rbx], 1
jne 0x40c9f7
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00ada3d1]
mov ebx, 0x1d
call fcn.00437b60
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x989680
call fcn.00433220
mov rcx, qword [0x0097f0e0]
mov rcx, qword [rcx]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
call fcn.004652c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rbx]
test rdx, rdx
je 0x40ca22
jmp 0x40ca08
lea rax, [0x00acff42]
mov ebx, 0x13
nop dword [rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.0040c960
Function at 0x40caa0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
nop
test cl, cl
je 0x40cb31
mov qword [rsp + 0x28], r14
test rbx, rbx
jge 0x40cafb
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x0097f0e0]
cmp qword [rcx], 0
jne 0x40cd1f
mov rax, 0xffffffffffffffff
call fcn.00433220
jmp 0x40ccd0
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x48], rbx
call fcn.004674a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x48]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40cb5d
cmp qword [rdx], 1
jne 0x40cb46
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00adb2e7]
mov ebx, 0x1e
call fcn.00437b60
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x0097f0e0]
cmp qword [rdx], 0
je 0x40cb8e
nop word [rax + rax]
cmp rbx, 0x989680
jle 0x40cb8e
mov ebx, 0x989680
mov rax, rbx
call fcn.00433220
test eax, eax
jge 0x40cc22
mov rax, qword [0x0097f0e0]
mov rax, qword [rax]
test rax, rax
je 0x40cbd3
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.004652c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.004674a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40cb57
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
nop
jmp 0x40cc41
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rsi, qword [rcx]
mov rdi, qword [rdx + 0x30]
mov r8, rdi
cmp rsi, rdi
jne 0x40cc71
mov rax, rsi
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
nop
test dil, dil
je 0x40cc41
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp rsi, 1
jne 0x40ccbf
mov byte [r8 + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.00433220
test eax, eax
jl 0x40ccae
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00ae8037]
mov ebx, 0x32
call fcn.00437b60
lea rax, [0x00ae7814]
mov ebx, 0x31
call fcn.00437b60
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [0x0097f0e0]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.004652c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, 0x989680
call fcn.00433220
test eax, eax
jl 0x40ccef
jmp 0x40ccd0
Function at 0x40cf80
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d28f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [0x0093b204], 0x10
jne 0x40d27d
call fcn.004356a0
xor eax, eax
jmp 0x40cfcc
lea rdx, [rax + rax*2]
lea rsi, [0x0093b200]
movzx edi, word [rsi + rax*2]
lea r8, [0x011a1190]
mov dword [r8 + rdx*8], edi
inc rax
cmp rax, 0x44
jl 0x40cfaf
mov rdx, qword [0x0119b800]
nop dword [rax]
test rdx, rdx
je 0x40d26c
cmp rdx, 0x80000
ja 0x40d200
nop word [rax + rax]
nop
cmp rdx, 0x1000
jb 0x40d18c
lea rbx, [rdx - 1]
test rdx, rbx
jne 0x40d140
mov rdx, qword [0x0119b7f8]
lea rbx, [rdx - 1]
test rdx, rbx
jne 0x40d0ef
cmp rdx, 0x400000
jbe 0x40d042
mov qword [0x0119b7f8], 0
cmp qword [0x0119b7f8], 0
jne 0x40d0c8
lea rax, [0x0115d560]
call fcn.00426a40
call fcn.004178c0
mov qword [0x0119b7b8], rax
mov eax, 0x7f
jmp 0x40d0ae
mov qword [rsp + 0x10], rax
lea rax, [0x01174110]
call fcn.0041a6a0
mov rcx, qword [rsp + 0x10]
mov rdx, rcx
shl rcx, 0x28
movabs rbx, 0xc000000000
or rcx, rbx
mov qword [rax], rcx
mov rcx, qword [0x0116d918]
mov qword [rax + 0x10], rcx
mov qword [0x0116d918], rax
lea rax, [rdx - 1]
test rax, rax
jge 0x40d06b
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rdx, [rcx + 1]
mov qword [0x0119b7f0], rdx
mov rcx, qword [0x0119b7f0]
cmp rcx, 0x40
sbb rdx, rdx
mov ebx, 1
shl rbx, cl
and rbx, rdx
cmp qword [0x0119b7f8], rbx
jne 0x40d0bd
jmp 0x40d04c
call fcn.004392e0
lea rax, [0x00ad42f6]
mov ebx, 0x17
call fcn.00439be0
mov rax, qword [0x0119b7f8]
call fcn.004398e0
lea rax, [0x00ad3326]
mov ebx, 0x17
nop dword [rax]
call fcn.00439be0
call fcn.00439360
lea rax, [0x00ad5e9f]
mov ebx, 0x19
call fcn.00437b60
nop dword [rax + rax]
call fcn.004392e0
lea rax, [0x00acf24f]
mov ebx, 0x12
call fcn.00439be0
mov rax, qword [0x0119b800]
nop dword [rax]
call fcn.004398e0
lea rax, [0x00ad3326]
mov ebx, 0x17
call fcn.00439be0
call fcn.00439360
lea rax, [0x00ad0d11]
mov ebx, 0x14
call fcn.00437b60
call fcn.004392e0
lea rax, [0x00acf24f]
mov ebx, 0x12
nop dword [rax]
call fcn.00439be0
mov rax, qword [0x0119b800]
call fcn.004398e0
lea rax, [0x00ae09ad]
mov ebx, 0x25
nop dword [rax]
call fcn.00439be0
mov eax, 0x1000
call fcn.004399e0
lea rax, [0x00ac7791]
mov ebx, 2
nop dword [rax + rax]
call fcn.00439be0
call fcn.00439360
lea rax, [0x00ad0d11]
mov ebx, 0x14
call fcn.00437b60
nop dword [rax + rax]
call fcn.004392e0
lea rax, [0x00acf24f]
mov ebx, 0x12
call fcn.00439be0
mov rax, qword [0x0119b800]
nop dword [rax]
call fcn.004398e0
lea rax, [0x00adfc09]
mov ebx, 0x24
call fcn.00439be0
mov eax, 0x80000
nop dword [rax + rax]
call fcn.004399e0
lea rax, [0x00ac7791]
mov ebx, 2
call fcn.00439be0
call fcn.00439360
lea rax, [0x00ad0d11]
mov ebx, 0x14
call fcn.00437b60
lea rax, [0x00adb107]
mov ebx, 0x1e
call fcn.00437b60
lea rax, [0x00ace246]
mov ebx, 0x11
call fcn.00437b60
nop
call fcn.00463480
jmp fcn.0040cf80
Function at 0x40eb20
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40edb7
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rax, rax
je 0x40eda5
test rbx, rbx
je 0x40eb6e
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40ed90
nop dword [rax + rax]
cmp rbx, 0x2000
jbe 0x40eb73
jmp 0x40ed7f
mov ebx, 8
cmp rax, 0x10000
jae 0x40ec45
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40ebbe
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40ebbe
test byte [rsi], al
add rsi, 0x1650
jmp 0x40ebe7
nop
nop
lea rax, [0x0119bac0]
call fcn.0040c5e0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x0119bac8]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
mov qword [rsi + 8], rdi
add rdi, rax
cmp rdi, 0x40000
ja 0x40ec19
cmp qword [rsi], 0
jne 0x40ec57
mov eax, 0x40000
lea rbx, [0x011a0160]
call fcn.00419060
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
jne 0x40ed03
nop dword [rax]
jmp 0x40ed52
mov rbx, rcx
call fcn.00419060
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
nop
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
mov dword [rdx + 0xd8], r10d
lea rdx, [rdi + r8]
nop dword [rax]
cmp r9d, 1
jne 0x40ec98
cmp byte [r14 + 0xb1], 0
je 0x40ec98
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdx
lea rdi, [0x0119bac8]
cmp rsi, rdi
jne 0x40ecc6
nop
nop
lea rax, [0x0119bac0]
call fcn.0040c800
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
lea rsi, [0x011a0160]
cmp rcx, rsi
je 0x40ecf6
mov rbx, rax
mov rax, rcx
call fcn.0042fd40
mov rbx, qword [rsp + 0x48]
neg rbx
lea rax, [0x011a0160]
call fcn.0042fd40
mov rdx, qword [rsp + 0x30]
mov rax, rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rcx]
mov rax, qword [0x0119b7e8]
mov qword [rdx], rax
mov rdx, qword [rcx]
lea rsi, [0x0119b7e8]
lock cmpxchg qword [rsi], rdx
sete dl
test dl, dl
je 0x40ed03
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x58]
jmp 0x40ec57
lea rdx, [0x0119bac8]
cmp rcx, rdx
je 0x40ed6f
lea rax, [0x00adc3a2]
mov ebx, 0x1f
call fcn.00437b60
nop
nop
lea rax, [0x0119bac0]
call fcn.0040c800
jmp 0x40ed5e
lea rax, [0x00adf8c0]
mov ebx, 0x23
call fcn.00437b60
lea rax, [0x00ae448a]
mov ebx, 0x2a
nop dword [rax]
call fcn.00437b60
lea rax, [0x00ad7369]
mov ebx, 0x1a
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00467ba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040eb20
Function at 0x40f660
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40f858
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
test rbx, rbx
je 0x40f742
cmp qword [rbx], 0
je 0x40f742
movzx esi, byte [rbx + 8]
nop word [rax + rax]
test sil, 4
jne 0x40f846
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov edi, dword [rbx + 0xc]
mov rax, rcx
mov rbx, rdi
call rsi
mov rcx, qword [rsp + 0x48]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x40]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x40f731
movzx r10d, byte [rdx + 8]
test r10b, 8
jne 0x40f714
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rsi, [r9 + r8]
movzx r8d, byte [r9 + r8]
add r8d, 0xfffffffe
cmp r8b, 3
jb 0x40f731
mov rcx, rsi
shr rax, 0x38
cmp al, 5
jae 0x40f73c
add eax, 5
mov byte [rsp + 0x17], al
jmp 0x40f779
mov esi, dword [rax + 0x54]
bt esi, 4
jae 0x40f759
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov rax, rcx
xor ebx, ebx
call rsi
lea rax, [0x0119cec0]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
movzx esi, word [rdi + 0x52]
lea rsi, [rcx + rsi]
lea rsi, [rsi - 8]
mov rcx, qword [rsi]
test rcx, rcx
je 0x40f787
mov qword [rsp + 0x20], rcx
xor edx, edx
jmp 0x40f7a0
lea rax, [0x0119cec0]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
inc rdx
nop dword [rax + rax]
cmp rdx, 8
jae 0x40f76a
movzx esi, byte [rdx + rcx]
cmp al, sil
je 0x40f7b6
test sil, sil
jne 0x40f798
jmp 0x40f787
mov qword [rsp + 0x18], rdx
movzx esi, byte [rdi + 0x50]
imul rsi, rdx
lea rcx, [rsi + rcx]
lea rcx, [rcx + 8]
mov esi, dword [rdi + 0x54]
bt esi, 0
jae 0x40f7d7
mov rcx, qword [rcx]
mov rsi, qword [rdi + 0x30]
mov rdx, qword [rsi + 0x18]
mov rsi, qword [rdx]
mov rax, qword [rsp + 0x28]
mov rbx, rcx
call rsi
test al, al
jne 0x40f806
movzx eax, byte [rsp + 0x17]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x40]
jmp 0x40f798
mov rcx, qword [rsp + 0x40]
movzx edx, byte [rcx + 0x50]
movzx ebx, byte [rcx + 0x51]
mov rsi, qword [rsp + 0x18]
imul rbx, rsi
lea rdx, [rbx + rdx*8]
mov rbx, qword [rsp + 0x20]
lea rdx, [rbx + rdx]
lea rdx, [rdx + 8]
mov ecx, dword [rcx + 0x54]
bt ecx, 1
jae 0x40f839
mov rdx, qword [rdx]
mov rax, rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00add902]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax + rax]
jmp fcn.0040f660