joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ff20
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ff97
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
nop
je 0x43ff85
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x01147e1c]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43ff6f
nop
call fcn.0043e720
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00add9c8]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00437b60
lea rax, [0x00adc383]
mov ebx, 0x1f
call fcn.00437b60
nop
call fcn.00463480
jmp fcn.0043ff20

Function at 0x4414e0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
mov rdx, r14
cmp qword [rcx], rdx
je 0x441534
nop word [rax + rax]
cmp qword [rcx + 0x50], rdx
je 0x441534
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x38], rbx
mov qword [rdx + 0x60], 0
mov qword [rdx + 0x58], 0
cmp qword [rdx + 0x50], 0
je 0x44152a
call fcn.0043ae00
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00ad95d1]
mov ebx, 0x1c
call fcn.00437b60
nop
int3
Function at 0x4444e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4447ad
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp byte [0x0119b2ac], 0
nop
jne 0x44450b
cmp byte [0x0119b2ab], 0
je 0x444515
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp dword [0x0119b4bc], 0
nop dword [rax]
ja 0x444610
cmp byte [0x00934043], 0
jne 0x444538
cmp byte [0x0119b2a4], 0
jne 0x44453c
xor ecx, ecx
jmp 0x44455e
mov eax, 1
call fcn.0043da00
nop
cmp dword [0x0119b484], 0
lea rcx, [0x0119b760]
xchg qword [rcx], rax
seta cl
movzx ecx, cl
mov edx, dword [0x01147de8]
mov rbx, qword [0x01147df0]
sub rbx, qword [0x01147e00]
mov rsi, rbx
sub ebx, edx
mov edi, dword [0x01147dec]
sub ebx, edi
mov r8d, dword [0x01147dfc]
sub ebx, r8d
cmp ecx, ebx
jge 0x444597
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test ebx, ebx
jl 0x444705
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004447c0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x30]
call fcn.0043af80
cmp qword [rsp + 0x20], 0
je 0x4446e5
cmp qword [0x0119b768], 0
je 0x4445fe
call fcn.00455120
test rbx, rbx
je 0x4445fe
mov qword [0x0119b768], rax
lea rax, [0x01147e10]
jmp 0x444672
mov rcx, qword [0x01145280]
mov rdx, qword [0x01145288]
xor eax, eax
jmp 0x444620
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
inc rax
nop dword [rax]
cmp rax, rdx
jge 0x44463f
mov rbx, qword [rcx + rax*8]
test byte [rbx], al
cmp qword [rbx + 0x26e8], 0
jle 0x44461a
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [r14 + 0x30]
mov dword [rcx + 0xc4], 0xffffffff
nop
nop
lea rax, [0x01147dd8]
call fcn.0040c800
lea rax, [0x00ae0ebc]
mov ebx, 0x25
call fcn.00437b60
test byte [rcx], al
lea rax, [rcx + 8]
mov rcx, qword [rax]
test rcx, rcx
je 0x444686
cmp rbx, rcx
jne 0x44466c
mov rcx, qword [rbx + 8]
mov qword [rax], rcx
nop
mov rcx, qword [0x01147de0]
test rcx, rcx
je 0x4446aa
mov rdx, qword [rcx + 0x130]
mov qword [0x01147de0], rdx
dec dword [0x01147de8]
test rcx, rcx
je 0x4446cf
nop
mov qword [rcx + 0xa8], rbx
lea rax, [rcx + 0x120]
nop dword [rax + rax]
call fcn.0040c8e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00ad5f03]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437b60
nop
nop
lea rax, [0x01147dd8]
call fcn.0040c800
lea rax, [0x00ae915e]
mov ebx, 0x36
nop
call fcn.00437b60
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x14], r8d
call fcn.004392e0
lea rax, [0x00ad8483]
mov ebx, 0x1b
call fcn.00439be0
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.004399e0
lea rax, [0x00acbc61]
mov ebx, 0xe
call fcn.00439be0
mov eax, dword [rsp + 0x18]
movsxd rax, eax
call fcn.004399e0
lea rax, [0x00ac8c05]
mov ebx, 8
call fcn.00439be0
mov rax, qword [rsp + 0x28]
movsxd rax, eax
call fcn.004399e0
lea rax, [0x00ac8679]
mov ebx, 7
call fcn.00439be0
mov eax, dword [rsp + 0x14]
movsxd rax, eax
call fcn.004399e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00adb071]
mov ebx, 0x1e
call fcn.00437b60
nop
call fcn.00463480
jmp fcn.004444e0
Function at 0x446080
Capabilities:
Get geographical location

Disassembly:
lea r12, [rsp - 0x3b8]
cmp r12, qword [r14 + 0x10]
jbe 0x446237
sub rsp, 0x438
mov qword [rsp + 0x430], rbp
lea rbp, [rsp + 0x430]
mov qword [rsp + 0x28], 0
mov edx, edi
lea rdi, [rsp + 0x30]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d40
mov rbp, qword [rbp]
sub edx, ecx
shr edx, 1
nop word [rax + rax]
cmp edx, 0x80
jne 0x446225
xor esi, esi
jmp 0x446108
test byte [rax], al
lea edi, [rsi + rcx]
movzx edi, dil
mov rdi, qword [rax + rdi*8 + 0x5f8]
mov qword [rsp + rsi*8 + 0x28], rdi
inc esi
cmp esi, edx
jb 0x4460f0
lea esi, [rdx + rcx]
mov rdi, rax
mov eax, ecx
lock cmpxchg dword [rdi + 0x5f0], esi
sete sil
test sil, sil
je 0x44612e
mov qword [rsp + rdx*8 + 0x28], rbx
xor eax, eax
jmp 0x44614d
xor eax, eax
mov rbp, qword [rsp + 0x430]
add rsp, 0x438
nop
ret
mov rsi, qword [rsp + rax*8 + 0x28]
mov qword [rbx + 0xa0], rsi
cmp eax, edx
jae 0x44616d
mov rbx, qword [rsp + rax*8 + 0x28]
test byte [rbx], al
inc eax
nop word [rax + rax]
cmp rax, 0x81
jb 0x446141
jmp 0x44621b
mov dword [rsp + 0x14], edx
movups xmmword [rsp + 0x18], xmm15
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + rdx*8 + 0x28]
mov qword [rsp + 0x20], rcx
nop
nop
lea rax, [0x01147dd8]
call fcn.0040c5e0
nop
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
test rcx, rcx
je 0x4461dc
mov rbx, rcx
mov qword [rcx + 0xa0], 0
mov rcx, qword [0x01147e28]
nop
test rcx, rcx
je 0x4461ce
mov qword [rcx + 0xa0], rdx
jmp 0x4461d5
mov qword [0x01147e20], rdx
mov qword [0x01147e28], rbx
mov ecx, dword [0x01147e30]
mov edx, dword [rsp + 0x14]
lea ecx, [rcx + rdx]
lea ecx, [rcx + 1]
mov dword [0x01147e30], ecx
movups xmmword [rsp + 0x18], xmm15
nop
nop
lea rax, [0x01147dd8]
call fcn.0040c800
mov eax, 1
mov rbp, qword [rsp + 0x430]
add rsp, 0x438
ret
mov ecx, 0x81
call fcn.00465ba0
lea rax, [0x00adb413]
mov ebx, 0x1e
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.00446080
Function at 0x44ba40
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44bbb3
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rsi, rdx
shr rdx, 0x2a
cmp rdx, 0x40
jae 0x44bba5
lea rdi, [0x0116d6f8]
mov rdx, qword [rdi + rdx*8]
shr rsi, 0x16
and rsi, 0xfffff
mov rsi, qword [rdx + rsi*8]
mov rdi, rax
shr rax, 0xd
and rax, 0x1ff
mov r8, qword [rsi + rax*8 + 0x20000]
test byte [rdx], al
test byte [rsi], al
mov dl, byte [r8 + 0x63]
cmp dl, 2
jne 0x44bb8f
mov qword [rsp + 0x18], r8
mov rdx, qword [r8 + 0x28]
test rdx, rdx
jne 0x44bb05
movzx eax, bl
cmp rax, 2
jae 0x44bb85
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x20], rdi
shl rax, 6
lea rcx, [0x0119be60]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, r8
call fcn.00428aa0
movzx ebx, byte [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x18]
mov rdx, rdi
mov rsi, qword [r8 + 0x28]
mov qword [rdi], rsi
mov qword [r8 + 0x28], rdx
movzx edx, word [r8 + 0x60]
lea esi, [rdx - 1]
mov word [r8 + 0x60], si
cmp dword [0x0119b4a0], 0
jne 0x44bb71
cmp dx, 1
jne 0x44bb71
movzx eax, bl
cmp rax, 2
jae 0x44bb7b
shl rax, 6
lea rcx, [0x0119be60]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, r8
call fcn.00428920
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 0x28], 0
lea rax, [0x0115d560]
mov ecx, 1
call fcn.00428500
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov ecx, 2
call fcn.00465ba0
mov ecx, 2
call fcn.00465ba0
lea rax, [0x00add9e9]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00437b60
mov rax, rdx
mov ecx, 0x40
call fcn.00465bc0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax]
call fcn.00463480
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0044ba40
Function at 0x44dcc0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44de49
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax], 0
nop dword [rax]
je 0x44de37
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x44dd1e
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop dword [rax]
cmp rax, rdx
jne 0x44de26
mov rsi, r14
cmp rsi, rdx
je 0x44de26
cmp ecx, 2
jne 0x44de26
cmp qword [rax + 0x70], 0
jne 0x44dd3f
cmp byte [rax + 0xb4], 0
je 0x44dd32
xor ecx, ecx
jmp 0x44dd41
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x44dd41
xor ecx, ecx
test cl, cl
je 0x44de15
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x44dd68
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x2d0], 0
jne 0x44de04
cmp dword [0x0119bd14], 0
jg 0x44ddfa
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x138]
mov rax, rcx
call fcn.00451520
test rax, rax
je 0x44dd9e
cmp byte [rax + 0x28], 6
jne 0x44dd9e
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rbx, rcx
mov rcx, rbx
shr rbx, 1
cmp rbx, 0x2000
jb 0x44ddf0
mov rsi, qword [rax + 0x38]
sub rdx, rsi
add rdx, 0x320
shr rcx, 2
cmp rcx, rdx
ja 0x44dde1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
call fcn.0044cd60
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00ad746d]
mov ebx, 0x1a
call fcn.00437b60
lea rax, [0x00ad4283]
mov ebx, 0x17
call fcn.00437b60
lea rax, [0x00ad5e86]
mov ebx, 0x19
call fcn.00437b60
lea rax, [0x00ad93bd]
mov ebx, 0x1c
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.0044dcc0
Function at 0x44e840
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44ea97
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
test rcx, rcx
jle 0x44e877
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x44ea48
xor edx, edx
xor esi, esi
xor edi, edi
nop dword [rax]
test rdx, rdx
je 0x44e945
cmp rdx, 1
jne 0x44e8e2
test rax, rax
je 0x44e8a0
mov rdx, rsi
mov esi, 1
jmp 0x44e8e7
cmp rcx, rsi
jbe 0x44ea30
mov rdx, rsi
shl rsi, 4
mov r8, qword [rbx + rsi]
mov rsi, qword [rbx + rsi + 8]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x58]
mov r8, qword [r14 + 8]
cmp qword [r14], rsi
ja 0x44e8da
cmp rsi, r8
setb sil
jmp 0x44e8dc
xor esi, esi
xor esi, 1
nop
jmp 0x44e8e7
mov rdx, rsi
xor esi, esi
test sil, sil
jne 0x44e929
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rbx
mov rbx, rdi
nop
call fcn.0044efa0
mov rdx, qword [rsp + 0x88]
test rdx, rdx
jle 0x44e95b
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov r8, qword [rsp + 0x80]
xor r9d, r9d
jmp 0x44e975
cmp rcx, rdx
jbe 0x44e953
shl rdx, 4
mov rax, qword [rbx + rdx]
mov rbx, qword [rbx + rdx + 8]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
call fcn.00465ba0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
add r8, 0x10
mov rcx, rsi
mov rsi, r9
mov r9, rdi
mov rdi, r11
mov r10, qword [r8 + 8]
cmp rdi, r10
mov r11, rdi
cmovg rdi, r10
mov r12, qword [r8]
cmp rcx, r12
jne 0x44e990
cmp r11, r10
jmp 0x44e9f5
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x18], r10
mov rax, rcx
mov rbx, r12
mov rcx, rdi
call fcn.00466520
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
mov r10, rax
mov r11, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jb 0x44ea25
lea rdi, [r9 + 1]
sub rsi, r10
sub r11, r10
mov r9, rsi
neg rsi
sar rsi, 0x3f
and r10, rsi
lea rsi, [rcx + r10]
cmp rdx, rdi
jg 0x44e965
nop dword [rax + rax]
jmp 0x44e95b
mov rax, r10
mov rcx, r11
call fcn.00465c60
mov rax, rsi
call fcn.00465ba0
add rbx, 0x10
mov r10, rsi
mov rsi, r9
mov r9, r8
mov r8, r10
mov r10, qword [rbx + 8]
test r10, r10
jne 0x44ea5f
mov r10, r9
mov r9, rsi
mov rsi, r8
mov r8, r10
jmp 0x44ea6e
lea r8, [r9 + r10]
cmp r9, r8
jg 0x44ea85
inc rdi
mov r9, rsi
inc r9
cmp rcx, r9
jg 0x44ea38
mov rbx, rdx
mov rdx, rdi
mov rdi, r8
nop
jmp 0x44e880
lea rax, [0x00ada64f]
mov ebx, 0x1d
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044e840
Function at 0x4524e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x452658
movzx edx, byte [rax]
nop
test edx, edx
jne 0x45251c
test r8b, r8b
jne 0x45251c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x45252f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x452618
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x452606
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x4525fc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x452583
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x4525c6
mov eax, 1
cmp rax, rbx
ja 0x4525b5
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00465c60
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x4525f4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x4525bd
mov r8d, eax
mov eax, r10d
jmp 0x452588
mov rcx, rbx
call fcn.00465ba0
xor eax, eax
mov rcx, rbx
call fcn.00465ba0
mov eax, r8d
mov rcx, rbx
call fcn.00465c60
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45264e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x452611
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x452535
mov eax, edx
mov rcx, rbx
call fcn.00465ba0
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.00465ba0
nop
int3
Function at 0x453120
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45324f
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
cmp qword [rax + 8], 0
nop dword [rax]
jle 0x45323d
cmp qword [rax + 0x10], 0
jl 0x45322c
cmp dword [rax + 0x40], 0
jne 0x45321b
mov qword [rsp + 0x48], rax
mov dword [rax + 0x40], 1
mov qword [rsp + 0x28], r14
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x10], rdx
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
mov qword [rsp + 0x30], rcx
test byte [rcx], al
lea rbx, [rcx + 0x26d8]
mov qword [rsp + 0x20], rbx
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi + 0x30]
mov qword [rsp + 0x18], rsi
nop
mov rax, rbx
call fcn.0040c5e0
mov rax, qword [rsp + 0x30]
call fcn.00453fc0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
call fcn.00453280
nop
nop
mov rax, qword [rsp + 0x20]
call fcn.0040c800
mov rax, qword [rsp + 0x10]
nop
call fcn.0043fec0
nop
mov rcx, qword [rsp + 0x18]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x453211
cmp byte [r14 + 0xb1], 0
je 0x453211
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00ae18a2]
mov ebx, 0x26
call fcn.00437b60
lea rax, [0x00addf32]
mov ebx, 0x21
call fcn.00437b60
lea rax, [0x00ad85c7]
mov ebx, 0x1b
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
nop
jmp fcn.00453120
Function at 0x456f40
Capabilities:
Get geographical location

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x457126
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0
lea rdi, [rsp + 0x50]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465e90
mov rbp, qword [rbp]
mov rsi, qword [rax + 0x28]
jmp 0x456fb4
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rdi + 0x28]
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0xb8]
test rsi, rsi
je 0x4570c8
mov qword [rsp + 0x38], rsi
mov rdi, qword [rsi + 0x18]
test rdi, rdi
jne 0x456ff4
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
jmp 0x457096
mov qword [rsp + 0x30], rdi
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
call fcn.00451520
test rax, rax
je 0x4570d8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov r8, qword [rsp + 0x38]
cmp dword [r8], 0
jne 0x457029
xor r9d, r9d
jmp 0x45702e
nop
lea r9, [r8 + 0x48]
mov qword [rsp + 0x88], r9
mov r9d, dword [rax + 0xc]
movsxd r10, r9d
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x98], 0
cmp r9d, 0x80000000
jne 0x457089
mov rcx, rbx
mov edi, 1
mov rsi, qword [rsp + 0x30]
mov rbx, rax
lea rax, [rsp + 0x48]
call fcn.00458f60
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x60], rsi
mov rsi, qword [rbx]
lea rax, [rsp + 0x48]
mov rdx, rbx
mov rbx, rcx
call rsi
test al, al
jne 0x456f9e
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
call fcn.004392e0
lea rax, [0x00ada615]
mov ebx, 0x1d
call fcn.00439be0
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
lea rax, [0x00aca0af]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00456f40
Function at 0x459a20
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459b8f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
call fcn.004392e0
lea rax, [0x00ad9021]
mov ebx, 0x1c
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.004399e0
lea rax, str._:_n_fk_rtadxaesageavxbincdpdirendfinfmaftpgc_gp_intip4ip6keymapnannewnilobjpcpdfpngptrreqrodsetsshtagtaptcptmpu00udpurlvfsviass______________as__at__fp_in__is__lr:_of__on__pc_sp:_sp_1._x_r_ngt_lt______m__Inf_Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.xml0x_x100_108031259222:_p:443__s_ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCHARCMYKCallChamDATADashDateDoneEESTEtagFASTFromGOGCGoneGrayHEADHOMEHomeHostIDATIENDIHDRIdleJulyJuneKeyAKeyBKeyCKeyDKeyEKeyFKeyGKeyHKeyIKeyJKeyKKeyLKeyMKeyNKeyOKeyPKeyQKeyRKeySKeyTKeyUKeyVKeyWKeyXKeyYKeyZLEAFLisuMetaMiaoModiNZDTNZSTNewaOpenPINGPLTEPOSTRGBASASTStatStepThaiVBox__s__::____r_nu00_n_tm_r_n__
mov ebx, 3
call fcn.00439be0
call fcn.00439360
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
xor edx, edx
jmp 0x459aba
mov rbx, qword [rsp + 0x20]
lea rdx, [rbx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
cmp rdx, rcx
jge 0x459b0f
mov qword [rsp + 0x20], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.00451520
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x20]
test rcx, rcx
sete dl
xor edi, edi
mov esi, edi
mov ecx, edx
call fcn.0045a1a0
test al, al
je 0x459aa7
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x18]
call fcn.00459be0
jmp 0x459aa7
cmp qword [rsp + 0x68], 0x64
jne 0x459b32
call fcn.004392e0
lea rax, [0x00adb612]
mov ebx, 0x1f
call fcn.00439be0
call fcn.00439360
mov rax, qword [rsp + 0x80]
call fcn.00451520
nop
test rax, rax
jne 0x459b49
xor ecx, ecx
jmp 0x459b6a
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edi, edi
mov esi, edi
call fcn.0045a1a0
mov rbx, qword [rsp + 0x38]
mov ecx, eax
mov rax, qword [rsp + 0x40]
test cl, cl
je 0x459b85
cmp qword [rsp + 0x78], 1
je 0x459b85
mov rcx, qword [rsp + 0x80]
nop
call fcn.00459460
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00459a20
Function at 0x459ec0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459f8a
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
lea rdx, [rsp + 0x18]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x28]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x38]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x48]
movups xmmword [rdx], xmm15
lea rdx, [0x00459fc0]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00463340
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00459ec0