joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e0e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41e370
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov edx, dword [0x011264e8]
mov rcx, qword [0x011267d8]
mov rsi, qword [0x011267d0]
cmp rbx, rcx
jae 0x41e367
mov rbx, qword [rsi + rbx*8]
mov rsi, rbx
shr rbx, 0x14
cmp rbx, 0x40
jae 0x41e35a
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x68], rax
lea rdi, [0x01126558]
mov rbx, qword [rdi + rbx*8]
test byte [rbx], al
and rsi, 0xfffff
mov rbx, qword [rbx + rsi*8]
mov qword [rsp + 0x50], rbx
test byte [rbx], al
xor ecx, ecx
jmp 0x41e159
inc rcx
cmp rcx, 0x40
jge 0x41e182
lea rsi, [rbx + rcx]
lea rsi, [rsi + 0x21080]
mov sil, byte [rsi]
test sil, sil
je 0x41e156
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x2e], sil
xor edi, edi
nop
jmp 0x41e193
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rdi, [rcx + 1]
mov rcx, r8
cmp rdi, 8
jae 0x41e156
mov r8, rcx
mov rcx, rdi
mov r9d, 1
shl r9d, cl
test sil, r9b
je 0x41e18c
lea r9, [rcx + r8*8]
cmp r9, 0x200
jae 0x41e34d
mov r9, qword [rbx + r9*8 + 0x20000]
mov r10b, byte [r9 + 0x63]
cmp r10b, 1
jne 0x41e309
mov qword [rsp + 0x58], rcx
cmp byte [0x01154111], 0
jne 0x41e1f8
mov r10d, dword [r9 + 0x58]
cmp r10d, edx
je 0x41e1f8
lea r11d, [rdx + 3]
cmp r10d, r11d
jne 0x41e2b7
mov qword [rsp + 0x40], r9
lea rax, [r9 + 0x78]
mov qword [rsp + 0x60], rax
nop
call fcn.0040c5e0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x80]
jmp 0x41e24d
nop
mov rax, qword [rsp + 0x60]
call fcn.0040c800
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rsp + 0x2e]
mov rdi, rcx
mov r8, qword [rsp + 0x48]
jmp 0x41e18c
mov rdx, qword [rdx]
test rdx, rdx
je 0x41e21a
cmp byte [rdx + 0xa], 1
jne 0x41e24a
movzx eax, word [rdx + 8]
mov rsi, qword [rcx + 0x68]
mov rdi, qword [rcx + 0x18]
test rsi, rsi
je 0x41e2b2
mov qword [rsp + 0x38], rdx
xor edx, edx
div rsi
imul rax, rsi
add rax, rdi
mov rbx, qword [rsp + 0x68]
nop
call fcn.0041fe20
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + 0x10]
mov ebx, 8
mov rdi, qword [rsp + 0x68]
xor esi, esi
lea rcx, [0x0092c044]
call fcn.0041fc80
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
jmp 0x41e24a
call fcn.00435420
mov dword [rsp + 0x34], r10d
nop dword [rax]
call fcn.004392e0
lea rax, [0x00abcec8]
mov ebx, 6
call fcn.00439be0
mov eax, dword [rsp + 0x34]
call fcn.004398e0
nop
call fcn.00439500
mov eax, dword [rsp + 0x30]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ac1f81]
mov ebx, 0x10
call fcn.00437b60
mov byte [rsp + 0x2f], r10b
call fcn.004392e0
lea rax, [0x00abe8c9]
mov ebx, 0xa
nop
call fcn.00439be0
movzx eax, byte [rsp + 0x2f]
movzx eax, al
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ad84b1]
mov ebx, 0x2b
call fcn.00437b60
mov rax, r9
mov ecx, 0x200
call fcn.00465b80
mov rax, rbx
mov ecx, 0x40
call fcn.00465b80
mov rax, rbx
call fcn.00465b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041e0e0
Function at 0x420bc0
Capabilities:
Hash data using murmur3
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x01154111], 0
jne 0x420cb9
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and rbx, 7
mov rsi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x420caf
lea rbx, [0x01126558]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x420c8a
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x16a8], rsi
add qword [rax + 0x16b0], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00465b80
lea rax, [0x00ad8afa]
mov ebx, 0x2c
call fcn.00437b60
nop
int3
Function at 0x421780
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4219dd
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
cmp dword [0x01154150], 0
nop
je 0x4219cb
test rbx, rbx
je 0x4217d3
mov rdx, qword [rbx + 0x1698]
test rdx, rdx
je 0x4217d3
cmp qword [rdx + 0x10], 0
jne 0x4217cc
mov rdx, qword [rbx + 0x16a0]
cmp qword [rdx + 0x10], 0
je 0x4217d3
mov ecx, 1
jmp 0x421800
mov rdx, qword [0x01155220]
test rdx, rdx
jne 0x4217f8
mov edx, dword [0x011552a8]
cmp dword [0x011552ac], edx
jbe 0x4217f4
mov ecx, 1
jmp 0x421800
xor ecx, ecx
jmp 0x421800
mov ecx, 1
nop dword [rax]
test cl, cl
je 0x421806
jmp 0x421815
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rcx
mov rdx, qword [0x01154440]
nop dword [rax]
test rdx, rdx
je 0x421851
mov rsi, rdx
sar rdx, 0x13
shl rdx, 3
nop
mov rdi, qword [rdx]
mov rcx, rax
mov rax, rsi
lea r8, [0x01154440]
lock cmpxchg qword [r8], rdi
sete sil
test sil, sil
je 0x421812
jmp 0x421860
mov rcx, rax
lea r8, [0x01154440]
xor edx, edx
nop dword [rax]
test rdx, rdx
je 0x421869
test byte [rcx], al
jmp 0x421875
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rsi, qword [rcx + 0x80]
nop dword [rax]
test rsi, rsi
jle 0x4218a3
lea rdi, [rsi - 1]
mov rax, rsi
lock cmpxchg qword [rcx + 0x80], rdi
sete dil
test dil, dil
je 0x421875
nop
test rsi, rsi
jg 0x421982
movsd xmm0, qword [rcx + 0x98]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x4218c6
nop word [rax + rax]
jnp 0x42196b
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x10], rdx
call fcn.00467460
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x20]
sub rax, qword [rcx + 0x78]
nop dword [rax + rax]
test rax, rax
jle 0x421952
mov rdx, qword [rsp + 0x40]
test byte [rdx], al
mov rsi, qword [rdx + 0x1680]
xorps xmm0, xmm0
cvtsi2sd xmm0, rsi
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
movsd xmm1, qword [rcx + 0x98]
ucomisd xmm0, xmm1
jbe 0x421957
lea rax, [0x01154440]
mov rbx, qword [rsp + 0x10]
call fcn.0040c380
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, qword [rsp + 0x40]
test byte [rdx], al
mov qword [rdx + 0x1688], 2
mov rdx, qword [rsp + 0x10]
jmp 0x42198f
mov rax, r8
mov rbx, rdx
call fcn.0040c380
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
test byte [rbx], al
mov qword [rbx + 0x1688], 1
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x18], rax
mov ebx, 4
mov ecx, 1
call fcn.0043be20
cmp byte [0x011062f0], 0
je 0x4219bc
mov rax, qword [rsp + 0x18]
xor ebx, ebx
call fcn.00456ba0
mov rax, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00adc7cb]
mov ebx, 0x36
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00421780
Function at 0x422a60
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x422af3
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test byte [rax], al
movabs rdx, 0x800000000000
lea rsi, [rdx + rbx]
add rdx, rcx
cmp rdx, rsi
jbe 0x422a99
nop
mov rdx, rcx
sub rcx, rbx
jmp 0x422aa0
mov rdx, rcx
xor ecx, ecx
nop
test rcx, rcx
je 0x422aad
cmp dword [rax + 0x100e0], edi
je 0x422ac0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
test rbx, 0x3fffff
jne 0x422ae1
add rax, 0x100b8
mov rcx, rdx
call fcn.0042eea0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00acd5cb]
mov ebx, 0x1c
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
call fcn.00467b60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
nop
jmp fcn.00422a60
Function at 0x423440
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423557
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
lea rcx, [rbx - 1]
test rcx, rbx
jne 0x423516
test rbx, rbx
je 0x423516
cmp rbx, 0x40
ja 0x4234d6
mov qword [rsp + 0x28], rax
mov ecx, 7
jmp 0x423498
mov rdx, qword [rsp + 0x10]
lea rcx, [rdx - 1]
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
test rcx, rcx
jl 0x4234ca
mov qword [rsp + 0x10], rcx
test byte [rax], al
mov rdx, qword [rax + rcx*8 + 0x40]
or rdx, qword [rax + rcx*8]
mov rax, rdx
call fcn.00423280
cmp rax, 0xffffffffffffffff
je 0x423485
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.004392e0
lea rax, [0x00ac15dd]
mov ebx, 0xf
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.004398e0
call fcn.00439540
nop dword [rax + rax]
call fcn.00439360
lea rax, [0x00ac0289]
mov ebx, 0xd
call fcn.00437b60
call fcn.004392e0
lea rax, [0x00ac15dd]
mov ebx, 0xf
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.004398e0
call fcn.00439540
nop dword [rax + rax]
call fcn.00439360
lea rax, [0x00ad17b1]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00423440
Function at 0x423b40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423c9a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x138]
test rdx, rdx
jne 0x423ba5
call fcn.00426000
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x130], rax
mov qword [rcx + 0x138], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x423c28
mov rdi, qword [rax + 0x100]
mov r8, rbx
sub rbx, rdi
lea rdi, [rsi - 1]
nop
cmp rdi, 0x3f
jae 0x423c8c
shl rdi, 5
mov r9d, dword [rdx + rdi + 0x20]
add r9d, dword [rdx + rdi + 0x24]
nop dword [rax + rax]
cmp r9d, ebx
ja 0x423c7b
cmp rsi, 0x3f
jne 0x423c2b
mov qword [rsp + 0x10], rdx
call fcn.00426000
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x138], rax
mov r8, qword [rsp + 0x30]
mov rdx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
jmp 0x423c2b
mov r8, rbx
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x3f
jae 0x423c6e
lea rsi, [rbx + 1]
mov qword [rdx + 0x10], rsi
shl rbx, 5
mov rsi, qword [rax + 0x100]
sub r8, rsi
mov dword [rdx + rbx + 0x20], r8d
mov esi, dword [rcx + 4]
mov dword [rdx + rbx + 0x24], esi
nop
mov qword [rdx + rbx + 0x28], rcx
inc qword [rax + 0x140]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rbx
mov ecx, 0x3f
call fcn.00465b60
lea rax, [0x00ad74bf]
mov ebx, 0x29
call fcn.00437b60
mov rax, rdi
mov ecx, 0x3f
call fcn.00465b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00423b40
Function at 0x4264a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42658c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
nop
lea rax, [0x01155270]
call fcn.0040c5e0
cmp qword [0x01155220], 0
jne 0x42657a
mov qword [0x01155228], 0
mov rcx, qword [0x01155288]
test rcx, rcx
jne 0x426510
nop
nop
lea rax, [0x01155270]
call fcn.0040c800
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rdx, [0x01155278]
mov qword [rcx + 0x10], rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x426502
mov rcx, qword [0x01155278]
nop dword [rax]
test rcx, rcx
je 0x426551
mov rdx, qword [0x01155290]
mov qword [rdx], rcx
mov rcx, qword [0x01155278]
mov rdx, qword [0x01155290]
mov qword [rcx + 8], rdx
mov rcx, qword [0x01155288]
mov qword [0x01155278], rcx
jmp 0x42656d
mov rcx, qword [0x01155290]
mov rdx, qword [0x01155288]
mov qword [0x01155278], rdx
mov qword [0x01155280], rcx
movups xmmword [0x01155288], xmm15
jmp 0x4264ea
lea rax, [0x00ad6817]
mov ebx, 0x28
call fcn.00437b60
nop
call fcn.00463440
jmp fcn.004264a0
Function at 0x427760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42779b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test cl, cl
je 0x427789
xor edi, edi
call fcn.00427b20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00ade07a]
mov ebx, 0x3c
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00467b60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00427760

Function at 0x4278c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4279da
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
xor edx, edx
jmp 0x4278f3
sub r12, rbx
lea rbx, [r12 + r9]
shr r12, 0xd
sub r11, r12
mov rax, rcx
mov rcx, r11
mov edx, r10d
test rcx, rcx
jbe 0x427979
test byte [rax], al
nop
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
cmp rdi, 0x40
jae 0x4279cc
mov rdi, qword [rax + rdi*8 + 0x10198]
test byte [rdi], al
shr r8, 0x16
and r8, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x210c8]
mov r9, rbx
and rbx, 0x3fffff
cmp r8, rbx
seta r10b
mov r11, rcx
shl rcx, 0xd
lea r12, [rcx + rbx]
or r10d, edx
nop
cmp r12, 0x400000
jbe 0x42798b
mov r12d, 0x400000
jmp 0x42798b
mov rcx, rax
jmp 0x4278dc
mov eax, edx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rcx
mov r8, rdx
cmp r12, r8
jbe 0x427971
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x210c8], r12
sete dl
test dl, dl
jne 0x4278dc
mov rdx, qword [rdi + 0x210c8]
cmp rdx, r12
ja 0x427985
cmp rdx, rbx
jbe 0x427985
lea rax, [0x00adbae6]
mov ebx, 0x33
call fcn.00437b60
mov rax, rdi
mov ecx, 0x40
call fcn.00465b80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004278c0
Function at 0x428920
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428a6b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rbx + 0x10]
nop dword [rax]
cmp rax, rcx
jne 0x428991
cmp qword [rax], rbx
jne 0x428952
mov rcx, qword [rbx]
mov qword [rax], rcx
jmp 0x428960
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov qword [rcx], rdx
nop dword [rax]
cmp qword [rax + 8], rbx
jne 0x428970
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
jmp 0x42897b
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
movups xmmword [rbx], xmm15
mov qword [rbx + 0x10], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x10], rcx
call fcn.004392e0
lea rax, [0x00ad92f9]
mov ebx, 0x2d
call fcn.00439be0
mov rax, qword [rsp + 0x18]
call fcn.004398e0
lea rax, [0x00abcb50]
mov ebx, 6
nop
call fcn.00439be0
mov rax, qword [rsp + 0x40]
call fcn.00439ba0
lea rax, [0x00abcb4a]
mov ebx, 6
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x10]
call fcn.00439ba0
lea rax, [0x00abea7b]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x20]
call fcn.00439ba0
lea rax, [0x00abcb32]
mov ebx, 6
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x38]
call fcn.00439ba0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ac2091]
mov ebx, 0x10
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00428920

Function at 0x428aa0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428b86
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x428b01
cmp qword [rbx + 8], 0
jne 0x428b01
cmp qword [rbx + 0x10], 0
jne 0x428b01
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rcx, qword [rax]
nop dword [rax]
test rcx, rcx
je 0x428aeb
mov qword [rcx + 8], rbx
jmp 0x428aef
mov qword [rax + 8], rbx
mov qword [rax], rbx
mov qword [rbx + 0x10], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov qword [rsp + 0x40], rbx
mov rax, qword [rbx + 8]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x10], rcx
call fcn.004392e0
lea rax, [0x00ad195e]
mov ebx, 0x21
call fcn.00439be0
mov rax, qword [rsp + 0x40]
call fcn.00439ba0
call fcn.00439500
mov rax, qword [rsp + 0x20]
call fcn.00439ba0
call fcn.00439500
mov rax, qword [rsp + 0x18]
call fcn.00439ba0
call fcn.00439500
mov rax, qword [rsp + 0x10]
call fcn.00439ba0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ac2081]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00428aa0
Function at 0x428bc0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428dca
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
call fcn.004269a0
test rax, rax
je 0x428db8
mov qword [rsp + 0x18], rax
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x28], rcx
call fcn.00424560
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x18]
sub rcx, qword [rdx + 0x18]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rbx + 0xa]
mov byte [rsp + 0x17], sil
lea rax, [rdx + 0x78]
mov qword [rsp + 0x30], rax
nop
call fcn.0040c5e0
mov rcx, qword [rsp + 0x18]
lea rdx, [rcx + 0x80]
movzx ebx, byte [rsp + 0x17]
mov rsi, qword [rsp + 0x20]
jmp 0x428c59
mov rdx, rdi
mov rdi, qword [rdx]
nop dword [rax]
test rdi, rdi
je 0x428ccb
movzx r8d, word [rdi + 8]
cmp r8, rsi
jne 0x428c77
cmp byte [rdi + 0xa], bl
je 0x428c87
cmp r8, rsi
ja 0x428ccb
jne 0x428c56
nop dword [rax + rax]
cmp byte [rdi + 0xa], bl
jbe 0x428c56
jmp 0x428ccb
nop
nop
mov rax, qword [rsp + 0x30]
call fcn.0040c800
nop
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x428cbf
cmp byte [r14 + 0xb1], 0
je 0x428cbf
mov qword [r14 + 0x10], 0xfffffffffffffade
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbx, qword [rsp + 0x50]
mov word [rbx + 8], si
mov rsi, qword [rdx]
mov qword [rbx], rsi
mov qword [rdx], rbx
nop
nop
mov rax, qword [rcx + 0x18]
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop word [rax + rax]
cmp rdx, 0x40
jae 0x428dab
lea rsi, [0x01126558]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and rbx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
shr rax, 0xd
mov rcx, rax
and rax, 0x1ff
shr rax, 3
cmp rax, 0x40
jae 0x428da1
lea rdx, [rdx + rax]
lea rdx, [rdx + 0x21080]
and rcx, 7
mov ebx, 1
shl ebx, cl
lock or byte [rdx], bl
nop
nop
mov rax, qword [rsp + 0x30]
nop
call fcn.0040c800
nop
mov rdx, qword [rsp + 0x28]
mov ebx, dword [rdx + 0xd8]
lea esi, [rbx - 1]
mov dword [rdx + 0xd8], esi
cmp ebx, 1
jne 0x428d91
cmp byte [r14 + 0xb1], 0
je 0x428d91
mov qword [r14 + 0x10], 0xfffffffffffffade
mov eax, 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
mov ecx, 0x40
call fcn.00465b80
mov rax, rdx
mov ecx, 0x40
call fcn.00465b80
lea rax, [0x00acde60]
mov ebx, 0x1d
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00428bc0
Function at 0x4292c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42934a
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x18], rax
nop
lea rax, [0x0112cf68]
call fcn.0040c5e0
lea rax, [0x0112ced8]
call fcn.0041a6a0
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x0112cf68]
call fcn.0040c800
mov rbx, qword [rsp + 0x10]
mov byte [rbx + 0xa], 2
mov rcx, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rax, qword [rsp + 0x18]
call fcn.00428bc0
test al, al
je 0x429338
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00ad4dcf]
mov ebx, 0x25
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004292c0

Function at 0x4298e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42998d
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [0x01154808]
nop
test rax, rax
je 0x429926
mov qword [rsp + 0x10], rax
mov rcx, qword [rax + 8]
mov qword [0x01154808], rcx
mov ebx, 0x10000
call fcn.00466220
mov rax, qword [rsp + 0x10]
jmp 0x429962
nop
nop
lea rax, [0x01154800]
call fcn.0040c800
mov eax, 0x10000
lea rbx, [0x01158cb8]
call fcn.00419060
test rax, rax
je 0x42997b
mov qword [rsp + 0x18], rax
nop
nop
lea rax, [0x01154800]
call fcn.0040c5e0
mov rax, qword [rsp + 0x18]
mov qword [rax + 8], 0
mov qword [rax], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00ad0082]
mov ebx, 0x1f
call fcn.00437b60
nop
call fcn.00463440
jmp fcn.004298e0
Function at 0x4299a0
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x429ae6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [0x0092e5e0]
nop
cmp rdx, 0x15
ja 0x429a63
mov qword [rsp + 0x30], rbx
test byte [rax], al
cmp dword [0x011546d0], 0
jne 0x4299e3
mov qword [rax + 0x10110], rcx
jmp 0x4299ef
lea rdi, [rax + 0x10110]
call fcn.004657c0
mov qword [rsp + 0x28], rax
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call fcn.0042ebc0
mov rax, qword [rsp + 0x28]
call fcn.0042bc60
mov rcx, qword [0x0092c400]
mov rdx, qword [rsp + 0x28]
mov qword [rdx + 0x10078], rcx
cmp dword [0x011546d0], 0
jne 0x429a3a
mov rax, qword [rsp + 0x30]
mov qword [rdx + 0x10108], rax
jmp 0x429a4b
lea rdi, [rdx + 0x10108]
mov rax, qword [rsp + 0x30]
call fcn.004656c0
mov rax, qword [0x0092c400]
mov qword [rdx + 0x100f8], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rdx
call fcn.004392e0
lea rax, [0x00ad0b8e]
mov ebx, 0x20
call fcn.00439be0
mov rcx, qword [rsp + 0x10]
cmp rcx, 0x40
sbb rax, rax
mov edx, 1
shl rdx, cl
and rax, rdx
call fcn.004399e0
call fcn.00439540
nop
call fcn.00439360
call fcn.004392e0
lea rax, [0x00ace444]
mov ebx, 0x1d
call fcn.00439be0
mov eax, 0x200000
call fcn.004399e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ad855d]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004299a0