joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f8a0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40faa6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
test rbx, rbx
je 0x40f982
cmp qword [rbx], 0
je 0x40f982
movzx esi, byte [rbx + 8]
nop word [rax + rax]
test sil, 4
jne 0x40fa8f
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov edi, dword [rbx + 0xc]
mov rax, rcx
mov rbx, rdi
call rsi
mov rcx, qword [rsp + 0x48]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x40]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x40f971
movzx r10d, byte [rdx + 8]
test r10b, 8
jne 0x40f954
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rsi, [r9 + r8]
movzx r8d, byte [r9 + r8]
add r8d, 0xfffffffe
cmp r8b, 3
jb 0x40f971
mov rcx, rsi
shr rax, 0x38
cmp al, 5
jae 0x40f97c
add eax, 5
mov byte [rsp + 0x17], al
jmp 0x40f9c0
mov esi, dword [rax + 0x54]
bt esi, 4
jae 0x40f999
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov rax, rcx
xor ebx, ebx
call rsi
lea rax, [0x0119cec0]
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
movzx esi, word [rdi + 0x52]
lea rsi, [rcx + rsi]
lea rsi, [rsi - 8]
mov rcx, qword [rsi]
nop dword [rax + rax]
test rcx, rcx
je 0x40f9ce
mov qword [rsp + 0x20], rcx
xor edx, edx
jmp 0x40f9e4
lea rax, [0x0119cec0]
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
inc rdx
cmp rdx, 8
jae 0x40f9ac
movzx esi, byte [rdx + rcx]
cmp al, sil
je 0x40f9fa
test sil, sil
jne 0x40f9e1
jmp 0x40f9ce
mov qword [rsp + 0x18], rdx
movzx esi, byte [rdi + 0x50]
imul rsi, rdx
lea rcx, [rsi + rcx]
lea rcx, [rcx + 8]
mov esi, dword [rdi + 0x54]
bt esi, 0
jae 0x40fa1b
mov rcx, qword [rcx]
mov rsi, qword [rdi + 0x30]
mov rdx, qword [rsi + 0x18]
mov rsi, qword [rdx]
mov rax, qword [rsp + 0x28]
mov rbx, rcx
call rsi
test al, al
jne 0x40fa4a
movzx eax, byte [rsp + 0x17]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x40]
jmp 0x40f9e1
mov rcx, qword [rsp + 0x40]
movzx edx, byte [rcx + 0x50]
movzx esi, byte [rcx + 0x51]
mov rdi, qword [rsp + 0x18]
imul rsi, rdi
lea rdx, [rsi + rdx*8]
mov rsi, qword [rsp + 0x20]
lea rdx, [rsi + rdx]
lea rdx, [rdx + 8]
mov ecx, dword [rcx + 0x54]
bt ecx, 1
jae 0x40fa7d
mov rdx, qword [rdx]
mov rax, rdx
mov ebx, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00add902]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040f8a0
Function at 0x4116c0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41182a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x30], ecx
nop dword [rax]
test rbx, rbx
je 0x41179d
cmp qword [rbx], 0
je 0x41179d
movzx ecx, byte [rbx + 8]
nop word [rax + rax]
test cl, 4
jne 0x411818
cmp byte [rbx + 9], 0
jne 0x411718
mov rcx, qword [rbx + 0x10]
jmp 0x4117c0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x411798
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x41177d
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx ebx, byte [r9 + r8]
add ebx, 0xfffffffe
cmp bl, 3
jb 0x411798
mov rcx, rdx
mov rax, rdi
jmp 0x4117c0
lea rax, [0x0119cec0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
nop
test rcx, rcx
je 0x4117ce
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x4117e6
lea rax, [0x0119cec0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 4
cmp rbx, 8
jae 0x4117ae
mov esi, dword [rdx]
cmp dword [rsp + 0x30], esi
jne 0x4117df
movzx esi, byte [rbx + rcx]
cmp sil, 1
jbe 0x4117df
movzx edx, byte [rax + 0x51]
imul rbx, rdx
lea rax, [rbx + rcx]
lea rax, [rax + 0x28]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00add902]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.004116c0
Function at 0x411860
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4119d7
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x30], ecx
nop dword [rax]
test rbx, rbx
je 0x41193e
cmp qword [rbx], 0
je 0x41193e
movzx ecx, byte [rbx + 8]
nop word [rax + rax]
test cl, 4
jne 0x4119c5
cmp byte [rbx + 9], 0
jne 0x4118b8
mov rcx, qword [rbx + 0x10]
jmp 0x411962
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x411939
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x41191d
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx esi, byte [r9 + r8]
add esi, 0xfffffffe
cmp sil, 3
jb 0x411939
mov rcx, rdx
mov rax, rdi
jmp 0x411962
lea rax, [0x0119cec0]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
test rcx, rcx
je 0x411970
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x41198a
lea rax, [0x0119cec0]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 4
cmp rbx, 8
jae 0x411951
mov esi, dword [rdx]
cmp dword [rsp + 0x30], esi
jne 0x411983
movzx esi, byte [rbx + rcx]
nop dword [rax]
cmp sil, 1
jbe 0x411983
movzx edx, byte [rax + 0x51]
imul rbx, rdx
lea rax, [rbx + rcx]
lea rax, [rax + 0x28]
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00add902]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.00411860
Function at 0x412460
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4125d3
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x30], rcx
nop dword [rax]
test rbx, rbx
je 0x41253d
cmp qword [rbx], 0
je 0x41253d
movzx ecx, byte [rbx + 8]
nop word [rax + rax]
test cl, 4
jne 0x4125c1
cmp byte [rbx + 9], 0
jne 0x4124b8
mov rcx, qword [rbx + 0x10]
jmp 0x412560
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x412538
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x41251d
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx ebx, byte [r9 + r8]
add ebx, 0xfffffffe
cmp bl, 3
jb 0x412538
mov rcx, rdx
mov rax, rdi
jmp 0x412560
lea rax, [0x0119cec0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
nop
test rcx, rcx
je 0x41256e
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x412586
lea rax, [0x0119cec0]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 8
cmp rbx, 8
jae 0x41254e
mov rsi, qword [rdx]
cmp qword [rsp + 0x30], rsi
jne 0x41257f
movzx esi, byte [rbx + rcx]
nop word [rax + rax]
cmp sil, 1
jbe 0x41257f
movzx edx, byte [rax + 0x51]
imul rdx, rbx
lea rax, [rdx + rcx]
lea rax, [rax + 0x48]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
lea rax, [0x00add902]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00412460
Function at 0x412600
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x412777
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x30], rcx
nop dword [rax]
test rbx, rbx
je 0x4126de
cmp qword [rbx], 0
je 0x4126de
movzx ecx, byte [rbx + 8]
nop word [rax + rax]
test cl, 4
jne 0x412765
cmp byte [rbx + 9], 0
jne 0x412658
mov rcx, qword [rbx + 0x10]
jmp 0x412702
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x4126d9
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x4126bd
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx esi, byte [r9 + r8]
add esi, 0xfffffffe
cmp sil, 3
jb 0x4126d9
mov rcx, rdx
mov rax, rdi
jmp 0x412702
lea rax, [0x0119cec0]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
test rcx, rcx
je 0x412710
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x41272a
lea rax, [0x0119cec0]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 8
cmp rbx, 8
jae 0x4126f1
mov rsi, qword [rdx]
cmp qword [rsp + 0x30], rsi
jne 0x412723
movzx esi, byte [rbx + rcx]
nop
cmp sil, 1
jbe 0x412723
movzx edx, byte [rax + 0x51]
imul rdx, rbx
lea rax, [rdx + rcx]
lea rax, [rax + 0x48]
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00add902]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00412600
Function at 0x414ee0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4150cf
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
call fcn.004392e0
call fcn.004392e0
lea rax, [0x00ace587]
mov ebx, 0x11
call fcn.00439be0
mov rax, qword [rsp + 0x38]
call fcn.00439a40
call fcn.00439360
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x414ff7
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x4150aa
call fcn.004392e0
lea rax, [0x00ad02c1]
mov ebx, 0x14
call fcn.00439be0
call fcn.00439360
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.004392e0
lea rax, [0x00acb433]
mov ebx, 0xd
nop dword [rax]
call fcn.00439be0
mov rax, qword [rsp + 0x28]
call fcn.00439a40
lea rax, [0x00aca945]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x38]
call fcn.00439a40
lea rax, [0x00aca951]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00439be0
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.004398e0
call fcn.00439360
call fcn.004392e0
nop dword [rax]
call fcn.00439540
call fcn.00439360
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x415030
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x00aead56]
mov ebx, 0x3e
call fcn.00437b60
call fcn.004392e0
lea rax, [0x00adb46d]
mov ebx, 0x1e
call fcn.00439be0
mov rax, qword [rsp + 0x60]
call fcn.00439a40
lea rax, [0x00ac773e]
mov ebx, 1
nop dword [rax]
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.00439a40
lea rax, [0x00ac7791]
mov ebx, 2
nop dword [rax + rax]
call fcn.00439be0
call fcn.00439360
lea rax, [0x00ac8553]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
call fcn.00420780
jmp 0x415014
call fcn.004392e0
lea rax, [0x00ad537d]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439be0
call fcn.00439360
jmp 0x414f75
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00414ee0
Function at 0x418260
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41832a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [0x0116d688]
mov edx, dword [rax + 0x488]
cmp edx, ecx
je 0x4182c1
lea ebx, [rcx - 2]
cmp edx, ebx
jne 0x4182cb
mov qword [rsp + 0x28], rax
call fcn.00418080
mov rax, qword [rsp + 0x28]
nop
call fcn.0044be40
mov ecx, dword [0x0116d688]
mov rdx, qword [rsp + 0x28]
xchg dword [rdx + 0x488], ecx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x10], ecx
mov dword [rsp + 0x14], edx
call fcn.004392e0
lea rax, [0x00acb947]
mov ebx, 0xd
call fcn.00439be0
mov eax, dword [rsp + 0x14]
call fcn.004398e0
lea rax, [0x00ada83d]
mov ebx, 0x1e
nop
call fcn.00439be0
mov eax, dword [rsp + 0x10]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00acafb1]
mov ebx, 0xc
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.00418260
Function at 0x418e60
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x419006
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x418f1c
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x418f0f
lea rsi, [0x0116d6f8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and rbx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x210c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and rcx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x418eff
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00465bc0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.004392e0
call fcn.004392e0
lea rax, [0x00ae9ef9]
mov ebx, 0x39
call fcn.00439be0
mov rax, qword [rsp + 0x40]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
call fcn.004392e0
lea rax, [0x00ad5214]
mov ebx, 0x18
call fcn.00439be0
mov rax, qword [rsp + 0x28]
call fcn.00439a40
lea rax, [0x00ac773e]
mov ebx, 1
call fcn.00439be0
mov rax, qword [rsp + 0x20]
call fcn.00439a40
lea rax, [0x00ac7791]
mov ebx, 2
call fcn.00439be0
call fcn.00439360
lea rax, [0x00ac7cf6]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.00420780
lea rax, [0x00ac7a83]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop
call fcn.00420780
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x00adbfa3]
mov ebx, 0x1f
nop dword [rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00418e60
Function at 0x4190e0
Capabilities:
Access peb ldr_data
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41928b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x0097f0b0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41914e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x419161
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x419185
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x419199
cmp rbx, 0x1000
jae 0x419158
nop
jmp 0x419209
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4191ad
xor edx, edx
jmp 0x419200
mov rcx, qword [0x0097f0b0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41918f
jmp 0x419175
call fcn.00467040
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004392e0
lea rax, [0x00ad51fc]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x38]
call fcn.004398e0
lea rax, [0x00ad5364]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00addd64]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004190e0
Function at 0x4192c0
Capabilities:
Access peb ldr_data
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4194ea
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x0097f0a8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00434100
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41933b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41934e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x419370
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x419384
cmp rbx, 0x1000
jae 0x419345
jmp 0x41940e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x419396
xor esi, esi
jmp 0x419400
mov rax, qword [0x0097f0a8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00434100
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41937a
jmp 0x419362
call fcn.00467040
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x419489
call fcn.004392e0
lea rax, [0x00ad623c]
mov ebx, 0x19
call fcn.00439be0
mov rax, qword [rsp + 0x68]
call fcn.004398e0
lea rax, [0x00ad5364]
mov ebx, 0x19
nop
call fcn.00439be0
mov eax, dword [rsp + 0x34]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00acbaf4]
mov ebx, 0xd
call fcn.00437b60
cmp eax, 0x5af
je 0x419433
call fcn.004392e0
lea rax, [0x00ad623c]
mov ebx, 0x19
call fcn.00439be0
mov rax, qword [rsp + 0x38]
call fcn.004398e0
lea rax, [0x00ad5364]
mov ebx, 0x19
nop dword [rax]
call fcn.00439be0
mov eax, dword [rsp + 0x34]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00adc3c1]
mov ebx, 0x1f
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004192c0
Function at 0x419520
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
neg rbx
mov rax, rcx
nop
call fcn.0042fd40
mov rcx, qword [0x0097f0b0]
mov rdx, qword [rsp + 0x40]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x8000
call fcn.00434080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x419597
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00467040
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x28], rax
call fcn.004392e0
lea rax, [0x00ad51fc]
mov ebx, 0x18
call fcn.00439be0
mov rax, qword [rsp + 0x48]
call fcn.004398e0
lea rax, [0x00ad5364]
mov ebx, 0x19
call fcn.00439be0
mov rax, qword [rsp + 0x28]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00adce6e]
mov ebx, 0x20
call fcn.00437b60
nop
int3
Function at 0x420bc0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x0119b2b2], 0
jne 0x420cb9
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and rbx, 7
mov rsi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x420caf
lea rbx, [0x0116d6f8]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x420c8a
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x16a8], rsi
add qword [rax + 0x16b0], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00465bc0
lea rax, [0x00ae5280]
mov ebx, 0x2c
call fcn.00437b60
nop
int3

Function at 0x422a60
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x422af3
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test byte [rax], al
movabs rdx, 0x800000000000
lea rsi, [rdx + rbx]
add rdx, rcx
cmp rdx, rsi
jbe 0x422a99
nop
mov rdx, rcx
sub rcx, rbx
jmp 0x422aa0
mov rdx, rcx
xor ecx, ecx
nop
test rcx, rcx
je 0x422aad
cmp dword [rax + 0x100e0], edi
je 0x422ac0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
test rbx, 0x3fffff
jne 0x422ae1
add rax, 0x100b8
mov rcx, rdx
call fcn.0042eea0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00ad965d]
mov ebx, 0x1c
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
call fcn.00467ba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
nop
jmp fcn.00422a60