joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a780
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x48], r14
cmp dword [0x01154174], 0
je 0x44a7bf
mov qword [rsp + 0x60], rax
mov eax, 2
call fcn.00432c80
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov dword [0x01154174], 1
mov rcx, qword [rsp + 0x48]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x38], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x30], rsi
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbx + 0xf8]
mov qword [rsp + 0x20], rdi
call fcn.004392e0
lea rax, [0x00abe38d]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x38]
call fcn.00439a40
call fcn.00439500
mov rax, qword [rsp + 0x30]
call fcn.00439a40
nop
call fcn.00439500
mov rax, qword [rsp + 0x28]
call fcn.00439a40
call fcn.00439500
mov rax, qword [rsp + 0x20]
call fcn.00439a40
nop
call fcn.00439540
call fcn.00439360
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
call fcn.004392e0
lea rax, [0x00abc2ae]
mov ebx, 3
call fcn.00439be0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x138], 0
je 0x44a914
cmp dword [rcx + 0x108], 0
jle 0x44a90d
mov rdx, qword [rsp + 0x70]
cmp qword [rcx], rdx
jne 0x44a919
cmp byte [0x0092c043], 0
je 0x44a900
nop
call fcn.004392e0
lea rax, [0x00ad9b5f]
mov ebx, 0x2e
call fcn.00439be0
call fcn.00439360
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x138]
jmp 0x44a91c
mov rdx, qword [rsp + 0x70]
jmp 0x44a919
mov rdx, qword [rsp + 0x70]
mov rcx, rdx
mov qword [rsp + 0x40], rcx
call fcn.004392e0
call fcn.00439540
call fcn.00439360
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 1
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
mov qword [rax + 0x98], rdi
mov eax, dword [0x0092c0e8]
mov rdx, qword [r14 + 0x30]
movzx edx, byte [rdx + 0xf9]
shr eax, 2
test dl, dl
cmovne eax, edx
test eax, eax
jle 0x44a9a5
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
mov rdi, rcx
xor ecx, ecx
call fcn.00459620
mov rax, qword [rsp + 0x40]
call fcn.0045a580
mov rax, qword [rsp + 0x68]
nop
call fcn.00408760
mov eax, 2
call fcn.00432c80
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x44ac00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44ac93
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
xor eax, eax
jmp 0x44ac30
lea r8, [0x011549c0]
mov byte [r8 + rax], sil
inc dword [0x01154134]
mov rax, rdi
cmp rax, 0x36
jge 0x44ac7e
lea rdx, [0x00adca53]
movzx esi, byte [rdx + rax]
cmp esi, 0x80
jge 0x44ac4f
lea rdi, [rax + 1]
jmp 0x44ac76
mov qword [rsp + 0x18], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
nop
call fcn.0045cfe0
lea rdx, [0x00adca53]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x18]
cmp rax, 0x64
jb 0x44ac1c
jmp 0x44ac88
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov ecx, 0x64
call fcn.00465b60
nop
call fcn.00463440
jmp fcn.0044ac00

Function at 0x44ba00
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44bb73
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rsi, rdx
shr rdx, 0x2a
cmp rdx, 0x40
jae 0x44bb65
lea rdi, [0x01126558]
mov rdx, qword [rdi + rdx*8]
shr rsi, 0x16
and rsi, 0xfffff
mov rsi, qword [rdx + rsi*8]
mov rdi, rax
shr rax, 0xd
and rax, 0x1ff
mov r8, qword [rsi + rax*8 + 0x20000]
test byte [rdx], al
test byte [rsi], al
mov dl, byte [r8 + 0x63]
cmp dl, 2
jne 0x44bb4f
mov qword [rsp + 0x18], r8
mov rdx, qword [r8 + 0x28]
test rdx, rdx
jne 0x44bac5
movzx eax, bl
cmp rax, 2
jae 0x44bb45
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x20], rdi
shl rax, 6
lea rcx, [0x01154ac0]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, r8
call fcn.00428aa0
movzx ebx, byte [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x18]
mov rdx, rdi
mov rsi, qword [r8 + 0x28]
mov qword [rdi], rsi
mov qword [r8 + 0x28], rdx
movzx edx, word [r8 + 0x60]
lea esi, [rdx - 1]
mov word [r8 + 0x60], si
cmp dword [0x01154158], 0
jne 0x44bb31
cmp dx, 1
jne 0x44bb31
movzx eax, bl
cmp rax, 2
jae 0x44bb3b
shl rax, 6
lea rcx, [0x01154ac0]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, r8
call fcn.00428920
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 0x28], 0
lea rax, [0x011163c0]
mov ecx, 1
call fcn.00428500
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov ecx, 2
call fcn.00465b60
mov ecx, 2
call fcn.00465b60
lea rax, [0x00ad1625]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00437b60
mov rax, rdx
mov ecx, 0x40
call fcn.00465b80
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax]
call fcn.00463440
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0044ba00
Function at 0x44dc80
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44de09
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax], 0
nop dword [rax]
je 0x44ddf7
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x44dcde
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop dword [rax]
cmp rax, rdx
jne 0x44dde6
mov rsi, r14
cmp rsi, rdx
je 0x44dde6
cmp ecx, 2
jne 0x44dde6
cmp qword [rax + 0x70], 0
jne 0x44dcff
cmp byte [rax + 0xb4], 0
je 0x44dcf2
xor ecx, ecx
jmp 0x44dd01
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x44dd01
xor ecx, ecx
test cl, cl
je 0x44ddd5
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x44dd28
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x2d0], 0
jne 0x44ddc4
cmp dword [0x01154974], 0
jg 0x44ddba
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x138]
mov rax, rcx
call fcn.004514e0
test rax, rax
je 0x44dd5e
cmp byte [rax + 0x28], 6
jne 0x44dd5e
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rbx, rcx
mov rcx, rbx
shr rbx, 1
cmp rbx, 0x2000
jb 0x44ddb0
mov rsi, qword [rax + 0x38]
sub rdx, rsi
add rdx, 0x320
shr rcx, 2
cmp rcx, rdx
ja 0x44dda1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
call fcn.0044cd20
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00acb524]
mov ebx, 0x1a
call fcn.00437b60
lea rax, [0x00ac855b]
mov ebx, 0x17
call fcn.00437b60
lea rax, [0x00ac9fbf]
mov ebx, 0x19
call fcn.00437b60
lea rax, [0x00acd32b]
mov ebx, 0x1c
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0044dc80
Function at 0x44e800
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44ea57
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
test rcx, rcx
jle 0x44e837
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x44ea08
xor edx, edx
xor esi, esi
xor edi, edi
nop dword [rax]
test rdx, rdx
je 0x44e905
cmp rdx, 1
jne 0x44e8a2
test rax, rax
je 0x44e860
mov rdx, rsi
mov esi, 1
jmp 0x44e8a7
cmp rcx, rsi
jbe 0x44e9f0
mov rdx, rsi
shl rsi, 4
mov r8, qword [rbx + rsi]
mov rsi, qword [rbx + rsi + 8]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x58]
mov r8, qword [r14 + 8]
cmp qword [r14], rsi
ja 0x44e89a
cmp rsi, r8
setb sil
jmp 0x44e89c
xor esi, esi
xor esi, 1
nop
jmp 0x44e8a7
mov rdx, rsi
xor esi, esi
test sil, sil
jne 0x44e8e9
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rbx
mov rbx, rdi
nop
call fcn.0044ef60
mov rdx, qword [rsp + 0x88]
test rdx, rdx
jle 0x44e91b
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov r8, qword [rsp + 0x80]
xor r9d, r9d
jmp 0x44e935
cmp rcx, rdx
jbe 0x44e913
shl rdx, 4
mov rax, qword [rbx + rdx]
mov rbx, qword [rbx + rdx + 8]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
call fcn.00465b60
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
add r8, 0x10
mov rcx, rsi
mov rsi, r9
mov r9, rdi
mov rdi, r11
mov r10, qword [r8 + 8]
cmp rdi, r10
mov r11, rdi
cmovg rdi, r10
mov r12, qword [r8]
cmp rcx, r12
jne 0x44e950
cmp r11, r10
jmp 0x44e9b5
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x18], r10
mov rax, rcx
mov rbx, r12
mov rcx, rdi
call fcn.004664e0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
mov r10, rax
mov r11, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jb 0x44e9e5
lea rdi, [r9 + 1]
sub rsi, r10
sub r11, r10
mov r9, rsi
neg rsi
sar rsi, 0x3f
and r10, rsi
lea rsi, [rcx + r10]
cmp rdx, rdi
jg 0x44e925
nop dword [rax + rax]
jmp 0x44e91b
mov rax, r10
mov rcx, r11
call fcn.00465c20
mov rax, rsi
call fcn.00465b60
add rbx, 0x10
mov r10, rsi
mov rsi, r9
mov r9, r8
mov r8, r10
mov r10, qword [rbx + 8]
test r10, r10
jne 0x44ea1f
mov r10, r9
mov r9, rsi
mov rsi, r8
mov r8, r10
jmp 0x44ea2e
lea r8, [r9 + r10]
cmp r9, r8
jg 0x44ea45
inc rdi
mov r9, rsi
inc r9
cmp rcx, r9
jg 0x44e9f8
mov rbx, rdx
mov rdx, rdi
mov rdi, r8
nop
jmp 0x44e840
lea rax, [0x00ace49b]
mov ebx, 0x1d
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044e800
Function at 0x4514e0
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rcx, [0x00938560]
jmp 0x451500
mov rcx, qword [rcx + 0x210]
nop
test rcx, rcx
je 0x451519
cmp qword [rcx + 0xa0], rax
ja 0x4514f7
cmp qword [rcx + 0xa8], rax
jbe 0x4514f7
jmp 0x451520
xor ecx, ecx
nop dword [rax + rax]
test rcx, rcx
je 0x4515ab
mov rdx, qword [rcx + 0xa0]
mov rsi, rax
sub rax, rdx
mov rdx, rax
shr rax, 0xc
lea rdi, [rax + rax*4]
shl rdi, 2
add rdi, qword [rcx + 0x98]
and rdx, 0xfff
shr rdx, 8
mov r8d, dword [rdi]
nop word [rax + rax]
cmp rdx, 0x10
jae 0x451675
movzx edx, byte [rdi + rdx + 4]
add edx, r8d
mov rdi, qword [rcx + 0x88]
mov r8, qword [rcx + 0x80]
cmp edi, edx
ja 0x451588
lea rdx, [rdi - 1]
mov eax, edx
cmp rdi, rax
jbe 0x45166d
shl rax, 4
mov r9, qword [r8 + rax]
nop dword [rax + rax]
cmp r9, rsi
ja 0x451630
jmp 0x4515bc
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov edx, r9d
lea eax, [rdx + 1]
nop
cmp rdi, rax
jbe 0x451626
mov r9d, eax
shl rax, 4
mov r10, qword [rax + r8]
cmp r10, rsi
jbe 0x4515b9
mov eax, edx
cmp rdi, rax
jbe 0x45161e
shl rax, 4
mov rax, qword [r8 + rax + 8]
cmp rax, 0xffffffffffffffff
je 0x451608
mov rdx, qword [rcx + 0x70]
mov rsi, qword [rcx + 0x68]
cmp rdx, rax
jbe 0x451616
add rax, rsi
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rdx
call fcn.00465b80
mov rcx, rdi
call fcn.00465b60
mov rcx, rdi
call fcn.00465b60
dec edx
mov eax, edx
cmp rdi, rax
jbe 0x451665
shl rax, 4
mov r9, qword [r8 + rax]
nop
cmp r9, rsi
jbe 0x45164b
test edx, edx
ja 0x45162e
jmp 0x45164f
test edx, edx
jne 0x4515d5
lea rax, [0x00ad31dc]
mov ebx, 0x23
nop dword [rax + rax]
call fcn.00437b60
mov rcx, rdi
call fcn.00465b60
mov rcx, rdi
call fcn.00465b60
mov rax, rdx
mov ecx, 0x10
nop dword [rax]
call fcn.00465b80
nop
int3
Function at 0x4524a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x452618
movzx edx, byte [rax]
nop
test edx, edx
jne 0x4524dc
test r8b, r8b
jne 0x4524dc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x4524ef
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4525d8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x4525c6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x4525bc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x452543
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x452586
mov eax, 1
cmp rax, rbx
ja 0x452575
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00465c20
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x4525b4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x45257d
mov r8d, eax
mov eax, r10d
jmp 0x452548
mov rcx, rbx
call fcn.00465b60
xor eax, eax
mov rcx, rbx
call fcn.00465b60
mov eax, r8d
mov rcx, rbx
call fcn.00465c20
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45260e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x4525d1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4524f5
mov eax, edx
mov rcx, rbx
call fcn.00465b60
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.00465b60
nop
int3
Function at 0x453240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4533aa
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
cmp dword [0x01154164], 0
jne 0x45327a
call fcn.004303c0
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
cmp qword [rbx], 0
nop
jne 0x453398
nop
mov rdx, rax
mov qword [rbx], rax
test byte [rdx], al
mov rdi, qword [rdx + 0x26e8]
mov r8, qword [rdx + 0x26e0]
mov r9, qword [rdx + 0x26f0]
lea rsi, [rdi + 1]
cmp r9, rsi
jb 0x4532b2
mov rax, rdi
jmp 0x453307
mov qword [rsp + 0x40], rdi
lea rax, [0x009d2760]
mov rbx, r8
mov rcx, rdi
mov rdi, r9
call fcn.0044b060
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x26f0], rcx
cmp dword [0x011546d0], 0
nop
jne 0x4532eb
mov qword [rdx + 0x26e0], rax
jmp 0x4532f7
lea rdi, [rdx + 0x26e0]
call fcn.004656c0
mov rdi, rbx
mov r8, rax
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
lea rsi, [rdi + 1]
mov qword [rdx + 0x26e8], rsi
lea rsi, [r8 + rdi*8]
cmp dword [0x011546d0], 0
jne 0x453325
mov qword [r8 + rdi*8], rbx
jmp 0x45332d
mov rdi, rsi
call fcn.00465800
mov rsi, qword [rdx + 0x26e0]
mov rbx, qword [rdx + 0x26e8]
mov rcx, qword [rdx + 0x26f0]
mov rdi, rax
mov rax, rsi
call fcn.004551c0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + 0x26e8]
mov rsi, qword [rdx + 0x26e0]
test rcx, rcx
jbe 0x453391
mov rax, qword [rsp + 0x60]
cmp qword [rsi], rax
jne 0x45337a
mov rax, qword [rax + 8]
xchg qword [rdx + 0x1668], rax
mov eax, 1
lock xadd dword [rdx + 0x26f8], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
call fcn.00465b60
lea rax, [0x00ad2555]
mov ebx, 0x22
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00453240
Function at 0x456f00
Capabilities:
Get geographical location

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4570e6
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0
lea rdi, [rsp + 0x50]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465e50
mov rbp, qword [rbp]
mov rsi, qword [rax + 0x28]
jmp 0x456f74
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rdi + 0x28]
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0xb8]
test rsi, rsi
je 0x457088
mov qword [rsp + 0x38], rsi
mov rdi, qword [rsi + 0x18]
test rdi, rdi
jne 0x456fb4
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
jmp 0x457056
mov qword [rsp + 0x30], rdi
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
call fcn.004514e0
test rax, rax
je 0x457098
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov r8, qword [rsp + 0x38]
cmp dword [r8], 0
jne 0x456fe9
xor r9d, r9d
jmp 0x456fee
nop
lea r9, [r8 + 0x48]
mov qword [rsp + 0x88], r9
mov r9d, dword [rax + 0xc]
movsxd r10, r9d
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x98], 0
cmp r9d, 0x80000000
jne 0x457049
mov rcx, rbx
mov edi, 1
mov rsi, qword [rsp + 0x30]
mov rbx, rax
lea rax, [rsp + 0x48]
call fcn.00458f20
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x60], rsi
mov rsi, qword [rbx]
lea rax, [rsp + 0x48]
mov rdx, rbx
mov rbx, rcx
call rsi
test al, al
jne 0x456f5e
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
call fcn.004392e0
lea rax, [0x00ace461]
mov ebx, 0x1d
call fcn.00439be0
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
lea rax, [0x00abe97d]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00456f00
Function at 0x4599e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459b4f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
call fcn.004392e0
lea rax, [0x00accfab]
mov ebx, 0x1c
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.004399e0
lea rax, str._:_n_fk_rtadxaesageavxbincdpdirendfinfmaftpgc_gp_idaintip4ip6keymapnannewnilobjpcpdfpngptrreqrodsetsshtagtaptcptmpu00udpurlvfsviass______________as__at__fp_in__is__lr:_of__on__pc_sp:_sp_1._x_r_ngt_lt______m__Inf_Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.rod.svg.xml0x_x108031259222:_p:443__s_ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCHARCMYKCallChamCopyDATADashDateDoneEESTEtagExitFASTFindFromGOGCGoneGrayHEADHOMEHelpHomeHostIDATIENDIHDRIdleInfoJulyJuneKeyAKeyBKeyCKeyDKeyEKeyFKeyGKeyHKeyIKeyJKeyKKeyLKeyMKeyNKeyOKeyPKeyQKeyRKeySKeyTKeyUKeyVKeyWKeyXKeyYKeyZLEAFLisuMetaMiaoModiNZDTNZSTNewaOpenPINGPLTEPOSTRGBARedoSASTSaveStatStepThaiUndo__s__::____r_nu00_n_tm_r_n__
mov ebx, 3
call fcn.00439be0
call fcn.00439360
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
xor edx, edx
jmp 0x459a7a
mov rbx, qword [rsp + 0x20]
lea rdx, [rbx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
cmp rdx, rcx
jge 0x459acf
mov qword [rsp + 0x20], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.004514e0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x20]
test rcx, rcx
sete dl
xor edi, edi
mov esi, edi
mov ecx, edx
call fcn.0045a160
test al, al
je 0x459a67
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x18]
call fcn.00459ba0
jmp 0x459a67
cmp qword [rsp + 0x68], 0x64
jne 0x459af2
call fcn.004392e0
lea rax, [0x00acf36e]
mov ebx, 0x1f
call fcn.00439be0
call fcn.00439360
mov rax, qword [rsp + 0x80]
call fcn.004514e0
nop
test rax, rax
jne 0x459b09
xor ecx, ecx
jmp 0x459b2a
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edi, edi
mov esi, edi
call fcn.0045a160
mov rbx, qword [rsp + 0x38]
mov ecx, eax
mov rax, qword [rsp + 0x40]
test cl, cl
je 0x459b45
cmp qword [rsp + 0x78], 1
je 0x459b45
mov rcx, qword [rsp + 0x80]
nop
call fcn.00459420
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004599e0
Function at 0x459e80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459f4a
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
lea rdx, [rsp + 0x18]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x28]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x38]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x48]
movups xmmword [rdx], xmm15
lea rdx, [0x00459f80]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00463300
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00459e80