joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423440
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423557
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
lea rcx, [rbx - 1]
test rcx, rbx
jne 0x423516
test rbx, rbx
je 0x423516
cmp rbx, 0x40
ja 0x4234d6
mov qword [rsp + 0x28], rax
mov ecx, 7
jmp 0x423498
mov rdx, qword [rsp + 0x10]
lea rcx, [rdx - 1]
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
test rcx, rcx
jl 0x4234ca
mov qword [rsp + 0x10], rcx
test byte [rax], al
mov rdx, qword [rax + rcx*8 + 0x40]
or rdx, qword [rax + rcx*8]
mov rax, rdx
call fcn.00423280
cmp rax, 0xffffffffffffffff
je 0x423485
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.004392e0
lea rax, [0x00acce73]
mov ebx, 0xf
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.004398e0
call fcn.00439540
nop dword [rax + rax]
call fcn.00439360
lea rax, [0x00acbaa6]
mov ebx, 0xd
call fcn.00437b60
call fcn.004392e0
lea rax, [0x00acce73]
mov ebx, 0xf
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.004398e0
call fcn.00439540
nop dword [rax + rax]
call fcn.00439360
lea rax, [0x00addb75]
mov ebx, 0x21
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00423440
Function at 0x428aa0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428b86
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x428b01
cmp qword [rbx + 8], 0
jne 0x428b01
cmp qword [rbx + 0x10], 0
jne 0x428b01
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rcx, qword [rax]
nop dword [rax]
test rcx, rcx
je 0x428aeb
mov qword [rcx + 8], rbx
jmp 0x428aef
mov qword [rax + 8], rbx
mov qword [rax], rbx
mov qword [rbx + 0x10], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov qword [rsp + 0x40], rbx
mov rax, qword [rbx + 8]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x10], rcx
call fcn.004392e0
lea rax, [0x00addd43]
mov ebx, 0x21
call fcn.00439be0
mov rax, qword [rsp + 0x40]
call fcn.00439ba0
call fcn.00439500
mov rax, qword [rsp + 0x20]
call fcn.00439ba0
call fcn.00439500
mov rax, qword [rsp + 0x18]
call fcn.00439ba0
call fcn.00439500
mov rax, qword [rsp + 0x10]
call fcn.00439ba0
call fcn.00439540
call fcn.00439360
lea rax, [0x00acd8c8]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00428aa0
Function at 0x428bc0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428dca
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
call fcn.004269a0
test rax, rax
je 0x428db8
mov qword [rsp + 0x18], rax
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x28], rcx
call fcn.00424560
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x18]
sub rcx, qword [rdx + 0x18]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rbx + 0xa]
mov byte [rsp + 0x17], sil
lea rax, [rdx + 0x78]
mov qword [rsp + 0x30], rax
nop
call fcn.0040c5e0
mov rcx, qword [rsp + 0x18]
lea rdx, [rcx + 0x80]
movzx ebx, byte [rsp + 0x17]
mov rsi, qword [rsp + 0x20]
jmp 0x428c59
mov rdx, rdi
mov rdi, qword [rdx]
nop dword [rax]
test rdi, rdi
je 0x428ccb
movzx r8d, word [rdi + 8]
cmp r8, rsi
jne 0x428c77
cmp byte [rdi + 0xa], bl
je 0x428c87
cmp r8, rsi
ja 0x428ccb
jne 0x428c56
nop dword [rax + rax]
cmp byte [rdi + 0xa], bl
jbe 0x428c56
jmp 0x428ccb
nop
nop
mov rax, qword [rsp + 0x30]
call fcn.0040c800
nop
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x428cbf
cmp byte [r14 + 0xb1], 0
je 0x428cbf
mov qword [r14 + 0x10], 0xfffffffffffffade
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbx, qword [rsp + 0x50]
mov word [rbx + 8], si
mov rsi, qword [rdx]
mov qword [rbx], rsi
mov qword [rdx], rbx
nop
nop
mov rax, qword [rcx + 0x18]
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop word [rax + rax]
cmp rdx, 0x40
jae 0x428dab
lea rsi, [0x0116d6f8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and rbx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
shr rax, 0xd
mov rcx, rax
and rax, 0x1ff
shr rax, 3
cmp rax, 0x40
jae 0x428da1
lea rdx, [rdx + rax]
lea rdx, [rdx + 0x21080]
and rcx, 7
mov ebx, 1
shl ebx, cl
lock or byte [rdx], bl
nop
nop
mov rax, qword [rsp + 0x30]
nop
call fcn.0040c800
nop
mov rdx, qword [rsp + 0x28]
mov ebx, dword [rdx + 0xd8]
lea esi, [rbx - 1]
mov dword [rdx + 0xd8], esi
cmp ebx, 1
jne 0x428d91
cmp byte [r14 + 0xb1], 0
je 0x428d91
mov qword [r14 + 0x10], 0xfffffffffffffade
mov eax, 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
mov ecx, 0x40
call fcn.00465bc0
mov rax, rdx
mov ecx, 0x40
call fcn.00465bc0
lea rax, [0x00ad9ff7]
mov ebx, 0x1d
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00428bc0
Function at 0x4298e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42998d
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [0x0119bba8]
nop
test rax, rax
je 0x429926
mov qword [rsp + 0x10], rax
mov rcx, qword [rax + 8]
mov qword [0x0119bba8], rcx
mov ebx, 0x10000
call fcn.00466260
mov rax, qword [rsp + 0x10]
jmp 0x429962
nop
nop
lea rax, [0x0119bba0]
call fcn.0040c800
mov eax, 0x10000
lea rbx, [0x011a0158]
call fcn.00419060
test rax, rax
je 0x42997b
mov qword [rsp + 0x18], rax
nop
nop
lea rax, [0x0119bba0]
call fcn.0040c5e0
mov rax, qword [rsp + 0x18]
mov qword [rax + 8], 0
mov qword [rax], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00adc3a2]
mov ebx, 0x1f
call fcn.00437b60
nop
call fcn.00463480
jmp fcn.004298e0

Function at 0x4299a0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x429ae6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [0x009365a0]
nop
cmp rdx, 0x15
ja 0x429a63
mov qword [rsp + 0x30], rbx
test byte [rax], al
cmp dword [0x0119ba70], 0
jne 0x4299e3
mov qword [rax + 0x10110], rcx
jmp 0x4299ef
lea rdi, [rax + 0x10110]
call fcn.00465800
mov qword [rsp + 0x28], rax
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call fcn.0042ebc0
mov rax, qword [rsp + 0x28]
call fcn.0042bc60
mov rcx, qword [0x00934408]
mov rdx, qword [rsp + 0x28]
mov qword [rdx + 0x10078], rcx
cmp dword [0x0119ba70], 0
jne 0x429a3a
mov rax, qword [rsp + 0x30]
mov qword [rdx + 0x10108], rax
jmp 0x429a4b
lea rdi, [rdx + 0x10108]
mov rax, qword [rsp + 0x30]
call fcn.00465700
mov rax, qword [0x00934408]
mov qword [rdx + 0x100f8], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rdx
call fcn.004392e0
lea rax, [0x00adcece]
mov ebx, 0x20
call fcn.00439be0
mov rcx, qword [rsp + 0x10]
cmp rcx, 0x40
sbb rax, rax
mov edx, 1
shl rdx, cl
and rax, rdx
call fcn.004399e0
call fcn.00439540
nop
call fcn.00439360
call fcn.004392e0
lea rax, [0x00ada5f8]
mov ebx, 0x1d
call fcn.00439be0
mov eax, 0x200000
call fcn.004399e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ae4cb7]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463480
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004299a0
Function at 0x42ffc0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430026
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rcx, [rax + 0x10]
mov qword [rax], rcx
cmp byte [0x0119ba75], 0
je 0x42ffee
lea rcx, [rax + 0x20]
mov qword [rax + 8], rcx
jmp 0x42fff9
add rcx, 0x1000
mov qword [rax + 8], rcx
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
test rcx, 0xf
jne 0x430013
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00adbf27]
mov ebx, 0x1f
nop
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463480
mov rax, qword [rsp + 8]
jmp fcn.0042ffc0
Function at 0x430100
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4303a6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x16d0]
mov rcx, qword [rax + 0x16c0]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x43039a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x16c0], 0
cmp byte [0x0119b2b2], 0
jne 0x430162
xor edx, edx
xor ebx, ebx
nop
jmp 0x4301ab
xor edx, edx
jmp 0x43018e
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x16d0]
mov rax, rcx
call fcn.004203e0
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x430166
add rax, 0x16c0
call fcn.0042ffc0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x430332
mov rsi, qword [rax + rdx*8 + 0x16d0]
nop dword [rax]
cmp rsi, 0x1000
jb 0x4301a8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00415120
test rax, rax
jne 0x430202
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x4301a8
nop
mov rsi, rcx
shr rcx, 3
and rsi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x430245
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x4301a8
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x43038d
lea r10, [0x0116d6f8]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x4302cc
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x430305
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x16a8]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x16a8], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x4301a8
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x430385
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x16d0], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x4301a8
cmp rbx, 0x200
ja 0x430377
lea rdx, [rax + 0x16d0]
lea rsi, [rax + 0x1698]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00425aa0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x16c0]
call fcn.0042ffc0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.00465c20
mov rax, r8
call fcn.00465ba0
mov rax, r8
mov ecx, 0x40
call fcn.00465bc0
mov edx, 0x200
nop
call fcn.00465c00
nop
mov qword [rsp + 8], rax
call fcn.00467ba0
mov rax, qword [rsp + 8]
jmp fcn.00430100
Function at 0x432140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4323dd
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x011436b0]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.00434080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x43224e
nop
jne 0x4321d6
cmp dword [rsp + 0x4c], 0
jne 0x4321d6
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x43224e
mov rax, qword [0x011436a8]
nop dword [rax]
call fcn.00433f20
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x0119cc4a]
mov ebx, 0x20
mov ecx, 0x21
call fcn.00432980
mov rcx, qword [0x0119b850]
nop word [rax + rax]
cmp rcx, 0x105
ja 0x4323d2
mov qword [rsp + 0x58], rcx
lea rax, [0x0119ca60]
lea rbx, [0x0119c5a0]
call fcn.00466520
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x432260
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rdx + rbx + 1], dil
inc rax
cmp rax, 0x20
jge 0x4322ce
lea rdx, [rcx + rax*2]
lea rbx, [0x0119ca60]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x00accfa8]
movzx esi, byte [rdi + rsi]
cmp rdx, 0x20b
jae 0x4323c5
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
nop word [rax + rax]
cmp rsi, 0x20b
jb 0x432258
jmp 0x4323b5
lea rdx, [rcx + 0x40]
jmp 0x4322e2
lea rbx, [0x0119ca60]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x4322f9
cmp rdx, 0x20b
jb 0x4322d4
jmp 0x4323a8
mov rax, qword [0x0097efb8]
lea rcx, [0x0119ca60]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.00434280
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.00467040
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x432397
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.004392e0
lea rax, [0x00aed5a0]
mov ebx, 0x5f
call fcn.00439be0
call fcn.00439360
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [0x0119b29f], 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.00465ba0
mov rax, rsi
mov ecx, 0x20b
nop dword [rax]
call fcn.00465ba0
mov rax, rdx
mov ecx, 0x20b
call fcn.00465ba0
mov edx, 0x105
call fcn.00465c00
nop
nop dword [rax]
call fcn.00463480
jmp fcn.00432140
Function at 0x43bd40
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43bdec
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x2c], ecx
lea edx, [rbx - 1]
cmp edx, 3
ja 0x43bd8e
mov edx, ebx
bts ebx, 0xc
cmp ecx, ebx
jne 0x43bd8e
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx + 0x90], ecx
sete cl
mov eax, ecx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.004392e0
lea rax, [0x00addd22]
mov ebx, 0x21
nop
call fcn.00439be0
mov eax, dword [rsp + 0x28]
mov eax, eax
call fcn.00439a40
lea rax, [0x00ac8c1d]
mov ebx, 8
nop dword [rax]
call fcn.00439be0
mov eax, dword [rsp + 0x2c]
mov eax, eax
call fcn.00439a40
call fcn.00439540
call fcn.00439360
lea rax, [0x00acd758]
mov ebx, 0x10
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x14], ecx
call fcn.00463480
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov ecx, dword [rsp + 0x14]
jmp fcn.0043bd40
Function at 0x43c640
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c89b
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jg 0x43c889
mov qword [rsp + 0x40], r14
nop
nop
lea rax, [0x01147dd8]
call fcn.0040c5e0
mov ecx, dword [0x0119b4a4]
mov dword [0x01147ec4], ecx
mov ecx, 1
lea rdx, [0x01147ec0]
xchg dword [rdx], ecx
call fcn.00444fc0
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0xa0]
mov dword [rcx + 4], 3
dec dword [0x01147ec4]
mov rcx, qword [0x01145280]
mov qword [rsp + 0x48], rcx
mov rdx, qword [0x01145288]
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x43c6e0
lea rax, [rdi + 1]
nop dword [rax + rax]
cmp rax, rdx
jge 0x43c77a
mov rbx, qword [rcx + rax*8]
mov esi, dword [rbx + 4]
cmp esi, 2
jne 0x43c70c
mov rdi, rax
mov eax, esi
mov r8d, 3
lock cmpxchg dword [rbx + 4], r8d
sete sil
jmp 0x43c717
mov rdi, rax
mov r8d, 3
xor esi, esi
test sil, sil
je 0x43c6d4
cmp byte [0x0114d490], 0
je 0x43c75f
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rbx
mov rax, rbx
call fcn.00456de0
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00456640
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
mov r8d, 3
inc dword [rbx + 0x14]
dec dword [0x01147ec4]
jmp 0x43c6d4
mov dword [rax + 4], 3
dec dword [0x01147ec4]
call fcn.00445e60
nop
test rax, rax
jne 0x43c76d
nop
nop
mov ecx, dword [0x01147ec4]
mov dword [rsp + 0x14], ecx
lea rax, [0x01147dd8]
call fcn.0040c800
mov ecx, dword [rsp + 0x14]
test ecx, ecx
jle 0x43c7d0
jmp 0x43c7ac
call fcn.00444fc0
lea rax, [0x01147ec8]
mov ebx, 0x186a0
call fcn.0040cd40
nop dword [rax]
test al, al
je 0x43c7a7
nop
mov qword [0x01147ec8], 0
cmp dword [0x01147ec4], 0
jne 0x43c7f2
mov rcx, qword [0x01145280]
mov rdx, qword [0x01145288]
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x43c879
mov eax, 0x29
lea rcx, [0x00ae3d0d]
mov edx, dword [0x0119b490]
test edx, edx
je 0x43c840
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x38], rcx
nop
nop
lea rax, [0x0119b750]
nop dword [rax + rax]
call fcn.0040c5e0
nop
nop
lea rax, [0x0119b750]
call fcn.0040c5e0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x38]
nop dword [rax]
test rax, rax
jne 0x43c84f
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbx, rax
mov rax, rcx
call fcn.00437b60
mov rdi, qword [rcx + rax*8]
cmp dword [rdi + 4], 3
mov edi, 0x2e
cmovne rbx, rdi
lea r8, [0x00ae63c8]
cmovne rsi, r8
inc rax
cmp rax, rdx
jl 0x43c85a
mov rax, rbx
mov rcx, rsi
jmp 0x43c7fe
lea rax, [0x00ad8591]
mov ebx, 0x1b
call fcn.00437b60
nop
nop dword [rax + rax]
call fcn.00463480
jmp fcn.0043c640
Function at 0x43e180
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43e40a
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], bl
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
nop
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rcx
nop
lea rax, [0x01147dd8]
nop
call fcn.0040c5e0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x43e1e0
call fcn.00445e60
test rax, rax
je 0x43e2d2
mov rcx, rax
nop
mov rdx, qword [0x01147de0]
test rdx, rdx
je 0x43e204
mov rbx, qword [rdx + 0x130]
mov qword [0x01147de0], rbx
dec dword [0x01147de8]
test rdx, rdx
mov qword [rsp + 0x28], rcx
jne 0x43e285
call fcn.0043b480
mov qword [rsp + 0x18], rax
nop
nop
lea rax, [0x01147dd8]
nop
call fcn.0040c800
movzx eax, byte [rsp + 0x50]
movzx eax, al
test rax, rax
mov eax, 0
lea rcx, [0x00c56890]
cmovne rax, rcx
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
call fcn.0043db00
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43e27b
cmp byte [r14 + 0xb1], 0
je 0x43e27b
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x30], rdx
nop
nop
lea rax, [0x01147dd8]
call fcn.0040c800
mov rcx, qword [rsp + 0x30]
cmp byte [rcx + 0xe4], 0
jne 0x43e3f8
cmp qword [rcx + 0xa8], 0
jne 0x43e3e7
movzx edx, byte [rsp + 0x50]
nop dword [rax]
test dl, dl
je 0x43e2ce
mov rsi, qword [rsp + 0x28]
jmp 0x43e3a1
xor eax, eax
jmp 0x43e34b
nop
nop
lea rax, [0x01147dd8]
nop dword [rax + rax]
call fcn.0040c800
movzx ecx, byte [rsp + 0x50]
test cl, cl
je 0x43e304
mov ecx, 0xffffffff
lea rdx, [0x01147e1c]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43e33a
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43e330
cmp byte [r14 + 0xb1], 0
je 0x43e330
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00ad8576]
mov ebx, 0x1b
call fcn.00437b60
mov byte [rcx + 0xe4], al
mov rdx, qword [rsp + 0x28]
mov qword [rcx + 0xa8], rdx
lea rax, [rcx + 0x120]
call fcn.0040c8e0
nop
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43e397
cmp byte [r14 + 0xb1], 0
je 0x43e397
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov edi, dword [rsi + 0x5f0]
mov r8d, dword [rsi + 0x5f4]
mov r9, qword [rsi + 0xdf8]
mov r10d, dword [rsi + 0x5f4]
nop dword [rax]
cmp r10d, r8d
jne 0x43e3a1
cmp r8d, edi
jne 0x43e3d6
test r9, r9
jne 0x43e3d6
mov eax, edx
jmp 0x43e34b
lea rax, [0x00ad62d2]
mov ebx, 0x19
call fcn.00437b60
lea rax, [0x00acceaf]
mov ebx, 0xf
call fcn.00437b60
lea rax, [0x00ad2217]
mov ebx, 0x15
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00463480
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0043e180
Function at 0x43e7a0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43e9dd
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x138]
test rdx, rdx
je 0x43e9cb
mov rdx, qword [rdx + 0xe8]
cmp rdx, rcx
jne 0x43e9cb
mov qword [rsp + 0x28], r14
cmp qword [rcx + 0xa0], 0
je 0x43e7f5
call fcn.00444320
call fcn.0043e440
mov eax, 1
call fcn.00444480
nop
call fcn.0043cc80
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x138]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43e854
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.004441a0
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov dword [rsp + 0x1c], ebx
call fcn.004392e0
lea rax, [0x00ae4db9]
mov ebx, 0x2b
call fcn.00439be0
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.004398e0
lea rax, [0x00adfc2d]
mov ebx, 0x24
call fcn.00439be0
call fcn.00439360
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x138]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
nop
call fcn.004392e0
lea rax, [0x00acda38]
mov ebx, 0x10
call fcn.00439be0
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00439b60
lea rax, [0x00ac86b1]
mov ebx, 7
call fcn.00439be0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004399e0
lea rax, [0x00acf375]
mov ebx, 0x13
call fcn.00439be0
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.004392e0
lea rax, [0x00acda08]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.00439b60
lea rax, [0x00ac86b1]
mov ebx, 7
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x20]
call fcn.004399e0
lea rax, [0x00acf362]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00439be0
mov eax, dword [rsp + 0x18]
mov eax, eax
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00ad62eb]
mov ebx, 0x19
call fcn.00437b60
lea rax, [0x00addeae]
mov ebx, 0x21
call fcn.00437b60
nop
nop dword [rax]
call fcn.00463480
jmp fcn.0043e7a0
Function at 0x43eac0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43eb97
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp dword [0x01147ec0], 0
nop
je 0x43eb85
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
je 0x43eb10
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x01147e1c]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43eb74
call fcn.00444320
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x01147dd8]
call fcn.0040c5e0
mov rax, qword [rsp + 0x10]
mov dword [rax + 4], 3
mov eax, dword [0x01147ec4]
lea ecx, [rax - 1]
mov dword [0x01147ec4], ecx
cmp eax, 1
jne 0x43eb54
lea rax, [0x01147ec8]
call fcn.0040c8e0
nop
nop
lea rax, [0x01147dd8]
nop dword [rax]
call fcn.0040c800
call fcn.0043e060
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00ad91fd]
mov ebx, 0x1c
call fcn.00437b60
lea rax, [0x00ad8123]
mov ebx, 0x1b
call fcn.00437b60
nop
call fcn.00463480
nop dword [rax]
jmp fcn.0043eac0