joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140215f10
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c5ffa
sub rsp, rax
mov rax, qword [0x1402b6380]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402bb200]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140216102
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140216056
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140216056
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14021603b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140215fd8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1402160c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140216121
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1402160fd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140216121
jmp 0x140215fae
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c79f4
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1402161d0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c5ffa
sub rsp, rax
mov rax, qword [0x1402b6380]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402bb200]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1402163dd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140216329
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140216329
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140216309
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140216298
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14021639d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1402163fc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1402163d8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1402163fc
jmp 0x14021626e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c79f4
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x4044a0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40453b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
test rax, rax
je 0x4044f9
mov rax, qword [rax + 8]
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x404508
movzx esi, byte [rax + 0x17]
test sil, 0x20
je 0x4044e4
cmp rbx, rcx
sete al
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rsi, qword [rdx]
mov rax, rbx
mov rbx, rcx
call rsi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, 1
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0045af40
mov ecx, 0x1c
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00acd053]
call fcn.0044eaa0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x00a11960]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.004044a0
Function at 0x404840
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], r14
mov rdx, qword [r14 + 0x30]
mov rsi, r14
cmp qword [rdx + 0x90], rsi
je 0x4048aa
nop
call fcn.004392e0
lea rax, [0x00acf18d]
mov ebx, 0x1e
call fcn.00439be0
call fcn.00439360
mov eax, 2
call fcn.00432c80
mov rsi, qword [rsp + 0x60]
mov rax, qword [r14 + 0x30]
nop
inc dword [rax + 0x244]
mov rax, qword [r14 + 0x30]
nop
mov rcx, r14
mov qword [rax + 0x138], rcx
mov rax, qword [r14 + 0x30]
mov qword [r14 + 0xe8], rax
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rax + 0x2e0]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x2f0]
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [rax + 0x300]
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rsi + 0x70]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsi + 0x78]
mov qword [rsp + 0x18], rdx
call fcn.0045fda0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0x350], edx
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x78]
call fcn.00404a20
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 1
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x68]
nop
cmp rcx, rdx
jne 0x404a07
mov qword [rsp + 0x70], rcx
nop
jmp 0x4049a3
nop
lea rax, [0x00c28268]
mov qword [rsp], rax
nop dword [rax]
call fcn.00463300
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
xor eax, eax
mov esi, 1
lock cmpxchg dword [rcx + 0x350], esi
sete dil
test dil, dil
je 0x404971
mov rbx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x18]
call fcn.00441560
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x30]
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx + 0x2e0], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rcx + 0x2f0], xmm0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rcx + 0x300], xmm0
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x00ad55c5]
mov ebx, 0x26
call fcn.00437b60
nop
int3
Function at 0x404ec0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40503d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
cmp dword [0x01154960], 0
je 0x405021
mov rdx, qword [rsp + 0x48]
nop
test rcx, rcx
je 0x404fe1
movzx r9d, byte [rdx + 0x17]
mov r10d, r9d
and r9d, 0x1f
cmp r9b, 0x16
je 0x404f2a
nop dword [rax + rax]
cmp r9b, 0x1a
jne 0x404fe1
test r10b, 0x20
jne 0x404f33
mov rbx, qword [rbx]
test rbx, rbx
je 0x404fd7
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rbx
mov rax, rbx
call fcn.004058e0
test al, al
je 0x404fd7
mov rdx, qword [rsp + 0x58]
movzx r9d, byte [rdx + 0x17]
and r9d, 0x1f
cmp r9b, 1
jne 0x404fb6
mov rdx, qword [rsp + 0x28]
movzx r9d, byte [rdx + 0x17]
and r9d, 0x1f
cmp r9b, 0x1a
jne 0x404f8a
mov eax, 1
lea rcx, [rsp + 0x48]
jmp 0x404feb
mov rax, qword [rdx + 0x30]
mov rbx, qword [rsp + 0x30]
mov ecx, 1
xor edi, edi
lea rsi, [0x00ad722f]
mov r8d, 0x29
call fcn.00405080
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp r9b, 0x11
jne 0x404fc5
xor eax, eax
lea rcx, [rsp + 0x58]
jmp 0x404feb
cmp r9b, 0x17
jne 0x40502b
mov eax, 1
lea rcx, [rsp + 0x58]
jmp 0x404feb
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, 1
lea rcx, [rsp + 0x48]
movzx r9d, byte [rdx + 0x17]
test r9b, 0x20
sete r9b
mov rbx, qword [rcx + 8]
mov ecx, r9d
mov edi, eax
lea rsi, [0x00ad722f]
mov r8d, 0x29
mov rax, rdx
call fcn.00405080
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00abf88e]
mov ebx, 0xc
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00404ec0
Function at 0x406100
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, rcx
shr rcx, 6
mov rsi, rcx
shl rcx, 6
nop
nop
sub rdx, rcx
add rdi, rdx
mov qword [rsp + 0x28], rdi
add rbx, rsi
add rcx, rax
mov qword [rsp + 0x30], rcx
xor eax, eax
xor esi, esi
jmp 0x406140
add rax, 8
nop
cmp rax, rdi
jae 0x4061aa
test rax, 0x3f
jne 0x406155
movzx esi, byte [rbx]
inc rbx
jmp 0x406157
shr esi, 1
test rdx, rdx
jbe 0x406162
add rdx, 0xfffffffffffffff8
jmp 0x40613a
bt esi, 0
jae 0x40613a
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x14], esi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rcx + rax]
mov rax, rdx
call fcn.004058e0
test al, al
jne 0x4061b4
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
mov esi, dword [rsp + 0x14]
mov rdi, qword [rsp + 0x28]
jmp 0x40613a
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00ad3995]
mov ebx, 0x24
call fcn.00437b60
nop
int3

Function at 0x406420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4065c8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx]
nop
cmp rsi, 0x10000
jae 0x4065b6
cmp byte [rdx + 0x15], 8
ja 0x4065a5
mov qword [rsp + 0x20], rdx
mov rax, rbx
mul rsi
jo 0x406591
movabs rdx, 0xffffffffffa0
cmp rax, rdx
ja 0x406591
nop dword [rax + rax]
test rbx, rbx
jl 0x406591
mov qword [rsp + 0x48], rbx
test rax, rax
je 0x40652c
mov rdx, qword [rsp + 0x20]
cmp qword [rdx + 8], 0
jne 0x4064d9
add rax, 0x60
xor ebx, ebx
mov ecx, 1
call fcn.0040dcc0
test byte [rax], al
lea rdx, [rax + 0x60]
cmp dword [0x011546d0], 0
jne 0x4064cb
mov qword [rax + 0x10], rdx
jmp 0x40655a
lea rdi, [rax + 0x10]
call fcn.004657e0
jmp 0x40655a
mov qword [rsp + 0x18], rax
lea rax, [0x00a9fea0]
call fcn.0040e6a0
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x20]
mov ecx, 1
mov rax, qword [rsp + 0x18]
nop
call fcn.0040dcc0
cmp dword [0x011546d0], 0
jne 0x406519
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
jmp 0x406527
mov rcx, qword [rsp + 0x28]
lea rdi, [rcx + 0x10]
call fcn.004656c0
mov rax, rcx
jmp 0x40655a
mov eax, 0x60
xor ebx, ebx
mov ecx, 1
call fcn.0040dcc0
test byte [rax], al
lea rdi, [rax + 0x10]
cmp dword [0x011546d0], 0
jne 0x406552
mov qword [rax + 0x10], rdi
jmp 0x40655a
mov rcx, rdi
call fcn.004657c0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
mov word [rax + 0x18], dx
cmp dword [0x011546d0], 0
jne 0x406575
mov qword [rax + 0x20], rcx
jmp 0x40657e
lea rdi, [rax + 0x20]
call fcn.004657c0
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00a11ae0]
lea rbx, [0x00db5830]
nop
call fcn.004373c0
lea rax, [0x00ac82d7]
mov ebx, 0x17
call fcn.00437b60
lea rax, [0x00ad55eb]
mov ebx, 0x26
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00406420
Function at 0x40b220
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40b346
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, qword [r14 + 0x30]
cmp dword [rdx + 0xc0], 0
jne 0x40b330
mov rdx, qword [0x00976ea8]
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
mov r8, rdi
shr rdi, 2
lea rdi, [rdi + rdi*2]
cmp rsi, rdi
jb 0x40b30a
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x28], rax
lea rax, [r8 + r8]
lea rax, [rax + 2]
shl rax, 3
xor ebx, ebx
mov ecx, 1
call fcn.0040dcc0
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x18]
mov rsi, qword [rdx]
shl rsi, 1
mov qword [rax], rsi
movups xmmword [rsp + 0x30], xmm15
lea rsi, [0x00467540]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
nop dword [rax]
call fcn.0040c2c0
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x18]
cmp qword [rsi + 8], rdx
jne 0x40b31f
nop
cmp byte [0x011546d0], 0
je 0x40b2f4
lea rax, [0x00976ea8]
call fcn.00404640
mov rbx, qword [rsp + 0x20]
lea rcx, [0x00976ea8]
xchg qword [rcx], rbx
mov rdx, qword [0x00976ea8]
mov rax, qword [rsp + 0x28]
mov rbx, rax
mov rax, rdx
call fcn.0040b360
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00ad6127]
mov ebx, 0x27
call fcn.00437b60
lea rax, [0x00ac14c0]
mov ebx, 0xf
nop dword [rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0040b220

Function at 0x40c380
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c4a6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rbx + 8]
inc rcx
mov qword [rbx + 8], rcx
nop
mov rdx, rbx
shl rbx, 0x10
mov rsi, rcx
and rcx, 0x7ffff
or rbx, rcx
mov rcx, rbx
sar rbx, 0x13
shl rbx, 3
cmp rdx, rbx
je 0x40c3cd
jmp 0x40c3ef
mov rax, rsi
mov rbx, qword [rax]
mov qword [rdx], rbx
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rsi], rcx
sete bl
test bl, bl
je 0x40c3ca
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x20], rbx
call fcn.004392e0
lea rax, [0x00ad8d8e]
mov ebx, 0x2c
call fcn.00439be0
mov rax, qword [rsp + 0x28]
nop
call fcn.00439b60
lea rax, [0x00abc753]
mov ebx, 5
call fcn.00439be0
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00439a40
lea rax, [0x00abd4ca]
mov ebx, 8
call fcn.00439be0
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00439a40
lea rax, [0x00abdb0b]
mov ebx, 9
call fcn.00439be0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00439b60
call fcn.00439540
call fcn.00439360
lea rax, [0x00abf9f6]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0040c380
Function at 0x40c4e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c56c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, rax
shl rax, 0x10
or rax, 0x7ffff
sar rax, 0x13
shl rax, 3
cmp rcx, rax
jne 0x40c51c
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rcx
call fcn.004392e0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x10], rax
call fcn.004392e0
lea rax, [0x00acd4eb]
mov ebx, 0x1c
call fcn.00439be0
mov rax, qword [rsp + 0x10]
call fcn.00439a40
call fcn.00439540
call fcn.00439360
lea rax, [0x00ac34eb]
mov ebx, 0x12
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.0040c4e0

Function at 0x40c960
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40ca86
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [r14 + 0x30]
mov rdx, r14
nop
cmp qword [rcx], rdx
jne 0x40ca70
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x18], rdx
mov rax, rcx
call fcn.004335c0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x30]
lock cmpxchg qword [rbx], rdx
sete dl
test dl, dl
je 0x40c9e7
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x00976ea0]
cmp qword [rdx], 0
je 0x40c9d4
jmp 0x40ca66
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
call fcn.00433220
jmp 0x40ca08
cmp qword [rbx], 1
jne 0x40c9f7
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00ace21d]
mov ebx, 0x1d
call fcn.00437b60
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xe5], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x989680
call fcn.00433220
mov rcx, qword [0x00976ea0]
mov rcx, qword [rcx]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
call fcn.00465280
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rbx]
test rdx, rdx
je 0x40ca22
jmp 0x40ca08
lea rax, [0x00ac44c6]
mov ebx, 0x13
nop dword [rax]
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0040c960
Function at 0x40caa0
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
nop
test cl, cl
je 0x40cb31
mov qword [rsp + 0x28], r14
test rbx, rbx
jge 0x40cafb
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x00976ea0]
cmp qword [rcx], 0
jne 0x40cd1f
mov rax, 0xffffffffffffffff
call fcn.00433220
jmp 0x40ccd0
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x48], rbx
call fcn.00467460
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x48]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40cb5d
cmp qword [rdx], 1
jne 0x40cb46
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00acf043]
mov ebx, 0x1e
call fcn.00437b60
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x00976ea0]
cmp qword [rdx], 0
je 0x40cb8e
nop word [rax + rax]
cmp rbx, 0x989680
jle 0x40cb8e
mov ebx, 0x989680
mov rax, rbx
call fcn.00433220
test eax, eax
jge 0x40cc22
mov rax, qword [0x00976ea0]
mov rax, qword [rax]
test rax, rax
je 0x40cbd3
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00465280
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.00467460
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40cb57
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
nop
jmp 0x40cc41
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rsi, qword [rcx]
mov rdi, qword [rdx + 0x30]
mov r8, rdi
cmp rsi, rdi
jne 0x40cc71
mov rax, rsi
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
nop
test dil, dil
je 0x40cc41
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp rsi, 1
jne 0x40ccbf
mov byte [r8 + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.00433220
test eax, eax
jl 0x40ccae
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00adb856]
mov ebx, 0x32
call fcn.00437b60
lea rax, [0x00adb033]
mov ebx, 0x31
call fcn.00437b60
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [0x00976ea0]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00465280
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, 0x989680
call fcn.00433220
test eax, eax
jl 0x40ccef
jmp 0x40ccd0