joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4877e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4878a9
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx esi, byte [rax + 0x17]
and esi, 0x1f
nop
cmp rsi, 0x13
jne 0x487876
movzx esi, byte [rax + 0x14]
test sil, 1
je 0x487817
mov ecx, 0x48
jmp 0x48781c
mov ecx, 0x38
movzx edx, word [rax + 0x30]
test dx, dx
jne 0x48782b
xor edx, edx
xor esi, esi
jmp 0x487838
lea rsi, [rax + rcx]
cmp rdx, 0x100000
ja 0x48786c
cmp rbx, rdx
jae 0x487861
mov rcx, qword [rsi + rbx*8]
test rcx, rcx
je 0x48784f
lea rax, [0x00dd54b0]
jmp 0x487853
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov rax, rbx
mov rcx, rdx
call fcn.00465b60
mov ebx, 0x100000
call fcn.00465c60
call fcn.004861e0
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00ace305]
call fcn.0044eaa0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004877e0

Function at 0x4878e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48795c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x15
jne 0x487929
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x487918
lea rax, [0x00dd54b0]
jmp 0x48791c
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004861e0
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00ace322]
call fcn.0044eaa0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004878e0

Function at 0x487980
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4879e7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x11
jne 0x4879b4
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004861e0
mov ecx, 0x1f
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00ad0025]
call fcn.0044eaa0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00487980

Function at 0x487a80
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487ae7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x13
jne 0x487ab4
movzx eax, word [rax + 0x30]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004861e0
mov ecx, 0x20
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00ad0a8e]
call fcn.0044eaa0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00487a80
Function at 0x487b00
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487b95
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx edx, byte [rax + 0x17]
and edx, 0x1f
nop
cmp rdx, 0x13
jne 0x487b60
movzx edx, word [rax + 0x32]
and edx, 0x7fff
test dx, dx
jne 0x487b39
xor ecx, ecx
jmp 0x487b4a
movzx eax, word [rax + 0x30]
add edx, eax
movzx ecx, dx
cmp rax, rcx
ja 0x487b57
sub rcx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00465ce0
nop dword [rax]
call fcn.004861e0
mov ecx, 0x21
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00ad1898]
call fcn.0044eaa0
nop
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00487b00

Function at 0x487bc0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487cad
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx edx, byte [rax + 0x17]
and edx, 0x1f
nop
cmp rdx, 0x13
jne 0x487c7a
movzx edx, byte [rax + 0x14]
test dl, 1
je 0x487bfa
mov ecx, 0x48
jmp 0x487bff
mov ecx, 0x38
movzx edx, word [rax + 0x32]
and edx, 0x7fff
test dx, dx
jne 0x487c14
xor edx, edx
xor esi, esi
jmp 0x487c40
movzx esi, word [rax + 0x30]
add edx, esi
lea rdi, [rax + rcx]
movzx ecx, dx
cmp rsi, rcx
ja 0x487c73
sub rcx, rsi
mov rdx, rcx
neg rcx
shl rsi, 3
sar rcx, 0x3f
and rsi, rcx
add rsi, rdi
nop dword [rax]
cmp rbx, rdx
jae 0x487c68
mov rcx, qword [rsi + rbx*8]
test rcx, rcx
je 0x487c57
lea rax, [0x00dd54b0]
jmp 0x487c5b
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rbx
mov rcx, rdx
call fcn.00465b60
mov eax, esi
call fcn.00465ce0
call fcn.004861e0
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00acf115]
call fcn.0044eaa0
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00487bc0

Function at 0x489720
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4897cc
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
test rbx, rbx
je 0x4897b8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x40], rbx
mov rdx, qword [rbx + 0x98]
mov rax, rcx
call rdx
cmp rax, 0x14
jne 0x4897a5
mov rax, qword [rsp + 0x40]
lea rdx, [0x00dd54b0]
cmp rax, rdx
jne 0x489792
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
call fcn.004899c0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rbx, [0x00aaeb40]
lea rcx, [0x00a9e6e0]
call fcn.0040b940
lea rax, [0x009e4c00]
lea rbx, [0x00db5420]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5410]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00489720
Function at 0x48df00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48dfd4
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test rax, rax
je 0x48df74
nop dword [rax]
test rax, 0x60
jne 0x48df32
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0048dea0
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x00ad87e2]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x00abe0c6]
call fcn.0044eb40
nop dword [rax]
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
call fcn.004373c0
call fcn.0048dea0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x00a4e0e0]
call fcn.0040e6a0
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x011546d0], 0
nop
jne 0x48dfc5
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00a093a0]
nop dword [rax]
call fcn.004373c0
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.004657c0
jmp 0x48dfaa
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0048df00

Function at 0x48e000
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48e127
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
nop dword [rax + rax]
test rax, rax
je 0x48e0c5
test rax, 0x60
jne 0x48e085
bt eax, 8
jae 0x48e041
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0048dea0
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x00aca5b4]
mov r9d, 0x1a
xor eax, eax
lea rbx, [0x00abe0c6]
call fcn.0044eb40
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
nop dword [rax + rax]
call fcn.004373c0
call fcn.0048dea0
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x00ad87e2]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x00abe0c6]
call fcn.0044eb40
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
nop
call fcn.004373c0
call fcn.0048dea0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x00a4e0e0]
nop dword [rax + rax]
call fcn.0040e6a0
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x011546d0], 0
jne 0x48e116
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00a093a0]
call fcn.004373c0
mov rdi, rax
mov rcx, qword [rsp + 0x40]
nop
call fcn.004657c0
jmp 0x48e0ff
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0048e000

Function at 0x48e140
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48e1a6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
bt ecx, 8
jae 0x48e18f
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rbx
call fcn.00489440
mov rcx, qword [rsp + 0x10]
and rcx, 0x60
or rcx, 0x16
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db54e0]
nop dword [rax]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0048e140
Function at 0x48e2c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48e396
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
and rcx, 0x1f
cmp rcx, 0x17
jne 0x48e335
mov qword [rsp + 0x28], rbx
call fcn.00487040
mov rcx, qword [rax + 0x98]
mov rax, rbx
call rcx
cmp rax, 8
jne 0x48e322
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db54f0]
call fcn.004373c0
mov qword [rsp + 0x18], rcx
call fcn.0048de40
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rbx
lea rax, [0x00a4e0e0]
call fcn.0040e6a0
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x011546d0], 0
jne 0x48e387
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00a093a0]
call fcn.004373c0
mov rdi, rax
mov rcx, qword [rsp + 0x20]
call fcn.004657c0
jmp 0x48e36f
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0048e2c0
Function at 0x492540
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492613
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and rcx, 0x1f
cmp rcx, 0x11
je 0x4925b5
cmp rcx, 0x12
jne 0x4925a1
cmp qword [rax], 8
jne 0x4925ff
cmp qword [rax + 8], 0
je 0x4925ff
bt edx, 7
jae 0x49258f
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045e600
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
jne 0x4925c4
mov rax, qword [rbx + 0x10]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00487980
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rcx
lea rax, [0x00a4e0e0]
call fcn.0040e6a0
mov qword [rax + 8], 0x11
lea rcx, [0x00ac2c75]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00a093a0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5270]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00492540

Function at 0x492a00
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492af0
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and rcx, 0x1f
cmp rcx, 0x19
jne 0x492ab4
mov rsi, qword [rax + 0x38]
cmp qword [rax + 0x40], rdi
jbe 0x492aa1
lea rdi, [rdi + rdi*2]
mov rax, qword [rsi + rdi*8 + 8]
mov r8, qword [rsi + rdi*8]
and rdx, 0x1a0
movzx r9d, byte [rax + 0x17]
and r9d, 0x1f
or rdx, r9
movzx r8d, byte [r8]
test r8b, 1
jne 0x492a86
mov r8, rdx
or rdx, 0x40
or r8, 0x20
mov r9, qword [rsi + rdi*8 + 0x10]
test r9, 1
cmovne r8, rdx
nop
mov rdx, r8
nop
nop
mov rsi, qword [rsi + rdi*8 + 0x10]
shr rsi, 1
add rbx, rsi
mov rcx, rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db5640]
call fcn.004373c0
mov qword [rsp + 0x10], rcx
lea rax, [0x00a4e0e0]
call fcn.0040e6a0
mov qword [rax + 8], 0x13
lea rcx, [0x00ac4584]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00a093a0]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00492a00
Function at 0x4932c0
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49344c
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and rcx, 0x1f
cmp rcx, 0x11
jne 0x493340
cmp qword [rax + 0x40], rdi
jbe 0x493438
mov rax, qword [rax + 0x30]
test rdx, 0x60
mov ecx, 0
mov esi, 0x20
cmovne rcx, rsi
mov rsi, qword [rax]
imul rdi, rsi
nop
and rdx, 0x180
or rcx, rdx
movzx edx, byte [rax + 0x17]
and edx, 0x1f
or rcx, rdx
add rbx, rdi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
jne 0x493391
cmp qword [rbx + 8], rdi
jbe 0x493425
mov rax, qword [rax + 0x30]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
mov rdx, qword [rax]
movzx esi, byte [rax + 0x17]
and esi, 0x1f
or rcx, rsi
or rcx, 0x180
imul rdi, rdx
add rdi, qword [rbx]
mov rbx, rdi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x18
jne 0x4933e5
cmp qword [rbx + 8], rdi
jbe 0x4933d2
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
mov rdx, qword [rbx]
or rcx, 0x88
mov rax, qword [0x010fc500]
nop
lea rbx, [rdx + rdi]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db5670]
call fcn.004373c0
mov qword [rsp + 0x10], rcx
lea rax, [0x00a4e0e0]
call fcn.0040e6a0
mov qword [rax + 8], 0x13
lea rcx, [0x00ac45aa]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00a093a0]
nop dword [rax + rax]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db53d0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5660]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004932c0
Function at 0x493680
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49378f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
test rcx, rcx
je 0x493759
test dil, dil
je 0x4936bd
test rcx, 0x60
jne 0x493746
bt ecx, 9
jae 0x4936dd
mov rdi, rbx
mov rsi, rcx
mov ebx, 9
mov rcx, rax
lea rax, [0x00abdd54]
call fcn.00485560
mov rdx, rcx
and rcx, 0x1f
cmp rcx, 0x14
jne 0x493734
mov qword [rsp + 0x28], rbx
mov rcx, rdx
call fcn.00494a80
test rax, rax
je 0x49371e
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
mov rbx, qword [rcx + 8]
test rdx, rdx
je 0x493711
mov rdx, qword [rdx + 8]
mov rax, rdx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rcx, rdx
call fcn.0048dc20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db5680]
call fcn.004373c0
lea rax, [0x00a4e0e0]
call fcn.0040e6a0
mov qword [rax + 8], 0x17
lea rcx, [0x00ac8475]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00a093a0]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp fcn.00493680

Function at 0x493dc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493f06
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and rcx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x493e48
cmp rcx, 0x11
je 0x493e3a
nop word [rax + rax]
cmp rcx, 0x12
jne 0x493ea8
cmp qword [rax], 8
jne 0x493ef1
cmp qword [rax + 8], 0
je 0x493ef1
bt edx, 7
jae 0x493e28
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045e5c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x15
jne 0x493e80
cmp qword [rax], 8
jne 0x493ede
cmp qword [rax + 8], 0
je 0x493ede
bt edx, 7
jae 0x493e68
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045ec60
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
je 0x493e9a
cmp rcx, 0x18
jne 0x493ea8
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00a4e0e0]
call fcn.0040e6a0
mov qword [rax + 8], 0x11
lea rcx, [0x00ac2c97]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00a093a0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5270]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5270]
nop
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00493dc0
Function at 0x4943c0
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494489
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rax + 0x18]
nop dword [rax]
test rcx, rcx
je 0x494475
mov qword [rsp + 0x40], rax
mov rax, rcx
call fcn.0045ec20
test rax, rax
je 0x494462
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x28], rdx
mov rbx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rbx
mov rax, qword [rcx + 0x18]
movzx ecx, byte [rdx + 0x17]
mov byte [rsp + 0x1f], cl
call fcn.0045ec20
mov rcx, qword [rsp + 0x20]
test rcx, 0x60
mov ebx, 0
mov ecx, 0x20
cmovne rbx, rcx
movzx ecx, byte [rsp + 0x1f]
and ecx, 0x1f
or rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x28]
call fcn.004947c0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db56a0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5690]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004943c0

Function at 0x4944a0
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494569
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rax + 0x18]
nop dword [rax]
test rcx, rcx
je 0x494555
mov qword [rsp + 0x40], rax
mov rax, rcx
call fcn.0045ec20
test rax, rax
je 0x494542
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rdx, qword [rdx + 0x38]
mov qword [rsp + 0x28], rdx
mov rbx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rbx
mov rax, qword [rcx + 0x18]
movzx ecx, byte [rdx + 0x17]
mov byte [rsp + 0x1f], cl
call fcn.0045ec40
mov rcx, qword [rsp + 0x20]
test rcx, 0x60
mov ebx, 0
mov ecx, 0x20
cmovne rbx, rcx
movzx ecx, byte [rsp + 0x1f]
and ecx, 0x1f
or rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x28]
call fcn.004947c0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db56c0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db56b0]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.004944a0
Function at 0x494580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49465e
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x4945fe
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov rsi, qword [rax + 0x10]
cmp qword [rcx], 8
jne 0x49464a
cmp qword [rcx + 8], 0
je 0x49464a
bt esi, 7
jae 0x4945cf
mov rdx, qword [rdx]
mov rax, rcx
mov rbx, rdx
call fcn.0045eb60
cmp dword [0x011546d0], 0
jne 0x4945ee
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x18], rax
jmp 0x49461e
mov rcx, qword [rsp + 0x20]
lea rdi, [rcx + 0x18]
call fcn.004656c0
jmp 0x49461e
mov rax, rcx
call fcn.0045ec20
test rax, rax
je 0x494637
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x18]
call fcn.0045ebe0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x18]
call fcn.0045ec20
test rax, rax
setne al
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db56d0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db5270]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00494580
Function at 0x494880
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494a3d
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rax, rax
je 0x494a07
bt ecx, 9
jb 0x4949f4
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rbx
call fcn.00486440
mov rcx, qword [rsp + 0x50]
cmp rax, rcx
jbe 0x4949f4
mov rax, qword [rsp + 0x20]
movzx edx, byte [rax + 0x17]
and edx, 0x1f
cmp rdx, 0x14
jne 0x49496a
nop
mov rdx, qword [rsp + 0x10]
mov rsi, rdx
and rdx, 0x1f
mov qword [rsp + 0x10], rdx
cmp rdx, 0x14
ja 0x494920
lea rdi, [rdx - 0x12]
cmp rdi, 1
jbe 0x494946
cmp rdx, 0x14
je 0x49492c
jmp 0x4949be
cmp rdx, 0x16
jbe 0x494946
cmp rdx, 0x17
jne 0x494940
mov rbx, qword [rsp + 0x18]
cmp qword [rbx], 0
sete dl
jmp 0x494964
cmp rdx, 0x1a
jne 0x4949be
bt esi, 7
jae 0x494956
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rbx]
jmp 0x49495e
mov rbx, qword [rsp + 0x18]
mov rdx, rbx
test rdx, rdx
sete dl
test dl, dl
je 0x494974
jmp 0x4949ab
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
test rsi, 0x60
mov edx, 0
mov edi, 0x20
cmovne rdx, rdi
and rsi, 0x80
or rsi, rdx
shl rcx, 0xa
or rcx, rsi
or rcx, 0x213
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db56e0]
call fcn.004373c0
lea rax, [0x00a4e0e0]
call fcn.0040e6a0
mov qword [rax + 8], 0x13
lea rcx, [0x00ac45bd]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00a093a0]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db53f0]
call fcn.004373c0
lea rax, [0x00a4e0e0]
call fcn.0040e6a0
mov qword [rax + 8], 0x14
lea rcx, [0x00ac561a]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x00a093a0]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00494880