joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c640
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c89b
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jg 0x43c889
mov qword [rsp + 0x40], r14
nop
nop
lea rax, [0x01100c38]
call fcn.0040c5e0
mov ecx, dword [0x0115415c]
mov dword [0x01100d24], ecx
mov ecx, 1
lea rdx, [0x01100d20]
xchg dword [rdx], ecx
call fcn.00444fc0
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0xa0]
mov dword [rcx + 4], 3
dec dword [0x01100d24]
mov rcx, qword [0x010fe0e0]
mov qword [rsp + 0x48], rcx
mov rdx, qword [0x010fe0e8]
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x43c6e0
lea rax, [rdi + 1]
nop dword [rax + rax]
cmp rax, rdx
jge 0x43c77a
mov rbx, qword [rcx + rax*8]
mov esi, dword [rbx + 4]
cmp esi, 2
jne 0x43c70c
mov rdi, rax
mov eax, esi
mov r8d, 3
lock cmpxchg dword [rbx + 4], r8d
sete sil
jmp 0x43c717
mov rdi, rax
mov r8d, 3
xor esi, esi
test sil, sil
je 0x43c6d4
cmp byte [0x011062f0], 0
je 0x43c75f
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rbx
mov rax, rbx
call fcn.00456da0
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00456600
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
mov r8d, 3
inc dword [rbx + 0x14]
dec dword [0x01100d24]
jmp 0x43c6d4
mov dword [rax + 4], 3
dec dword [0x01100d24]
call fcn.00445e60
nop
test rax, rax
jne 0x43c76d
nop
nop
mov ecx, dword [0x01100d24]
mov dword [rsp + 0x14], ecx
lea rax, [0x01100c38]
call fcn.0040c800
mov ecx, dword [rsp + 0x14]
test ecx, ecx
jle 0x43c7d0
jmp 0x43c7ac
call fcn.00444fc0
lea rax, [0x01100d28]
mov ebx, 0x186a0
call fcn.0040cd40
nop dword [rax]
test al, al
je 0x43c7a7
nop
mov qword [0x01100d28], 0
cmp dword [0x01100d24], 0
jne 0x43c7f2
mov rcx, qword [0x010fe0e0]
mov rdx, qword [0x010fe0e8]
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x43c879
mov eax, 0x29
lea rcx, [0x00ad75de]
mov edx, dword [0x01154148]
test edx, edx
je 0x43c840
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x38], rcx
nop
nop
lea rax, [0x01154400]
nop dword [rax + rax]
call fcn.0040c5e0
nop
nop
lea rax, [0x01154400]
call fcn.0040c5e0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x38]
nop dword [rax]
test rax, rax
jne 0x43c84f
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbx, rax
mov rax, rcx
call fcn.00437b60
mov rdi, qword [rcx + rax*8]
cmp dword [rdi + 4], 3
mov edi, 0x2e
cmovne rbx, rdi
lea r8, [0x00ad9c17]
cmovne rsi, r8
inc rax
cmp rax, rdx
jl 0x43c85a
mov rax, rbx
mov rcx, rsi
jmp 0x43c7fe
lea rax, [0x00acc58b]
mov ebx, 0x1b
call fcn.00437b60
nop
nop dword [rax + rax]
call fcn.00463440
jmp fcn.0043c640
Function at 0x43c8c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ca86
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x60], al
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x01154164]
test edx, edx
je 0x43c914
xor eax, eax
nop dword [rax]
call fcn.00430ec0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.0043ffa0
nop
nop
lea rax, [0x01100c38]
nop dword [rax]
call fcn.0040c5e0
mov ecx, dword [0x0115415c]
mov edx, dword [0x01154170]
test edx, edx
je 0x43c942
mov dword [0x01154170], 0
nop
jmp 0x43c944
mov edx, ecx
mov eax, edx
call fcn.00443960
mov qword [rsp + 0x40], rax
mov dword [0x01100d20], 0
cmp dword [0x01100d30], 0
je 0x43c979
mov dword [0x01100d30], 0
lea rax, [0x01100d38]
call fcn.0040c8e0
nop
nop
lea rax, [0x01100c38]
call fcn.0040c800
mov rcx, qword [rsp + 0x40]
jmp 0x43c993
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x43c9ef
mov rdx, qword [rcx + 8]
mov rsi, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rsi, rsi
je 0x43c9dc
nop
mov qword [rcx + 0x38], 0
cmp qword [rsi + 0xa8], 0
nop dword [rax + rax]
jne 0x43ca74
nop
mov qword [rsi + 0xa8], rcx
lea rax, [rsi + 0x120]
call fcn.0040c8e0
jmp 0x43c98e
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
call fcn.0043db00
jmp 0x43c98e
nop
call fcn.00467460
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x43ca34
nop
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.00455780
call fcn.0043e720
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43ca65
cmp byte [r14 + 0xb1], 0
je 0x43ca65
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x00ad4e19]
mov ebx, 0x25
call fcn.00437b60
nop
mov byte [rsp + 8], al
call fcn.00463440
movzx eax, byte [rsp + 8]
jmp fcn.0043c8c0
Function at 0x43db00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43dbf5
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043d320
mov rdx, qword [rsp + 0x38]
test rdx, rdx
setne byte [rax + 0x118]
nop
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43dbd4
mov rcx, qword [rdx + 0x30]
test rcx, rcx
je 0x43dbd4
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x240], 0
jne 0x43db6e
cmp byte [rcx + 0xe8], 0
je 0x43dbd4
nop
nop
lea rax, [0x01154840]
call fcn.0040c5e0
cmp dword [0x01154860], 0
je 0x43dbe3
mov rcx, qword [0x01154848]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x130], rcx
nop
mov qword [0x01154848], rdx
cmp byte [0x01154850], 0
je 0x43dbbc
mov byte [0x01154850], 0
lea rax, [0x01154858]
call fcn.0040c8e0
nop
nop
lea rax, [0x01154840]
call fcn.0040c800
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043dc20
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00ad7d07]
mov ebx, 0x2a
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043db00

Function at 0x43de20
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [r14 + 0x30]
mov ecx, dword [rcx + 0x288]
nop dword [rax + rax]
test ecx, ecx
je 0x43deda
mov qword [rsp + 0x18], r14
mov rcx, qword [r14 + 0x30]
test byte [rcx], al
lea rax, [rcx + 0x280]
nop
nop dword [rax + rax]
call fcn.0040c5e0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x290]
mov qword [rsp + 0x10], rdx
test rdx, rdx
je 0x43deaf
cmp dword [0x01154158], 0
jne 0x43dee6
mov rcx, qword [rdx]
xor eax, eax
call rcx
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rcx + 0x30]
mov qword [rbx + 0x290], 0
mov rbx, qword [rcx + 0x30]
xor esi, esi
xchg dword [rbx + 0x288], esi
mov rcx, qword [rcx + 0x30]
test byte [rcx], al
lea rax, [rcx + 0x280]
nop
nop dword [rax]
call fcn.0040c800
mov rcx, qword [rsp + 0x10]
test rcx, rcx
setne al
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00adb9b4]
mov ebx, 0x33
call fcn.00437b60
nop
int3
Function at 0x43e180
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43e40a
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], bl
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
nop
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rcx
nop
lea rax, [0x01100c38]
nop
call fcn.0040c5e0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x43e1e0
call fcn.00445e60
test rax, rax
je 0x43e2d2
mov rcx, rax
nop
mov rdx, qword [0x01100c40]
test rdx, rdx
je 0x43e204
mov rbx, qword [rdx + 0x130]
mov qword [0x01100c40], rbx
dec dword [0x01100c48]
test rdx, rdx
mov qword [rsp + 0x28], rcx
jne 0x43e285
call fcn.0043b480
mov qword [rsp + 0x18], rax
nop
nop
lea rax, [0x01100c38]
nop
call fcn.0040c800
movzx eax, byte [rsp + 0x50]
movzx eax, al
test rax, rax
mov eax, 0
lea rcx, [0x00c28160]
cmovne rax, rcx
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
call fcn.0043db00
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43e27b
cmp byte [r14 + 0xb1], 0
je 0x43e27b
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x30], rdx
nop
nop
lea rax, [0x01100c38]
call fcn.0040c800
mov rcx, qword [rsp + 0x30]
cmp byte [rcx + 0xe4], 0
jne 0x43e3f8
cmp qword [rcx + 0xa8], 0
jne 0x43e3e7
movzx edx, byte [rsp + 0x50]
nop dword [rax]
test dl, dl
je 0x43e2ce
mov rsi, qword [rsp + 0x28]
jmp 0x43e3a1
xor eax, eax
jmp 0x43e34b
nop
nop
lea rax, [0x01100c38]
nop dword [rax + rax]
call fcn.0040c800
movzx ecx, byte [rsp + 0x50]
test cl, cl
je 0x43e304
mov ecx, 0xffffffff
lea rdx, [0x01100c7c]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43e33a
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43e330
cmp byte [r14 + 0xb1], 0
je 0x43e330
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00acc570]
mov ebx, 0x1b
call fcn.00437b60
mov byte [rcx + 0xe4], al
mov rdx, qword [rsp + 0x28]
mov qword [rcx + 0xa8], rdx
lea rax, [rcx + 0x120]
call fcn.0040c8e0
nop
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43e397
cmp byte [r14 + 0xb1], 0
je 0x43e397
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov edi, dword [rsi + 0x5f0]
mov r8d, dword [rsi + 0x5f4]
mov r9, qword [rsi + 0xdf8]
mov r10d, dword [rsi + 0x5f4]
nop dword [rax]
cmp r10d, r8d
jne 0x43e3a1
cmp r8d, edi
jne 0x43e3d6
test r9, r9
jne 0x43e3d6
mov eax, edx
jmp 0x43e34b
lea rax, [0x00aca40b]
mov ebx, 0x19
call fcn.00437b60
lea rax, [0x00ac1619]
mov ebx, 0xf
call fcn.00437b60
lea rax, [0x00ac6629]
mov ebx, 0x15
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00463440
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0043e180
Function at 0x43e7a0
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43e9dd
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x138]
test rdx, rdx
je 0x43e9cb
mov rdx, qword [rdx + 0xe8]
cmp rdx, rcx
jne 0x43e9cb
mov qword [rsp + 0x28], r14
cmp qword [rcx + 0xa0], 0
je 0x43e7f5
call fcn.00444320
call fcn.0043e440
mov eax, 1
call fcn.00444480
nop
call fcn.0043cc80
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x138]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43e854
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.004441a0
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov dword [rsp + 0x1c], ebx
call fcn.004392e0
lea rax, [0x00ad865f]
mov ebx, 0x2b
call fcn.00439be0
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.004398e0
lea rax, [0x00ad3779]
mov ebx, 0x24
call fcn.00439be0
call fcn.00439360
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x138]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
nop
call fcn.004392e0
lea rax, [0x00ac21e1]
mov ebx, 0x10
call fcn.00439be0
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00439b60
lea rax, [0x00abcfa9]
mov ebx, 7
call fcn.00439be0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004399e0
lea rax, [0x00ac39dd]
mov ebx, 0x13
call fcn.00439be0
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.004392e0
lea rax, [0x00ac21b1]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x30]
call fcn.00439b60
lea rax, [0x00abcfa9]
mov ebx, 7
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x20]
call fcn.004399e0
lea rax, [0x00ac39ca]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00439be0
mov eax, dword [rsp + 0x18]
mov eax, eax
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00aca424]
mov ebx, 0x19
call fcn.00437b60
lea rax, [0x00ad1ac9]
mov ebx, 0x21
call fcn.00437b60
nop
nop dword [rax]
call fcn.00463440
jmp fcn.0043e7a0
Function at 0x43eac0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43eb97
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp dword [0x01100d20], 0
nop
je 0x43eb85
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
je 0x43eb10
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x01100c7c]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43eb74
call fcn.00444320
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x01100c38]
call fcn.0040c5e0
mov rax, qword [rsp + 0x10]
mov dword [rax + 4], 3
mov eax, dword [0x01100d24]
lea ecx, [rax - 1]
mov dword [0x01100d24], ecx
cmp eax, 1
jne 0x43eb54
lea rax, [0x01100d28]
call fcn.0040c8e0
nop
nop
lea rax, [0x01100c38]
nop dword [rax]
call fcn.0040c800
call fcn.0043e060
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00acd16b]
mov ebx, 0x1c
call fcn.00437b60
lea rax, [0x00acc16e]
mov ebx, 0x1b
call fcn.00437b60
nop
call fcn.00463440
nop dword [rax]
jmp fcn.0043eac0
Function at 0x43ff20
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ff97
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
nop
je 0x43ff85
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x01100c7c]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43ff6f
nop
call fcn.0043e720
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00ad1604]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00437b60
lea rax, [0x00ad0063]
mov ebx, 0x1f
call fcn.00437b60
nop
call fcn.00463440
jmp fcn.0043ff20
Function at 0x440e60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4410cc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
cmp byte [0x011062f0], 0
je 0x440e97
mov eax, 0x14
xor ebx, ebx
call fcn.00456b20
mov rax, qword [rsp + 0x48]
nop
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
jne 0x440fa5
mov byte [rax + 0xb0], 0x19
cmp byte [rax + 0xb4], 0
je 0x440ede
mov rcx, qword [rax + 0x40]
mov rax, rcx
call fcn.004514e0
test rax, rax
je 0x440f8f
movzx edx, byte [rax + 0x29]
test dl, 2
jne 0x440f34
mov rax, qword [rsp + 0x48]
mov ebx, 2
mov ecx, 0x1009
call fcn.0043c240
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop
nop
xor esi, esi
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
nop
xor esi, esi
mov qword [rdx + 0x90], rsi
mov rax, qword [rsp + 0x48]
mov ebx, 0x1009
mov ecx, 9
nop dword [rax]
call fcn.0043b980
call fcn.004402c0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00451bc0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.004392e0
lea rax, [0x00ad4daa]
mov ebx, 0x25
call fcn.00439be0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
call fcn.00439be0
lea rax, [0x00ac2e97]
mov ebx, 0x12
call fcn.00439be0
call fcn.00439360
lea rax, [0x00ac1574]
mov ebx, 0xf
call fcn.00437b60
lea rax, [0x00ac64d9]
mov ebx, 0x15
nop dword [rax + rax]
call fcn.00437b60
nop
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.004392e0
lea rax, [0x00ac21e1]
mov ebx, 0x10
call fcn.00439be0
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.00439b60
lea rax, [0x00abcfa9]
mov ebx, 7
call fcn.00439be0
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.004399e0
lea rax, [0x00ac39dd]
mov ebx, 0x13
call fcn.00439be0
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.004398e0
call fcn.00439540
call fcn.00439360
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x10], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.004392e0
lea rax, [0x00ac21b1]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x28]
call fcn.00439b60
lea rax, [0x00abcfa9]
mov ebx, 7
nop dword [rax + rax]
call fcn.00439be0
mov rax, qword [rsp + 0x18]
call fcn.004399e0
lea rax, [0x00ac39ca]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00439be0
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.004398e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00abf846]
mov ebx, 0xc
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00467b60
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.00440e60
Function at 0x4414e0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
mov rdx, r14
cmp qword [rcx], rdx
je 0x441534
nop word [rax + rax]
cmp qword [rcx + 0x50], rdx
je 0x441534
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x38], rbx
mov qword [rdx + 0x60], 0
mov qword [rdx + 0x58], 0
cmp qword [rdx + 0x50], 0
je 0x44152a
call fcn.0043ae00
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x00acd53f]
mov ebx, 0x1c
call fcn.00437b60
nop
int3
Function at 0x4444e0
Capabilities:
Get geographical location
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4447ad
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp byte [0x0115410b], 0
nop
jne 0x44450b
cmp byte [0x0115410a], 0
je 0x444515
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp dword [0x01154174], 0
nop dword [rax]
ja 0x444610
cmp byte [0x0092c043], 0
jne 0x444538
cmp byte [0x01154103], 0
jne 0x44453c
xor ecx, ecx
jmp 0x44455e
mov eax, 1
call fcn.0043da00
nop
cmp dword [0x0115413c], 0
lea rcx, [0x01154410]
xchg qword [rcx], rax
seta cl
movzx ecx, cl
mov edx, dword [0x01100c48]
mov rbx, qword [0x01100c50]
sub rbx, qword [0x01100c60]
mov rsi, rbx
sub ebx, edx
mov edi, dword [0x01100c4c]
sub ebx, edi
mov r8d, dword [0x01100c5c]
sub ebx, r8d
cmp ecx, ebx
jge 0x444597
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test ebx, ebx
jl 0x444705
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004447c0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x30]
call fcn.0043af80
cmp qword [rsp + 0x20], 0
je 0x4446e5
cmp qword [0x01154418], 0
je 0x4445fe
call fcn.004550e0
test rbx, rbx
je 0x4445fe
mov qword [0x01154418], rax
lea rax, [0x01100c70]
jmp 0x444672
mov rcx, qword [0x010fe0e0]
mov rdx, qword [0x010fe0e8]
xor eax, eax
jmp 0x444620
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
inc rax
nop dword [rax]
cmp rax, rdx
jge 0x44463f
mov rbx, qword [rcx + rax*8]
test byte [rbx], al
cmp qword [rbx + 0x26e8], 0
jle 0x44461a
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [r14 + 0x30]
mov dword [rcx + 0xc4], 0xffffffff
nop
nop
lea rax, [0x01100c38]
call fcn.0040c800
lea rax, [0x00ad492f]
mov ebx, 0x25
call fcn.00437b60
test byte [rcx], al
lea rax, [rcx + 8]
mov rcx, qword [rax]
test rcx, rcx
je 0x444686
cmp rbx, rcx
jne 0x44466c
mov rcx, qword [rbx + 8]
mov qword [rax], rcx
nop
mov rcx, qword [0x01100c40]
test rcx, rcx
je 0x4446aa
mov rdx, qword [rcx + 0x130]
mov qword [0x01100c40], rdx
dec dword [0x01100c48]
test rcx, rcx
je 0x4446cf
nop
mov qword [rcx + 0xa8], rbx
lea rax, [rcx + 0x120]
nop dword [rax + rax]
call fcn.0040c8e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00aca055]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437b60
nop
nop
lea rax, [0x01100c38]
call fcn.0040c800
lea rax, [0x00adc97b]
mov ebx, 0x36
nop
call fcn.00437b60
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x14], r8d
call fcn.004392e0
lea rax, [0x00acc498]
mov ebx, 0x1b
call fcn.00439be0
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.004399e0
lea rax, [0x00ac045e]
mov ebx, 0xe
call fcn.00439be0
mov eax, dword [rsp + 0x18]
movsxd rax, eax
call fcn.004399e0
lea rax, [0x00abd4a2]
mov ebx, 8
call fcn.00439be0
mov rax, qword [rsp + 0x28]
movsxd rax, eax
call fcn.004399e0
lea rax, [0x00abcf71]
mov ebx, 7
call fcn.00439be0
mov eax, dword [rsp + 0x14]
movsxd rax, eax
call fcn.004399e0
call fcn.00439540
call fcn.00439360
lea rax, [0x00acee09]
mov ebx, 0x1e
call fcn.00437b60
nop
call fcn.00463440
jmp fcn.004444e0
Function at 0x445d40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x445e3c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov ecx, dword [rax + 0x5f0]
mov edx, dword [rax + 0x5f4]
mov rsi, qword [rax + 0xdf8]
mov edi, dword [rax + 0x5f4]
cmp edi, edx
jne 0x445d58
cmp edx, ecx
jne 0x445e2a
nop dword [rax]
test rsi, rsi
jne 0x445e2a
mov qword [rsp + 0x20], rax
call fcn.00445c40
mov rcx, qword [0x010fe148]
mov rdx, qword [0x010fe140]
mov rbx, qword [rsp + 0x20]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
nop dword [rax]
test edi, edi
jl 0x445e25
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
nop dword [rax]
cmp rax, rsi
jbe 0x445e1a
lea rax, [rdx + rsi*4]
lock or dword [rax], r9d
mov rax, qword [0x01100c70]
mov qword [rbx + 8], rax
nop
mov qword [0x01100c70], rbx
mov eax, 1
lea rcx, [0x01100c78]
lock xadd dword [rcx], eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov rax, rsi
call fcn.00465b60
call fcn.004353c0
lea rax, [0x00ad342f]
mov ebx, 0x23
call fcn.00437b60
nop
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.00445d40
Function at 0x446080
Capabilities:
Get geographical location

Disassembly:
lea r12, [rsp - 0x3b8]
cmp r12, qword [r14 + 0x10]
jbe 0x446237
sub rsp, 0x438
mov qword [rsp + 0x430], rbp
lea rbp, [rsp + 0x430]
mov qword [rsp + 0x28], 0
mov edx, edi
lea rdi, [rsp + 0x30]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465d00
mov rbp, qword [rbp]
sub edx, ecx
shr edx, 1
nop word [rax + rax]
cmp edx, 0x80
jne 0x446225
xor esi, esi
jmp 0x446108
test byte [rax], al
lea edi, [rsi + rcx]
movzx edi, dil
mov rdi, qword [rax + rdi*8 + 0x5f8]
mov qword [rsp + rsi*8 + 0x28], rdi
inc esi
cmp esi, edx
jb 0x4460f0
lea esi, [rdx + rcx]
mov rdi, rax
mov eax, ecx
lock cmpxchg dword [rdi + 0x5f0], esi
sete sil
test sil, sil
je 0x44612e
mov qword [rsp + rdx*8 + 0x28], rbx
xor eax, eax
jmp 0x44614d
xor eax, eax
mov rbp, qword [rsp + 0x430]
add rsp, 0x438
nop
ret
mov rsi, qword [rsp + rax*8 + 0x28]
mov qword [rbx + 0xa0], rsi
cmp eax, edx
jae 0x44616d
mov rbx, qword [rsp + rax*8 + 0x28]
test byte [rbx], al
inc eax
nop word [rax + rax]
cmp rax, 0x81
jb 0x446141
jmp 0x44621b
mov dword [rsp + 0x14], edx
movups xmmword [rsp + 0x18], xmm15
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + rdx*8 + 0x28]
mov qword [rsp + 0x20], rcx
nop
nop
lea rax, [0x01100c38]
call fcn.0040c5e0
nop
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
test rcx, rcx
je 0x4461dc
mov rbx, rcx
mov qword [rcx + 0xa0], 0
mov rcx, qword [0x01100c88]
nop
test rcx, rcx
je 0x4461ce
mov qword [rcx + 0xa0], rdx
jmp 0x4461d5
mov qword [0x01100c80], rdx
mov qword [0x01100c88], rbx
mov ecx, dword [0x01100c90]
mov edx, dword [rsp + 0x14]
lea ecx, [rcx + rdx]
lea ecx, [rcx + 1]
mov dword [0x01100c90], ecx
movups xmmword [rsp + 0x18], xmm15
nop
nop
lea rax, [0x01100c38]
call fcn.0040c800
mov eax, 1
mov rbp, qword [rsp + 0x430]
add rsp, 0x438
ret
mov ecx, 0x81
call fcn.00465b60
lea rax, [0x00acf16f]
mov ebx, 0x1e
call fcn.00437b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.00446080