joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031170
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042654
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10047ca4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
lea eax, [edi + 0x10]
mov dword [eax], 0
mov dword [ebp - 0x1c], eax
add eax, 4
push eax
call dword [sym.imp.MSDART.DLL_MPInitializeCriticalSection]
lea esi, [edi + 0x18]
mov dword [edi], 0x100012ac
push esi
mov dword [edi + 4], 0x10001a8c
mov dword [edi + 8], 0x10001a78
mov dword [edi + 0xc], 0x10001a28
call dword [sym.imp.MSDART.DLL_MPInitializeCriticalSection]
add esp, 8
mov dword [esi + 4], 0xffffffff
lea ecx, [edi + 0x30]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.1003f0f0
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x117c]
mov esi, dword [0x1004b7c4]
mov dword [edi], 0x100018c4
mov dword [edi + 4], 0x10001a8c
mov dword [edi + 8], 0x100018b0
mov dword [edi + 0xc], 0x10001a28
mov dword [ecx + 4], 0
mov dword [ecx], 0x100018ac
cmp dword [0x10047cac], 0xffffffff
jne 0x1003125b
test byte [0x1004926c], 2
je 0x10031292
cmp dword [0x10049448], 0
je 0x1003126f
call fcn.10028f60
lea ecx, [edi + 0x117c]
mov eax, dword [0x10047cac]
cmp eax, 0xffffffff
je 0x10031292
push 0
push ecx
push 6
push esi
mov esi, dword [0x10047094]
mov ecx, esi
push eax
call dword [0x1004a1e8]
call esi
jmp 0x10031294
xor eax, eax
mov dword [edi + 0x1180], eax
lea ecx, [edi + 0x1184]
mov dword [ecx + 0x10], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x24], 1
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx], 0x10001884
mov byte [ebp - 4], 3
mov eax, dword [0x1000320c]
mov dword [edi + 0x1158], eax
mov eax, dword [0x10003210]
mov dword [edi + 0x115c], eax
mov eax, dword [0x10003214]
mov dword [edi + 0x1160], eax
mov eax, dword [0x10003218]
mov dword [edi + 0x1164], eax
mov eax, dword [0x1004943c]
mov dword [edi + 0x1168], 0x10003180
mov dword [edi + 0x30], eax
mov dword [edi + 0x116c], 0x10047cb0
push ecx
mov dword [edi + 0x1170], 0x100215b0
call fcn.1003bec0
mov dword [edi + 0x11a8], 1
jmp 0x1003136b
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100401a0
mov esp, ebp
pop ebp
ret
Function at 0x10040640
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1004067e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10040676
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10040680
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10040666
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10040750
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10040766
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10040781
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x40feb0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x1426408]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41007b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40fed9
mov eax, 0x7000000
jmp 0x40fee1
test eax, eax
je 0x410056
mov dword [esp + 0x14], eax
mov ecx, dword [0x1426408]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x94], ebx
mov dword [ecx + 0x98], ebp
mov dword [esp], edx
call fcn.0046cbb0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x28]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x1322080]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x41006e
cmp edx, 0x21
jae 0x410062
movsd qword [esp + 0x18], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], ebp
mov dword [esp], ecx
call fcn.00463f20
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00463ff0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x90c278]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x90c288]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x410031
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x90c2b8]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.0046cc80
mov eax, edx
mov ecx, 0x21
call fcn.0046cd70
nop
call fcn.0046b800
jmp fcn.0040feb0
Function at 0x41a740
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x1426408]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41a94e
sub esp, 0x18
mov eax, dword [0x1426304]
test eax, eax
jne 0x41a937
nop
nop
lea eax, [0x14262f4]
mov dword [esp], eax
call fcn.0040dba0
mov eax, dword [0x14262f8]
test eax, eax
je 0x41a788
cmp dword [eax + 8], 0xcc
jne 0x41a7fe
mov edx, dword [0x14262fc]
test edx, edx
jne 0x41a7e0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x142d610]
mov dword [esp + 8], eax
call fcn.00410090
mov eax, dword [esp + 0xc]
mov dword [0x14262fc], eax
mov ecx, dword [0x1426300]
mov dword [eax], ecx
mov eax, dword [0x14262fc]
mov dword [0x1426300], eax
movzx eax, byte [0x14269c0]
test al, al
jne 0x41a7e0
xor eax, eax
jmp 0x41a908
mov edx, dword [0x14262fc]
mov ebx, dword [edx + 4]
mov dword [0x14262fc], ebx
mov ebx, dword [0x14262f8]
mov dword [edx + 4], ebx
mov dword [0x14262f8], edx
mov edx, dword [0x14262f8]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x41a8e7
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00406690
mov eax, dword [0x1426690]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x41a848
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x41a85e
call fcn.0046cc10
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x1426690]
test eax, eax
jne 0x41a882
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x41a8b0
call fcn.0046cc50
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x14262f4]
mov dword [esp], eax
call fcn.0040dda0
nop
lea eax, [0x14262f0]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00406810
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0046cc80
lea edx, [0x131bce0]
movzx ebx, byte [edx + eax]
lea ebp, [0x14269c0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x41a7e0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x41a8f1
mov ecx, 5
call fcn.0046cc70
lea eax, [0x8872ce]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0043cb10
nop
call fcn.0046b800
jmp fcn.0041a740
Function at 0x428680
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x1426408]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x428777
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x428771
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.00428ad0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00428bb0
movzx eax, byte [esp + 0x18]
test al, 2
je 0x428725
cmp word [esp + 0x10], 0x1f0
jbe 0x428725
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + 0x30]
test bl, bl
jne 0x428729
nop
jmp 0x428729
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x42876c
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call fcn.00428b40
add esp, 0x1c
ret
call fcn.0046cc80
call fcn.0046cc80
nop
call fcn.0046b800
jmp fcn.00428680
Function at 0x428790
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x1426408]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4288c4
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jae 0x4288be
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.00428ad0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00428ca0
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jae 0x4288b7
mov ecx, dword [eax]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call fcn.00428b40
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax - 1]
shl eax, 0xd
mov ecx, dword [esp + 0x28]
shl ecx, 0x16
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x28], eax
jae 0x42887a
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x20]
mov dword [esp], eax
call fcn.00435200
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jae 0x4288b3
mov ecx, dword [esp + 0x24]
add ecx, 0x20
nop
mov dword [esp], ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0
sbb eax, 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.004065d0
add esp, 0x20
ret
mov eax, edx
call fcn.0046cc80
call fcn.0046cc80
nop
call fcn.0046b800
jmp fcn.00428790
Function at 0x429560
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1426408]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42976f
sub esp, 0x38
mov eax, dword [esp + 0x40]
cmp dword [0x1406350], eax
jne 0x429758
mov eax, dword [esp + 0x3c]
test byte [eax], al
mov dword [esp], eax
call fcn.00406520
mov eax, dword [esp + 4]
mov ecx, eax
and eax, 0x7fffffff
dec eax
cmp eax, 0x80000000
jae 0x429742
mov dword [esp + 0x2c], ecx
lea eax, [ecx - 1]
mov edx, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 8], eax
call fcn.00406540
movzx eax, byte [esp + 0xc]
test al, al
je 0x429587
mov eax, dword [esp + 0x2c]
cmp eax, 0x80000000
jne 0x42973e
mov eax, dword [0x1426974]
test eax, eax
jle 0x42973a
nop
lea eax, [0x1426e88]
mov dword [esp], eax
call fcn.00406790
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
shr eax, 0x14
mov edx, dword [esp + 8]
mov dword [esp + 0x1c], edx
mov ebx, edx
shl edx, 0xc
or eax, edx
mov dword [esp + 0x2c], eax
shr ebx, 0x14
mov dword [esp + 0x28], ebx
lea ebp, [0x1406368]
mov dword [esp], ebp
call fcn.00406790
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x10], ecx
mov edx, dword [0x1406378]
mov dword [esp + 0x24], edx
mov ebx, dword [0x140637c]
mov dword [esp + 0x20], ebx
movsd xmm0, qword [0x1406380]
movsd qword [esp + 0x30], xmm0
call fcn.0043e840
lea eax, [0x88d21a]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.0043f0c0
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0043eda0
lea eax, [0x87d7bb]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043f0c0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
sub eax, ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sbb ecx, edx
mov edx, ecx
shl ecx, 0xc
shr eax, 0x14
or ecx, eax
shr edx, 0x14
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.0043eda0
lea eax, [0x88602b]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.0043f0c0
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0043eda0
lea eax, [0x878c83]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.0043f0c0
movsd xmm0, qword [esp + 0x30]
movsd qword [esp], xmm0
call fcn.0043eaf0
lea eax, [0x87b55a]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043f0c0
call fcn.0043e8a0
add esp, 0x38
ret
add esp, 0x38
ret
lea eax, [0x88fd3f]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.0043cb10
lea eax, [0x897278]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.0043cb10
nop
call fcn.0046b800
jmp fcn.00429560
Function at 0x42e900
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x1426408]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42ea70
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42ea00
cmp cl, 1
je 0x42e992
cmp cl, 2
jne 0x42ea59
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00433f40
nop
nop
lea eax, [0x140a8e0]
mov dword [esp], eax
call fcn.0040dba0
mov eax, dword [0x140a884]
sub eax, dword [0x140a868]
nop
mov dword [0x140a884], eax
mov eax, dword [0x140a874]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x140a874], ecx
nop
lea eax, [0x140a8e0]
mov dword [esp], eax
call fcn.0040dda0
jmp 0x42ea55
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.0041a740
nop
nop
lea eax, [0x140a8e0]
mov dword [esp], eax
call fcn.0040dba0
mov eax, dword [0x140a85c]
sub eax, dword [0x140a840]
nop
mov dword [0x140a85c], eax
mov eax, dword [0x140a84c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x140a84c], ecx
nop
lea eax, [0x140a8e0]
mov dword [esp], eax
call fcn.0040dda0
jmp 0x42ea55
cmp cl, 3
jne 0x42ea0b
mov byte [eax + 8], 1
jmp 0x42ea55
cmp cl, 4
jne 0x42ea59
nop
nop
lea eax, [0x140a8e0]
mov dword [esp], eax
call fcn.0040dba0
mov eax, dword [0x140a8d4]
sub eax, dword [0x140a8b8]
nop
mov dword [0x140a8d4], eax
mov eax, dword [0x140a8c4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x140a8c4], ecx
nop
nop
lea eax, [0x140a8e0]
mov dword [esp], eax
call fcn.0040dda0
add esp, 0x14
ret
lea eax, [0x87f5ab]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0043cb10
nop
call fcn.0046b800
jmp fcn.0042e900
Function at 0x446a50
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1426408]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x446b4a
sub esp, 0xc
mov eax, dword [esp + 0x10]
test byte [eax], al
lea ecx, [eax + 0x48]
nop
mov dword [esp], ecx
call fcn.00406520
mov eax, dword [esp + 4]
and eax, 0xffffefff
cmp eax, 2
jne 0x446b27
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 1
call fcn.00441620
mov eax, dword [0x1426408]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x50]
xor edx, edx
nop
nop
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
xor ecx, ecx
nop
mov dword [eax + 0x50], ecx
nop
nop
lea eax, [0x14015d8]
mov dword [esp], eax
call fcn.0040dba0
nop
nop
mov eax, dword [esp + 0x10]
mov dword [eax + 0x58], 0
mov ecx, dword [0x1401618]
test ecx, ecx
je 0x446af6
mov edx, eax
mov dword [ecx + 0x58], eax
jmp 0x446b01
mov ecx, eax
nop
mov dword [0x1401614], eax
mov edx, ecx
nop
mov dword [0x1401618], edx
inc dword [0x140161c]
nop
nop
lea eax, [0x14015d8]
mov dword [esp], eax
call fcn.0040dda0
call fcn.00446280
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00440880
lea eax, [0x87b5ba]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043cb10
nop
call fcn.0046b800
jmp fcn.00446a50
Function at 0x446d20
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1426408]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x446eda
sub esp, 0x1c
movzx eax, byte [0x140a944]
test al, al
je 0x446d6c
nop
mov byte [esp], 0x14
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0045c640
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x48]
nop
mov dword [esp], ecx
call fcn.00406520
mov eax, dword [esp + 4]
and eax, 0xffffefff
cmp eax, 2
jne 0x446eb7
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x68]
test cl, cl
je 0x446dc0
mov ecx, dword [eax + 0x20]
mov dword [esp], ecx
call fcn.00458660
mov eax, dword [esp + 4]
test eax, eax
je 0x446ea1
movzx ecx, byte [eax + 0x29]
test cl, 2
jne 0x446e1e
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 0x1009
call fcn.00441a30
mov eax, dword [0x1426408]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x50]
xor edx, edx
nop
nop
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
xor ecx, ecx
nop
mov dword [eax + 0x50], ecx
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x1009
mov dword [esp + 8], 9
call fcn.00441380
call fcn.00446280
add esp, 0x1c
ret
mov ecx, dword [esp + 8]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00458180
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
call fcn.0043e840
lea eax, [0x89123f]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.0043f0c0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043f0c0
lea eax, [0x88144d]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0043f0c0
call fcn.0043e8a0
lea eax, [0x87e844]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043cb10
lea eax, [0x88431b]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.0043cb10
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00440880
lea eax, [0x87b5ba]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043cb10
nop
call fcn.0046a0f0
jmp fcn.00446d20
Function at 0x449f40
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [0x1426408]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x58]
test edx, edx
jne 0x44a052
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x2c]
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x449f91
mov ebp, dword [edx + 4]
test ebp, ebp
jne 0x449f89
mov ebx, edx
nop
mov dword [ecx + 0x58], edx
mov eax, dword [eax + 0x18]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 4], 1
add esp, 0x18
ret
test ebx, ebx
je 0x44a049
mov ecx, dword [ebx + 0x64]
mov ebx, dword [ebx + 0x68]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov eax, dword [edx + 4]
mov dword [esp + 0x10], eax
call fcn.0043e840
lea eax, [0x87b5d2]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043f0c0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0043eda0
lea eax, [0x909de8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043f0c0
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.0043eee0
lea eax, [0x87b5de]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043f0c0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0043eda0
call fcn.0043ea50
call fcn.0043e8a0
lea eax, [0x88527c]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.0043cb10
xor ebx, ebx
xor ecx, ecx
jmp 0x449f97
lea eax, [0x88304b]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.0043cb10
nop
int3
Function at 0x44a070
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1426408]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44a1d4
sub esp, 0x1c
mov eax, dword [0x1426408]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x58]
test edx, edx
je 0x44a1bd
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov ebx, dword [edx + 0x2c]
mov dword [esp + 8], ebx
nop
cmp ebx, ecx
jne 0x44a0f9
cmp dword [edx + 4], 1
jne 0x44a0f9
movzx ecx, byte [0x140a944]
test cl, cl
je 0x44a0d9
mov dword [esp + 0x10], eax
mov dword [esp], edx
call fcn.0045d5d0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x58], 0
mov dword [edx + 0x2c], 0
mov dword [edx + 4], 0
mov dword [esp + 0x20], edx
add esp, 0x1c
ret
mov eax, dword [edx + 4]
mov dword [esp + 0xc], eax
call fcn.0043e840
lea eax, [0x87b5ea]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043f0c0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0043f040
lea eax, [0x87481c]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.0043f0c0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0043f040
lea eax, [0x874822]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.0043f0c0
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.0043ef50
lea eax, [0x879db7]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043f0c0
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0043eda0
call fcn.0043ea50
call fcn.0043e8a0
lea eax, [0x888199]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.0043cb10
lea eax, [0x884330]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.0043cb10
nop
call fcn.0046b800
jmp fcn.0044a070