joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4177a0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4179e1
mov ecx, dword [esp + 0x40]
cmp dword [eax], ecx
jne 0x41791c
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x4178a4
movzx ecx, byte [0x1ae30c0]
test cl, cl
je 0x4177fb
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x2c], ecx
test byte [ecx], al
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
xor esi, esi
xor edi, edi
jmp 0x417802
add esp, 0x30
ret
add esi, 4
cmp dword [eax + 4], esi
jbe 0x4178a0
test esi, 0x1f
jne 0x417819
movzx edi, byte [edx]
inc edx
jmp 0x41781b
shr edi, 1
test edi, 1
je 0x4177ff
mov dword [esp + 0x1c], edx
add ebp, esi
add ebx, esi
mov eax, dword [ecx + 0x998]
add eax, 8
nop
cmp dword [ecx + 0x99c], eax
jae 0x41786a
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebx
call fcn.0043bf40
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [ecx + 0x998]
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
add edx, 8
mov dword [ecx + 0x998], edx
mov edx, dword [ebp]
mov dword [eax], edx
mov edx, dword [ebx]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
jmp 0x4177ff
add esp, 0x30
ret
mov dword [esp], eax
call fcn.0046f540
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
call fcn.00443c40
lea eax, [0xe744dc]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.004444b0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.004444b0
lea eax, [0xe4739d]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.004444b0
call fcn.00443ca0
lea eax, [0xe6b418]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00441d50
mov dword [esp], eax
call fcn.0046f540
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x34]
mov edx, dword [edx]
mov dword [esp + 0x18], edx
call fcn.00443c40
lea eax, [0xe744dc]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.004444b0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.004444b0
lea eax, [0xe41915]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.004444b0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
lea eax, [0xe4b88f]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.004444b0
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
call fcn.00443e50
call fcn.00443ca0
lea eax, [0xe6b418]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00441d50
lea eax, [0xe76098]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.00441d50
nop
int3
Function at 0x41cb20
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41cd1e
sub esp, 0x18
mov eax, dword [0x1ae2d04]
test eax, eax
jne 0x41cd07
nop
nop
lea eax, [0x1ae2cf4]
mov dword [esp], eax
call fcn.0040f460
mov eax, dword [0x1ae2cf8]
test eax, eax
je 0x41cb68
cmp dword [eax + 8], 0xcc
jne 0x41cbde
mov edx, dword [0x1ae2cfc]
test edx, edx
jne 0x41cbc0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x1ae9410]
mov dword [esp + 8], eax
call fcn.00411a60
mov eax, dword [esp + 0xc]
mov dword [0x1ae2cfc], eax
mov ecx, dword [0x1ae2d00]
mov dword [eax], ecx
mov eax, dword [0x1ae2cfc]
mov dword [0x1ae2d00], eax
movzx eax, byte [0x1ae3b40]
test al, al
jne 0x41cbc0
xor eax, eax
jmp 0x41ccd8
mov edx, dword [0x1ae2cfc]
mov ebx, dword [edx + 4]
mov dword [0x1ae2cfc], ebx
mov ebx, dword [0x1ae2cf8]
mov dword [edx + 4], ebx
mov dword [0x1ae2cf8], edx
mov edx, dword [0x1ae2cf8]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x41ccb7
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00406a20
mov eax, dword [0x1ae30c0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x41cc30
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x41cc70
call fcn.0047b1c0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x1ae2cf4]
mov dword [esp], eax
call fcn.0040f680
nop
lea eax, [0x1ae2cf0]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00406ba0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0047b1e0
lea edx, [0x199cf8c]
movzx ebx, byte [edx + eax]
lea ebp, [0x1ae3b40]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x41cbc0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x41ccc1
mov ecx, 5
call fcn.0047b1d0
lea eax, [0xe55125]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.0041cb20
Function at 0x42b4f0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42b5d0
sub esp, 0xc
mov eax, dword [esp + 0x10]
movzx ecx, word [eax]
movzx edx, cx
mov ebx, dword [esp + 0x14]
add edx, ebx
cmp edx, 0x200
ja 0x42b54d
mov edx, dword [esp + 0x18]
cmp dword [eax + 4], edx
je 0x42b52f
mov word [eax + 2], cx
mov dword [eax + 4], edx
movzx ecx, word [eax]
add ecx, ebx
mov word [eax], cx
cmp cx, 0x200
jne 0x42b549
movzx ecx, byte [eax + 8]
and ecx, 0xfffffffe
nop
mov byte [eax + 8], cl
add esp, 0xc
ret
mov word [esp + 0xa], cx
call fcn.00443c40
lea eax, [0xe473d9]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.004444b0
movzx eax, word [esp + 0xa]
movzx eax, ax
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
lea eax, [0xe3de2f]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004444b0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
call fcn.00443e50
call fcn.00443ca0
lea eax, [0xe673bc]
mov dword [esp], eax
mov dword [esp + 4], 0x22
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.0042b4f0

Function at 0x42b5e0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42b6b3
sub esp, 0xc
mov eax, dword [esp + 0x10]
movzx ecx, word [eax]
movzx edx, cx
mov ebx, dword [esp + 0x14]
cmp ebx, edx
ja 0x42b630
mov edx, dword [esp + 0x18]
cmp dword [eax + 4], edx
je 0x42b619
mov word [eax + 2], cx
mov dword [eax + 4], edx
movzx ecx, word [eax]
sub ecx, ebx
mov word [eax], cx
movzx ecx, byte [eax + 8]
or ecx, 1
nop
mov byte [eax + 8], cl
add esp, 0xc
ret
mov word [esp + 0xa], cx
call fcn.00443c40
lea eax, [0xe473d9]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.004444b0
movzx eax, word [esp + 0xa]
movzx eax, ax
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
lea eax, [0xe3de2f]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004444b0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
call fcn.00443e50
call fcn.00443ca0
lea eax, [0xe59f8a]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.0042b5e0
Function at 0x431390
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x431500
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x431490
cmp cl, 1
je 0x431422
cmp cl, 2
jne 0x4314e9
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00436980
nop
nop
lea eax, [0x1aaf0e0]
mov dword [esp], eax
call fcn.0040f460
mov eax, dword [0x1aaf084]
sub eax, dword [0x1aaf068]
nop
mov dword [0x1aaf084], eax
mov eax, dword [0x1aaf074]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x1aaf074], ecx
nop
lea eax, [0x1aaf0e0]
mov dword [esp], eax
call fcn.0040f680
jmp 0x4314e5
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.0041cb20
nop
nop
lea eax, [0x1aaf0e0]
mov dword [esp], eax
call fcn.0040f460
mov eax, dword [0x1aaf05c]
sub eax, dword [0x1aaf040]
nop
mov dword [0x1aaf05c], eax
mov eax, dword [0x1aaf04c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x1aaf04c], ecx
nop
lea eax, [0x1aaf0e0]
mov dword [esp], eax
call fcn.0040f680
jmp 0x4314e5
cmp cl, 3
jne 0x43149b
mov byte [eax + 8], 1
jmp 0x4314e5
cmp cl, 4
jne 0x4314e9
nop
nop
lea eax, [0x1aaf0e0]
mov dword [esp], eax
call fcn.0040f460
mov eax, dword [0x1aaf0d4]
sub eax, dword [0x1aaf0b8]
nop
mov dword [0x1aaf0d4], eax
mov eax, dword [0x1aaf0c4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x1aaf0c4], ecx
nop
nop
lea eax, [0x1aaf0e0]
mov dword [esp], eax
call fcn.0040f680
add esp, 0x14
ret
lea eax, [0xe48a3c]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.00431390
Function at 0x433220
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x43347a
sub esp, 0x24
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0x34]
mov ebx, eax
shr ebx, 0x16
cmp dword [edx + 0x3c], ebx
jbe 0x43336b
and eax, 0x3fffff
shr eax, 0xd
lea ebp, [eax - 0x200]
xchg ebp, ebx
neg ebx
xchg ebp, ebx
mov esi, dword [esp + 0x2c]
cmp esi, ebp
ja 0x4332e5
mov ecx, dword [edx + 0x28]
cmp ecx, ebx
jbe 0x433472
mov ecx, dword [edx + 0x24]
lea ecx, [ecx + ebx*8]
mov ebp, dword [ecx + 4]
test ebp, 0x80000000
je 0x43328b
mov ecx, 0x40000
jmp 0x43329b
mov ecx, dword [ecx]
shl ebp, 0xe
shr ecx, 0x12
or ecx, ebp
and ecx, 0x3ffff
cmp esi, ecx
ja 0x4332e5
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ecx
mov ecx, dword [edx + 0x30]
test byte [ecx], al
shl ebx, 7
add ecx, ebx
mov dword [esp], ecx
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call fcn.004356f0
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x43337f
mov ecx, dword [esp + 0x10]
shl eax, 0xd
shl ecx, 0xd
mov edx, dword [esp + 0x20]
shl edx, 0x16
add eax, edx
add ecx, edx
jmp 0x433327
mov dword [esp], edx
mov dword [esp + 4], esi
call fcn.00432500
mov eax, dword [esp + 8]
test eax, eax
jne 0x433323
mov eax, dword [esp + 0x2c]
cmp eax, 1
jne 0x43330f
mov eax, dword [0x199ce70]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x34], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x24
ret
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x28]
mov dword [esp], edx
mov dword [esp + 4], eax
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebx
call fcn.00432140
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
cmp dword [edx + 0x34], ecx
jae 0x43335b
mov dword [edx + 0x34], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
add esp, 0x24
ret
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x24
ret
call fcn.00443c40
lea eax, [0xe473e8]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.004444b0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
lea eax, [0xe419a4]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.004444b0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
call fcn.00443e50
call fcn.00443ca0
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x34]
mov dword [esp + 0x20], eax
and eax, 0x3fffff
shr eax, 0xd
mov dword [esp + 0x1c], eax
call fcn.00443c40
lea eax, [0xe504ca]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.004444b0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
lea eax, [0xe4a056]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.004444b0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00444340
call fcn.00443e50
call fcn.00443ca0
lea eax, [0xe48a4c]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00441d50
mov eax, ebx
call fcn.0047b1e0
nop
call fcn.00478320
jmp fcn.00433220
Function at 0x4371f0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4372d6
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [eax + 0x88], 0
lea ecx, [0x1ae3af0]
mov dword [esp], ecx
call fcn.00406990
mov eax, dword [esp + 4]
test eax, eax
je 0x4372b2
mov dword [esp + 8], 0
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x30]
lea edi, [esp + 0x10]
xor eax, eax
call fcn.0047b419
lea ecx, [0x4372e0]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 3
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x10]
mov dword [esp], edx
call fcn.00479c60
mov eax, dword [esp + 8]
cmp eax, 0x20
jge 0x4372ae
jae 0x4372cb
mov ecx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 8], 0
add esp, 0x2c
ret
lea eax, [fcn.0044ef70]
inc eax
mov ecx, dword [esp + 0x30]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
add esp, 0x2c
ret
mov ecx, 0x20
call fcn.0047b1d0
nop
call fcn.00479d50
jmp fcn.004371f0
Function at 0x441730
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x441920
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx edx, byte [eax + 0x32]
mov ebx, dword [0x1ae2f1c]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
test dl, dl
jne 0x441773
cmp dword [ebx + 0x10], eax
jne 0x441909
movzx edx, byte [eax + 0x30]
test dl, dl
jne 0x4418e5
mov edx, dword [0x1ae30c0]
mov ebp, dword [eax + 0x14]
test edx, edx
je 0x44178c
call fcn.0047b160
mov dword [edi], ebp
mov edx, dword [eax]
mov dword [edi + 4], edx
mov dword [esp + 8], ebx
mov dword [eax], ebp
jmp 0x44179c
mov ebx, dword [esp + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0x28]
test edx, edx
je 0x441830
movzx ebp, byte [edx]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4417e3
mov ecx, dword [0x1ae30c0]
test ecx, ecx
je 0x4417c4
mov ecx, dword [eax + 0x28]
call fcn.0047b150
mov dword [edi], ecx
mov dword [eax + 0x28], 0
jmp 0x441830
mov dword [esp], eax
call fcn.00441930
movzx eax, byte [esp + 4]
test al, al
jne 0x441794
jmp 0x4418d4
xchg ebp, eax
movzx ebx, al
xchg ebp, eax
lea esi, [0xe967a5]
movzx ebx, byte [esi + ebx]
add ebx, 0xfffffff8
neg ebx
lea ecx, [ebx - 7]
neg ecx
mov ebx, 1
shl ebx, cl
cmp ecx, 0x20
sbb esi, esi
and ebx, esi
not ebx
and ebx, ebp
mov byte [edx], bl
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 1
add esp, 0x10
ret
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov eax, ecx
mov ebx, dword [esp + 8]
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x4417cd
mov edx, dword [eax + 0x18]
cmp dword [ecx + 4], edx
jne 0x4417cd
movzx edx, byte [ecx + 1]
test dl, dl
je 0x441876
mov dword [esp], ecx
call fcn.004409d0
mov eax, dword [0x1ae30c0]
mov ecx, dword [esp + 4]
test eax, eax
jne 0x441863
mov eax, dword [esp + 8]
jmp 0x441823
call fcn.0047b160
mov dword [edi], ecx
mov eax, dword [esp + 8]
mov edx, dword [eax + 0x14]
mov dword [edi + 4], edx
jmp 0x441823
mov edx, dword [0x1ae30c0]
mov ebp, dword [ecx + 0xc]
test edx, edx
je 0x44188d
mov edx, dword [ecx + 0xc]
call fcn.0047b150
mov dword [edi], edx
mov dword [esp + 0xc], ebp
mov dword [ecx + 0xc], 0
mov edx, dword [ecx + 8]
mov dword [eax + 0x24], edx
mov eax, dword [0x1ae30c0]
mov edx, dword [ecx + 0x10]
test eax, eax
je 0x4418b8
call fcn.0047b160
mov dword [edi], edx
mov eax, dword [ebx + 0x14]
mov dword [edi + 4], eax
mov dword [ebx + 0x14], edx
mov dword [esp], ecx
call fcn.00440d20
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 1
add esp, 0x10
ret
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 0
add esp, 0x10
ret
lea eax, [0xea2098]
mov dword [esp], eax
call fcn.00479c00
lea eax, [0xe47406]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00441d50
lea eax, [0xe473f7]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.00441730
Function at 0x445e40
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x445f13
sub esp, 0x14
mov eax, dword [0x1aa5188]
mov dword [esp + 0x10], eax
mov ecx, dword [0x1aa5198]
mov dword [esp + 0xc], ecx
lea edx, [0x1ae2d84]
mov dword [esp], edx
call fcn.004068b0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
sub eax, ecx
sub eax, dword [esp + 4]
mov dword [esp + 8], eax
lea ecx, [0x1ae2d7c]
mov dword [esp], ecx
call fcn.004068b0
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
mov ecx, dword [0x1aa5190]
cmp ecx, eax
jl 0x445eaf
add esp, 0x14
ret
mov dword [esp + 8], ecx
call fcn.00443c40
lea eax, [0xe568cb]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.004444b0
mov eax, dword [esp + 8]
mov dword [esp], eax
sar eax, 0x1f
mov dword [esp + 4], eax
call fcn.004442d0
lea eax, [0xe45d54]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.004444b0
call fcn.00443ca0
lea eax, [0xe4a09a]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.00445e40
Function at 0x449100
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x449218
sub esp, 0x10
mov eax, dword [0x1ae2f1c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x7c]
test edx, edx
jne 0x449201
mov edx, dword [ecx + 0x58]
test edx, edx
jne 0x4491eb
movzx ecx, byte [ecx + 0x88]
test cl, cl
jne 0x4491d5
mov dword [esp + 0xc], eax
nop
nop
lea eax, [0x1aa5178]
mov dword [esp], eax
call fcn.0040f460
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov dword [esp], ecx
call fcn.00452250
nop
nop
lea eax, [0x1aa5178]
mov dword [esp], eax
call fcn.0040f680
mov eax, dword [0x1ae2f1c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0xac
nop
mov dword [esp], ecx
call fcn.0040f800
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x18]
mov dword [eax + 0xac], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x5c]
mov dword [esp], ecx
call fcn.004502c0
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x5c], 0
add esp, 0x10
ret
lea eax, [0xe45d62]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00441d50
lea eax, [0xe47415]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00441d50
lea eax, [0xe4d21b]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.00449100
Function at 0x44c6b0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44c820
sub esp, 0x14
call fcn.00468220
mov eax, dword [esp + 0x18]
test byte [eax], al
lea ecx, [eax + 0x48]
mov edx, dword [esp]
mov dword [esp + 0x10], edx
mov ebx, dword [esp + 4]
mov dword [esp + 0xc], ebx
nop
mov dword [esp], ecx
call fcn.004068b0
mov eax, dword [esp + 4]
and eax, 0xffffefff
cmp eax, 2
jne 0x44c7fd
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 1
call fcn.004469f0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x44c76d
movzx ecx, byte [esp + 0x1c]
test cl, cl
je 0x44c743
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.004691b0
jmp 0x44c759
nop
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov byte [esp + 8], 1
call fcn.004691b0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.00468330
mov eax, dword [0x1ae2f1c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x50]
xor edx, edx
nop
nop
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
xor ecx, ecx
nop
mov dword [eax + 0x50], ecx
nop
nop
lea eax, [0x1aa5178]
mov dword [esp], eax
call fcn.0040f460
nop
nop
mov eax, dword [esp + 0x18]
mov dword [eax + 0x58], 0
mov ecx, dword [0x1aa51b8]
test ecx, ecx
je 0x44c7bc
mov edx, eax
mov dword [ecx + 0x58], eax
jmp 0x44c7c7
mov ecx, eax
nop
mov dword [0x1aa51b4], eax
mov edx, ecx
nop
mov dword [0x1aa51b8], edx
inc dword [0x1aa51bc]
nop
nop
lea eax, [0x1aa5178]
mov dword [esp], eax
call fcn.0040f680
movzx eax, byte [0x1ae2c62]
test al, al
je 0x44c7f4
call fcn.004498a0
call fcn.0044beb0
add esp, 0x14
ret
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00445ca0
lea eax, [0xe4312d]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.0044c6b0