joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c8f0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x44cabb
sub esp, 0x20
mov eax, dword [esp + 0x24]
test byte [eax], al
lea ecx, [eax + 0x48]
nop
mov dword [esp], ecx
call fcn.004068b0
mov eax, dword [esp + 4]
and eax, 0xffffefff
cmp eax, 2
jne 0x44ca98
mov eax, dword [esp + 0x24]
movzx ecx, byte [eax + 0x68]
test cl, cl
je 0x44c95f
mov ecx, dword [eax + 0x20]
mov dword [esp], ecx
call fcn.004603b0
mov eax, dword [esp + 4]
test eax, eax
je 0x44ca82
movzx ecx, byte [eax + 0x29]
test cl, 2
jne 0x44c9ff
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 0x1009
call fcn.00446e60
mov eax, dword [0x1ae2f1c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x50]
xor edx, edx
nop
nop
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
xor ecx, ecx
nop
mov dword [eax + 0x50], ecx
call fcn.00468220
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov ecx, dword [esp]
mov dword [esp + 0x1c], ecx
test eax, eax
je 0x44c9c2
mov byte [esp + 8], 0xb
mov dword [esp + 0xc], 0
call fcn.004692e0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0x1009
mov dword [esp + 8], 9
call fcn.00446750
mov eax, dword [esp + 0x14]
test eax, eax
je 0x44c9f6
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00468330
call fcn.0044beb0
add esp, 0x20
ret
mov ecx, dword [esp + 8]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045ff00
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
call fcn.00443c40
lea eax, [0xe6d814]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.004444b0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.004444b0
lea eax, [0xe4b943]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.004444b0
call fcn.00443ca0
lea eax, [0xe47433]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00441d50
lea eax, [0xe50587]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00441d50
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00445ca0
lea eax, [0xe4312d]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00441d50
nop
call fcn.00478320
jmp fcn.0044c8f0
Function at 0x44cfb0
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x2c
call fcn.00468220
mov eax, dword [0x1ae2f1c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ecx, dword [eax + 0x18]
mov edx, dword [esp]
mov dword [esp + 0x14], edx
mov ebx, dword [esp + 4]
mov dword [esp + 0xc], ebx
inc dword [ecx + 0x7c]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
mov ebp, dword [esp + 0x34]
mov dword [esp + 4], ebp
call fcn.0044cf50
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x30]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.004469f0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
ja 0x44d035
cmp dword [eax + 4], ecx
jae 0x44d063
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
lea ecx, [0x44d210]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x24]
mov dword [esp], ecx
call fcn.00479c60
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x44d0b9
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
lea eax, [0x44d1c0]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.00479c60
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.0044cf50
lea eax, [0x1aa5200]
mov dword [esp], eax
call fcn.004062a0
movzx eax, byte [esp + 4]
test al, al
je 0x44d0f2
lea eax, [0xea1ee4]
mov dword [esp], eax
call fcn.00479c60
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.0044cf50
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
test byte [ecx], al
mov ecx, dword [ecx + 0x11a0]
test ecx, ecx
je 0x44d12e
lea eax, [0xea20a4]
mov dword [esp], eax
call fcn.00479c60
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.0044cf50
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x58]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x1f8], edx
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
lea edx, [ecx + 4]
mov dword [ecx + 0x2c], 0
mov ebx, dword [eax + 0x18]
mov dword [ebx + 0x60], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x58], 0
mov dword [esp], edx
mov dword [esp + 4], 2
call fcn.00406af0
lea eax, [0x1aa51f4]
mov dword [esp], eax
call fcn.004062a0
movzx eax, byte [esp + 4]
test al, al
je 0x44d1a6
lea eax, [0xea1ee0]
mov dword [esp], eax
call fcn.00479c60
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0044cf50
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x7c]
add esp, 0x2c
ret
Function at 0x44f4d0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44f637
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], 3
mov dword [ecx + 0x500], 0
mov dword [ecx + 0x504], 0x80
mov edx, dword [0x1ae30c0]
lea ebx, [ecx + 0x508]
lea ebp, [ecx + 0x58]
test edx, edx
je 0x44f538
call fcn.0047b180
mov dword [edi], ebx
mov edx, dword [ecx + 0x4fc]
mov dword [edi + 4], edx
mov dword [edi + 8], ebp
mov edx, dword [ecx + 0x4c]
mov dword [edi + 0xc], edx
mov dword [ecx + 0x4fc], ebx
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0x20
mov dword [ecx + 0x4c], ebp
lea eax, [ecx + 0x998]
mov dword [esp], eax
call fcn.0043bf10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x44f56e
mov ecx, dword [esp + 0x18]
jmp 0x44f59c
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x44f589
mov edx, dword [0x1ae2d6c]
test edx, edx
je 0x44f620
mov dword [eax + 0x30], edx
jmp 0x44f59c
call fcn.00418f00
mov eax, dword [esp]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x30], eax
mov ecx, dword [esp + 0x18]
mov edx, ecx
sar edx, 0x1f
shr edx, 0x1b
lea eax, [ecx + edx]
mov edx, eax
and edx, 0xffffffe0
mov ebx, ecx
sub ebx, edx
test ebx, ebx
jl 0x44f61b
mov edx, dword [0x1aa04d4]
sar eax, 5
mov ecx, ebx
mov esi, 1
shl esi, cl
cmp ecx, 0x20
sbb ebx, ebx
and esi, ebx
cmp edx, eax
jbe 0x44f614
mov ecx, dword [0x1aa04d0]
lea eax, [ecx + eax*4]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.00406ba0
mov eax, dword [0x1aa04c0]
mov ecx, dword [0x1aa04c4]
mov edx, dword [0x1aa04c8]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
call fcn.00452400
add esp, 0x10
ret
mov ecx, edx
call fcn.0047b1d0
call fcn.00440860
lea eax, [0xe47442]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.0044f4d0
Function at 0x450530
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x450672
sub esp, 0x18
mov eax, dword [0x1ae2f1c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x45065b
mov dword [esp + 0x14], eax
mov edx, dword [ecx + 0x2c]
mov dword [esp + 8], edx
nop
cmp edx, eax
jne 0x450593
cmp dword [ecx + 4], 1
jne 0x450593
mov dword [eax + 0x58], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 4], 0
mov dword [esp + 0x1c], ecx
add esp, 0x18
ret
mov dword [esp + 0x10], ecx
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
call fcn.00443c40
lea eax, [0xe4315d]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.004444b0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00444430
lea eax, [0xe3afa3]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.004444b0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00444430
lea eax, [0xe3afa9]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.004444b0
mov eax, dword [esp + 8]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00444340
lea eax, [0xe419ba]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.004444b0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
call fcn.00443e50
call fcn.00443ca0
lea eax, [0xe56916]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00441d50
lea eax, [0xe5059c]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.00450530
Function at 0x454900
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x454a91
sub esp, 0x44
nop
nop
lea eax, [0x1ae4760]
mov dword [esp], eax
call fcn.0040f460
movzx eax, byte [0x1ae48b0]
test al, al
je 0x454948
lea eax, [0xe45d8c]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00441e20
mov edx, dword [0x1aa0470]
test edx, edx
je 0x45495f
mov ebx, dword [0x1aa0474]
xor eax, eax
jmp 0x454a16
lea eax, [0x1ae4764]
mov dword [esp], eax
mov dword [esp + 4], 0x20
mov dword [esp + 8], 0x20
call fcn.0043df00
cmp dword [esp + 0xc], 0x20
je 0x4549a9
mov byte [0x1ae2c65], 1
lea eax, [0x1ae4764]
mov dword [esp], eax
mov dword [esp + 4], 0x20
mov dword [esp + 8], 0x20
call fcn.00454aa0
lea edi, [esp + 0x24]
lea esi, [0x1ae4764]
call fcn.0047b8e0
lea eax, [0x1ae4784]
mov dword [esp], eax
lea edi, [esp + 4]
lea esi, [esp + 0x24]
call fcn.0047b8e0
call fcn.00406f50
lea eax, [0x1ae4764]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.0047b940
mov byte [0x1ae48b0], 1
nop
nop
lea eax, [0x1ae4760]
mov dword [esp], eax
call fcn.0040f680
add esp, 0x44
ret
lea esi, [0x1ae4764]
movzx edi, byte [ecx + esi]
xor edi, ebp
xchg edi, eax
mov byte [esi + ecx], al
xchg edi, eax
inc eax
cmp eax, ebx
jge 0x454a2e
mov ebp, eax
and ebp, 0xffffffe0
mov ecx, eax
sub ecx, ebp
movzx ebp, byte [eax + edx]
cmp ecx, 0x20
jb 0x454a04
jmp 0x454a84
mov eax, dword [0x1aa0474]
test eax, eax
je 0x454a4a
mov ecx, dword [0x1aa0470]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0047b940
mov dword [0x1aa0474], 0
mov dword [0x1aa0478], 0
mov eax, dword [0x1ae30c0]
test eax, eax
je 0x454a75
mov eax, dword [0x1aa0470]
call fcn.0047b150
mov dword [edi], eax
mov dword [0x1aa0470], 0
jmp 0x4549a9
mov eax, ecx
mov ecx, 0x20
call fcn.0047b1d0
nop
call fcn.00479d50
jmp fcn.00454900

Function at 0x454bf0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x454c9d
sub esp, 0x10
nop
nop
lea eax, [0x1ae4760]
mov dword [esp], eax
call fcn.0040f460
movzx eax, byte [0x1ae48b0]
test al, al
jne 0x454c48
lea eax, [0xe47460]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00441e20
jmp 0x454c48
lea eax, [0x1ae4784]
mov dword [esp], eax
call fcn.00407230
mov eax, dword [0x1ae48a4]
nop
cmp dword [0x1ae48a8], eax
jbe 0x454c3a
lea ecx, [eax + 1]
mov dword [0x1ae48a4], ecx
and eax, 0x1f
lea ecx, [0x1ae4784]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 8], ecx
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
nop
nop
lea edx, [0x1ae4760]
mov dword [esp], edx
call fcn.0040f680
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
add esp, 0x10
ret
call fcn.00479d50
jmp fcn.00454bf0
Function at 0x454cb0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x454d16
sub esp, 8
nop
nop
lea eax, [0x1ae4760]
mov dword [esp], eax
call fcn.0040f460
movzx eax, byte [0x1ae48b0]
test al, al
jne 0x454cf4
lea eax, [0xe47460]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00441e20
lea eax, [0x1ae4784]
mov dword [esp], eax
call fcn.00407320
nop
nop
lea eax, [0x1ae4760]
mov dword [esp], eax
call fcn.0040f680
add esp, 8
ret
call fcn.00479d50
jmp fcn.00454cb0
Function at 0x45a5b0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45a71d
sub esp, 0x1c
movzx edx, byte [esp + 0x20]
movzx eax, dl
cmp eax, 3
jae 0x45a712
shl eax, 6
lea ecx, [0x1ae4080]
mov ebx, dword [ecx + eax + 4]
lea eax, [ecx + eax + 4]
test ebx, ebx
jne 0x45a643
mov dword [esp + 0x14], eax
lea eax, [0x1aaaa60]
mov dword [esp], eax
mov dword [esp + 4], 4
mov byte [esp + 8], 1
call fcn.0042f560
mov eax, dword [esp + 0xc]
test eax, eax
je 0x45a6fc
movzx edx, word [eax + 0x3c]
test dx, dx
jne 0x45a6e6
mov edx, dword [eax + 0x14]
test edx, edx
jne 0x45a6d0
movzx ecx, byte [esp + 0x20]
mov edx, 0x1000
shl edx, cl
mov dword [eax + 0x44], edx
xor ecx, ecx
jmp 0x45a6a7
mov ecx, dword [ebx + 0x14]
mov edx, ecx
test ecx, ecx
je 0x45a67d
mov ecx, dword [ecx]
mov dword [ebx + 0x14], ecx
movzx ecx, word [ebx + 0x3c]
inc ecx
mov word [ebx + 0x3c], cx
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x45a675
mov dword [esp + 0x18], edx
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.00430a80
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], edx
add esp, 0x1c
ret
lea eax, [0xe539e1]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00441d50
mov edx, dword [eax + 0x14]
mov ebx, dword [eax + 0xc]
add ebx, ecx
mov ebp, ebx
mov dword [ebx], edx
mov dword [eax + 0x14], ebp
mov edx, dword [eax + 0x44]
add ecx, edx
cmp ecx, 0x8000
jb 0x45a693
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00430be0
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
jmp 0x45a643
lea eax, [0xe4b955]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00441d50
lea eax, [0xe45dc4]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00441d50
lea eax, [0xe44798]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00441d50
mov ecx, 3
call fcn.0047b1d0
nop
call fcn.00479d50
jmp fcn.0045a5b0
Function at 0x45fdd0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x58]
mov edx, dword [eax + 0xa8]
mov ebx, dword [esp + 0x20]
lea ebp, [ecx + ebx]
cmp edx, 1
jle 0x45fdfe
mov dword [esp + 0x14], ecx
mov dword [esp + 8], ebp
mov esi, dword [eax + 0xa4]
xor edi, edi
jmp 0x45fe1a
mov dword [esp + 0x24], ebp
add esp, 0x18
ret
mov eax, dword [esp + 0x10]
lea esi, [eax + 0xc]
inc edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 8]
cmp edi, edx
jge 0x45fe4a
mov dword [esp + 0x10], esi
mov ecx, dword [esi]
mov ebp, dword [esi + 4]
cmp ebx, ecx
jb 0x45fe2f
cmp ebx, ebp
jb 0x45fe3e
lea eax, [edx - 1]
cmp edi, eax
jne 0x45fe06
cmp ebx, ebp
jne 0x45fe06
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 8]
lea ebp, [edx + ebx]
sub ebp, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 0x5c]
cmp ebp, eax
jbe 0x45fdfe
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], eax
call fcn.00443c40
lea eax, [0xe4b967]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.004444b0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00444340
lea eax, [0xe45dfc]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.004444b0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00444340
lea eax, [0xe38972]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.004444b0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00444340
call fcn.00443e50
call fcn.00443ca0
lea eax, [0xe656a5]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00441d50
nop
int3
Function at 0x461150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4612ca
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x4612c0
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x4611aa
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4611aa
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x4611bd
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x461297
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x46128b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x461282
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x461210
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x461253
mov eax, 1
cmp eax, ecx
ja 0x461247
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.0047b240
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x46127d
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x46124c
mov ecx, dword [esp + 0xc]
jmp 0x461215
call fcn.0047b1e0
xor eax, eax
mov ecx, eax
call fcn.0047b1d0
call fcn.0047b240
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x4612bb
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x461290
mov ecx, dword [esp + 0x18]
jmp 0x4611c2
call fcn.0047b1e0
xor eax, eax
mov ecx, eax
call fcn.0047b1d0
nop
call fcn.00479d50
jmp fcn.00461150
Function at 0x469410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4695fd
sub esp, 0x68
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x102
call fcn.004676b0
mov eax, dword [esp + 0x74]
test byte [eax], al
mov ecx, eax
mov eax, 0xaaaaaaab
mov edx, dword [esp + 0x70]
mov ebx, edx
mul edx
shr edx, 1
lea eax, [edx + edx*2]
sub ebx, eax
lea eax, [ecx + ebx*4 + 0xe0]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x64], ebx
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x44], ebp
mov esi, dword [esp + 0x14]
mov dword [esp + 0x40], esi
mov dword [esp], eax
call fcn.004068b0
mov eax, dword [esp + 4]
test eax, eax
je 0x46949e
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x40]
jmp 0x469526
mov eax, dword [esp + 0x74]
lea ecx, [eax + 0xe0]
mov dword [esp], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
call fcn.0046b240
movzx eax, byte [esp + 8]
test al, al
jne 0x4694cf
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x40]
jmp 0x469526
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
movzx ebx, byte [eax + 0x6e]
mov ebp, dword [esp + 0x64]
mov dword [esp], ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x40]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0x1c], 4
mov byte [esp + 0x1d], bl
call fcn.0046ad00
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x60], ebx
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x70]
mov ecx, eax
and eax, 1
mov edx, dword [esp + 0x74]
lea eax, [edx + eax*8 + 0xec]
mov edi, dword [eax]
mov esi, dword [eax + 4]
add edi, 1
mov dword [esp + 0x3c], edi
mov dword [eax], edi
adc esi, 0
mov dword [eax + 4], esi
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
mov esi, dword [esp + 0x78]
mov dword [esp], esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
call fcn.00469e50
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
lea edi, [esp + 0x48]
mov edx, eax
xor eax, eax
call fcn.0047b41a
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x50]
mov eax, dword [eax + 0x54]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x15
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.004678d0
add esp, 0x68
ret
call fcn.00479d50
jmp fcn.00469410
Function at 0x469cc0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1ae2f1c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x469daf
sub esp, 0x24
mov eax, dword [esp + 0x28]
test byte [eax], al
lea ecx, [eax + 0x200]
mov dword [esp + 0x18], ecx
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00406980
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
lea ecx, [0x469dc0]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
mov dword [esp], ecx
call fcn.00479c60
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x14], eax
nop
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00406980
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jne 0x469d5b
add esp, 0x24
ret
mov dword [esp + 0xc], eax
call fcn.00443c40
lea eax, [0xe45e18]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.004444b0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004441a0
call fcn.00443e50
call fcn.00443ca0
lea eax, [0xe55245]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00441d50
nop
call fcn.00479d50
jmp fcn.00469cc0