joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4139b0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x34]
test eax, eax
je 0x413bf1
mov ecx, dword [esp + 0x40]
cmp dword [eax], ecx
jne 0x413b2c
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x413ab4
movzx ecx, byte [0x14674f0]
test cl, cl
je 0x413a0b
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x2c], ecx
test byte [ecx], al
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
xor esi, esi
xor edi, edi
jmp 0x413a12
add esp, 0x30
ret
add esi, 4
cmp dword [eax + 4], esi
jbe 0x413ab0
test esi, 0x1f
jne 0x413a29
movzx edi, byte [edx]
inc edx
jmp 0x413a2b
shr edi, 1
test edi, 1
je 0x413a0f
mov dword [esp + 0x1c], edx
add ebp, esi
add ebx, esi
mov eax, dword [ecx + 0x988]
add eax, 8
nop
cmp dword [ecx + 0x98c], eax
jae 0x413a7a
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebx
call fcn.00434890
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [ecx + 0x988]
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
add edx, 8
mov dword [ecx + 0x988], edx
mov edx, dword [ebp]
mov dword [eax], edx
mov edx, dword [ebx]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
jmp 0x413a0f
add esp, 0x30
ret
mov dword [esp], eax
call fcn.00464c30
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
call fcn.0043bf20
lea eax, [0xd72b11]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.0043c780
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043c780
lea eax, [0xd54d1f]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043c780
call fcn.0043bf80
lea eax, [0xd6e9d1]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.0046ffd0
mov dword [esp], eax
call fcn.00464c30
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x34]
mov edx, dword [edx]
mov dword [esp + 0x18], edx
call fcn.0043bf20
lea eax, [0xd72b11]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.0043c780
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043c780
lea eax, [0xd4fda6]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043c780
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c470
lea eax, [0xd5859c]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0043c780
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c470
call fcn.0043c120
call fcn.0043bf80
lea eax, [0xd6e9d1]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.0046ffd0
lea eax, [0xd73b8c]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.0046ffd0
nop
int3
Function at 0x417790
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41798e
sub esp, 0x18
mov eax, dword [0x1466f08]
test eax, eax
jne 0x417977
nop
nop
lea eax, [0x1466ef8]
mov dword [esp], eax
call fcn.0040de00
mov eax, dword [0x1466efc]
test eax, eax
je 0x4177d8
cmp dword [eax + 8], 0xcc
jne 0x41784e
mov edx, dword [0x1466f00]
test edx, edx
jne 0x417830
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x146cfd0]
mov dword [esp + 8], eax
call fcn.0040f990
mov eax, dword [esp + 0xc]
mov dword [0x1466f00], eax
mov ecx, dword [0x1466f04]
mov dword [eax], ecx
mov eax, dword [0x1466f00]
mov dword [0x1466f04], eax
movzx eax, byte [0x1467aa0]
test al, al
jne 0x417830
xor eax, eax
jmp 0x417948
mov edx, dword [0x1466f00]
mov ebx, dword [edx + 4]
mov dword [0x1466f00], ebx
mov ebx, dword [0x1466efc]
mov dword [edx + 4], ebx
mov dword [0x1466efc], edx
mov edx, dword [0x1466efc]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x417927
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0047d3a0
mov eax, dword [0x14674f0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x4178a0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x4178e0
call fcn.00476ee0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x1466ef8]
mov dword [esp], eax
call fcn.0040e020
nop
lea eax, [0x1466ef4]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.0047d530
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00476f00
lea edx, [0x13d10a0]
movzx ebx, byte [edx + eax]
lea ebp, [0x1467aa0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x417830
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x417931
mov ecx, 5
call fcn.00476ef0
lea eax, [0xd60144]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046ffd0
nop
call fcn.00475a70
jmp fcn.00417790
Function at 0x41c9b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41ca39
sub esp, 0x10
mov eax, dword [esp + 0x14]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.0047d250
movzx eax, byte [esp + 0xc]
test al, al
je 0x41ca1e
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x41ca22
mov dword [esp], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.0041ca50
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0041d000
add esp, 0x10
ret
add esp, 0x10
ret
lea eax, [0xd6015c]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046ffd0
nop
call fcn.00475a70
jmp fcn.0041c9b0
Function at 0x4263f0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4264d0
sub esp, 0xc
mov eax, dword [esp + 0x10]
movzx ecx, word [eax]
movzx edx, cx
mov ebx, dword [esp + 0x14]
add edx, ebx
cmp edx, 0x200
ja 0x42644d
mov edx, dword [esp + 0x18]
cmp dword [eax + 4], edx
je 0x42642f
mov word [eax + 2], cx
mov dword [eax + 4], edx
movzx ecx, word [eax]
add ecx, ebx
mov word [eax], cx
cmp cx, 0x200
jne 0x426449
movzx ecx, byte [eax + 8]
and ecx, 0xfffffffe
nop
mov byte [eax + 8], cl
add esp, 0xc
ret
mov word [esp + 0xa], cx
call fcn.0043bf20
lea eax, [0xd54d5b]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043c780
movzx eax, word [esp + 0xa]
movzx eax, ax
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c470
lea eax, [0xd4c664]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.0043c780
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c470
call fcn.0043c120
call fcn.0043bf80
lea eax, [0xd6c7a8]
mov dword [esp], eax
mov dword [esp + 4], 0x22
call fcn.0046ffd0
nop
call fcn.00475a70
jmp fcn.004263f0

Function at 0x4264e0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4265b3
sub esp, 0xc
mov eax, dword [esp + 0x10]
movzx ecx, word [eax]
movzx edx, cx
mov ebx, dword [esp + 0x14]
cmp ebx, edx
ja 0x426530
mov edx, dword [esp + 0x18]
cmp dword [eax + 4], edx
je 0x426519
mov word [eax + 2], cx
mov dword [eax + 4], edx
movzx ecx, word [eax]
sub ecx, ebx
mov word [eax], cx
movzx ecx, byte [eax + 8]
or ecx, 1
nop
mov byte [eax + 8], cl
add esp, 0xc
ret
mov word [esp + 0xa], cx
call fcn.0043bf20
lea eax, [0xd54d5b]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043c780
movzx eax, word [esp + 0xa]
movzx eax, ax
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c470
lea eax, [0xd4c664]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.0043c780
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c470
call fcn.0043c120
call fcn.0043bf80
lea eax, [0xd639e6]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.0046ffd0
nop
call fcn.00475a70
jmp fcn.004264e0
Function at 0x42c7c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42c99a
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42c8c5
cmp cl, 1
je 0x42c854
cmp cl, 2
jne 0x42c983
mov ecx, dword [eax + 8]
test byte [ecx], al
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.0047d2f0
nop
nop
lea eax, [0x1453588]
mov dword [esp], eax
call fcn.0040de00
mov eax, dword [0x145357c]
sub eax, dword [0x1453560]
nop
mov dword [0x145357c], eax
mov eax, dword [0x145356c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x145356c], ecx
nop
lea eax, [0x1453588]
mov dword [esp], eax
call fcn.0040e020
jmp 0x42c97f
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00417790
nop
nop
lea eax, [0x1453588]
mov dword [esp], eax
call fcn.0040de00
mov eax, dword [0x14534dc]
sub eax, dword [0x14534c0]
nop
mov dword [0x14534dc], eax
mov eax, dword [0x14534cc]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x14534cc], ecx
nop
lea eax, [0x1453588]
mov dword [esp], eax
call fcn.0040e020
jmp 0x42c97f
cmp cl, 3
je 0x42c927
cmp cl, 4
jne 0x42c8d8
mov byte [eax + 8], 1
jmp 0x42c97f
cmp cl, 5
jne 0x42c983
nop
nop
lea eax, [0x1453588]
mov dword [esp], eax
call fcn.0040de00
mov eax, dword [0x1453554]
sub eax, dword [0x1453538]
nop
mov dword [0x1453554], eax
mov eax, dword [0x1453544]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x1453544], ecx
nop
lea eax, [0x1453588]
mov dword [esp], eax
call fcn.0040e020
jmp 0x42c97f
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00431dc0
nop
nop
lea eax, [0x1453588]
mov dword [esp], eax
call fcn.0040de00
mov eax, dword [0x1453504]
sub eax, dword [0x14534e8]
nop
mov dword [0x1453504], eax
mov eax, dword [0x14534f4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x14534f4], ecx
nop
nop
lea eax, [0x1453588]
mov dword [esp], eax
call fcn.0040e020
add esp, 0x14
ret
lea eax, [0xd55f4a]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0046ffd0
nop
call fcn.00475a70
jmp fcn.0042c7c0
Function at 0x42e6a0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x42e8fa
sub esp, 0x24
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0x34]
mov ebx, eax
shr ebx, 0x16
cmp dword [edx + 0x3c], ebx
jbe 0x42e7eb
and eax, 0x3fffff
shr eax, 0xd
lea ebp, [eax - 0x200]
xchg ebp, ebx
neg ebx
xchg ebp, ebx
mov esi, dword [esp + 0x2c]
cmp esi, ebp
ja 0x42e765
mov ecx, dword [edx + 0x28]
cmp ecx, ebx
jbe 0x42e8f2
mov ecx, dword [edx + 0x24]
lea ecx, [ecx + ebx*8]
mov ebp, dword [ecx + 4]
test ebp, 0x80000000
je 0x42e70b
mov ecx, 0x40000
jmp 0x42e71b
mov ecx, dword [ecx]
shl ebp, 0xe
shr ecx, 0x12
or ecx, ebp
and ecx, 0x3ffff
cmp esi, ecx
ja 0x42e765
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ecx
mov ecx, dword [edx + 0x30]
test byte [ecx], al
shl ebx, 7
add ecx, ebx
mov dword [esp], ecx
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call fcn.00430b80
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x42e7ff
mov ecx, dword [esp + 0x10]
shl eax, 0xd
shl ecx, 0xd
mov edx, dword [esp + 0x20]
shl edx, 0x16
add eax, edx
add ecx, edx
jmp 0x42e7a7
mov dword [esp], edx
mov dword [esp + 4], esi
call fcn.0042d9a0
mov eax, dword [esp + 8]
test eax, eax
jne 0x42e7a3
mov eax, dword [esp + 0x2c]
cmp eax, 1
jne 0x42e78f
mov eax, dword [0x13d0f74]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x34], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x24
ret
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x28]
mov dword [esp], edx
mov dword [esp + 4], eax
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebx
call fcn.0042d5e0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
cmp dword [edx + 0x34], ecx
jae 0x42e7db
mov dword [edx + 0x34], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
add esp, 0x24
ret
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x24
ret
call fcn.0043bf20
lea eax, [0xd54d6a]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043c780
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c470
lea eax, [0xd4fe35]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043c780
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c470
call fcn.0043c120
call fcn.0043bf80
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x34]
mov dword [esp + 0x20], eax
and eax, 0x3fffff
shr eax, 0xd
mov dword [esp + 0x1c], eax
call fcn.0043bf20
lea eax, [0xd5c3c6]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.0043c780
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c470
lea eax, [0xd5729b]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.0043c780
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c610
call fcn.0043c120
call fcn.0043bf80
lea eax, [0xd55f5a]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0046ffd0
mov eax, ebx
call fcn.00476f00
nop
call fcn.004724e0
jmp fcn.0042e6a0
Function at 0x431e90
Capabilities:
Access peb ldr_data
Get geographical location

Disassembly:
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x432012
sub esp, 0x24
mov eax, dword [0x14679fc]
test eax, eax
je 0x431fbd
mov eax, dword [esp + 0x38]
cmp eax, 5
jg 0x431fc8
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov edx, dword [ecx + 0x18]
mov dword [esp + 0x20], edx
mov ebx, dword [edx + 0x50]
test ebx, ebx
je 0x431f16
cmp ecx, ebx
je 0x431f16
mov ecx, dword [edx + 0x17c]
mov ebp, dword [edx + 0x180]
mov esi, dword [edx + 0x178]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebp
call fcn.0045dd40
mov eax, dword [esp + 0x14]
jmp 0x431f40
mov ecx, dword [edx + 0x178]
mov ebx, dword [edx + 0x17c]
mov ebp, dword [edx + 0x180]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call fcn.00474d20
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
mov edx, dword [ebx + 0x180]
cmp eax, edx
ja 0x431fc1
mov ecx, dword [ebx + 0x178]
mov ebp, dword [esp + 0x28]
mov dword [esp], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x30]
mov dword [esp + 8], ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.004328d0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x14670ec]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x431fb9
movzx eax, byte [ebx + 0x69]
test al, al
je 0x431fb9
mov dword [ebx + 8], 0xfffffade
add esp, 0x24
ret
add esp, 0x24
ret
mov ecx, eax
call fcn.00476f30
call fcn.0043bf20
lea eax, [0xd54d79]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043c780
mov eax, dword [esp + 0x38]
mov dword [esp], eax
sar eax, 0x1f
mov dword [esp + 4], eax
call fcn.0043c5a0
call fcn.0043bf80
lea eax, [0xd585e4]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0046ffd0
nop
call fcn.00475a70
jmp fcn.00431e90
Function at 0x4380e0
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 8
mov dword [esp + 0x30], 0
mov eax, dword [0x14670ec]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x1b0], 8
lea ecx, [esp + 0x10]
mov dword [eax + 0x1b4], ecx
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00437dc0
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
add esp, 8
ret

Function at 0x439cc0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x439e6c
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx edx, byte [eax + 0x32]
mov ebx, dword [0x14670ec]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
test dl, dl
jne 0x439d03
cmp dword [ebx + 0x10], eax
jne 0x439e55
movzx edx, byte [eax + 0x30]
test dl, dl
jne 0x439e31
mov edx, dword [0x14674f0]
mov ebp, dword [eax + 0x14]
test edx, edx
je 0x439d1c
call fcn.00476e80
mov dword [edi], ebp
mov edx, dword [eax]
mov dword [edi + 4], edx
mov dword [esp + 8], ebx
mov dword [eax], ebp
jmp 0x439d2c
mov ebx, dword [esp + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0x28]
test edx, edx
je 0x439ddb
movzx ebp, byte [edx]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x439d73
mov ecx, dword [0x14674f0]
test ecx, ecx
je 0x439d54
mov ecx, dword [eax + 0x28]
call fcn.00476e70
mov dword [edi], ecx
mov dword [eax + 0x28], 0
jmp 0x439ddb
mov dword [esp], eax
call fcn.00439e80
movzx eax, byte [esp + 4]
test al, al
jne 0x439d24
jmp 0x439e20
xchg ebp, eax
movzx ebx, al
xchg ebp, eax
lea esi, [0xd8a723]
movzx ebx, byte [esi + ebx]
add ebx, 0xfffffff8
neg ebx
lea ecx, [ebx - 7]
neg ecx
mov ebx, 1
shl ebx, cl
cmp ecx, 0x20
sbb esi, esi
and esi, ebx
xchg esi, ebx
not ebx
xchg esi, ebx
and esi, ebp
xchg esi, eax
mov byte [edx], al
xchg esi, eax
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 1
add esp, 0x10
ret
mov dword [esp], ecx
call fcn.00439290
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.004395c0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
mov eax, ecx
mov ebx, dword [esp + 8]
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x439d5d
mov edx, dword [eax + 0x18]
cmp dword [ecx + 4], edx
jne 0x439d5d
movzx edx, byte [ecx + 1]
test dl, dl
jne 0x439db9
mov edx, dword [ecx + 0xc]
mov dword [esp + 0xc], edx
mov ecx, dword [ecx + 8]
mov dword [eax + 0x24], ecx
mov dword [esp], ebx
call fcn.004395c0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 1
add esp, 0x10
ret
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 0
add esp, 0x10
ret
lea eax, [0xd93e00]
mov dword [esp], eax
call fcn.00475920
lea eax, [0xd54d97]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0046ffd0
lea eax, [0xd54d88]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0046ffd0
nop
call fcn.00475a70
jmp fcn.00439cc0
Function at 0x43e100
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43e1d3
sub esp, 0x14
mov eax, dword [0x1449608]
mov dword [esp + 0x10], eax
mov ecx, dword [0x1449618]
mov dword [esp + 0xc], ecx
lea edx, [0x14670e8]
mov dword [esp], edx
call fcn.0047d220
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
sub eax, ecx
sub eax, dword [esp + 4]
mov dword [esp + 8], eax
lea ecx, [0x1466f78]
mov dword [esp], ecx
call fcn.0047d220
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
mov ecx, dword [0x1449610]
cmp ecx, eax
jl 0x43e16f
add esp, 0x14
ret
mov dword [esp + 8], ecx
call fcn.0043bf20
lea eax, [0xd613d7]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.0043c780
mov eax, dword [esp + 8]
mov dword [esp], eax
sar eax, 0x1f
mov dword [esp + 4], eax
call fcn.0043c5a0
lea eax, [0xd53d0c]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043c780
call fcn.0043bf80
lea eax, [0xd572df]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.0046ffd0
nop
call fcn.00475a70
jmp fcn.0043e100
Function at 0x441670
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x14670ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x441788
sub esp, 0x10
mov eax, dword [0x14670ec]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x7c]
test edx, edx
jne 0x441771
mov edx, dword [ecx + 0x58]
test edx, edx
jne 0x44175b
movzx ecx, byte [ecx + 0x88]
test cl, cl
jne 0x441745
mov dword [esp + 0xc], eax
nop
nop
lea eax, [0x14495f8]
mov dword [esp], eax
call fcn.0040de00
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov dword [esp], ecx
call fcn.00449fa0
nop
nop
lea eax, [0x14495f8]
mov dword [esp], eax
call fcn.0040e020
mov eax, dword [0x14670ec]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0xac
nop
mov dword [esp], ecx
call fcn.0040e1a0
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x18]
mov dword [eax + 0xac], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x5c]
mov dword [esp], ecx
call fcn.00447ff0
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x5c], 0
add esp, 0x10
ret
lea eax, [0xd53d1a]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0046ffd0
lea eax, [0xd54da6]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0046ffd0
lea eax, [0xd59b2d]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.0046ffd0
nop
call fcn.00475a70
jmp fcn.00441670