joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414300
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4144fb
sub esp, 0x28
mov eax, dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x1000
mov dword [esp + 0x10], 4
call fcn.0042dfd0
mov eax, dword [esp + 0x2c]
mov ecx, eax
cmp dword [esp + 0x14], eax
je 0x414404
mov eax, dword [esp + 0x30]
mov edx, eax
jmp 0x414386
shr eax, 1
and eax, 0xfffff000
mov dword [esp + 0x18], eax
cmp eax, 0x1000
jae 0x4143b8
xor ebp, ebp
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x41435f
cmp eax, 0x1000
jb 0x414396
sub ebx, eax
add ecx, eax
mov eax, ebx
test eax, eax
jbe 0x414400
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], ecx
mov ebx, eax
jmp 0x414366
call fcn.0045a2f0
mov eax, dword [esp]
mov dword [esp + 0x20], eax
cmp eax, 8
je 0x414481
cmp eax, 0x5af
je 0x414481
jmp 0x414408
mov edx, dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x1000
mov dword [esp + 0x10], 4
call fcn.0042dfd0
mov eax, dword [esp + 0x14]
test eax, eax
xchg ebp, ebx
sete bl
xchg ebp, ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
jmp 0x414373
add esp, 0x28
ret
add esp, 0x28
ret
call fcn.00432510
lea eax, [0x7f14b2]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00432db0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00432ac0
lea eax, [0x7f0ad5]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00432db0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00432ac0
call fcn.00432730
call fcn.00432580
lea eax, [0x7f5305]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00430c90
call fcn.00432510
lea eax, [0x7f14b2]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00432db0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00432ac0
lea eax, [0x7f0ad5]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00432db0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00432ac0
call fcn.00432730
call fcn.00432580
lea eax, [0x7e819d]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.00414300
Function at 0x414510
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00429d50
mov eax, dword [sym.imp.kernel32.dll_VirtualFree]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x8000
call fcn.0042df90
mov eax, dword [esp + 0x10]
test eax, eax
je 0x414559
add esp, 0x18
ret
call fcn.0045a2f0
mov eax, dword [esp]
mov dword [esp + 0x14], eax
call fcn.00432510
lea eax, [0x7f093d]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00432db0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00432ac0
lea eax, [0x7f0ad5]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00432db0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00432ac0
call fcn.00432730
call fcn.00432580
lea eax, [0x7f5b56]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00430c90
nop
int3
Function at 0x414700
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41491c
sub esp, 0x18
mov eax, dword [0xb532bc]
test eax, eax
jne 0x414905
lea eax, [0xb532a8]
mov dword [esp], eax
call fcn.004089b0
mov eax, dword [0xb402e4]
test eax, eax
je 0x41474c
cmp dword [eax + 8], 0xcc
jne 0x414814
mov edx, dword [0xb402dc]
test edx, edx
jne 0x4147f6
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0xb55558]
mov dword [esp + 8], eax
call fcn.0040ad90
mov eax, dword [esp + 0xc]
mov dword [0xb402dc], eax
mov ecx, dword [0xb402b8]
mov dword [eax], ecx
mov eax, dword [0xb402dc]
mov dword [0xb402b8], eax
movzx eax, byte [0xb53720]
test al, al
jne 0x4147f6
xor eax, eax
jmp 0x4147b3
lea esi, [0xb53720]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x4147f6
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x4148fb
lea edx, [0xb05160]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x4147a5
jmp 0x4148ef
mov edx, dword [0xb402dc]
mov ebx, dword [edx + 4]
mov dword [0xb402dc], ebx
mov ebx, dword [0xb402e4]
mov dword [edx + 4], ebx
mov dword [0xb402e4], edx
mov edx, dword [0xb402e4]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4148e5
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004020f0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0xb53500]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x4148d6
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0xb53500]
test edx, edx
jne 0x4148b3
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0xb53231], 1
lea eax, [0xb532a8]
mov dword [esp], eax
call fcn.00408b90
add esp, 0x18
ret
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00459620
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00459620
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00459620
jmp 0x41489a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00459620
mov eax, edx
jmp 0x414870
mov ecx, 0xcc
call fcn.004596b0
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.004596a0
mov ecx, 5
call fcn.004596a0
lea eax, [0x7f08dd]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.00414700
Function at 0x41e700
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41e858
sub esp, 0x18
mov edx, dword [esp + 0x20]
lea ebx, [edx - 1]
test edx, ebx
jne 0x41e808
test edx, edx
je 0x41e808
cmp edx, 0x40
ja 0x41e7b9
mov ebx, dword [esp + 0x1c]
mov eax, 7
jmp 0x41e757
mov ebp, dword [esp + 0x14]
lea eax, [ebp - 1]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edx, esi
mov ebx, ebp
test eax, eax
jl 0x41e7a6
test byte [ebx], al
cmp eax, 8
jae 0x41e7af
mov dword [esp + 0x14], eax
lea ecx, [ebx + eax*8 + 0x40]
mov ebp, dword [ecx]
mov ecx, dword [ecx + 4]
lea esi, [ebx + eax*8]
or ecx, dword [esi + 4]
or ebp, dword [esi]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.0041e450
cmp dword [esp + 0x10], 0xffffffff
setne al
cmp dword [esp + 0xc], 0xffffffff
setne cl
or eax, ecx
test al, al
je 0x41e744
mov byte [esp + 0x24], 1
add esp, 0x18
ret
mov byte [esp + 0x24], 0
add esp, 0x18
ret
mov ecx, 8
call fcn.004596a0
call fcn.00432510
lea eax, [0x7e9a90]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00432db0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00432ac0
call fcn.00432730
call fcn.00432580
lea eax, [0x7e8142]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00430c90
call fcn.00432510
lea eax, [0x7e9a90]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00432db0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00432ac0
call fcn.00432730
call fcn.00432580
lea eax, [0x7f6359]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.0041e700
Function at 0x4233a0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42347d
sub esp, 0x14
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x4233f4
mov edx, dword [eax + 4]
test edx, edx
jne 0x4233f4
mov edx, dword [eax + 8]
test edx, edx
jne 0x4233f4
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx]
test edx, edx
je 0x4233ef
mov dword [edx + 4], eax
mov dword [ecx], eax
mov dword [eax + 8], ecx
add esp, 0x14
ret
mov dword [ecx + 4], eax
jmp 0x4233e6
mov ecx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 8]
mov dword [esp + 8], edx
call fcn.00432510
lea eax, [0x7f64e5]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00432db0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00432d70
call fcn.004326f0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00432d70
call fcn.004326f0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00432d70
call fcn.004326f0
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00432d70
call fcn.00432730
call fcn.00432580
lea eax, [0x7ea75e]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.004233a0

Function at 0x423c00
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423d09
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x423c87
cmp cl, 2
jne 0x423cf2
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00428ad0
lea eax, [0xb47290]
mov dword [esp], eax
call fcn.004089b0
nop
mov eax, dword [0xb47284]
sub eax, dword [0xb4726c]
mov dword [0xb47284], eax
mov eax, dword [0xb47278]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xb47278], ecx
lea eax, [0xb47290]
mov dword [esp], eax
call fcn.00408b90
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00414700
lea eax, [0xb47290]
mov dword [esp], eax
call fcn.004089b0
nop
mov eax, dword [0xb47260]
sub eax, dword [0xb47248]
mov dword [0xb47260], eax
mov eax, dword [0xb47254]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xb47254], ecx
lea eax, [0xb47290]
mov dword [esp], eax
call fcn.00408b90
jmp 0x423c83
lea eax, [0x7ea4ae]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.00423c00
Function at 0x424060
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424114
sub esp, 0x14
mov eax, dword [0xb41244]
test eax, eax
je 0x4240b9
mov dword [esp + 0x10], eax
mov ecx, dword [eax + 4]
mov dword [0xb41244], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x10000
call fcn.00459de0
mov eax, dword [esp + 0x10]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [esp + 0x18], eax
add esp, 0x14
ret
lea eax, [0xb41240]
mov dword [esp], eax
call fcn.00408b90
mov dword [esp], 0x10000
lea eax, [0xb55558]
mov dword [esp + 4], eax
call fcn.00414140
mov eax, dword [esp + 8]
test eax, eax
je 0x4240fd
mov dword [esp + 0xc], eax
lea eax, [0xb41240]
mov dword [esp], eax
call fcn.004089b0
mov eax, dword [esp + 0xc]
jmp 0x4240a4
lea eax, [0x7f52e6]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.00424060

Function at 0x424120
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424253
sub esp, 0xc
mov ecx, dword [0xb05820]
cmp ecx, 0x12
ja 0x4241b9
mov ecx, dword [esp + 0x10]
test byte [ecx], al
mov edx, dword [0xb53500]
test edx, edx
jne 0x4241ab
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x5c], eax
lea edx, [ecx + 0x48]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00429460
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00425dd0
mov eax, dword [esp + 0x10]
mov dword [eax + 0x34], 0xffffffff
mov dword [eax + 0x38], 0
mov ecx, dword [0xb53500]
test ecx, ecx
jne 0x42419d
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x58], ecx
add esp, 0xc
ret
lea edi, [eax + 0x58]
mov eax, dword [esp + 0x14]
call fcn.00459620
jmp 0x424199
lea edi, [ecx + 0x5c]
mov eax, dword [esp + 0x18]
call fcn.00459620
jmp 0x42415b
mov dword [esp + 8], ecx
call fcn.00432510
lea eax, [0x7f5bb6]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00432db0
mov ecx, dword [esp + 8]
cmp ecx, 0x20
sbb eax, eax
mov edx, 1
shl edx, cl
and edx, eax
mov dword [esp], edx
sar edx, 0x1f
mov dword [esp + 4], edx
call fcn.00432bf0
call fcn.00432730
call fcn.00432580
call fcn.00432510
lea eax, [0x7f3eed]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00432db0
mov dword [esp], 0x40000
mov dword [esp + 4], 0
call fcn.00432bf0
call fcn.00432730
call fcn.00432580
lea eax, [0x7fa6e8]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.00424120
Function at 0x429d50
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
test eax, eax
je 0x429dfb
xor ecx, ecx
mov edx, dword [esp + 0x18]
sub ecx, edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00402070
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
lea edx, [eax + ecx]
cmp edx, ecx
jb 0x429d86
add esp, 0x10
ret
mov dword [esp + 0xc], eax
call fcn.00432510
lea eax, [0x7f3eb3]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00432db0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00432ac0
lea eax, [0x7e3566]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00432db0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00432ac0
call fcn.00432730
call fcn.00432580
mov dword [esp], 2
call fcn.0042d2a0
jmp 0x429d82
add esp, 0x10
ret

Function at 0x429e00
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x429e62
sub esp, 8
mov eax, dword [esp + 0xc]
lea ecx, [eax + 8]
mov dword [eax], ecx
movzx edx, byte [0xb53505]
test dl, dl
je 0x429e40
lea ecx, [eax + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
test ecx, 7
jne 0x429e4b
add esp, 8
ret
add ecx, 0x800
mov dword [eax + 4], ecx
jmp 0x429e2f
lea eax, [0x7f4fc0]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.00429e00
Function at 0x42fc90
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x14]
test edx, edx
je 0x42fdd2
lea ebx, [esp + 0x24]
cmp dword [edx + 8], ebx
jne 0x42fdce
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], edx
lea edi, [ecx + 0x14]
mov dword [esp + 0x14], edi
movzx ebx, byte [edx + 6]
test bl, bl
jne 0x42fd88
mov ebx, dword [edx]
test ebx, ebx
jne 0x42fd48
mov ebx, dword [edx + 0x10]
mov ebp, dword [0xb53500]
test ebp, ebp
jne 0x42fd34
mov dword [edx + 0x10], 0
mov dword [esp + 0x10], ebx
test byte [ecx], al
mov ebp, dword [0xb53500]
mov eax, dword [edx + 0x18]
test ebp, ebp
jne 0x42fd2d
mov dword [ecx + 0x14], eax
mov dword [esp], edx
call fcn.0042fa20
mov eax, dword [esp + 0x10]
test byte [eax], al
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.00458fb0
add esp, 0x20
ret
call fcn.00459620
jmp 0x42fd03
lea ebp, [edx + 0x10]
mov eax, edi
mov edi, ebp
mov esi, eax
xor eax, eax
call fcn.00459620
mov edi, esi
jmp 0x42fced
cmp ebx, 4
jne 0x42fd5f
lea ebx, [edx + 0x28]
test byte [ebx], al
mov ebx, dword [edx + 0x28]
nop
mov dword [esp + 0x24], ebx
jmp 0x42fcd9
nop
lea eax, [esp + 0x24]
mov dword [esp], eax
lea ecx, [edx + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.00459fc0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
jmp 0x42fcd9
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.004301a0
movzx eax, byte [esp + 8]
test al, al
je 0x42fdd6
mov ecx, dword [esp + 0xc]
test byte [ecx], al
mov edx, dword [0xb53500]
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
test edx, edx
jne 0x42fdc3
mov dword [ecx + 0x14], eax
mov dword [esp], ebx
call fcn.0042fa20
add esp, 0x20
ret
mov edi, dword [esp + 0x14]
call fcn.00459620
jmp 0x42fdb7
add esp, 0x20
ret
add esp, 0x20
ret
lea eax, [0x7fa86b]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00430c90
nop
int3
Function at 0x436f90
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4370c4
sub esp, 0xc
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0xc0]
test edx, edx
je 0x4370ad
mov edx, dword [edx + 0x84]
cmp edx, ecx
jne 0x4370ad
mov dword [esp + 8], eax
mov ecx, dword [ecx + 0x54]
test ecx, ecx
jne 0x43705c
mov dword [esp], 1
call fcn.0043bfb0
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0xb0
mov dword [esp], ecx
call fcn.00408d10
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0xb0], 0
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0xc0]
test byte [ecx], al
add ecx, 0x48
mov dword [esp], ecx
call fcn.00401fc0
mov eax, dword [esp + 4]
and eax, 0xffffefff
cmp eax, 1
jne 0x43706b
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp], ecx
call fcn.0043bc30
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x58], 0
add esp, 0xc
ret
call fcn.0043bdc0
call fcn.00436c50
jmp 0x436fe0
call fcn.00432510
lea eax, [0x7fdb83]
mov dword [esp], eax
mov dword [esp + 4], 0x39
call fcn.00432db0
call fcn.00432580
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00434360
lea eax, [0x7f1548]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00430c90
lea eax, [0x7f660e]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.00436f90
Function at 0x4384c0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x438572
sub esp, 0xc
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
movzx ecx, byte [eax + 0x84]
test cl, cl
je 0x43855b
mov byte [eax + 0x84], 0
lea eax, [0xb41a2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.004020f0
mov eax, dword [esp + 8]
test eax, eax
jl 0x438545
je 0x43852c
xor eax, eax
test al, al
jne 0x438525
add esp, 0xc
ret
call fcn.00436f30
jmp 0x438521
lea eax, [0xb41a28]
mov dword [esp], eax
call fcn.00401fc0
mov eax, dword [esp + 4]
test eax, eax
seta al
jmp 0x43851d
lea eax, [0x7f61cd]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00430c90
lea eax, [0x7f52c7]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.004384c0
Function at 0x439840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
call fcn.00439800
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x1c]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.00434d10
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
jbe 0x439a26
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea ecx, [0x456fd0]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
mov dword [esp], ecx
call fcn.00457cc0
movzx eax, byte [0xb4b188]
test al, al
jne 0x4399ff
lea eax, [0xb41a8c]
mov dword [esp], eax
call fcn.00401fc0
mov eax, dword [esp + 4]
test eax, eax
jne 0x4399d8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
test byte [ecx], al
mov ecx, dword [ecx + 0x13f0]
test ecx, ecx
jne 0x4399ad
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x164], edx
mov byte [eax + 0x6f], 1
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0xbc], 0
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [ecx + 0x2c], 0
mov edx, dword [eax + 0x18]
mov ebx, ecx
mov dword [edx + 0x5c], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x54], 0
lea ecx, [ebx + 4]
mov dword [esp], ecx
mov dword [esp + 4], 2
call fcn.004021b0
mov eax, dword [0xb41a80]
test eax, eax
jne 0x439989
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
add esp, 0x18
ret
lea eax, [0x806024]
mov dword [esp], eax
call fcn.00457cc0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00439800
jmp 0x43997b
lea eax, [0x806128]
mov dword [esp], eax
call fcn.00457cc0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00439800
mov eax, dword [esp + 0xc]
jmp 0x43991f
lea eax, [0x806028]
mov dword [esp], eax
call fcn.00457cc0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00439800
jmp 0x439905
lea eax, [0x806174]
mov dword [esp], eax
call fcn.00457cc0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00439800
jmp 0x4398eb
cmp dword [eax + 4], ecx
jb 0x4398b2
jmp 0x4398dc
Function at 0x43dee0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x1a0]
cmp eax, dword [ecx + 8]
jbe 0x43e090
sub esp, 0x220
lea edi, [esp + 0x1c]
mov ecx, 0x81
xor eax, eax
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x230]
mov ebx, dword [esp + 0x22c]
sub edx, ebx
shr edx, 1
cmp edx, 0x80
jne 0x43e079
mov eax, dword [esp + 0x224]
xor ecx, ecx
jmp 0x43df53
test byte [eax], al
lea ebp, [ecx + ebx]
and ebp, 0xff
mov ebp, dword [eax + ebp*4 + 0x320]
lea esi, [esp + 0x1c]
mov dword [esi + ecx*4], ebp
inc ecx
cmp ecx, edx
jb 0x43df39
mov dword [esp + 0x10], edx
test byte [eax], al
add eax, 0x318
mov dword [esp], eax
mov dword [esp + 4], ebx
lea eax, [edx + ebx]
mov dword [esp + 8], eax
call fcn.00402030
movzx eax, byte [esp + 0xc]
test al, al
je 0x43e05e
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x228]
lea ebp, [esp + 0x1c]
mov dword [ebp + edx*4], ebx
xor eax, eax
jmp 0x43dfa2
mov edi, dword [ebp + eax*4 + 4]
mov dword [ebx + 0x58], edi
mov eax, esi
cmp eax, edx
jae 0x43dfbc
mov ebx, dword [ebp + eax*4]
test byte [ebx], al
lea esi, [eax + 1]
cmp esi, 0x81
jb 0x43df99
jmp 0x43e06d
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + edx*4]
mov dword [esp + 0x18], eax
lea eax, [0xb419f8]
mov dword [esp], eax
call fcn.004089b0
nop
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
test eax, eax
jne 0x43e038
mov eax, dword [0xb41a38]
mov ecx, dword [esp + 0x10]
lea eax, [eax + ecx + 1]
mov dword [0xb41a38], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
lea eax, [0xb419f8]
mov dword [esp], eax
call fcn.00408b90
mov byte [esp + 0x234], 1
add esp, 0x220
ret
mov edx, eax
mov dword [eax + 0x58], 0
mov eax, dword [0xb41a34]
test eax, eax
je 0x43e056
mov dword [eax + 0x58], ecx
mov dword [0xb41a34], edx
jmp 0x43dff7
mov dword [0xb41a30], ecx
jmp 0x43e04e
mov byte [esp + 0x234], 0
add esp, 0x220
ret
mov eax, esi
mov ecx, 0x81
call fcn.004596b0
lea eax, [0x7f4909]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00430c90
nop
call fcn.00457de0
jmp fcn.0043dee0