joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop ebp
ret

Function at 0x401cf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0xae5fa0
push eax
push dword fs:[0]
pop edi
scasb al, byte es:[edi]
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
mov ecx, 0xd4e4027f
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
mov ebx, 0xa4e81020
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [edi], edx
stosd dword es:[edi], eax
loop 0x4010a6
shr byte [edx - 0x45d61c4d], 1
arpl word [edi - 0x278de9a], dx
sub dword [edx + 0x21669763], edi
xchg ebp, edi
jo 0x4010b7
adc byte [ebx - 0x7b], dh
jae 0x40102e
xlatb
in al, dx
scasd eax, dword es:[edi]
rol dword [0xffffd0cf], 1
fisub dword [edx + 0x3d]
xchg edi, eax
xchg ebp, eax
push 0xa7e35ce0
iretd
loopne 0x401115
jecxz 0x401062
jmp 0x4010fb
inc edi
inc ebp
invalid
mov eax, dword [edi]
jmp 0x4010de
push es
aas
dec esp
sbb al, 0xb2
or ecx, esi
pushal
jp 0x40110e
xchg dword [edi], edi
push ebp
arpl word [edx], bx
xchg ebp, eax
and dword [ecx + 0x73], 0x27
push esi
leave
adc bh, byte [0xf1cfcb47]
mov ecx, dword [esi + 0x2afe0d5e]
push ebx
lcall 0x58e9, 0xe192ed67
pop eax
outsb dx, byte [esi]
sub byte [eax + 0x15], ah
mov ecx, 0x775fedc3
test byte [eax + 0x35], ch
setb byte [edi + eax*8 - 0x62]
inc edi
in eax, dx
sub cl, byte [eax - 0x71]
jbe 0x401126
dec edi
iretd
Function at 0x4036f0
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4038c0
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.004730d0
jmp fcn.004036f0
Function at 0x409a80
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409b7d
sub esp, 0x20
mov eax, dword [0x13d411c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x6c]
test eax, eax
jne 0x409b66
mov eax, dword [0x139f454]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov ebx, edx
shr edx, 2
lea edx, [edx + edx*2]
cmp ecx, edx
jb 0x409b3c
mov dword [esp + 0x10], eax
shl ebx, 1
lea eax, [ebx + 2]
shl eax, 2
mov dword [esp], eax
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.004689b0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [eax], edx
lea edx, [0x477e40]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x18]
mov dword [esp], edx
call fcn.0040a670
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x10]
cmp dword [edx + 4], ecx
jne 0x409b50
lea ecx, [0x139f454]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00404d30
mov eax, dword [0x139f454]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00409b90
add esp, 0x20
ret
lea eax, [0x8b1529]
mov dword [esp], eax
mov dword [esp + 4], 0x27
call fcn.0046daf0
lea eax, [0x89f317]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0046daf0
nop
call fcn.004730d0
jmp fcn.00409a80
Function at 0x40c280
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40c44b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40c2a9
mov eax, 0x7000000
jmp 0x40c2b1
test eax, eax
je 0x40c426
mov dword [esp + 0x34], eax
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x448]
mov ebx, dword [ecx + 0x44c]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x448], ebx
mov dword [ecx + 0x44c], ebp
mov dword [esp], edx
call fcn.00474480
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x1345840]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40c43e
cmp edx, 0x21
jae 0x40c432
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.00464b30
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00464c00
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x9449d8]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x944a30]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40c401
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x944a68]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.00474560
mov eax, edx
mov ecx, 0x21
call fcn.00474640
nop
call fcn.004730d0
jmp fcn.0040c280
Function at 0x410bb0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x34]
test eax, eax
je 0x410df1
mov ecx, dword [esp + 0x40]
cmp dword [eax], ecx
jne 0x410d2c
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x410cb4
movzx ecx, byte [0x13d4400]
test cl, cl
je 0x410c0b
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x2c], ecx
test byte [ecx], al
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
xor esi, esi
xor edi, edi
jmp 0x410c12
add esp, 0x30
ret
add esi, 4
cmp dword [eax + 4], esi
jbe 0x410cb0
test esi, 0x1f
jne 0x410c29
movzx edi, byte [edx]
inc edx
jmp 0x410c2b
shr edi, 1
test edi, 1
je 0x410c0f
mov dword [esp + 0x1c], edx
add ebp, esi
add ebx, esi
mov eax, dword [ecx + 0x988]
add eax, 8
nop
cmp dword [ecx + 0x98c], eax
jae 0x410c7a
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebx
call fcn.00432a90
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [ecx + 0x988]
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
add edx, 8
mov dword [ecx + 0x988], edx
mov edx, dword [ebp]
mov dword [eax], edx
mov edx, dword [ebx]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
jmp 0x410c0f
add esp, 0x30
ret
mov dword [esp], eax
call fcn.00462e30
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
call fcn.0043a0d0
lea eax, [0x8b1e2e]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.0043a930
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043a930
lea eax, [0x89f335]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043a930
call fcn.0043a130
lea eax, [0x8af587]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.0046daf0
mov dword [esp], eax
call fcn.00462e30
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x34]
mov edx, dword [edx]
mov dword [esp + 0x18], edx
call fcn.0043a0d0
lea eax, [0x8b1e2e]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.0043a930
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043a930
lea eax, [0x89bfa0]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043a930
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a620
lea eax, [0x8a1772]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0043a930
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a620
call fcn.0043a2d0
call fcn.0043a130
lea eax, [0x8af587]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.0046daf0
lea eax, [0x8b2721]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.0046daf0
nop
int3
Function at 0x414990
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x414b8e
sub esp, 0x18
mov eax, dword [0x13d3fa0]
test eax, eax
jne 0x414b77
nop
nop
lea eax, [0x13d3f90]
mov dword [esp], eax
call fcn.0040a8d0
mov eax, dword [0x13d3f94]
test eax, eax
je 0x4149d8
cmp dword [eax + 8], 0xcc
jne 0x414a4e
mov edx, dword [0x13d3f98]
test edx, edx
jne 0x414a30
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x13d9b30]
mov dword [esp + 8], eax
call fcn.0040c460
mov eax, dword [esp + 0xc]
mov dword [0x13d3f98], eax
mov ecx, dword [0x13d3f9c]
mov dword [eax], ecx
mov eax, dword [0x13d3f98]
mov dword [0x13d3f9c], eax
movzx eax, byte [0x13d4880]
test al, al
jne 0x414a30
xor eax, eax
jmp 0x414b48
mov edx, dword [0x13d3f98]
mov ebx, dword [edx + 4]
mov dword [0x13d3f98], ebx
mov ebx, dword [0x13d3f94]
mov dword [edx + 4], ebx
mov dword [0x13d3f94], edx
mov edx, dword [0x13d3f94]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x414b27
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004794e0
mov eax, dword [0x13d4400]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x414aa0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x414ae0
call fcn.00474540
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x13d3f90]
mov dword [esp], eax
call fcn.0040aaf0
nop
lea eax, [0x13d3f8c]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00479660
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00474560
lea edx, [0x133e828]
movzx ebx, byte [edx + eax]
lea ebp, [0x13d4880]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x414a30
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x414b31
mov ecx, 5
call fcn.00474550
lea eax, [0x8a6c3e]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046daf0
nop
call fcn.004730d0
jmp fcn.00414990
Function at 0x4199c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x419a49
sub esp, 0x10
mov eax, dword [esp + 0x14]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.00479390
movzx eax, byte [esp + 0xc]
test al, al
je 0x419a2e
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x419a32
mov dword [esp], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.00419a60
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0041a010
add esp, 0x10
ret
add esp, 0x10
ret
lea eax, [0x8a6c56]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046daf0
nop
call fcn.004730d0
jmp fcn.004199c0
Function at 0x423400
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4234e0
sub esp, 0xc
mov eax, dword [esp + 0x10]
movzx ecx, word [eax]
movzx edx, cx
mov ebx, dword [esp + 0x14]
add edx, ebx
cmp edx, 0x200
ja 0x42345d
mov edx, dword [esp + 0x18]
cmp dword [eax + 4], edx
je 0x42343f
mov word [eax + 2], cx
mov dword [eax + 4], edx
movzx ecx, word [eax]
add ecx, ebx
mov word [eax], cx
cmp cx, 0x200
jne 0x423459
movzx ecx, byte [eax + 8]
and ecx, 0xfffffffe
nop
mov byte [eax + 8], cl
add esp, 0xc
ret
mov word [esp + 0xa], cx
call fcn.0043a0d0
lea eax, [0x89f371]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043a930
movzx eax, word [esp + 0xa]
movzx eax, ax
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a620
lea eax, [0x899b48]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.0043a930
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a620
call fcn.0043a2d0
call fcn.0043a130
lea eax, [0x8ae315]
mov dword [esp], eax
mov dword [esp + 4], 0x22
call fcn.0046daf0
nop
call fcn.004730d0
jmp fcn.00423400

Function at 0x4234f0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4235c3
sub esp, 0xc
mov eax, dword [esp + 0x10]
movzx ecx, word [eax]
movzx edx, cx
mov ebx, dword [esp + 0x14]
cmp ebx, edx
ja 0x423540
mov edx, dword [esp + 0x18]
cmp dword [eax + 4], edx
je 0x423529
mov word [eax + 2], cx
mov dword [eax + 4], edx
movzx ecx, word [eax]
sub ecx, ebx
mov word [eax], cx
movzx ecx, byte [eax + 8]
or ecx, 1
nop
mov byte [eax + 8], cl
add esp, 0xc
ret
mov word [esp + 0xa], cx
call fcn.0043a0d0
lea eax, [0x89f371]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043a930
movzx eax, word [esp + 0xa]
movzx eax, ax
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a620
lea eax, [0x899b48]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.0043a930
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a620
call fcn.0043a2d0
call fcn.0043a130
lea eax, [0x8a9203]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.0046daf0
nop
call fcn.004730d0
jmp fcn.004234f0
Function at 0x4297a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42997a
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x4298a5
cmp cl, 1
je 0x429834
cmp cl, 2
jne 0x429963
mov ecx, dword [eax + 8]
test byte [ecx], al
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00479430
nop
nop
lea eax, [0x13c0628]
mov dword [esp], eax
call fcn.0040a8d0
mov eax, dword [0x13c061c]
sub eax, dword [0x13c0600]
nop
mov dword [0x13c061c], eax
mov eax, dword [0x13c060c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x13c060c], ecx
nop
lea eax, [0x13c0628]
mov dword [esp], eax
call fcn.0040aaf0
jmp 0x42995f
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00414990
nop
nop
lea eax, [0x13c0628]
mov dword [esp], eax
call fcn.0040a8d0
mov eax, dword [0x13c057c]
sub eax, dword [0x13c0560]
nop
mov dword [0x13c057c], eax
mov eax, dword [0x13c056c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x13c056c], ecx
nop
lea eax, [0x13c0628]
mov dword [esp], eax
call fcn.0040aaf0
jmp 0x42995f
cmp cl, 3
je 0x429907
cmp cl, 4
jne 0x4298b8
mov byte [eax + 8], 1
jmp 0x42995f
cmp cl, 5
jne 0x429963
nop
nop
lea eax, [0x13c0628]
mov dword [esp], eax
call fcn.0040a8d0
mov eax, dword [0x13c05f4]
sub eax, dword [0x13c05d8]
nop
mov dword [0x13c05f4], eax
mov eax, dword [0x13c05e4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x13c05e4], ecx
nop
lea eax, [0x13c0628]
mov dword [esp], eax
call fcn.0040aaf0
jmp 0x42995f
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042ecd0
nop
nop
lea eax, [0x13c0628]
mov dword [esp], eax
call fcn.0040a8d0
mov eax, dword [0x13c05a4]
sub eax, dword [0x13c0588]
nop
mov dword [0x13c05a4], eax
mov eax, dword [0x13c0594]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x13c0594], ecx
nop
nop
lea eax, [0x13c0628]
mov dword [esp], eax
call fcn.0040aaf0
add esp, 0x14
ret
lea eax, [0x89ff3b]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0046daf0
nop
call fcn.004730d0
jmp fcn.004297a0
Function at 0x42b680
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x42b8da
sub esp, 0x24
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0x34]
mov ebx, eax
shr ebx, 0x16
cmp dword [edx + 0x3c], ebx
jbe 0x42b7cb
and eax, 0x3fffff
shr eax, 0xd
lea ebp, [eax - 0x200]
xchg ebp, ebx
neg ebx
xchg ebp, ebx
mov esi, dword [esp + 0x2c]
cmp esi, ebp
ja 0x42b745
mov ecx, dword [edx + 0x28]
cmp ecx, ebx
jbe 0x42b8d2
mov ecx, dword [edx + 0x24]
lea ecx, [ecx + ebx*8]
mov ebp, dword [ecx + 4]
test ebp, 0x80000000
je 0x42b6eb
mov ecx, 0x40000
jmp 0x42b6fb
mov ecx, dword [ecx]
shl ebp, 0xe
shr ecx, 0x12
or ecx, ebp
and ecx, 0x3ffff
cmp esi, ecx
ja 0x42b745
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ecx
mov ecx, dword [edx + 0x30]
test byte [ecx], al
shl ebx, 7
add ecx, ebx
mov dword [esp], ecx
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call fcn.0042db60
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x42b7df
mov ecx, dword [esp + 0x10]
shl eax, 0xd
shl ecx, 0xd
mov edx, dword [esp + 0x20]
shl edx, 0x16
add eax, edx
add ecx, edx
jmp 0x42b787
mov dword [esp], edx
mov dword [esp + 4], esi
call fcn.0042a980
mov eax, dword [esp + 8]
test eax, eax
jne 0x42b783
mov eax, dword [esp + 0x2c]
cmp eax, 1
jne 0x42b76f
mov eax, dword [0x133e750]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x34], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x24
ret
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x28]
mov dword [esp], edx
mov dword [esp + 4], eax
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebx
call fcn.0042a5c0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
cmp dword [edx + 0x34], ecx
jae 0x42b7bb
mov dword [edx + 0x34], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
add esp, 0x24
ret
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
add esp, 0x24
ret
call fcn.0043a0d0
lea eax, [0x89f380]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043a930
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a620
lea eax, [0x89c024]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043a930
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a620
call fcn.0043a2d0
call fcn.0043a130
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x34]
mov dword [esp + 0x20], eax
and eax, 0x3fffff
shr eax, 0xd
mov dword [esp + 0x1c], eax
call fcn.0043a0d0
lea eax, [0x8a431b]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.0043a930
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a620
lea eax, [0x8a0be1]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.0043a930
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a7c0
call fcn.0043a2d0
call fcn.0043a130
lea eax, [0x89ff4b]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0046daf0
mov eax, ebx
call fcn.00474560
nop
call fcn.0046fb40
jmp fcn.0042b680