joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c1f0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44c381
sub esp, 0x44
nop
nop
lea eax, [0x1899780]
mov dword [esp], eax
call fcn.0040dea0
movzx eax, byte [0x18998d0]
test al, al
je 0x44c238
lea eax, [0xea4692]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043a5f0
mov edx, dword [0x1876480]
test edx, edx
je 0x44c24f
mov ebx, dword [0x1876484]
xor eax, eax
jmp 0x44c306
lea eax, [0x1899784]
mov dword [esp], eax
mov dword [esp + 4], 0x20
mov dword [esp + 8], 0x20
call fcn.00436de0
cmp dword [esp + 0xc], 0x20
je 0x44c299
mov byte [0x1897d95], 1
lea eax, [0x1899784]
mov dword [esp], eax
mov dword [esp + 4], 0x20
mov dword [esp + 8], 0x20
call fcn.0044c390
lea edi, [esp + 0x24]
lea esi, [0x1899784]
call fcn.00477290
lea eax, [0x18997a4]
mov dword [esp], eax
lea edi, [esp + 4]
lea esi, [esp + 0x24]
call fcn.00477290
call fcn.004067b0
lea eax, [0x1899784]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.004772f0
mov byte [0x18998d0], 1
nop
nop
lea eax, [0x1899780]
mov dword [esp], eax
call fcn.0040e0c0
add esp, 0x44
ret
lea esi, [0x1899784]
movzx edi, byte [ecx + esi]
xor edi, ebp
xchg edi, eax
mov byte [esi + ecx], al
xchg edi, eax
inc eax
cmp eax, ebx
jge 0x44c31e
mov ebp, eax
and ebp, 0xffffffe0
mov ecx, eax
sub ecx, ebp
movzx ebp, byte [eax + edx]
cmp ecx, 0x20
jb 0x44c2f4
jmp 0x44c374
mov eax, dword [0x1876484]
test eax, eax
je 0x44c33a
mov ecx, dword [0x1876480]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004772f0
mov dword [0x1876484], 0
mov dword [0x1876488], 0
mov eax, dword [0x1898608]
test eax, eax
je 0x44c365
mov eax, dword [0x1876480]
call fcn.00476b00
mov dword [edi], eax
mov dword [0x1876480], 0
jmp 0x44c299
mov eax, ecx
mov ecx, 0x20
call fcn.00476b80
nop
call fcn.00475700
jmp fcn.0044c1f0

Function at 0x44c4e0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44c58d
sub esp, 0x10
nop
nop
lea eax, [0x1899780]
mov dword [esp], eax
call fcn.0040dea0
movzx eax, byte [0x18998d0]
test al, al
jne 0x44c538
lea eax, [0xea5ca5]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043a5f0
jmp 0x44c538
lea eax, [0x18997a4]
mov dword [esp], eax
call fcn.00406a70
mov eax, dword [0x18998c4]
nop
cmp dword [0x18998c8], eax
jbe 0x44c52a
lea ecx, [eax + 1]
mov dword [0x18998c4], ecx
and eax, 0x1f
lea ecx, [0x18997a4]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 8], ecx
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
nop
nop
lea edx, [0x1899780]
mov dword [esp], edx
call fcn.0040e0c0
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
add esp, 0x10
ret
call fcn.00475700
jmp fcn.0044c4e0
Function at 0x44c5a0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44c606
sub esp, 8
nop
nop
lea eax, [0x1899780]
mov dword [esp], eax
call fcn.0040dea0
movzx eax, byte [0x18998d0]
test al, al
jne 0x44c5e4
lea eax, [0xea5ca5]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043a5f0
lea eax, [0x18997a4]
mov dword [esp], eax
call fcn.00406b60
nop
nop
lea eax, [0x1899780]
mov dword [esp], eax
call fcn.0040e0c0
add esp, 8
ret
call fcn.00475700
jmp fcn.0044c5a0
Function at 0x451780
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4518ed
sub esp, 0x1c
movzx edx, byte [esp + 0x20]
movzx eax, dl
cmp eax, 3
jae 0x4518e2
shl eax, 6
lea ecx, [0x18991a0]
mov ebx, dword [ecx + eax + 4]
lea eax, [ecx + eax + 4]
test ebx, ebx
jne 0x451813
mov dword [esp + 0x14], eax
lea eax, [0x187fde0]
mov dword [esp], eax
mov dword [esp + 4], 4
mov byte [esp + 8], 1
call fcn.0042a8a0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4518cc
movzx edx, word [eax + 0x3c]
test dx, dx
jne 0x4518b6
mov edx, dword [eax + 0x14]
test edx, edx
jne 0x4518a0
movzx ecx, byte [esp + 0x20]
mov edx, 0x1000
shl edx, cl
mov dword [eax + 0x44], edx
xor ecx, ecx
jmp 0x451877
mov ecx, dword [ebx + 0x14]
mov edx, ecx
test ecx, ecx
je 0x45184d
mov ecx, dword [ecx]
mov dword [ebx + 0x14], ecx
movzx ecx, word [ebx + 0x3c]
inc ecx
mov word [ebx + 0x3c], cx
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x451845
mov dword [esp + 0x18], edx
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.0042bea0
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], edx
add esp, 0x1c
ret
lea eax, [0xeb1ef1]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.0046fe20
mov edx, dword [eax + 0x14]
mov ebx, dword [eax + 0xc]
add ebx, ecx
mov ebp, ebx
mov dword [ebx], edx
mov dword [eax + 0x14], ebp
mov edx, dword [eax + 0x44]
add ecx, edx
cmp ecx, 0x8000
jb 0x451863
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0042c000
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
jmp 0x451813
lea eax, [0xeaa19f]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0046fe20
lea eax, [0xea46bc]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0046fe20
lea eax, [0xea2fa8]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.0046fe20
mov ecx, 3
call fcn.00476b80
nop
call fcn.00475700
jmp fcn.00451780
Function at 0x456940
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x58]
mov edx, dword [eax + 0xa8]
mov ebx, dword [esp + 0x20]
lea ebp, [ecx + ebx]
cmp edx, 1
jle 0x45696e
mov dword [esp + 0x14], ecx
mov dword [esp + 8], ebp
mov esi, dword [eax + 0xa4]
xor edi, edi
jmp 0x45698a
mov dword [esp + 0x24], ebp
add esp, 0x18
ret
mov eax, dword [esp + 0x10]
lea esi, [eax + 0xc]
inc edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 8]
cmp edi, edx
jge 0x4569ba
mov dword [esp + 0x10], esi
mov ecx, dword [esi]
mov ebp, dword [esi + 4]
cmp ebx, ecx
jb 0x45699f
cmp ebx, ebp
jb 0x4569ae
lea eax, [edx - 1]
cmp edi, eax
jne 0x456976
cmp ebx, ebp
jne 0x456976
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 8]
lea ebp, [edx + ebx]
sub ebp, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 0x5c]
cmp ebp, eax
jbe 0x45696e
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], eax
call fcn.0043c2c0
lea eax, [0xeaa1b1]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0043cb20
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c9b0
lea eax, [0xea46f4]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043cb20
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c9b0
lea eax, [0xe90958]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.0043cb20
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c9b0
call fcn.0043c4c0
call fcn.0043c320
lea eax, [0xec41e3]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.0046fe20
nop
int3
Function at 0x458220
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x458386
sub esp, 0x28
mov eax, dword [esp + 0x2c]
test byte [eax], al
lea ecx, [0x1897e5c]
mov dword [esp], ecx
call fcn.0047cf90
mov eax, dword [esp + 4]
test eax, eax
jne 0x458258
call fcn.00434ff0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x45836f
mov ecx, dword [0x1898608]
test ecx, ecx
jne 0x458277
mov ecx, dword [esp + 0x2c]
jmp 0x458288
call fcn.00476b10
mov ecx, dword [esp + 0x2c]
mov dword [edi], ecx
mov edx, dword [eax + 0x2c]
mov dword [edi + 4], edx
mov dword [eax + 0x2c], ecx
mov edx, dword [ecx + 0xc]
mov ebx, dword [ecx + 8]
inc ebx
mov ebp, dword [ecx + 4]
mov esi, dword [eax + 0xc]
mov edi, dword [eax + 0x10]
cmp edx, ebx
jae 0x45830a
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 1
lea eax, [0xdd7600]
mov dword [esp + 0x10], eax
call fcn.00471940
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
mov dword [ebx + 0xc], eax
mov eax, dword [0x1898608]
test eax, eax
je 0x4582f3
call fcn.00476b10
mov dword [edi], ecx
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov dword [ebx + 4], ecx
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, ecx
mov ebx, edx
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 8], ebx
lea edx, [ebx + ebx*2]
mov dword [ebp + edx*4 - 8], esi
mov dword [ebp + edx*4 - 4], edi
mov ebx, dword [0x1898608]
test ebx, ebx
je 0x458330
call fcn.00476b10
mov dword [edi], eax
mov ebx, dword [ebp + edx*4 - 0xc]
mov dword [edi + 4], ebx
mov dword [ebp + edx*4 - 0xc], eax
mov edx, dword [ecx + 8]
mov dword [esp], ecx
dec edx
mov dword [esp + 4], edx
call fcn.00459d20
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 8]
test ecx, ecx
jbe 0x458366
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x30]
cmp dword [ecx], edx
jne 0x458362
mov dword [esp], eax
call fcn.00459b10
add esp, 0x28
ret
xor eax, eax
mov ecx, eax
call fcn.00476b80
lea eax, [0xea5ce1]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0046fe20
nop
call fcn.00475700
jmp fcn.00458220
Function at 0x458600
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x458759
sub esp, 0x10
mov ebx, dword [esp + 0x14]
mov ebp, dword [ebx + 8]
test ebp, ebp
jbe 0x45874f
mov ebp, dword [ebx + 4]
mov ebp, dword [ebp]
cmp dword [ebp + 0x2c], ebx
jne 0x458739
mov esi, dword [0x1898608]
test esi, esi
je 0x458649
mov esi, dword [ebp + 0x2c]
call fcn.00476b00
mov dword [edi], esi
mov dword [ebp + 0x2c], 0
mov ebp, dword [ebx + 8]
lea eax, [ebp - 1]
test eax, eax
jle 0x45868f
mov esi, dword [ebx + 4]
lea edi, [ebp + ebp*2]
mov ecx, dword [esi + edi*4 - 8]
mov edx, dword [esi + edi*4 - 4]
mov edi, dword [esi + edi*4 - 0xc]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov ecx, dword [0x1898608]
test ecx, ecx
je 0x45868d
mov ecx, edi
call fcn.00476b10
mov dword [edi], ecx
mov edx, dword [esi]
mov dword [edi + 4], edx
mov edi, ecx
mov dword [esi], edi
mov ecx, dword [ebx + 8]
cmp ecx, eax
jbe 0x458734
mov esi, dword [ebx + 4]
lea edi, [ebp + ebp*2]
mov dword [esi + edi*4 - 8], 0
mov dword [esi + edi*4 - 4], 0
mov ecx, dword [0x1898608]
test ecx, ecx
je 0x4586ca
mov ecx, dword [esi + edi*4 - 0xc]
mov edx, edi
call fcn.00476b00
mov dword [edi], ecx
mov edi, edx
mov dword [esi + edi*4 - 0xc], 0
mov edx, dword [ebx + 0xc]
cmp edx, eax
jb 0x45872d
mov dword [esp + 0xc], ebp
mov dword [ebx + 8], eax
test eax, eax
jle 0x4586f8
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.00459eb0
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.00459b10
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x458729
mov eax, dword [esp + 0x14]
add eax, 0x28
nop
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0047d050
add esp, 0x10
ret
mov ecx, eax
call fcn.00476bc0
call fcn.00476b80
lea eax, [0xea19be]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0046fe20
xor eax, eax
mov ecx, eax
call fcn.00476b80
nop
call fcn.00475700
jmp fcn.00458600
Function at 0x45a310
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45a40c
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
test byte [eax], al
nop
nop
mov dword [esp], eax
call fcn.0040dea0
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x45a353
call fcn.0045a1b0
mov eax, dword [esp + 0x10]
inc dword [eax + 8]
movzx ecx, byte [eax + 5]
test cl, 1
je 0x45a3a7
test cl, 4
je 0x45a3a7
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
test ebx, ebx
setg bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test edx, edx
seta dl
and ebp, edx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x45a3a7
and ecx, 0xfffffffb
mov byte [eax + 5], cl
mov ecx, dword [eax + 0x2c]
test byte [ecx], al
add ecx, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
call fcn.0047d0a0
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 5]
nop
test cl, 1
jne 0x45a3e5
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
test edx, edx
setg dl
sete bl
test ecx, ecx
seta cl
and ebx, ecx
or ebx, edx
test bl, bl
je 0x45a3e5
movzx ecx, byte [eax + 6]
test cl, cl
je 0x45a3de
mov ecx, dword [eax + 8]
test ecx, ecx
seta cl
jmp 0x45a3e7
mov ecx, 1
jmp 0x45a3e7
xor ecx, ecx
mov byte [esp + 0xf], cl
mov dword [esp], eax
call fcn.00457fa0
movzx eax, byte [esp + 0xf]
test al, al
je 0x45a408
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00458ae0
add esp, 0x14
ret
call fcn.00475700
jmp fcn.0045a310
Function at 0x45c9b0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45caad
sub esp, 0x38
mov eax, dword [esp + 0x40]
cmp eax, 0xf
jne 0x45c9ff
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
lea ecx, [0xea5cff]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xf
call fcn.004066c0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x45ca89
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045c8a0
mov eax, dword [esp + 8]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x28], ebx
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
call fcn.0043c2c0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.0043cb20
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0043cb20
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0043cb20
call fcn.0043c320
add esp, 0x38
ret
call fcn.0043c2c0
lea eax, [0xe92202]
mov dword [esp], eax
mov dword [esp + 4], 5
call fcn.0043cb20
call fcn.0043c320
add esp, 0x38
ret
call fcn.00475700
jmp fcn.0045c9b0
Function at 0x45cba0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45cdb5
sub esp, 0x30
call fcn.0043c2c0
lea eax, [0xea0294]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043cb20
call fcn.0043c320
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x45cbe5
xor ecx, ecx
xor edx, edx
jmp 0x45cc02
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00456a70
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, eax
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.0045c9b0
mov eax, dword [esp + 0x44]
test eax, eax
setne cl
mov edx, dword [esp + 0x40]
test edx, edx
setne bl
or ecx, ebx
test cl, cl
je 0x45cc5a
call fcn.0043c2c0
lea eax, [0xea4710]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043cb20
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.0043c810
call fcn.0043c320
call fcn.0043c2c0
call fcn.0043c4c0
call fcn.0043c320
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00456940
mov eax, dword [esp + 0x3c]
cmp dword [esp + 8], eax
jae 0x45cc8e
lea ecx, [eax - 1]
jmp 0x45cc90
mov ecx, eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov edx, dword [esp + 0x38]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.00472e40
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
sar eax, 0x1f
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x10]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x24], ebx
call fcn.0043c2c0
lea eax, [0x115cdf0]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043cb20
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0043cb20
lea eax, [0x115cd28]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043cb20
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.0043c940
call fcn.0043c320
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00456940
mov eax, dword [esp + 0x3c]
cmp dword [esp + 8], eax
jae 0x45cda2
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00456940
mov eax, dword [esp + 8]
mov dword [esp + 0x1c], eax
call fcn.0043c2c0
lea eax, [0xe8fee5]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.0043cb20
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
sub eax, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c9b0
call fcn.0043c320
call fcn.0043c2c0
call fcn.0043c4c0
call fcn.0043c320
add esp, 0x30
ret
call fcn.00475700
jmp fcn.0045cba0
Function at 0x45e1b0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45e2f8
sub esp, 0x18
call fcn.0044cc20
cmp dword [esp], 1
jg 0x45e2ef
movzx eax, byte [esp + 0x28]
cmp al, 0x16
jne 0x45e1fd
movzx eax, byte [esp + 0x2d]
cmp al, 0xa
je 0x45e1fd
cmp al, 0x13
je 0x45e1fd
cmp al, 0xf
je 0x45e1fd
mov byte [esp + 0x30], 0
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x45e20b
xor ecx, ecx
xor eax, eax
jmp 0x45e223
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00456a70
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp ecx, 0xf
je 0x45e234
xor edx, edx
jmp 0x45e25d
mov dword [esp], eax
lea ecx, [0xea5cff]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xf
call fcn.004066c0
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
je 0x45e273
movzx edx, byte [esp + 0x2c]
test dl, dl
jne 0x45e273
mov byte [esp + 0x30], 1
add esp, 0x18
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
mov byte [esp + 8], 0x2e
call fcn.00406730
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x45e2e5
mov eax, dword [esp + 0x10]
cmp eax, 8
jge 0x45e29c
mov eax, 1
jmp 0x45e2e7
mov eax, dword [esp + 0x14]
mov dword [esp], eax
lea ecx, [0xe9c28b]
mov dword [esp + 4], ecx
mov dword [esp + 8], 8
call fcn.004066c0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x45e2ca
mov eax, 1
jmp 0x45e2e7
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.0045e310
movzx eax, byte [esp + 8]
jmp 0x45e2e7
xor eax, eax
mov byte [esp + 0x30], al
add esp, 0x18
ret
mov byte [esp + 0x30], 1
add esp, 0x18
ret
call fcn.00475700
jmp fcn.0045e1b0

Function at 0x4629c0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x462a9f
sub esp, 0x24
mov eax, dword [esp + 0x28]
test byte [eax], al
lea ecx, [eax + 0x19c]
mov dword [esp + 0x18], ecx
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.0047d070
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
lea ecx, [0x462ab0]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
mov dword [esp], ecx
call fcn.00475610
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x14], eax
nop
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.0047d070
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jne 0x462a4b
add esp, 0x24
ret
mov dword [esp + 0xc], eax
call fcn.0043c2c0
lea eax, [0xea471e]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043cb20
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c810
call fcn.0043c4c0
call fcn.0043c320
lea eax, [0xeb3785]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046fe20
nop
call fcn.00475700
jmp fcn.004629c0
Function at 0x463c50
Capabilities:
Get geographical location
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x463e5a
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x463e0a
mov ecx, dword [esp + 0x8c]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x90]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x463d1a
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.00460510
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x463d9c
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call fcn.00460510
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x463df1
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.00460510
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call fcn.0043c2c0
lea eax, [0xea472c]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043cb20
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.0043c810
call fcn.0043c4c0
call fcn.0043c320
lea eax, [0xee76e4]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.0046fe20
nop
call fcn.00475700
jmp fcn.00463c50