joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4023d0
Capabilities:
Delete service
Stop service

Disassembly:
mov eax, 0x1020
call fcn.00408790
mov eax, dword [0x40d1f8]
xor eax, esp
mov dword [esp + 0x101c], eax
push ebx
push ebp
push esi
push edi
push 0xf003f
xor ebp, ebp
push ebp
push ebp
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x40242b
push 1
lea ebx, [edi + 0x40]
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x402420
push eax
mov ebp, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
jne 0x402435
mov eax, 1
jmp 0x4025a5
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x402490
push 0x400
lea eax, [esp + 0x30]
push eax
push 0xd80a
call fcn.00401e80
add esp, 0xc
test eax, eax
jne 0x402483
push str.Could_not_open_Service_Manager
lea ecx, [esp + 0x30]
push 0x400
push ecx
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
push eax
call fcn.00401b70
add esp, 0x10
push 0
push ebx
lea edx, [esp + 0x34]
push edx
jmp 0x40259b
push 0x10020
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4024cc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x400
lea eax, [esp + 0x30]
push eax
push 0xd80c
call fcn.00401e80
add esp, 0xc
test eax, eax
jne 0x402483
push str.Could_not_open_service
jmp 0x40246a
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40253b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x40253b
cmp eax, 0x425
jne 0x4024f9
cmp dword [esp + 0x14], 3
je 0x40253b
push 0x400
lea ecx, [esp + 0x30]
push ecx
push 0xd80e
call fcn.00401e80
add esp, 0xc
test eax, eax
jne 0x40252b
push str.Could_not_stop_service
lea edx, [esp + 0x30]
push 0x400
push edx
call fcn.00401cd0
add esp, 0xc
push 0
push ebx
lea eax, [esp + 0x34]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, eax
call esi
push edi
call esi
test ebp, ebp
jne 0x40242b
push 0x400
lea ecx, [esp + 0x830]
push ecx
push 0xd80d
call fcn.00401e80
add esp, 0xc
test eax, eax
jne 0x402590
push str.Could_not_delete_service
lea edx, [esp + 0x830]
push 0x400
push edx
call fcn.00401cd0
add esp, 0xc
push 0
push ebx
lea eax, [esp + 0x834]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408758
add esp, 0x1020
ret
Function at 0x402670
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x40268c
pop esi
pop ecx
ret
push edi
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x402640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x4026b4
mov ecx, dword [esi + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x402ea0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x18
push edi
mov edi, ecx
call fcn.004023d0
test eax, eax
jne 0x402ebb
mov eax, 0x80004005
pop edi
add esp, 0x18
ret 4
mov ecx, dword [0x40d21c]
push ebx
lea eax, [esp + 0x10]
push eax
push 1
push 0x65
xor ebx, ebx
push ecx
mov dword [esp + 0x20], str.APPID
mov dword [esp + 0x24], str.F0D094A7_C48F_496E_B9DC_BA9E0B7F69BB
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.00402790
cmp eax, ebx
jl 0x402ff5
push esi
push 0x20006
push str.AppID
push 0x80000000
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.004020c0
cmp eax, ebx
je 0x402f3d
push eax
call fcn.00401ed0
mov esi, eax
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, ebx
je 0x402f32
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
pop edi
add esp, 0x18
ret 4
mov edx, dword [esp + 0x14]
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push str.F0D094A7_C48F_496E_B9DC_BA9E0B7F69BB
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.00402040
mov esi, eax
cmp esi, ebx
je 0x402f8b
lea ecx, [esp + 0xc]
call fcn.00402650
lea ecx, [esp + 0x14]
call fcn.00402650
push esi
call fcn.00401ed0
add esp, 4
pop esi
pop ebx
pop edi
add esp, 0x18
ret 4
mov eax, dword [esp + 0xc]
push str.LocalService
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [esp + 0x28], bl
je 0x402fe0
push 1
lea ecx, [edi + 0x40]
push ecx
push str.LocalService
lea ecx, [esp + 0x18]
call fcn.004021a0
mov ecx, edi
call fcn.00402230
test eax, eax
jne 0x402fe0
lea ecx, [esp + 0xc]
call fcn.00402650
lea ecx, [esp + 0x14]
call fcn.00402650
pop esi
pop ebx
mov eax, 0x80004005
pop edi
add esp, 0x18
ret 4
lea ecx, [esp + 0xc]
call fcn.00402650
lea ecx, [esp + 0x14]
call fcn.00402650
xor eax, eax
pop esi
pop ebx
pop edi
add esp, 0x18
ret 4
Function at 0x4030c0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x14
call fcn.004023d0
test eax, eax
jne 0x4030d5
mov eax, 0x80004005
add esp, 0x14
ret
lea eax, [esp]
push eax
push 0x20006
push 0
push str.AppID
push 0x80000000
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40315c
mov eax, dword [esp]
push ebp
push esi
push edi
push 0x20006
push str.F0D094A7_C48F_496E_B9DC_BA9E0B7F69BB
mov ebp, eax
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004020c0
test eax, eax
je 0x403169
push eax
call fcn.00401ed0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x40314c
push eax
call edi
test ebp, ebp
je 0x403153
push ebp
call edi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x14
ret
push eax
call fcn.00401ed0
add esp, 4
add esp, 0x14
ret
mov esi, dword [esp + 0x10]
push str.LocalService
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call fcn.00402de0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
test esi, esi
je 0x40318f
push esi
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40319a
push eax
call edi
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x14
ret

Function at 0x403500
Capabilities:
Modify service

Disassembly:
sub esp, 0x80c
mov eax, dword [0x40d1f8]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
mov ebx, dword [esp + 0x814]
push ebp
push edi
xor ebp, ebp
push ebx
mov edi, ecx
mov dword [esp + 0x10], ebp
call fcn.00402ea0
test bl, bl
je 0x403622
push esi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x403626
push 1
add edi, 0x40
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x40356d
push eax
mov ebx, 1
call ebp
push esi
call ebp
test ebx, ebx
je 0x40361c
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x403594
call fcn.00401040
jmp 0x403628
push 2
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x40360e
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0x400
lea eax, [esp + 0x1c]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.Glarysoft_Startup_Manager_Servers
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x14]
push eax
push 1
lea edx, [esp + 0x20]
push esi
mov dword [esp + 0x20], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push esi
call ebp
mov esi, dword [esp + 0x10]
push ebx
call ebp
mov eax, esi
jmp 0x403628
call fcn.00401040
push ebx
mov esi, eax
call ebp
mov eax, esi
jmp 0x403628
mov eax, dword [esp + 0x10]
jmp 0x403628
mov eax, ebp
jmp 0x403629
mov eax, ebp
pop esi
mov ecx, dword [esp + 0x814]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408758
add esp, 0x80c
ret 4
Function at 0x403ac0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4091e9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x40d1f8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [0x40d500]
mov edx, dword [eax + 0xc]
mov ecx, 0x40d500
mov dword [esp + 0x1c], 0
call edx
mov esi, dword [esp + 0x24]
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], 1
call fcn.004031b0
push str.Log_
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x2c], 1
call fcn.00403870
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x20], 2
call fcn.00403950
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x1c], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403b73
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x1c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b98
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x28], 0
je 0x403bb7
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403bb7
mov eax, dword [esi]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 8

Function at 0x404170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404189
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4041c4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4041c0
lea ebx, [ebx]
cmp esi, eax
jae 0x4041c4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4041b0
cmp esi, eax
jb 0x4041ca
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x408758
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d1f8]
jne 0x408762
repz ret
jmp fcn.00408cc1
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x406c50
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x406e20
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.00475700
jmp fcn.00406c50
Function at 0x40d0f0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d1ed
sub esp, 0x20
mov eax, dword [0x1898054]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x6c]
test eax, eax
jne 0x40d1d6
mov eax, dword [0x18434a4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov ebx, edx
shr edx, 2
lea edx, [edx + edx*2]
cmp ecx, edx
jb 0x40d1ac
mov dword [esp + 0x10], eax
shl ebx, 1
lea eax, [ebx + 2]
shl eax, 2
mov dword [esp], eax
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.0046ab70
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [eax], edx
lea edx, [0x47a720]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x18]
mov dword [esp], edx
call fcn.0040dc40
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x10]
cmp dword [edx + 4], ecx
jne 0x40d1c0
lea ecx, [0x18434a4]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004082e0
mov eax, dword [0x18434a4]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0040d200
add esp, 0x20
ret
lea eax, [0xed313e]
mov dword [esp], eax
mov dword [esp + 4], 0x27
call fcn.0046fe20
lea eax, [0xea5ba6]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0046fe20
nop
call fcn.00475700
jmp fcn.0040d0f0
Function at 0x40f850
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40fa1b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40f879
mov eax, 0x7000000
jmp 0x40f881
test eax, eax
je 0x40f9f6
mov dword [esp + 0x34], eax
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x448]
mov ebx, dword [ecx + 0x44c]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x448], ebx
mov dword [ecx + 0x44c], ebp
mov dword [esp], edx
call fcn.00476ab0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x1775b80]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40fa0e
cmp edx, 0x21
jae 0x40fa02
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.00466c90
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00466d60
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x11604d8]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x1160528]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40f9d1
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x1160560]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.00476b90
mov eax, edx
mov ecx, 0x21
call fcn.00476c70
nop
call fcn.00475700
jmp fcn.0040f850
Function at 0x413ce0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x34]
test eax, eax
je 0x413f21
mov ecx, dword [esp + 0x40]
cmp dword [eax], ecx
jne 0x413e5c
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x413de4
movzx ecx, byte [0x1898608]
test cl, cl
je 0x413d3b
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x2c], ecx
test byte [ecx], al
mov edx, dword [eax + 0x14]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
xor esi, esi
xor edi, edi
jmp 0x413d42
add esp, 0x30
ret
add esi, 4
cmp dword [eax + 4], esi
jbe 0x413de0
test esi, 0x1f
jne 0x413d59
movzx edi, byte [edx]
inc edx
jmp 0x413d5b
shr edi, 1
test edi, 1
je 0x413d3f
mov dword [esp + 0x1c], edx
add ebp, esi
add ebx, esi
mov eax, dword [ecx + 0x988]
add eax, 8
nop
cmp dword [ecx + 0x98c], eax
jae 0x413daa
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebx
call fcn.00434b90
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [ecx + 0x988]
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
add edx, 8
mov dword [ecx + 0x988], edx
mov edx, dword [ebp]
mov dword [eax], edx
mov edx, dword [ebx]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
jmp 0x413d3f
add esp, 0x30
ret
mov dword [esp], eax
call fcn.00464f20
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
call fcn.0043c2c0
lea eax, [0xed60cd]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.0043cb20
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043cb20
lea eax, [0xea5bd3]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043cb20
call fcn.0043c320
lea eax, [0xecb552]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.0046fe20
mov dword [esp], eax
call fcn.00464f20
mov eax, dword [esp + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x34]
mov edx, dword [edx]
mov dword [esp + 0x18], edx
call fcn.0043c2c0
lea eax, [0xed60cd]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.0043cb20
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043cb20
lea eax, [0xea013f]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043cb20
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c810
lea eax, [0xeaa0d9]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0043cb20
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043c810
call fcn.0043c4c0
call fcn.0043c320
lea eax, [0xecb552]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.0046fe20
lea eax, [0xed862d]
mov dword [esp], eax
mov dword [esp + 4], 0x29
call fcn.0046fe20
nop
int3
Function at 0x417ac0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x417cbe
sub esp, 0x18
mov eax, dword [0x1897e38]
test eax, eax
jne 0x417ca7
nop
nop
lea eax, [0x1897e28]
mov dword [esp], eax
call fcn.0040dea0
mov eax, dword [0x1897e2c]
test eax, eax
je 0x417b08
cmp dword [eax + 8], 0xcc
jne 0x417b7e
mov edx, dword [0x1897e30]
test edx, edx
jne 0x417b60
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x189dc70]
mov dword [esp + 8], eax
call fcn.0040fa30
mov eax, dword [esp + 0xc]
mov dword [0x1897e30], eax
mov ecx, dword [0x1897e34]
mov dword [eax], ecx
mov eax, dword [0x1897e30]
mov dword [0x1897e34], eax
movzx eax, byte [0x1898c20]
test al, al
jne 0x417b60
xor eax, eax
jmp 0x417c78
mov edx, dword [0x1897e30]
mov ebx, dword [edx + 4]
mov dword [0x1897e30], ebx
mov ebx, dword [0x1897e2c]
mov dword [edx + 4], ebx
mov dword [0x1897e2c], edx
mov edx, dword [0x1897e2c]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x417c57
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0047d110
mov eax, dword [0x1898608]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x417bd0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x417c10
call fcn.00476b70
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x1897e28]
mov dword [esp], eax
call fcn.0040e0c0
nop
lea eax, [0x1897e24]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.0047d2a0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00476b90
lea edx, [0x176cef4]
movzx ebx, byte [edx + eax]
lea ebp, [0x1898c20]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x417b60
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x417c61
mov ecx, 5
call fcn.00476b80
lea eax, [0xeb364d]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046fe20
nop
call fcn.00475700
jmp fcn.00417ac0
Function at 0x41cce0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41cd69
sub esp, 0x10
mov eax, dword [esp + 0x14]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.0047cfc0
movzx eax, byte [esp + 0xc]
test al, al
je 0x41cd4e
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x41cd52
mov dword [esp], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.0041cd80
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0041d330
add esp, 0x10
ret
add esp, 0x10
ret
lea eax, [0xeb3665]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046fe20
nop
call fcn.00475700
jmp fcn.0041cce0