joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440f70
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x441045
sub esp, 0x14
mov eax, dword [0xf0e748]
mov dword [esp + 0x10], eax
mov ecx, dword [0xf0e758]
mov dword [esp + 0xc], ecx
lea edx, [0xf334f4]
mov dword [esp], edx
call fcn.00406520
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
sub eax, ecx
sub eax, dword [esp + 4]
mov dword [esp + 8], eax
lea ecx, [0xf334ec]
mov dword [esp], ecx
call fcn.00406520
mov eax, dword [0xf0e750]
mov ecx, dword [esp + 8]
sub ecx, dword [esp + 4]
cmp eax, ecx
jl 0x440fdf
add esp, 0x14
ret
mov dword [esp + 8], eax
call fcn.0043ed90
lea eax, [0xa2bbe8]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.0043f610
mov eax, dword [esp + 8]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043f430
lea eax, [0xa21ea3]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043f610
call fcn.0043edf0
lea eax, [0xa242a0]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.0043d060
nop
call fcn.0046c2f0
jmp fcn.00440f70
Function at 0x443e00
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x443f18
sub esp, 0x10
mov eax, dword [0xf335f8]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x7c]
test edx, edx
jne 0x443f01
mov edx, dword [ecx + 0x58]
test edx, edx
jne 0x443eeb
movzx ecx, byte [ecx + 0x88]
test cl, cl
jne 0x443ed5
mov dword [esp + 0xc], eax
nop
nop
lea eax, [0xf0e738]
mov dword [esp], eax
call fcn.0040dbd0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov dword [esp], ecx
call fcn.0044c2e0
nop
nop
lea eax, [0xf0e738]
mov dword [esp], eax
call fcn.0040ddd0
mov eax, dword [0xf335f8]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0xb4
nop
mov dword [esp], ecx
call fcn.0040df30
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x18]
mov dword [eax + 0xb4], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x5c]
mov dword [esp], ecx
call fcn.0044a3e0
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x5c], 0
add esp, 0x10
ret
lea eax, [0xa21eb1]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043d060
lea eax, [0xa229f7]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043d060
lea eax, [0xa25e7d]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.0043d060
nop
call fcn.0046c2f0
jmp fcn.00443e00
Function at 0x446fa0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44709a
sub esp, 0xc
mov eax, dword [esp + 0x10]
test byte [eax], al
lea ecx, [eax + 0x48]
nop
mov dword [esp], ecx
call fcn.00406520
mov eax, dword [esp + 4]
and eax, 0xffffefff
cmp eax, 2
jne 0x447077
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 1
call fcn.00441b70
mov eax, dword [0xf335f8]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x50]
xor edx, edx
nop
nop
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
xor ecx, ecx
nop
mov dword [eax + 0x50], ecx
nop
nop
lea eax, [0xf0e738]
mov dword [esp], eax
call fcn.0040dbd0
nop
nop
mov eax, dword [esp + 0x10]
mov dword [eax + 0x58], 0
mov ecx, dword [0xf0e778]
test ecx, ecx
je 0x447046
mov edx, eax
mov dword [ecx + 0x58], eax
jmp 0x447051
mov ecx, eax
nop
mov dword [0xf0e774], eax
mov edx, ecx
nop
mov dword [0xf0e778], edx
inc dword [0xf0e77c]
nop
nop
lea eax, [0xf0e738]
mov dword [esp], eax
call fcn.0040ddd0
call fcn.004467d0
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00440dd0
lea eax, [0xa20219]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043d060
nop
call fcn.0046c2f0
jmp fcn.00446fa0
Function at 0x447270
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x44742a
sub esp, 0x1c
movzx eax, byte [0xf17aa4]
test al, al
je 0x4472bc
nop
mov byte [esp], 0x14
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0045caa0
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x48]
nop
mov dword [esp], ecx
call fcn.00406520
mov eax, dword [esp + 4]
and eax, 0xffffefff
cmp eax, 2
jne 0x447407
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x68]
test cl, cl
je 0x447310
mov ecx, dword [eax + 0x20]
mov dword [esp], ecx
call fcn.00458ac0
mov eax, dword [esp + 4]
test eax, eax
je 0x4473f1
movzx ecx, byte [eax + 0x29]
test cl, 2
jne 0x44736e
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 0x1009
call fcn.00441f80
mov eax, dword [0xf335f8]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x50]
xor edx, edx
nop
nop
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
xor ecx, ecx
nop
mov dword [eax + 0x50], ecx
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x1009
mov dword [esp + 8], 9
call fcn.004418d0
call fcn.004467d0
add esp, 0x1c
ret
mov ecx, dword [esp + 8]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00458690
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
call fcn.0043ed90
lea eax, [0xa3b950]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.0043f610
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0043f610
lea eax, [0xa24fd0]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0043f610
call fcn.0043edf0
lea eax, [0xa22a15]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043d060
lea eax, [0xa27e3d]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.0043d060
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00440dd0
lea eax, [0xa20219]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043d060
nop
call fcn.0046ab20
jmp fcn.00447270
Function at 0x449610
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x449785
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], 3
mov dword [ecx + 0x500], 0
mov dword [ecx + 0x504], 0x80
mov edx, dword [0xf339d0]
lea ebx, [ecx + 0x508]
test edx, edx
je 0x44966c
call fcn.0046d700
mov dword [edi], ebx
mov edx, dword [ecx + 0x4fc]
mov dword [edi + 4], edx
mov dword [ecx + 0x4fc], ebx
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0x20
mov edx, dword [0xf339d0]
lea ebx, [ecx + 0x58]
test edx, edx
je 0x44969a
call fcn.0046d700
mov dword [edi], ebx
mov edx, dword [ecx + 0x4c]
mov dword [edi + 4], edx
mov dword [ecx + 0x4c], ebx
lea eax, [ecx + 0x978]
mov dword [esp], eax
call fcn.00436ca0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x4496bc
mov ecx, dword [esp + 0x18]
jmp 0x4496ea
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x4496d7
mov edx, dword [0xf334d8]
test edx, edx
je 0x44976e
mov dword [eax + 0x30], edx
jmp 0x4496ea
call fcn.00417ab0
mov eax, dword [esp]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x30], eax
mov ecx, dword [esp + 0x18]
mov edx, ecx
sar edx, 0x1f
shr edx, 0x1b
lea eax, [ecx + edx]
mov edx, eax
and edx, 0xffffffe0
mov ebx, ecx
sub ebx, edx
test ebx, ebx
jl 0x449769
mov edx, dword [0xf0bfec]
sar eax, 5
mov ecx, ebx
mov esi, 1
shl esi, cl
cmp ecx, 0x20
sbb ebx, ebx
and esi, ebx
cmp edx, eax
jbe 0x449762
mov ecx, dword [0xf0bfe8]
lea eax, [ecx + eax*4]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.00406810
mov eax, dword [0xf0bfd8]
mov ecx, dword [0xf0bfdc]
mov edx, dword [0xf0bfe0]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
call fcn.0044c490
add esp, 0x10
ret
mov ecx, edx
call fcn.0046d760
call fcn.0043b780
lea eax, [0xa22a24]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0043d060
nop
call fcn.0046c2f0
jmp fcn.00449610
Function at 0x44a490
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [0xf335f8]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x58]
test edx, edx
jne 0x44a5a2
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x2c]
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x44a4e1
mov ebp, dword [edx + 4]
test ebp, ebp
jne 0x44a4d9
mov ebx, edx
nop
mov dword [ecx + 0x58], edx
mov eax, dword [eax + 0x18]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 4], 1
add esp, 0x18
ret
test ebx, ebx
je 0x44a599
mov ecx, dword [ebx + 0x64]
mov ebx, dword [ebx + 0x68]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov eax, dword [edx + 4]
mov dword [esp + 0x10], eax
call fcn.0043ed90
lea eax, [0xa20231]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043f610
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0043f2f0
lea eax, [0xb249c8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043f610
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.0043f430
lea eax, [0xa2023d]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043f610
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0043f2f0
call fcn.0043efa0
call fcn.0043edf0
lea eax, [0xa28e92]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.0043d060
xor ebx, ebx
xor ecx, ecx
jmp 0x44a4e7
lea eax, [0xa26e7f]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.0043d060
nop
int3
Function at 0x44a5c0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44a724
sub esp, 0x1c
mov eax, dword [0xf335f8]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x58]
test edx, edx
je 0x44a70d
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov ebx, dword [edx + 0x2c]
mov dword [esp + 8], ebx
nop
cmp ebx, ecx
jne 0x44a649
cmp dword [edx + 4], 1
jne 0x44a649
movzx ecx, byte [0xf17aa4]
test cl, cl
je 0x44a629
mov dword [esp + 0x10], eax
mov dword [esp], edx
call fcn.0045da30
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x58], 0
mov dword [edx + 0x2c], 0
mov dword [edx + 4], 0
mov dword [esp + 0x20], edx
add esp, 0x1c
ret
mov eax, dword [edx + 4]
mov dword [esp + 0xc], eax
call fcn.0043ed90
lea eax, [0xa20249]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0043f610
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0043f590
lea eax, [0xa1c328]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.0043f610
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0043f590
lea eax, [0xa1c32e]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.0043f610
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.0043f4a0
lea eax, [0xa1f2e7]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043f610
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0043f2f0
call fcn.0043efa0
call fcn.0043edf0
lea eax, [0xa2bc33]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.0043d060
lea eax, [0xa27e52]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.0043d060
nop
call fcn.0046c2f0
jmp fcn.0044a5c0
Function at 0x452bb0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x452d1d
sub esp, 0x1c
movzx edx, byte [esp + 0x20]
movzx eax, dl
cmp eax, 3
jae 0x452d12
shl eax, 6
lea ecx, [0xf342c0]
mov ebx, dword [ecx + eax + 4]
lea eax, [ecx + eax + 4]
test ebx, ebx
jne 0x452c43
mov dword [esp + 0x14], eax
lea eax, [0xf13400]
mov dword [esp], eax
mov dword [esp + 4], 4
mov byte [esp + 8], 1
call fcn.0042d0e0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x452cfc
movzx edx, word [eax + 0x3c]
test dx, dx
jne 0x452ce6
mov edx, dword [eax + 0x14]
test edx, edx
jne 0x452cd0
movzx ecx, byte [esp + 0x20]
mov edx, 0x1000
shl edx, cl
mov dword [eax + 0x44], edx
xor ecx, ecx
jmp 0x452ca7
mov ecx, dword [ebx + 0x14]
mov edx, ecx
test ecx, ecx
je 0x452c7d
mov ecx, dword [ecx]
mov dword [ebx + 0x14], ecx
movzx ecx, word [ebx + 0x3c]
inc ecx
mov word [ebx + 0x3c], cx
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x452c75
mov dword [esp + 0x18], edx
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.0042e5f0
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], edx
add esp, 0x1c
ret
lea eax, [0xa29ed7]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.0043d060
mov edx, dword [eax + 0x14]
mov ebx, dword [eax + 0xc]
add ebx, ecx
mov ebp, ebx
mov dword [ebx], edx
mov dword [eax + 0x14], ebp
mov edx, dword [eax + 0x44]
add ecx, edx
cmp ecx, 0x8000
jb 0x452c93
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0042e750
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
jmp 0x452c43
lea eax, [0xa24fe2]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0043d060
lea eax, [0xa21f05]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043d060
lea eax, [0xa21066]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.0043d060
mov ecx, 3
call fcn.0046d760
nop
call fcn.0046c2f0
jmp fcn.00452bb0
Function at 0x458560
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0xa8]
mov edx, dword [eax + 0x58]
mov ebx, dword [esp + 0x20]
lea ebp, [edx + ebx]
cmp ecx, 1
jle 0x45858e
mov dword [esp + 0x14], edx
mov dword [esp + 8], ebp
mov esi, dword [eax + 0xa4]
xor edi, edi
jmp 0x4585aa
mov dword [esp + 0x24], ebp
add esp, 0x18
ret
mov eax, dword [esp + 0x10]
lea esi, [eax + 0xc]
inc edi
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 8]
cmp edi, ecx
jge 0x4585da
mov dword [esp + 0x10], esi
mov edx, dword [esi]
mov ebp, dword [esi + 4]
cmp ebx, edx
jb 0x4585bf
cmp ebx, ebp
jb 0x4585ce
lea eax, [ecx - 1]
cmp edi, eax
jne 0x458596
cmp ebx, ebp
jne 0x458596
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 8]
lea ebp, [ecx + ebx]
sub ebp, edx
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x5c]
cmp ebp, eax
jbe 0x45858e
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], eax
call fcn.0043ed90
lea eax, [0xa24ff4]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0043f610
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0043f4a0
lea eax, [0xa21f3d]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043f610
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0043f4a0
lea eax, [0xa1b13d]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.0043f610
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0043f4a0
call fcn.0043efa0
call fcn.0043edf0
lea eax, [0xa33dcc]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.0043d060
nop
int3
Function at 0x459730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4598aa
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x4598a0
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x45978a
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x45978a
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x45979d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x459877
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x45986b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x459862
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x4597f0
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x459833
mov eax, 1
cmp eax, ecx
ja 0x459827
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.0046d7d0
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x45985d
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x45982c
mov ecx, dword [esp + 0xc]
jmp 0x4597f5
call fcn.0046d770
xor eax, eax
mov ecx, eax
call fcn.0046d760
call fcn.0046d7d0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x45989b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x459870
mov ecx, dword [esp + 0x18]
jmp 0x4597a2
call fcn.0046d770
xor eax, eax
mov ecx, eax
call fcn.0046d760
nop
call fcn.0046c2f0
jmp fcn.00459730
Function at 0x45fa80
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45fb7d
sub esp, 0x38
mov eax, dword [esp + 0x40]
cmp eax, 0xf
jne 0x45facf
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
lea ecx, [0xa22a8d]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xf
call fcn.00406ed0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x45fb59
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045f970
mov eax, dword [esp + 8]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x28], ebx
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
call fcn.0043ed90
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.0043f610
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0043f610
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0043f610
call fcn.0043edf0
add esp, 0x38
ret
call fcn.0043ed90
lea eax, [0xa1bbb4]
mov dword [esp], eax
mov dword [esp + 4], 5
call fcn.0043f610
call fcn.0043edf0
add esp, 0x38
ret
call fcn.0046c2f0
jmp fcn.0045fa80
Function at 0x45fc70
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45fe7f
sub esp, 0x2c
call fcn.0043ed90
lea eax, [0xa1f3ad]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043f610
call fcn.0043edf0
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x45fcb5
xor ecx, ecx
xor edx, edx
jmp 0x45fcd2
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x34]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00458690
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, eax
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.0045fa80
mov eax, dword [esp + 0x3c]
test eax, eax
setne cl
mov edx, dword [esp + 0x40]
test edx, edx
setne bl
or ebx, ecx
test bl, bl
je 0x45fd2a
call fcn.0043ed90
lea eax, [0xa21f59]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043f610
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.0043f2f0
call fcn.0043edf0
call fcn.0043ed90
call fcn.0043efa0
call fcn.0043edf0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
mov edx, dword [esp + 0x34]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00458560
mov eax, dword [esp + 0x38]
cmp dword [esp + 8], eax
jae 0x45fd5e
lea ecx, [eax - 1]
jmp 0x45fd60
mov ecx, eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov edx, dword [esp + 0x34]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.00459340
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], edx
call fcn.0043ed90
lea eax, str._t_.__E
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043f610
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0043f610
lea eax, [0xb24858]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043f610
mov eax, dword [esp + 0x20]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043f430
call fcn.0043edf0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
mov edx, dword [esp + 0x34]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00458560
mov eax, dword [esp + 0x38]
cmp dword [esp + 8], eax
jae 0x45fe6c
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov ecx, dword [esp + 0x34]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00458560
mov eax, dword [esp + 8]
mov dword [esp + 0x1c], eax
call fcn.0043ed90
lea eax, [0xa1ac39]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.0043f610
mov dword [esp + 4], 0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x1c]
sub eax, ecx
mov dword [esp], eax
call fcn.0043f4a0
call fcn.0043edf0
call fcn.0043ed90
call fcn.0043efa0
call fcn.0043edf0
add esp, 0x2c
ret
call fcn.0046c2f0
jmp fcn.0045fc70