joyce8/EMBER2024-capa huggingface dataset:
Function at 0x650434
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x65044b
add esp, 0xfffffff0
call fcn.0040c780
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004ce0d4
mov eax, dword [0x68cfec]
cmp byte [eax], 0
jne 0x650478
push 0
call fcn.00682a58
test eax, 0x80000000
sete al
mov byte [ebx + 0x19c], al
mov eax, dword [0x68d094]
cmp word [eax + 2], 0
jne 0x650492
mov eax, dword [0x68d094]
mov dword [eax + 4], ebx
mov dword [eax], fcn.006528f8
mov eax, dword [0x68d054]
cmp word [eax + 2], 0
jne 0x6504ac
mov eax, dword [0x68d054]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00652d10
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x51abac]
call fcn.00523154
mov esi, eax
mov dword [ebx + 0x54], esi
mov byte [esi + 0x25], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x6532bc
mov dl, 1
mov eax, dword [0x48e5e0]
call fcn.0040c160
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x48e5e0]
call fcn.0040c160
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x51ff54]
call fcn.0052d968
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x6506a0
mov eax, dword [0x68d034]
mov eax, dword [eax]
push eax
call fcn.00682846
mov edx, eax
mov eax, esi
call fcn.0052df60
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x6535a8
mov dl, 1
mov eax, dword [0x48e5e0]
call fcn.0040c160
mov dword [ebx + 0xb0], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x68d034]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00428ee8
test eax, eax
je 0x6505c3
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00428cec
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00428ecc
test eax, eax
je 0x6505db
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call fcn.00682570
push eax
call fcn.0068256a
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.0040eb9c
push ebx
push 0x6522d0
call fcn.00640058
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x68cfec]
cmp byte [eax], 0
jne 0x65062c
mov eax, ebx
call fcn.00650868
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.00653950
mov eax, ebx
call fcn.00654488
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x650697
call fcn.0040c7d8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x650b98
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x650c3a
cmp dword [ebx + 0xac], 0
jne 0x650c34
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x650ad8
call fcn.00682672
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x650c34
push 3
mov eax, dword [esp + 4]
push eax
call fcn.006827b6
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call fcn.006827c8
test al, 8
je 0x650bfa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x650c34
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004b830c
push eax
call fcn.0068298a
dec esi
cmp esi, 0xffffffff
jne 0x650c09
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x650f70
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x6949e4]
cmp dword [eax + 0x190], 0
je 0x6510d5
test bl, bl
jne 0x65102a
cmp dword [esi + 0xb4], 0
jne 0x65101f
mov eax, esi
call fcn.006542d8
push eax
push 0x650e78
call fcn.00682672
cmp dword [esi + 0x58], 0
je 0x650ff0
mov eax, dword [0x6949e4]
cmp byte [eax + 0xeb], 0
je 0x650ff0
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x650fd1
mov eax, dword [eax - 4]
mov edi, eax
dec edi
cmp edi, 0
jl 0x650ff0
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call fcn.006829b4
dec edi
cmp edi, 0xffffffff
jne 0x650fd9
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x65101f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004b830c
push eax
call fcn.006829a8
dec edi
cmp edi, 0xffffffff
jne 0x650fff
inc dword [esi + 0xb4]
jmp 0x6510d5
cmp dword [esi + 0xb4], 0
jle 0x6510d5
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x6510d5
cmp dword [esi + 0x58], 0
je 0x65108a
mov eax, dword [0x6949e4]
cmp byte [eax + 0xeb], 0
je 0x65108a
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x65106b
mov eax, dword [eax - 4]
mov edi, eax
dec edi
cmp edi, 0
jl 0x65108a
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call fcn.006829b4
dec edi
cmp edi, 0xffffffff
jne 0x651073
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x6510b9
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004b830c
push eax
call fcn.006829a8
dec edi
cmp edi, 0xffffffff
jne 0x651099
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x63c2a8]
call fcn.00411128
pop edi
pop esi
pop ebx
ret
Function at 0x651edc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x651f37
cmp byte [ebx + 0xeb], 0
jne 0x651f37
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call fcn.006827da
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040e02c
mov eax, dword [esi]
test eax, eax
je 0x651f24
mov eax, dword [eax - 4]
test eax, eax
jne 0x651f44
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040e284
jmp 0x651f44
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040e284
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x653b64
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x653bd5
mov eax, esi
call fcn.00551eac
test al, al
je 0x653bd5
mov eax, dword [ebx + 0x98]
call fcn.00551a44
push eax
call fcn.00682828
test eax, eax
je 0x653bd5
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x17c]
test al, al
je 0x653bc6
push 0
mov eax, dword [ebx + 0x98]
call fcn.00551a44
push eax
call fcn.006829b4
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.005476c8
jmp 0x653bd5
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.00653970
pop esi
pop ebx
ret
Function at 0x65c484
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x98], 0
jne 0x65c50a
mov eax, dword [ebx + 8]
call fcn.00551a44
mov ecx, eax
mov dl, 1
mov eax, dword [0x567fb0]
call fcn.0054b2b4
mov dword [ebx + 0x98], eax
mov esi, dword [ebx + 0x98]
xor edx, edx
mov eax, esi
call fcn.00577674
mov dword [esi + 0x2f4], ebx
mov dword [esi + 0x2f0], 0x65bd54
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x98]
call fcn.00551a44
push eax
call fcn.0068298a
push 0
mov eax, dword [ebx + 0x98]
call fcn.00551a44
push eax
call fcn.006829b4
cmp dword [ebx + 0xa8], 0
jne 0x65c58c
mov eax, dword [ebx + 8]
call fcn.00551a44
mov ecx, eax
mov dl, 1
mov eax, dword [0x567fb0]
call fcn.0054b2b4
mov dword [ebx + 0xa8], eax
mov esi, dword [ebx + 0xa8]
mov dl, 1
mov eax, esi
call fcn.00577674
mov dword [esi + 0x2f4], ebx
mov dword [esi + 0x2f0], 0x65bda0
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa8]
call fcn.00551a44
push eax
call fcn.0068298a
push 0
mov eax, dword [ebx + 0xa8]
call fcn.00551a44
push eax
call fcn.006829b4
cmp dword [ebx + 0xa0], 0
jne 0x65c60a
mov eax, dword [ebx + 8]
call fcn.00551a44
mov ecx, eax
mov dl, 1
mov eax, dword [0x569928]
call fcn.0054b2b4
mov dword [ebx + 0xa0], eax
mov esi, dword [ebx + 0xa0]
mov byte [esi + 0x2c8], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa0]
call fcn.00551a44
push eax
call fcn.0068298a
push 0
mov eax, dword [ebx + 0xa0]
call fcn.00551a44
push eax
call fcn.006829b4
pop esi
pop ebx
ret
Function at 0x66af94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov byte [ebp - 5], al
mov al, byte [edx]
mov bl, al
xor bl, byte [ebp + 0xc]
lock cmpxchg byte [edx], bl
jne 0x66afa9
mov byte [ebp + 0xc], al
mov al, byte [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
movzx eax, al
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x66b524
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ax, word [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov word [ebp - 6], ax
mov ax, word [edx]
mov bx, ax
xor bx, word [ebp + 0xc]
lock cmpxchg word [edx], bx
jne 0x66b53c
mov word [ebp + 0xc], ax
mov ax, word [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov word [ebp - 0xe], ax
mov ax, word [ebp - 0xe]
movzx eax, ax
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x66ba84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [edx]
mov ebx, eax
xor ebx, dword [ebp + 0xc]
lock cmpxchg dword [edx], ebx
jne 0x66ba99
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x66cd44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
mov edi, dword [ebp - 0x1c]
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov ecx, edx
mov ebx, eax
xor ebx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x14]
lock cmpxchg8b qword [edi]
jne 0x66cd6d
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x66cfa8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
test edi, edi
je 0x66d0da
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x66d0da
cmp dword [esp + 0x28], 0
je 0x66d0da
mov dword [esp], str.borlndmm
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov esi, eax
test esi, esi
je 0x66d0da
mov ebp, dword [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysGetMem_qqri
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [edi], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysFreeMem_qqrpv
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebx], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysReallocMem_qqrpvi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysAllocMem_qqri
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebp], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysRegisterExpectedMemoryLeak_qqrpi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [esp], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 4], str._Borlndmm_SysUnregisterExpectedMemoryLeak_qqrpi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [esi], eax
mov eax, dword [edi]
mov dword [0x695010], eax
cmp dword [ebp], 0
jne 0x66d08e
mov dword [ebp], 0x66cf78
mov eax, dword [esp + 0x30]
cmp dword [eax], 0
jne 0x66d09d
mov dword [eax], 0x66cf68
mov ecx, dword [esi]
test ecx, ecx
je 0x66d0ca
cmp dword [edi], 0
je 0x66d0da
cmp dword [ebx], 0
je 0x66d0da
mov esi, dword [esp + 0x28]
cmp dword [esi], 0
je 0x66d0da
cmp dword [ebp], 0
je 0x66d0da
cmp dword [eax], 0
je 0x66d0da
xor eax, eax
test ecx, ecx
setne al
jmp 0x66d0dc
mov dword [esi], 0x66cf68
mov ecx, 0x66cf68
cmp dword [edi], 0
jne 0x66d0a8
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x66e974
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x68b008], eax
jbe 0x66e9b1
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x695124]
call sub.KERNEL32.DLL_ReadFile
add esp, 0xc
cmp eax, 1
jne 0x66e9b8
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
jmp 0x66e9ce
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
jne 0x66e9ca
add esp, 0xc
ret
sub esp, 0xc
push ecx
call fcn.0066f6f4
add esp, 0x10
add esp, 0xc
ret

Function at 0x66e9ec
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x68b008], eax
jbe 0x66ea29
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x695124]
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
cmp eax, 1
jne 0x66ea3a
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
call fcn.0066f6f4
add esp, 0x10
add esp, 0xc
ret
call fcn.0066f794
add esp, 0xc
ret
Function at 0x6703d0
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.KERNEL32.DLL_DeleteFileA
sub esp, 4
cmp eax, 1
jne 0x6703ed
xor eax, eax
add esp, 0xc
ret
add esp, 0xc
jmp fcn.0066f794
Function at 0x672ecc
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x21c
mov dword [esp + 0x18], edx
mov esi, ecx
mov eax, dword [esi + 4]
lea ebp, [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], eax
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 4], 0x1001
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.0066df78
mov word [esp + eax + 0x1c], 0x5f
mov edi, dword [esi + 4]
mov dword [esp], ebp
call fcn.0066df78
lea ecx, [esp + eax + 0x1c]
mov edx, pe_nt_image_headers32
sub edx, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp], edi
mov dword [esp + 4], 0x1002
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.0066df78
mov word [esp + eax + 0x1c], 0x2e
mov edi, dword [esi]
mov dword [esp], ebp
call fcn.0066df78
lea eax, [esp + eax + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], 0xa
call fcn.00676298
mov edi, dword [esi + 0x24]
test edi, edi
je 0x672fc0
mov dword [esp], edi
call fcn.0066df78
mov ebx, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0066df78
mov ecx, ebp
mov ebp, eax
mov dword [esp], ecx
call fcn.0066df78
add ebp, ebx
lea eax, [eax + ebp + 3]
lea ebp, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0066d384
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
jne 0x673015
jmp 0x67305d
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0066df78
mov ebx, eax
mov edi, ebp
mov dword [esp], ebp
call fcn.0066df78
mov ebp, eax
lea eax, [ebx + ebp + 3]
mov dword [esp], eax
call fcn.0066d36c
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
je 0x67305d
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0066df78
lea eax, [ebp + eax + 3]
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.0066de13
mov ebp, edi
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0066de2c
mov edi, dword [esi + 0x24]
mov dword [esp], edi
call fcn.0066df78
mov word [edi + eax], 0x3d
mov eax, dword [esi + 0x24]
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.0066de2c
mov esi, dword [esi + 0x24]
mov dword [esp], esi
call fcn.0066df78
mov word [esi + eax], 0xa
mov eax, 1
jmp 0x67305f
xor eax, eax
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x674ab8
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
push 0
push dword [edi + 4]
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0066d36c
add esp, 0x10
mov dword [edi + 4], eax
push esi
push eax
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi]
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0066d36c
add esp, 0x10
mov dword [edi], eax
test edi, edi
je 0x674b2b
push esi
push eax
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
jmp 0x674b3a
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
xor ecx, ecx
and ecx, ebx
mov dword [esp + 8], ecx
push 0
push dword [edi + 8]
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0066d36c
add esp, 0x10
mov dword [edi + 8], eax
push esi
push eax
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi + 0xc]
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0066d36c
add esp, 0x10
mov dword [edi + 0xc], eax
push esi
push eax
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
and ecx, ebx
mov ebx, ebp
mov ebp, ecx
push 0
push dword [edi + 0x10]
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0066d36c
add esp, 0x10
mov dword [edi + 0x10], eax
push esi
push eax
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
and ebx, ebp
and ebx, dword [esp + 8]
sub esp, 0xc
push 4
call fcn.0066d36c
add esp, 0x10
mov esi, eax
test esi, esi
je 0x674c24
push 4
push esi
push 0x11
push dword [esp + 0x2c]
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0xc
test eax, eax
je 0x674c33
push esi
call fcn.00675c4c
add esp, 0x10
mov word [edi + 0x14], ax
sub esp, 0xc
push esi
call fcn.0066d37c
add esp, 0x10
mov eax, 1
jmp 0x674c3e
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
jmp 0x674c3c
push esi
call fcn.0066d37c
add esp, 0x10
xor eax, eax
and ebx, eax
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x67887c
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push dword [esp + 0x4c]
call sub.KERNEL32.DLL_CreateFileA
add esp, 4
mov edi, eax
test edi, edi
je 0x678942
sub esp, 0xc
lea eax, [esp + 0x14]
push eax
call sub.KERNEL32.DLL_GetLocalTime
add esp, 0xc
movzx eax, word [esp + 0xa]
mov dword [esp + 0x18], eax
movzx ecx, word [esp + 0xe]
movzx edx, word [esp + 8]
movzx ebp, word [esp + 0x10]
movzx eax, word [esp + 0x12]
movzx esi, word [esp + 0x14]
movzx ebx, word [esp + 0x16]
sub esp, 0xc
push ebx
push esi
push eax
push ebp
push edx
push ecx
push dword [esp + 0x3c]
push str._02d__02d__04d__02d:_02d:_02d._03d
push 0x69542c
call fcn.006829fc
add esp, 0x24
push 0x69542c
call fcn.0066df78
add esp, 4
push 0
lea ebx, [esp + 0x18]
push ebx
push eax
push 0x69542c
push edi
call sub.KERNEL32.DLL_WriteFile
mov esi, dword [esp + 0x40]
push esi
call fcn.0066df78
add esp, 4
push 0
push ebx
push eax
push esi
push edi
call sub.KERNEL32.DLL_WriteFile
push edi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0xc
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x678974
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x90
mov edi, dword [esp + 0xa0]
mov eax, dword [0x69544c]
test eax, eax
mov ecx, dword [0x695448]
jne 0x678a39
test ecx, ecx
jne 0x678a39
cmp dword [0x68c588], 0
je 0x678a6f
sub esp, 4
lea esi, [esp + 0x14]
push 0x80
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 4
push 0x5c
push esi
call fcn.00678118
add esp, 0x10
test eax, eax
jne 0x6789e4
sub esp, 8
push 0x3a
push esi
call fcn.00678118
add esp, 0x10
test eax, eax
je 0x6789e7
inc eax
mov esi, eax
mov dword [esp + 0xc], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x678a2a
call sub.KERNEL32.DLL_GetCurrentThreadId
sub esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0x678b04
push eax
call fcn.0068266c
add esp, 4
cmp dword [esp + 0xc], 0
mov eax, 0x11010
mov ecx, 0x12010
cmove ecx, eax
push ecx
push esi
push edi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x678abc
cmp ecx, 0xffffffff
je 0x678abc
test ecx, ecx
je 0x678a50
sub esp, 0xc
push edi
call ecx
add esp, 0x10
mov eax, dword [0x69544c]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x678abc
cmp byte [eax], 0
je 0x678abc
sub esp, 8
push edi
push eax
call fcn.0067887c
add esp, 0xa0
jmp 0x678ac2
sub esp, 0xc
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
add esp, 0xc
mov esi, eax
sub esp, 0xc
lea ebx, [esp + 0x1c]
push 0
push ebx
push 2
push 0x68c2c8
push esi
call sub.KERNEL32.DLL_WriteFile
push edi
call fcn.0066df78
add esp, 4
push 0
push ebx
push eax
push edi
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
push ebx
push 2
push 0x68c2c8
push esi
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
add esp, 0x90
pop esi
pop edi
pop ebx
ret
Function at 0x679c4c
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x69d488]
test eax, eax
je 0x679c81
mov ecx, dword [eax]
test ecx, ecx
je 0x679ce4
add eax, 4
xor edi, edi
nop
cmp byte [ecx], 1
sbb edi, 0
inc edi
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x679c6c
jmp 0x679d10
mov esi, dword [0x69d4d4]
test esi, esi
jne 0x679cae
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov esi, eax
mov dword [0x69d4d4], esi
test esi, esi
jne 0x679cae
mov dword [esp], 0x68c424
call fcn.00678ae4
mov esi, dword [0x69d4d4]
mov dword [esp], esi
call fcn.0066df78
test eax, eax
je 0x679ce8
xor ebx, ebx
xor edi, edi
mov ebp, esi
nop word cs:[eax + eax]
lea ebx, [eax + ebx + 1]
inc edi
lea ebp, [ebp + eax + 1]
mov dword [esp], ebp
call fcn.0066df78
test eax, eax
jne 0x679ccc
inc ebx
jmp 0x679cef
xor edi, edi
jmp 0x679d10
mov ebx, 1
xor edi, edi
mov dword [esp], ebx
call fcn.0066d36c
mov dword [0x69d484], eax
test eax, eax
je 0x679d69
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0066dc48
lea eax, [edi + 4]
mov dword [0x69d48c], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.0066d350
mov esi, eax
test esi, esi
je 0x679d69
mov edi, dword [0x69d488]
test edi, edi
je 0x679d6d
mov edx, dword [edi]
test edx, edx
je 0x679da6
lea eax, [edi + 4]
xor ecx, ecx
nop word [eax + eax]
cmp byte [edx], 0
je 0x679d5c
mov edx, dword [eax - 4]
mov dword [esi + ecx*4], edx
jmp 0x679d5d
dec ecx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x679d4c
jmp 0x679da2
xor eax, eax
jmp 0x679db9
mov ebx, dword [0x69d484]
mov dword [esp], ebx
call fcn.0066df78
test eax, eax
je 0x679dae
mov ebp, esi
nop word cs:[eax + eax]
mov dword [ebp], ebx
lea ebx, [ebx + eax + 1]
mov dword [esp], ebx
call fcn.0066df78
add ebp, 4
test eax, eax
jne 0x679d8c
test edi, edi
je 0x679dae
mov dword [esp], edi
call fcn.0066d37c
mov dword [0x69d488], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret