joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70c4c2c1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x712e9018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x712e9018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x70c4c384
jmp 0x70c4c427
jmp 0x70c4c4ca
jmp 0x70c4c56d
jmp 0x70c4c610
jmp 0x70c4c6b3
jmp 0x70c4c756
jmp 0x70c4c7f9
jmp 0x70c4c89c
jmp 0x70c4c93f
jmp 0x70c4c9e2
jmp 0x70c4ca85
jmp 0x70c4cb28
jmp 0x70c4cbcb
jmp 0x70c4cc6e
jmp 0x70c4cd11
jmp 0x70c4cdb4
jmp 0x70c4ce57
jmp 0x70c4cefa
jmp 0x70c4cf9d
jmp 0x70c4d040
jmp 0x70c4d0e3
jmp 0x70c4d186
jmp 0x70c4d229
jmp 0x70c4d2cc
jmp 0x70c4d36f
jmp 0x70c4d412
jmp 0x70c4d4b5
mov dword [ebp - 0x14], 0
jmp 0x70c4d55f
jmp 0x70c4d602
jmp 0x70c4d6a5
jmp 0x70c4d748
jmp 0x70c4d7eb
jmp 0x70c4d88e
jmp 0x70c4d931
jmp 0x70c4d9d4
jmp 0x70c4da77
jmp 0x70c4db1a
jmp 0x70c4dbbd
jmp 0x70c4dc60
jmp 0x70c4dd03
jmp 0x70c4dda6
jmp 0x70c4de49
jmp 0x70c4deec
jmp 0x70c4df8f
jmp 0x70c4e032
jmp 0x70c4e0d5
jmp 0x70c4e178
jmp 0x70c4e21b
jmp 0x70c4e2be
jmp 0x70c4e361
jmp 0x70c4e404
jmp 0x70c4e4a7
jmp 0x70c4e54a
jmp 0x70c4e5ed
jmp 0x70c4e690
mov dword [ebp - 0x18], 0
jmp 0x70c4e73a
jmp 0x70c4e7dd
jmp 0x70c4e880
jmp 0x70c4e923
jmp 0x70c4e9c6
jmp 0x70c4ea69
jmp 0x70c4eb0c
jmp 0x70c4ebaf
jmp 0x70c4ec52
jmp 0x70c4ecf5
jmp 0x70c4ed98
jmp 0x70c4ee3b
jmp 0x70c4eede
jmp 0x70c4ef81
jmp 0x70c4f024
jmp 0x70c4f0c7
jmp 0x70c4f16a
jmp 0x70c4f20d
jmp 0x70c4f2b0
jmp 0x70c4f353
jmp 0x70c4f3f6
jmp 0x70c4f499
jmp 0x70c4f53c
jmp 0x70c4f5df
jmp 0x70c4f682
jmp 0x70c4f725
jmp 0x70c4f7c8
jmp 0x70c4f86b
mov dword [ebp - 0x10], 0
jmp 0x70c4f915
jmp 0x70c4f9b8
jmp 0x70c4fa5b
jmp 0x70c4fafe
jmp 0x70c4fba1
jmp 0x70c4fc44
jmp 0x70c4fce7
jmp 0x70c4fd8a
jmp 0x70c4fe2d
jmp 0x70c4fed0
jmp 0x70c4ff73
jmp 0x70c50016
jmp 0x70c500b9
jmp 0x70c5015c
jmp 0x70c501ff
jmp 0x70c502a2
jmp 0x70c50345
jmp 0x70c503e8
jmp 0x70c5048b
jmp 0x70c5052e
jmp 0x70c505d1
jmp 0x70c50674
jmp 0x70c50717
jmp 0x70c507ba
jmp 0x70c5085d
jmp 0x70c50900
jmp 0x70c509a3
jmp 0x70c50a46
mov dword [ebp - 0x10], 0
jmp 0x70c563be
jmp 0x70c50af5
jmp 0x70c50b98
jmp 0x70c50c3b
jmp 0x70c50cde
jmp 0x70c50d81
jmp 0x70c50e24
jmp 0x70c50ec7
jmp 0x70c50f6a
jmp 0x70c5100d
jmp 0x70c510b0
jmp 0x70c51153
jmp 0x70c511f6
jmp 0x70c51299
jmp 0x70c5133c
jmp fcn.70c513df
mov eax, dword [0x712e9018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x70c50a52
nop
leave
ret
Function at 0x4ee3b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc7000]
push edi
or ebp, 0xffffffff
jmp 0x4ee3d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ee3d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ee3c8
mov eax, 1
add ebx, ebx
jne 0x4ee3eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ee3fc
jne 0x4ee41b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ee41b
dec eax
add ebx, ebx
jne 0x4ee408
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ee3e0
add ebx, ebx
jne 0x4ee417
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ee46d
xor ecx, ecx
sub eax, 3
jb 0x4ee433
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ee4a2
sar eax, 1
mov ebp, eax
jmp 0x4ee43e
add ebx, ebx
jne 0x4ee43e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ee40c
inc ecx
add ebx, ebx
jne 0x4ee44c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ee40c
add ebx, ebx
jne 0x4ee459
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ee44e
jne 0x4ee46a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ee44e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ee48c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ee47e
jmp 0x4ee3ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ee48c
add edi, ecx
jmp 0x4ee3ce
pop esi
mov edi, esi
mov ecx, 0x866
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ee4aa
cmp byte [edi], 0xa
jne 0x4ee4aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ee4af
lea edi, [esi + 0xec000]
mov eax, dword [edi]
or eax, eax
je 0x4ee527
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xee7cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xee920]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ee4dc
mov ecx, edi
jns 0x4ee50b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xee924]
or eax, eax
je 0x4ee521
mov dword [ebx], eax
add ebx, 4
jmp 0x4ee4f9
call dword [esi + 0xee934]
mov ebp, dword [esi + 0xee928]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ee55b
sub esp, 0xffffff80
jmp 0x465d14
Function at 0x410860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
jmp 0x41087a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x410881
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x410870
mov eax, 1
add ebx, ebx
jne 0x410893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x410888
jne 0x4108a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410888
xor ecx, ecx
sub eax, 3
jb 0x4108b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41092a
mov ebp, eax
add ebx, ebx
jne 0x4108c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4108d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4108f4
inc ecx
add ebx, ebx
jne 0x4108e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4108d5
jne 0x4108f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4108d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x410914
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x410905
jmp 0x410876
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x410914
add edi, ecx
jmp 0x410876
pop esi
mov edi, esi
mov ecx, 0x186
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x410932
cmp byte [edi], 7
jne 0x410932
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x410937
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x4109a6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x116e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11748]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x410964
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1174c]
or eax, eax
je 0x4109a0
mov dword [ebx], eax
add ebx, 4
jmp 0x410981
call dword [esi + 0x1175c]
mov ebp, dword [esi + 0x11750]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4109da
sub esp, 0xffffff80
jmp 0x40199b
Function at 0x435440
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2a000]
push edi
or ebp, 0xffffffff
jmp 0x435462
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x435469
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x435458
mov eax, 1
add ebx, ebx
jne 0x43547b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x435470
jne 0x43548c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x435470
xor ecx, ecx
sub eax, 3
jb 0x4354a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x435512
mov ebp, eax
add ebx, ebx
jne 0x4354ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4354b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4354dc
inc ecx
add ebx, ebx
jne 0x4354c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4354bd
jne 0x4354d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4354bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4354fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4354ed
jmp 0x43545e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4354fc
add edi, ecx
jmp 0x43545e
pop esi
mov edi, esi
mov ecx, 0x85d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43551a
cmp byte [edi], 0
jne 0x43551a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x43551f
lea edi, [esi + 0x33000]
mov eax, dword [edi]
or eax, eax
je 0x43558e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x36238]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x362ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43554c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x362f0]
or eax, eax
je 0x435588
mov dword [ebx], eax
add ebx, 4
jmp 0x435569
call dword [esi + 0x362f4]
popal
jmp 0x4170f8
Function at 0x66001dd2
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.66001e36
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x6610c050], eax
je 0x660488a3
push 0x74
push 1
call fcn.66001e61
mov esi, eax
add esp, 8
test esi, esi
je 0x660488a3
mov eax, dword [0x6610c050]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x660488a3
push esi
call fcn.66002051
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x66002064
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x6610c1f8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x66002097
call edi
mov esi, eax
test esi, esi
je 0x66048cf4
mov eax, 1
mov dword [0x6610c1f8], eax
cmp eax, 1
jne 0x66048d37
test esi, esi
je 0x66048d06
cmp word [esi], 0
mov eax, esi
je 0x660020c2
add eax, 2
cmp word [eax], 0
jne 0x660020b0
add eax, 2
cmp word [eax], 0
jne 0x660020b0
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x66048d29
push edi
call fcn.66002122
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x66048d29
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x66048d19
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
call ebp
mov ebx, eax
test ebx, ebx
je 0x66048d12
mov eax, 2
jmp 0x66002092
call edi
mov esi, eax
test esi, esi
jne 0x660020a8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.660026f5
add esp, 4
xor ebx, ebx
jmp 0x66002114
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x66048d12
test ebx, ebx
jne 0x66048d48
call ebp
mov ebx, eax
test ebx, ebx
je 0x66048d12
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x66048d60
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x66048d50
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x66048d50
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.66002122
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x66048d82
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x660037e1
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.66002de1
mov eax, dword [0x6610e79c]
mov ebp, dword [esp + 0x10]
cmp eax, 1
je 0x66048487
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x6610a020], 1
mov byte [0x6610e798], bl
jne 0x66003855
mov ecx, dword [0x6610c7dc]
test ecx, ecx
je 0x66003843
mov esi, dword [0x6610c7d8]
sub esi, 4
cmp esi, ecx
jb 0x66003843
mov eax, dword [esi]
test eax, eax
je 0x6600383c
call eax
mov ecx, dword [0x6610c7dc]
sub esi, 4
cmp esi, ecx
jae 0x6600382e
push 0x6610e78c
push 0x6610e784
call fcn.660029b8
add esp, 8
push 0x6610e794
push 0x6610e790
call fcn.660029b8
add esp, 8
test ebx, ebx
je 0x6604849a
call fcn.66002e33
pop esi
pop ebp
pop ebx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x660037fb
push ebp
mov dword [0x6610e79c], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x6600e0c1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x6603b833
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x6603b841
push 1
mov dword [ebp + 8], eax
pop ebx
cmp dword [esi + 0x38], ebx
jge 0x6600e107
mov ecx, dword [esi + 0x24]
push eax
push edi
call fcn.6600e1d1
test eax, eax
mov dword [ebp - 4], eax
jl 0x6600e198
mov dword [esi + 0x38], ebx
push 2
pop ebx
cmp dword [esi + 0x38], ebx
jge 0x6600e14e
mov eax, dword [edi + 0x3c]
shl eax, 0x1f
sar eax, 0x1f
push eax
push dword [esi + 0x28]
call fcn.6600fda9
test eax, eax
mov dword [ebp - 4], eax
jl 0x6600e198
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x38], ebx
test al, 1
jne 0x6603b84f
xor ecx, ecx
cmp dword [esi + 0x2c], ebx
sete cl
test cl, cl
jne 0x6603b84f
test al, 4
jne 0x6603b84f
push 3
pop ebx
cmp dword [esi + 0x38], ebx
jge 0x6600e17a
mov eax, dword [edi + 0x3c]
test al, 4
jne 0x6603b865
shl eax, 0x1f
sar eax, 0x1f
push eax
push dword [esi + 0x28]
call fcn.660116da
test eax, eax
mov dword [ebp - 4], eax
jl 0x6600e198
mov dword [esi + 0x38], ebx
push dword [ebp + 8]
call fcn.660035fe
test eax, eax
jne 0x6603b87b
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.66011b48
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x6600e1c2
mov eax, dword [ebp - 4]
mov dword [esi + 0xec], eax
xor eax, eax
cmp dword [esi + 0x2c], 2
sete al
test al, al
jne 0x6603b8ad
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
cmp dword [esi + 0x20], 0
jne 0x6600e19e
mov ecx, esi
call fcn.66016a21
jmp 0x6600e19e
mov eax, dword [esi + 0x24]
mov edi, dword [eax + 0x11c]
jmp 0x6600e0d9
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x118]
jmp 0x6600e0e4
mov eax, dword [esi + 0x28]
push 0
push dword [eax + 0x36c]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x6600e14e
xor ecx, ecx
cmp dword [esi + 0x2c], 1
sete cl
test cl, cl
je 0x6600e17a
jmp 0x6600e161
lea ecx, [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.6601388d
test eax, eax
je 0x6600e18a
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x20], 0
jne 0x6603b8a1
cmp byte [eax + 0x21], 0
je 0x6600e198
mov dword [ebp - 4], 0x8000ffff
jmp 0x6600e198
test byte [edi + 0x3c], 1
jne 0x6600e1b8
push dword [esi + 0xf4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x6600e1b8
Function at 0x6600e1d1
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
push 0x6610e498
lea ecx, [ebp - 4]
call fcn.6600354f
mov ecx, dword [esi + 0x124]
lea eax, [esi + 0x124]
test ecx, ecx
lea edx, [ecx + 1]
mov dword [eax], edx
jne 0x6600e2bf
mov edi, dword [ebp + 8]
test byte [edi + 0x3c], 1
jne 0x6603baad
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
je 0x6603ba92
test al, al
je 0x6600e22d
cmp al, 0x20
je 0x6600e22d
mov al, byte [esi + 1]
inc esi
jmp 0x6600e21f
mov al, byte [esi]
test al, al
je 0x6600e23a
cmp al, 0x20
jne 0x6600e23a
inc esi
jmp 0x6600e22d
push esi
mov dword [0x6610e7a8], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 4
and al, 0xfc
call fcn.660300e8
mov ebx, esp
test ebx, ebx
je 0x6603bacd
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [edi + 0x3c]
shl eax, 0x1f
sar eax, 0x1f
push eax
push dword [ebp + 0xc]
push esi
call fcn.6600e2d3
mov esi, eax
test esi, esi
jl 0x6603bab7
mov eax, ebx
shr eax, 0x10
test ax, ax
je 0x6603bac6
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300e8
mov eax, esp
push ebx
push eax
call fcn.660035d5
push eax
call fcn.6600fd7b
test eax, eax
je 0x6603bacd
lea ecx, [ebp - 4]
call fcn.66003582
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 8
mov al, byte [esi + 1]
inc esi
test al, al
je 0x6603ba9e
cmp al, 0x22
jne 0x6603ba92
cmp byte [esi], 0
je 0x6600e22d
inc esi
jmp 0x6600e22d
mov esi, 0x6601a430
jmp 0x6600e23a
lea ecx, [ebp - 4]
call fcn.66003582
mov eax, esi
jmp 0x6600e2c9
mov eax, ebx
jmp 0x6600e2b1
lea ecx, [ebp - 4]
call fcn.66003582
mov eax, 0x8007000e
jmp 0x6600e2c9

Function at 0x6600e903
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
mov dword [0x6610e9e4], eax
call fcn.6600e958
cmp dword [0x6610e730], 0
mov dword [0x6610e9e0], eax
jne 0x6600e933
xor ecx, ecx
test eax, eax
sete cl
mov dword [0x6610e730], ecx
lea eax, [ebp - 2]
push 2
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x6603b39a
mov al, byte [ebp - 2]
mov byte [0x6610e9e8], al
leave
ret
mov byte [0x6610e9e8], 0x2e
leave
ret
Function at 0x6600e971
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push esi
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x66037acf
lea ecx, [ebp - 0x3c]
push ecx
push 0x3c
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x66037acf
cmp byte [ebp - 0x25], 0xb2
je 0x66037acf
cmp byte [ebp - 0x25], 0xb1
je 0x66037acf
push 1
pop eax
pop esi
leave
ret
lea eax, [ebp - 0x150]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x6600e9b4
lea eax, [ebp - 0x150]
push 0x6604fa7c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x6610e7b8], eax
je 0x6600e9b4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6604fa68
push eax
call esi
test eax, eax
mov dword [0x6611083c], eax
je 0x6600e9b4
push 0x6604fa54
push dword [0x6610e7b8]
call esi
test eax, eax
mov dword [0x66110850], eax
je 0x6600e9b4
push 0x6604fa40
push dword [0x6610e7b8]
call esi
test eax, eax
mov dword [0x66110830], eax
je 0x6600e9b4
push 0x6604fa2c
push dword [0x6610e7b8]
call esi
test eax, eax
mov dword [0x66110854], eax
je 0x6600e9b4
push 0x6604fa18
push dword [0x6610e7b8]
call esi
test eax, eax
mov dword [0x66110828], eax
je 0x6600e9b4
push 0x6604fa04
push dword [0x6610e7b8]
call esi
test eax, eax
mov dword [0x66110840], eax
je 0x6600e9b4
push 0x6604f9f0
push dword [0x6610e7b8]
call esi
test eax, eax
mov dword [0x66110838], eax
je 0x6600e9b4
push 0x6604f9e0
push dword [0x6610e7b8]
call esi
test eax, eax
mov dword [0x66110844], eax
je 0x6600e9b4
push 0x6604f9cc
push dword [0x6610e7b8]
call esi
test eax, eax
mov dword [0x6611081c], eax
je 0x6600e9b4
push 0x6604f9bc
push dword [0x6610e7b8]
call esi
test eax, eax
mov dword [0x66110820], eax
je 0x6600e9b4
call dword [0x6611083c]
test eax, eax
je 0x6600e9b4
call dword [0x66110850]
mov edx, eax
and edx, 0xf
cmp edx, 2
jb 0x6600e9b4
cmp edx, 2
mov ecx, 0x3f0
jne 0x66037c70
mov esi, eax
and esi, ecx
cmp esi, 0x10
jb 0x6600e9b4
cmp edx, edx
jne 0x66037c70
mov edx, eax
and edx, ecx
cmp edx, 0x10
jne 0x66037c70
and eax, 0xfc00
cmp eax, 0x1000
jb 0x6600e9b4
push 1
pop eax
mov dword [0x6610e7b4], eax
jmp 0x6600e9b7

Function at 0x6600ea62
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push 4
push eax
push reloc.OLEAUT32.dll_SysAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x66037984
mov ax, si
and esi, 0x3ff
shr ax, 0xa
test ax, ax
je 0x6600eab5
cmp ax, 1
jne 0x6603797d
cmp si, 4
je 0x6603797d
cmp si, 0x16
je 0x6603797d
push 2
pop eax
and byte [ebp + eax - 8], 0
inc eax
cmp dword [ebp + 0x10], eax
jb 0x66037984
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop esi
leave
ret 0xc
push 3
jmp 0x6600eab7
mov eax, 0x80004005
jmp 0x6600ead6
Function at 0x6600f492
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp dword [ebx + 0xc], 0
je 0x6600f4fb
movsx edx, word [ebx + 6]
mov ecx, dword [0x6610eca0]
add edx, 7
and edx, 0xfffffffc
cmp edx, ecx
mov dword [ebp + 8], edx
ja 0x6600f51a
mov eax, dword [0x6610ec98]
add dword [0x6610ec98], edx
sub ecx, edx
mov esi, dword [ebx + 8]
mov dword [0x6610eca0], ecx
lea edi, [eax + 4]
movsx ecx, word [ebx + 6]
mov edx, ecx
mov dword [ebp + 8], 0xfffffffd
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
sub dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0xc]
lea ecx, [ebx + 3]
jmp 0x6600f609
push 0xd4
push 8
push dword [0x6610e6c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebx + 0xc], eax
jne 0x6600f4a4
jmp 0x6603f59d
mov edx, dword [0x6610eca8]
test edx, edx
je 0x6600f57d
mov eax, dword [0x6610ec98]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add ecx, eax
mov eax, dword [0x6610ec9c]
sub ecx, eax
test eax, eax
je 0x6600f598
lea edi, [ecx + edx]
cmp edi, 0x10000
ja 0x6600f598
push 4
add ecx, edx
push 0x1000
push ecx
push eax
call esi
test eax, eax
je 0x6603f59d
mov ecx, dword [0x6610eca0]
mov eax, dword [0x6610ec9c]
add ecx, dword [0x6610eca8]
cmp eax, dword [0x6610ec98]
je 0x6600f5df
mov edx, dword [ebp + 8]
jmp 0x6600f4bb
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x20]
mov ecx, dword [0x6610eca0]
mov dword [0x6610eca8], edx
jmp 0x6600f524
push 4
push 0x2000
push 0x10000
push 0
call esi
mov edi, eax
test edi, edi
je 0x6603f59d
push 1
call fcn.6600f342
mov edx, dword [0x6610eca8]
mov eax, edi
xor ecx, ecx
mov dword [0x6610ec9c], eax
mov dword [0x6610ec98], edi
mov dword [0x6610eca0], ecx
mov dword [0x6610eca4], ecx
jmp 0x6600f547
mov edx, dword [0x6610ecac]
sub ecx, 4
add dword [0x6610ec98], 4
mov dword [eax], edx
mov dword [0x6610ecac], eax
jmp 0x6600f575
mov edx, dword [ebp + 8]
add esi, 4
inc ecx
add edx, ecx
cmp edx, 3
jge 0x6600f631
movzx edx, byte [ecx - 3]
lea edi, [edx + eax + 4]
movzx edx, byte [ecx]
sub edx, 0
je 0x6600f5fb
dec edx
je 0x6603f5af
dec edx
je 0x6603f5a4
dec edx
dec edx
jne 0x6600f5fb
mov edx, dword [esi]
mov dword [edi], edx
jmp 0x6600f5fb
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp + 0x10]
lea ecx, [ecx + edx*4]
mov edx, dword [ecx]
mov dword [ecx], eax
mov dword [eax], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x6600f640
mov dx, word [esi]
mov word [edi], dx
jmp 0x6600f5fb
mov dl, byte [esi]
mov byte [edi], dl
jmp 0x6600f5fb