joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6600e9f4
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push esi
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x660377cb
lea ecx, [ebp - 0x3c]
push ecx
push 0x3c
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x660377cb
cmp byte [ebp - 0x25], 0xb2
je 0x660377cb
cmp byte [ebp - 0x25], 0xb1
je 0x660377cb
push 1
pop eax
pop esi
leave
ret
lea eax, [ebp - 0x150]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x6600ea37
lea eax, [ebp - 0x150]
push 0x6604f894
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x6610f7ec], eax
je 0x6600ea37
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6604f880
push eax
call esi
test eax, eax
mov dword [0x66111850], eax
je 0x6600ea37
push 0x6604f86c
push dword [0x6610f7ec]
call esi
test eax, eax
mov dword [0x66111864], eax
je 0x6600ea37
push 0x6604f858
push dword [0x6610f7ec]
call esi
test eax, eax
mov dword [0x66111844], eax
je 0x6600ea37
push 0x6604f844
push dword [0x6610f7ec]
call esi
test eax, eax
mov dword [0x66111868], eax
je 0x6600ea37
push 0x6604f830
push dword [0x6610f7ec]
call esi
test eax, eax
mov dword [0x6611183c], eax
je 0x6600ea37
push 0x6604f81c
push dword [0x6610f7ec]
call esi
test eax, eax
mov dword [0x66111854], eax
je 0x6600ea37
push 0x6604f808
push dword [0x6610f7ec]
call esi
test eax, eax
mov dword [0x6611184c], eax
je 0x6600ea37
push 0x6604f7f8
push dword [0x6610f7ec]
call esi
test eax, eax
mov dword [0x66111858], eax
je 0x6600ea37
push 0x6604f7e4
push dword [0x6610f7ec]
call esi
test eax, eax
mov dword [0x66111830], eax
je 0x6600ea37
push 0x6604f7d4
push dword [0x6610f7ec]
call esi
test eax, eax
mov dword [0x66111834], eax
je 0x6600ea37
call dword [0x66111850]
test eax, eax
je 0x6600ea37
call dword [0x66111864]
mov edx, eax
and edx, 0xf
cmp edx, 2
jb 0x6600ea37
cmp edx, 2
mov ecx, 0x3f0
jne 0x6603796c
mov esi, eax
and esi, ecx
cmp esi, 0x10
jb 0x6600ea37
cmp edx, edx
jne 0x6603796c
mov edx, eax
and edx, ecx
cmp edx, 0x10
jne 0x6603796c
and eax, 0xfc00
cmp eax, 0x1000
jb 0x6600ea37
push 1
pop eax
mov dword [0x6610f7e8], eax
jmp 0x6600ea3a

Function at 0x6600eae5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push 4
push eax
push reloc.OLEAUT32.dll_SysAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x66037680
mov ax, si
and esi, 0x3ff
shr ax, 0xa
test ax, ax
je 0x6600eb38
cmp ax, 1
jne 0x66037679
cmp si, 4
je 0x66037679
cmp si, 0x16
je 0x66037679
push 2
pop eax
and byte [ebp + eax - 8], 0
inc eax
cmp dword [ebp + 0x10], eax
jb 0x66037680
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop esi
leave
ret 0xc
push 3
jmp 0x6600eb3a
mov eax, 0x80004005
jmp 0x6600eb59
Function at 0x6600f515
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp dword [ebx + 0xc], 0
je 0x6600f57e
movsx edx, word [ebx + 6]
mov ecx, dword [0x6610fcd8]
add edx, 7
and edx, 0xfffffffc
cmp edx, ecx
mov dword [ebp + 8], edx
ja 0x6600f59d
mov eax, dword [0x6610fcd0]
add dword [0x6610fcd0], edx
sub ecx, edx
mov esi, dword [ebx + 8]
mov dword [0x6610fcd8], ecx
lea edi, [eax + 4]
movsx ecx, word [ebx + 6]
mov edx, ecx
mov dword [ebp + 8], 0xfffffffd
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
sub dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0xc]
lea ecx, [ebx + 3]
jmp 0x6600f68c
push 0xd4
push 8
push dword [0x6610f6c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebx + 0xc], eax
jne 0x6600f527
jmp 0x6603f2ef
mov edx, dword [0x6610fce0]
test edx, edx
je 0x6600f600
mov eax, dword [0x6610fcd0]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add ecx, eax
mov eax, dword [0x6610fcd4]
sub ecx, eax
test eax, eax
je 0x6600f61b
lea edi, [ecx + edx]
cmp edi, 0x10000
ja 0x6600f61b
push 4
add ecx, edx
push 0x1000
push ecx
push eax
call esi
test eax, eax
je 0x6603f2ef
mov ecx, dword [0x6610fcd8]
mov eax, dword [0x6610fcd4]
add ecx, dword [0x6610fce0]
cmp eax, dword [0x6610fcd0]
je 0x6600f662
mov edx, dword [ebp + 8]
jmp 0x6600f53e
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x20]
mov ecx, dword [0x6610fcd8]
mov dword [0x6610fce0], edx
jmp 0x6600f5a7
push 4
push 0x2000
push 0x10000
push 0
call esi
mov edi, eax
test edi, edi
je 0x6603f2ef
push 1
call fcn.6600f3c5
mov edx, dword [0x6610fce0]
mov eax, edi
xor ecx, ecx
mov dword [0x6610fcd4], eax
mov dword [0x6610fcd0], edi
mov dword [0x6610fcd8], ecx
mov dword [0x6610fcdc], ecx
jmp 0x6600f5ca
mov edx, dword [0x6610fce4]
sub ecx, 4
add dword [0x6610fcd0], 4
mov dword [eax], edx
mov dword [0x6610fce4], eax
jmp 0x6600f5f8
mov edx, dword [ebp + 8]
add esi, 4
inc ecx
add edx, ecx
cmp edx, 3
jge 0x6600f6b4
movzx edx, byte [ecx - 3]
lea edi, [edx + eax + 4]
movzx edx, byte [ecx]
sub edx, 0
je 0x6600f67e
dec edx
je 0x6603f301
dec edx
je 0x6603f2f6
dec edx
dec edx
jne 0x6600f67e
mov edx, dword [esi]
mov dword [edi], edx
jmp 0x6600f67e
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp + 0x10]
lea ecx, [ecx + edx*4]
mov edx, dword [ecx]
mov dword [ecx], eax
mov dword [eax], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x6600f6c3
mov dx, word [esi]
mov word [edi], dx
jmp 0x6600f67e
mov dl, byte [esi]
mov byte [edi], dl
jmp 0x6600f67e
Function at 0x6601051e
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x6610f788], 1
push ebx
push esi
push edi
mov ebx, 0x6610fd20
jne 0x66010536
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [0x6610feb0], 0xffffffff
jne 0x66010564
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x6610feb0], eax
je 0x660429d6
call fcn.66010634
mov esi, eax
cmp esi, edi
jne 0x66042969
cmp dword [0x6610f788], edi
je 0x66042993
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, edi
jne 0x660105d3
cmp dword [0x6610f788], edi
je 0x660429a4
push 0xa8
call fcn.660107a3
mov esi, eax
cmp esi, edi
je 0x660429d6
push esi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call fcn.660107e7
cmp dword [0x6610feb4], edi
jne 0x660429b8
cmp dword [0x6610feb8], edi
jne 0x660429b8
mov dword [0x6610feb8], esi
cmp dword [esi + 0x1c], edi
jne 0x660105e8
call fcn.66010843
cmp eax, edi
mov dword [esi + 0x1c], eax
je 0x660429cd
cmp dword [esi + 0x20], edi
jne 0x660105fd
call fcn.6601087a
cmp eax, edi
mov dword [esi + 0x20], eax
je 0x660429cd
mov eax, dword [esp + 0x10]
add eax, 0x8000
cmp eax, dword [esi + 0x70]
jbe 0x6601060e
mov dword [esi + 0x70], eax
call fcn.660fe000
mov ax, word [esp + 0x14]
or word [esi + 0x30], ax
cmp dword [0x6610f788], 1
jne 0x6601062c
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsFree]
or dword [0x6610feb0], 0xffffffff
cmp dword [0x6610f788], 1
jne 0x6604298c
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x6601062e
cmp dword [0x6610feb8], edi
je 0x66010582
jmp 0x66010570
cmp dword [0x6610feb8], edi
je 0x6601058e
push 7
pop eax
jmp 0x6601062e
mov dword [0x6610feb4], 1
mov dword [0x6610feb8], edi
jmp 0x660105d3
push dword [esp + 0x14]
call fcn.660188a3
cmp dword [0x6610f788], 1
jne 0x660429b0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x660429b0

Function at 0x66010891
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
push dword [0x6610feb0]
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
mov dword [esi + 4], 0x6601a1c8
mov dword [esi + 8], 0x6601a1f0
mov dword [esi + 0xc], 0x6601a1d8
mov dword [esi], 0x6601a238
mov dword [esi + 4], 0x6601a228
mov dword [esi + 8], 0x6601a218
mov dword [esi + 0xc], 0x6601a200
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esi + 0x18], eax
call fcn.660108e5
mov eax, esi
pop esi
ret
Function at 0x660133c1
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov ecx, dword [esp + 4]
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], ecx
mov dword [ecx], edx
ret 4

Function at 0x660138ac
Capabilities:
Get thread local storage value

Disassembly:
call fcn.660138c9
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0x14]
mov ecx, dword [ecx]
mov dword [eax + 0x14], ecx
ret

Function at 0x660138dd
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
ret

Function at 0x66013c12
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push 0x1c
call fcn.6600fdd3
mov ebx, eax
test ebx, ebx
je 0x660454c6
push edi
push esi
mov esi, dword [esp + 0x14]
mov edi, ebx
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x18]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x10], eax
call dword [ecx + 4]
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop edi
mov ecx, dword [esp + 8]
mov dword [ebx + 0x14], ecx
mov ecx, dword [eax + 0x48]
mov dword [eax + 0x48], ebx
mov dword [ebx + 0x18], ecx
xor eax, eax
pop ebx
ret 0xc
mov eax, 0x8007000e
jmp 0x66013c5d

Function at 0x660144fa
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x24], 0
jne 0x66045df0
push eax
call fcn.66014520
mov al, byte [eax + 0x28]
shr eax, 2
and eax, 1
ret
xor eax, eax
ret

Function at 0x66014703
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov edi, dword [esp + 0xc]
push edi
call fcn.660fe9ff
mov eax, dword [edi + 0x20]
pop edi
mov dword [esi + 0x14], eax
pop esi
ret 4
Function at 0x660148b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6610f474]
push ebx
xor ebx, ebx
push esi
cmp eax, 0xffffffff
push edi
je 0x66037a9d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [eax + 0x2c], 2
sete cl
movzx ecx, cl
cmp ecx, ebx
mov dword [ebp - 8], ecx
jne 0x66037aa7
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x66014935
mov eax, dword [esi]
push 0xffffffffffffffff
push esi
call dword [eax + 0x28]
cmp dword [ebp + 8], 2
je 0x66014978
cmp eax, ebx
jne 0x6601492a
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push ebx
push eax
call edi
test eax, eax
jne 0x6601492a
cmp dword [ebp - 8], ebx
jne 0x66037ab2
call dword [sym.imp.USER32.dll_WaitMessage]
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x30]
test eax, eax
je 0x66014978
push 1
push ebx
push ebx
lea eax, [ebp - 0x28]
push ebx
push eax
call edi
test eax, eax
je 0x660148f5
cmp dword [ebp - 0x24], 0x12
je 0x6601496e
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
push ecx
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x6601492a
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x6601492a
cmp dword [ebp + 8], 0xffffffff
jne 0x66037af8
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [ebp - 4], ebx
mov eax, ebx
jmp 0x660148d3
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x660148ea
push 0xff
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push ebx
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebx
jne 0x66037af3
mov ecx, dword [ebp - 4]
mov byte [ebp + 0xc], bl
cmp dword [ecx + 0x30], 3
jne 0x66037ae8
mov byte [ebp + 0xc], 1
cmp byte [ebp + 0xc], bl
je 0x6601492a
jmp 0x66014978
lea eax, [ebp + 0xc]
push eax
call fcn.6608827c
jmp 0x66037ada
cmp eax, 1
jmp 0x66037add
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x66014978

Function at 0x66014d49
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x66042f0a
mov esi, dword [esp + 0x10]
test esi, esi
je 0x66042f0a
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + 0x40]
dec eax
mov dword [esi], ecx
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 8
push 5
pop eax
jmp 0x66014d7c

Function at 0x6601501a
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push dword [esp + 0xc]
mov eax, dword [esi + 0xa0]
mov edi, eax
or al, 1
shl edi, 0x1f
push esi
mov dword [esi + 0xa0], eax
sar edi, 0x1f
call fcn.66015069
mov ecx, dword [esi + 0xa0]
xor edx, edx
test edi, edi
setne dl
xor edx, ecx
pop edi
and edx, 1
xor edx, ecx
mov dword [esi + 0xa0], edx
pop esi
ret 4
Function at 0x660152ce
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
push esi
cmp eax, 0xffffffff
push edi
jne 0x66046a25
mov eax, dword [ebp + 8]
xor edi, edi
mov ax, word [eax + 0x2a]
cmp ax, di
je 0x66046a16
movzx eax, ax
dec eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], eax
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edi
cmp ecx, dword [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ecx
ja 0x6601535c
lea ecx, [ecx + ecx*2]
shl ecx, 4
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
mov eax, ecx
add eax, dword [edx + 0x30]
mov eax, dword [eax]
mov esi, eax
inc esi
neg esi
sbb esi, esi
and esi, eax
cmp esi, edi
je 0x66015348
mov eax, dword [esi + 0x18]
test byte [eax + 0x28], 2
jne 0x66015371
inc dword [ebp - 0x14]
add ecx, 0x30
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
cmp eax, dword [ebp - 8]
jbe 0x66015328
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x18], edi
jne 0x66015314
cmp dword [ebp - 0x10], edi
jl 0x66046a95
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [eax + 0x28]
shr eax, 0xf
and eax, 3
cmp al, 2
jl 0x66015348
cmp dword [0x6610feb4], edi
jne 0x66046a32
mov eax, dword [esi + 0x1c]
mov ebx, dword [eax]
cmp ebx, edi
je 0x6601536a
mov ecx, ebx
call fcn.6602e783
mov edi, dword [ebx]
test edi, edi
jne 0x660153b2
mov esi, dword [ebx + 4]
test esi, esi
jne 0x66046a86
mov ecx, dword [ebp - 0x1c]
xor edi, edi
jmp 0x66015348
mov eax, dword [edi + 0x2c]
test ah, 4
jne 0x6601544a
test al, 0x10
jne 0x6601544a
mov ecx, dword [edi + 0x1c]
lea eax, [edi + 0x1c]
push eax
call dword [ecx + 4]
mov eax, dword [ebp - 4]
test byte [eax + 0xa0], 1
je 0x6601542e
push 0
push edi
mov ecx, ebx
call fcn.6601d38c
mov edx, 0x800a9c68
cmp eax, edx
je 0x66046a3e
mov ecx, dword [ebp - 4]
test byte [ecx + 0xa0], 1
je 0x66046a65
test eax, eax
jl 0x66046a74
cmp word [esi + 0x58], 0
je 0x6601542e
test byte [edi + 0x2c], 8
je 0x6601542e
mov eax, dword [ebp - 4]
test byte [eax + 0x76], 2
jne 0x6601542e
cmp dword [ebp + 0xc], 0xffffffff
jne 0x6601542e
mov dword [ebp - 0x18], 1
mov eax, dword [edi + 0x2c]
and al, 0xf7
or al, 0x10
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x18]
test byte [eax + 0x29], 2
jne 0x6601544a
push 0
push edi
call dword [sym.imp.ole32.dll_CoDisconnectObject]
mov edi, dword [edi + 4]
jmp 0x6601539c
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], edi
jmp 0x660152ff
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
xor edi, edi
jmp 0x660152ff
mov ecx, esi
call fcn.660de018
jmp 0x6601538d
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0xa0]
test cl, 1
je 0x660153f3
mov eax, dword [ebp - 4]
and ecx, 0xfffffffe
and dword [ebp - 0x18], 0
mov dword [eax + 0xa0], ecx
jmp 0x6601540b
or dword [edi + 0x2c], 0x10
push edx
call fcn.660dec27
jmp 0x6601540b
cmp dword [ebp - 0x10], 0
jl 0x6601540b
mov dword [ebp - 0x10], eax
jmp 0x6601540b
mov ecx, esi
call fcn.660d5535
mov esi, dword [esi + 4]
jmp 0x660153a3
push dword [ebp - 0x10]
call fcn.660dec27
jmp 0x6601536a
Function at 0x660159ca
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
push dword [0x6610feb0]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, edi
je 0x66015a1e
mov ebx, dword [eax + 0x18]
cmp ebx, edi
je 0x66015a1e
cmp word [ebp + 0xc], di
jl 0x66043429
cmp word [ebp + 0xc], 0x200
jg 0x66043429
movsx eax, word [ebp + 0xc]
mov dword [ebp - 8], eax

Function at 0x66015aa4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
mov dword [ebp - 4], esi
je 0x66015ac3
cmp edi, 0x100
jge 0x660434da

Function at 0x66016248
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x6601639b
cmp byte [eax], 0
je 0x6601639b
mov ebx, dword [ebp + 8]
push eax
mov ecx, ebx
call fcn.6600eba8
test eax, eax
je 0x660330cd
mov ecx, ebx
call fcn.660163a2
test eax, eax
je 0x66016296
mov ecx, ebx
call fcn.66016455
cmp byte [eax], 0
jne 0x660330c6
push 1
xor edi, edi
pop esi
push esi
push ebx
call fcn.660164d3
test eax, eax
je 0x660330c6
xor eax, eax
test esi, esi
sete al
inc edi
mov esi, eax
cmp edi, 2
jl 0x6601629b
push 0x6610f450
mov ecx, ebx
call fcn.66016676
test eax, eax
je 0x660330cd
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.66016704
test eax, eax
je 0x660330cd
mov ecx, ebx
call fcn.660165f0
push eax
call fcn.660167d8
test eax, eax
jne 0x660330c6
mov al, byte [0x6601a650]
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x105], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x6601634c
lea eax, [ebp - 0x104]
push 0x6601b1b6
push eax
call esi
lea eax, [ebp - 0x104]
push 0x6601b1b0
push eax
call esi
lea eax, [ebp - 0x104]
mov ecx, ebx
push eax
call fcn.660166a4
test eax, eax
je 0x660330cd
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.66016704
test eax, eax
je 0x660330cd
mov ecx, ebx
call fcn.660165f0
push eax
call fcn.660167d8
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80004005
jmp 0x66016394
xor eax, eax
jmp 0x66016394
mov eax, 0x8007000e
jmp 0x66016394
Function at 0x660164d3
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
push 0x105
push esi
push dword [0x6610f6c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.660165f0
push eax
call fcn.66016621
cmp dword [ebp - 4], esi
mov dword [ebp - 8], eax
je 0x6603309a
cmp eax, esi
je 0x6603309a
lea eax, [ebp - 0x10]
mov edi, 0x20019
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x6601b1c4
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ebx, eax
test ebx, ebx
jne 0x66016592
cmp dword [ebp + 0xc], eax
mov eax, 0x6601b1b8
jne 0x66016547
mov eax, 0x6601b1b0
lea ecx, [ebp - 0xc]
push ecx
push edi
push 0
push eax
push dword [ebp - 0x10]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
test ebx, ebx
jne 0x66016585
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
push dword [ebp - 4]
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
mov ebx, eax
call esi
push dword [ebp - 0x10]
call esi
test ebx, ebx
je 0x6603308b
push 0x6601b1e8
push 0x104
push dword [ebp - 4]
push 0x66005020
push dword [ebp - 8]
push 0x6601b1e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x6603308b
push 1
pop esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x660165d6
push dword [ebp - 4]
push ebx
push dword [0x6610f6c0]
call edi
cmp dword [ebp - 8], ebx
je 0x660165e7
push dword [ebp - 8]
push ebx
push dword [0x6610f6c0]
call edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
call fcn.660166a4
test eax, eax
jne 0x660330a4
mov esi, 0x8007000e
jmp 0x660165bd
push dword [ebp - 8]
mov ecx, dword [ebp + 8]
call fcn.66016704
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
add esi, 0x8007000e
jmp 0x660165bd

Function at 0x66016821
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x6604781d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.66016848
add esp, 4
or eax, 0xffffffff
ret
test al, 1
je 0x66047842
test byte [esp + 8], 2
je 0x66047842
call fcn.660168b4
mov dword [eax], 0xd
call fcn.6601687f
mov dword [eax], 5
or eax, 0xffffffff
ret
xor eax, eax
ret