joyce8/EMBER2024-capa huggingface dataset:
Function at 0x660bcbbf
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov eax, dword [esi + 0xd8]
mov dword [ebp - 4], edi
cmp eax, edi
jne 0x660bcbe2
mov eax, 0x66005020
push eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x250]
push 0x105
push eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x250]
push eax
call fcn.660bc3fc
push edi
push edi
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x28]
push 0xb
push dword [esi + 0x3c]
mov eax, dword [eax]
push esi
call dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push edi
push edi
push 0x184
push dword [esi + 0x3c]
mov eax, dword [eax]
push esi
call dword [eax + 0x10]
mov eax, dword [esi + 0xdc]
cmp eax, edi
mov ebx, eax
jne 0x660bcc4c
mov ebx, 0x66087280
mov edi, ebx
mov al, byte [edi]
test al, al
je 0x660bcc63
cmp al, 0x3b
je 0x660bcc63
push edi
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
jmp 0x660bcc4e
mov al, byte [edi]
and byte [edi], 0
push ebx
mov byte [ebp + 8], al
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x660bcd0b
mov dl, byte [ebp - 0x148]
test dl, 0x10
jne 0x660bccf2
mov eax, dword [esi + 0xd4]
xor ecx, ecx
test dl, 2
je 0x660bccaf
test al, 2
je 0x660bccf2
push 1
pop ecx
test dl, 4
je 0x660bccbb
test al, 4
je 0x660bccf2
push 1
pop ecx
test al, 0x80
jne 0x660bccd4
test al, 1
je 0x660bcccb
test dl, 1
je 0x660bcccb
push 1
pop ecx
test al, 0x20
je 0x660bccd7
test dl, 0x20
je 0x660bccd7
push 1
pop ecx
test ecx, ecx
je 0x660bccf2
lea eax, [ebp - 0x11c]
push eax
push 0
push 0x180
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x148]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x660bcc90
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp + 8]
inc dword [ebp - 4]
test al, al
je 0x660bcd27
push edi
mov byte [edi], al
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
mov ebx, edi
jmp 0x660bcc4e
cmp dword [ebp - 4], 1
jle 0x660bcd35
push dword [ebp + 0xc]
call fcn.660bcd66
mov eax, dword [esi + 0x28]
push 0
push 1
push 0xb
push dword [esi + 0x3c]
mov eax, dword [eax]
push esi
call dword [eax + 0x10]
mov eax, dword [esi + 0x30]
test byte [eax + 0x20], 0x10
jne 0x660bcd5d
push 1
push 0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x660bce13
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
push 0
push 0
push 0x31
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
test eax, eax
je 0x660bce43
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push 0x100
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [sym.imp.GDI32.dll_GetTextExtentPointA]
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp + 0x10], eax
push eax
lea eax, [ebp - 0x144]
push eax
push edi
call esi
cmp dword [ebp - 8], 0
push 1
pop ebx
jne 0x660bce8c
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0x660538e8
push edi
call esi
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [0x6610f7e8], 0
je 0x660bcfbb
mov eax, dword [ebp + 8]
test byte [eax + 0x27], 0x20
je 0x660bcfbb
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffc
mov dword [ebp - 0x24], eax
sub eax, dword [ebp - 0xc]
sub eax, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
and dword [ebp - 0x28], 0
mov dword [ebp - 0x20], eax
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
cdq
sub eax, edx
push 0x10
sar eax, 1
add dword [ebp - 0x18], eax
dec dword [ebp - 0x14]
dec dword [ebp - 0x10]
call esi
push 0xf
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.660276cf
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push 0x14
call esi
push 0xf
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.660276cf
lea eax, [ebp - 0x44]
push ebx
mov ebx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
call fcn.66027200
mov esi, dword [sym.imp.GDI32.dll_SetBkMode]
push 2
push edi
call esi
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x660bcf64
push reloc.OLEAUT32.dll_SafeArrayGetElemsize
push ebx
call fcn.660215ad
cmp eax, dword [ebp - 0x30]
jne 0x660bcf5c
push reloc.OLEAUT32.dll_SafeArrayGetDim
push ebx
call fcn.660215ad
push eax
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [0x6610f7e8], 0
je 0x660bcfd0
test byte [ebx + 0x27], 0x20
je 0x660bcfd0
push 0x20022
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x144]
push dword [ebp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_DrawTextA]
cmp dword [ebp - 4], 0
je 0x660bcf9d
push dword [ebp - 4]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 8]
push edi
call esi
lea eax, [ebp - 0x44]
push 0
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
call fcn.66027200
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], 4
add eax, 8
mov dword [ebp - 0x24], eax
jmp 0x660bcec5
push 0x20
jmp 0x660bcf78
Function at 0x660ca3de
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x7f02
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x38]
mov dword [esp + 0x10], eax
cmp dword [esi + 0xd5c], edi
mov ebp, dword [esi + 0xe3c]
mov dword [esi + 0xd60], 1
jne 0x660ca42c
mov dword [esi + 0xe3c], edi
push 1
push edi
push edi
lea eax, [esp + 0x24]
push edi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x660ca559
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
mov eax, dword [esp + 0x1c]
je 0x660ca468
cmp eax, 0x200
jae 0x660ca57e
cmp eax, 0x209
jbe 0x660ca57e
mov edx, dword [esp + 0x20]
cmp eax, 0x100
jne 0x660ca483
cmp edx, 0x1b
jne 0x660ca483
mov ebx, 0x11f
mov dword [esi + 0xd60], edi
cmp eax, 0x200
je 0x660ca57e
cmp eax, 0x202
je 0x660ca57e
cmp eax, 0x205
je 0x660ca57e
cmp eax, 0x208
je 0x660ca57e
mov ecx, 0xa0
cmp eax, ecx
je 0x660ca57e
cmp eax, 0xa2
je 0x660ca57e
cmp eax, 0xa5
je 0x660ca57e
cmp eax, 0xa8
je 0x660ca57e
cmp eax, ecx
jb 0x660ca4e8
cmp eax, 0xa9
jbe 0x660ca504
cmp eax, 0x100
jb 0x660ca4f6
cmp eax, 0x108
jbe 0x660ca504
cmp eax, 0x200
jb 0x660ca547
cmp eax, 0x209
ja 0x660ca547
cmp eax, 0x104
jne 0x660ca589
cmp edx, 0x12
je 0x660ca5d8
cmp edx, 0x11
je 0x660ca5d8
cmp dword [esi + 0xd58], edi
lea ecx, [esi + 0xd58]
je 0x660ca589
cmp edx, 0x10
je 0x660ca589
cmp edx, 9
mov dword [ecx], edi
je 0x660ca53c
cmp edx, 0x1b
jne 0x660ca547
mov ebx, 0x11f
mov dword [esi + 0xd60], edi
cmp eax, 0x104
je 0x660ca559
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esi + 0xd60], edi
je 0x660ca595
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x40]
jbe 0x660ca589
mov ebx, 0x11e
mov dword [esi + 0xd60], edi
jmp 0x660ca589
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esi + 0xd60], edi
jne 0x660ca42c
cmp ebx, edi
mov dword [esi + 0xe3c], ebp
je 0x660ca5c6
push edi
push dword [esp + 0x40]
push dword [esi + 0xd74]
call sub.USER32.dll_DdeAbandonTransaction
test eax, eax
jne 0x660ca5c2
call fcn.660ca9f1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
mov eax, ebx
jmp 0x660ca5b8
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esi + 0xd70]
jmp 0x660ca5b8
mov dword [esi + 0xd58], 1
jmp 0x660ca589
Function at 0x660cb75d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [ebx + 0x30]
push edi
and dword [eax], 0
mov esi, dword [ecx + 0x34]
mov edi, dword [esi + 0xd88]
test edi, edi
je 0x660cb7ab
mov eax, dword [esi + 0xdc0]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0x58]
test edx, edx
je 0x660cb7a7
mov edx, dword [edx + 0x74]
mov edx, dword [edx]
cmp byte [edx + 0x37], 0x1d
jne 0x660cb7a7
cmp dword [eax + 0x40], 0
jne 0x660cb7a7
cmp eax, ecx
jne case.default.0x660cb936
test edi, edi
jne 0x660cb811
mov eax, dword [ebp + 0x14]
sub eax, 0xa1
je 0x660cb7c8
dec eax
dec eax
je 0x660cb7c8
sub eax, 0x15e
je 0x660cb7c8
dec eax
dec eax
jne case.default.0x660cb936
mov eax, dword [ebx + 0x24]
and eax, 8
cmp al, 8
jne case.default.0x660cb936
mov eax, dword [ebp + 0x1c]
movsx ecx, ax
shr eax, 0x10
cmp dword [ebp + 0x14], 0x201
mov dword [ebp - 8], ecx
movsx eax, ax
mov dword [ebp - 4], eax
je 0x660cb7f6
cmp dword [ebp + 0x14], 0x203
jne 0x660cb800
lea eax, [ebp - 8]
push eax
push ebx
call fcn.6606f3d8
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call fcn.660cbb4a
push 1
pop eax
jmp 0x660cb852
mov ebx, dword [esi + 0xdc0]
mov eax, ebx
push dword [eax + 0x30]
call fcn.660226cf
mov edi, dword [ebp + 0x14]
cmp ebx, eax
je 0x660cb830
cmp edi, 0x215
jne 0x660cb848
cmp dword [ebp + 0xc], ebx
jne 0x660cb859
cmp edi, 0x1012
je 0x660cb842
cmp edi, 0x1f
jne 0x660cb859
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
push esi
call fcn.660cbf66
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18
cmp edi, 0x14
ja 0x660cb89d
je 0x660cb8d7
cmp edi, 0xf
je 0x660cb8d7
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esi + 0xdc0]
jne case.default.0x660cb936
mov eax, dword [ebp + 0x1c]
movsx edx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 4], eax
mov eax, 0xa0
cmp edi, eax
mov dword [ebp - 8], edx
ja 0x660cb8eb
je 0x660cb916
cmp edi, 0x20
jne case.default.0x660cb936
call fcn.660cb9ff
jmp 0x660cb852
cmp edi, 0x85
je 0x660cb8d7
cmp edi, 0x88
je 0x660cb8d7
cmp edi, 0xff
jbe 0x660cb865
cmp edi, 0x102
jbe case.0x660cb936.513
cmp edi, 0x103
jbe 0x660cb865
cmp edi, 0x106
jbe case.0x660cb936.513
jmp 0x660cb865
cmp dword [esi + 0xd8c], 0
je 0x660cb865
push esi
call fcn.660cbaba
jmp 0x660cb865
mov eax, 0x200
cmp edi, eax
ja 0x660cb927
je 0x660cb90c
lea eax, [edi - 0xa1]
cmp eax, 8
ja case.default.0x660cb936
jmp dword [eax*4 + 0x660cb985]
lea eax, [ebp - 8]
push eax
push ecx
call fcn.6606f3d8
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call fcn.660cbcb2
jmp case.0x660cb936.513
add edi, 0xfffffdff
cmp edi, 8
ja case.default.0x660cb936
jmp dword [edi*4 + 0x660cb9a9]
lea eax, [ebp - 8]
push eax
push ecx
call fcn.6606f3d8
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ax, ax
jl case.0x660cb936.513
push 4
call edi
test ax, ax
jl case.0x660cb936.513
push 2
call edi
test ax, ax
jl case.0x660cb936.513
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call fcn.660cbecf
jmp case.0x660cb936.513
Function at 0x660cc077
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 1
mov bx, word [eax + 4]
mov ecx, dword [edi + 0x30]
mov esi, dword [ecx + 0x34]
pop ecx
cmp dword [eax], ecx
jne 0x660cc098
mov ebx, ecx
movzx eax, bx
test eax, eax
jl 0x660cc11b
cmp eax, ecx
jle 0x660cc0cb
cmp eax, 2
jne 0x660cc11b
cmp dword [esi + 0xd88], 0
je 0x660cc0c7
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call fcn.660cbecf
xor eax, eax
jmp 0x660cc0fc
cmp dword [esi + 0xd88], 0
je 0x660cc0db
push ecx
push esi
call fcn.660cbf66
cmp bx, 1
jne 0x660cc0c7
push dword [edi + 0x30]
mov esi, dword [edi + 0x3c]
call fcn.6606f674
push esi
push edi
call fcn.66022e54
test eax, eax
je 0x660cc103
mov eax, 0x16c
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call fcn.660cbb4a
jmp 0x660cc0c7
push 5
pop eax
jmp 0x660cc0fc

Function at 0x660cc120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
and dword [ebp + 8], 0
push esi
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
inc eax
shr eax, 1
je 0x660cc143
mov cx, word [esi]
xor word [ebp + 8], cx
inc esi
inc esi
dec eax
jne 0x660cc137
mov cl, byte [ebp + 8]
xor eax, eax
mov al, byte [ebp + 9]
pop esi
xor eax, ecx
pop ebp
ret 4

Function at 0x660ceae3
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, dword [ebp + 8]
push esi
push edi
and dword [ebp - 4], 0
push 8
and dword [eax], 0
pop esi
push 3
mov dword [ebp - 0x14], esi
pop edi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 9
call fcn.66014495
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x660ceb2c
mov eax, 0x800a0209
pop edi
pop esi
pop ebx
leave
ret 8
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x660cebb8
xor edi, edi
lea esi, [ebp - 0x14]
push dword [esi]
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x660ceb90
inc edi
add esi, 4
cmp edi, 4
jb 0x660ceb3c
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push ebx
call esi
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x660ceb85
cmp dword [0x6610f6e0], eax
je 0x660ceb73
cmp ebx, 2
jne 0x660ceb73
push 9
call esi
push 0
push 0
push eax
push ebx
push edi
push dword [ebp + 8]
call fcn.660ce8e7
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
jmp 0x660ceb25
mov ebx, dword [ebp + edi*4 - 0x14]
cmp ebx, 3
jne 0x660ceb51
mov esi, dword [sym.imp.USER32.dll_EnumClipboardFormats]
push 0
call esi
test eax, eax
je 0x660ceb51
cmp eax, 3
je 0x660cebb4
cmp eax, 0xe
je 0x660cebb4
push eax
jmp 0x660ceba1
mov ebx, eax
jmp 0x660ceb51
cmp ebx, 2
je 0x660ceb51
cmp ebx, edi
je 0x660ceb51
cmp ebx, esi
je 0x660ceb51
cmp ebx, 0xe
je 0x660ceb51
cmp ebx, 9
je 0x660ceb51
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 0x800a01cc
jmp 0x660ceb25
Function at 0x660d297a
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
xor ebx, ebx
cmp dword [0x6610f720], ebx
je 0x660d2993
xor eax, eax
pop ebx
leave
ret
push edi
lea eax, [ebp - 8]
push esi
push eax
push 0x20006
push ebx
push 0x66054504
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x660d29d0
cmp eax, 5
je 0x660d2a0c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0xc], eax
jmp 0x660d2a0c
lea eax, [ebp - 4]
mov edi, 0x660507cc
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
cmp esi, ebx
je 0x660d2a30
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, eax
cmp esi, ebx
je 0x660d2a30
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 0xc], esi
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x660d2a1c
push dword [ebp - 8]
call esi
cmp dword [ebp - 4], ebx
je 0x660d2a26
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 0xc]
pop esi
pop edi
jmp 0x660d2990
mov edi, 0x100
lea eax, [ebp - 0x118]
push edi
push eax
push dword [0x6610f6c8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x660d2a66
mov eax, esi
and esi, 0xffff
or esi, 0x80070000
neg eax
sbb eax, eax
and eax, esi
jmp 0x660d29cb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
mov ebx, 0x660544f0
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x660d2ac2
cmp dword [ebp - 0x18], 1
jne 0x660d2ac2
lea esi, [ebp - 0x218]
lea eax, [ebp - 0x118]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x660d2b0d
test cl, cl
je 0x660d2abc
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x660d2b0d
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x660d2a9e
xor eax, eax
test eax, eax
je 0x660d2b06
lea edi, [ebp - 0x118]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x118]
push ecx
push eax
push 1
push 0
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x660d2b06
push 4
lea ecx, [ebp - 0x14]
pop eax
push eax
push ecx
push eax
push 0
push 0x660544e0
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
call esi
xor ebx, ebx
jmp 0x660d2a0c
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x660d2abe
Function at 0x660d2b14
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x6610f720], 0
je 0x660d2b25
xor eax, eax
leave
ret
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
and dword [ebp - 4], esi
push 0x66054504
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x660d2b55
push 0x660507cc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x660d2b61
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp dword [ebp - 4], 0
je 0x660d2b70
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x660d2dc6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [0x66110d80], esi
je 0x660d2e54
mov eax, dword [0x66111c38]
mov dword [0x66110d80], esi
test eax, eax
je 0x660d2df7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [0x66111c38], 0
lea eax, [ebp - 8]
push 6
push eax
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x660d2e54
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 8]
push eax
mov ebx, str.vb6_s.dll
lea eax, [ebp - 0x18]
push ebx
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
mov dword [0x66111c38], eax
jne 0x660d2e54
and byte [ebp - 6], al
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push ebx
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
call edi
mov dword [0x66111c38], eax
mov eax, dword [0x66111c38]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x660d3976
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
push edi
mov esi, ecx
je 0x660d3988
and dword [ebp], 0
mov eax, dword [esi + 4]
test al, 2
jne 0x660d39ad
test al, 0x20
jne 0x660d39d2
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edi, eax
mov eax, dword [esi + 0x20]
mov ecx, edi
sub ecx, eax
cmp ecx, dword [esi + 0x14]
jae 0x660d39b6
cmp edi, eax
jb 0x660d39b6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 1
mov ecx, esi
call fcn.660d3900
mov dword [esi + 0x24], edi
call ebx
test ebp, ebp
mov dword [esi + 0x20], eax
je 0x660d39d2
mov dword [ebp], 1
push 1
pop eax
jmp 0x660d39af
Function at 0x660d3ab0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 1
call ebx
mov esi, dword [edi + 0x2c]
xor ecx, ecx
cmp esi, ecx
mov dword [ebp - 0xc], eax
jne 0x660d3adf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
inc dword [esi]
cmp dword [ebp + 8], ecx
je 0x660d3bcd
mov dword [ebp + 0xc], 1
cmp dword [ebp + 8], ecx
je 0x660d3b01
mov eax, dword [edi + 0x14]
and ah, 0xf7
or al, 0x20
mov dword [edi + 0x14], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], ecx
test al, 2
jne 0x660d3b8e
cmp dword [ebp + 8], ecx
je 0x660d3bd6
and eax, 0x20
cmp eax, ecx
je 0x660d3b8e
mov eax, dword [esi + 0xc]
push dword [ebp + 0xc]
mov dword [ebp - 4], 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x660d3b4a
cmp dword [ebp + 8], 0
mov eax, dword [esi + 4]
je 0x660d3bde
and eax, 0x10
test eax, eax
jne 0x660d3b60
xor eax, eax
mov ecx, esi
cmp dword [ebp + 8], eax
mov dword [ebp - 8], eax
push eax
je 0x660d3be6
call fcn.660d3900
cmp dword [ebp + 0x10], 0
je 0x660d3b81
call ebx
mov ecx, eax
sub ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jae 0x660d3b77
cmp eax, dword [ebp - 0xc]
jae 0x660d3b7b
and dword [ebp + 0x10], 0
cmp dword [ebp + 0x10], 0
jne 0x660d3b8c
mov ecx, edi
call fcn.66028d30
test eax, eax
je 0x660d3bf0
xor ecx, ecx
cmp dword [ebp - 4], ecx
je 0x660d3b9c
cmp dword [ebp - 8], ecx
jne 0x660d3b01
cmp dword [ebp + 8], ecx
je 0x660d3ba5
and dword [edi + 0x14], 0xffffffdf
push 1
push 0xffffffffffffffff
push esi
mov ecx, edi
call fcn.66011484
xor eax, eax
cmp dword [ebp - 4], eax
je 0x660d3ad8
cmp dword [ebp - 8], eax
je 0x660d3ad8
push 1
pop eax
jmp 0x660d3ad8
and dword [ebp + 0xc], 0xfffffffe
jmp 0x660d3af1
and eax, 0x40
jmp 0x660d3b1b
and eax, 8
jmp 0x660d3b46
call fcn.66018ea8
jmp 0x660d3b60
xor ecx, ecx
jmp 0x660d3b9c

Function at 0x660d5922
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [0x6610feb0]
call esi
cmp dword [eax + 0x34], 0
jne 0x660d5977
cmp word [eax + 0x38], 0
jne 0x660d5977
push dword [0x6610feb0]
call esi
test byte [eax + 0xa0], 2
jne 0x660d5977
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.660d5766
pop esi
pop ebp
ret 0x24
xor eax, eax
jmp 0x660d5972
Function at 0x660d5da8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x10]
mov edi, eax
push esi
mov eax, dword [esi]
call dword [eax + 4]
mov eax, dword [edi + 0xa0]
test al, 2
je 0x660d5dd3
test al, 1
je 0x660d5ddd
push 0
push esi
mov ecx, ebx
call fcn.6601d38c
push esi
push 0xd
call fcn.66015452
mov eax, dword [esi]
push esi
call dword [eax + 8]
test eax, eax
jbe 0x660d5e0b
push esi
mov ecx, ebx
call fcn.6602e89b
test eax, eax
jl 0x660d5e0d
test byte [esi + 0x2c], 0x10
je 0x660d5e0b
mov ecx, dword [esi + 0x1c]
lea eax, [esi + 0x1c]
push eax
call dword [ecx + 8]
xor eax, eax
pop edi
pop esi
pop ebx
ret 4

Function at 0x660d5e73
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [esp + 4], 0
jne 0x660d5e98
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
mov ecx, eax
push dword [esp + 0xc]
call fcn.660d6b94
xor eax, eax
ret 8
push 5
pop eax
jmp 0x660d5e95

Function at 0x660d5f66
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp word [esp + 4], 0xffff
je 0x660d5f8b
movzx eax, word [esp + 4]
mov ecx, dword [ecx + 8]
mov eax, dword [ecx + eax*4]
ret 4