joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66028500
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
cmp dword [edi + 0x2c], esi
jne 0x660413ae
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp ecx, esi
je 0x6602865e
mov dword [ebp + 0xc], 1
cmp ecx, esi
je 0x66028667
mov eax, dword [edi + 0x14]
and ah, 0xf7
or al, 0x20
mov dword [edi + 0x14], eax
cmp ecx, esi
lea eax, [edi + 0x70]
je 0x66028667
mov dword [ebp - 0xc], eax
mov eax, dword [eax]
cmp eax, esi
je 0x6602863c
cmp dword [eax], esi
je 0x6602863c
cmp ecx, esi
lea eax, [edi + 0x4c]
jne 0x66028574
lea eax, [edi + 0x50]
mov dword [ebp - 4], eax
mov eax, dword [eax]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x6602863c
push ecx
mov ecx, edi
call fcn.66028686
mov eax, dword [ebp - 4]
cmp dword [eax], esi
jbe 0x6602863c
xor ebx, ebx
cmp dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
jbe 0x6602867b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp eax, esi
je 0x6602867b
cmp ebx, dword [eax]
jge 0x6602867b
mov eax, dword [eax + 0x10]
mov esi, dword [eax + ebx*4]
test esi, esi
je 0x6602866f
mov eax, dword [esi + 4]
test al, 2
jne 0x6602866f
cmp dword [ebp + 8], 0
jne 0x660413c8
and eax, 0x40
test eax, eax
je 0x6602866f
mov eax, dword [esi + 0xc]
push dword [ebp + 0xc]
inc dword [esi]
mov dword [ebp - 8], 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
jne 0x660413d0
xor eax, eax
mov ecx, esi
cmp dword [ebp + 8], eax
push eax
jne 0x660413ee
call fcn.66018c8d
push 1
push 0xffffffffffffffff
push esi
mov ecx, edi
call fcn.660113a3
xor esi, esi
cmp dword [ebp + 0x10], esi
jne 0x660413f8
mov ecx, edi
call fcn.66028741
test eax, eax
jne 0x6602866f
xor esi, esi
cmp dword [ebp + 8], esi
je 0x66028645
and dword [edi + 0x14], 0xffffffdf
cmp dword [ebp - 8], esi
je 0x66028655
mov eax, dword [ebp - 4]
cmp dword [eax], esi
ja 0x6604141e
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0xc
and dword [ebp + 0xc], 0xfffffffe
jmp 0x66028537
lea eax, [edi + 0x6c]
jmp 0x66028555
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x660413c1
xor esi, esi
cmp dword [ebp - 8], esi
jne 0x6602858c
jmp 0x6602863c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.660d2670
jmp 0x66028658
xor esi, esi
jmp 0x660285a5
and eax, 0x20
jmp 0x660285e0
cmp dword [ebp + 8], 0
mov eax, dword [esi + 4]
je 0x660413e9
and eax, 0x10
test eax, eax
jne 0x66028618
jmp 0x66028605
and eax, 8
jmp 0x660413dc
call fcn.660d24c0
jmp 0x66028618
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0x10]
jae 0x6604140d
cmp eax, dword [ebp - 0x10]
jae 0x66041410
mov dword [ebp + 0x10], esi
cmp dword [ebp + 0x10], esi
je 0x6602862f
jmp 0x6602866f
push 1
pop eax
jmp 0x66028657
Function at 0x6602ce98
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 8
pop edi
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp + 8]
add eax, 0x50
mov dword [ebp - 4], eax
mov esi, 0x4000
mov dx, word [ecx]
movzx eax, dx
and ah, 0xbf
dec eax
dec eax
je 0x66046568
sub eax, 7
je 0x66046527
dec eax
dec eax
je 0x66046568
sub eax, 6
je 0x66046551
push ecx
call fcn.660243e5
lea edx, [ebp - 4]
mov cl, al
and cl, 0xf
movsx cx, cl
add ecx, 0x30
cmp cx, 0x39
ja 0x6602cf39
dec edi
dec edx
dec edx
shr eax, 4
mov word [edx], cx
jne 0x6602cef1
push 8
pop eax
sub eax, edi
push eax
lea eax, [ebp + edi*2 - 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x66046586
mov ecx, dword [ebp - 4]
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, esi
pop edi
pop esi
leave
ret 4
add ecx, 7
jmp 0x6602cf03
test si, dx
je 0x6604654c
mov eax, dword [ecx + 8]
mov ecx, dword [eax]
push dword [ebp - 4]
push 3
push 0
push 0
push 0
push 0
push ecx
call fcn.660ddd03
mov ecx, dword [ebp - 4]
jmp 0x6602cebd
mov ecx, dword [ecx + 8]
jmp 0x66046531
test si, dx
je 0x66046563
mov eax, dword [ecx + 8]
mov cl, byte [eax]
movzx eax, cl
jmp 0x6602ceee
mov cl, byte [ecx + 8]
jmp 0x6604655b
test si, dx
je 0x66046580
mov eax, dword [ecx + 8]
mov cx, word [eax]
and ecx, 0xffff
mov eax, ecx
jmp 0x6602ceee
mov cx, word [ecx + 8]
jmp 0x66046573
push 0xe
call fcn.66024fdc

Function at 0x6602d59f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 8]
push edi
push eax
call fcn.66025191
test eax, eax
jne 0x66043753
movsx esi, word [ebp + 8]
cmp esi, 1
jl 0x66043759
cmp esi, 0x200
jg 0x66043759
push 0
push esi
push dword [ebp - 8]
call fcn.660158cc
mov edi, eax
test edi, edi
je 0x66043760
mov ax, word [edi]
cmp ax, 2
je 0x66043776
cmp ax, 8
je 0x66043776
cmp ax, 4
je 0x66043767
cmp ax, 0x20
je 0x66043767
lea eax, [ebp - 4]
push eax
push edi
call fcn.6602d651
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
dec ecx
cmp dword [ebp - 4], 0
mov esi, ecx
jne 0x6604377e
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call fcn.6602d863
or esi, 0xffffffff
jmp 0x6602d63e
Function at 0x6602d87c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
xor edi, edi
push dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.6602d92c
push dword [0x6610ee98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x18]
mov esi, dword [eax]
lea eax, [ebp - 4]
push eax
push esi
call fcn.6602d661
mov ebx, eax
cmp ebx, 0xffffffff
je 0x660432d6
lea eax, [ebp - 4]
push eax
push ebx
push esi
call fcn.6602d863
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.6602d95a
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.6602d661
cmp eax, 0xd
jne 0x6602d907
lea eax, [ebp - 4]
push eax
push esi
call fcn.6602d661
cmp eax, 0xa
jne 0x660432f8
call fcn.6602da9b
cmp dword [ebp - 4], edi
jne 0x66043311
mov esi, dword [ebp + 8]
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 8]
pop edi
mov dword [esi], eax
pop esi
pop ebx
leave
ret 8
pop esi
ret 4
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.6602d661
mov ebx, eax
cmp ebx, 0xffffffff
je 0x6602d9e7
cmp ebx, dword [esi]
je 0x6602d9e7
cmp ebx, dword [esi + 4]
je 0x6602d9e7
cmp ebx, dword [esi + 8]
je 0x6602d9e7
cmp ebx, dword [esi + 0xc]
je 0x6602d9e7
cmp ebx, dword [esi + 0x10]
je 0x6602d9e7
cmp ebx, dword [esi + 0x14]
je 0x6602d9e7
cmp dword [ebp - 4], 0x1ff
jae 0x6604332f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add eax, ecx
cmp bx, 0x100
jae 0x6604334e
cmp bx, 0x100
mov byte [eax], bl
sbb eax, eax
inc eax
inc eax
add dword [ebp - 4], eax
jmp 0x6602d987
cmp dword [ebp - 8], 0
jne 0x6602da26
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
call fcn.6602d863
cmp edi, 2
je 0x6604335a
cmp edi, 3
je 0x6604335a
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.6602da30
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x14
call fcn.6602da9b
cmp dword [ebp - 4], edi
jne 0x660432f0
mov dword [ebp - 4], 0x3e
cmp dword [ebp - 4], edi
je 0x6602d8c1
push dword [ebp - 4]
call fcn.66024fdc
cmp dword [ebp - 4], edi
jne 0x6602d907
lea ecx, [ebp - 4]
push ecx
push eax
push esi
call fcn.6602d863
jmp 0x6602d907
push dword [ebp - 4]
call fcn.66024fdc
cmp ax, 0x20
je 0x6602d956
call fcn.6602da9b
push 0x36
call fcn.66024fdc
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.6602da30
test eax, eax
mov dword [ebp - 8], eax
je 0x6602d9c4
jmp 0x6602da29
xor ecx, ecx
mov cl, bh
mov byte [eax], cl
inc eax
jmp 0x6602d9d7
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add eax, ecx
cmp byte [eax - 1], 0x20
jne 0x6604336e
dec dword [ebp - 4]
dec eax
jmp 0x66043362
cmp edi, 3
jne 0x6602da0c
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x6602da0c
jmp 0x6602da1e
Function at 0x66069019
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, ecx
push edi
or byte [esi + 0x15a], 4
call fcn.66067c30
xor ebx, ebx
cmp eax, 1
jle 0x66069041
push ebx
push 1
mov ecx, esi
call fcn.660699fc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x54]
mov ecx, esi
call fcn.66068525
push ebx
mov ecx, esi
call fcn.66069550
cmp dword [esi + 0x138], ebx
je 0x660690f6
mov eax, dword [esi + 0x120]
lea edx, [ebp - 4]
push edx
push 0x66056400
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x6606908d
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi + 0x138]
lea edx, [ebp - 0x4c]
push ebx
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [esi + 0x138]
cmp eax, ebx
je 0x660690b4
mov ecx, dword [eax]
push eax
mov dword [esi + 0x138], ebx
call dword [ecx + 8]
mov eax, dword [ebp - 0x4c]
mov ecx, eax
shr ecx, 0x10
test cx, cx
je 0x660690e1
push eax
call fcn.6602618b
lea eax, [eax + eax + 1]
pop ecx
add eax, 3
and al, 0xfc
call fcn.660300e8
mov eax, esp
push dword [ebp - 0x4c]
push eax
call fcn.660261a9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x6610e6c4]
push dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov ecx, dword [esi + 0x140]
cmp ecx, ebx
je 0x66069115
mov eax, dword [ecx]
cmp ecx, ebx
mov dword [esi + 0x140], eax
je 0x660690f6
push 1
call fcn.660691de
jmp 0x660690f6
xor edi, edi
push edi
mov ecx, esi
call fcn.66069429
inc edi
cmp edi, 5
jl 0x66069117
mov eax, dword [esi + 0x15c]
cmp eax, ebx
je 0x66069159
push dword [esi + 0x160]
mov ecx, dword [eax]
lea edi, [esi + 0x160]
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x15c]
mov dword [edi], ebx
cmp eax, ebx
je 0x66069159
mov ecx, dword [eax]
push eax
mov dword [esi + 0x15c], ebx
call dword [ecx + 8]
mov ecx, dword [esi + 0x120]
lea eax, [esi + 0x120]
cmp ecx, ebx
je 0x66069171
mov dword [eax], ebx
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
mov ecx, esi
call fcn.66067c14
cmp dword [esi + 0x110], ebx
je 0x6606919c
mov al, byte [esi + 0x15b]
lea ecx, [esi + 0x15b]
test al, 1
jne 0x6606919c
or al, 1
mov byte [ecx], al
mov ecx, esi
call fcn.6602b2c4
cmp dword [esi + 0x118], ebx
je 0x660691b2
or byte [esi + 0x15b], 2
mov ecx, esi
call fcn.6602b2c4
mov eax, dword [esi + 0x11c]
lea edi, [esi + 0x11c]
cmp eax, ebx
je 0x660691cd
mov ecx, dword [eax]
push eax
mov dword [eax + 4], ebx
call dword [ecx + 8]
mov dword [edi], ebx
and byte [esi + 0x15a], 0xfb
lea esp, [ebp - 0x58]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6607095f
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
je 0x6607097d
push edi
call fcn.660bf545
pop edi
ret 4
push esi
mov esi, dword [edi + 0x3c]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x66070999
push esi
call fcn.660225f8
push eax
push edi
call fcn.660709a5
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
jmp 0x66070979

Function at 0x66071533
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
mov ebx, dword [ebp + 0xc]
push edi
push esi
and byte [ebp + 0xf], 0
push esi
push 3
push esi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebx], 2
mov byte [ebp + 0xc], 0x3f
mov byte [ebp + 0xd], 0x5f
mov byte [ebp + 0xe], 3
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x66071593
lea ecx, [ebp - 8]
push esi
push ecx
lea ecx, [ebp - 0xc]
push 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x66071593
cmp dword [ebp - 8], 4
je 0x660715b9
call fcn.66072549
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xffffffff
je 0x660715af
cmp dword [ebp + 8], esi
je 0x660715af
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
push 4
lea edi, [ebp + 0xc]
pop ecx
lea esi, [ebp - 0xc]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x660715cd
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebx], ecx
xor esi, esi
jmp 0x6607159b

Function at 0x66071ead
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [0x6610e474]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp ecx, 0xffffffff
jne 0x66071edf
xor eax, eax
test al, al
je 0x66071ef4
cmp ecx, 0xffffffff
je 0x66071ef0
push ecx
call esi
xor ecx, ecx
cmp dword [eax + 0x38], 2
setge cl
test cl, cl
je 0x66071ef4
push 1
pop eax
pop esi
ret
push ecx
call esi
mov ecx, dword [0x6610e474]
neg eax
sbb eax, eax
neg eax
jmp 0x66071ec1
xor eax, eax
jmp 0x66071ecd
xor eax, eax
pop esi
ret
Function at 0x660731fa
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x6610e7ac]
push ebx
push esi
mov ecx, eax
mov esi, 0x3ff
push edi
and ecx, esi
xor edi, edi
cmp cx, di
mov bl, 1
je 0x66073220
cmp cx, 9
jne 0x66073226
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp dword [0x6610e700], 0x400
jb 0x66073265
lea ecx, [ebp - 0x20]
push 0x20
movzx eax, ax
push ecx
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x40]
push 3
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x6607325e
mov bl, byte [ebp - 0x40]
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
mov edx, eax
mov ecx, 0x6604f2bc
and edx, esi
cmp word [ecx - 4], dx
jne 0x66073288
cmp bl, 1
jne 0x6607327b
mov bl, byte [ecx]
mov si, ax
shr si, 0xa
cmp word [ecx - 2], si
je 0x66073296
add ecx, 6
inc edi
cmp ecx, 0x6604f3b2
jae 0x6607325e
jmp 0x6607326e
lea eax, [edi + edi*2]
mov bl, byte [eax*2 + 0x6604f2bc]
jmp 0x6607325e

Function at 0x66074202
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6607421b
test al, 0x10
je 0x6607421b
push 1
pop eax
ret 4
xor eax, eax
jmp 0x66074218
Function at 0x66074396
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov edi, ecx
call fcn.660161ca
xor ebx, ebx
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x66074510
mov al, byte [eax]
cmp al, bl
je 0x66074510
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x66074510
cmp eax, 5
je 0x66074510
cmp eax, 6
je 0x66074510
cmp eax, 2
je 0x66074510
mov dword [ebp - 0x10], 0x100
call fcn.66084f70
cmp eax, ebx
jne 0x660744c5
xor eax, eax
cmp eax, ebx
jl 0x660744be
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0xc]
call dword [0x66110b5c]
test eax, eax
jne 0x66074510
push dword [ebp - 0x114]
mov esi, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
call esi
test eax, eax
jne 0x66074510
cmp byte [ebp - 0x114], 0x5c
jne 0x66074510
push dword [ebp - 0x113]
call esi
test eax, eax
jne 0x66074510
cmp byte [ebp - 0x113], 0x5c
jne 0x66074510
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
push dword [edi + 4]
call fcn.66015fc0
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
mov edx, eax
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x14], edx
call esi
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax + 1]
push eax
push ebx
push dword [0x6610e6c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x660744d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push eax
call fcn.66071e7b
jmp 0x66074412
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [edi + 8], ebx
push esi
mov ecx, edi
je 0x66074509
call fcn.660164cc
push esi
push ebx
push dword [0x6610e6c0]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
jmp 0x660744c0
call fcn.6600eb25
jmp 0x660744f5
push 1
pop eax
jmp 0x660744c0
Function at 0x66079eb2
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov eax, dword [ebx + 0x28]
push edi
mov dword [esp + 0x10], 1
mov edi, 0x202
mov ecx, dword [eax]
test byte [ecx + 1], 1
je 0x66079edc
test byte [eax + 0x29], 0x80
jne 0x66079edc
mov ebx, dword [ebx + 0x50]
mov ebp, dword [esp + 0x1c]
xor eax, eax
cmp dword [ebx + 0x3c], ebp
mov esi, 0x80018001
sete al
mov dword [esp + 0x18], eax
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x66079f12
xor ecx, ecx
cmp dword [esp + 0x18], ecx
jne 0x66079f55
push esi
push ecx
push edi
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
dec eax
neg eax
sbb eax, eax
and eax, 2
inc eax
inc eax
mov dword [esp + 0x10], eax
xor eax, eax
cmp edi, 0x202
setne al
dec eax
and al, 0xfd
add eax, 0x208
cmp dword [esp + 0x10], 4
mov edi, eax
jne 0x66079ef1
push 0
push 0
push 0x1f
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [ebx + 0x28]
mov eax, dword [eax + 0xc]
cmp eax, ecx
jne 0x66079f64
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
push esi
push ecx
push edi
push ebp
push eax
call dword [sym.imp.USER32.dll_CallWindowProcA]
jmp 0x66079f12
Function at 0x6607a11e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x6607a137
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x1c]
cmp eax, 0xffffffff
je 0x6607a189
mov dword [ebp - 8], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, 0x100
mov edx, dword [edi + 0x28]
cmp esi, ecx
mov dword [ebp + 0x1c], edx
jb 0x6607a180
mov eax, 0x101
cmp esi, eax
jbe 0x6607a24d
cmp esi, 0x102
je 0x6607a1bb
cmp esi, 0x103
jbe 0x6607a180
cmp esi, 0x105
jbe 0x6607a24d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x1c
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ax, ax
jge 0x6607a19b
push 2
pop edi
push 0x10
call esi
xor ecx, ecx
test ax, ax
mov eax, dword [ebp + 0x18]
setl cl
mov eax, dword [eax]
shr eax, 0x1b
and eax, 4
or ecx, eax
or ecx, edi
mov dword [ebp - 8], ecx
jmp 0x6607a142
mov eax, dword [edi + 0x30]
mov ebx, dword [ebp + 0x14]
mov esi, dword [eax + 0x34]
mov al, byte [ebx]
push eax
xor eax, eax
cmp dword [ebp + 0x20], eax
mov ecx, dword [esi + 0xe2c]
setne al
push eax
push dword [ebp + 0xc]
call fcn.6607a301
test eax, eax
jne 0x6607a180
mov eax, dword [ebp + 0x1c]
movzx eax, byte [eax + 0xf2]
cmp eax, 0xff
mov dword [ebp + 0x14], eax
je 0x6607a180
movzx ax, byte [ebx]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x6607a220
push dword [ebp + 0xc]
mov ecx, dword [esi + 0xe2c]
call fcn.6607a467
xor ecx, ecx
mov cl, al
mov ch, byte [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [ebp + 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
push ecx
push edi
call fcn.66022982
mov ecx, 0x16c
cmp eax, ecx
jne 0x6607a2a1
mov eax, ecx
jmp 0x6607a182
cmp esi, ecx
je 0x6607a29d
cmp esi, 0x104
je 0x6607a29d
push 7
pop ecx
movzx ecx, byte [edx + ecx + 0xec]
cmp ecx, 0xff
je 0x6607a180
mov ebx, dword [ebp + 0x14]
cmp esi, eax
jne 0x6607a292
mov eax, dword [0x6610e9e4]
and ax, 0x3ff
cmp ax, 0x12
jne 0x6607a292
cmp dword [ebx], 0xe5
je 0x6607a180
lea eax, [ebp - 8]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], eax
jmp 0x6607a232
push 5
jmp 0x6607a25b
cmp esi, 0x102
jne 0x6607a2e1
lea eax, [ebp - 4]
push eax
xor eax, eax
cmp dword [ebp + 0x20], eax
push dword [ebp + 0x1c]
setne al
push eax
mov eax, dword [edi + 0x30]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x34]
mov ecx, dword [eax + 0xe2c]
call fcn.6607a492
test eax, eax
jl 0x6607a2f9
xor eax, eax
test eax, eax
jne 0x6607a182
movzx ecx, word [ebp - 4]
mov dword [ebx], ecx
test eax, eax
jne 0x6607a182
cmp dword [ebx], eax
jne 0x6607a182
or eax, 0xffffffff
jmp 0x6607a182
push eax
call fcn.66071e9f
jmp 0x6607a2d3
Function at 0x6607aea7
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, eax
and esi, 0x3ff
cmp si, 9
je 0x6607aef7
lea ecx, [ebp - 4]
push 4
push ecx
push 3
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x6607aef7
cmp si, 4
je 0x6607aedd
and byte [ebp - 2], 0
lea eax, [ebp - 4]
push eax
push 0x6604fa88
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
pop esi
leave
ret 4
mov eax, dword [ebp + 8]
and byte [eax + 1], 0
mov byte [eax], 0x2a
jmp 0x6607aef2

Function at 0x6607b3f6
Capabilities:
Get keyboard layout

Disassembly:
cmp dword [0x6611088c], 0
push esi
push edi
je 0x6607b411
push dword [esp + 0xc]
call dword [0x6611085c]
mov esi, eax
test esi, esi
jne 0x6607b418
xor eax, eax
pop edi
pop esi
ret 4
mov eax, dword [0x6610e9e4]
and ax, 0x3ff
cmp ax, 4
jne 0x6607b44f
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [0x66110878]
mov edi, eax
push edi
push esi
call dword [0x66110860]
push esi
push dword [esp + 0x10]
call dword [0x66110870]
mov eax, edi
jmp 0x6607b413
push esi
call dword [0x6611086c]
mov edi, eax
jmp 0x6607b440

Function at 0x6607bafc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
call esi
test ax, ax
jge 0x6607bb33
push 2
pop ebx
push 0x12
call esi
test ax, ax
jge 0x6607bb37
push 4
pop edi
push 0x10
call esi
xor ecx, ecx
test ax, ax
setl cl
or ecx, edi
pop edi
or ecx, ebx
pop esi
mov eax, ecx
pop ebx
ret
xor ebx, ebx
jmp 0x6607bb11
xor edi, edi
jmp 0x6607bb1d
Function at 0x6607c4e5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push esi
push 0xe
push dword [ebp + 8]
call edi
mov ebx, eax
inc ebx
push ebx
push esi
push dword [0x6610e6c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x6607c51f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 4
push esi
push ebx
push 0xd
push dword [ebp + 8]
call edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0xb0
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
je 0x6607c564
cmp byte [esi + eax], 0
je 0x6607c55d
mov ecx, dword [ebp - 4]
inc eax
mov dword [ebp - 8], eax
mov al, byte [esi + eax]
mov byte [esi + ecx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x6607c542
mov eax, dword [ebp - 4]
and byte [esi + eax], 0
push esi
call fcn.660865e4
push esi
push 0
push dword [0x6610e6c0]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
jmp 0x6607c518