joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d7ef650
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x63]
push ebx
push eax
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x64], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x20019
push 0x6d7fe12c
push SysReAllocString
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
call fcn.6d7eaed2
lea ecx, [ebp - 0x74]
test eax, eax
je 0x6d7ef6c8
call fcn.6d7e2c8b
lea ecx, [ebp - 0x80]
call fcn.6d7e2c8b
jmp 0x6d7ef754
push 0x2001f
push str.Classes
push dword [ebp - 0x80]
call fcn.6d7eaed2
test eax, eax
je 0x6d7ef6e3
lea ecx, [ebp - 0x74]
jmp 0x6d7ef6b6
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, 0x400
push esi
lea eax, [ebp - 0x64]
push eax
push ebx
jmp 0x6d7ef739
push 0xa
lea eax, [ebp - 0x64]
push str.JavaPlugin
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x6d7ef720
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d7e32a5
test eax, eax
je 0x6d7ef723
inc dword [ebp - 0x68]
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x74]
call edi
test eax, eax
je 0x6d7ef6f8
lea ecx, [ebp - 0x74]
call fcn.6d7e2c8b
lea ecx, [ebp - 0x80]
call fcn.6d7e2c8b
pop edi
pop esi
mov ecx, dword [ebp + 0x39c]
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0x3a0
leave
ret
Function at 0x6d7f0277
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x390], eax
push esi
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor esi, esi
push esi
push 0x6d7fe280
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d7f0378
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x7c], esi
push esi
jmp 0x6d7f035a
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0x74], esi
jbe 0x6d7f0348
cmp byte [ebp + eax - 0x70], 0x2e
jne 0x6d7f02e9
inc ecx
cmp ecx, 1
jg 0x6d7f02f4
inc eax
cmp eax, dword [ebp - 0x74]
jb 0x6d7f02dc
cmp ecx, 1
jle 0x6d7f0348
push 0x6d7fe2ac
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
js 0x6d7f0348
lea eax, [ebp - 0x70]
push eax
call fcn.6d7ef279
pop ecx
test eax, eax
je 0x6d7f0348
mov eax, dword [ebp - 0x74]
inc eax
push eax
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
lea ecx, [ebp - 0x70]
push ecx
mov ecx, dword [ebp - 0x74]
push 0x6d7fe2b4
inc ecx
push ecx
push eax
mov dword [ebp - 0x80], eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x14
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x6d8086c0
call fcn.6d7f0abd
inc dword [ebp - 0x7c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
mov dword [ebp - 0x74], 0x400
call edi
test eax, eax
je 0x6d7f02d3
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp + 0x390]
xor ecx, ebp
pop esi
call fcn.6d7f98d8
add ebp, 0x394
leave
ret
Function at 0x6d7f0c23
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x6d7fe5f0]
fld qword [0x6d7fe5e8]
fdiv st(1), st(0)
fxch st(1)
call fcn.6d7f9b30
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.6d7f9b30
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x6d7fe5e0]
fadd qword [0x6d7fe5d8]
call fcn.6d7f9b30
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x6d7fe5c0
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x6d7f0d6e
push dword [ebp - 0x78]
jmp 0x6d7f0d73
push 0x6d7fe5c8
push 0x20
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0x3d8
leave
ret 0x14
Function at 0x6d7f256f
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
shr eax, 4
and eax, 1
ret
Function at 0x6d7f45cf
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x17e0]
mov eax, 0x1860
call fcn.6d7f99b0
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x17dc], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x17e8]
mov esi, 0x7ff
xor ebx, ebx
push esi
lea eax, [ebp + 0x7dd]
push ebx
push eax
mov byte [ebp + 0x7dc], bl
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp - 0x23]
push ebx
push eax
mov byte [ebp - 0x24], bl
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp + 0xfdd]
push ebx
push eax
mov byte [ebp + 0xfdc], bl
call sub.MSVCR100.dll_memset
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0xfdc]
push eax
push edi
mov dword [ebp - 0x28], 0x800
call fcn.6d7f38c4
add esp, 0x34
test eax, eax
jne 0x6d7f465b
xor eax, eax
jmp 0x6d7f475f
lea eax, [ebp + 0xfdc]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp byte [ebp + eax + 0xfdb], 0x5c
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x6d7f468a
lea eax, [ebp + 0xfdc]
push eax
push 0x6d7ff210
push eax
call esi
add esp, 0xc
push str.jqs.exe
lea eax, [ebp + 0xfdc]
push eax
lea eax, [ebp + 0x7dc]
push str._sbin_s
push eax
call esi
lea eax, [ebp + 0x7dc]
push eax
call fcn.6d7eaed2
add esp, 0x14
test eax, eax
je 0x6d7f4654
call fcn.6d7eaed2
push 0x44
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x50], ax
lea eax, [ebp + 0x7dc]
push eax
xor edi, edi
lea eax, [ebp - 0x24]
push str.__s___unregister
inc edi
push eax
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], edi
call esi
add esp, 0x18
lea eax, [ebp - 0x2c]
push eax
push 0x2000000
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6d7f4654
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x8000008
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
cmp eax, ebx
je 0x6d7f4654
push 0x7530
push dword [ebp - 0x3c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov eax, edi
mov ecx, dword [ebp + 0x17dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0x17e0
leave
ret
Function at 0x6d7f57d2
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xb0]
sub esp, 0x130
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0xac], eax
mov eax, dword [ebp + 0xb8]
push esi
mov esi, dword [ebp + 0xbc]
push 0x6d7ff3e0
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x6d7f593d
push esi
call dword [sym.imp.MSVCR100.dll__chdir]
pop ecx
test eax, eax
jne 0x6d7f593d
mov esi, dword [sym.imp.MSVCR100.dll_fread]
push ebx
push dword [ebp - 0x7c]
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x78]
push 0x1e
push eax
call esi
add esp, 0x10
cmp eax, ebx
jne 0x6d7f5932
push edi
cmp dword [ebp - 0x78], 0x4034b50
jne 0x6d7f5931
cmp word [ebp - 0x70], 0
jne 0x6d7f5931
movzx eax, word [ebp - 0x5e]
push dword [ebp - 0x7c]
movzx edi, word [ebp - 0x5e]
push eax
lea eax, [ebp - 0x58]
push ebx
push eax
call esi
add esp, 0x10
cmp eax, edi
jne 0x6d7f5931
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + edi - 0x58], 0
call fcn.6d7eaed2
cmp word [ebp - 0x5c], 0
pop ecx
jbe 0x6d7f58ab
movzx eax, word [ebp - 0x5c]
push ebx
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x6d7f5931
movzx eax, word [ebp - 0x5e]
cmp byte [ebp + eax - 0x59], 0x2f
je 0x6d7f5911
lea eax, [ebp - 0x58]
push 0x6d7ff3e4
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x80], eax
test eax, eax
je 0x6d7f5931
push dword [ebp - 0x62]
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
push dword [ebp - 0x7c]
mov edi, eax
push dword [ebp - 0x62]
push ebx
push edi
call esi
add esp, 0x14
cmp eax, dword [ebp - 0x62]
jne 0x6d7f592a
push dword [ebp - 0x80]
push dword [ebp - 0x62]
push ebx
push edi
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
push edi
cmp eax, dword [ebp - 0x62]
jne 0x6d7f592b
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x80]
call dword [sym.imp.MSVCR100.dll_fclose]
pop ecx
pop ecx
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push ebx
push 0x1e
push eax
call esi
add esp, 0x10
cmp eax, ebx
je 0x6d7f5845
jmp 0x6d7f5931
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
push dword [ebp - 0x7c]
call dword [sym.imp.MSVCR100.dll_fclose]
pop ecx
pop ebx
mov ecx, dword [ebp + 0xac]
xor ecx, ebp
pop esi
call fcn.6d7f98d8
add ebp, 0xb0
leave
ret
Function at 0x6d7f5953
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x10cc]
mov eax, 0x114c
call fcn.6d7f99b0
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x10c8], eax
push ebx
mov ebx, dword [ebp + 0x10d4]
push esi
push edi
mov esi, 0x7ff
xor edi, edi
push esi
lea eax, [ebp + 0x8c9]
push edi
push eax
mov dword [ebp - 0x7c], edi
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp + 0xc9]
push edi
push eax
mov byte [ebp + 0xc8], 0
call sub.MSVCR100.dll_memset
add esp, 0x18
push 8
pop ecx
mov esi, str.SOFTWAREMozillaMozilla_Firefox
lea edi, [ebp + 0x8c8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x7c]
push eax
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp + 0x8c8]
push eax
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x80], 0x800
call esi
test eax, eax
je 0x6d7f59e7
xor eax, eax
jmp 0x6d7f5ad2
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xc8]
push eax
push 0
push 0
push str.CurrentVersion
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
test eax, eax
je 0x6d7f5a13
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6d7f59e0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x8c8]
push str.SOFTWAREMozillaMozilla_Firefox_sMain
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x8c8]
push eax
push edi
call esi
test eax, eax
jne 0x6d7f59e0
lea eax, [ebp - 0x80]
push eax
push ebx
push 0
push 0
push str.Install_Directory
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
test eax, eax
jne 0x6d7f5a0b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6d7f5a77
sub eax, esi
cmp byte [eax + ebx - 1], 0x5c
je 0x6d7f5a99
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x6d7f5a8a
mov esi, 0x6d7ff45c
movsw word es:[edi], word [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x6d7f5a9c
mov esi, str.extensions
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x78]
push eax
push ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x6d7f5aea
push 0
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
je 0x6d7f59e0
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x10c8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0x10cc
leave
ret
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test byte [ebp - 0x78], 0x10
jmp 0x6d7f5ac9
Function at 0x6d7f5bc0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x10c4]
mov eax, 0x1144
call fcn.6d7f99b0
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x10c0], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10cc]
push 0x140
lea eax, [ebp - 0x80]
push 0
push eax
call sub.MSVCR100.dll_memset
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [ebp + 0xc0]
push str._s.
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xc0]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x6d7f5cdd
push 0x6d7ff48c
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
je 0x6d7f5ca9
push 0x6d7ff490
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
je 0x6d7f5ca9
lea eax, [ebp - 0x54]
push eax
push edi
lea eax, [ebp + 0x8c0]
push 0x6d7ff494
push eax
call esi
mov eax, dword [ebp - 0x80]
add esp, 0x10
and eax, 0xfffffffe
push eax
lea eax, [ebp + 0x8c0]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test byte [ebp - 0x80], 0x10
lea eax, [ebp + 0x8c0]
push eax
jne 0x6d7f5ca3
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x6d7f5ca9
push eax
lea eax, [ebp + 0x8c0]
push eax
call fcn.6d7f314b
pop ecx
jmp 0x6d7f5ca8
call fcn.6d7f5bc0
pop ecx
lea eax, [ebp - 0x80]
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x6d7f5c2c
push ebx
call dword [sym.imp.kernel32.dll_FindClose]
push edi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov esi, eax
test esi, esi
jne 0x6d7f5cd9
push eax
push edi
call fcn.6d7f314b
pop ecx
pop ecx
mov eax, esi
jmp 0x6d7f5ce0
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x10c0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0x10c4
leave
ret
Function at 0x6d7f61fe
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x6d7fe5f0]
fld qword [0x6d7fe5e8]
fdiv st(1), st(0)
fxch st(1)
call fcn.6d7f9b30
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.6d7f9b30
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x6d7fe5e0]
fadd qword [0x6d7fe5d8]
call fcn.6d7f9b30
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x6d7ff744
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x6d7f6349
push dword [ebp - 0x78]
jmp 0x6d7f634e
push 0x6d7ff74c
push 0x20
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0x3d8
leave
ret 0x14
Function at 0x6d7f705f
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x6d7fe5f0]
fld qword [0x6d7fe5e8]
fdiv st(1), st(0)
fxch st(1)
call fcn.6d7f9b30
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.6d7f9b30
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x6d7fe5e0]
fadd qword [0x6d7fe5d8]
call fcn.6d7f9b30
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push str.Japan
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x6d7f71aa
push dword [ebp - 0x78]
jmp 0x6d7f71af
push 0x6d7ff8a4
push 0x20
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0x3d8
leave
ret 0x14
Function at 0x6d7f73a4
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x17dc]
mov eax, 0x185c
call fcn.6d7f99b0
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x17d8], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, edi
call fcn.6d7f71ed
movzx eax, word [ebp + 0x17e8]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
push ebx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push 0x7ff
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xfd9]
push ebx
push eax
mov byte [ebp + 0xfd8], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
mov esi, 0x800
push esi
lea eax, [ebp + 0xfd8]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
je 0x6d7f7491
add edi, 0x38
push edi
mov edi, dword [sym.imp.MSVCR100.dll_sprintf_s]
push str.http:__java.sun.com_j2se__s_download.html
lea eax, [ebp - 0x28]
push esi
push eax
mov byte [ebp + 0x7d8], bl
call edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0xfd8]
push eax
push str.__s____s_
lea eax, [ebp + 0x7d8]
push esi
push eax
call edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0x30
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x7d8]
push eax
push ebx
mov dword [ebp - 0x80], esi
call dword [sym.imp.kernel32.dll_CreateProcessA]
mov ecx, dword [ebp + 0x17d8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.6d7f98d8
add ebp, 0x17dc
leave
ret 0x10
Function at 0x6d7f82f8
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
je 0x6d7f831b
push 0x104
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x6d7f831b
mov bl, 1
mov al, bl
pop ebx
ret

Function at 0x6d7f8686
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x6d7fb690
call fcn.6d7f991a
mov eax, dword [ebp + 8]
push 0x104
push eax
xor edi, edi
push edi
push edi
xor ecx, ecx
push 0x6d7fc7f4
mov word [eax], cx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x6d7f86fa
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__NULL__pPath__MAX_PATH_
call fcn.6d7f91ca
pop ecx
pop ecx
push edi
push esi
call fcn.6d7eaed2
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.6d7f8f38
push eax
push esi
push 0x6d7ffdac
call fcn.6d7f91ca
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x6d7f86f3
ret
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x6d7f87ab
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x6d7f8757
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x6d7f86be
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x6d7f87ab
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x6d7f87ab
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x6d7f86be
mov eax, esi
call fcn.6d7f9986
ret