joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d05a4e7
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
push str.OGLFuncs_InitPlatformFuncs
inc ebx
push ebx
push 3
call fcn.6d05f1d0
mov eax, dword [0x6d0f95e0]
add esp, 0xc
test eax, eax
jne 0x6d05a517
push str.OGLFuncs_InitPlatformFuncs:_library_not_yet_initialized
push ebx
push ebx
call fcn.6d05f1d0
add esp, 0xc
xor al, al
pop ebx
ret
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push edi
mov edi, str.wglCreateContext
push edi
push eax
call esi
mov dword [0x6d0fbd20], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglDeleteContext
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbcc0], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglMakeCurrent
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbdf0], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglGetCurrentContext
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbe18], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglGetCurrentDC
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbe14], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglGetProcAddress
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbe2c], eax
test eax, eax
je 0x6d05a5bf
mov edi, str.wglShareLists
push edi
push dword [0x6d0f95e0]
call esi
mov dword [0x6d0fbca4], eax
test eax, eax
jne 0x6d05a5ce
push edi
push ebx
push ebx
call fcn.6d05f1d0
add esp, 0xc
xor al, al
jmp 0x6d05a5d0
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x6d05f1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x6d05f1df
pop dword [ebp - 0x18]
mov eax, 0x6d05f1df
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x91c023b2
add dword [ebp - 0x28], 0xbc922199
mov dword [ebp - 0x24], 0x2963a4c9
add dword [ebp - 0x24], 0x8cfa77c
mov dword [ebp - 0x20], 0xa163b8b8
add dword [ebp - 0x20], 0xaae88b76
mov dword [ebp - 0x1c], 0xb31db9c6
add dword [ebp - 0x1c], 0x4ce2463a
lea eax, [ebp - 0x28]
push eax
mov eax, 0x2f7f34fd
add eax, 0x3d8c2b33
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x8595f0e7
add dword [ebp - 0x28], 0xeedc786f
mov dword [ebp - 0x24], 0xbb06b30b
sub dword [ebp - 0x24], 0x799a5196
mov dword [ebp - 0x20], 0x3afccb10
add dword [ebp - 0x20], 0x2872a15c
mov dword [ebp - 0x1c], 0x69ebbff4
add dword [ebp - 0x1c], 0x9614400c
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xa4760f2
sub eax, 0x9d3c0092
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3da9d
push 0
call eax
mov ecx, 0x49e6
mov edi, eax
mov esi, 0x1888df31
sub esi, 0xab74cd31
add esi, dword [ebp - 0x18]
mov ebx, 0x258e05c3
add ebx, 0xe05ce996
sub dword [ebp - 0xc], edi
mov edx, dword [esi]
xor dword [ebp - 0x14], edx
add edx, ebx
mov dword [ebp - 0x14], 0x2e042665
mov dword [edi], edx
add edi, 4
add esi, 0x6eb1a4a
add esi, 0xf914e5ba
loop 0x6d05f2f6
add eax, 0x11a6b
xor ebx, ebx
add ebx, eax
add eax, 0xee7a79fe
add eax, 0x11858607
mov ecx, 0x4cd6dbfe
sub ecx, 0xdfd6dbfe
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x6d07067e
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
sub esp, 0x100
lea ebp, [esp - 4]
mov eax, dword [0x6d0f8610]
xor eax, ebp
mov dword [ebp + 0x100], eax
push 8
mov eax, 0x6d0b25d8
call fcn.6d0b0c76
test byte [0x6d0fa9cc], 1
mov edi, dword [ebp + 0x10c]
mov dword [ebp - 0x10], edi
jne 0x6d0706eb
or dword [0x6d0fa9cc], 1
fld dword [0x6d0ba530]
and dword [ebp - 4], 0
push ecx
fstp dword [esp]
push 0x1d
push 0
push str.VKEY_translations
mov ecx, 0x6d0fa994
call fcn.6d0627a2
push 0x6d0b5a0c
call fcn.6d05f1d0
or dword [ebp - 4], 0xffffffff
pop ecx
cmp dword [ebp + 0x114], 1
jne 0x6d070707
push edi
mov ecx, 0x6d0fa994
call fcn.6d062988
test eax, eax
jne 0x6d070844
cmp edi, 0xd
jne 0x6d070714
push 0xa
pop eax
jmp 0x6d070844
lea eax, [ebp]
push eax
call fcn.6d08d640
mov eax, dword [ebp + 0x110]
pop ecx
test eax, eax
je 0x6d0707c3
mov esi, eax
mov edx, eax
mov ecx, eax
mov ebx, 0x80
and esi, 0x40
and edx, 0x200
and ecx, ebx
test eax, 0x2000
je 0x6d07074e
xor ecx, ecx
inc ecx
mov edx, ecx
test esi, esi
je 0x6d070758
or byte [ebp + 0x10], bl
mov edi, dword [ebp - 0x10]
push edi
call fcn.6d06ca24
add esp, 4
test eax, eax
je 0x6d07076c
and byte [ebp + 0x12], 0x7f
mov edi, dword [ebp - 0x10]
test ecx, ecx
je 0x6d0707c3
test edx, edx
jne 0x6d070780
and byte [ebp + 0x11], 0x7f
lea eax, [edi - 0x41]
cmp eax, 0x19
ja 0x6d070785
or byte [ebp + 0x11], bl
jmp 0x6d0707c3
push 0x1b
pop edi
push edi
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
movzx ecx, al
cmp dword [ebp - 0x10], ecx
je 0x6d0707a3
inc edi
cmp di, 0x20
jb 0x6d070788
jmp 0x6d0707c0
shr eax, 8
movzx eax, al
test al, 2
jne 0x6d0707bd
not eax
xor ecx, ecx
and eax, 1
test esi, esi
sete cl
cmp eax, ecx
jne 0x6d0707c0
or byte [ebp + 0x11], bl
mov edi, dword [ebp - 0x10]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push dword [0x6d0fa958]
lea ecx, [ebp - 0x14]
push 0
push ecx
lea ecx, [ebp]
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_ToAsciiEx]
test eax, eax
js 0x6d070801
jne 0x6d070808
cmp edi, 0x2e
jne 0x6d0707f4
push 0x7f
pop esi
jmp 0x6d07082d
lea eax, [edi - 0x60]
cmp eax, 9
ja 0x6d070801
lea esi, [edi - 0x30]
jmp 0x6d07082d
mov esi, 0xffff
jmp 0x6d07082d
jle 0x6d07082a
push 1
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push 1
push dword [0x6d0fa944]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
movzx esi, word [ebp - 0x10]
jmp 0x6d07082d
mov esi, dword [ebp - 0x10]
cmp dword [ebp + 0x114], 2
jne 0x6d070842
push esi
push edi
mov ecx, 0x6d0fa994
call fcn.6d0628e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.6d0b0acb
add ebp, 0x104
leave
ret 0xc
Function at 0x6d075aa6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1fc
mov eax, dword [0x6d0f8610]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call dword [sym.imp.kernel32.dll_GetVersion]
cmp al, 6
sbb eax, eax
push 0
and eax, 0xfffffffc
lea ecx, [ebp - 0x184]
add eax, 0x1f8
push ecx
push eax
push 0x29
mov dword [ebp - 0x184], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea eax, [ebp - 0x16c]
push eax
push str.win.frame.captionFont
mov ecx, esi
call fcn.6d05f1d0
push dword [ebp - 0x170]
mov ecx, esi
push str.win.frame.captionHeight
call fcn.6d0752d7
push dword [ebp - 0x174]
mov ecx, esi
push str.win.frame.captionButtonWidth
call fcn.6d0752d7
push dword [ebp - 0x170]
mov ecx, esi
push str.win.frame.captionButtonHeight
call fcn.6d0752d7
lea eax, [ebp - 0x108]
push eax
push str.win.frame.smallCaptionFont
mov ecx, esi
call fcn.6d05f1d0
push dword [ebp - 0x10c]
mov ecx, esi
push str.win.frame.smallCaptionHeight
call fcn.6d0752d7
push dword [ebp - 0x110]
mov ecx, esi
push str.win.frame.smallCaptionButtonWidth
call fcn.6d0752d7
push dword [ebp - 0x10c]
mov ecx, esi
push str.win.frame.smallCaptionButtonHeight
call fcn.6d0752d7
push dword [ebp - 0x180]
mov ecx, esi
push str.win.frame.sizingBorderWidth
call fcn.6d0752d7
lea eax, [ebp - 0xa4]
push eax
push str.win.menu.font
mov ecx, esi
call fcn.6d05f1d0
push dword [ebp - 0xa8]
mov ecx, esi
push str.win.menu.height
call fcn.6d0752d7
push dword [ebp - 0xac]
mov ecx, esi
push str.win.menu.buttonWidth
call fcn.6d0752d7
push dword [ebp - 0x17c]
mov ecx, esi
push str.win.scrollbar.width
call fcn.6d0752d7
push dword [ebp - 0x178]
mov ecx, esi
push str.win.scrollbar.height
call fcn.6d0752d7
lea eax, [ebp - 0x48]
push eax
push str.win.status.font
mov ecx, esi
call fcn.6d05f1d0
lea eax, [ebp - 0x48]
push eax
push str.win.tooltip.font
mov ecx, esi
call fcn.6d05f1d0
lea eax, [ebp + 0x14]
push eax
push str.win.messagebox.font
mov ecx, esi
call fcn.6d05f1d0
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.6d0b0acb
add ebp, 0x78
leave
ret
Function at 0x6d075c9f
Capabilities:
Check os version

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push edi
push 0x1b
mov edi, ecx
call esi
push eax
push str.win.frame.activeCaptionGradientColor
mov ecx, edi
call fcn.6d05f1d0
push 0x1c
call esi
push eax
push str.win.frame.inactiveCaptionGradientColor
mov ecx, edi
call fcn.6d05f1d0
push 0x1a
call esi
push eax
push str.win.item.hotTrackedColor
mov ecx, edi
call fcn.6d05f1d0
push 0x15
call esi
push eax
push str.win.3d.darkShadowColor
mov ecx, edi
call fcn.6d05f1d0
push 0xf
call esi
push eax
push str.win.3d.backgroundColor
mov ecx, edi
call fcn.6d05f1d0
push 0x14
call esi
push eax
push str.win.3d.highlightColor
mov ecx, edi
call fcn.6d05f1d0
push 0x16
call esi
push eax
push str.win.3d.lightColor
mov ecx, edi
call fcn.6d05f1d0
push 0x10
call esi
push eax
push str.win.3d.shadowColor
mov ecx, edi
call fcn.6d05f1d0
push 0x12
call esi
push eax
push str.win.button.textColor
mov ecx, edi
call fcn.6d05f1d0
push 1
call esi
push eax
push str.win.desktop.backgroundColor
mov ecx, edi
call fcn.6d05f1d0
push 2
call esi
push eax
push str.win.frame.activeCaptionColor
mov ecx, edi
call fcn.6d05f1d0
push 0xa
call esi
push eax
push str.win.frame.activeBorderColor
mov ecx, edi
call fcn.6d05f1d0
push 6
call esi
push eax
push str.win.frame.color
mov ecx, edi
call fcn.6d05f1d0
push 5
call esi
push eax
push str.win.frame.backgroundColor
mov ecx, edi
call fcn.6d05f1d0
push 9
call esi
push eax
push str.win.frame.captionTextColor
mov ecx, edi
call fcn.6d05f1d0
push 0xb
call esi
push eax
push str.win.frame.inactiveBorderColor
mov ecx, edi
call fcn.6d05f1d0
push 3
call esi
push eax
push str.win.frame.inactiveCaptionColor
mov ecx, edi
call fcn.6d05f1d0
push 0x13
call esi
push eax
push str.win.frame.inactiveCaptionTextColor
mov ecx, edi
call fcn.6d05f1d0
push 8
call esi
push eax
push str.win.frame.textColor
mov ecx, edi
call fcn.6d05f1d0
push 0xd
call esi
push eax
push str.win.item.highlightColor
mov ecx, edi
call fcn.6d05f1d0
push 0xe
call esi
push eax
push str.win.item.highlightTextColor
mov ecx, edi
call fcn.6d05f1d0
push 0xc
call esi
push eax
push str.win.mdi.backgroundColor
mov ecx, edi
call fcn.6d05f1d0
push 4
call esi
push eax
push str.win.menu.backgroundColor
mov ecx, edi
call fcn.6d05f1d0
push 7
call esi
push eax
push str.win.menu.textColor
mov ecx, edi
call fcn.6d05f1d0
mov ebx, dword [sym.imp.kernel32.dll_GetVersion]
call ebx
cmp al, 5
jb 0x6d075e57
call ebx
shr eax, 8
cmp al, 1
jae 0x6d075e61
call ebx
cmp al, 5
ja 0x6d075e61
push 4
jmp 0x6d075e63
push 0x1e
pop eax
push eax
call esi
push eax
push str.win.menubar.backgroundColor
mov ecx, edi
call fcn.6d05f1d0
push 0
call esi
push eax
push str.win.scrollbar.backgroundColor
mov ecx, edi
call fcn.6d05f1d0
push 0x11
call esi
push eax
push str.win.text.grayedTextColor
mov ecx, edi
call fcn.6d05f1d0
push 0x18
call esi
push eax
push str.win.tooltip.backgroundColor
mov ecx, edi
call fcn.6d05f1d0
push 0x17
call esi
push eax
push str.win.tooltip.textColor
mov ecx, edi
call fcn.6d05f1d0
pop edi
pop esi
pop ebx
ret
Function at 0x6d079249
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
add eax, dword [ebp + 8]
push 0
push 0
push eax
push dword [esi + 0x18]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x18]
call dword [sym.imp.kernel32.dll_ReadFile]
pop esi
pop ebp
ret 0xc

Function at 0x6d079454
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x6d0f8610]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x74], eax
cmp dword [0x6d0f77e4], ebx
je 0x6d0795d5
call fcn.6d05f1d0
cmp eax, ebx
jne 0x6d07949e
mov dword [0x6d0f77e4], ebx
jmp 0x6d0795d5
lea ecx, [ebp - 0x7c]
push ecx
push 0xf003f
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d079493
push edi
push dword [esi + 4]
mov edi, dword [sym.imp.MSVCR100.dll_wcscpy]
lea eax, [ebp - 0x70]
push eax
call edi
lea eax, [ebp - 0x70]
push 0x2c
push eax
call dword [sym.imp.MSVCR100.dll_wcschr]
add esp, 0x10
cmp eax, ebx
je 0x6d0794e0
xor ecx, ecx
mov word [eax], cx
mov esi, 0x104
push esi
lea eax, [ebp + 0x30]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
push ebx
push 0x50
lea eax, [ebp + 0x134]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
mov dword [ebp - 0x78], esi
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp + 0x134]
push eax
push dword [ebp - 0x7c]
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x6d07958d
cmp dword [0x6d0f77e8], ebx
je 0x6d0795d4
mov esi, 0x6d0fad48
push esi
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
test eax, eax
je 0x6d079557
push esi
push dword [ebp - 0x74]
call edi
jmp 0x6d0795d2
push 5
pop ecx
mov esi, 0x6d0beee0
lea edi, [ebp + 0x184]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp + 0x184]
movsw word es:[edi], word [esi]
push eax
push dword [ebp - 0x7c]
xor esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d0795a1
lea eax, [ebp + 0x30]
push str.userfont.fon
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x6d0795a9
mov dword [0x6d0f77e8], ebx
jmp 0x6d0795d4
push dword [ebp + 0x1ac]
lea eax, [ebp + 0x30]
push dword [ebp - 0x74]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp esi, ebx
je 0x6d0795d4
push dword [ebp - 0x74]
push 0x6d0fad48
call dword [sym.imp.MSVCR100.dll_wcscpy]
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp + 0x19c]
pop esi
xor ecx, ebp
pop ebx
call fcn.6d0b0acb
add ebp, 0x1a0
leave
ret 8
Function at 0x6d07d67c
Capabilities:
Get keyboard layout

Disassembly:
push 0x14
mov eax, 0x6d0b3136
call fcn.6d0b0ca9
xor edi, edi
mov dword [ebp - 4], edi
call fcn.6d09cfff
call fcn.6d05f1d0
movzx eax, word [0x6d0fa934]
push eax
call sub.java.dll_getJavaIDFromLangID
mov esi, dword [ebp + 8]
pop ecx
lea ecx, [ebp - 0x12]
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x2a4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x1c], edi
je 0x6d07d6f4
push eax
push dword [ebp - 0x1c]
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x6d07d6f4
push dword [ebp - 0x18]
mov eax, dword [esi]
push dword [ebp + 0x10]
push esi
call dword [eax + 0x2a8]
mov bl, 1
push dword [ebp - 0x1c]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
mov al, bl
jmp 0x6d07d7a9
mov ebx, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push edi
push edi
call ebx
lea esi, [eax + 1]
mov eax, esi
shl eax, 2
push eax
call fcn.6d05f1d0
mov edi, eax
pop ecx
lea eax, [edi + 4]
push eax
lea eax, [esi - 1]
push eax
call ebx
call fcn.6d05f1d0
and dword [ebp - 0x20], 0
mov dword [edi], eax
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 0x20]
cmp eax, esi
jge 0x6d07d775
lea ebx, [edi + eax*4]
movzx eax, word [ebx]
push eax
call sub.java.dll_getJavaIDFromLangID
pop ecx
test eax, eax
je 0x6d07d797
push dword [ebp - 0x18]
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x6d07d797
push dword [ebx]
movzx eax, byte [ebp + 0x14]
push eax
push 0x9823
mov ecx, 0x6d0fb1d0
call fcn.6d06bdbd
test eax, eax
je 0x6d07d775
push dword [ebx]
call fcn.6d08d7c0
pop ecx
mov byte [ebp - 0x11], 1
push dword [ebp - 0x18]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2a8]
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov bl, byte [ebp - 0x11]
pop ecx
jmp 0x6d07d6e3
inc dword [ebp - 0x20]
jmp 0x6d07d728
call fcn.6d0b0d4e
ret 0x10
Function at 0x6d07d7b7
Capabilities:
Get keyboard layout

Disassembly:
push 0x1c
mov eax, 0x6d0b3151
call fcn.6d0b0ca9
xor esi, esi
mov dword [ebp - 4], esi
call fcn.6d09cfff
call fcn.6d05f1d0
push esi
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
call esi
mov ebx, eax
mov edi, ebx
shl edi, 2
push edi
mov dword [ebp - 0x28], ebx
call fcn.6d05f1d0
pop ecx
push eax
push ebx
mov dword [ebp - 0x24], eax
call esi
xor eax, eax
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
call fcn.6d05f1d0
mov ebx, eax
pop ecx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x28]
jge 0x6d07d856
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
movzx eax, word [eax + ecx*4]
push eax
call sub.java.dll_getJavaIDFromLangID
mov edi, eax
pop ecx
test edi, edi
je 0x6d07d851
xor esi, esi
cmp esi, dword [ebp - 0x14]
jge 0x6d07d846
push edi
push dword [ebx + esi*4]
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x6d07d843
inc esi
jmp 0x6d07d82c
cmp esi, dword [ebp - 0x14]
jne 0x6d07d851
inc dword [ebp - 0x1c]
inc dword [ebp - 0x14]
mov dword [ebx + esi*4], edi
inc dword [ebp - 0x18]
jmp 0x6d07d80b
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push str.java_util_Locale
push esi
call dword [eax + 0x18]
mov ecx, dword [esi]
xor ebx, ebx
push ebx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
push esi
call dword [ecx + 0x2b0]
mov edi, dword [sym.imp.MSVCR100.dll_free]
mov dword [ebp + 8], eax
cmp ebx, dword [ebp - 0x1c]
jge 0x6d07d8ad
mov eax, dword [ebp - 0x20]
push dword [eax + ebx*4]
push esi
call fcn.6d07d523
pop ecx
pop ecx
mov ecx, dword [esi]
push eax
push ebx
push dword [ebp + 8]
push esi
call dword [ecx + 0x2b8]
mov eax, dword [ebp - 0x20]
push dword [eax + ebx*4]
call edi
pop ecx
inc ebx
jmp 0x6d07d880
push dword [ebp - 0x28]
mov eax, dword [esi]
push esi
call dword [eax + 0x5c]
push dword [ebp - 0x24]
call edi
push dword [ebp - 0x20]
call edi
mov eax, dword [ebp + 8]
pop ecx
pop ecx
jmp 0x6d07d8d4
call fcn.6d0b0d4e
ret 8
Function at 0x6d082858
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x6d0f8610]
xor eax, ebp
mov dword [ebp + 0x388], eax
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc08]
push edi
call fcn.6d095ef6
mov edi, eax
test edi, edi
je 0x6d082a29
push ebx
push 0xc
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [esi + 0xc08]
push edi
mov ebx, eax
call fcn.6d095f00
cmp ebx, 8
jne 0x6d0828f5
mov ecx, dword [esi + 0xc08]
call fcn.6d095ef6
mov ebx, eax
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.6d0826d1
pop ecx
pop ecx
mov ecx, dword [esi + 0xc08]
push ebx
mov edi, eax
call fcn.6d095f00
cmp edi, dword [esi + 0xc00]
jne 0x6d0828fc
mov eax, edi
shl eax, 2
push eax
lea eax, [esi + 0x800]
push eax
lea eax, [ebp - 0x78]
push eax
call sub.MSVCR100.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x6d0828fc
xor eax, eax
jmp 0x6d082a28
mov eax, 0x100
cmp edi, eax
jle 0x6d082907
mov edi, eax
mov eax, edi
shl eax, 2
push eax
lea eax, [ebp - 0x78]
push eax
lea ebx, [esi + 0x800]
push ebx
call sub.MSVCR100.dll_memcpy
and dword [ebp - 0x80], 0
add esp, 0xc
lea eax, [edi - 1]
push ebx
mov ecx, esi
mov dword [esi + 0xc00], edi
mov dword [ebp - 0x7c], eax
call fcn.6d05f1d0
cmp eax, 1
jne 0x6d082941
push 2
jmp 0x6d082984
cmp eax, 2
jne 0x6d08294a
push 3
jmp 0x6d082984
push str.FORCEGRAY
call dword [sym.imp.MSVCR100.dll_getenv]
pop ecx
test eax, eax
je 0x6d082982
push 0xa
pop edx
lea eax, [esi + 0x7d8]
mov ecx, edx
and dword [eax - 0x3d8], 0
and dword [eax], 0
add eax, 4
dec ecx
jne 0x6d082965
sub edi, 0x14
sub dword [ebp - 0x7c], edx
mov dword [ebp - 0x80], edx
push 1
jmp 0x6d082984
push 0
mov ecx, dword [esi + 0xc08]
call fcn.6d096479
mov ecx, dword [ebp - 0x80]
cmp ecx, dword [ebp - 0x7c]
jg 0x6d0829c8
lea eax, [esi + ecx*4 + 0x400]
movzx edx, byte [ebp + ecx*4 - 0x78]
movzx ebx, byte [ebp + ecx*4 - 0x77]
or edx, 0xffffff00
shl edx, 8
or edx, ebx
movzx ebx, byte [ebp + ecx*4 - 0x76]
shl edx, 8
or edx, ebx
mov dword [eax], edx
inc ecx
add eax, 4
cmp ecx, dword [ebp - 0x7c]
jle 0x6d08299e
push 0x20
lea ebx, [esi + 0x400]
push edi
push ebx
call fcn.6d05f1d0
mov dword [esi + 0xc0c], eax
mov eax, dword [esi + 0xc08]
mov edi, dword [eax + 8]
mov eax, dword [eax]
mov eax, dword [eax]
add esp, 0xc
cmp eax, 3
je 0x6d0829f7
cmp eax, 1
jne 0x6d082a25
test edi, edi
je 0x6d082a25
mov eax, dword [edi + 0x10]
test eax, eax
je 0x6d082a0e
push eax
call dword [sym.imp.MSVCR100.dll_free]
and dword [edi + 0x10], 0
pop ecx
mov eax, dword [esi + 0xc08]
push dword [eax + 8]
push 0x100
push ebx
call fcn.6d05f1d0
add esp, 0xc
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp + 0x388]
pop edi
xor ecx, ebp
pop esi
call fcn.6d0b0acb
add ebp, 0x38c
leave
ret
Function at 0x6d08afa6
Capabilities:
Check os version

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
mov ebx, 0x43f
mov esi, ecx
push ebx
push dword [esi + 0x28]
call edi
mov ebp, dword [esp + 0x14]
push ebp
push 0
push 0x437
push dword [esi + 0x28]
call edi
push 1
push 1
push ebx
push dword [esi + 0x28]
call edi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp al, 6
jb 0x6d08affb
mov eax, dword [ebp]
cmp eax, dword [ebp + 4]
jne 0x6d08affb
push 1
push 0
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x6d08f090
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d0b43c0
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x6d0f8610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
call fcn.6d09cfff
call fcn.6d05f1d0
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
push eax
push eax
push str.0x_x___ld
lea eax, [ebp - 0x114]
push 0x80
push eax
call fcn.6d0959c2
add esp, 0x14
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.kernel32.dll_lstrlenW]
mov edi, eax
call esi
cmp al, 5
jb 0x6d08f157
call esi
cmp al, 5
jb 0x6d08f11c
call esi
shr eax, 8
cmp al, 1
jae 0x6d08f122
call esi
cmp al, 5
jbe 0x6d08f143
call esi
cmp al, 6
jb 0x6d08f12f
push str.__Windows_Vista_
jmp 0x6d08f15c
push str.__Windows_XP_
push 0x80
lea eax, [ebp + edi*2 - 0x114]
push eax
jmp 0x6d08f169
push str.__Windows_2000_
push 0x80
lea ecx, [ebp + edi*2 - 0x114]
push ecx
jmp 0x6d08f169
push str.__Unknown_
push 0x80
lea edx, [ebp + edi*2 - 0x114]
push edx
call fcn.6d0959c2
lea eax, [ebp - 0x114]
add esp, 0xc
push eax
call dword [sym.imp.MSVCR100.dll_wcslen]
mov ecx, dword [ebx]
add esp, 4
push eax
mov eax, dword [ecx + 0x28c]
lea edx, [ebp - 0x114]
push edx
push ebx
call eax
jmp 0x6d08f1a3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.6d0b0acb
mov esp, ebp
pop ebp
ret 8