joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d092ed8
Capabilities:
Get keyboard layout

Disassembly:
push 0x1c
mov eax, 0x6d0b6cfc
call fcn.6d0b4001
xor edi, edi
mov dword [ebp - 4], edi
call fcn.6d0af51c
call fcn.6d0a44f0
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push edi
push edi
call esi
mov ebx, eax
cmp ebx, edi
jl 0x6d09308c
cmp ebx, 0xffffffff
ja 0x6d09308c
cmp ebx, edi
je 0x6d092f20
cmp ebx, 0x3fffffff
ja 0x6d09308c
mov edi, ebx
shl edi, 2
push edi
call fcn.6d0af480
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
je 0x6d092f6a
push eax
push ebx
call esi
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
cmp ebx, esi
je 0x6d092f52
cmp ebx, 0x3fffffff
ja 0x6d093072
push edi
call fcn.6d0af480
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x6d092f74
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
xor eax, eax
call fcn.6d0b40a6
ret 8
cmp dword [ebp - 0x24], ebx
jge 0x6d092fca
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + ecx*4]
push eax
call sub.java.dll_getJavaIDFromLangID
mov edi, eax
pop ecx
test edi, edi
je 0x6d092fc2
xor esi, esi
cmp esi, dword [ebp - 0x20]
jge 0x6d092fb4
mov eax, dword [ebp - 0x1c]
push edi
push dword [eax + esi*4]
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x6d092fc7
push edi
call dword [sym.imp.MSVCR100.dll_free]
cmp esi, dword [ebp - 0x20]
pop ecx
jne 0x6d092fc2
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x18]
inc dword [ebp - 0x20]
mov dword [eax + esi*4], edi
inc dword [ebp - 0x24]
jmp 0x6d092f74
inc esi
jmp 0x6d092f92
mov esi, dword [ebp + 8]
mov eax, dword [esi]
and dword [ebp - 0x20], 0
push str.java_util_Locale
push esi
call dword [eax + 0x18]
xor edi, edi
mov dword [ebp + 8], eax
cmp eax, edi
je 0x6d093032
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x18]
push esi
call dword [ecx + 0x2b0]
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x6d093029
cmp edi, dword [ebp - 0x18]
jge 0x6d093029
mov eax, dword [ebp - 0x1c]
push dword [eax + edi*4]
push esi
call fcn.6d092bcc
pop ecx
pop ecx
mov ebx, eax
mov eax, dword [esi]
push esi
call dword [eax + 0x390]
test al, al
mov eax, dword [esi]
je 0x6d093049
push dword [ebp - 0x20]
push esi
call dword [eax + 0x5c]
and dword [ebp - 0x20], 0
push dword [ebp + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x5c]
xor esi, esi
cmp esi, dword [ebp - 0x18]
jge 0x6d093058
mov eax, dword [ebp - 0x1c]
push dword [eax + esi*4]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
inc esi
jmp 0x6d093034
push ebx
push edi
push dword [ebp - 0x20]
push esi
call dword [eax + 0x2b8]
inc edi
jmp 0x6d092ffa
push dword [ebp - 0x28]
mov esi, dword [sym.imp.MSVCR100.dll_free]
call esi
push dword [ebp - 0x1c]
call esi
mov eax, dword [ebp - 0x20]
pop ecx
pop ecx
jmp 0x6d092f6c
xor eax, eax
lea edi, [ebp + 0xb]
stosb byte es:[edi], al
mov al, byte [ebp + 0xb]
mov byte [ebp - 0x11], al
push 0x6d0d93c8
lea eax, [ebp - 0x11]
push eax
call sub.MSVCR100.dll__CxxThrowException
xor eax, eax
lea edi, [ebp + 0xb]
stosb byte es:[edi], al
mov al, byte [ebp + 0xb]
mov byte [ebp - 0x12], al
push 0x6d0d93c8
lea eax, [ebp - 0x12]
jmp 0x6d093086
Function at 0x6d098649
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x6d0fb630]
xor eax, ebp
mov dword [ebp + 0x388], eax
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc08]
push edi
call fcn.6d0a9357
mov edi, eax
test edi, edi
je 0x6d09881a
push ebx
push 0xc
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [esi + 0xc08]
push edi
mov ebx, eax
call fcn.6d0a9361
cmp ebx, 8
jne 0x6d0986e6
mov ecx, dword [esi + 0xc08]
call fcn.6d0a9357
mov ebx, eax
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.6d0984c2
pop ecx
pop ecx
mov ecx, dword [esi + 0xc08]
push ebx
mov edi, eax
call fcn.6d0a9361
cmp edi, dword [esi + 0xc00]
jne 0x6d0986ed
mov eax, edi
shl eax, 2
push eax
lea eax, [esi + 0x800]
push eax
lea eax, [ebp - 0x78]
push eax
call sub.MSVCR100.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x6d0986ed
xor eax, eax
jmp 0x6d098819
mov eax, 0x100
cmp edi, eax
jle 0x6d0986f8
mov edi, eax
mov eax, edi
shl eax, 2
push eax
lea eax, [ebp - 0x78]
push eax
lea ebx, [esi + 0x800]
push ebx
call sub.MSVCR100.dll_memcpy
and dword [ebp - 0x80], 0
add esp, 0xc
lea eax, [edi - 1]
push ebx
mov ecx, esi
mov dword [esi + 0xc00], edi
mov dword [ebp - 0x7c], eax
call fcn.6d0985b7
cmp eax, 1
jne 0x6d098732
push 2
jmp 0x6d098775
cmp eax, 2
jne 0x6d09873b
push 3
jmp 0x6d098775
push str.FORCEGRAY
call dword [sym.imp.MSVCR100.dll_getenv]
pop ecx
test eax, eax
je 0x6d098773
push 0xa
pop edx
lea eax, [esi + 0x7d8]
mov ecx, edx
and dword [eax - 0x3d8], 0
and dword [eax], 0
add eax, 4
dec ecx
jne 0x6d098756
sub edi, 0x14
sub dword [ebp - 0x7c], edx
mov dword [ebp - 0x80], edx
push 1
jmp 0x6d098775
push 0
mov ecx, dword [esi + 0xc08]
call fcn.6d0a9907
mov ecx, dword [ebp - 0x80]
cmp ecx, dword [ebp - 0x7c]
jg 0x6d0987b9
lea eax, [esi + ecx*4 + 0x400]
movzx edx, byte [ebp + ecx*4 - 0x78]
movzx ebx, byte [ebp + ecx*4 - 0x77]
or edx, 0xffffff00
shl edx, 8
or edx, ebx
movzx ebx, byte [ebp + ecx*4 - 0x76]
shl edx, 8
or edx, ebx
mov dword [eax], edx
inc ecx
add eax, 4
cmp ecx, dword [ebp - 0x7c]
jle 0x6d09878f
push 0x20
lea ebx, [esi + 0x400]
push edi
push ebx
call fcn.6d0b140e
mov dword [esi + 0xc0c], eax
mov eax, dword [esi + 0xc08]
mov edi, dword [eax + 8]
mov eax, dword [eax]
mov eax, dword [eax]
add esp, 0xc
cmp eax, 3
je 0x6d0987e8
cmp eax, 1
jne 0x6d098816
test edi, edi
je 0x6d098816
mov eax, dword [edi + 0x10]
test eax, eax
je 0x6d0987ff
push eax
call dword [sym.imp.MSVCR100.dll_free]
and dword [edi + 0x10], 0
pop ecx
mov eax, dword [esi + 0xc08]
push dword [eax + 8]
push 0x100
push ebx
call fcn.6d0b10c7
add esp, 0xc
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp + 0x388]
pop edi
xor ecx, ebp
pop esi
call fcn.6d0b3eb2
add ebp, 0x38c
leave
ret
Function at 0x6d09f9a4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x10002
push dword [0x6d0fe4b4]
call sub.java.dll__JNU_GetEnv_8
mov esi, eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.6d074634
add esp, 0x10
cmp dword [ebp - 4], 0
jne 0x6d09f9e4
push str.Invalid_key_code
push esi
call sub.java.dll__JNU_ThrowIllegalArgumentException_8
jmp 0x6d09f9fe
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push dword [ebp + 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
pop esi
leave
ret 8

Function at 0x6d0a16ca
Capabilities:
Check os version

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
mov ebx, 0x43f
mov esi, ecx
push ebx
push dword [esi + 0x28]
call edi
mov ebp, dword [esp + 0x14]
push ebp
push 0
push 0x437
push dword [esi + 0x28]
call edi
push 1
push 1
push ebx
push dword [esi + 0x28]
call edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x6d0a171f
mov eax, dword [ebp]
cmp eax, dword [ebp + 4]
jne 0x6d0a171f
push 1
push 0
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x6d0a25a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push esi
mov esi, 0x205
push edi
mov edi, ecx
cmp eax, esi
je 0x6d0a25f8
cmp eax, 0x104
jne 0x6d0a25dd
cmp dword [ebx + 8], 0x79
jne 0x6d0a25dd
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
jne 0x6d0a25f8
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov ecx, edi
mov dword [edi + 0xa0], eax
call fcn.6d0759d8
and dword [edi + 0xa0], 0
jmp 0x6d0a2663
cmp dword [ebx + 4], esi
jne 0x6d0a2609
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x6d0a2611
or dword [ebp - 8], 0xffffffff
or dword [ebp - 4], 0xffffffff
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
mov edi, dword [edi + 0x28]
shl eax, 0x10
or eax, ecx
push eax
push edi
push 0x7b
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
jne 0x6d0a2659
push 0x10002
push dword [0x6d0fe4b4]
call sub.java.dll__JNU_GetEnv_8
mov esi, eax
push str.Message_not_posted__native_event_queue_may_be_full.
push esi
call sub.java.dll__JNU_ThrowInternalError_8
mov eax, dword [esi]
push esi
call dword [eax + 0x40]
mov eax, dword [esi]
push esi
call dword [eax + 0x44]
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x6d0a352c
Capabilities:
Check os version

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
push 0
mov esi, ecx
push 0x437
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x6d0a3563
mov eax, dword [edi]
cmp eax, dword [edi + 4]
jne 0x6d0a3563
push 1
push 0
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
ret 4
Function at 0x6d0a3b50
Capabilities:
Log keystrokes via polling

Disassembly:
test byte [0x6d0fe6ac], 1
jne 0x6d0a3b6d
or dword [0x6d0fe6ac], 1
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x6d0fe6a8], eax
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
shr eax, 8
test al, al
je 0x6d0a3b87
mov esi, 8
push 0x10
call edi
shr eax, 8
test al, al
je 0x6d0a3b95
or esi, 4
push 1
call edi
shr eax, 8
test al, al
je 0x6d0a3bae
xor eax, eax
cmp dword [0x6d0fe6a8], eax
setne al
inc eax
or esi, eax
push 2
call edi
shr eax, 8
test al, al
je 0x6d0a3bc8
mov ecx, dword [0x6d0fe6a8]
neg ecx
sbb ecx, ecx
add ecx, 2
or esi, ecx
push 4
call edi
shr eax, 8
test al, al
je 0x6d0a3bd6
or esi, 0x10
pop edi
mov eax, esi
pop esi
ret

Function at 0x6d0a4750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6d0b7db8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6d0fb630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax]
call edx
xor eax, eax
cmp dword [esi + 0x1c], eax
je 0x6d0a47a7
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call edx
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
mov ecx, dword [esi + 0x2c]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov al, byte [esp + 0x1c]
push ecx
mov byte [esi + 0x20], al
mov dword [esi + 0x1c], 2
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call eax
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x6d0a47f0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x6d0b7db8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6d0fb630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax]
call edx
cmp dword [esi + 0x1c], 0
je 0x6d0a4846
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call edx
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 0x2c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x30], eax
neg eax
sbb eax, eax
add eax, 2
push edx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call edx
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
Function at 0x6d0a5480
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d0b7fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x6d0fb630]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
call fcn.6d0af51c
call fcn.6d0a44f0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
call esi
push eax
push eax
push str.0x_x___ld
lea eax, [ebp - 0x114]
push 0x80
push eax
call fcn.6d0a3a8f
add esp, 0x14
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
call esi
cmp al, 5
jb 0x6d0a5547
call esi
cmp al, 5
jb 0x6d0a550c
call esi
shr eax, 8
cmp al, 1
jae 0x6d0a5512
call esi
cmp al, 5
jbe 0x6d0a5533
call esi
cmp al, 6
jb 0x6d0a551f
push str.__Windows_Vista_
jmp 0x6d0a554c
push str.__Windows_XP_
push 0x80
lea eax, [ebp + edi*2 - 0x114]
push eax
jmp 0x6d0a5559
push str.__Windows_2000_
push 0x80
lea ecx, [ebp + edi*2 - 0x114]
push ecx
jmp 0x6d0a5559
push str.__Unknown_
push 0x80
lea edx, [ebp + edi*2 - 0x114]
push edx
call fcn.6d0a3a8f
lea eax, [ebp - 0x114]
add esp, 0xc
push eax
call dword [sym.imp.MSVCR100.dll_wcslen]
mov ecx, dword [ebx]
add esp, 4
push eax
mov eax, dword [ecx + 0x28c]
lea edx, [ebp - 0x114]
push edx
push ebx
call eax
jmp 0x6d0a5593
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.6d0b3eb2
mov esp, ebp
pop ebp
ret 8

Function at 0x6d0a6890
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
push eax
mov ebx, ecx
call fcn.6d077ee6
mov esi, eax
add esp, 4
test esi, esi
je 0x6d0a68bc
mov edx, dword [esi]
mov eax, dword [edx + 0x98]
push edi
mov ecx, esi
call eax
cmp eax, 2
je 0x6d0a68e8
mov eax, dword [edi + 4]
cmp eax, 0x200
jb 0x6d0a68cd
cmp eax, 0x20e
jbe 0x6d0a68db
cmp eax, 0xa0
jb 0x6d0a68f3
cmp eax, 0xa9
ja 0x6d0a68f3
push edi
push esi
mov ecx, ebx
call fcn.6d0a5d10
test eax, eax
je 0x6d0a6926
pop edi
pop esi
mov eax, 1
pop ebx
ret 4
cmp eax, 0x100
jb 0x6d0a6926
cmp eax, 0x109
ja 0x6d0a6926
mov edx, dword [ebx + 0x158]
mov eax, dword [edx]
lea esi, [ebx + 0x158]
mov ecx, esi
call eax
add ebx, 0x58
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
Function at 0x6d0a76d0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x6d0b51f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6d0fb630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax]
call edx
cmp dword [esi + 0x1c], 0
jle 0x6d0a772a
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
call edx
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6d0a773a
mov eax, dword [esp + 0x24]
mov dword [esi + 0x38], eax
jmp 0x6d0a7751
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x6d0a774a
mov ecx, eax
mov eax, dword [eax + 0x24]
test eax, eax
jne 0x6d0a7741
mov edx, dword [esp + 0x24]
mov dword [ecx + 0x24], edx
or ebx, 0xffffffff
cmp dword [esi + 0x1c], ebx
jle 0x6d0a7772
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov dword [esp + 0x1c], ebx
call eax
jmp 0x6d0a77e5
mov ecx, dword [esi + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
call edi
mov edx, dword [esi + 0x28]
push edx
call edi
lea edi, [esi + 0x24]
push edi
push 0
push esi
push 0x6d0a69e0
push 0x100000
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
test eax, eax
jne 0x6d0a77ca
mov dword [edi], eax
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
mov dword [esp + 0x1c], ebx
call edx
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
push eax
mov dword [esi + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
mov dword [esp + 0x1c], ebx
call edx
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x6d0a7860
Capabilities:
Set global application hook

Disassembly:
push 0xffffffffffffffff
push 0x6d0b826e
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d0fb630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x6d0fe4d8], 0
je 0x6d0a795f
cmp dword [0x6d0fe4c8], 0
jne 0x6d0a795f
test byte [0x6d0fca2c], 1
jne 0x6d0a78d7
or dword [0x6d0fca2c], 1
mov ecx, 0x6d0fca28
mov dword [esp + 0x1c], 0
call fcn.6d011742
push 0x6d0b8eea
call fcn.6d0b42b2
add esp, 4
mov dword [esp + 0x1c], 0xffffffff
mov ecx, 0x6d0fca28
call fcn.6d011748
mov ebx, dword [esp + 0x24]
test ebx, ebx
jne 0x6d0a78f6
push 1
lea ecx, [esi + 0x1a8]
call fcn.6d0a4750
call fcn.6d0a7800
call fcn.6d0af5d0
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 0xe
push esi
call edi
push 0xc
push esi
mov ebp, eax
call edi
imul ebp, eax
cmp ebp, 4
jge 0x6d0a7977
push 0x10
push str.AWT_Initialization_Error
push str.Sorry__but_this_release_of_Java_requires_at_least_16_colors
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x6d0fe4b4]
push 0x10002
push eax
call sub.java.dll__JNU_GetEnv_8
push str.unsupported_screen_depth
push str.java_lang_InternalError
push eax
call sub.java.dll__JNU_ThrowByName_12
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [0x6d0fe4c4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x6d0fe634]
mov edx, dword [str.SunAwtToolkit]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x8000000
push str.theAwtToolkitWindow
push edx
push 0
mov dword [0x6d0fe4c8], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x6d0fe4cc], eax
mov eax, dword [0x6d0fe4c8]
push eax
push 0
push 0x6d0a7620
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x6d0fe500], eax
call fcn.6d083615
mov eax, 1
jmp 0x6d0a7961

Function at 0x6d0a9aa2
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [ecx]
cmp dword [eax + 4], 8
jle 0x6d0a9aad
xor eax, eax
ret
mov ecx, dword [ecx + 4]
jmp fcn.6d098649

Function at 0x6d0aa89b
Capabilities:
Check os version

Disassembly:
push 0xc
mov eax, 0x6d0b85d0
call fcn.6d0b4001
mov eax, dword [0x6d0fb618]
cmp eax, 0xfffffffe
jne 0x6d0aa920
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x6d0aa8c6
and dword [0x6d0fb618], 0
xor eax, eax
jmp 0x6d0aa920
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
call fcn.6d0214f1
pop ecx
cmp eax, ebx
jl 0x6d0aa8ea
mov ebx, dword [ebp - 0x14]
jmp 0x6d0aa8ea
push 0x10002
push dword [0x6d0fe4b4]
mov dword [0x6d0fb618], ebx
call sub.java.dll__JNU_GetEnv_8
movzx ecx, bl
push ecx
push str._Z_V
push str.dwmCompositionChanged
push str.sun_awt_Win32GraphicsEnvironment
push 0
push eax
call sub.java.dll_JNU_CallStaticMethodByName
add esp, 0x18
mov eax, ebx
call fcn.6d0b40a6
ret
Function at 0x6d0aaa10
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5b4]
sub esp, 0x634
mov eax, dword [0x6d0fb630]
xor eax, ebp
mov dword [ebp + 0x5b0], eax
push ebx
mov ebx, dword [ebp + 0x5bc]
push esi
mov dword [ebp - 0x7c], 0x105
lea esi, [ebp + 0x3a4]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov ecx, 0x411
cmp ax, cx
jne 0x6d0aaa5a
mov eax, str.EUDC932
jmp 0x6d0aaabe
mov ecx, 0x804
cmp ax, cx
je 0x6d0aaab9
mov ecx, 0x1004
cmp ax, cx
je 0x6d0aaab9
mov ecx, 0xc04
cmp ax, cx
je 0x6d0aaab2
mov ecx, 0x404
cmp ax, cx
je 0x6d0aaab2
mov ecx, 0x1404
cmp ax, cx
je 0x6d0aaab2
mov ecx, 0x412
cmp ax, cx
jne 0x6d0aaa9d
mov eax, str.EUDC949
jmp 0x6d0aaabe
mov ecx, 0x409
cmp ax, cx
jne 0x6d0aab6e
mov eax, str.EUDC1252
jmp 0x6d0aaabe
mov eax, str.EUDC950
jmp 0x6d0aaabe
mov eax, str.EUDC936
lea ecx, [ebp - 0x78]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6d0aab6e
push edi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x3a4]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.SystemDefaultEUDCFont
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x6d0aab6e
cmp dword [ebp - 0x80], 1
jne 0x6d0aab6e
mov ecx, dword [ebp - 0x7c]
xor eax, eax
mov word [ebp + ecx*2 + 0x3a4], ax
lea eax, [ebp + 0x3a4]
push str._SystemRoot_
push eax
call dword [sym.imp.MSVCR100.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x6d0aab89
push str.SystemRoot
call dword [sym.imp.MSVCR100.dll__wgetenv]
pop ecx
test eax, eax
je 0x6d0aab6e
lea ecx, [ebp + 0x3bc]
push ecx
push eax
push str._s_s
lea eax, [ebp + 0x198]
push 0x104
push eax
call fcn.6d0a3a8f
add esp, 0x14
cmp eax, 0xffffffff
jne 0x6d0aabd1
xor eax, eax
mov ecx, dword [ebp + 0x5b0]
pop esi
xor ecx, ebp
pop ebx
call fcn.6d0b3eb2
add ebp, 0x5b4
leave
ret 8
lea eax, [ebp + 0x3a4]
push str.EUDC.TTE
push eax
call dword [sym.imp.MSVCR100.dll_wcscmp]
pop ecx
pop ecx
test eax, eax
jne 0x6d0aabd7
push 0x105
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x6d0aab6e
lea eax, [ebp - 0x74]
push eax
push str._sFONTSEUDC.TTE
lea eax, [ebp + 0x198]
push 0x104
push eax
call fcn.6d0a3a8f
add esp, 0x10
lea esi, [ebp + 0x198]
push esi
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
mov ecx, dword [ebx]
push eax
push esi
push ebx
call dword [ecx + 0x28c]
jmp 0x6d0aab70

Function at 0x6d0aacb5
Capabilities:
Check os version

Disassembly:
mov dword [0x6d0fb618], 0xfffffffe
jmp fcn.6d0aa89b
Function at 0x6d0b0d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push esi
push dword [ebp + 8]
call fcn.6d0b08e9
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.6d0b0934
push eax
push esi
push dword [ebp + 8]
call fcn.6d0b08e9
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.6d0b0924
pop ebp
pop ebp
and dword [edx - 0x836278], ebp
invalid