joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6864f0
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x686506
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x6864ff
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x686591
movzx ecx, byte [ecx + 0x983610]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x983510]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x983510]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x983610]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x6865ee
movzx ecx, byte [ecx + 0x983610]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x983610]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x983510]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x983510]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x983510]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x983610]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x983510]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x983610]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x983510]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x983510]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x983610]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x983610]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x983710]
xor edx, dword [ebx*4 + 0x983b10]
xor edx, dword [eax*4 + 0x983f10]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + 0x984310]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x6867f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
and ecx, 0xff
xor ebx, ebx
mov esi, dword [edx + ebx*4]
imul edi, ecx, 0x1010101
xor esi, edi
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x6867fb
pop edi
pop esi
pop ebx
ret
Function at 0x686814
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x983510
lea eax, [ebp - 0x100]
call fcn.006867f0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
and edx, 0xff
xor eax, eax
lea ecx, [ebp - 0x100]
mov ebx, eax
add ebx, ebx
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x983510]
xor edi, edx
mov edi, dword [edi*4 + 0x983710]
mov dword [esi + ebx*4], edi
inc eax
inc ecx
cmp eax, 0x100
jne 0x68684a
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x983610
lea eax, [ebp - 0x100]
call fcn.006867f0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 8
and edx, 0xff
xor eax, eax
lea ecx, [ebp - 0x100]
mov ebx, eax
add ebx, ebx
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x983510]
xor edi, edx
mov edi, dword [edi*4 + 0x983b10]
mov dword [esi + ebx*4 + 4], edi
inc eax
inc ecx
cmp eax, 0x100
jne 0x6868a3
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x983510
lea eax, [ebp - 0x100]
call fcn.006867f0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 0x10
and edx, 0xff
xor eax, eax
lea ecx, [ebp - 0x100]
mov ebx, eax
add ebx, ebx
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x983610]
xor edi, edx
mov edi, dword [edi*4 + 0x983f10]
mov dword [esi + ebx*4 + 0x800], edi
inc eax
inc ecx
cmp eax, 0x100
jne 0x6868fd
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x983610
lea eax, [ebp - 0x100]
call fcn.006867f0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 0x18
xor eax, eax
lea ecx, [ebp - 0x100]
mov ebx, eax
add ebx, ebx
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x983610]
xor edi, edx
mov edi, dword [edi*4 + 0x984310]
mov dword [esi + ebx*4 + 0x804], edi
inc eax
inc ecx
cmp eax, 0x100
jne 0x686954
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x686988
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov edx, 0x983610
lea eax, [ebp - 0x100]
call fcn.006867f0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
and ecx, 0xff
xor eax, eax
lea ebx, [ebp - 0x100]
mov esi, eax
add esi, esi
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
lea esi, [edi + esi*4]
push esi
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x983510]
xor esi, ecx
movzx esi, byte [esi + 0x983510]
xor esi, edx
mov esi, dword [esi*4 + 0x983710]
pop edi
mov dword [edi], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x6869ca
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
mov edx, 0x983610
lea eax, [ebp - 0x100]
call fcn.006867f0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 8
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
and ecx, 0xff
xor eax, eax
lea ebx, [ebp - 0x100]
mov esi, eax
add esi, esi
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
lea esi, [edi + esi*4 + 4]
push esi
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x983610]
xor esi, ecx
movzx esi, byte [esi + 0x983510]
xor esi, edx
mov esi, dword [esi*4 + 0x983b10]
pop edi
mov dword [edi], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x686a3f
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x10
mov edx, 0x983510
lea eax, [ebp - 0x100]
call fcn.006867f0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 0x10
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
and ecx, 0xff
xor eax, eax
lea ebx, [ebp - 0x100]
mov esi, eax
add esi, esi
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
lea esi, [edi + esi*4 + 0x800]
push esi
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x983510]
xor esi, ecx
movzx esi, byte [esi + 0x983610]
xor esi, edx
mov esi, dword [esi*4 + 0x983f10]
pop edi
mov dword [edi], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x686ab5
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x18
mov edx, 0x983510
lea eax, [ebp - 0x100]
call fcn.006867f0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x18]
shr edx, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
xor eax, eax
lea ebx, [ebp - 0x100]
mov esi, eax
add esi, esi
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
lea esi, [edi + esi*4 + 0x804]
push esi
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x983610]
xor esi, ecx
movzx esi, byte [esi + 0x983610]
xor esi, edx
mov esi, dword [esi*4 + 0x984310]
pop edi
mov dword [edi], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x686b22
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x691e90
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x691ecc
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404ef4
add esp, 0x108
pop ebx
ret

Function at 0x692618
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x6927be
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x10], 0
jne 0x6927a8
mov al, byte [ebp - 1]
mov byte [ebx + 0xc], al
mov al, byte [ebp + 0x10]
mov byte [ebx + 0xd], al
mov al, byte [ebp + 0xc]
mov byte [ebx + 0x18], al
mov dword [ebx + 0x14], edi
mov al, byte [ebp - 1]
sub al, 1
jb 0x69266f
je 0x69272f
jmp 0x692790
mov eax, esi
call fcn.0040bb50
test al, al
jne 0x69269f
push 0
lea edx, [ebp - 8]
mov eax, dword [0x98a7a8]
call fcn.004074d0
mov eax, dword [ebp - 8]
push eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
pop eax
call fcn.0066c4c4
mov ecx, edi
mov edx, esi
mov eax, dword [ebx]
call fcn.00692cb4
test al, al
jne 0x6926c6
push 0
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x6927d8
call fcn.0066c4c4
mov ecx, edi
mov edx, esi
mov eax, dword [ebx]
call fcn.00692e48
mov eax, esi
call fcn.0040513c
push eax
call sub.kernel32.dll_GetFileAttributesA
test eax, 1
seta al
mov byte [ebx + 0x19], al
cmp byte [ebx + 0x19], 0
jne 0x6926f6
cmp byte [ebx + 0x18], 0
je 0x6926fe
mov word [ebp - 4], 0
jmp 0x692704
mov word [ebp - 4], 2
cmp byte [ebp + 0x10], 0
je 0x692711
or word [ebp - 4], 0x10
jmp 0x692716
or word [ebp - 4], 0x40
mov ax, word [ebp - 4]
push eax
push edi
mov ecx, esi
mov dl, 1
mov eax, dword [0x6882ec]
call fcn.006912c0
mov dword [ebx + 0x10], eax
jmp 0x692790
mov eax, esi
call fcn.0068a070
test al, al
jne 0x692752
push 0
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x692808
call fcn.0066c4c4
mov eax, esi
call fcn.00689f1c
mov edi, eax
xor ecx, ecx
mov edx, edi
mov eax, dword [ebx]
call fcn.00692c24
test al, al
jne 0x692782
push 0
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
mov eax, 0x6927d8
xor ecx, ecx
call fcn.0066c4c4
xor ecx, ecx
mov edx, edi
mov eax, dword [ebx]
call fcn.00692d18
mov dword [ebx + 0x10], edi
lea eax, [ebx + 8]
mov edx, esi
call fcn.00404cd0
mov eax, ebx
call fcn.0069286c
mov eax, ebx
call fcn.00692904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6927c5
lea eax, [ebp - 8]
call fcn.00404c7c
ret

Function at 0x6a2cec
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x998768
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x6a2d0e
shr eax, 1
xor eax, 0xedb88320
jmp 0x6a2d10
shr eax, 1
dec edx
jne 0x6a2cfc
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x6a2cf5
mov byte [0x998b68], 1
pop esi
pop ebx
ret
Function at 0x6a2d2c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x998b68], 0
jne 0x6a2d43
call fcn.006a2cec
mov eax, edi
dec eax
test eax, eax
jl 0x6a2d6c
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x998768]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6a2d4d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6a55c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x6a55f9
dec al
je 0x6a563a
dec al
je 0x6a567e
dec al
je 0x6a56e9
jmp 0x6a5773
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6a5773
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6a5609
jmp 0x6a5773
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6a5773
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6a564a
jmp 0x6a5773
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6a5773
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x6a56ac
xor ebp, ebp
jmp 0x6a56bd
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x6a56c6
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6a568e
jmp 0x6a5773
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6a5773
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x6a5741
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.006a2d74
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6a56fd
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6a94d4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x84], 2
jne 0x6a9517
cmp dword [ebp - 0x90], 5
ja 0x6a951b
cmp dword [ebp - 0x90], 5
jne 0x6a9517
cmp dword [ebp - 0x8c], 1
jae 0x6a951b
xor eax, eax
jmp 0x6a951d
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x6acfcc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 1
je 0x6acff3
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x6ad17c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x6ad175
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x6ad042
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
test edi, edi
je 0x6ad038
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, ebx
call edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.user32.dll_GetWindowRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 4
je 0x6ad15a
mov edx, dword [ebp - 4]
test al, 8
je 0x6ad0be
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x6ad0a3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004575b4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x14
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x6ad0e0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004575b4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x318
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004575b4
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 0x10
je 0x6ad138
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x28], 0x1e
lea eax, [ebp - 0x34]
push eax
push 0x6acf08
push ebx
call sub.user32.dll_EnumChildWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x20
je 0x6ad15a
mov byte [ebp - 0x34], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x6acf08
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ad17c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6ad568
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x6ad61f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x190
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x6ad630
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x6ad609
mov dword [ebp - 0xc], 0x20
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x6ad648
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp esi, 2
je 0x6ad609
test esi, esi
jne 0x6ad5e0
cmp dword [ebp - 8], 1
je 0x6ad5e4
xor ebx, ebx
jmp 0x6ad609
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, 0x20
call fcn.00404ef4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x10]
call fcn.0040364c
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x6ad609
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ad626
lea eax, [ebp - 0x34]
call fcn.00404c7c
ret

Function at 0x6ae1f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x6ae2b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x989d9c]
cmp dword [eax], 5
jl 0x6ae225
mov eax, dword [0x98ab48]
cmp dword [eax], 2
je 0x6ae229
mov bl, 1
jmp 0x6ae29d
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x6ae2cc
push esi
push 0x6ae2f8
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405004
mov eax, dword [ebp - 0x14]
call fcn.0040513c
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x6ae29d
mov dword [ebp - 0x10], 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x6ae28b
cmp word [ebp - 0xc], 0
jne 0x6ae292
cmp eax, 0xea
jne 0x6ae294
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ae2ba
lea eax, [ebp - 0x14]
call fcn.00404c7c
ret
Function at 0x6ae370
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x6ae3f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0x1004
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x6ae3e0
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 0x10
call fcn.00404ef4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.00406430
mov ebx, eax
cmp dword [ebp - 4], 0
jne 0x6ae3dc
push ebx
call sub.kernel32.dll_IsValidCodePage
test eax, eax
jne 0x6ae3e2
xor ebx, ebx
jmp 0x6ae3e2
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ae3ff
lea eax, [ebp - 0x18]
call fcn.00404c7c
ret
Function at 0x6b5584
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov ebx, 0x99aff4
xor eax, eax
call fcn.006b5540
xor eax, eax
mov dword [ebp - 9], eax
xor eax, eax
mov dword [ebp - 5], eax
call fcn.006b5304
mov eax, ebx
xor ecx, ecx
mov edx, 0x4c
call fcn.0040357c
mov dword [ebx], esi
mov dword [ebx + 4], edi
cmp byte [ebp - 1], 0
je 0x6b55d1
cmp dword [0x99b048], 0
jne 0x6b55d5
xor eax, eax
jmp 0x6b55d7
mov al, 1
mov byte [ebx + 8], al
mov al, byte [ebp + 8]
mov byte [ebx + 0x3c], al
lea eax, [ebx + 0x34]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebx + 0x1c]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetClientRect
push 2
lea eax, [ebx + 0x1c]
push eax
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_MapWindowPoints
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetWindowRect
push 3
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetDCEx
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
mov dword [ebx + 0x2c], eax
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x20]
mov dword [ebx + 0x30], esi
push esi
mov eax, dword [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x10]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x10]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov esi, eax
mov dword [ebx + 0x14], esi
mov eax, dword [ebx + 0x18]
push eax
push esi
call sub.gdi32.dll_SelectObject
push 0x1e
mov eax, dword [ebx + 0x14]
push eax
push 0x317
mov eax, dword [ebx]
push eax
call sub.user32.dll_SendMessageA
cmp byte [ebx + 8], 0
je 0x6b56c7
push 0xffffffffffffffec
mov esi, dword [ebx]
push esi
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
mov dword [ebx + 0xc], 0x20
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x14], 0
mov al, byte [ebx + 0xc]
mov byte [ebp - 0x12], al
push 2
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 9]
push eax
mov eax, dword [ebx + 0x14]
push eax
lea eax, [ebx + 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebx]
push eax
call dword [0x99b048]
jmp 0x6b56f0
xor eax, eax
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
push 0
call sub.gdi32.dll_CreateRectRgn
mov esi, eax
push 0
push esi
mov eax, dword [ebx]
push eax
call sub.user32.dll_SetWindowRgn
test eax, eax
jne 0x6b56f0
push esi
call sub.gdi32.dll_DeleteObject
push 0x425f
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_SetWindowPos
push 0
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x6b5350
xor edx, edx
xor eax, eax
call fcn.00404c30
mov dword [0x99aff0], eax
cmp dword [0x99aff0], 0
jne 0x6b5732
call fcn.006b54b8
jmp 0x6b5743
inc dword [0x99b040]
mov eax, dword [0x99aff0]
push eax
call sub.kernel32.dll_ResumeThread
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4