joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d07d60a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d0fb630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x6d07d64a
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x6d07d7b9
cmp dword [ebp - 0x10], ebx
jne 0x6d07d7b9
cmp dword [ebp - 0x14], ebx
jne 0x6d07d7b9
push esi
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push edi
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
push 0x4a
cmp dword [0x6d0faa8c], ebx
je 0x6d07d6c5
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersion]
call edi
cmp al, 5
jb 0x6d07d682
call edi
shr eax, 8
cmp al, 1
jae 0x6d07d688
call edi
cmp al, 5
jbe 0x6d07d6a2
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x200a
call esi
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x200c
call esi
mov eax, dword [ebp - 0x20]
mov dword [0x6d0fdd74], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x6d0faa88], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6d0faa84], eax
mov dword [0x6d0faa8c], ebx
jmp 0x6d07d7b7
call esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, dword [0x6d0fdd74]
setne cl
mov dword [ebp - 0x18], ecx
cmp ecx, ebx
jne 0x6d07d6e4
cmp eax, ebx
je 0x6d07d7b7
mov edi, dword [sym.imp.KERNEL32.dll_GetVersion]
call edi
cmp al, 5
jb 0x6d07d6f9
call edi
shr eax, 8
cmp al, 1
jae 0x6d07d6ff
call edi
cmp al, 5
jbe 0x6d07d764
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x200a
call esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, dword [0x6d0faa88]
setne cl
or dword [ebp - 0x18], ecx
jne 0x6d07d728
cmp eax, 1
je 0x6d07d7b7
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x200c
call esi
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp ecx, dword [0x6d0faa84]
setne al
or dword [ebp - 0x18], eax
cmp dword [ebp - 0x1c], 2
jne 0x6d07d774
call fcn.6d07d5a1
xor ecx, ecx
cmp eax, dword [0x6d0faa80]
mov dword [ebp - 0x28], eax
setne cl
or dword [ebp - 0x18], ecx
jmp 0x6d07d774
cmp dword [ebp - 0x18], ebx
je 0x6d07d7b7
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jne 0x6d07d774
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x18], ebx
je 0x6d07d7b7
mov eax, dword [ebp - 0x20]
mov dword [0x6d0fdd74], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x6d0faa88], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6d0faa84], eax
mov eax, dword [ebp - 0x28]
mov dword [0x6d0faa80], eax
mov eax, dword [0x6d0fe630]
cmp eax, ebx
je 0x6d07d7b7
push dword [0x6d0fe498]
push eax
call fcn.6d0a45b0
push eax
call fcn.6d0598c8
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.6d0b3eb2
leave
ret
Function at 0x6d07e212
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1fc
mov eax, dword [0x6d0fb630]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
sbb eax, eax
push 0
and eax, 0xfffffffc
lea ecx, [ebp - 0x184]
add eax, 0x1f8
push ecx
push eax
push 0x29
mov dword [ebp - 0x184], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea eax, [ebp - 0x16c]
push eax
push str.win.frame.captionFont
mov ecx, esi
call fcn.6d07dc8f
push dword [ebp - 0x170]
mov ecx, esi
push str.win.frame.captionHeight
call fcn.6d07d8bc
push dword [ebp - 0x174]
mov ecx, esi
push str.win.frame.captionButtonWidth
call fcn.6d07d8bc
push dword [ebp - 0x170]
mov ecx, esi
push str.win.frame.captionButtonHeight
call fcn.6d07d8bc
lea eax, [ebp - 0x108]
push eax
push str.win.frame.smallCaptionFont
mov ecx, esi
call fcn.6d07dc8f
push dword [ebp - 0x10c]
mov ecx, esi
push str.win.frame.smallCaptionHeight
call fcn.6d07d8bc
push dword [ebp - 0x110]
mov ecx, esi
push str.win.frame.smallCaptionButtonWidth
call fcn.6d07d8bc
push dword [ebp - 0x10c]
mov ecx, esi
push str.win.frame.smallCaptionButtonHeight
call fcn.6d07d8bc
push dword [ebp - 0x180]
mov ecx, esi
push str.win.frame.sizingBorderWidth
call fcn.6d07d8bc
lea eax, [ebp - 0xa4]
push eax
push str.win.menu.font
mov ecx, esi
call fcn.6d07dc8f
push dword [ebp - 0xa8]
mov ecx, esi
push str.win.menu.height
call fcn.6d07d8bc
push dword [ebp - 0xac]
mov ecx, esi
push str.win.menu.buttonWidth
call fcn.6d07d8bc
push dword [ebp - 0x17c]
mov ecx, esi
push str.win.scrollbar.width
call fcn.6d07d8bc
push dword [ebp - 0x178]
mov ecx, esi
push str.win.scrollbar.height
call fcn.6d07d8bc
lea eax, [ebp - 0x48]
push eax
push str.win.status.font
mov ecx, esi
call fcn.6d07dc8f
lea eax, [ebp - 0x48]
push eax
push str.win.tooltip.font
mov ecx, esi
call fcn.6d07dc8f
lea eax, [ebp + 0x14]
push eax
push str.win.messagebox.font
mov ecx, esi
call fcn.6d07dc8f
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.6d0b3eb2
add ebp, 0x78
leave
ret
Function at 0x6d07e40b
Capabilities:
Check os version

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push edi
push 0x1b
mov edi, ecx
call esi
push eax
push str.win.frame.activeCaptionGradientColor
mov ecx, edi
call fcn.6d07d9d8
push 0x1c
call esi
push eax
push str.win.frame.inactiveCaptionGradientColor
mov ecx, edi
call fcn.6d07d9d8
push 0x1a
call esi
push eax
push str.win.item.hotTrackedColor
mov ecx, edi
call fcn.6d07d9d8
push 0x15
call esi
push eax
push str.win.3d.darkShadowColor
mov ecx, edi
call fcn.6d07d9d8
push 0xf
call esi
push eax
push str.win.3d.backgroundColor
mov ecx, edi
call fcn.6d07d9d8
push 0x14
call esi
push eax
push str.win.3d.highlightColor
mov ecx, edi
call fcn.6d07d9d8
push 0x16
call esi
push eax
push str.win.3d.lightColor
mov ecx, edi
call fcn.6d07d9d8
push 0x10
call esi
push eax
push str.win.3d.shadowColor
mov ecx, edi
call fcn.6d07d9d8
push 0x12
call esi
push eax
push str.win.button.textColor
mov ecx, edi
call fcn.6d07d9d8
push 1
call esi
push eax
push str.win.desktop.backgroundColor
mov ecx, edi
call fcn.6d07d9d8
push 2
call esi
push eax
push str.win.frame.activeCaptionColor
mov ecx, edi
call fcn.6d07d9d8
push 0xa
call esi
push eax
push str.win.frame.activeBorderColor
mov ecx, edi
call fcn.6d07d9d8
push 6
call esi
push eax
push str.win.frame.color
mov ecx, edi
call fcn.6d07d9d8
push 5
call esi
push eax
push str.win.frame.backgroundColor
mov ecx, edi
call fcn.6d07d9d8
push 9
call esi
push eax
push str.win.frame.captionTextColor
mov ecx, edi
call fcn.6d07d9d8
push 0xb
call esi
push eax
push str.win.frame.inactiveBorderColor
mov ecx, edi
call fcn.6d07d9d8
push 3
call esi
push eax
push str.win.frame.inactiveCaptionColor
mov ecx, edi
call fcn.6d07d9d8
push 0x13
call esi
push eax
push str.win.frame.inactiveCaptionTextColor
mov ecx, edi
call fcn.6d07d9d8
push 8
call esi
push eax
push str.win.frame.textColor
mov ecx, edi
call fcn.6d07d9d8
push 0xd
call esi
push eax
push str.win.item.highlightColor
mov ecx, edi
call fcn.6d07d9d8
push 0xe
call esi
push eax
push str.win.item.highlightTextColor
mov ecx, edi
call fcn.6d07d9d8
push 0xc
call esi
push eax
push str.win.mdi.backgroundColor
mov ecx, edi
call fcn.6d07d9d8
push 4
call esi
push eax
push str.win.menu.backgroundColor
mov ecx, edi
call fcn.6d07d9d8
push 7
call esi
push eax
push str.win.menu.textColor
mov ecx, edi
call fcn.6d07d9d8
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
call ebx
cmp al, 5
jb 0x6d07e5c3
call ebx
shr eax, 8
cmp al, 1
jae 0x6d07e5cd
call ebx
cmp al, 5
ja 0x6d07e5cd
push 4
jmp 0x6d07e5cf
push 0x1e
pop eax
push eax
call esi
push eax
push str.win.menubar.backgroundColor
mov ecx, edi
call fcn.6d07d9d8
push 0
call esi
push eax
push str.win.scrollbar.backgroundColor
mov ecx, edi
call fcn.6d07d9d8
push 0x11
call esi
push eax
push str.win.text.grayedTextColor
mov ecx, edi
call fcn.6d07d9d8
push 0x18
call esi
push eax
push str.win.tooltip.backgroundColor
mov ecx, edi
call fcn.6d07d9d8
push 0x17
call esi
push eax
push str.win.tooltip.textColor
mov ecx, edi
call fcn.6d07d9d8
pop edi
pop esi
pop ebx
ret
Function at 0x6d0875cc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
add eax, dword [ebp + 8]
push 0
push 0
push eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
pop ebp
ret 0xc

Function at 0x6d0877d7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x6d0fb630]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x74], eax
cmp dword [0x6d0fad60], ebx
je 0x6d087958
call fcn.6d08774a
cmp eax, ebx
jne 0x6d087821
mov dword [0x6d0fad60], ebx
jmp 0x6d087958
lea ecx, [ebp - 0x7c]
push ecx
push 0xf003f
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d087816
push edi
push dword [esi + 4]
mov edi, dword [sym.imp.MSVCR100.dll_wcscpy]
lea eax, [ebp - 0x70]
push eax
call edi
lea eax, [ebp - 0x70]
push 0x2c
push eax
call dword [sym.imp.MSVCR100.dll_wcschr]
add esp, 0x10
cmp eax, ebx
je 0x6d087863
xor ecx, ecx
mov word [eax], cx
mov esi, 0x104
push esi
lea eax, [ebp + 0x30]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
push ebx
push 0x50
lea eax, [ebp + 0x134]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
mov dword [ebp - 0x78], esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp + 0x134]
push eax
push dword [ebp - 0x7c]
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x6d087910
cmp dword [0x6d0fad64], ebx
je 0x6d087957
mov esi, 0x6d0fdfd0
push esi
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
test eax, eax
je 0x6d0878da
push esi
push dword [ebp - 0x74]
call edi
jmp 0x6d087955
push 5
pop ecx
mov esi, 0x6d0d397c
lea edi, [ebp + 0x184]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp + 0x184]
movsw word es:[edi], word [esi]
push eax
push dword [ebp - 0x7c]
xor esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d087924
lea eax, [ebp + 0x30]
push str.userfont.fon
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x6d08792c
mov dword [0x6d0fad64], ebx
jmp 0x6d087957
push dword [ebp + 0x1ac]
lea eax, [ebp + 0x30]
push dword [ebp - 0x74]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, ebx
je 0x6d087957
push dword [ebp - 0x74]
push 0x6d0fdfd0
call dword [sym.imp.MSVCR100.dll_wcscpy]
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp + 0x19c]
pop esi
xor ecx, ebp
pop ebx
call fcn.6d0b3eb2
add ebp, 0x1a0
leave
ret 8
Function at 0x6d0877fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x6d0fb630]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x74], eax
cmp dword [0x6d0fad60], ebx
je 0x6d087958
call fcn.6d08774a
cmp eax, ebx
jne 0x6d087821
mov dword [0x6d0fad60], ebx
jmp 0x6d087958
lea ecx, [ebp - 0x7c]
push ecx
push 0xf003f
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d087816
push edi
push dword [esi + 4]
mov edi, dword [sym.imp.MSVCR100.dll_wcscpy]
lea eax, [ebp - 0x70]
push eax
call edi
lea eax, [ebp - 0x70]
push 0x2c
push eax
call dword [sym.imp.MSVCR100.dll_wcschr]
add esp, 0x10
cmp eax, ebx
je 0x6d087863
xor ecx, ecx
mov word [eax], cx
mov esi, 0x104
push esi
lea eax, [ebp + 0x30]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
push ebx
push 0x50
lea eax, [ebp + 0x134]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
mov dword [ebp - 0x78], esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp + 0x134]
push eax
push dword [ebp - 0x7c]
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x6d087910
cmp dword [0x6d0fad64], ebx
je 0x6d087957
mov esi, 0x6d0fdfd0
push esi
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
test eax, eax
je 0x6d0878da
push esi
push dword [ebp - 0x74]
call edi
jmp 0x6d087955
push 5
pop ecx
mov esi, 0x6d0d397c
lea edi, [ebp + 0x184]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp + 0x184]
movsw word es:[edi], word [esi]
push eax
push dword [ebp - 0x7c]
xor esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d087924
lea eax, [ebp + 0x30]
push str.userfont.fon
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x6d08792c
mov dword [0x6d0fad64], ebx
jmp 0x6d087957
push dword [ebp + 0x1ac]
lea eax, [ebp + 0x30]
push dword [ebp - 0x74]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, ebx
je 0x6d087957
push dword [ebp - 0x74]
push 0x6d0fdfd0
call dword [sym.imp.MSVCR100.dll_wcscpy]
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp + 0x19c]
pop esi
xor ecx, ebp
pop ebx
call fcn.6d0b3eb2
add ebp, 0x1a0
leave
ret 8
Function at 0x6d087f3a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d0fb630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, ecx
call fcn.6d0874c1
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
je 0x6d088000
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [ebp - 0x28]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push eax
call edi
movzx ecx, byte [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov edx, 0x100
imul cx, dx
shr eax, 8
movzx eax, al
add ax, cx
xor ecx, ecx
mov word [ebp - 0xc], ax
mov dword [ebp - 0x24], ebx
cmp cx, ax
jae 0x6d087fdd
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x10
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x18]
call edi
cmp dword [ebp - 0x20], 0x70616d63
je 0x6d087fdd
movzx eax, word [ebp - 0xc]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jl 0x6d087fb8
lea eax, [ebp - 0x18]
push eax
call fcn.6d08754e
mov eax, dword [ebp - 0x18]
pop ecx
mov ecx, esi
mov dword [esi + 0x1c], eax
call fcn.6d087be8
push dword [esi + 0x18]
mov dword [esi + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 0x18], ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.6d0b3eb2
leave
ret 4

Function at 0x6d08b318
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, 0x2328
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6d08b38f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.GDIProcessHandleQuota
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6d08b386
mov eax, dword [ebp - 0xc]
fild dword [ebp - 0xc]
test eax, eax
jns 0x6d08b379
fadd qword [0x6d0ca690]
fmul qword [0x6d0d3ea0]
call fcn.6d0b3ed0
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret
Function at 0x6d08c1a0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_getenv]
push str.IMLIB_DEBUG
call esi
add esp, 4
mov ebx, 1
test eax, eax
je 0x6d08c1e2
call sym.awt.dll_awt_setMlibStartTimer
mov dword [0x6d0fe280], eax
call sym.awt.dll_awt_setMlibStartTimer
cmp dword [0x6d0fe280], 0
mov dword [0x6d0fe284], eax
je 0x6d08c1e2
test eax, eax
je 0x6d08c1e2
mov dword [0x6d0fe270], ebx
push str.IMLIB_PRINT
call esi
add esp, 4
test eax, eax
je 0x6d08c1f6
mov dword [0x6d0fe274], ebx
push str.IMLIB_START
call esi
add esp, 4
test eax, eax
je 0x6d08c218
push 0x6d0fe278
push 0x6d0ce054
push eax
call dword [sym.imp.MSVCR100.dll_sscanf]
add esp, 0xc
push str.IMLIB_NOMLIB
call esi
add esp, 4
test eax, eax
je 0x6d08c233
pop esi
mov dword [0x6d0fe27c], ebx
xor al, al
pop ebx
ret 8
mov eax, dword [esp + 0xc]
push 0x6d0fe264
push 0x6d0fae24
push eax
call sym.awt.dll_awt_getImagingLib
add esp, 0xc
test eax, eax
jne 0x6d08c226
pop esi
mov al, bl
pop ebx
ret 8

Function at 0x6d08f1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, ecx
xor ecx, ecx
push esi
mov esi, eax
mov eax, dword [esp + 0x18]
push edi
mov dword [esp + 0x10], ecx
cmp ebp, ecx
jge 0x6d08f1ef
xor ebp, ebp
jmp 0x6d08f1fc
cmp ebp, 0xff
jle 0x6d08f200
mov ebp, 0xff
mov dword [esp + 0x18], ebp
cmp ebx, ecx
jge 0x6d08f208
xor ebx, ebx
jmp 0x6d08f215
cmp ebx, 0xff
jle 0x6d08f215
mov ebx, 0xff
cmp eax, ecx
jge 0x6d08f21d
xor eax, eax
jmp 0x6d08f229
cmp eax, 0xff
jle 0x6d08f22d
mov eax, 0xff
mov dword [esp + 0x1c], eax
cmp ebp, ebx
jne 0x6d08f28e
cmp ebx, eax
jne 0x6d08f28e
mov ebx, dword [esp + 0x20]
mov edi, 0x100
cmp ebx, ecx
jle 0x6d08f2e4
add esi, 2
lea esp, [esp]
mov al, byte [esi - 1]
mov dl, byte [esi]
cmp al, dl
jne 0x6d08f274
cmp dl, byte [esi + 1]
jne 0x6d08f274
movzx eax, al
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
je 0x6d08f286
cmp eax, edi
jge 0x6d08f274
mov dword [esp + 0x10], ecx
mov edi, eax
inc ecx
add esi, 4
cmp ecx, ebx
jl 0x6d08f250
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
pop ecx
ret
xor eax, eax
mov edi, 0x1000000
cmp dword [esp + 0x20], ecx
jle 0x6d08f2e4
add esi, 2
mov edi, edi
movzx ecx, byte [esi - 1]
sub ecx, ebp
imul ecx, ecx
cmp ecx, edi
jge 0x6d08f2da
movzx edx, byte [esi]
sub edx, ebx
imul edx, edx
add ecx, edx
cmp ecx, edi
jge 0x6d08f2d6
movzx edx, byte [esi + 1]
sub edx, dword [esp + 0x1c]
imul edx, edx
add ecx, edx
cmp ecx, edi
jge 0x6d08f2d6
test ecx, ecx
je 0x6d08f2e8
mov dword [esp + 0x10], eax
mov edi, ecx
mov ebp, dword [esp + 0x18]
inc eax
add esi, 4
cmp eax, dword [esp + 0x20]
jl 0x6d08f2a0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6d092c3f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6d0fb630]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x18]
push eax
push 0x20019
xor edi, edi
push edi
push 0x6d0d4200
push SysReAllocString
mov dword [ebp - 0x1c], 0x10
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6d092cb1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push 0x6d0d41fc
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6d092ca8
push 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR100.dll_wcstoul]
add esp, 0xc
mov edi, eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.6d0b3eb2
leave
ret
Function at 0x6d092d29
Capabilities:
Get keyboard layout

Disassembly:
push 0x14
mov eax, 0x6d0b6ce1
call fcn.6d0b4001
and dword [ebp - 4], 0
call fcn.6d0af51c
call fcn.6d0a44f0
mov edi, dword [ebp + 8]
mov eax, dword [edi]
lea ecx, [ebp - 0x13]
push ecx
push dword [ebp + 0x10]
push edi
call dword [eax + 0x2a4]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x6d092df7
movzx eax, word [0x6d0fdb18]
push eax
call sub.java.dll_getJavaIDFromLangID
mov esi, eax
pop ecx
test esi, esi
je 0x6d092da5
push ebx
push esi
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x6d092d9d
mov eax, dword [edi]
push ebx
push dword [ebp + 0x10]
push edi
call dword [eax + 0x2a8]
push esi
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
mov al, 1
jmp 0x6d092df9
push esi
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
mov ebx, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
call ebx
mov edi, eax
inc edi
js 0x6d092ea8
cmp edi, 0xffffffff
ja 0x6d092ea8
test edi, edi
je 0x6d092dd3
cmp edi, 0x3fffffff
ja 0x6d092ea8
mov eax, edi
shl eax, 2
push eax
call fcn.6d0af480
mov esi, eax
pop ecx
test esi, esi
jne 0x6d092e01
push dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2a8]
xor al, al
call fcn.6d0b40a6
ret 0x10
lea eax, [esi + 4]
push eax
lea eax, [edi - 1]
push eax
call ebx
call fcn.6d092c3f
and dword [ebp - 0x18], 0
mov dword [esi], eax
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 0x18]
cmp eax, edi
jge 0x6d092e74
lea ebx, [esi + eax*4]
movzx eax, word [ebx]
push eax
call sub.java.dll_getJavaIDFromLangID
pop ecx
mov dword [ebp - 0x20], eax
test eax, eax
je 0x6d092ea0
push dword [ebp - 0x1c]
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x6d092e96
push dword [ebx]
movzx eax, byte [ebp + 0x14]
push eax
push 0x9823
mov ecx, 0x6d0fe4b8
call fcn.6d019ce0
test eax, eax
je 0x6d092e6a
push dword [ebx]
call fcn.6d0a3d60
pop ecx
mov byte [ebp - 0x11], 1
push dword [ebp - 0x20]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
push dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2a8]
push esi
call dword [sym.imp.MSVCR100.dll_free]
mov al, byte [ebp - 0x11]
pop ecx
jmp 0x6d092df9
push dword [ebp - 0x20]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
inc dword [ebp - 0x18]
jmp 0x6d092e1a
xor eax, eax
lea edi, [ebp + 0x17]
stosb byte es:[edi], al
mov al, byte [ebp + 0x17]
mov byte [ebp - 0x12], al
push 0x6d0d93c8
lea eax, [ebp - 0x12]
push eax
call sub.MSVCR100.dll__CxxThrowException
call fcn.6d0af53b
mov eax, 0x6d092ecd
ret