joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e9c3
Capabilities:
Create directory

Disassembly:
mov eax, 0x6b40a9
call fcn.0066bd6c
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
push 8
pop ebx
cmp dword [esi + 0x14], ebx
jb 0x45e9e2
mov eax, dword [esi]
push 0x5c
push eax
call fcn.0066f61b
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x45ea0f
mov eax, esi
cmp dword [esi + 0x14], ebx
jb 0x45e9fb
mov eax, dword [esi]
push 0x2f
push eax
call fcn.0066f61b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45eb12
mov eax, esi
cmp dword [esi + 0x14], ebx
jb 0x45ea18
mov eax, dword [esi]
sub edi, eax
mov eax, esi
sar edi, 1
cmp dword [esi + 0x14], ebx
jb 0x45ea25
mov eax, dword [esi]
and dword [ebp - 0x40], 0
xor ecx, ecx
and dword [ebp - 0x30], 0
mov word [ebp - 0x40], cx
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x2c], 7
call fcn.00427613
xor ecx, ecx
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x28], ecx
push edi
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x40]
push ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.00437260
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0045e9c3
mov eax, dword [ebp - 0x14]
mov edi, 0x1000
cmp eax, ebx
jb 0x45eab4
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
cmp eax, edi
jb 0x45eaab
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042741e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.0066bb0a
pop ecx
pop ecx
and dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 7
cmp eax, ebx
jb 0x45eafc
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
cmp eax, edi
jb 0x45eaf3
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042741e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.0066bb0a
pop ecx
pop ecx
cmp byte [ebp + 0xc], 0
je 0x45eb12
cmp dword [esi + 0x14], ebx
jb 0x45eb09
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x45f3df
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x6b0c5b
call fcn.0066bd6c
sub esp, 0x280
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push str._s.
push eax
call fcn.004646d1
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x28], 8
jb 0x45f413
mov eax, dword [ebp - 0x3c]
push esi
lea ecx, [ebp - 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45f4ce
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0x6db758
push eax
call fcn.004646d1
add esp, 0x10
test byte [ebp - 0x28c], 0x10
mov byte [ebp - 4], 1
jne 0x45f469
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
jb 0x45f461
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046fa6b
jmp 0x45f4a5
push 0x6dfe68
lea eax, [ebp - 0x260]
push eax
call fcn.0043b6c6
test eax, eax
je 0x45f4a5
push 0x6dfe60
lea eax, [ebp - 0x260]
push eax
call fcn.0043b6c6
test eax, eax
je 0x45f4a5
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
jb 0x45f49f
mov eax, dword [ebp - 0x24]
push eax
call fcn.0045f3df
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.0042756c
lea eax, [ebp - 0x28c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45f42d
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
lea ecx, [ebp - 0x3c]
call fcn.0042756c
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x45f5d9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45f5f0
test al, 0x10
je 0x45f5f0
mov al, 1
jmp 0x45f5f2
xor al, al
ret 4
Function at 0x45f6c8
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x6b416f
call fcn.0066bd6c
sub esp, 0x29c
push ebx
push esi
push edi
push 7
pop ebx
xor edi, edi
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x28], edi
push 0x6dff9c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
call fcn.00427613
push 1
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push eax
sub esp, 0x18
mov eax, esp
push dword [ebp + 0xc]
push eax
call fcn.004288df
lea eax, [ebp - 0x58]
push eax
call fcn.0045e5a4
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x45f75b
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x45f752
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042741e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.0066bb0a
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x44], 8
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x14], ebx
jb 0x45f773
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45f82b
mov bl, byte [ebp + 0x10]
test bl, bl
jne 0x45f79d
cmp word [ebp - 0x27c], 0x2e
je 0x45f80e
xor eax, eax
mov dword [ebp - 0x40], edi
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x30], edi
push eax
mov dword [ebp - 0x2c], 7
call fcn.00427613
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 3
call fcn.0045f3b9
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x45f80e
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], ecx
cmp eax, 0x1000
jb 0x45f805
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0042741e
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.0066bb0a
pop ecx
pop ecx
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45f78f
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x58]
call fcn.0042756c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
Function at 0x45f852
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x6afb74
call fcn.0066bd6c
sub esp, 0x2a4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov ebx, esi
mov eax, edi
test edi, edi
jne 0x45f877
mov eax, 0x6dff9c
xor ecx, ecx
mov dword [ebp - 0x30], esi
mov word [ebp - 0x30], cx
lea ecx, [ebp - 0x30]
push eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 7
call fcn.00427613
push 1
lea eax, [ebp - 0x30]
mov dword [ebp - 4], esi
push eax
sub esp, 0x18
mov eax, esp
push dword [ebp + 0xc]
push eax
call fcn.004288df
lea eax, [ebp - 0x60]
push eax
call fcn.0045e5a4
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x45f8f2
mov ecx, dword [ebp - 0x30]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x45f8e9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0042741e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.0066bb0a
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x4c], 8
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x1c], 7
jb 0x45f90e
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x2b0]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
je 0x45f9d2
mov edi, eax
xor eax, eax
mov dword [ebp - 0x48], esi
mov word [ebp - 0x48], ax
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x284]
mov dword [ebp - 0x38], esi
push eax
mov dword [ebp - 0x34], 7
call fcn.00427613
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 3
call fcn.0045f3b9
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x45f99b
mov ecx, dword [ebp - 0x48]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x45f992
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042741e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.0066bb0a
pop ecx
pop ecx
lea eax, [ebp - 0x2b0]
inc ebx
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45f92a
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push edi
push ebx
push str.Found__d_entries_using_filter__s_in_directory__s
call fcn.00427598
add esp, 0x10
mov esi, ebx
lea ecx, [ebp - 0x60]
call fcn.0042756c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
Function at 0x45fca7
Capabilities:
Move file

Disassembly:
push 3
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
ret 8

Function at 0x45ff9f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], ebx
push eax
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x45ffe4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x460005
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
test ecx, ecx
je 0x45fff0
mov dword [ecx], eax
cmp eax, esi
je 0x460003
sub esi, eax
add eax, edi
push esi
push ebx
push eax
call fcn.0066f070
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x46093f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 2
pop ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, ebx
cmp ax, si
jne 0x460951
sub edi, ecx
sar edi, 1
lea eax, [edi + 1]
test eax, eax
js 0x460976
lea eax, [edi*2 + 2]
call fcn.0066c3f0
mov esi, esp
jmp 0x460987
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [0x7c5370], eax
mov dword [0], esi
lea eax, [edi*2 + 2]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
push esi
call fcn.0066d9b0
add esp, 0xc
push 0x5c
pop ecx
cmp word [esi], cx
jne 0x4609c2
cmp word [esi + 2], cx
jne 0x4609c2
movzx eax, word [esi + 4]
mov edx, eax
cmp eax, 0x3f
jne 0x460a24
push ecx
pop eax
cmp word [esi + 6], ax
jne 0x460a24
add esi, 8
cmp edi, 3
jl 0x4609d1
cmp word [esi + 2], 0x3a
jne 0x4609d1
add esi, 6
push ecx
push esi
call fcn.0047cda5
mov esi, eax
test esi, esi
je 0x460a18
mov edi, dword [ebp - 4]
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x4609fc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x460a43
push 0x5c
pop eax
mov word [esi - 2], ax
cmp word [esi], bx
je 0x460a18
push eax
lea eax, [esi + 2]
push eax
call fcn.0047cda5
mov esi, eax
test esi, esi
jne 0x4609e3
mov al, 1
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4
push 0x5c
add esi, 4
mov eax, edx
pop ecx
add esi, 2
cmp ax, cx
jne 0x460a39
sub ebx, 1
je 0x4609d1
test ax, ax
je 0x460a43
movzx eax, word [esi]
jmp 0x460a2c
xor al, al
jmp 0x460a1a
Function at 0x461b04
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push ebx
push esi
push edi
mov ebx, 0x104
or esi, 0xffffffff
push ebx
push eax
push dword [ebp + 8]
mov edi, SysReAllocString
call fcn.004715ac
test al, al
je 0x461bac
push ebx
xor ebx, ebx
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
je 0x461bac
push str.FATE
lea eax, [ebp - 0x208]
push eax
call fcn.0047e9fc
test al, al
jne 0x461bac
push str.FAT32
lea eax, [ebp - 0x208]
push eax
call fcn.0047e9fc
test al, al
jne 0x461baa
push 0x6e079c
lea eax, [ebp - 0x208]
push eax
call fcn.0047e9fc
test al, al
jne 0x461ba5
push str.FAT16
lea eax, [ebp - 0x208]
push eax
call fcn.0047e9fc
test al, al
je 0x461bac
mov esi, 0x7ffa8000
mov edi, ebx
push dword [ebp + 8]
push edi
push esi
push str.GetMaxFileSize___returning__Ld_for___s_
call fcn.00427598
add esp, 0x10
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x461f92
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
lea eax, [ebp - 0x438]
push ebx
push esi
push 0x21c
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov esi, eax
call fcn.004768de
xor ebx, ebx
test al, al
je 0x461ffc
mov ecx, str.Sysnative..explorer.exe
lea eax, [esi + esi]
sub eax, ecx
lea edx, [ebp - 0x438]
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x461fce
push 1
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
jg 0x46203a
mov ecx, 0x6e08ec
lea eax, [esi + esi]
sub eax, ecx
lea edx, [ebp - 0x438]
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x46200e
push 1
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
pop esi
mov al, cl
pop ebx
leave
ret 4
Function at 0x4623d9
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
push str.ReplaceFileW
xor ebx, ebx
push 0x6d6fdc
mov esi, ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x462498
push dword [0x7c1a90]
call fcn.0067fb1b
call fcn.0067fafa
push eax
push dword [ebp + 0xc]
mov esi, 0x104
lea eax, [ebp - 0x208]
push str._s._u.tmp
push esi
push eax
call fcn.00463afb
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push str._s.new
push esi
push eax
call fcn.00463afb
add esp, 0x28
lea eax, [ebp - 0x410]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push ebx
push ebx
push 2
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 0xc]
call edi
mov esi, eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x462498
push 4
push ebx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
pop edi
test esi, esi
pop esi
setne al
pop ebx
leave
ret 8

Function at 0x462756
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push dword [esp + 0x220]
xor ebx, ebx
mov esi, ebx
call fcn.00458d4c
movzx ebp, al
test al, al
mov eax, 0x6d7170
je 0x462780
mov eax, str..new
push eax
push dword [esp + 0x224]
lea eax, [esp + 0x1c]
push 0x6d7e8c
push 0x104
push eax
call fcn.00463afb
add esp, 0x14
lea eax, [esp + 0x14]
push 0x80
push 7
push eax
call fcn.0045fd28
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x4627bd
xor al, al
jmp 0x46282d
push dword [esp + 0x228]
push dword [esp + 0x228]
push eax
call fcn.0046024d
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
call fcn.0045fcba
test ebp, ebp
je 0x46281b
push dword [esp + 0x220]
lea eax, [esp + 0x18]
push eax
call fcn.004623d9
movzx esi, al
test al, al
jne 0x46281b
push ebx
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x228]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov esi, eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [esp + 0x10], ebx
jne 0x46282b
test esi, esi
jne 0x462829
test ebp, ebp
jne 0x46282b
mov bl, 1
mov al, bl
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc

Function at 0x462911
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x462921
xor al, al
jmp 0x46297d
mov eax, dword [esp + 8]
push ebx
push esi
push edi
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push dword [esp + 0x14]
xor ecx, ecx
push eax
mov word [esi + eax], cx
call fcn.0066d9b0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov al, bl
pop ebx
ret 8
Function at 0x462e16
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
test eax, eax
jne 0x462e6a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_get_computer_name____d__d
call fcn.0047d375
mov esi, dword [ebp + 8]
add esp, 0xc
and dword [esi], 0
and dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x6e0928
jmp 0x462e84
mov esi, dword [ebp + 8]
and dword [esi], 0
and dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00427613
mov eax, esi
pop esi
leave
ret 4

Function at 0x463420
Capabilities:
Check http status code

Disassembly:
mov eax, 0x6b43e4
call fcn.0066bd6c
sub esp, 0x44
push ebx
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov esi, ecx
push eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push 0x20000013
push dword [esi]
mov dword [ebp - 0x18], ebx
call dword [0x7bfbf8]
test eax, eax
je 0x463497
cmp dword [ebp - 0x14], 0xc8
je 0x463497
push dword [ebp - 0x14]
lea eax, [ebp - 0x50]
push str.HTTP_Reply__d
push eax
call fcn.004646d1
add esp, 0xc
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x463482
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.004633ed
lea ecx, [ebp - 0x50]
call fcn.0042756c
jmp 0x463553
push edi
xor eax, eax
mov dword [ebp - 0x10], 0x14
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x1d
push dword [esi]
call dword [0x7bfbf8]
test eax, eax
je 0x4634db
lea eax, [ebp - 0x38]
push str.gzip
push eax
call fcn.0067fb68
pop ecx
pop ecx
test eax, eax
jne 0x4634db
or byte [esi + 0x25], 1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x20
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
push eax
lea eax, [esi + 5]
push eax
push 1
push dword [esi]
call dword [0x7bfbf8]
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push eax
lea eax, [ebp - 0x24]
push eax
push 0x20000005
push dword [esi]
call dword [0x7bfbf8]
test eax, eax
je 0x463525
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], ebx
push 0xa
pop ecx
xor eax, eax
lea edi, [esi + 0x2c]
rep stosd dword es:[edi], eax
mov edi, 0x2000
mov dword [esi + 0x2c], 0x28
push edi
call fcn.0045e2af
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edi
mov byte [esi + 4], 1
call fcn.004635ad
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x466a0a
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
sub esp, 0x70
mov eax, 0x6b4736
call fcn.0066bd6c
sub esp, 0x1a8
push ebx
lea ecx, [ebp - 0x70]
call fcn.004cf03a
xor ebx, ebx
lea ecx, [ebp - 0x108]
push 1
mov dword [ebp - 4], ebx
call fcn.00448ceb
lea eax, [ebp + 0x68]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00494f97
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.0043b6a9
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp + 0x30]
push eax
call fcn.0043b6a9
push 0x55
lea eax, [ebp - 0x1b4]
mov byte [ebp - 4], 3
push eax
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLocaleName]
cmp eax, 1
lea eax, [ebp - 0x1b4]
jg 0x466a8f
mov eax, 0x6e0928
push esi
xor ecx, ecx
mov dword [ebp + 0x48], ebx
push edi
mov word [ebp + 0x48], cx
lea ecx, [ebp + 0x48]
push eax
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x5c], 7
call fcn.00427613
push str.Mozilla_5.0__
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 4
push eax
call fcn.004276cc
push 0x6e11e4
lea eax, [ebp + 0x48]
mov edi, 0x6e11e8
push eax
push edi
call fcn.00494e4f
push eax
push 0x2e
push dword [ebp + 0x68]
mov esi, 0x6df1c8
push 0x2e
push dword [ebp + 0x64]
push 0x2e
push dword [ebp + 0x60]
push esi
call fcn.00494ea6
push eax
push edi
lea eax, [ebp + 0x30]
push eax
push esi
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0046559f
push eax
call fcn.004276cc
push eax
call fcn.0046559f
push eax
call fcn.004276cc
push eax
call fcn.004278f2
push eax
call fcn.004276cc
mov ecx, eax
call fcn.004662f2
push eax
call fcn.004653d1
mov ecx, eax
call fcn.004662f2
push eax
call fcn.004653d1
mov ecx, eax
call fcn.004662f2
push eax
call fcn.004653d1
mov ecx, eax
call fcn.004662f2
push eax
call fcn.004276cc
push eax
call fcn.0046559f
push eax
call fcn.004276cc
lea eax, [ebp]
push eax
call fcn.00466c35
push eax
push 0x75c64c
mov byte [ebp - 4], 5
lea eax, [ebp - 0x108]
push str.iexplore
push eax
call fcn.004278f2
push eax
call fcn.004276cc
push eax
call fcn.0046559f
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.0042756c
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x104]
call fcn.00454a7d
mov eax, dword [ebp + 0x5c]
pop edi
pop esi
cmp eax, 8
jb 0x466bed
mov ecx, dword [ebp + 0x48]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x70], eax
mov dword [ebp + 0x6c], ecx
cmp eax, 0x1000
jb 0x466be4
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.0042741e
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x6c]
push eax
push ecx
call fcn.0066bb0a
pop ecx
pop ecx
xor eax, eax
mov dword [ebp + 0x58], ebx
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x5c], 7
mov word [ebp + 0x48], ax
call fcn.0042756c
lea ecx, [ebp + 0x18]
call fcn.0042756c
lea ecx, [ebp - 0x108]
call fcn.004497b3
lea ecx, [ebp - 0x70]
call fcn.004cf225
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x7c]
pop ebx
mov dword fs:[0], ecx
add ebp, 0x74
leave
ret 4