joyce8/EMBER2024-capa huggingface dataset:
Function at 0x268756c8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, 0x268ed415
call fcn.268eb4dc
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push str.Rich_Text_Format
mov edi, ecx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x2687571a
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x13966
push edi
mov ebx, 0x268f3f58
call fcn.268c708f
mov eax, dword [ebp + 8]
and dword [eax], 0
pop ecx
pop ecx
jmp 0x268757a1
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x26875751
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
mov ecx, eax
mov eax, esi
push ebx
mov esi, ecx
call fcn.268e72f2
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
push 2
mov ecx, eax
pop eax
call fcn.268e6b73
jmp 0x2687579c
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
cmp esi, ebx
je 0x26875796
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x268757aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
mov ecx, eax
mov eax, esi
push ebx
mov esi, ecx
call fcn.268e72f2
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
push 2
mov ecx, eax
pop eax
call fcn.268e6b73
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov dword [ebp - 0x10], 1
jmp 0x26875809
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [ebp - 0x18]
mov edx, eax
push edx
call fcn.268756b2
cmp edx, eax
pop ecx
jle 0x268757c3
mov edx, eax
mov dword [ebp - 0x14], ebx
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push edx
push dword [ebp - 0x18]
lea edi, [ebp - 0x14]
call fcn.26873a64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [ebp + 8]
mov ecx, edi
call fcn.2686bcfc
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x26875806
call fcn.268e5db4
and dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x2687581a
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, 0x268ed415
call fcn.268eb4dc
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push 0xd
mov edi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
cmp eax, esi
jne 0x26875847
mov dword [ebx], esi
jmp 0x268758ce
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x26875880
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
mov ecx, eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
call fcn.268e72f2
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
push 2
mov ecx, eax
pop eax
call fcn.268e6b73
jmp 0x268758cb
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x268758d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
mov ecx, eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
call fcn.268e72f2
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
push 2
mov ecx, eax
pop eax
call fcn.268e6b73
call dword [sym.imp.USER32.dll_CloseClipboard]
and dword [ebx], 0
mov dword [ebp - 0x10], 1
jmp 0x26875927
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
push dword [ebp + 8]
lea edi, [ebp - 0x14]
call fcn.268633af
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, edi
mov esi, ebx
call fcn.2686bcfc
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x26875927
call fcn.268e5db4
and dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x26875a12
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push edi
push dword [ebp + 0x10]
push 2
call ebx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x26875ac4
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x26875ac4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x26875ac4
push dword [ebp - 4]
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test esi, esi
je 0x26875ac4
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x26875af4
push dword [ebp + 0x1c]
push 2
call ebx
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x26875ac4
mov ecx, dword [ebp + 0x1c]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
push dword [ebp + 0x20]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_SetClipboardData]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test esi, esi
jne 0x26875af4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp + 8]
mov ebx, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
mov esi, eax
push 0
mov eax, ebx
call fcn.268e72f2
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
push 2
mov ecx, eax
pop eax
call fcn.268e6b73
xor esi, esi
jmp 0x26875af7
xor esi, esi
inc esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x26875d7e
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, 0x268eba7c
call fcn.268eb4dc
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
push ebx
push 0x18
push ebx
call dword [eax + 0x5c]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x18], esi
je 0x26875e16
mov eax, dword [esi]
mov ecx, esi
mov dword [ebp - 0x10], esi
call dword [eax + 0x48]
cmp eax, ebx
je 0x26875e27
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x34]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x26875e27
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x26875de7
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x26875de7
push dword [ebp - 0x14]
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp eax, ebx
jne 0x26875e1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
mov ecx, eax
mov eax, esi
push ebx
mov esi, ecx
call fcn.268e72f2
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
push 2
mov ecx, eax
pop eax
call fcn.268e6b73
mov esi, dword [ebp - 0x18]
jmp 0x26875e21
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x26875e34
xor ebx, ebx
inc ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x26876cc1
Capabilities:
Get hostname

Disassembly:
mov eax, 0x268ec929
call fcn.268eb4dc
sub esp, 0x218
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, 0x104
push edi
mov edi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], esi
jne 0x26876db5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x224]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x26876e16
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x10]
call fcn.268e31f4
push 0x269115f0
xor ecx, ecx
lea esi, [ebp - 0x10]
call fcn.268e36ff
cmp eax, 0xffffffff
je 0x26876d43
lea edi, [eax + 1]
mov eax, esi
call fcn.268e31d2
jmp 0x26876e40
push str.secur32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.GetComputerObjectNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and word [ebp - 0x224], 0
test eax, eax
mov dword [ebp - 0x14], ebx
je 0x26876e40
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x224]
push ecx
push 7
call eax
test eax, eax
je 0x26876e40
lea eax, [ebp - 0x224]
push 0x2f
push eax
call dword [sym.imp.MSVCRT.dll_wcschr]
test eax, eax
pop ecx
pop ecx
je 0x26876e40
lea ecx, [ebp - 0x224]
sub eax, ecx
sar eax, 1
push ecx
lea ebx, [ebp - 0x10]
call fcn.268e328f
jmp 0x26876e40
push str.secur32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
je 0x26876e16
push str.GetComputerObjectNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x26876e16
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x224]
push ecx
push 2
call eax
test eax, eax
je 0x26876e16
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x10]
call fcn.268e31f4
push 0x26911198
xor ecx, ecx
lea esi, [ebp - 0x10]
call fcn.268e36ff
cmp eax, 0xffffffff
je 0x26876e40
mov esi, eax
lea edi, [ebp - 0x10]
call fcn.268e31b7
jmp 0x26876e40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
mov ecx, eax
push esi
mov eax, ebx
mov esi, ecx
call fcn.268e72f2
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
push 2
mov ecx, eax
pop eax
call fcn.268e6b73
lea eax, [ebp - 0x10]
call fcn.268e3147
mov esi, dword [ebp + 8]
push eax
call fcn.26869bdf
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
call fcn.268e3036
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x26877f2e
Capabilities:
Read clipboard data

Disassembly:
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
push 6
pop ecx
xor eax, eax
mov edi, ebx
push 2
rep stosd dword es:[edi], eax
call esi
push 8
mov edi, eax
call esi
test edi, edi
mov ebp, eax
je 0x26877f8a
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
push 0x18
push edi
call esi
test eax, eax
jne 0x26877f85
push ebx
push 0x18
push ebp
call esi
test eax, eax
jne 0x26877f85
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x26877f8a
push 6
pop ecx
mov esi, eax
mov edi, ebx
push ebp
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
inc eax
jmp 0x26877f8c
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x26877f90
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 2
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x26877fd6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x230]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x26877fd6
push ebx
push esi
lea ebx, [ebp - 0x18]
call fcn.26877f2e
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
pop esi
pop ebx
jne 0x26877fdb
or eax, 0xffffffff
jmp 0x26877fde
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x26877fe2
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 2
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x26878028
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x230]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x26878028
push ebx
push esi
lea ebx, [ebp - 0x18]
call fcn.26877f2e
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
pop esi
pop ebx
jne 0x2687802d
or eax, 0xffffffff
jmp 0x26878030
mov eax, dword [ebp - 0x14]
leave
ret 4
Function at 0x26879f1b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push 1
push 0x401
call esi
mov ebx, eax
test ebx, ebx
jne 0x26879f74
push dword [ebp + 8]
push 1
push 1
call esi
test eax, eax
je 0x26879f55
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
test ebx, ebx
jne 0x26879f70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
mov ecx, eax
mov eax, esi
push 0
mov esi, ecx
call fcn.268e72f2
mov eax, ebx
jmp 0x26879fc4
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
mov dword [ebp + 8], eax
je 0x26879fba
cmp dword [ebp - 4], 0x103
jne 0x26879fba
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
mov dword [ebp + 8], eax
jne 0x26879fba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x3c]
mov ecx, eax
mov eax, esi
push 0
mov esi, ecx
call fcn.268e72f2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
pop esi
pop ebx
leave
ret 4
Function at 0x2687a3da
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
push dword [ebp + 8]
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x2687a414
mov eax, dword [esi]
push ebx
push 0x138e5
push esi
call dword [eax + 0x3c]
mov ebx, 0x268f3f58
call fcn.268e6bb2
pop ecx
pop ebx
jmp 0x2687a489
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
je 0x2687a440
cmp dword [ebp + 0xc], 5
je 0x2687a482
cmp dword [ebp + 0xc], 4
je 0x2687a482
mov eax, dword [ebp + 0xc]
xor ecx, ecx
dec eax
je 0x2687a477
dec eax
je 0x2687a470
dec eax
je 0x2687a46c
dec eax
je 0x2687a465
dec eax
je 0x2687a45e
dec eax
jne 0x2687a47a
mov ecx, 0x100
jmp 0x2687a47a
mov ecx, 0x8000
jmp 0x2687a47a
mov ecx, 0x4000
jmp 0x2687a47a
push 0x40
jmp 0x2687a479
mov ecx, 0x80
jmp 0x2687a47a
push 0x20
pop ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
leave
ret 8
Function at 0x2687a7c3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov ecx, dword [0x2692af68]
push ebx
push edi
xor edi, edi
cmp ecx, edi
mov ebx, eax
je 0x2687a803
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax]
cmp eax, edi
jne 0x2687a7ec
xor eax, eax
jmp 0x2687a7fb
mov ecx, dword [eax]
push eax
call dword [ecx + 0x354]
mov ecx, dword [0x2692af68]
mov edx, dword [ecx]
push ebx
push 1
push eax
call dword [edx]
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
je 0x2687a8fb
push ebx
call fcn.268d231e
test eax, eax
pop ecx
je 0x2687a831
lea eax, [ebp - 0x20c]
push edi
push eax
mov ecx, ebx
call fcn.26863476
pop ecx
pop ecx
jmp 0x2687a838
mov word [ebp - 0x20c], di
cmp dword [ebp + 0xc], edi
lea eax, [ebp - 0x20c]
je 0x2687a854
push 1
push eax
push edi
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x2687a87d
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push eax
push edi
push ebx
push str.open
push edi
call esi
cmp eax, 0x20
jae 0x2687a87c
push 1
lea eax, [ebp - 0x20c]
push eax
push edi
push ebx
push edi
push edi
call esi
pop esi
cmp eax, 0x20
jbe 0x2687a887
xor eax, eax
inc eax
jmp 0x2687a8fd
cmp eax, 0x1a
ja 0x2687a8c3
je 0x2687a8bc
cmp eax, 2
jb 0x2687a8fb
cmp eax, 3
jbe 0x2687a8d9
cmp eax, 5
je 0x2687a8b5
cmp eax, 8
je 0x2687a8ae
cmp eax, 0xb
jne 0x2687a8fb
push 0x138e7
jmp 0x2687a8ec
push 0x138eb
jmp 0x2687a8ec
push 0x138e8
jmp 0x2687a8ec
push 0x138ec
jmp 0x2687a8ec
cmp eax, 0x1b
je 0x2687a8e7
jbe 0x2687a8fb
cmp eax, 0x1e
jbe 0x2687a8e0
cmp eax, 0x1f
je 0x2687a8e7
cmp eax, 0x20
jne 0x2687a8fb
push 0x138e6
jmp 0x2687a8ec
push 0x138ea
jmp 0x2687a8ec
push 0x138e9
push dword [ebp + 8]
mov ebx, 0x268f3f58
call fcn.268c708f
pop ecx
pop ecx
xor eax, eax
pop edi
pop ebx
leave
ret 8
Function at 0x2687d812
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov ecx, dword [0x2692af68]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp ecx, edi
je 0x2687d857
mov eax, dword [esi + 4]
mov eax, dword [eax]
cmp eax, edi
jne 0x2687d83a
xor eax, eax
jmp 0x2687d849
mov ecx, dword [eax]
push eax
call dword [ecx + 0x354]
mov ecx, dword [0x2692af68]
mov ebx, dword [ebp + 0xc]
mov edx, dword [ecx]
push ebx
push 1
push eax
call dword [edx + 0xc]
jmp 0x2687d85a
mov ebx, dword [ebp + 0xc]
cmp dword [ebx], edi
jne 0x2687d87b
push 0x138bb
push esi
mov ebx, 0x268f3f58
call fcn.268c708f
pop ecx
pop ecx
mov eax, dword [esi]
push esi
call dword [eax + 0x3c]
jmp 0x2687d9e4
cmp word [ebx + 4], 0x10
mov eax, ebx
jne 0x2687d88e
call fcn.268e6198
mov dword [ebp - 4], eax
jmp 0x2687d8cb
call fcn.268e618c
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
push edi
push 0xffffffffffffffff
push eax
push edi
push edi
mov dword [ebp - 8], eax
call esi
mov ebx, eax
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.268eb500
mov dword [ebp - 4], esp
push ebx
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp - 8]
push edi
push edi
call esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
shr eax, 8
and eax, 1
mov dword [ebp + 0xc], eax
mov eax, ebx
je 0x2687d8ed
push edi
push dword [ebp + 0x10]
push 3
push edi
push esi
call fcn.26887a03
jmp 0x2687d9f0
call fcn.268824e8
test eax, eax
jne 0x2687d928
test byte [ebp + 0x10], 8
je 0x2687d90a
push 0x80
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esi]
push esi
call dword [eax + 0x3c]
mov ebx, dword [ebp - 4]
call fcn.268d1915
test eax, eax
je 0x2687d870
xor eax, eax
inc eax
jmp 0x2687d9f0
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.26863476
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
push edi
push 0x10
push dword [ebp - 4]
mov ebx, eax
xor eax, eax
lea ecx, [ebp - 0x44c]
call fcn.268d20a6
add esp, 0x18
test eax, eax
je 0x2687d9ee
mov eax, dword [ebp + 0x10]
and eax, 8
lea esi, [ebp + ebx*2 - 0x214]
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x214]
push eax
mov word [esi], di
call dword [sym.imp.MSVCRT.dll_wcscat]
cmp dword [ebp + 0x10], edi
pop ecx
pop ecx
je 0x2687d9a5
push 0x80
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
lea ebx, [ebp - 0x214]
call fcn.268d1915
test eax, eax
push edi
lea eax, [ebp - 0x44c]
je 0x2687d9d5
push eax
call fcn.268d216f
test eax, eax
pop ecx
pop ecx
jne 0x2687d975
jmp 0x2687d920
call fcn.268d224d
mov eax, dword [ebp + 8]
pop ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
push 2
mov ecx, eax
pop eax
call fcn.268e6b73
xor eax, eax
lea esp, [ebp - 0x458]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x2687dbb2
Capabilities:
Set current directory

Disassembly:
mov eax, 0x268ee014
call fcn.268eb4dc
sub esp, 0x628
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
mov ecx, dword [0x2692af68]
cmp ecx, esi
je 0x2687dbf9
mov eax, dword [edi + 4]
mov eax, dword [eax]
cmp eax, esi
jne 0x2687dbe0
xor eax, eax
jmp 0x2687dbef
mov ecx, dword [eax]
push eax
call dword [ecx + 0x354]
mov ecx, dword [0x2692af68]
push dword [ebp + 0xc]
mov edx, dword [ecx]
push 1
push eax
call dword [edx]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
mov ebx, 0x268f3f58
jbe 0x2687dc81
mov ecx, dword [ebp + 0xc]
push esi
push esi
push esi
lea eax, [ebp - 0x21c]
call fcn.268634ed
add esp, 0xc
cmp word [ebp - 0x21a], 0x3a
jne 0x2687dc49
lea eax, [ebp - 0x21c]
call fcn.268df7bd
movzx eax, word [ebp - 0x21c]
sub eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll__chdrive]
pop ecx
jmp 0x2687dc81
cmp word [ebp - 0x21c], 0x5c
jne 0x2687dc6c
cmp word [ebp - 0x21a], 0x5c
jne 0x2687dc6c
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x2687dc81
lea eax, [ebp - 0x21c]
push eax
push 0x138a8
push edi
call fcn.268c708f
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__wgetcwd]
test eax, eax
pop ecx
pop ecx
jne 0x2687dca6
push 0x138ac
push edi
call fcn.268c708f
pop ecx
pop ecx
push esi
push esi
push esi
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x634]
call fcn.268634ed
push dword [ebp - 0x428]
call dword [sym.imp.MSVCRT.dll_towupper]
mov esi, dword [ebp + 8]
mov word [ebp - 0x428], ax
add esp, 0x10
lea eax, [ebp - 0x428]
push eax
call fcn.26869bdf
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword [ebp - 0x10], 1
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x2687dcf8
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x268edea6
call fcn.268eb4dc
sub esp, 0x214
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x2692af68]
test ecx, ecx
push edi
mov edi, edx
je 0x2687dd39
mov eax, dword [edi + 4]
mov eax, dword [eax]
test eax, eax
je 0x2687dd31
mov ecx, dword [eax]
push eax
call dword [ecx + 0x354]
mov ecx, dword [0x2692af68]
mov edx, dword [ecx]
push esi
push 1
push eax
call dword [edx]
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call ebx
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.MSVCRT.dll_wcslen]
cmp eax, 1
pop ecx
je 0x2687dd99
mov ax, word [esi + 2]
cmp ax, 0x3a
je 0x2687dd99
cmp word [esi], 0x5c
jne 0x2687ddf6
cmp ax, 0x5c
jne 0x2687ddf6
lea eax, [ebp - 0x220]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
call edi
mov esi, eax
lea eax, [ebp - 0x220]
push eax
call edi
jmp 0x2687dded
movzx eax, word [esi]
mov ecx, eax
cmp ecx, 0x61
jl 0x2687dda6
sub ecx, 0x20
cmp ecx, 0x41
jl 0x2687ddf6
cmp ecx, 0x5a
jg 0x2687ddf6
push eax
lea eax, [ebp - 0x10]
push str._c:_
push eax
call fcn.268849d8
add esp, 0xc
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x10]
call fcn.268e3147
push eax
call dword [sym.imp.MSVCRT.dll__waccess]
mov esi, eax
neg esi
sbb esi, esi
pop ecx
pop ecx
inc esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.2687de1b
push dword [ebp - 0x14]
call ebx
mov eax, esi
jmp 0x2687de0c
push esi
push 0x138b7
mov ebx, 0x268f3f58
push edi
call fcn.268c708f
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret