joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b609
Capabilities:
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x6195b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov dword [esi + 8], 0x628808
xor ebx, ebx
mov dword [esi], 0x6335dc
mov dword [esi + 4], 0x6335d8
mov dword [esi + 8], 0x6335c8
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
lea edi, [esi + 0x38]
mov eax, 0x6575c8
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], bl
mov byte [esi + 0x29], bl
mov byte [esi + 0x2a], bl
mov byte [esi + 0x2b], bl
mov byte [esi + 0x2c], bl
mov byte [esi + 0x2d], bl
mov byte [esi + 0x2e], bl
mov byte [esi + 0x2f], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esp + 0x2c], ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov eax, 0x6575cc
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
lea ecx, [esi + 0x80]
mov byte [esp + 0x2c], 3
call fcn.00524735
lea ecx, [esi + 0xb0]
mov byte [esp + 0x2c], 4
call fcn.00521843
lea ecx, [esi + 0xc4]
mov byte [esp + 0x2c], 5
mov dword [esi + 0xc0], 0x63350c
call fcn.00521843
mov byte [esi + 0xd4], 1
mov dword [esi + 0xd8], ebx
push str.unnamed
mov ecx, edi
mov byte [esp + 0x30], 6
mov dword [esp + 0x10], 0x10
call fcn.00402370
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, ebx
mov cl, 0x20
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ebx
call fcn.005fb380
mov dword [esi + 0x48], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esi + 0x4c], edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x45b753
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.00402370
lea eax, [esp + 0x14]
push eax
call fcn.00521264
add esp, 4
xor edx, edx
mov cl, 0x20
call fcn.005fb380
xor dword [esi + 0x48], eax
xor dword [esi + 0x4c], edx
add dword [esi + 0x50], eax
adc dword [esi + 0x54], edx
mov ecx, dword [esp + 0x24]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x460370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x827c
call fcn.005f9f10
push ebx
push esi
push 0x627b24
push 0xe7
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x4604bf
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x4604bf
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x4604b8
mov edx, eax
lea eax, [ebp - 0x3aec]
mov dword [ebp - 4], ebx
push edi
mov ecx, 0xff000000
test ecx, ebx
jne 0x4603d9
movzx ebx, byte [edx]
or ebx, ecx
inc edx
test bl, bl
jns 0x4603ee
mov cl, byte [edx]
mov byte [eax], cl
movzx ecx, cl
add dword [ebp - 4], ecx
not dword [ebp - 4]
inc eax
inc edx
jmp 0x460419
movzx esi, word [edx]
mov edi, esi
sar edi, 0xc
add edi, 3
and esi, 0xfff
inc edx
inc edx
mov cl, byte [esi + eax - 0x1000]
mov byte [eax], cl
movzx ecx, cl
add ecx, dword [ebp - 4]
inc eax
dec edi
not ecx
mov dword [ebp - 4], ecx
jne 0x460401
add ebx, ebx
cmp dword [ebp - 4], 0xfffff609
jne 0x4603ca
lea ecx, [ebp - 0x3aec]
lea eax, [ebp - 0x827c]
mov dl, byte [ecx]
cmp dl, 0xa0
jb 0x46043f
mov byte [eax], 0x20
and dl, 0x7f
jmp 0x46045f
cmp dl, 0x80
jb 0x460457
dec byte [ecx]
mov dl, byte [ecx]
mov byte [eax], 0x20
inc eax
cmp dl, 0x80
jae 0x460444
dec dl
mov byte [ecx], dl
jmp 0x460463
cmp dl, 0xa
jne 0x460460
mov byte [eax], 0xd
inc eax
mov byte [eax], dl
inc eax
lea edx, [ebp - 0x3af0]
inc ecx
cmp eax, edx
jne 0x460430
push 1
push 0xb
mov byte [eax], 0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x30
mov ebx, 0x480
push ebx
push dword [ebp + 8]
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call edi
lea eax, [ebp - 0x827c]
push eax
push 0
push 0xc
push ebx
push dword [ebp + 8]
call esi
push eax
call edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
jmp 0x4604c9
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
pop esi
pop ebx
leave
ret
Function at 0x460517
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x619853
call fcn.005f77f4
sub esp, 0xc
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
push esi
mov esi, ecx
je 0x460599
xor eax, eax
mov cl, byte [eax + 0x630400]
xor cl, 0xaa
mov byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 0xa
jl 0x460531
lea ecx, [ebp + 0xc]
mov byte [ebp + eax - 0x18], bl
call fcn.0051b1b6
push ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ebx
call fcn.0051b006
test eax, eax
lea ecx, [ebp + 0xc]
je 0x460582
or dword [ebp - 4], 0xffffffff
call fcn.0051aec7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.0051af02
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0051aec7
push ebx
push 0x4604cd
push dword [ebp + 8]
push 0xe8
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
jne 0x460570
push 4
call fcn.005f7f03
cmp eax, ebx
pop ecx
je 0x4605d0
mov dword [eax], 0x62756476
mov dword [ebp + 8], eax
jmp 0x4605d3
mov dword [ebp + 8], ebx
push 0x69b084
lea eax, [ebp + 8]
push eax
call fcn.005f8355
int3
Function at 0x460680
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x3c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x20]
call fcn.0052463a
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x1c]
push eax
push ecx
push edx
call fcn.004559a0
add esp, 0xc
test al, al
jne 0x4606c2
lea ecx, [esp + 0x1c]
call fcn.005244c5
mov eax, 0xa
add esp, 0x3c
ret 0x10
push ebx
push esi
push edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
xor bl, bl
push 1
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x460738
cmp dword [esp + 0x10], 0x12
je 0x460790
lea ecx, [esp + 0xc]
push ecx
call fcn.0044e140
add esp, 4
test al, al
jne 0x4606e0
lea edx, [esp + 0xc]
push edx
call fcn.0048df30
add esp, 4
test al, al
jne 0x4606e0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4606e0
test bl, bl
jne 0x460751
lea edx, [esp + 0x28]
push edx
mov bl, 1
call fcn.004566d0
mov esi, eax
add esp, 4
test esi, esi
jge 0x46079d
mov ecx, dword [0x6b48a0]
call fcn.00474d30
test al, al
jne 0x4606e0
mov ecx, dword [0x6b3f18]
call fcn.0047d880
test al, al
jne 0x4606e0
call fcn.004582c0
test al, al
jne 0x4606e0
call fcn.0051e419
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x4606e0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4607a6
call fcn.0048df00
mov dword [esp + 0x14], esi
mov ecx, dword [0x6b48b8]
test ecx, ecx
je 0x4607d2
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [0x6b48b8]
test ecx, ecx
je 0x4607c8
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov dword [0x6b48b8], 0
mov ecx, dword [0x6b48b4]
test ecx, ecx
je 0x4607fe
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [0x6b48b4]
test ecx, ecx
je 0x4607f4
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov dword [0x6b48b4], 0
call fcn.00456340
mov ecx, dword [0x6d2d2c]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [eax + 0xa4]
mov edx, ecx
and edx, 0xf
add ecx, 1
lea edx, [eax + edx*8 + 0x24]
mov dword [eax + 0xa4], ecx
mov eax, dword [0x6b48a4]
test eax, eax
mov dword [edx], str.._sourceMain.cpp
mov dword [edx + 4], 0xb2
mov esi, eax
jne 0x46084a
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x28]
call fcn.005244c5
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x3c
ret 0x10
Function at 0x461330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6198c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x24]
push edi
push eax
push ecx
lea eax, [esp + 0x20]
push eax
call fcn.0051ed82
add esp, 0xc
lea edi, [esi + 0x30]
push eax
mov ecx, edi
mov dword [esp + 0x3c], 0
call fcn.00403990
mov eax, dword [esp + 0x18]
cmp eax, 0x6575cc
mov dword [esp + 0x38], 0xffffffff
je 0x461391
push eax
call fcn.005f7371
add esp, 4
push str._0lld
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.00413020
lea edx, [esi + 0x18]
push edx
push eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x50], 1
call fcn.00410190
add esp, 0x18
mov eax, dword [esp + 0x18]
cmp eax, 0x6575cc
mov byte [esp + 0x38], 3
je 0x4613d4
push eax
call fcn.005f7371
add esp, 4
mov edx, dword [esp + 0xc]
lea ecx, [esi + 0x40]
push ecx
lea edi, [esi + 0x3c]
push edi
push 2
push edx
lea eax, [esp + 0x34]
push eax
call fcn.0051c148
add esp, 0x14
mov eax, dword [eax]
mov ecx, dword [esi + 4]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x48c
push ecx
mov byte [esp + 0x44], 4
call ebp
push eax
call fcn.0051910d
mov eax, dword [esp + 0x2c]
add esp, 8
cmp eax, 0x6575cc
mov byte [esp + 0x38], 3
je 0x46142b
push eax
call fcn.005f7371
add esp, 4
mov eax, dword [esp + 0xc]
lea edx, [esi + 0x48]
push edx
push edi
push 2
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.0051c148
add esp, 0x14
mov eax, dword [eax]
mov edx, dword [esi + 4]
push eax
push 0x493
push edx
mov byte [esp + 0x44], 5
call ebp
push eax
call fcn.0051910d
mov eax, dword [esp + 0x2c]
add esp, 8
cmp eax, 0x6575cc
pop edi
pop esi
pop ebp
je 0x461477
push eax
call fcn.005f7371
add esp, 4
mov eax, dword [esp]
cmp eax, 0x6575cc
je 0x46148a
push eax
call fcn.005f7371
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x464020
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
push 0x79
mov dword [esp + 0xc], esi
call fcn.0044d6a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], ecx
mov dword [esi], 0x6356b0
mov edi, dword [eax]
lea ecx, [esi + 0x18]
mov dword [ecx], edi
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], edx
mov byte [esi + 0x30], dl
call fcn.0051dc40
fild qword [esi + 0x20]
sub esp, 8
fmulp st(1)
fmul qword [0x62b768]
fstp qword [esp]
call fcn.00519e5d
mov ecx, dword [esp + 0x14]
add esp, 8
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x465050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619b18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push ebx
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.00464be0
mov edx, dword [esp + 0x2c]
push edx
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0
call fcn.0044e030
test eax, eax
lea ecx, [esp + 4]
setne bl
mov dword [esp + 0x24], 0xffffffff
call fcn.0044d6c0
mov ecx, dword [esp + 0x1c]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x468ba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61d2b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x30]
mov dword [esp + 8], esi
call fcn.00421760
mov esi, dword [esi + 0x28]
mov ebx, dword [esi]
cmp ebx, esi
mov dword [esp + 0xc], esi
je 0x468cfe
push ebp
push edi
jmp 0x468be0
lea eax, [ebx + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0051b61b
add esp, 8
mov edx, dword [ebx + 0xc]
mov ebp, 0x6575c8
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov ecx, dword [eax + 4]
mov edi, dword [eax]
sub ecx, edi
mov dword [esp + 0x3c], 0
mov esi, ecx
je 0x468c48
push 0
push esi
lea ecx, [esp + 0x30]
call fcn.00518c68
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x468c48
push esi
push edi
push eax
call fcn.005f7b00
mov eax, dword [esp + 0x34]
add esp, 0xc
add eax, esi
mov dword [esp + 0x2c], eax
mov byte [eax], 0
mov ecx, dword [esp + 0x10]
mov esi, dword [ecx + 0x30]
mov edi, dword [esi + 4]
mov eax, dword [edi + 4]
lea edx, [esp + 0x24]
push edx
push eax
push edi
mov ecx, esi
mov byte [esp + 0x48], 1
call fcn.004216d0
push 1
mov ecx, esi
mov ebp, eax
call fcn.0045c1d0
mov dword [edi + 4], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ebp
mov eax, dword [esp + 0x28]
cmp eax, 0x6575c8
je 0x468c8f
push eax
call fcn.005f7371
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, 0x6575c8
mov dword [esp + 0x3c], 0xffffffff
je 0x468cab
push eax
call fcn.005f7371
add esp, 4
cmp byte [ebx + 0x1d], 0
jne 0x468cf2
mov eax, dword [ebx + 8]
cmp byte [eax + 0x1d], 0
jne 0x468cd0
mov ebx, eax
mov eax, dword [ebx]
cmp byte [eax + 0x1d], 0
jne 0x468cf2
mov ebx, eax
mov eax, dword [ebx]
cmp byte [eax + 0x1d], 0
je 0x468cc4
jmp 0x468cf2
mov eax, dword [ebx + 4]
cmp byte [eax + 0x1d], 0
jne 0x468cf0
lea esp, [esp]
cmp ebx, dword [eax + 8]
jne 0x468cf0
mov ebx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x1d], 0
je 0x468ce0
mov ebx, eax
cmp ebx, dword [esp + 0x14]
jne 0x468be0
pop edi
pop ebp
mov ecx, dword [esp + 0x2c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x468e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
push 0x10b
mov dword [esp + 0xc], esi
call fcn.0044d6a0
lea edi, [esi + 0x24]
mov ecx, edi
mov dword [esp + 0x14], 0
mov dword [esi], 0x635d38
mov dword [esi + 0x10], 0
call fcn.00466da0
mov ecx, dword [esp + 0xc]
mov dword [edi + 4], eax
mov byte [eax + 0x1d], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 8], 0
mov dword [esi + 0x30], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x469d00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x469d86
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x469d7c
mov ebp, dword [esp + 0x14]
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x469d23
sub eax, edx
lea edi, [eax + 1]
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x469d7c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x469d75
push edi
push ebp
push ebx
call fcn.005f7b00
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebp
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret

Function at 0x469e40
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x469ee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.PerfStatsStartStat
push reloc.COMCTL32.dll_CreateStatusWindowA
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x469f84
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x18]
push str.KERNELCPUUsage
push eax
call edi
test eax, eax
jne 0x469f6f
mov ecx, dword [esp + 0xc]
push esi
push ecx
call fcn.00461f60
mov ecx, dword [esp + 0x10]
add esp, 4
lea edx, [esp + 0x10]
push edx
mov esi, eax
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push str.KERNELCPUUsage
push ecx
call edi
push esi
call fcn.00461f70
mov edx, dword [esp + 0x10]
add esp, 4
pop esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 8]
push edx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret
xor al, al
pop ebx
add esp, 0xc
ret
Function at 0x469f90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.PerfStatsStopStat
push reloc.COMCTL32.dll_CreateStatusWindowA
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46a034
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x18]
push str.KERNELCPUUsage
push eax
call edi
test eax, eax
jne 0x46a01f
mov ecx, dword [esp + 0xc]
push esi
push ecx
call fcn.00461f60
mov ecx, dword [esp + 0x10]
add esp, 4
lea edx, [esp + 0x10]
push edx
mov esi, eax
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push str.KERNELCPUUsage
push ecx
call edi
push esi
call fcn.00461f70
mov edx, dword [esp + 0x10]
add esp, 4
pop esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 8]
push edx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret
xor al, al
pop ebx
add esp, 0xc
ret

Function at 0x46a0e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x46a0f3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp fcn.00469f90
ret
Function at 0x46a100
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x28
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x46a147
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.KERNELCPUUsage
push eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46a13f
mov eax, dword [esp + 0xc]
pop esi
add esp, 0x28
ret
or eax, 0xffffffff
pop esi
add esp, 0x28
ret
cmp byte [esi], 0
je 0x46a13f
push ebx
push edi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esi + 0x18]
mov edi, dword [esp + 0xc]
cmp edi, eax
mov ecx, dword [esi + 0x1c]
mov ebx, dword [esp + 0x10]
jne 0x46a19c
cmp ebx, ecx
jne 0x46a19c
pop edi
pop ebx
mov eax, 0x64
pop esi
add esp, 0x28
ret
mov edx, dword [esp + 0x20]
sub edi, eax
sbb ebx, ecx
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esi + 0x10]
push ebp
sbb edx, dword [esi + 0x14]
sub ecx, dword [esi + 8]
push 0
sbb edx, dword [esi + 0xc]
add ecx, dword [esp + 0x1c]
push 0x64
adc edx, dword [esp + 0x24]
push edx
push ecx
call fcn.005f8550
mov ecx, edi
mov ebp, ebx
shrd ecx, ebp, 1
shr ebp, 1
push ebx
add eax, ecx
push edi
adc edx, ebp
push edx
push eax
call fcn.005f8590
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esi + 8], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x1c]
pop ebp
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0xc]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0x10]
pop edi
pop ebx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ecx
pop esi
add esp, 0x28
ret
Function at 0x46a4a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x469e1b
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x469e11
mov ebp, dword [esp + 0x14]
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x469db3
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 2]
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x469e11
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x469e0a
push edi
push ebp
push ebx
call fcn.005f7b00
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebp
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret
sub esp, 0xc
test byte [0x6b2cd4], 1
jne 0x46a4c7
or dword [0x6b2cd4], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
shr eax, 0x1f
not al
and al, 1
mov byte [0x6b2cd0], al
jmp 0x46a4cc
mov al, byte [0x6b2cd0]
test al, al
je 0x46a4d8
add esp, 0xc
jmp 0x469d90
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
lea edx, [esp + 8]
push edx
call fcn.0051b523
mov eax, dword [esp + 0xc]
push eax
call fcn.00469d00
mov eax, dword [esp + 0x10]
add esp, 0x10
cmp eax, 0x6575c8
je 0x46a50a
push eax
call fcn.005f7371
add esp, 4
add esp, 0xc
ret