joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432117
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x563e28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CCommandLineInfo.virtual_0
mov dword [esi + 4], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
lea edi, [esi + 0x14]
push ebx
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.0050b4fa
mov dword [edi], vtable.CCriticalSection.0
add edi, 8
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x38]
mov dword [esi + 0x3c], ebx
push eax
push 4
push esi
push 0x432520
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, 0x5d7fd0
jmp 0x432100

Function at 0x432700
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x563e68
push eax
mov dword fs:[0], esp
push esi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or esi, 0xffffffff
cmp eax, esi
jne 0x432747
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], esi
call fcn.00530b8f
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
mov ecx, eax
and ecx, 0x10
cmp cl, 0x10
je 0x432770
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], esi
call fcn.00530b8f
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
mov edx, eax
and edx, 1
cmp dl, 1
jne 0x4327ab
and al, 0xfe
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4327ab
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], esi
call fcn.00530b8f
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4327fc
mov ecx, dword [esp + 0x14]
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, esi
jne 0x4327f5
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], esi
call fcn.00530b8f
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], esi
call fcn.00530b8f
mov ecx, dword [esp + 4]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
Function at 0x432820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x563eb7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [esp + 0xc], 0
mov ebx, 1
push 0x5c
push 0x2f
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], ebx
call fcn.005280b2
push 0x5c4800
lea ecx, [esp + 0x2c]
call fcn.0052887f
mov eax, dword [esp + 0x28]
push 0x5c4800
push eax
mov esi, eax
call fcn.00514e99
add esp, 8
test eax, eax
jne 0x432897
mov esi, dword [esp + 0x24]
push 0x5d7b88
mov ecx, esi
call fcn.00530bfd
mov dword [esp + 0xc], ebx
jmp 0x4329b1
mov eax, dword [esp + 0x28]
mov eax, dword [eax - 8]
cmp eax, 2
jge 0x4328bc
mov esi, dword [esp + 0x24]
push 0x5d7b88
mov ecx, esi
call fcn.00530bfd
mov dword [esp + 0xc], ebx
jmp 0x4329b1
mov ecx, dword [0x5d2d10]
mov dword [esp + 8], ecx
mov al, byte [esi + 1]
mov byte [esp + 0x1c], 2
cmp al, 0x3a
jne 0x43290f
lea edx, [esp + 0x10]
push 2
push edx
lea ecx, [esp + 0x30]
call fcn.005283d8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call fcn.00530cc8
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 2
call fcn.00530b8f
push 0x5c
lea ecx, [esp + 0xc]
call fcn.00530f92
jmp 0x432990
cmp byte [esi], 0x5c
jne 0x432929
cmp al, 0x5c
jne 0x432929
push 2
push 0x5c
lea ecx, [esp + 0x30]
call fcn.00531064
test eax, eax
jg 0x43293b
mov esi, dword [esp + 0x24]
push 0x5d7b88
mov ecx, esi
call fcn.00530bfd
jmp 0x4329a0
inc eax
lea ecx, [esp + 0x28]
push eax
push 0x5c
call fcn.00531064
test eax, eax
lea ecx, [esp + 0x28]
jg 0x432967
push ecx
lea ecx, [esp + 0xc]
call fcn.00530cc8
push 0x5c
lea ecx, [esp + 0xc]
call fcn.00530f92
jmp 0x432990
inc eax
lea edx, [esp + 0x10]
push eax
push edx
call fcn.005283d8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 4
call fcn.00530cc8
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 2
call fcn.00530b8f
mov esi, dword [esp + 0x24]
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.00530904
lea ecx, [esp + 8]
mov byte [esp + 0x1c], bl
mov dword [esp + 0xc], ebx
call fcn.00530b8f
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call fcn.00530b8f
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4329e0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x563f10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call fcn.00530904
lea ecx, [esp + 0xc]
push ecx
call fcn.00432820
add esp, 8
mov edx, dword [esp + 8]
mov bl, 1
push edx
mov byte [esp + 0x1c], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x432a85
cmp esi, 0x57
jne 0x432a64
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
push 0x17b
push ecx
call fcn.004efd60
add esp, 0xc
mov byte [esp + 0x18], 2
jmp 0x432b0a
mov edx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push edx
push 0x17a
push eax
call fcn.004efd60
add esp, 0xc
mov byte [esp + 0x18], 3
jmp 0x432b0a
cmp eax, 2
jne 0x432acb
cmp esi, 0x57
jne 0x432aad
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0xc]
push ecx
push 0x17b
push edx
call fcn.004efd60
add esp, 0xc
mov byte [esp + 0x18], 4
jmp 0x432b0a
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
push 0x17b
push ecx
call fcn.004efd60
add esp, 0xc
mov byte [esp + 0x18], 5
jmp 0x432b0a
cmp eax, 4
jne 0x432aee
mov edx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push edx
push 0x16b
push eax
call fcn.004efd60
add esp, 0xc
mov byte [esp + 0x18], 6
jmp 0x432b0a
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0xc]
push ecx
push 0x16b
push edx
call fcn.004efd60
add esp, 0xc
mov byte [esp + 0x18], 7
mov eax, dword [eax]
push 0
push 0x4000
push eax
call fcn.0053a94a
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], bl
call fcn.00530b8f
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.00530b8f
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00530b8f
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x454830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x45484a
test al, 0x10
je 0x45484a
mov eax, 1
ret
xor eax, eax
ret
Function at 0x455190
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x568537
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push esi
push edi
call fcn.0054fc30
mov eax, dword [eax + 8]
lea ecx, [esp + 0x30]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x30]
lea ecx, [esp + 0x24]
push edx
call fcn.00530bfd
mov esi, eax
push 0x5c8254
lea ecx, [esp + 0x30]
mov dword [esp + 0x154], 0
call fcn.00530bfd
push esi
push eax
lea eax, [esp + 0x28]
mov byte [esp + 0x158], 1
push eax
call fcn.00530dbe
push str.____1_
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x15c], 2
call fcn.00530e24
lea ecx, [esp + 0x20]
mov byte [esp + 0x150], 6
call fcn.00530b8f
lea ecx, [esp + 0x2c]
mov byte [esp + 0x150], 5
call fcn.00530b8f
lea ecx, [esp + 0x24]
mov byte [esp + 0x150], 4
call fcn.00530b8f
call fcn.004f14e0
push str.SoftwareClasses_
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.00530bfd
test esi, esi
mov byte [esp + 0x150], 7
je 0x4552b7
mov edx, dword [esp + 0x158]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00530e24
mov eax, dword [eax]
lea edx, [esp + 0xc]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push SysReAllocStringLen
call esi
lea ecx, [esp + 0x28]
mov edi, eax
call fcn.00530b8f
jmp 0x4552e2
mov ecx, dword [esp + 0x158]
lea eax, [esp + 0xc]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push SysReAllocStringLen
call esi
mov edi, eax
test edi, edi
jne 0x4553a3
mov eax, dword [esp + 0xc]
push ebp
lea edx, [esp + 0x1c]
push edi
push edx
push edi
push 0x20006
push edi
push edi
push edi
push str.shell
push eax
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45539b
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push edi
push ecx
push edi
push 0x20006
push edi
push edi
push edi
push str.CuteFTP_Pro
push edx
call esi
test eax, eax
jne 0x455394
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x16
push str.Edit_with_CuteFTP_Pro
push 1
push eax
push eax
mov eax, dword [esp + 0x20]
push eax
call edi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x20]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.command
push edx
call esi
test eax, eax
jne 0x45538d
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [esp + 0x28]
push 1
push 0
push 0
push eax
call edi
mov ecx, dword [esp + 0x20]
push ecx
call ebp
mov edx, dword [esp + 0xc]
push edx
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call ebp
pop ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x150], 4
call fcn.00530b8f
lea ecx, [esp + 0x10]
mov dword [esp + 0x150], 0xffffffff
call fcn.00530b8f
mov ecx, dword [esp + 0x148]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14c
ret
Function at 0x4556c0
Capabilities:
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x568598
push eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or ecx, 0xffffffff
mov dword [esp + 8], ecx
cmp eax, ecx
lea ecx, [esp + 0x10]
je 0x455708
call fcn.00530b8f
mov eax, 1
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret
call fcn.00530b8f
mov ecx, dword [esp]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0xc
ret

Function at 0x45cd60
Capabilities:
Capture screenshot

Disassembly:
push 0xffffffffffffffff
push 0x5689b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.00535a5f
mov ebx, eax
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x24]
mov ebp, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x10], eax
or eax, 0xffffffff
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov eax, dword [0x5c6d7c]
test eax, eax
je 0x45ce11
push 5
call dword [sym.imp.USER32.dll_GetSysColorBrush]
lea edx, [esp + 0x24]
push eax
push edx
push edi
call dword [sym.imp.USER32.dll_FillRect]
jmp 0x45ce76
mov eax, dword [0x5c6d80]
lea ecx, [esp + 0x1c]
push eax
call fcn.005366b5
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0
push ecx
mov ecx, ebx
call fcn.00535c08
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
push edx
push eax
push edi
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.00535c08
mov dword [esp + 0x1c], vtable.CGdiObject.0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 1
call fcn.0053664f
mov dword [esp + 0x3c], 0xffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.0045ec20
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push 0xcc0020
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x10]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebx + 4]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_ShowCaret]
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x45cef0
Capabilities:
Capture screenshot

Disassembly:
push esi
mov esi, ecx
call fcn.0045be50
mov ecx, dword [esi + 0xa0]
test ecx, ecx
je 0x45cf22
mov eax, dword [ecx + 0x44]
xor edx, edx
test eax, eax
jle 0x45cf10
mov edx, 1
mov eax, dword [ecx + 0x74]
cmp eax, edx
jg 0x45cf1e
mov eax, dword [ecx]
call dword [eax + 0x58]
jmp 0x45cf22
dec eax
mov dword [ecx + 0x74], eax
mov eax, dword [esi + 0x94]
test eax, eax
jne 0x45cf82
mov eax, dword [esi + 0x90]
test eax, eax
je 0x45cfaa
mov ecx, dword [esi + 0x84]
dec eax
mov edx, dword [ecx + 0x18]
mov dword [esi + 0x90], eax
mov dword [esi + 0x84], edx
mov eax, dword [0x5d825c]
test eax, eax
mov ecx, esi
jne 0x45cf5d
pop esi
jmp 0x45e1e0
call fcn.0045c240
push eax
mov eax, dword [esi + 0x84]
push 0x186a0
mov ecx, dword [eax + 0xc]
push ecx
call fcn.00452550
add esp, 0xc
mov dword [esi + 0x94], eax
jmp 0x45cf92
dec eax
push 0
mov ecx, esi
mov dword [esi + 0x94], eax
call fcn.0045d3f0
push 1
mov ecx, esi
call fcn.0045bec0
mov ecx, esi
call fcn.0045c100
mov ecx, esi
pop esi
jmp fcn.0045e2e0
pop esi
ret
push esi
push edi
mov esi, ecx
call fcn.0045be50
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x45e226
mov eax, dword [eax + 0x94]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x18b
push eax
call edi
mov ecx, dword [esi + 0xa0]
dec eax
push 0
push eax
mov edx, dword [ecx + 0x94]
push 0x186
push edx
call edi
pop edi
pop esi
ret
push ebp
mov ecx, esi
call fcn.0045c240
mov ebp, eax
mov eax, dword [0x5d825c]
test eax, eax
jne 0x45e272
mov eax, dword [esi + 0x84]
mov edi, dword [eax + 0xc]
xor eax, eax
mov cl, byte [edi]
test cl, cl
je 0x45e26a
push ebx
mov ebx, dword [0x5c7f1c]
cmp cl, 9
jne 0x45e260
xor edx, edx
div ebx
inc eax
imul eax, ebx
jmp 0x45e261
inc eax
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x45e251
pop ebx
mov dword [esi + 0x94], eax
jmp 0x45e28f
mov eax, dword [esi + 0x94]
push 0
cdq
idiv ebp
mov ecx, esi
inc eax
imul eax, ebp
dec eax
mov dword [esi + 0x94], eax
call fcn.0045d3f0
push 1
mov ecx, esi
call fcn.0045bec0
mov ecx, esi
call fcn.0045c100
mov eax, dword [0x5d825c]
test eax, eax
jne 0x45e2be
mov ecx, dword [esi + 0x94]
pop ebp
mov dword [esi + 0x9c], ecx
mov ecx, esi
pop edi
pop esi
jmp fcn.0045e2e0
mov eax, dword [esi + 0x94]
mov ecx, esi
cdq
idiv ebp
pop ebp
pop edi
mov dword [esi + 0x9c], edx
pop esi
jmp fcn.0045e2e0
Function at 0x45e2e0
Capabilities:
Capture screenshot

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x104]
test eax, eax
je 0x45e330
mov eax, dword [esi + 0xf4]
test eax, eax
jne 0x45e311
mov dword [esi + 0x104], 0
mov dword [esi + 0xf4], 0
pop esi
jmp fcn.0045cd60
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + 0xec]
push eax
push ecx
mov ecx, esi
call fcn.0045e340
mov dword [esi + 0xf4], 0
pop esi
ret
Function at 0x463de0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
mov esi, ecx
call fcn.0045e5c0
mov ebx, eax
test ebx, ebx
je 0x463e4e
mov eax, dword [esi + 0x1c]
push edi
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
test cl, cl
jne 0x463e22
push ebx
call fcn.00531c29
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
ret
Function at 0x46bdf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x569cf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x5872d8
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], 1
call fcn.00530b8f
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 0
call fcn.00530b8f
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], 0xffffffff
call fcn.0052cfbe
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x46be50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x569d10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
push str.CUTERG01
lea esi, [edi + 0x30]
mov ecx, esi
call fcn.00530d18
mov eax, dword [edi + 0x18]
mov ecx, dword [0x5d2d10]
neg eax
sbb eax, eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 8], ecx
test eax, eax
mov byte [esp + 0x1c], 1
je 0x46bedf
add edi, 0xc
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, edi
call fcn.0052d1c5
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0046c7d0
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.0046c7d0
mov eax, dword [esp + 0x20]
add esp, 0x10
test eax, eax
jne 0x46bea8
mov edx, dword [esi]
xor ecx, ecx
mov byte [esp + 0x1c], 0
mov eax, dword [edx - 8]
cmp eax, 0x2800
setl cl
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00530b8f
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00530b8f
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x46c550
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x569da8
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [0x5c9648]
push 0x20
mov ebx, eax
inc eax
mov dword [esp + 0x18], 0
mov dword [0x5c9648], eax
call fcn.00531c00
add esp, 4
test eax, eax
je 0x46c5a3
mov ecx, dword [0x5d2d10]
mov esi, eax
mov dword [eax + 4], ecx
mov edx, dword [0x5d2d10]
mov dword [eax + 0x10], edx
jmp 0x46c5a5
xor esi, esi
mov eax, dword [esp + 0x1c]
mov dword [esi], ebx
lea edx, [edi + 0x30]
mov ecx, dword [eax + 0x1c]
push edx
mov dword [esi + 8], ecx
lea ecx, [esi + 4]
mov dword [esi + 0xc], 0
call fcn.00530cc8
lea eax, [esp + 0x20]
lea ecx, [esi + 0x10]
push eax
call fcn.00530cc8
mov ecx, dword [esp + 0x24]
push 0
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 8]
push 0
push 0
mov dword [esi + 0x1c], edx
mov eax, dword [edi + 4]
push 0
push esi
push 0x46bf30
mov dword [esi + 0x18], eax
call fcn.00531e34
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0xffffffff
call fcn.00530b8f
mov ecx, dword [esp + 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x46c620
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x569dd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [0x5c9648]
mov ebx, dword [esp + 0x88]
xor esi, esi
mov ebp, eax
inc eax
push 0x20
mov dword [0x5c9648], eax
mov dword [esp + 0x80], esi
mov dword [ebx], ebp
call fcn.00531c00
add esp, 4
cmp eax, esi
je 0x46c67f
mov ecx, dword [0x5d2d10]
mov esi, eax
mov dword [eax + 4], ecx
mov edx, dword [0x5d2d10]
mov dword [eax + 0x10], edx
mov eax, dword [esp + 0x84]
mov dword [esi], ebp
lea edx, [edi + 0x30]
mov ecx, dword [eax + 0x1c]
push edx
mov dword [esi + 8], ecx
lea ecx, [esi + 4]
call fcn.00530cc8
lea eax, [esp + 0x8c]
lea ecx, [esi + 0x10]
push eax
mov dword [esi + 0xc], 0
call fcn.00530cc8
mov ecx, dword [esp + 0x90]
push 0
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 8]
mov dword [esi + 0x1c], edx
mov eax, dword [edi + 4]
push ebx
push esi
lea ecx, [esp + 0x1c]
mov dword [esi + 0x18], eax
call fcn.0046c720
lea ecx, [esp + 0x10]
mov byte [esp + 0x7c], 1
call fcn.00532ba8
lea ecx, [esp + 0x10]
mov esi, eax
mov byte [esp + 0x7c], 0
call fcn.005327a5
lea ecx, [esp + 0x8c]
mov dword [esp + 0x7c], 0xffffffff
call fcn.00530b8f
mov ecx, dword [esp + 0x74]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x70
ret 0x10

Function at 0x46cabd
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x569e57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x5d2d10]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x10]
mov dword [ecx], eax
mov edx, dword [0x5d2d10]
lea ebx, [esi + 0x14]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx], edx
mov eax, dword [0x5d2d10]
mov dword [esi + 0x18], eax
mov edx, dword [0x5d2d10]
lea ebp, [esi + 0x1c]
mov dword [ebp], edx
mov eax, dword [0x5d2d10]
mov dword [esi + 0x40], eax
push 0x5d7b88
mov byte [esp + 0x20], 4
mov dword [esi], 0x5873c0
call fcn.00530d18
push 0x5d7b88
mov ecx, ebx
call fcn.00530d18
push str.res_nag.bmp
mov ecx, ebp
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.00530d18
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x20], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x24], 0x5c975c
mov dword [esi + 0x28], str..DEFAULTSoftwareGlobalSCAPECuteFTP_ProfessionalValue
mov dword [esi + 0x2c], 0x5c971c
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, 0x66c0e0
jmp 0x46caa0