joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008de0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push edi
mov esi, ecx
push eax
push 0x202
mov dword [esi], 0x100933f8
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edx, edx
mov ecx, 0xc
xor eax, eax
lea edi, [esi + 8]
mov dword [esi + 0x70], edx
mov dword [esi + 0x6c], 0xffffffff
mov dword [esi + 4], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xc
xor eax, eax
lea edi, [esi + 0x3a]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x19c]
stosw word es:[edi], ax
mov dword [esi + 0x78], edx
mov dword [esi + 0x7c], edx
mov byte [esi + 0x80], dl
lea edx, [esi + 0x84]
push edx
mov dword [esi + 0x9c], ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret 4

Function at 0x10008f60
Capabilities:
Query service status
Stop service

Disassembly:
sub esp, 0x1c
push esi
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
mov eax, dword [esp + 0x28]
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
lea ecx, [esp + 8]
mov esi, eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0xc], 1
je 0x10008fa7
lea edx, [esp + 8]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x10008fc0
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 8]
mov dword [esp + 4], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x24]
lea eax, [esp + 4]
push eax
push accept
push ecx
push accept
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
pop edi
je 0x1000901a
mov ecx, dword [esp + 4]
xor eax, eax
cmp ecx, 4
sete al
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret
Function at 0x10009020
Capabilities:
Create tcp socket
Create thread
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
push str.MpsSvc
call fcn.10008fc0
add esp, 4
test eax, eax
je 0x10009044
push str.MpsSvc
call fcn.10008f60
add esp, 4
push str.SharedAccess
call fcn.10008fc0
add esp, 4
test eax, eax
je 0x10009062
push str.SharedAccess
call fcn.10008f60
add esp, 4
mov ecx, ebx
call fcn.10008ee0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [ebx + 0x6c], eax
jne 0x10009086
xor al, al
pop ebx
add esp, 0x14
ret 0x10
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0xa], eax
push ecx
mov dword [esp + 0x12], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x16], eax
mov word [esp + 0x1a], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
mov eax, dword [ebx + 0x6c]
lea edx, [esp + 8]
push 0x10
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x100090e1
mov ecx, dword [ebx + 0x6c]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
pop ebx
add esp, 0x14
ret 0x10
mov edx, dword [ebx + 0x6c]
push 0x32
push edx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x10009105
mov eax, dword [ebx + 0x6c]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [ebx + 0x6c]
push ebp
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0x14]
push ecx
push edx
push eax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [esp + 0x16]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [esp + 0x30]
and eax, 0xffff
mov dword [ebx + 4], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000919d
mov ebp, dword [esp + 0x34]
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000919d
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
lea esi, [ebx + 8]
not ecx
sub edi, ecx
mov eax, esi
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor eax, eax
and ecx, 3
lea edx, [ebx + 0x3a]
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100091c8
mov ecx, dword [ebx + 0x78]
push 0
push 0
push ebx
push 0x10009200
inc ecx
push 0
push 0
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x78], ecx
call esi
mov dword [ebx + 0x74], eax
mov edi, dword [ebx + 0x78]
push 0
push 0
push ebx
push 0x100092a0
inc edi
push 0
push 0
mov dword [ebx + 0x78], edi
mov byte [ebx + 0x80], 1
call esi
pop edi
pop esi
test eax, eax
mov dword [ebx + 0x70], eax
pop ebp
setne al
pop ebx
add esp, 0x14
ret 0x10
Function at 0x10009390
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push ecx
mov dword [esp + 0x1c], eax
mov word [esp + 0x10], 2
call dword [sym.imp.WS2_32.dll_htons]
mov esi, dword [esp + 0x24]
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
push esi
mov word [esp + 0x12], ax
call ebx
cmp eax, 0xffffffff
push esi
jne 0x100093e8
mov ecx, edi
call fcn.1000a270
test eax, eax
je 0x10009421
push esi
mov ecx, edi
call fcn.1000a270
push eax
call ebx
push 6
push 1
push 2
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [esp + 0x20]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x10009421
lea edx, [esp + 0xc]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1000942c
mov eax, dword [esi]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 0xc

Function at 0x10009440
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x14
push ebp
push 0x100dcf98
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebp, eax
test ebp, ebp
je 0x1000951d
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x10]
cmp dword [eax + ecx], 0
je 0x10009526
mov edx, dword [esp + 0x28]
xor ebx, ebx
mov byte [edx], 0
cmp word [ebp + 0xa], bx
jle 0x10009513
test ebx, ebx
jle 0x100094b8
mov edi, 0x100d106c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x28]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx]
xor eax, eax
lea ecx, [esp + 0x14]
mov al, byte [edx + ebx]
push eax
push 0x100d2294
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x28]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
movsx eax, word [ebp + 0xa]
cmp ebx, eax
jl 0x10009488
add dword [esp + 0x10], 4
jmp 0x10009464
mov eax, dword [esp + 0x1c]
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x14
ret
Function at 0x10009540
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x124
xor eax, eax
push esi
mov dword [esp + 8], eax
push 0x11
mov dword [esp + 0x10], eax
push 2
mov dword [esp + 0x18], eax
push 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0x10
mov word [esp + 0x24], 2
mov dword [esp + 0x28], eax
mov word [esp + 0x26], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000958e
xor eax, eax
pop esi
add esp, 0x124
ret
lea ecx, [esp + 0x18]
push 0x10
push ecx
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x100095ab
xor eax, eax
pop esi
add esp, 0x124
ret
mov edx, dword [esp + 0x130]
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
push esi
mov dword [edx], esi
call dword [sym.imp.WS2_32.dll_getsockname]
lea edx, [esp + 0x28]
push edx
call fcn.10009440
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x12c]
pop esi
mov dword [ecx + 4], eax
mov ax, word [esp + 6]
mov word [ecx + 8], ax
mov eax, 1
add esp, 0x124
ret

Function at 0x10009600
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
test esi, esi
jle 0x1000963b
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
push ebp
push 0
lea ecx, [edi + eax]
push esi
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x10009642
sub esi, eax
add edi, eax
test esi, esi
jg 0x10009616
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x1000a060
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x214]
push ebp
push esi
mov al, byte [ebx]
push edi
cmp al, 5
mov dword [esp + 0x14], ecx
mov byte [esp + 0x12], 5
mov byte [esp + 0x13], 0
je 0x1000a097
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x208
ret 0xc
mov al, byte [ebx + 2]
lea esi, [ebx + 2]
test al, al
je 0x1000a0b4
cmp al, 2
je 0x1000a0b4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret 0xc
lea ebp, [ecx + 8]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
neg ecx
sbb cl, cl
lea eax, [esp + 0x16]
and ecx, 2
push 2
mov byte [esp + 0x1b], cl
mov ecx, dword [esp + 0x224]
push eax
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1000a0fa
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret 0xc
cmp byte [esp + 0x13], 2
jne 0x1000a254
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x18]
push eax
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x11c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x220]
push 0x5000
push ebx
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1000a245
test eax, eax
je 0x1000a245
cmp byte [ebx], 1
je 0x1000a15c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret 0xc
mov al, byte [ebx + 1]
test al, al
je 0x1000a185
mov ecx, eax
and ecx, 0xff
cmp ecx, 0x100
jg 0x1000a185
mov edx, ecx
lea edi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and eax, 0xff
add eax, ebx
movsx ecx, byte [eax + 2]
test ecx, ecx
je 0x1000a1b4
cmp ecx, 0x100
jg 0x1000a1b4
lea esi, [eax + 3]
mov eax, ecx
lea edi, [esp + 0x118]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [esp + 0x18]
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1000a1de
test cl, cl
je 0x1000a1da
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1000a1de
add eax, 2
add esi, 2
test cl, cl
jne 0x1000a1ba
xor eax, eax
jmp 0x1000a1e3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000a227
mov eax, dword [esp + 0x14]
lea esi, [esp + 0x118]
add eax, 0x3a
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1000a219
test cl, cl
je 0x1000a215
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1000a219
add eax, 2
add esi, 2
test cl, cl
jne 0x1000a1f5
xor eax, eax
jmp 0x1000a21e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000a227
mov byte [ebx + 1], al
jmp 0x1000a22b
mov byte [ebx + 1], 0xff
mov eax, dword [esp + 0x21c]
push 0
push 2
push ebx
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1000a254
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x208
ret 0xc
Function at 0x1000a270
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1000a282
ret 4
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
ret 4

Function at 0x1000a430
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push eax
push esi
mov ebx, ecx
push edi
call fcn.1000a060
test eax, eax
je 0x1000a4b8
cmp eax, 4
jne 0x1000a458
pop edi
pop esi
pop ebx
ret 0x14
mov ecx, dword [edi]
push 0
push 0x5000
push esi
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1000a4b8
test eax, eax
je 0x1000a4b8
cmp byte [esi], 5
jne 0x1000a4b8
mov cl, byte [esi + 3]
cmp cl, 1
je 0x1000a484
cmp cl, 3
jne 0x1000a4b8
mov edx, dword [esp + 0x20]
and ecx, 0xff
push edx
mov edx, dword [esp + 0x20]
push edx
push ecx
push eax
push esi
mov ecx, ebx
call fcn.1000a2a0
test eax, eax
je 0x1000a4b8
mov al, byte [esi + 1]
cmp al, 1
je 0x1000a4ad
cmp al, 3
jne 0x1000a4b8
pop edi
pop esi
and eax, 0xff
pop ebx
ret 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x14
Function at 0x1000a4d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007407e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [esp + 0x54]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.10007fd0
mov dword [esp + 0x5c], 0
mov dword [esi + 0x34], 0x10093404
mov dword [esp + 0x14], 0x7f8a
mov dword [esp + 0x18], 0x7f00
mov dword [esp + 0x1c], 0x7f03
mov dword [esp + 0x20], 0x7f89
mov dword [esp + 0x24], 0x7f8b
mov dword [esp + 0x28], 0x7f01
mov dword [esp + 0x2c], 0x7f81
mov dword [esp + 0x30], 0x7f88
mov dword [esp + 0x34], 0x7f80
mov dword [esp + 0x38], 0x7f86
mov dword [esp + 0x3c], 0x7f83
mov dword [esp + 0x40], 0x7f85
mov dword [esp + 0x44], 0x7f82
mov dword [esp + 0x48], 0x7f84
mov dword [esp + 0x4c], 0x7f04
mov dword [esp + 0x50], 0x7f02
lea ebx, [esp + 0x14]
lea edi, [esi + 0x78]
mov ebp, 0x10
mov eax, dword [ebx]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [edi], eax
add ebx, 4
add edi, 4
dec ebp
jne 0x1000a597
mov ebx, 1
push 0x1f0
mov byte [esp + 0x60], bl
mov dword [esi], 0x100933fc
mov byte [esi + 0x18], bl
mov dword [esi + 0x20], 0x20
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x64], eax
xor edi, edi
mov byte [esp + 0x5c], 2
cmp eax, edi
je 0x1000a5f3
push 0x19
push edi
push 0x20
mov ecx, eax
call fcn.1000b2c0
jmp 0x1000a5f5
xor eax, eax
mov ecx, esi
mov byte [esp + 0x5c], bl
mov dword [esi + 0xb8], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c], edi
call fcn.1000a8d0
push edi
mov dword [esi + 0x24], eax
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push edi
push esi
push 0x1000acf0
push edi
push edi
mov dword [esi + 0x28], eax
call fcn.1000c510
push ebx
push edi
push edi
push esi
push 0x1000ad60
push edi
push edi
mov dword [esi + 0x2c], eax
call fcn.1000c510
mov ecx, dword [esp + 0x8c]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 4
Function at 0x1000a690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100740a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x100933fc
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea eax, [esi + 0x14]
push 0
push eax
mov dword [esp + 0x24], 1
call edi
lea ecx, [esi + 0xc]
push 0
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push edx
call edi
mov eax, dword [esi + 0x30]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esi + 0x30]
push edx
call edi
mov eax, dword [esi + 0x28]
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esi + 0x24]
push ecx
mov ecx, esi
call fcn.1000a900
push 0
call sub.USER32.dll_BlockInput
mov ecx, dword [esi + 0xb8]
test ecx, ecx
je 0x1000a72a
mov edx, dword [ecx]
push 1
call dword [edx]
mov ebp, dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [esi + 0xb8], 0
mov dword [esi + 0x34], 0x10093404
lea edi, [esi + 0x78]
mov ebx, 0x10
mov eax, dword [edi]
push eax
call ebp
add edi, 4
dec ebx
jne 0x1000a749
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
call fcn.10008020
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1000a900
Capabilities:
Set registry value

Disassembly:
sub esp, 0x408
push esi
push edi
push str.DwmEnableComposition
push str.Dwmapi.dll
call fcn.100078a0
mov esi, eax
add esp, 8
test esi, esi
je 0x1000a9ad
mov edi, dword [esp + 0x414]
xor eax, eax
test edi, edi
push str.SoftwareMicrosoftWindowsDWM
lea ecx, [esp + 0x14]
sete al
push 0x100d1c94
push ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
push 2
push 0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000a9ad
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push eax
push str.SuppressDisableCompositionUI
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1000a99f
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x408
ret 4
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call esi
pop edi
pop esi
add esp, 0x408
ret 4
Function at 0x1000b140
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1000b1a8
push ebx
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [esp + 0x10]
push esi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1000b1a0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, esi
mov esi, dword [esp + 0x10]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
ret 8

Function at 0x1000b1b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 8
push esi
mov dword [esp + 8], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1000b242
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
jne 0x1000b1e1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
add esp, 8
ret
push ebx
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ebx, eax
push esi
inc ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov esi, eax
call sub.MFC42.DLL_operatornew
lea ecx, [ebx - 1]
mov ebp, eax
mov eax, ecx
add esp, 4
lea edi, [ebp + 1]
mov byte [ebp], 0xf
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x14]
push ebx
push ebp
call fcn.10008050
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
Function at 0x1000b7a0
Capabilities:
Check for time delay via queryperformancecounter
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
mov esi, ecx
test ebx, ebx
je 0x1000b94b
mov eax, dword [esi + 0x78]
test eax, eax
je 0x1000b94b
push ebp
push edi
call fcn.1000bfc0
mov al, byte [esi + 0x10]
lea ecx, [esp + 0x3c]
push 1
push ecx
mov ecx, esi
mov dword [esi + 0x7c], 0
mov byte [esp + 0x44], al
call fcn.1000bde0
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
fild dword [esi + 0x1c]
push 0
fstp dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fdivr dword [esp + 0x18]
fild dword [esp + 0x1c]
fmul st(1)
fadd dword [0x10093410]
call sub.MSVCRT.dll__ftol
fild dword [esp + 0x20]
mov dword [esp + 0x1c], eax
fmul st(1)
fadd dword [0x10093410]
call sub.MSVCRT.dll__ftol
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 8
push eax
mov ecx, esi
fstp st(0)
call fcn.1000bde0
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x14
push ecx
call dword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x1000b88b
cmp dword [esp + 0x28], 1
jne 0x1000b88b
mov ecx, dword [esp + 0x2c]
xor edi, edi
lea eax, [esi + 0x1ac]
cmp ecx, dword [eax]
je 0x1000b878
inc edi
add eax, 4
cmp edi, 0x10
jl 0x1000b86b
push ecx
call dword [sym.imp.USER32.dll_DestroyCursor]
cmp edi, 0x10
jne 0x1000b887
or edi, 0xffffffff
mov eax, edi
jmp 0x1000b88e
or eax, 0xffffffff
lea edx, [esp + 0x13]
push 1
push edx
mov ecx, esi
mov byte [esp + 0x1b], al
call fcn.1000bde0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x48]
mov edx, dword [esi + 0x20]
push eax
mov eax, dword [esi + 0x1c]
push 0
push 0
push ecx
mov ecx, dword [esi + 0x50]
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov al, byte [esp + 0x3c]
cmp al, 1
jne 0x1000b8d5
push 1
mov ecx, esi
call fcn.1000b960
jmp 0x1000b901
cmp al, 2
jne 0x1000b901
mov edx, dword [esi + 0x64]
mov ecx, dword [esi + 0x7c]
mov eax, dword [edx + 0x14]
mov edx, dword [esi + 0x5c]
push eax
mov eax, dword [esi + 0x78]
add ecx, eax
push ecx
push edx
lea ecx, [esi + 0x84]
call fcn.1000d3b0
test eax, eax
mov dword [ebx], eax
jbe 0x1000b901
add dword [esi + 0x7c], eax
mov eax, dword [esi + 0x7c]
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebx], eax
lea edi, [esi + 0x40]
lea ebx, [esi + 0x38]
push edi
call ebp
mov ecx, dword [edi]
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
sub ecx, eax
mov eax, dword [edi + 4]
sbb eax, edx
mov edx, dword [esi + 0x34]
cmp eax, edx
jg 0x1000b93b
jl 0x1000b931
cmp ecx, dword [esi + 0x30]
jae 0x1000b93b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000b912
push ebx
call ebp
mov eax, dword [esi + 0x78]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x28
ret 4
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret 4