joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ff1d
Capabilities:
Create thread
Power down monitor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push str.user32
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test eax, eax
jne 0x40ff51
mov ecx, dword [esi + 0xe8]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x21c]
mov ecx, esi
call fcn.00410207
test eax, eax
je 0x40ff6b
mov ecx, dword [esi + 0xe8]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x21c]
call fcn.00419b43
xor edi, edi
inc edi
cmp eax, edi
jne 0x40ff8a
mov eax, dword [esi + 0x638]
cmp eax, ebx
je 0x40ffa3
movzx ecx, byte [ebp + 8]
push ecx
call eax
jmp 0x40ffa3
mov ecx, dword [esi + 0xe8]
movzx edx, byte [ebp + 8]
mov eax, dword [ecx]
push edx
call dword [eax + 0x110]
mov dword [esi + 0x604], edi
mov ecx, dword [esi + 0xe8]
mov eax, dword [ecx]
call dword [eax + 0x1ac]
test eax, eax
je 0x4100b5
mov ecx, dword [esi + 0xe8]
mov eax, dword [ecx]
call dword [eax + 0x220]
cmp byte [ebp + 8], bl
je 0x41004b
test eax, eax
jne 0x41001c
push ebx
push 0x100
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [esi + 0x5f8]
push ebx
push eax
push ebx
push 0x50
call edi
push ebx
push ebx
push 0x64
push 0x52
call edi
push ebx
push ebx
push 1
push 0x56
call edi
push 2
push 0xf170
push 0x112
push dword [esi + 0xf0]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4100b5
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push 0x4013e6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0xe4]
cmp dword [eax], ebx
mov dword [eax], ebx
setne cl
mov byte [esi + 0x5fc], cl
jmp 0x4100b5
test eax, eax
jne 0x41008d
mov eax, dword [esi + 0x5f8]
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
cmp eax, ebx
je 0x410066
push ebx
push ebx
push eax
push 0x52
call edi
push ebx
push ebx
push ebx
push 0x56
call edi
push 0xffffffffffffffff
push 0xf170
push 0x112
push dword [esi + 0xf0]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x5f8], ebx
jmp 0x4100b5
push ebx
push str.blackscreen
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x4100a8
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
movzx eax, byte [esi + 0x5fc]
mov dword [esi + 0xe4], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41040a
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov esi, ecx
je 0x4104ed
lea eax, [ebp - 0x158]
push 0x104
push eax
push ebx
mov dword [esi + 0x614], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x41046e
lea eax, [ebp - 0x158]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x410509
mov byte [eax], bl
lea eax, [ebp - 0x158]
push str.16bithlp.exe
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x44
lea eax, [ebp - 0x54]
pop edi
push edi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], edi
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x158]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4104b7
push str.C:DATASCZ_SCwinvncwinvnc_vncdesktop.cpp_:_set_ddihooks_Failed_n
push ebx
push 0x4378c8
call fcn.004053a7
add esp, 0xc
jmp 0x410503
push str.C:DATASCZ_SCwinvncwinvnc_vncdesktop.cpp_:_set_ddihooks_OK_n
push ebx
push 0x4378c8
call fcn.004053a7
add esp, 0xc
mov dword [esi + 0x5f4], 1
push 0x2710
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x614], eax
jmp 0x410509
lea edi, [esi + 0x614]
mov eax, dword [edi]
cmp eax, ebx
je 0x410509
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [edi], ebx
mov dword [esi + 0x5f4], ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41400a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push str.C:DATASCZ_SCwinvncwinvnc_vncencoder.cpp_:_remote_palette_data_requested_n
mov ebx, 0x4378c8
push 9
push ebx
mov esi, ecx
call fcn.004053a7
add esp, 0xc
cmp byte [esi + 0x13], 0
jne 0x41403f
mov ecx, esi
call fcn.00414191
test eax, eax
je 0x41411e
cmp byte [esi + 0x23], 0
jne 0x41411e
cmp byte [esi + 0x13], 0
je 0x414122
push str.C:DATASCZ_SCwinvncwinvnc_vncencoder.cpp_:_generating_BGR233_palette_data_n
push 9
push ebx
call fcn.004053a7
mov cl, byte [esi + 0x30]
xor ebx, ebx
inc ebx
lea edi, [esi + 0xc]
shl ebx, cl
mov eax, dword [edi]
add esp, 0xc
test eax, eax
mov dword [ebp - 8], ebx
je 0x41407f
push eax
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov eax, ebx
shl eax, 2
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [edi], eax
je 0x414104
and dword [ebp - 4], 0
test ebx, ebx
jle 0x414104
lea ebx, [eax + 1]
mov eax, dword [ebp - 4]
mov cl, byte [esi + 0x3c]
movzx edx, word [esi + 0x38]
sar eax, cl
movzx ecx, word [esi + 0x38]
and eax, edx
imul eax, eax, 0xff
cdq
idiv ecx
mov byte [ebx - 1], al
mov eax, dword [ebp - 4]
mov cl, byte [esi + 0x3a]
movzx edx, word [esi + 0x34]
sar eax, cl
movzx ecx, word [esi + 0x34]
and eax, edx
imul eax, eax, 0xff
cdq
idiv ecx
mov byte [ebx + 1], al
mov eax, dword [ebp - 4]
mov cl, byte [esi + 0x3b]
movzx edx, word [esi + 0x36]
sar eax, cl
movzx ecx, word [esi + 0x36]
and eax, edx
imul eax, eax, 0xff
cdq
idiv ecx
inc dword [ebp - 4]
mov byte [ebx], al
mov eax, dword [ebp - 4]
add ebx, 4
cmp eax, dword [ebp - 8]
jl 0x41409d
mov ebx, 0x4378c8
mov edi, dword [edi]
test edi, edi
jne 0x414174
push str.C:DATASCZ_SCwinvncwinvnc_vncencoder.cpp_:_failed_to_obtain_colour_map_data__n
push edi
push ebx
call fcn.004053a7
add esp, 0xc
xor eax, eax
jmp 0x41418a
push str.C:DATASCZ_SCwinvncwinvnc_vncencoder.cpp_:_generating_8_bit_palette_data_n
push 9
push ebx
call fcn.004053a7
and byte [ebp - 0x16], 0
and byte [ebp - 0xc], 0
lea edi, [esi + 0xc]
lea eax, [ebp - 0x18]
add esi, 0x10
push eax
push esi
push edi
mov byte [ebp - 0x15], 1
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 0x18
mov word [ebp - 0x10], 0xff
mov word [ebp - 0x12], 0xff
mov word [ebp - 0x14], 0xff
mov byte [ebp - 0xe], 0x10
mov byte [ebp - 0xd], 8
call dword [0x430b94]
add esp, 0x18
jmp 0x414109
mov eax, dword [ebp + 0xc]
shl eax, 2
push eax
push edi
push dword [ebp + 8]
call sub.MSVCRT.dll_memcpy
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4164ee
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.WinVNC_Win32_SC_Instance_Mutex
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
pop esi
test eax, eax
jne 0x416508
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret
Function at 0x416558
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
js 0x4165a6
mov eax, dword [esi + 4]
mov cl, byte [esi]
push 0
push eax
movzx eax, cl
push 0
push eax
mov byte [ebp - 4], cl
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_down_n
push 9
push 0x4378c8
call fcn.004053a7
add esp, 0x10
mov byte [esi + 8], 1
pop esi
leave
ret

Function at 0x4165a9
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x4165f9
mov eax, dword [esi + 4]
mov cl, byte [esi]
or al, 2
push 0
push eax
push 0
movzx eax, cl
push eax
mov byte [ebp - 4], cl
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_up_n
push 9
push 0x4378c8
call fcn.004053a7
add esp, 0x10
mov byte [esi + 9], 1
pop esi
leave
ret

Function at 0x4165fc
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor ecx, ecx
cmp byte [esi + 8], cl
je 0x416634
mov eax, dword [esi + 4]
mov dl, byte [esi]
or al, 2
push ecx
push eax
push ecx
movzx eax, dl
push eax
mov byte [ebp - 4], dl
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_up_n
jmp 0x41665f
cmp byte [esi + 9], cl
je 0x41666e
mov eax, dword [esi + 4]
mov dl, byte [esi]
push ecx
push eax
movzx eax, dl
push ecx
push eax
mov byte [ebp - 4], dl
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_down_n
push 9
push 0x4378c8
call fcn.004053a7
add esp, 0x10
pop esi
leave
ret
Function at 0x416fae
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
movzx edi, byte [esp + 0x14]
push edi
call ebp
mov esi, dword [esp + 0x18]
shr eax, 0xf
and eax, 1
mov dword [esp + 0xc], eax
je 0x416fe0
test esi, esi
jne 0x41704b
mov ecx, 0x4354a4
mov eax, str.down
jmp 0x416fee
test esi, esi
je 0x41704b
mov ecx, str.down
mov eax, 0x4354a4
push ebx
push ecx
push eax
push edi
push str.C:DATASCZ_SCwinvncwinvnc_vnckeymap.cpp_:_setshiftstate__d_____s___s__n
mov ebx, 0x4378c8
push 9
push ebx
call fcn.004053a7
add esp, 0x18
neg esi
sbb esi, esi
push 0
and esi, 0xfffffffe
inc esi
inc esi
push esi
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_keybd_event]
push edi
call ebp
test ah, ah
mov eax, str.down
js 0x417038
mov eax, 0x4354a4
push eax
push edi
push str.C:DATASCZ_SCwinvncwinvnc_vnckeymap.cpp_:_new_state__d___s__n
push 9
push ebx
call fcn.004053a7
add esp, 0x14
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x4182a1
Capabilities:
Move file

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, ebx
jne 0x4182c9
push str.Error_opening_log_file_n
push ebx
push esi
mov byte [esi + 5], 1
mov byte [esi + 4], bl
call fcn.004053a7
add esp, 0xc
jmp 0x418373
cmp byte [esi + 0x18], bl
push edi
mov byte [esi + 4], 1
jne 0x418314
push eax
call sub.MSVCRT.dll_strlen
add eax, 5
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x418314
push dword [esi + 0x14]
push edi
call sub.MSVCRT.dll_strcpy
push str..bak
push edi
call sub.MSVCRT.dll_strcat
add esp, 0x10
push 1
push edi
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, esi
call fcn.00418376
push ebx
push 0x80
push 4
push ebx
push 1
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
pop edi
jne 0x418356
push dword [esi + 0x14]
mov byte [esi + 5], 1
mov byte [esi + 4], bl
push str.Error_opening_log_file__s_n
push ebx
push esi
call fcn.004053a7
add esp, 0x10
cmp byte [esi + 0x18], bl
je 0x41836a
push 2
push ebx
push ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x418373
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
pop ebx
ret
Function at 0x418559
Capabilities:
Check os version
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
push esi
lea eax, [ebp - 0xe8]
push edi
push eax
mov dword [ebp - 0xe8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xe4], 6
jb 0x418678
lea eax, [ebp - 0x18]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
mov edi, 0x20019
push esi
push edi
push esi
push esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x418678
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push str.System
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4185da
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x418678
push 4
lea eax, [ebp - 0xc]
pop edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push esi
push str.ConsentPromptBehaviorAdmin
mov dword [ebp - 8], edi
push dword [ebp - 0x10]
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x418678
cmp dword [ebp - 8], edi
jne 0x418678
cmp dword [ebp - 0xc], edi
jne 0x418678
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x4354fc], eax
call edi
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x1ec]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x1ec]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x48], str.runas
mov dword [ebp - 0x40], str._dis_auc
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
pop esi
leave
ret
Function at 0x41867c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x418736
lea eax, [ebp - 8]
push eax
push 0x2001f
push ebx
push str.System
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4186d7
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x418736
push 4
lea eax, [ebp - 0x14]
pop esi
mov edi, str.ConsentPromptBehaviorAdmin
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
mov dword [ebp - 0x10], esi
push dword [ebp - 8]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x418736
cmp dword [ebp - 0x10], esi
jne 0x418736
cmp dword [ebp - 0x14], esi
jne 0x418736
mov eax, dword [ebp - 4]
push esi
mov dword [0x4354fc], eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
push edi
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4187fd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, 0x63
mov byte [0x43b2de], bl
mov dword [0x4354fc], eax
je 0x41888e
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41888e
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push str.System
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x418864
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41888e
push esi
push 4
push 0x4354fc
push 4
push ebx
push str.ConsentPromptBehaviorAdmin
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp + 8]
call esi
pop esi
pop ebx
leave
ret
Function at 0x418c2d
Capabilities:
Check os version
Create process on windows

Disassembly:
call fcn.00418c46
call fcn.00402c22
cmp byte [0x43b2de], 0
je 0x418c45
jmp fcn.0041873b
ret

Function at 0x418cd2
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
lea eax, [ebp - 0x108]
push 0x100
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
je 0x418cfd
push dword [ebp + 0xc]
push str.Host_name_unavailable
jmp 0x418d1a
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x418d2b
push dword [ebp + 0xc]
push str.IP_address_unavailable
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
jmp 0x418dce
mov eax, dword [ebp + 8]
and byte [eax], 0
mov eax, dword [esi + 0xc]
cmp dword [eax], edi
je 0x418dce
push ebx
xor ebx, ebx
cmp word [esi + 0xa], bx
jle 0x418d87
mov eax, dword [esi + 0xc]
mov eax, dword [edi + eax]
movzx eax, byte [eax + ebx]
push eax
lea eax, [ebp - 8]
push 0x431588
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov ecx, dword [ebp + 0xc]
sub ecx, eax
lea eax, [ebp - 8]
dec ecx
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strncat]
movsx eax, word [esi + 0xa]
add esp, 0x1c
inc ebx
cmp ebx, eax
jl 0x418d45
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov ebx, dword [ebp + 8]
add edi, 4
pop ecx
and byte [eax + ebx - 1], 0
mov eax, dword [esi + 0xc]
cmp dword [edi + eax], 0
je 0x418dc0
push ebx
call sub.MSVCRT.dll_strlen
mov ecx, dword [ebp + 0xc]
sub ecx, eax
dec ecx
push ecx
push 0x431584
push ebx
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0x10
mov eax, dword [esi + 0xc]
cmp dword [edi + eax], 0
jne 0x418d3d
pop ebx
pop edi
pop esi
leave
ret

Function at 0x419b43
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x84]
dec eax
je 0x419b8f
dec eax
je 0x419b73
xor eax, eax
leave
ret
cmp dword [ebp - 0x90], 5
jb 0x419b81
xor eax, eax
inc eax
leave
ret
cmp dword [ebp - 0x90], 4
ja 0x419b8f
push 3
pop eax
leave
ret
mov eax, dword [ebp - 0x8c]
neg eax
sbb eax, eax
add eax, 5
leave
ret
Function at 0x41ce94
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
xor edi, edi
cmp dword [0x437e50], 2
jne 0x41cf15
call fcn.0041d4a6
test eax, eax
je 0x41cf15
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
cmp eax, edi
je 0x41cf68
lea ecx, [ebp - 4]
push ecx
push edi
push edi
push 4
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 4], edi
jne 0x41cf0d
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov dword [0x437e58], edi
mov esi, 0x437894
push esi
call sub.MSVCRT.dll_strlen
cmp eax, dword [ebp + 0xc]
pop ecx
jae 0x41cf68
push esi
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x41cf6a
cmp dword [0x437e58], edi
je 0x41ceec
mov eax, dword [0x437e50]
cmp eax, edi
jbe 0x41cf68
cmp eax, 2
ja 0x41cf68
mov ebx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x41cf08
call esi
cmp eax, 0x4dd
jne 0x41cf52
mov esi, 0x437894
push esi
call sub.MSVCRT.dll_strlen
cmp eax, ebx
jmp 0x41cefa
call esi
push eax
push str.C:DATASCZ_SCwinvncwinvnc_vncservice.cpp_:_getusername_error__d_n
push edi
push 0x4378c8
call fcn.004053a7
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41da0f
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push esi
push eax
push 2
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x41da33
and dword [esi], 0
jmp 0x41da43
mov ax, word [ebp - 0x190]
mov word [0x437e70], ax
or dword [esi], 0xffffffff
mov eax, esi
pop esi
leave
ret

Function at 0x41db37
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], 1
cmp dword [esi + 4], 0
jl 0x41db51
call fcn.0041db9c
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
test eax, eax
mov dword [esi + 4], eax
jge 0x41db68
xor eax, eax
jmp 0x41db98
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea ecx, [ebp - 4]
push 4
push ecx
push 8
push 0xffff
push eax
call edi
test eax, eax
jne 0x41db64
lea eax, [ebp - 4]
push 4
push eax
push 1
push 6
push dword [esi + 4]
call edi
neg eax
sbb eax, eax
neg eax
dec eax
pop edi
pop esi
leave
ret
Function at 0x41dc5f
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jl 0x41dce0
push 0x10
lea eax, [ebp - 0x10]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov word [ebp - 0x10], 2
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x41dcb0
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x41dce0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x41dce0
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
jne 0x41dcd5
or eax, 0xffffffff
jmp 0x41dce2
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop esi
leave
ret 8

Function at 0x41dd05
Capabilities:
Set socket configuration

Disassembly:
mov eax, 0x427ba6
call fcn.004268b0
push ecx
push ecx
mov eax, dword [ecx + 4]
push edi
test eax, eax
mov dword [ebp - 0x10], 1
jl 0x41dd31
push 0
push 0
push eax
call dword [sym.imp.WSOCK32.dll_accept]
mov edi, eax
test edi, edi
jge 0x41dd35
xor eax, eax
jmp 0x41dd88
push esi
push 0x2394
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x41dd57
call fcn.0041da54
mov esi, eax
jmp 0x41dd59
xor esi, esi
test esi, esi
je 0x41dd62
mov dword [esi + 4], edi
jmp 0x41dd72
push 2
push edi
call dword [sym.imp.WSOCK32.dll_shutdown]
push edi
call dword [sym.imp.WSOCK32.dll_closesocket]
lea eax, [ebp - 0x10]
push 4
push eax
push 1
push 6
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x41ddd9
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ecx + 4]
call dword [sym.imp.WSOCK32.dll_getsockname]
lea eax, [ebp - 0x14]
push 4
push eax
lea eax, [ebp - 8]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
test eax, eax
jne 0x41de1b
mov eax, str._unavailable_
leave
ret

Function at 0x41de1d
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x41de48
push dword [esp + 4]
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x41de46
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x41de46
mov eax, dword [eax]
ret
xor eax, eax
ret