joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b5dd
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41b61c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b61c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41b61c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41b61c
cmp dword [ecx + 0x74], 0xe
jbe 0x41b61c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x422d8b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x422e28
push ebx
push esi
call fcn.00422d54
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00422ce8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x422dd5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x422e27
push edi
push eax
call fcn.00421820
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x422df5
call fcn.0042186e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x422e26
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00422ce8
add esp, 0x20
test eax, eax
jne 0x422e14
push edi
call fcn.0042186e
jmp 0x422e1c
push ebx
call fcn.0042186e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x424037
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c9a0
push 0x42c998
push str.FlsAlloc
push 0x1f
call fcn.00423ef6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42406b
push dword [ebp + 8]
mov ecx, esi
call dword [0x42a144]
call esi
jmp 0x424071
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4240b5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c9b0
push 0x42c9a8
push str.FlsGetValue
push 0x21
call fcn.00423ef6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4240ec
push dword [ebp + 8]
mov ecx, esi
call dword [0x42a144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4240f4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c9b8
push 0x42c9b0
push str.FlsSetValue
push 0x22
call fcn.00423ef6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42412e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42a144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x429410
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42943d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42943d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4013f0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x442118]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x401403
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x401444
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x4421c0]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x401476
mov bl, byte [esp + ecx + 0x4c]
jmp 0x40147a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x40146b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x401498
mov bl, byte [esp + ecx + 0x4c]
jmp 0x40149c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x40148d
xor ecx, ecx
mov eax, 0x442128
xor ebx, ebx
mov bl, byte [ecx + 0x4421d0]
cmp byte [esp + ebx + 0x14], 0
je 0x4014c7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x4421e8]
cmp byte [esp + ebx + 0x14], 0
je 0x4014de
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4014ae
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x401437
lea edx, [esp + 0x84]
push edx
call fcn.00401520
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x402a00
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, ecx
push edi
mov edi, dword [ebp + 0x18]
test edi, edi
jne 0x402a25
push str.Error_opening_log_file_n
push edi
push ebp
mov byte [ebp + 5], 1
mov byte [ebp + 4], 0
call fcn.004024a0
add esp, 0xc
pop edi
pop ebp
ret
mov al, byte [ebp + 0x1c]
push ebx
test al, al
mov byte [ebp + 4], 1
mov dword [ebp + 0x28], 0
jne 0x402abe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 4
push ecx
call fcn.004305ac
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x402abe
mov edi, dword [ebp + 0x18]
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..bak
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp + 0x18]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push ebx
call fcn.004304f0
add esp, 4
pop esi
mov ecx, dword [ebp + 0x18]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0x14], eax
pop ebx
jne 0x402aff
mov edx, dword [ebp + 0x18]
mov byte [ebp + 5], 1
push edx
push str.Error_opening_log_file__s_n
push 0
push ebp
mov byte [ebp + 4], 0
call fcn.004024a0
add esp, 0x10
mov al, byte [ebp + 0x1c]
test al, al
je 0x402b19
mov eax, dword [ebp + 0x14]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop ebp
ret
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop ebp
ret
Function at 0x403590
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4049a0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x100
push ebx
push esi
mov esi, dword [esp + 0x10c]
mov ebx, ecx
test esi, esi
jne 0x4049df
push edi
mov edi, str._No_Window_Selected_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
jmp 0x404a1f
lea ecx, [esp + 8]
push 0x100
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 8]
test al, al
jne 0x404a1f
push esi
lea edx, [esp + 0xc]
push str.0x_x
push edx
call fcn.00430e5e
mov ecx, 0x100
add esp, 0xc
sub ecx, eax
lea edx, [esp + eax + 8]
push ecx
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov ecx, dword [ebx + 4]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
pop ebx
add esp, 0x100
ret 4
Function at 0x408cc0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x100
lea eax, [esp]
push esi
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esi, dword [esp + 0x108]
mov ecx, esi
and ecx, 0xff
test byte [esp + ecx + 4], 1
je 0x408d02
push edi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 1
push 0
push esi
call edi
push 0
push 3
push 0
push esi
call edi
pop edi
pop esi
add esp, 0x100
ret

Function at 0x40aa37
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43a272
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x78]
call fcn.00418d80
xor ebx, ebx
lea ecx, [esi + 0x7c]
mov dword [esp + 0x14], ebx
call fcn.00418d80
lea ecx, [esi + 0x80]
mov byte [esp + 0x14], 1
call fcn.00418d80
lea ecx, [esi + 0x84]
mov byte [esp + 0x14], 2
call fcn.00424fb0
push 0x444194
push 9
push 0x44b018
mov byte [esp + 0x20], 3
mov dword [esi], 0x43c5a4
call fcn.004024a0
mov ecx, dword [esp + 0x18]
add esp, 0xc
or eax, 0xffffffff
mov dword [esi + 0x28], ebx
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x50], ebx
mov byte [esi + 0x55], bl
mov word [esi + 0x56], bx
mov word [esi + 0x58], bx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0xd4], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40c150
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x40c210
push 0x2000
mov dword [esp + 0xc], 0
mov dword [esi + 0x300], 0x2000
call fcn.004305ac
mov ecx, dword [esi + 0x300]
mov edx, dword [esi + 0xe4]
add esp, 4
mov edi, eax
lea eax, [esp + 8]
push 0
push eax
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [esp + 8]
je 0x40c1f0
test eax, eax
jne 0x40c1f0
mov eax, dword [esi + 0x2f4]
mov ecx, esi
push eax
call fcn.0040c110
lea ecx, [esi + 0x1f0]
push ecx
push str.D:_vncwinvnc_vncClient.cpp:_tfile_download_complete:__s_n
push 1
push 0x44b018
call fcn.004024a0
mov edx, dword [esi + 0xe4]
add esp, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xe0], 0
pop edi
pop esi
pop ecx
ret
push edi
push eax
mov ecx, esi
call fcn.0040c220
push edi
call fcn.004304f0
mov eax, dword [0x44b910]
push 0
push esi
push eax
call fcn.004222e0
add esp, 0x10
pop edi
pop esi
pop ecx
ret

Function at 0x40cb80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43a45b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x34]
call fcn.00424fb0
xor edi, edi
lea ecx, [esi + 0x4f0]
mov dword [esp + 0x14], edi
call fcn.00418d80
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x4b4], edi
mov dword [esi + 0x4cc], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi], edi
mov dword [esi + 0x4d0], edi
mov dword [esi + 0x4dc], edi
mov dword [esi + 0x4e0], edi
mov dword [esi + 0x4d4], edi
mov dword [esi + 0x4d8], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x4e4], edi
mov dword [esi + 0x4f4], edi
mov dword [esi + 0x24], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40cb96
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43a45b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x34]
call fcn.00424fb0
xor edi, edi
lea ecx, [esi + 0x4f0]
mov dword [esp + 0x14], edi
call fcn.00418d80
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x4b4], edi
mov dword [esi + 0x4cc], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi], edi
mov dword [esi + 0x4d0], edi
mov dword [esi + 0x4dc], edi
mov dword [esi + 0x4e0], edi
mov dword [esi + 0x4d4], edi
mov dword [esi + 0x4d8], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x4e4], edi
mov dword [esi + 0x4f4], edi
mov dword [esi + 0x24], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40d150
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x5c
push esi
mov esi, ecx
push 0x94
call fcn.004305ac
add esp, 4
mov dword [esi + 0x4e4], eax
push eax
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
jne 0x40d1a7
push str.D:_vncwinvnc_vncDesktop.cpp:_tSCR_WBB:_could_not_get_current_display_settings__n
push 9
push 0x44b018
call fcn.004024a0
mov eax, dword [esi + 0x4e4]
push eax
call fcn.004304f0
add esp, 0x10
mov dword [esi + 0x4e4], 0
pop esi
add esp, 0x5c
ret
mov eax, dword [esi + 0x4e4]
push ebx
push edi
mov ecx, dword [eax + 0x78]
mov edx, dword [eax + 0x68]
push ecx
mov ecx, dword [eax + 0x70]
push edx
mov edx, dword [eax + 0x6c]
push ecx
push edx
push str.D:_vncwinvnc_vncDesktop.cpp:_tSCR_WBB:_current_display:_w_d_h_d_bpp_d_vRfrsh_d._n
push 9
push 0x44b018
call fcn.004024a0
mov eax, dword [esi + 0x4e4]
add esp, 0x1c
mov ecx, dword [eax + 0x6c]
mov dword [esi + 0x4e8], ecx
mov edx, dword [eax + 0x70]
lea eax, [esp + 0x10]
mov dword [esi + 0x4ec], edx
push eax
push 0x20019
push 0
push str.SoftwareORLWinVNC3
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.ResWidth
push ecx
mov dword [esp + 0x2c], 0x50
call ebx
cmp dword [esp + 0xc], 1
jne 0x40d306
lea edx, [esp + 0x18]
push edx
call fcn.00430dc8
add esp, 4
test eax, eax
je 0x40d306
lea eax, [esp + 0x18]
push eax
call fcn.00430dc8
mov ecx, dword [esi + 0x4e4]
lea edi, [esp + 0x1c]
add esp, 4
lea edx, [esp + 0x14]
mov dword [ecx + 0x6c], eax
mov ecx, 0x14
xor eax, eax
push edx
mov edx, dword [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push str.ResHeight
push edx
call ebx
lea eax, [esp + 0x18]
push eax
call fcn.00430dc8
mov ecx, dword [esi + 0x4e4]
add esp, 4
mov dword [ecx + 0x70], eax
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x40d306
mov eax, dword [esi + 0x4e4]
mov ecx, dword [eax + 0x70]
test ecx, ecx
jbe 0x40d306
mov edx, dword [eax + 0x6c]
push ecx
push edx
push str.D:_vncwinvnc_vncDesktop.cpp:_tSCR_WBB:_attempting_to_change_resolution_w_d_h_d_n
push 9
push 0x44b018
call fcn.004024a0
mov eax, dword [esi + 0x4e4]
mov edi, dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
add esp, 0x14
push 2
push eax
call edi
test eax, eax
jne 0x40d306
mov ecx, dword [esi + 0x4e4]
push 1
push ecx
call edi
jmp 0x40d323
mov eax, dword [esi + 0x4e4]
test eax, eax
je 0x40d323
push eax
call fcn.004304f0
add esp, 4
mov dword [esi + 0x4e4], 0
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
pop ebx
je 0x40d334
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x5c
ret
Function at 0x40d360
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x5c
push esi
lea eax, [esp + 4]
push edi
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareORLWinVNC3
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea eax, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push eax
push esi
push str.OptimizeDesktop
push ecx
mov dword [esp + 0x24], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [esp + 0x10], 1
jne 0x40d471
mov al, byte [esp + 0x14]
cmp al, 0x59
je 0x40d3da
cmp al, 0x79
jne 0x40d471
push str.D:_vncwinvnc_vncDesktop.cpp:_tSCR_WBB:_desktop_optimization_enabled._n
push 9
push 0x44b018
call fcn.004024a0
push str.D:_vncwinvnc_vncDesktop.cpp:_tSCR_WBB:_attempting_to_disable_pattern._n
push 9
push 0x44b018
call fcn.004024a0
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
add esp, 0x18
push 2
push 0
push 0
push 0x15
call esi
push str.D:_vncwinvnc_vncDesktop.cpp:_tSCR_WBB:_attempting_to_disable_wallpaper._n
push 9
push 0x44b018
call fcn.004024a0
add esp, 0xc
push 2
push 0x44aff8
push 0
push 0x14
call esi
push str.D:_vncwinvnc_vncDesktop.cpp:_tSCR_WBB:_attempting_to_disable_font_smoothing._n
push 9
push 0x44b018
call fcn.004024a0
add esp, 0xc
push 2
push 0
push 0
push 0x4b
call esi
push str.D:_vncwinvnc_vncDesktop.cpp:_tSCR_WBB:_attempting_to_disable_full_window_drags._n
push 9
push 0x44b018
call fcn.004024a0
add esp, 0xc
push 2
push 0
push 0
push 0x25
call esi
mov esi, 1
mov eax, dword [esp + 8]
test eax, eax
je 0x40d480
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x5c
ret
Function at 0x40e0c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43a4e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x34]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.00424fd0
mov dword [esp + 0x18], 0
call dword [sym.imp.GDI32.dll_GdiFlush]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
test ebx, ebx
jne 0x40e117
mov dword [esp + 0x18], 0xffffffff
mov ecx, edi
jmp 0x40e16f
mov edi, dword [esp + 0x20]
mov edx, dword [esi + 0x2c]
push ebp
push 0xcc0020
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
push edx
mov edx, dword [edi + 0xc]
sub edx, eax
push edx
mov edx, dword [edi + 8]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x28]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esi + 0x28]
push ebx
push ecx
mov ebp, eax
call dword [sym.imp.GDI32.dll_SelectObject]
test ebp, ebp
pop ebp
je 0x40e163
mov edx, dword [esp + 0x24]
mov ecx, esi
push edx
push edi
call fcn.0040e560
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.00424fe0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x40e4e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [ecx + 0xc]
push ebx
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40e554
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40e554
mov esi, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40e554
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
ret 4
Function at 0x410bc0
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push esi
xor esi, esi
cmp eax, 8
push edi
mov byte [esp + 0xc], 0
je 0x410c11
cmp eax, 0x10
jne 0x410be7
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
pop esi
mov ax, word [ecx]
pop ebx
pop ecx
ret
cmp eax, 0x20
jne 0x410bf7
mov edx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov eax, dword [edx]
pop ecx
ret
push eax
push str.getBgColour:_bpp__d__n
push 0x449f00
call fcn.00431b45
add esp, 0xc
push 1
call fcn.00431a52
mov ecx, 0x100
xor eax, eax
mov edi, 0x44b07c
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x18]
xor ecx, ecx
test edi, edi
jle 0x410c5c
mov edx, dword [esp + 0x14]
xor eax, eax
mov al, byte [ecx + edx]
cmp eax, 0x100
jge 0x410c6a
mov ebx, dword [eax*4 + 0x44b07c]
inc ebx
mov dword [eax*4 + 0x44b07c], ebx
mov eax, ebx
cmp eax, esi
jle 0x410c57
mov esi, eax
mov al, byte [ecx + edx]
mov byte [esp + 0xc], al
inc ecx
cmp ecx, edi
jl 0x410c2d
mov eax, dword [esp + 0xc]
pop edi
pop esi
and eax, 0xff
pop ebx
pop ecx
ret
push eax
push str.getBgColour
push str._s:_unusual_colour___d_n
push 0x449f00
call fcn.00431b45
add esp, 0x10
push 1
call fcn.00431a52
nop
nop
nop
nop
nop
nop
nop
mov eax, 0x44546c
ret

Function at 0x413240
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push esi
xor esi, esi
cmp eax, 8
push edi
mov byte [esp + 0xc], 0
je 0x413291
cmp eax, 0x10
jne 0x413267
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
pop esi
mov ax, word [ecx]
pop ebx
pop ecx
ret
cmp eax, 0x20
jne 0x413277
mov edx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov eax, dword [edx]
pop ecx
ret
push eax
push str.getBgColour:_bpp__d__n
push 0x449f00
call fcn.00431b45
add esp, 0xc
push 1
call fcn.00431a52
mov ecx, 0x100
xor eax, eax
mov edi, 0x44b48c
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x18]
xor ecx, ecx
test edi, edi
jle 0x4132dc
mov edx, dword [esp + 0x14]
xor eax, eax
mov al, byte [ecx + edx]
cmp eax, 0x100
jge 0x4132ea
mov ebx, dword [eax*4 + 0x44b48c]
inc ebx
mov dword [eax*4 + 0x44b48c], ebx
mov eax, ebx
cmp eax, esi
jle 0x4132d7
mov esi, eax
mov al, byte [ecx + edx]
mov byte [esp + 0xc], al
inc ecx
cmp ecx, edi
jl 0x4132ad
mov eax, dword [esp + 0xc]
pop edi
pop esi
and eax, 0xff
pop ebx
pop ecx
ret
push eax
push str.getBgColour
push str._s:_unusual_colour___d_n
push 0x449f00
call fcn.00431b45
add esp, 0x10
push 1
call fcn.00431a52
nop
nop
nop
nop
nop
nop
nop
mov eax, 0x445b24
ret