joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418bd0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x2a0
lea eax, [esp + 0x1a0]
push ebx
push ebp
push esi
mov ebp, dword [esp + 0x2b0]
mov esi, ecx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esp + 0x2b4]
push edi
push eax
mov edx, dword [ecx + 0x3c]
push edx
push 0x41e
push ebp
call ebx
push eax
mov ecx, esi
call fcn.00418970
mov edi, 0x443c88
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x2b8]
mov eax, dword [edi + 0x3c]
push eax
push 4
push 0x110a
push 0x41e
push ebp
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call esi
test eax, eax
je 0x418ca7
mov ecx, dword [edi + 0x3c]
push ecx
push 4
push 0x110a
push 0x41e
push ebp
call ebx
push eax
call esi
push eax
push 0
push 0x1101
push 0x41e
push ebp
call ebx
push eax
call esi
mov edx, dword [edi + 0x3c]
push edx
push 4
push 0x110a
push 0x41e
push ebp
call ebx
push eax
call esi
test eax, eax
jne 0x418c64
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
lea eax, [esp + 0x70]
lea ecx, [esp + 0x1b0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
push 0
mov dword [esp + 0x14], edi
call esi
cmp edi, 0xffffffff
je 0x418ddf
mov esi, 0x443c84
lea eax, [esp + 0x9c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x418d07
test cl, cl
je 0x418d03
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x418d07
add eax, 2
add esi, 2
test cl, cl
jne 0x418ce3
xor eax, eax
jmp 0x418d0c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x418dbc
mov esi, 0x443c80
lea eax, [esp + 0x9c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x418d44
test cl, cl
je 0x418d40
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x418d44
add eax, 2
add esi, 2
test cl, cl
jne 0x418d20
xor eax, eax
jmp 0x418d49
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x418dbc
test byte [esp + 0x70], 0x10
je 0x418dbc
mov ecx, dword [esp + 0x2b8]
lea eax, [esp + 0x9c]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x14]
mov edx, dword [ecx + 0x3c]
push eax
push 0
mov ecx, 0xa
lea esi, [esp + 0x50]
lea edi, [esp + 0x24]
push 0x1100
mov dword [esp + 0x54], 1
mov dword [esp + 0x20], edx
push 0x41e
rep movsd dword es:[edi], dword [esi]
push ebp
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
push ecx
push 0
push 0x1100
push 0x41e
push ebp
call ebx
push eax
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418cd7
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret 8
Function at 0x41b0e0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x40c]
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x410]
push eax
push ecx
lea edx, [esp + 0x14]
push 0x3fe
push edx
call fcn.00431142
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
mov byte [esp + 0x40a], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x41b144
cmp ecx, 0x3fe
ja 0x41b144
cmp byte [esp + ecx + 0xb], 0xa
jne 0x41b144
mov byte [esp + ecx + 0xb], 0xd
mov byte [esp + ecx + 0xc], 0xa
mov byte [esp + ecx + 0xd], 0
mov al, byte [esi + 5]
test al, al
je 0x41b156
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [esi + 6]
test al, al
je 0x41b187
lea ecx, [esp + 8]
push 0
push ecx
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x14]
push ecx
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov al, byte [esi + 4]
test al, al
je 0x41b1b7
mov edx, dword [esi + 0xc]
test edx, edx
je 0x41b1b7
lea eax, [esp + 8]
push 0
push eax
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
add esp, 0x404
ret 8
Function at 0x41d2d0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
push str.options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret

Function at 0x41d7b0
Capabilities:
Persist via app paths registry key
Set registry value

Disassembly:
sub esp, 0x328
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push esi
push edi
push eax
push str..vnc
push accept
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41d7fb
mov ecx, dword [esp + 0xc]
push 0
push str.VncViewer.Config
push 1
push 0
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call edi
jmp 0x41d80f
push str.Failed_to_register_.vnc_extension_n
push 0
push 0x44a3a0
call fcn.004063e0
add esp, 0xc
lea eax, [esp + 0x14]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41d842
push str.Error_getting_vncviewer_filename_n
push eax
push 0x44a3a0
call fcn.004063e0
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x328
ret
lea ecx, [esp + 0x14]
push ecx
push str.Viewer_is__s_n
push 2
push 0x44a3a0
call fcn.004063e0
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push str.VncViewer.Config
push accept
call ebx
test eax, eax
jne 0x41d921
push eax
push str.VNCviewer_Config_File
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push str.DefaultIcon
push edx
call ebx
test eax, eax
jne 0x41d8cf
lea eax, [esp + 0x14]
lea ecx, [esp + 0x118]
push eax
push str._s_0
push ecx
call fcn.004309ee
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x118]
push 0
push edx
push 1
push 0
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push str.Shellopencommand
push eax
call ebx
test eax, eax
jne 0x41d91a
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
push str.__s___config____1_
push edx
call fcn.004309ee
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x118]
push 0
push eax
push 1
push 0
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_vncviewer.exe
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x41d94d
lea edx, [esp + 0x14]
push eax
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call edi
pop edi
pop esi
pop ebx
add esp, 0x328
ret

Function at 0x41fb70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
lea eax, [esp + 4]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x41fbad
mov eax, dword [esp]
add esp, 8
ret 0xc
Function at 0x41fee0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x50
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push ebx
push esi
push edi
mov edi, dword [esp + 0x64]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x443c90
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x60]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
add esp, 0x50
ret 8

Function at 0x41ff80
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc
Function at 0x41ffa0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
lea eax, [esp + 4]
push ebx
push eax
push str.SoftwareORLVNCviewerSettings
mov ebx, ecx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x420169
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push edi
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.SkipFullScreenPrompt
push ecx
mov dword [esp + 0x2c], 4
call esi
test eax, eax
mov edi, 1
jne 0x420009
cmp dword [esp + 0xc], edi
sete dl
mov byte [ebx + 0x10d], dl
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.NoToolbar
push eax
call esi
test eax, eax
jne 0x420037
cmp dword [esp + 0xc], edi
sete cl
mov byte [ebx + 0x10c], cl
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.LogToFile
push edx
call esi
test eax, eax
jne 0x420065
cmp dword [esp + 0xc], edi
sete al
mov byte [ebx + 0x374], al
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.HistoryLimit
push ecx
call esi
test eax, eax
jne 0x420090
mov edx, dword [esp + 0xc]
mov dword [ebx + 0x110], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.LocalCursor
push eax
call esi
test eax, eax
jne 0x4200bb
mov ecx, dword [esp + 0xc]
mov dword [ebx + 0x234], ecx
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.LogLevel
push edx
call esi
test eax, eax
jne 0x4200e6
mov eax, dword [esp + 0xc]
mov dword [ebx + 0x370], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.ListenPort
push ecx
call esi
test eax, eax
jne 0x42010e
mov edx, dword [esp + 0xc]
mov dword [ebx + 8], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.LogFileName
push eax
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
jne 0x42015c
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 0x376]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x114
ret
Function at 0x420180
Capabilities:
Set registry value

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push str.SoftwareORLVNCviewerSettings
mov ebx, ecx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebx + 0x234]
push 4
push ecx
push 4
push 0
push str.LocalCursor
push edx
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [ebx + 0x110]
push 4
push eax
push 4
push 0
push str.HistoryLimit
push ecx
call ebp
mov eax, dword [esp + 0x10]
lea edx, [ebx + 0x370]
push 4
push edx
push 4
push 0
push str.LogLevel
push eax
call ebp
lea edi, [ebx + 0x376]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 1
push eax
push str.LogFileName
push edx
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [ebx + 8]
push 4
push eax
push 4
push 0
push str.ListenPort
push ecx
call ebp
mov al, byte [ebx + 0x374]
xor edx, edx
test al, al
setne dl
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 4
push eax
push 4
push 0
push str.LogToFile
push ecx
call ebp
mov al, byte [ebx + 0x10d]
mov ecx, dword [esp + 0x10]
xor edx, edx
push 4
test al, al
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.SkipFullScreenPrompt
setne dl
push ecx
mov dword [esp + 0x2c], edx
call ebp
mov al, byte [ebx + 0x10c]
mov ecx, dword [esp + 0x10]
xor edx, edx
push 4
test al, al
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.NoToolbar
setne dl
push ecx
mov dword [esp + 0x2c], edx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x420870
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x43b3af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 4]
mov ecx, edi
call fcn.0041c1b0
lea ecx, [esi + 0x6a0]
mov dword [esp + 0x1a4], 0
call fcn.004216d0
mov ecx, dword [esp + 0x1b0]
mov eax, dword [esp + 0x1ac]
mov dword [esi], 0x43c760
push ecx
mov dword [0x44a3d4], esi
mov ecx, edi
mov byte [esp + 0x1a8], 1
mov dword [esi + 0x49c], eax
call fcn.0041c6b0
mov edx, dword [esi + 0x374]
mov ecx, 0x44a3a0
push edx
call fcn.0041b030
mov al, byte [esi + 0x379]
test al, al
je 0x420916
mov eax, dword [0x43c740]
mov edx, dword [0x43c748]
or eax, edx
mov ecx, 0x44a3a0
push eax
call fcn.0041afd0
mov al, byte [esi + 0x378]
test al, al
je 0x420933
lea ecx, [esi + 0x37a]
push 0
push ecx
mov ecx, 0x44a3a0
call fcn.0041b040
lea edx, [esp + 0xc]
lea edi, [esi + 0x4a0]
mov ecx, 0x80
xor eax, eax
push edx
push 2
rep stosd dword es:[edi], eax
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x42096f
push 0x10
push str.VNC_info
push str.Error_initialising_sockets_library
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [esp + 0xc]
and eax, 0xffff
push eax
push str.Started_and_Winsock__v__d__initialised_n
push 3
push 0x44a3a0
call fcn.004063e0
mov ecx, dword [esp + 0x1ac]
add esp, 0x10
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x1a0
ret 8

Function at 0x420be0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x43b454
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x10], esi
call fcn.00420870
lea edx, [esp + 0x20]
xor ebx, ebx
push edx
lea ecx, [esi + 0x6c0]
mov dword [esp + 0x18], ebx
call fcn.00421480
lea ecx, [esi + 0x6cc]
mov byte [esp + 0x14], 1
call fcn.004216d0
mov al, byte [esi + 0x263]
mov byte [esp + 0x14], 2
cmp al, bl
mov dword [esi], fcn.00421050
mov dword [esi + 0x6bc], ebx
mov dword [esi + 0x6b8], ebx
je 0x420c83
lea eax, [esi + 0x25a]
push 0x19
push eax
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
test eax, eax
jne 0x420c83
push 0x10
push str.VNC_info
push str.Error_loading_specified_keyboard_layout
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.004313b8
cmp byte [esi + 8], bl
je 0x420cb5
push ebx
push str.VNCviewer_Daemon
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x420cb5
push str.In_listening_mode___staring_daemons_n
push 3
push 0x44a3a0
call fcn.004063e0
add esp, 0xc
mov ecx, esi
call fcn.00421050
jmp 0x420cb8
mov byte [esi + 8], bl
mov ecx, esi
call fcn.00421130
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x421130
Capabilities:
Set registry value

Disassembly:
mov eax, dword [str.VNCviewerBell]
sub esp, 0x104
lea ecx, [esp + 4]
push ebx
push esi
push edi
push eax
push str.AppEventsEventLabels_s
push ecx
call fcn.004309ee
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
jne 0x4212bb
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push eax
push str.Bell
push 1
push eax
push ecx
call edi
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
mov ecx, dword [str.AppEventsSchemesAppsVNCviewer]
lea eax, [esp + 0xc]
push eax
push ecx
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
jne 0x4212bb
mov edx, dword [str.VNCviewerBell]
mov eax, dword [str.AppEventsSchemesAppsVNCviewer]
push ebp
push edx
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call fcn.004309ee
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push reloc.WSOCK32.dll_accept
call esi
mov ecx, dword [esp + 0x10]
push 0
push str.Bell
push 1
push 0
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, dword [str.VNCviewerBell]
mov ecx, dword [str.AppEventsSchemesAppsVNCviewer]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_s.current
push edx
call fcn.004309ee
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push reloc.WSOCK32.dll_accept
call ebp
test eax, eax
je 0x421255
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push reloc.WSOCK32.dll_accept
call esi
mov ecx, dword [esp + 0x10]
push 0
push str.ding.wav
push 1
push 0
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, dword [str.VNCviewerBell]
mov ecx, dword [str.AppEventsSchemesAppsVNCviewer]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_s.default
push edx
call fcn.004309ee
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push reloc.WSOCK32.dll_accept
call ebp
test eax, eax
pop ebp
je 0x4212b4
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push reloc.WSOCK32.dll_accept
call esi
mov ecx, dword [esp + 0xc]
push 0
push str.ding.wav
push 1
push 0
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x42166b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4216c3
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x44a130
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4216b6
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4216c5
xor eax, eax
pop esi
leave
ret 4
Function at 0x421b50
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x43b598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov ecx, edi
mov dword [esp + 0x14], edi
call fcn.004216f0
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x20], 0
test eax, eax
je 0x421ba0
mov al, byte [esp + 0xb]
lea ecx, [esp + 0xb]
push 0x43eb28
push ecx
mov byte [esp + 0x13], al
call fcn.004305d1
lea edx, [esp + 0xc]
push edx
push 4
push esi
push 0x421900
push 0
push 0
call fcn.0043184a
mov ecx, dword [esp + 0x24]
add esp, 0x18
test eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
jne 0x421be0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push 0x43ea78
push edx
mov dword [esp + 0x18], eax
call fcn.004305d1
mov ecx, dword [esi + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x421c08
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push 0x43ea78
push edx
mov dword [esp + 0x18], eax
call fcn.004305d1
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x421c30
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push 0x43ea78
push ecx
mov dword [esp + 0x18], eax
call fcn.004305d1
mov ecx, edi
mov dword [esi + 0x1c], 1
call fcn.00421700
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x424d20
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x424d50
push esi
call fcn.004280f0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x424d49
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x424dd3
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x424dbf
mov eax, dword [esi + 8]
test eax, eax
je 0x424d74
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x424dbb
cmp eax, 2
je 0x424dbf
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x424d67
cmp eax, 3
je 0x424d9a
cmp eax, 1
jne 0x424d67
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x424d67
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x424d67
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00424e00
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x424df3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00424e00
add esp, 4
pop esi
ret

Function at 0x431580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4315a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435cba
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4315c3
test byte [esp + 8], 2
je 0x4315c3
call fcn.00435d2d
mov dword [eax], 0xd
call fcn.00435d36
mov dword [eax], 5
jmp 0x43159c
xor eax, eax
ret

Function at 0x4372f0
Capabilities:
Hash data using murmur3

Disassembly:
ror byte [0x40f9334e], 0x87
sal bh, 1
fidiv word [ebx]
invalid

Function at 0x437360
Capabilities:
Hash data using murmur3

Disassembly:
dec esi
add edi, esp
xor esi, esp
xor dword [0x44bd74], 0x16cd0e1e
xor esi, eax
inc esi
add edx, 0x1a730c2a
sub edx, 0xb4a9556
mov dword [0x44bc83], ebx
dec edi
xor edi, 0xbb28b7a
not edx
xchg esi, edx
mov dword [0x44bcd8], 0x9d71a20
sub dword [esi], 0x2d34f0b0
xchg esi, edx
add eax, esp
xor dword [0x44bd4e], 0xcb6e4c6
xor esi, 0x21ee8b0
rol esi, 0x19
not esi
rol esi, 0x1e
dec edi
rol eax, 0xa
sub edx, esp
mov dword [0x44bca2], ecx
sub edi, 0xa2896d0
rol edx, 0x10
inc eax
add esi, eax
invalid
invalid

Function at 0x4373d5
Capabilities:
Hash data using murmur3

Disassembly:
and byte [edx], bl
xlatb
or dword [ecx + 0x34f0b02e], eax
sub eax, 0xc403d687
je 0x437395
inc esp
add byte [ebx], ch
invalid