joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46dc00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push str.d:_saasultravncwinvncwinvnc_vnchttpconnect.cpp_:_started_HTTP_server_thread_n
push 9
push 0x558c50
mov edi, ecx
call fcn.0041c840
add esp, 0xc
cmp dword [edi + 0x60], 0
jne 0x46dd4d
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push esi
nop dword [eax]
mov ecx, dword [edi + 0x68]
call fcn.00485cb0
mov esi, eax
test esi, esi
je 0x46dd4b
cmp dword [edi + 0x60], 0
jne 0x46dd43
push str.d:_saasultravncwinvncwinvnc_vnchttpconnect.cpp_:_HTTP_client_connected_n
push 1
push 0x558c50
call fcn.0041c840
add esp, 0xc
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x58a320], 2
jb 0x46dcaa
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x3a98
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call ebx
cmp eax, 0xffffffff
je 0x46dcaa
push 4
lea eax, [ebp - 4]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call ebx
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x10]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.d:_saasultravncwinvncwinvnc_vsocket.cpp_:_shutdown_socket_n
push 0xa
push 0x558c50
call fcn.0041c840
add esp, 0xc
push 2
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
push str.d:_saasultravncwinvncwinvnc_vsocket.cpp_:_closing_socket_n
push 0xa
push 0x558c50
call fcn.0041c840
add esp, 0xc
push 2
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esi + 0x14]
mov dword [esi + 8], 0xffffffff
test ecx, ecx
je 0x46dd2f
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
cmp dword [edi + 0x60], 0
je 0x46dc30
jmp 0x46dd4b
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
pop esi
pop ebx
push str.d:_saasultravncwinvncwinvnc_vnchttpconnect.cpp_:_quitting_HTTP_server_thread_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0xc
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x46e2e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x401
call fcn.004cbf7b
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
lea edi, [ebp - 1]
mov esi, 1
nop dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x46e332
push 0
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x46e330
add edi, eax
sub esi, eax
jmp 0x46e33b
je 0x46e36e
call ebx
cmp eax, 0x2733
jne 0x46e394
test esi, esi
jne 0x46e310
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
cmp al, byte [ebp + 0xc]
je 0x46e384
mov edx, dword [ebp - 0xc]
mov byte [ecx + edx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x3ff
jne 0x46e304
pop edi
pop esi
mov byte [edx + 0x3ff], 0
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.d:_saasultravncwinvncwinvnc_vsocket.cpp_:_zero_bytes_read3_n
push 4
push 0x558c50
call fcn.0041c840
add esp, 0xc
jmp 0x46e3ab
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov byte [ecx + eax], 0
mov esp, ebp
pop ebp
ret 8
call ebx
push eax
push str.d:_saasultravncwinvncwinvnc_vsocket.cpp_:_HTTP_socket_error:__d_n
push 4
push 0x558c50
call fcn.0041c840
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
call fcn.004cbf38
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46e700
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46e74c
mov bl, byte [esi]
push ecx
push dword [esi + 4]
movzx eax, bl
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, bl
call fcn.0042f780
push dword [esi]
push str.fake__d_down_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x18
mov byte [esi + 8], 1
pop esi
pop ebx
pop ecx
ret

Function at 0x46e750
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x46e7a0
mov eax, dword [esi + 4]
mov bl, byte [esi]
or eax, 2
push ecx
push eax
push 0
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, bl
call fcn.0042f780
push dword [esi]
push str.fake__d_up_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x18
mov byte [esi + 9], 1
pop esi
pop ebx
pop ecx
ret
Function at 0x46e7b0
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x46e7f4
mov eax, dword [esi + 4]
mov bl, byte [esi]
or eax, 2
push ecx
push eax
push 0
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, bl
call fcn.0042f780
push dword [esi]
push str.fake__d_up_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x18
pop esi
pop ebx
pop ecx
ret
cmp byte [esi + 9], 0
je 0x46e82b
mov bl, byte [esi]
push ecx
push dword [esi + 4]
movzx eax, bl
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, bl
call fcn.0042f780
push dword [esi]
push str.fake__d_down_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x18
pop esi
pop ebx
pop ecx
ret
Function at 0x46f8e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov bl, cl
movzx esi, bl
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test eax, 0x8000
je 0x46f95a
push 0x548b0c
push str.down
push esi
push str.d:_saasultravncwinvncwinvnc_vnckeymap.cpp_:_setshiftstate__d_____s___s__n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x14
push 2
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, bl
call fcn.0042f780
add esp, 8
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test eax, 0x8000
mov ecx, 0x548b0c
mov eax, str.down
cmove eax, ecx
push eax
push esi
push str.d:_saasultravncwinvncwinvnc_vnckeymap.cpp_:_new_state__d___s__n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x4710d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x418]
call fcn.004268c0
lea eax, [ebp - 0x418]
push eax
push 0x200
lea eax, [ebp - 0x310]
push eax
push 0x518188
push str.path
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471120
sub ecx, edx
jne 0x471162
push 0x104
lea eax, [ebp - 0x110]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x47115a
lea eax, [ebp - 0x110]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x47117b
mov byte [eax], 0
lea eax, [ebp - 0x110]
jmp 0x471168
lea eax, [ebp - 0x310]
push eax
push 0x104
push 0x558e6a
call fcn.004d0170
add esp, 0xc
push 0x558e6a
push 0x200
push 0x558c68
call fcn.004d0170
add esp, 0xc
push 0x53e1f8
push 0x200
push 0x558c68
call fcn.004d01ca
add esp, 0xc
push str.WinVNC.log
push 0x200
push 0x558c68
call fcn.004d01ca
add esp, 0xc
mov byte [0x558e68], 1
cmp byte [0x558c58], 0
je 0x4711d5
call fcn.004711f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
Function at 0x4711f0
Capabilities:
Move file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push ecx
mov ecx, 0x558c68
push esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471210
sub ecx, edx
jne 0x47123f
push str.Error_opening_log_file_n
push ecx
push 0x558c50
mov word [0x558c58], 0x100
call fcn.0041c840
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp byte [0x558e68], 0
mov byte [0x558c58], 1
jne 0x4712c0
mov ecx, 0x558c68
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471257
sub ecx, edx
lea eax, [ecx + 5]
push eax
call fcn.004cbf7b
mov esi, eax
add esp, 4
test esi, esi
je 0x4712c0
mov ecx, 0x558c68
mov edx, esi
sub edx, ecx
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x471280
lea ecx, [esi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x471290
mov eax, dword [str..bak]
push 1
mov dword [ecx], eax
mov al, byte [0x548bcc]
push esi
push 0x558c68
mov byte [ecx + 4], al
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
call fcn.004cbf38
add esp, 4
mov eax, dword [0x558c64]
test eax, eax
je 0x4712da
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x558c64], 0
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push 0x558c68
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x558c64], eax
cmp eax, 0xffffffff
jne 0x471328
push 0x558c68
push str.Error_opening_log_file__s_n
push 0
push 0x558c50
mov word [0x558c58], 0x100
call fcn.0041c840
mov eax, dword [0x558c64]
add esp, 0x10
cmp byte [0x558e68], 0
je 0x471346
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4713e0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc14
mov eax, dword [0x55800c]
xor eax, esp
mov dword [esp + 0xc10], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov esi, ecx
mov dword [esp + 0x10], eax
call fcn.004d02e5
lea ecx, [esi + 0x320]
add esp, 4
cmp eax, dword [ecx]
jne 0x471422
cmp edx, dword [ecx + 4]
je 0x471438
push ecx
mov dword [ecx], eax
mov dword [ecx + 4], edx
call fcn.004dc47a
add esp, 4
mov ecx, esi
push eax
call fcn.00471360
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0xc]
mov edx, 0x400
mov edi, eax
push ecx
push ebx
lea ecx, [esp + 0x1c]
call fcn.0041e880
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4714d0
push 0
push 0x400
lea eax, [esp + 0x820]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x47149f
push edi
lea eax, [esp + 0x81c]
push str.error_code_0x_08X
push eax
call fcn.0042b800
add esp, 0xc
push 0x548c00
lea eax, [esp + 0x14]
push 0x801
push eax
call fcn.004d01ca
add esp, 0xc
lea eax, [esp + 0x818]
push eax
lea eax, [esp + 0x14]
push 0x801
push eax
call fcn.004d01ca
add esp, 0xc
cmp byte [esi + 9], 0
je 0x4714e1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [esi + 0xa], 0
je 0x471515
lea ecx, [esp + 0x10]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4714f0
push 0
lea eax, [esp + 0x10]
sub ecx, edx
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
cmp byte [esi + 8], 0
je 0x47154d
mov edx, dword [esi + 0x14]
test edx, edx
je 0x47154d
lea ecx, [esp + 0x10]
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471530
push 0
lea eax, [esp + 0x10]
sub ecx, esi
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0xc1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 8
Function at 0x4752f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x108]
call fcn.004268c0
lea eax, [ebp - 0x108]
push eax
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x475383
lea eax, [ebp - 0x10c]
push eax
push 0x56328c
push 0
push 0x20019
push 0
push 0
push 0
push 0x519c80
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x475383
lea eax, [ebp - 0x10c]
push eax
push 0x56349c
push 0
push 0x2001f
push 0
push 0
push 0
push str.mslogon
push dword [0x56328c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret

Function at 0x4753a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x108]
call fcn.004268c0
lea eax, [ebp - 0x108]
push eax
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x475408
mov eax, dword [0x56349c]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4753ef
push eax
call esi
mov eax, dword [0x563490]
test eax, eax
je 0x4753fb
push eax
call esi
mov eax, dword [0x56328c]
test eax, eax
je 0x475407
push eax
call esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret

Function at 0x475420
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x56349c]
lea ecx, [ebp - 0x108]
push esi
mov esi, edx
call fcn.004268c0
lea eax, [ebp - 0x108]
push eax
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4754c8
lea eax, [ebp - 0x110]
mov dword [ebp - 0x10c], 4
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x110], 4
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4754b5
cmp dword [ebp - 0x10c], 4
jne 0x4754b5
cmp dword [ebp - 0x110], 4
mov eax, dword [ebp - 0x114]
je 0x4754de
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
push esi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
Function at 0x4754f0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x56349c]
lea ecx, [ebp - 0x108]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x114], ebx
call fcn.004268c0
lea eax, [ebp - 0x108]
push eax
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4755dc
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x110]
push eax
push 0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x110], 0x100
push eax
push 0
push edi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call ebx
test eax, eax
jne 0x4755c7
cmp dword [ebp - 0x10c], 3
jne 0x4755c7
push 0x100
mov dword [ebp - 0x110], 0x100
call fcn.004cbf7b
mov esi, eax
add esp, 4
test esi, esi
je 0x4755c7
lea eax, [ebp - 0x110]
push eax
push esi
lea eax, [ebp - 0x10c]
push eax
push 0
push edi
push dword [ebp - 0x114]
call ebx
test eax, eax
jne 0x4755be
cmp dword [ebp - 0x10c], 3
je 0x475609
push esi
call fcn.004cbf38
add esp, 4
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push 0x96
call fcn.004cbf7b
add esp, 4
mov esi, eax
lea eax, [ebp - 0x108]
push eax
push 0x96
push esi
push 0x518188
push edi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cbf27
mov esp, ebp
pop ebp
ret

Function at 0x475620
Capabilities:
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [0x56349c]
lea ecx, [ebp - 0x128]
mov esi, edx
call fcn.004268c0
lea eax, [ebp - 0x128]
push eax
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x475688
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0x5405e8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
Function at 0x4756d0
Capabilities:
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x56349c]
lea ecx, [ebp - 0x108]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
call fcn.004268c0
lea eax, [ebp - 0x108]
push eax
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x47573d
push 0xfe
push edi
push 3
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push eax
push edi
push esi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
Function at 0x4757d0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x118], eax
mov ebx, ecx
mov dword [ebp - 0x120], edi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x110], 4
mov dword [ebp - 0x114], 4
call fcn.004268c0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x108]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x4758cc
lea eax, [ebp - 0x10c]
push eax
push 1
push 0
push str.SoftwareORLWinVNC3
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4759fa
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.NewMSLogon
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4759fa
cmp dword [ebp - 0x110], 4
jne 0x4759fa
cmp dword [ebp - 0x114], 4
jne 0x4759fa
mov eax, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x11c]
test eax, eax
je 0x4758e3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4758e3
lea eax, [ebp - 0x108]
push eax
push 0
push str.NewMSLogon
push str.admin
call esi
mov esi, eax
test esi, esi
je 0x4759fa
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x475949
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.004cd350
lea ecx, [ebp - 0x108]
add esp, 8
dec ecx
mov byte [eax], 0
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x475920
mov eax, dword [str._authSSP.dll]
mov dword [ecx], eax
mov eax, dword [0x549580]
mov dword [ecx + 4], eax
mov eax, dword [0x549584]
mov dword [ecx + 8], eax
mov al, byte [0x549588]
mov byte [ecx + 0xc], al
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4759d3
push str.CUPSD
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.d:_saasultravncwinvncwinvnc_vncntlm.cpp_:_GetProcAddress
push 9
push 0x558c50
mov dword [0x563494], eax
call fcn.0041c840
add esp, 0xc
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x118]
push dword [ebp - 0x120]
push ebx
call dword [0x563494]
mov esi, eax
push esi
push str.CheckUserPasswordSDUni_result_i
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x1c
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push 0
push 0x5674c8
mov edx, str.You_selected_ms_logon__but_authSSP.dll_nwas_not_found.Check_you_installation
call fcn.00425e00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x118]
mov edx, edi
mov ecx, ebx
call fcn.00475a20
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
Function at 0x477670
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 8]
call fcn.004268c0
lea ebx, [edi + 0x448]
lea esi, [ebx + 0x430]
mov ecx, esi
call fcn.004268c0
push esi
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
dec eax
mov dword [ebx + 0x100], 0
neg eax
mov dword [ebx + 0x104], 0
mov ecx, ebx
mov dword [ebx + 0x108], 0
sbb eax, eax
mov dword [ebx + 0x10c], 0
inc eax
mov dword [ebx + 0x11c], 0
mov dword [ebx + 0x42c], eax
mov dword [ebx + 0x120], 0
mov dword [ebx + 0x124], 0
call fcn.00484de0
mov ecx, ebx
mov dword [ebx + 0x110], eax
call fcn.00484e60
mov ecx, ebx
mov dword [ebx + 0x114], eax
call fcn.00484ee0
push dword [ebx + 0x11c]
mov ecx, ebx
mov dword [ebx + 0x118], eax
call fcn.00484f60
push dword [ebx + 0x120]
mov ecx, ebx
mov dword [ebx + 0x11c], eax
call fcn.00484ff0
push dword [ebx + 0x124]
mov ecx, ebx
mov dword [ebx + 0x120], eax
call fcn.00485080
mov ecx, dword [ebx + 0x110]
mov dword [ebx + 0x124], eax
lea eax, [ebx + 0x128]
test ecx, ecx
je 0x477781
push ecx
push 0x100
push eax
call fcn.004d0170
push dword [ebx + 0x110]
call fcn.004cbf38
add esp, 0x10
jmp 0x477794
push 0x518188
push 0x100
push eax
call fcn.004d0170
add esp, 0xc
mov ecx, dword [ebx + 0x114]
lea eax, [ebx + 0x228]
test ecx, ecx
je 0x4777c0
push ecx
push 0x100
push eax
call fcn.004d0170
push dword [ebx + 0x114]
call fcn.004cbf38
add esp, 0x10
jmp 0x4777d3
push 0x518188
push 0x100
push eax
call fcn.004d0170
add esp, 0xc
mov ecx, dword [ebx + 0x118]
lea eax, [ebx + 0x328]
test ecx, ecx
je 0x4777ff
push ecx
push 0x100
push eax
call fcn.004d0170
push dword [ebx + 0x118]
call fcn.004cbf38
add esp, 0x10
jmp 0x477812
push 0x518188
push 0x100
push eax
call fcn.004d0170
add esp, 0xc
mov dword [edi + 0x120], 1
mov eax, edi
mov dword [edi + 0x114], 1
mov dword [edi + 0x118], 0
mov dword [edi + 0x11c], 1
mov dword [edi + 0x134], 0
mov dword [edi + 0x110], 1
mov byte [edi], 1
mov dword [edi + 4], 0
mov dword [edi + 0x124], 0x1e
mov dword [edi + 0x128], 5
mov dword [edi + 0x12c], 0
mov dword [edi + 0xc74], 1
mov dword [edi + 0xc78], 0
mov byte [edi + 0x248], 0
pop edi
pop esi
pop ebx
ret
Function at 0x477ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
push 0
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x477c1b
cmp dword [ebp - 4], 1
jne 0x477c1b
push dword [ebp - 8]
call fcn.004cbf7b
mov esi, eax
add esp, 4
test esi, esi
je 0x477c1b
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x477c12
cmp dword [ebp - 4], 1
jne 0x477c12
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.004cbf38
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8