joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042800
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x680]
sub rsp, 0x780
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rbp + 0x670], rax
mov rsi, rdx
mov r14, rcx
mov rcx, rsi
mov edx, 0x5c
call fcn.14012f358
mov edx, 0x20
mov rcx, rsi
lea rbx, [rax + 1]
call fcn.14012f358
cmp byte [rbx], 0x5b
jne 0x140042aa2
cmp byte [rbx + 1], 0x20
jne 0x140042aa2
cmp byte [rax + 1], 0x5d
jne 0x140042aa2
cmp rbx, rax
jae 0x140042aa2
lea rdx, [rbp + 0x260]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r8, rsi
lea rcx, [rbp + 0x40]
mov edx, 0x104
call fcn.14012524c
mov edx, 0x5c
lea rcx, [rbp + 0x40]
call fcn.14012f358
mov edx, 0x104
lea rcx, [rsp + 0x30]
mov rbx, rax
lea r8, [rax + 3]
call fcn.14012524c
lea rax, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400428c6
sub rcx, 2
cmp rcx, 0x104
jae 0x140042ac7
mov byte [rsp + rcx + 0x30], 0
mov rax, 0xffffffffffffffff
mov byte [rbx + 1], 0
lea rcx, [rsp + 0x30]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400428f5
lea rdx, [rbp + 0x40]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140042910
add rax, 0xd
add rax, rcx
cmp rax, 0x103
ja 0x140042aa2
lea rax, str..zip
mov qword [rsp + 0x28], rax
lea r9, str._UVNCDIR_
lea rax, [rsp + 0x30]
lea r8, [rbp + 0x260]
mov qword [rsp + 0x20], rax
lea rdx, str._s_s_s_s
lea rcx, [rbp + 0x150]
call fcn.14002e0d0
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rbp + 0x40]
call fcn.1401252ac
lea r8, [rbp + 0x40]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14012524c
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140042995
cmp rax, 0x100
ja 0x140042a9b
lea r8, [0x14019c764]
mov qword [rsp + 0x7b0], rdi
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1401252ac
lea rax, [0x1401bc0f0]
lea rbx, str.__s____s____s
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea r9, [rbp + 0x40]
lea r8, [0x1401bc3f0]
lea rcx, [rbp + 0x370]
call fcn.1400480c0
lea rdx, [rbp + 0x370]
mov rcx, r14
call fcn.140040ed0
mov rcx, qword [r14 + 0x430]
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x40]
call fcn.14006b9c0
movzx edi, al
test al, al
je 0x140042a37
lea r8, [0x1401bc5c0]
lea rcx, [0x1401bd480]
jmp 0x140042a4c
lea rbx, str.__s____s__.__s
lea r8, [0x1401bca00]
lea rcx, [0x1401bc530]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x40]
lea rcx, [rbp + 0x370]
mov rdx, rbx
call fcn.1400480c0
lea rdx, [rbp + 0x370]
mov rcx, r14
call fcn.140040ed0
test dil, dil
mov rdi, qword [rsp + 0x7b0]
je 0x140042a9b
lea r8, [rbp + 0x150]
mov edx, 0x124
mov rcx, rsi
call fcn.14012524c
mov eax, 1
jmp 0x140042aa4
mov eax, 0xffffffff
jmp 0x140042aa4
xor eax, eax
mov rcx, qword [rbp + 0x670]
xor rcx, rsp
call fcn.14011c340
mov rbx, qword [rsp + 0x7b8]
add rsp, 0x780
pop r14
pop rsi
pop rbp
ret
call fcn.14011c4dc
int3
Function at 0x140042ad0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
push rbp
push rdi
push r14
sub rsp, 0x280
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [rcx + 0x73], 0
mov r14d, edx
mov ebp, r8d
mov rdi, rcx
je 0x140042d14
test r8d, r8d
je 0x140042d14
lea eax, [rbp + 1]
mov qword [r11 + 0x10], rbx
mov ecx, eax
mov qword [r11 + 0x20], rsi
mov ebx, eax
call fcn.14011c740
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1401216a0
mov rcx, qword [rdi + 0x38]
mov r8d, ebp
mov rdx, rsi
call fcn.140025f70
cmp ebp, 0x104
jbe 0x140042b50
mov byte [rsi + 0x104], 0
jmp 0x140042b55
mov byte [rbp + rsi], 0
cmp r14d, 0xffffffff
jne 0x140042c46
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14003d8d0
cmp qword [rax + 0x18], 0x10
jb 0x140042b76
mov rax, qword [rax]
lea rcx, [0x1401bc6c0]
mov r9, rax
mov qword [rsp + 0x20], rcx
lea r8, [0x1401bd580]
lea rcx, [rsp + 0x60]
lea rdx, str.__s____s____s
call fcn.140048000
lea rcx, [rsp + 0x40]
call fcn.14002dbe0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140040ed0
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14003d8d0
cmp qword [rax + 0x18], 0x10
jb 0x140042bcb
mov rax, qword [rax]
lea rcx, [0x1401bc780]
mov r9, rax
mov qword [rsp + 0x20], rcx
lea r8, [0x1401bce00]
lea rcx, [rsp + 0x60]
lea rdx, str.__s____s____s
call fcn.140048000
lea rcx, [rsp + 0x40]
call fcn.14002dbe0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140040ed0
mov rcx, rsi
mov byte [rdi + 0x751], 1
call fcn.14011c3a0
xor al, al
mov rbx, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x280
pop r14
pop rdi
pop rbp
ret
mov rcx, rsi
call fcn.14011c3a0
xor esi, esi
lea rcx, [rdi + 0x620]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000000
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi + 0x618], rax
cmp rax, 0xffffffffffffffff
jne 0x140042cc3
lea r9, [rdi + 0x620]
lea r8, [0x1401bc230]
lea rdx, str.__s____s__
lea rcx, [rsp + 0x60]
call fcn.140048000
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140040ed0
mov byte [rdi + 0x751], 1
jmp 0x140042c18
mov rax, qword [rdi + 0x38]
mov word [rdi + 0x750], si
mov dword [rdi + 0x744], esi
mov qword [rdi + 0x748], rsi
cmp dword [rax + 0x5604], 0x800
mov byte [rdi + 0x752], 1
setbe al
mov byte [rdi + 0x754], al
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0xb60], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x610], eax
mov al, 1
jmp 0x140042c1a
xor al, al
jmp 0x140042c2a
Function at 0x140043100
Capabilities:
Delete file
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x460], rax
cmp byte [rcx + 0x752], 0
mov rbx, rcx
jne 0x14004312e
xor al, al
jmp 0x14004336a
mov byte [rcx + 0x752], 0
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + 0x38]
mov edx, 0xffff
mov qword [rsp + 0x488], rdi
mov r8d, 0x1005
xor edi, edi
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x30], edi
mov rcx, qword [rcx + 0x748]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x618]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbx + 0x751], dil
je 0x1400431de
cmp byte [rbx + 0x750], dil
jne 0x1400431de
cmp dword [rbx + 0xb54], 1
lea r8d, [rdi + 0xc]
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0x30707
mov dword [rsp + 0x40], edi
jne 0x1400431c6
xor r9d, r9d
call fcn.140026ae0
lea rax, [0x1401bcf40]
lea r8, [0x1401bd700]
jmp 0x14004321d
mov r9b, 7
call fcn.1400266a0
lea rax, [0x1401bcf40]
lea r8, [0x1401bd700]
jmp 0x14004321d
cmp dword [rbx + 0xb54], 1
lea rdx, [rsp + 0x38]
mov rcx, qword [rbx + 0x38]
mov r8d, InitCommonControls
mov word [rsp + 0x38], 0x607
jne 0x140043207
xor r9d, r9d
call fcn.140026ae0
jmp 0x14004320f
mov r9b, 7
call fcn.1400266a0
lea rax, [0x1401bd1c0]
lea r8, [0x1401bcbc0]
lea rdi, [rbx + 0x620]
mov qword [rsp + 0x20], rax
mov r9, rdi
lea rdx, str.__s____s____s
lea rcx, [rsp + 0x160]
call fcn.1400480c0
mov edx, 0x5c
mov rcx, rdi
call fcn.14012f358
mov r8d, 9
lea rdx, str._UVNCDIR_
lea rcx, [rax + 1]
call fcn.14012e560
test eax, eax
jne 0x14004330a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp byte [rbx + 0x751], 0
jne 0x14004330a
mov edx, 0x5c
mov rcx, rdi
call fcn.14012f358
mov edx, 0x2d
mov rcx, rax
call fcn.14012f544
mov edx, 0x104
lea rcx, [rsp + 0x50]
lea r8, [rax + 1]
call fcn.14012524c
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400432c0
sub rax, 4
cmp rax, 0x104
jae 0x140043383
mov byte [rsp + rax + 0x50], 0
lea r9, [rsp + 0x50]
lea rax, [0x1401bc430]
lea r8, [0x1401bc5c0]
mov qword [rsp + 0x20], rax
lea rdx, str.__s____s____s
lea rcx, [rsp + 0x160]
call fcn.1400480c0
lea rdx, [rsp + 0x160]
mov rcx, rbx
call fcn.140040ed0
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rbx + 0x40]
mov edx, 0x40e
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x40]
mov edx, 0x412
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call fcn.14003f0c0
mov rdi, qword [rsp + 0x488]
mov al, 1
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x470
pop rbx
ret
call fcn.14011c4dc
int3
Function at 0x140048940
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x1401da714], 0
je 0x14004895e
xor eax, eax
cmp qword [0x1401ba718], rax
setne al
add rsp, 0x28
ret
lea rcx, str.USER32
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140048a9e
lea rdx, [0x14019c900]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401ba6f0], rax
test rax, rax
je 0x140048a9e
lea rdx, [0x14019c918]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401ba700], rax
test rax, rax
je 0x140048a9e
lea rdx, str.MonitorFromRect
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401ba6f8], rax
test rax, rax
je 0x140048a9e
lea rdx, [0x14019c940]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401ba720], rax
test rax, rax
je 0x140048a9e
lea rdx, str.EnumDisplayMonitors
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401ba710], rax
test rax, rax
je 0x140048a9e
lea rdx, [0x14019c970]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401ba718], rax
test rax, rax
je 0x140048a9e
lea rdx, [0x14019c980]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401ba708], rax
test rax, rax
je 0x140048a9e
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ebx, eax
jl 0x140048a9e
mov ecx, 0x4f
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ebx, eax
jl 0x140048a9e
mov rbx, qword [rsp + 0x20]
mov eax, 1
mov dword [0x1401da714], eax
add rsp, 0x28
ret
mov rbx, qword [rsp + 0x20]
xor eax, eax
mov qword [0x1401ba6f0], rax
mov qword [0x1401ba700], rax
mov qword [0x1401ba6f8], rax
mov qword [0x1401ba720], rax
mov qword [0x1401ba718], rax
mov qword [0x1401ba710], rax
mov qword [0x1401ba708], rax
mov dword [0x1401da714], 1
add rsp, 0x28
ret

Function at 0x14004aba0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r8, str.Reset_keyboard_for_first_use_n
lea rcx, vtable.Log.0
mov edx, 8
call fcn.1400155a0
xor esi, esi
lea rcx, [rdi + 0x1f8]
mov word [rdi + 0xf10], si
call qword [sym.imp.USER32.dll_GetKeyboardState]
lea rdx, [rdi + 0x1f8]
mov rcx, rdi
call fcn.14004ad50
mov eax, esi
lea rcx, [rdi + 0x2f8]
nop dword [rax + rax]
inc eax
mov dword [rcx], 0xffffff
lea rcx, [rcx + 4]
cmp eax, 0x200
jb 0x14004ac00
mov ecx, esi
lea rax, [rdi + 0xaf8]
nop dword [rax]
inc ecx
mov word [rax], si
lea rax, [rax + 2]
cmp ecx, 0x200
jb 0x14004ac20
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004d840
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x20
xor ebp, ebp
shr r9d, 0x18
mov dword [rdx + 0x10], ebp
mov r15d, r8d
mov rdi, rdx
mov rsi, rcx
mov ebx, ebp
test r9b, 1
je 0x14004d88d
mov eax, r8d
sub eax, 0xd
je 0x14004d887
sub eax, 4
je 0x14004d87f
cmp eax, 1
jne 0x14004d88d
mov r15d, 0xa5
jmp 0x14004d88d
mov r15d, 0xa3
jmp 0x14004d88d
mov r15d, 0x1234
lea rdx, [0x14018ba10]
mov eax, ebp
mov rcx, rdx
mov qword [rsp + 0x58], r14
nop
cmp dword [rcx], r15d
je 0x14004da63
inc eax
add rcx, 8
cmp eax, 0x54
jb 0x14004d8a0
lea rcx, [rsi + 4]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov edx, r15d
mov rcx, rsi
call fcn.14004d6d0
movsxd r14, eax
cmp byte [rsi + 0x16], bl
jge 0x14004d98b
cmp byte [rsi + 0x15], bl
jge 0x14004d98b
cmp r14d, 1
jl 0x14004d98b
movzx eax, byte [rsi]
lea ecx, [rax - 0x20]
cmp cl, 0x5e
jbe 0x14004d8fb
cmp al, 0xa0
jb 0x14004d98b
mov ecx, 0xa2
mov qword [rsp + 0x50], r12
call qword [sym.imp.USER32.dll_GetKeyState]
mov r12d, 0x8000
test r12w, ax
je 0x14004d91b
or dword [rdi + 0x10], 1
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
test r12w, ax
je 0x14004d930
or dword [rdi + 0x10], 4
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
and ax, r12w
mov r12, qword [rsp + 0x50]
mov eax, dword [rdi + 0x10]
je 0x14004d94f
or eax, 8
mov dword [rdi + 0x10], eax
test eax, eax
jne 0x14004d95a
mov dword [rdi + 0x10], reloc.WS2_32.dll_listen
cmp r14d, 2
je 0x14004da6e
test r14d, r14d
jle 0x14004d995
mov rdx, rbp
nop dword [rax]
movzx ecx, byte [rdx + rsi]
inc rdx
mov eax, ebx
inc ebx
mov dword [rdi + rax*4], ecx
cmp rdx, r14
jl 0x14004d970
test ebx, ebx
jne 0x14004da6e
cmp r14d, 2
je 0x14004da6e
mov edx, r15d
mov r14d, ebx
mov rcx, rsi
mov word [rsi + 0xa6], bp
mov byte [rsi + 0x15], bpl
call fcn.14004d6d0
test eax, eax
jns 0x14004da00
movzx ecx, byte [rsi]
sub ecx, 0x27
je 0x14004d9f8
sub ecx, 0x37
je 0x14004d9f0
sub ecx, 2
je 0x14004d9e8
sub ecx, 0x1e
je 0x14004d9dd
cmp ecx, 0x2a
jne 0x14004da6e
mov dword [rdi], 0xfe57
jmp 0x14004da69
mov dword [rdi], 0xfe53
jmp 0x14004da69
mov dword [rdi], 0xfe50
jmp 0x14004da69
mov dword [rdi], 0xfe52
jmp 0x14004da69
mov dword [rdi], 0xfe51
jmp 0x14004da69
mov ebx, r14d
cmp eax, 1
jl 0x14004da6e
cmp eax, 2
jne 0x14004da40
movzx eax, byte [rsi]
cmp al, 0xb4
jne 0x14004da28
cmp byte [rsi + 1], 0xf9
jne 0x14004da6e
mov dword [rdi + r14*4], 0xfe51
lea ebx, [r14 + 1]
jmp 0x14004da6e
cmp al, 0x60
jne 0x14004da6e
cmp byte [rsi + 1], 0xb5
jne 0x14004da6e
mov dword [rdi + r14*4], 0xfe50
lea ebx, [r14 + 1]
jmp 0x14004da6e
movsxd rdx, eax
test eax, eax
jle 0x14004da6e
nop word [rax + rax]
movzx ecx, byte [rsi + rbp]
inc rbp
mov dword [rdi + rbx*4], ecx
inc ebx
cmp rbp, rdx
jl 0x14004da50
jmp 0x14004da6e
mov eax, dword [rdx + rax*8 + 4]
mov dword [rdi], eax
mov ebx, 1
mov r14, qword [rsp + 0x58]
mov eax, ebx
mov dword [rdi + rax*4], 0xffffff
mov rax, rdi
add rsp, 0x20
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004dc60
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14004dc87
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rdi
mov byte [rbx + 8], 1
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x10], rax
cmp rax, 0xffffffffffffffff
jne 0x14004dcdd
mov r9, rdi
mov word [rbx + 8], 0x100
lea r8, str.Error_opening_log_file__s_n
xor edx, edx
mov rcx, rbx
call fcn.1400155a0
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetEndOfFile]
Function at 0x14004f740
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rax, vtable.MRU.0
mov rbx, rcx
mov qword [rcx], rax
xor edx, edx
add rcx, 8
mov r8d, 0x101
call fcn.1401216a0
lea rsi, [rbx + 0x110]
mov rcx, rsi
call fcn.140061fc0
lea r9, [rbx + 8]
mov qword [rsp + 0x28], rsi
lea r8, [0x14019945a]
mov dword [rbx + 0x10c], WSAAsyncSelect
lea rdx, str.index
mov dword [rsp + 0x20], 0x101
lea rcx, str.connection
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x14004f7d1
mov r9, rsi
lea r8, [rbx + 8]
lea rdx, str.index
lea rcx, str.connection
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140051460
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push r14
sub rsp, 0x280
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14, rdx
mov qword [r11 + 0x18], rbx
mov rbp, rcx
mov qword [r11 + 0x20], rdi
mov rcx, r14
mov edx, 0x444
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r8d, 0x104
lea rdx, [rsp + 0x160]
xor ecx, ecx
mov rsi, rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140051597
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x160]
call fcn.140120eb0
test rax, rax
je 0x140051597
mov byte [rax], bl
lea rcx, [rsp + 0x160]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp byte [rcx + rax + 1], bl
lea rax, [rax + 1]
jne 0x1400514f0
cmp byte [rsp + rax + 0x15f], 0x5c
je 0x14005151d
lea r8, [0x14019c38c]
mov edx, 0x104
lea rcx, [rsp + 0x160]
call fcn.1401252ac
lea r8, str..dsm
mov edx, 0x104
lea rcx, [rsp + 0x160]
call fcn.1401252ac
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140051597
nop dword [rax]
nop word [rax + rax]
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov edx, 0x143
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
lea rdx, [rsp + 0x20]
mov rcx, rdi
inc ebx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140051560
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x1400515af
lea r9, [0x1401bcb80]
xor r8d, r8d
mov edx, 0x143
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x14e
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, 0x446
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
movzx ebx, byte [rbp + 0x2d6]
mov edx, 0x444
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rdi, qword [rsp + 0x2b8]
lea r9, [rbp + 0x2d7]
cmp byte [r9], 0
mov rbx, qword [rsp + 0x2b0]
je 0x14005168f
cmp byte [rbp + 0x2d6], 0
je 0x14005168f
mov edx, 0x158
mov r8, 0xffffffffffffffff
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x14005168f
movsxd r8, eax
xor r9d, r9d
mov edx, 0x14e
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, 0x442
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov edx, 0xf1
mov rcx, rax
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, 0x446
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x280
pop r14
pop rsi
pop rbp
ret
Function at 0x140051910
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0x160
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, rdx
mov qword [r11 + 0x18], rbx
mov rbp, rcx
mov qword [r11 - 0x10], rdi
mov rcx, rax
mov qword [r11 - 0x18], r14
mov edx, 0x3e8
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x14b
mov r14, rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov rdx, qword [rbp + 0x210]
mov rbx, 0xffffffffffffffff
mov rcx, rbx
xor edi, edi
nop word [rax + rax]
inc rcx
cmp byte [rdx + rcx + 8], dil
jne 0x140051980
test ecx, ecx
jle 0x140051a4d
mov qword [rsp + 0x188], rsi
mov rsi, rdi
nop dword [rax]
mov rax, rbx
inc rax
cmp byte [rdx + rax + 8], 0
jne 0x1400519a3
dec eax
cmp edi, eax
jg 0x1400519f3
movzx eax, byte [rdx + rsi + 8]
lea r9, [rsp + 0x40]
mov byte [rsp + 0x30], al
lea r8, [0x14019945a]
lea rax, [rdx + 0x110]
mov byte [rsp + 0x31], 0
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
lea rcx, str.connection
mov dword [rsp + 0x20], 0xff
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x40]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140051a00
test rax, rax
je 0x140051a24
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x143
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageA]
mov rdx, qword [rbp + 0x210]
inc edi
inc rsi
mov rax, rbx
inc rax
cmp byte [rdx + rax + 8], 0
jne 0x140051a33
cmp edi, eax
jl 0x1400519a0
mov rsi, qword [rsp + 0x188]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x14e
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageA]
mov rdx, qword [rbp + 0x210]
mov r14, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x158]
nop dword [rax + rax]
inc rbx
cmp byte [rdx + rbx + 8], 0
jne 0x140051a80
cmp ebx, 1
mov rbx, qword [rsp + 0x180]
js 0x140051ad6
movzx eax, byte [rdx + 8]
lea r9, [rsp + 0x40]
mov byte [rsp + 0x30], al
lea r8, [0x14019945a]
lea rax, [rdx + 0x110]
mov byte [rsp + 0x31], 0
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
lea rcx, str.connection
mov dword [rsp + 0x20], 0xff
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.140054f80
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x160
pop rbp
ret
Function at 0x1400533f0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x950
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x940], rax
movzx ebx, r8b
mov rsi, rdx
mov rdi, rcx
call fcn.140053680
mov ecx, dword [rdi + 8]
lea r8, [rdi + 0x13]
lea rdx, str._.15s__d.vnc
lea eax, [rcx - 0x1bc]
lea r9d, [rcx - 0x1bb]
cmp eax, 0x62
cmova r9d, ecx
lea rcx, [rsp + 0x130]
call fcn.14002e0d0
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea r8, [0x14019d728]
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.1401252ac
lea rcx, [rsp + 0x20]
call fcn.140131810
test bl, bl
je 0x1400535d7
xorps xmm0, xmm0
lea rcx, [0x1401bfde0]
xor eax, eax
mov qword [0x1401bfe70], rax
lea rax, str.VNC_files__.vnc_
movups xmmword [0x1401bfe40], xmm0
mov dword [0x1401bfe40], 4
movups xmmword [0x1401bfe10], xmm0
mov dword [0x1401bfe18], 0x104
movups xmmword [0x1401bfe20], xmm0
mov dword [0x1401bfe28], 0x200
movups xmmword [0x1401bfde0], xmm0
mov dword [0x1401bfde0], 0x88
movups xmmword [0x1401bfdf0], xmm0
mov qword [0x1401bfdf8], rax
lea rax, [0x14019be80]
mov qword [0x1401bfe48], rax
lea rax, [rsp + 0x130]
mov qword [0x1401bfe10], rax
lea rax, [rsp + 0x340]
mov qword [0x1401bfe20], rax
lea rax, [rsp + 0x20]
movups xmmword [0x1401bfe30], xmm0
mov qword [0x1401bfe30], rax
movups xmmword [0x1401bfe00], xmm0
mov qword [0x1401bfde8], rsi
movups xmmword [0x1401bfe50], xmm0
movups xmmword [0x1401bfe60], xmm0
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
test eax, eax
jne 0x1400535cd
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
test eax, eax
je 0x14005364f
cmp eax, 0x3002
je 0x140053591
mov r9d, eax
lea r8, str.Error__d_from_GetSaveFileName_n
xor edx, edx
lea rcx, vtable.Log.0
call fcn.1400155a0
jmp 0x14005364f
lea r8, [0x1401bd780]
mov edx, 0x400
lea rcx, [rsp + 0x540]
call fcn.14012524c
mov r9d, 0x50010
lea r8, [0x1401bcd80]
lea rdx, [rsp + 0x540]
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14005364f
lea rdx, [rsp + 0x130]
jmp 0x140053609
lea r8, [0x14019c38c]
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.1401252ac
lea r8, [rsp + 0x130]
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.1401252ac
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rdi
call fcn.140053810
mov r9d, 0x100
lea r8, [rsp + 0x240]
mov edx, 0x3e8
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItemTextA]
mov rcx, qword [rdi + 0x210]
lea rdx, [rsp + 0x240]
call fcn.14004f820
mov rdx, rsi
mov rcx, rdi
call fcn.140051910
mov rcx, qword [rsp + 0x940]
xor rcx, rsp
call fcn.14011c340
lea r11, [rsp + 0x950]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret