joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404603
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov edi, 0x2000
xor ebx, ebx
push edi
and byte [esi + 0x10], bl
and byte [esi + 0x30], bl
mov dword [esi], 0x429560
mov dword [esi + 0xc], ebx
mov dword [esi + 4], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
push ebx
push eax
mov dword [esi + 0x14], eax
call sub.MSVCRT.dll_memset
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
push ebx
push eax
mov dword [esi + 0x18], eax
call sub.MSVCRT.dll_memset
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
push ebx
push eax
mov dword [esi + 0x1c], eax
call sub.MSVCRT.dll_memset
mov ebx, 0x80
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push ebx
push 0
push eax
mov dword [esi + 0x20], eax
call sub.MSVCRT.dll_memset
add esp, 0x40
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push ebx
push 0
push eax
mov dword [esi + 0x24], eax
call sub.MSVCRT.dll_memset
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
push 0
push eax
mov dword [esi + 0x28], eax
call sub.MSVCRT.dll_memset
add esp, 0x20
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x4046d0
cmp dword [ebp + 8], ebx
jb 0x4046d0
mov eax, dword [esi + 0x24]
mov byte [eax + 0x7c], 0x2e
mov eax, dword [esi + 0x24]
mov byte [eax + 0x7d], 0x2e
mov eax, dword [esi + 0x24]
mov byte [eax + 0x7e], 0x2e
mov eax, dword [esi + 0x24]
and byte [eax + 0x7f], 0
push str.RICHED32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x4046f5
push 0x30
push 0x439490
push 0x439648
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x404c2a
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push ecx
push 0x404c06
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop ecx
ret
Function at 0x40cfe9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, 0x2000
push edi
xor ebx, ebx
push esi
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40d084
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
push ebx
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x40d034
cmp dword [ebp - 8], ebx
je 0x40d039
mov byte [ebp - 1], 1
jmp 0x40d039
cmp dword [ebp - 8], ebx
je 0x40d06c
push ebx
push ebx
push ebx
call fcn.0042274c
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
push edi
push eax
call fcn.0042274c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push 4
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add dword [ebp - 0xc], 4
add esp, 0x24
add dword [ebp + 0xc], 4
jmp 0x40d015
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
cmp byte [ebp - 1], bl
pop ecx
je 0x40d089
or eax, 0xffffffff
jmp 0x40d08c
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40d0e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x2c1], 0
je 0x40d1ff
cmp byte [esi + 0x2c0], 0
jne 0x40d1df
cmp dword [ebp + 8], 0x2000
jg 0x40d1ff
cmp dword [ebp + 0xc], 2
push 1
mov byte [ebp - 1], 1
pop edi
sete al
test al, al
je 0x40d141
push edi
push 0
push dword [ebp + 8]
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40d1e8
jmp 0x40d1d8
push dword [ebp + 8]
mov ecx, dword [esi + 0xc8]
push dword [esi + 0x2a0]
call fcn.0041e719
test eax, eax
je 0x40d1c6
cmp dword [ebp + 0xc], 0
jne 0x40d163
and byte [ebp - 1], 0
cmp byte [ebp - 1], 0
mov dword [ebp + 0xc], 0x2000
je 0x40d194
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push dword [esi + 0x2a0]
push eax
push dword [esi + 0x2a4]
call fcn.00422865
add esp, 0x10
test eax, eax
jne 0x40d1d8
mov ecx, dword [ebp + 0xc]
jmp 0x40d197
mov ecx, dword [ebp + 8]
cmp byte [ebp - 1], 0
je 0x40d1a5
mov eax, dword [esi + 0x2a4]
jmp 0x40d1ab
mov eax, dword [esi + 0x2a0]
lea edx, [esi + 0x2b8]
push 0
push edx
push ecx
push eax
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
jmp 0x40d1d4
mov ecx, esi
mov byte [esi + 0x2c0], 1
call fcn.0040d205
test edi, edi
jne 0x40d1ed
mov byte [esi + 0x2c0], 1
mov ecx, esi
call fcn.0040d205
jmp 0x40d1ff
mov eax, dword [ebp + 8]
jmp 0x40d1f3
mov eax, dword [esi + 0x2b8]
add dword [esi + 0x2bc], eax
inc dword [esi + 0x2b4]
pop edi
pop esi
leave
ret 8
Function at 0x40d205
Capabilities:
Clear file content
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
cmp byte [esi + 0x2c1], 0
lea eax, [esi + 0x2c1]
je 0x40d2ff
and byte [eax], 0
push edi
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea edi, [esi + 0x28c]
push edi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x40d2c2
push edi
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
call edi
mov word [ebp - 0x16], ax
lea eax, [esi + 0x28f]
push eax
call edi
mov word [ebp - 0x12], ax
lea eax, [esi + 0x292]
push eax
call edi
mov word [ebp - 0x18], ax
lea eax, [esi + 0x297]
push eax
call edi
mov word [ebp - 0x10], ax
lea eax, [esi + 0x29a]
push eax
call edi
and word [ebp - 0xa], 0
and word [ebp - 0xc], 0
add esp, 0x14
mov word [ebp - 0xe], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x148]
mov ecx, esi
push eax
call fcn.0040d88d
mov eax, dword [esi + 0x2a4]
pop edi
test eax, eax
je 0x40d2ee
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov esi, dword [esi + 0x2a0]
test esi, esi
je 0x40d2ff
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop esi
leave
ret
Function at 0x40d58c
Capabilities:
Delete file

Disassembly:
mov eax, 0x427b60
call fcn.00427220
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x24]
mov edi, eax
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x41e]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [eax], bl
jne 0x40d5c7
push edi
jmp 0x40d665
cmp byte [esi + 0x41d], bl
mov byte [eax], bl
mov byte [ebp - 0x20], 7
mov byte [ebp - 0x1f], 6
je 0x40d5dd
mov byte [ebp - 0x1f], 7
mov ecx, dword [esi + 0xc8]
push 7
lea eax, [ebp - 0x20]
push 0xc
push eax
call fcn.0041e5d4
push dword [esi + 0x408]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x2a0]
cmp eax, ebx
je 0x40d60d
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, dword [esi + 0x2a4]
cmp eax, ebx
je 0x40d61e
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
lea edi, [esi + 0x2c2]
mov esi, str._UVNCDIR_
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strrchr]
push 0x5c
push edi
call esi
pop ecx
inc eax
pop ecx
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x40d662
push 0x2c
push edi
call esi
pop ecx
cmp eax, ebx
pop ecx
je 0x40d65b
mov byte [eax], bl
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40d88d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
cmp byte [ecx + 0x2c0], 0
push ebx
push esi
mov dword [ebp - 4], ecx
jne 0x40d953
mov esi, str._UVNCDIR_
push esi
call sub.MSVCRT.dll_strlen
mov ebx, dword [ebp + 8]
pop ecx
push eax
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strrchr]
push 0x5c
push ebx
call esi
pop ecx
inc eax
pop ecx
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x40d953
push edi
lea eax, [ebp - 0x310]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x310]
push 0x5c
push eax
call esi
mov edi, eax
push 0x2d
inc edi
push edi
call dword [sym.imp.MSVCRT.dll_strchr]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x108]
push 0x2e
push eax
call esi
and byte [eax], 0
add esp, 0x28
test edi, edi
je 0x40d920
and byte [edi], 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x310]
pop ecx
push ebx
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x144]
call fcn.004207fb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x40f682
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
xor ebx, ebx
cmp word [0x438b72], bx
push esi
push edi
mov esi, ecx
mov edi, str.WinVNC_desktop_sink
jne 0x40f6f1
mov eax, dword [0x439248]
push ebx
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0x4100f2
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ebx
call dword [sym.imp.USER32.dll_RegisterClassExA]
cmp ax, bx
mov word [0x438b72], ax
jne 0x40f6f1
push str.C:cppSCZ_SCwinvncwinvnc_vncdesktop.cpp_:_failed_to_register_window_class_n
jmp 0x40f72c
push ebx
mov eax, 0x80000000
push dword [0x439248]
push ebx
push ebx
push 0xc8
push 0x190
push eax
push eax
push 0xcf0000
push str.WinVNC
push edi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [esi + 0xf0], eax
jne 0x40f73e
push str.C:cppSCZ_SCwinvncwinvnc_vncdesktop.cpp_:_failed_to_create_hook_window_n
push ebx
push 0x4386e8
call fcn.00405446
add esp, 0xc
xor eax, eax
jmp 0x40f78d
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push dword [esi + 0xf0]
call dword [sym.imp.USER32.dll_SetClipboardViewer]
mov ecx, esi
mov dword [esi + 0xf8], eax
mov byte [esi + 0xb8], bl
call fcn.004106ba
test eax, eax
je 0x40f78a
lea eax, [ebp - 4]
push eax
push ebx
push dword [esi + 0xf0]
push 0x40f5ee
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40fc97
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov ebx, eax
lea eax, [ebx + ebx + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor esi, esi
pop ecx
mov edi, eax
xor ecx, ecx
test ebx, ebx
jle 0x40fcdb
mov eax, dword [ebp + 8]
add eax, ecx
cmp byte [eax], 0xa
jne 0x40fcd0
mov byte [esi + edi], 0xd
inc esi
mov al, byte [eax]
mov byte [esi + edi], al
inc esi
inc ecx
cmp ecx, ebx
jl 0x40fcc1
mov eax, dword [ebp - 4]
and byte [esi + edi], 0
push dword [eax + 0xf0]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40fd2f
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40fd2f
inc esi
push esi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40fd2f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4103bd
Capabilities:
Create thread
Power down monitor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push str.user32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test eax, eax
jne 0x4103f1
mov ecx, dword [esi + 0xe8]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x21c]
mov ecx, esi
call fcn.004106ba
test eax, eax
je 0x41040b
mov ecx, dword [esi + 0xe8]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x21c]
call fcn.0041a0cb
push 1
pop edi
cmp eax, edi
jne 0x41042a
mov eax, dword [esi + 0x638]
cmp eax, ebx
je 0x410443
movzx ecx, byte [ebp + 8]
push ecx
call eax
jmp 0x410443
mov ecx, dword [esi + 0xe8]
movzx edx, byte [ebp + 8]
mov eax, dword [ecx]
push edx
call dword [eax + 0x110]
mov dword [esi + 0x604], edi
mov ecx, dword [esi + 0xe8]
mov eax, dword [ecx]
call dword [eax + 0x1ac]
test eax, eax
je 0x410563
mov ecx, dword [esi + 0xe8]
cmp byte [ebp + 8], bl
mov eax, dword [ecx]
je 0x4104f3
call dword [eax + 0x220]
test eax, eax
jne 0x4104c0
push ebx
push 0x100
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [esi + 0x5f8]
push ebx
push eax
push ebx
push 0x50
call edi
push ebx
push ebx
push 0x64
push 0x52
call edi
push ebx
push ebx
push 1
push 0x56
call edi
push 2
push 0xf170
push 0x112
push dword [esi + 0xf0]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x410563
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push 0x4013e6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0xe4], ebx
lea eax, [esi + 0xe4]
setne cl
mov byte [esi + 0x5fc], cl
mov dword [eax], ebx
jmp 0x410563
call dword [eax + 0x220]
test eax, eax
jne 0x41053b
mov eax, dword [esi + 0x5f8]
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
cmp eax, ebx
je 0x410514
push ebx
push ebx
push eax
push 0x52
call edi
push ebx
push ebx
push ebx
push 0x56
call edi
push 0xffffffffffffffff
push 0xf170
push 0x112
push dword [esi + 0xf0]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x5f8], ebx
jmp 0x410563
push ebx
push str.blackscreen
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x410556
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
movzx eax, byte [esi + 0x5fc]
mov dword [esi + 0xe4], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4108ef
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov esi, ecx
je 0x4109d2
lea eax, [ebp - 0x158]
push 0x104
push eax
push ebx
mov dword [esi + 0x614], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x410953
lea eax, [ebp - 0x158]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x4109f2
mov byte [eax], bl
lea eax, [ebp - 0x158]
push str.16bithlp.exe
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x44
lea eax, [ebp - 0x54]
pop edi
push edi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], edi
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x158]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41099c
push str.C:cppSCZ_SCwinvncwinvnc_vncdesktop.cpp_:_set_ddihooks_Failed_n
push ebx
push 0x4386e8
call fcn.00405446
add esp, 0xc
jmp 0x4109ec
push str.C:cppSCZ_SCwinvncwinvnc_vncdesktop.cpp_:_set_ddihooks_OK_n
push ebx
push 0x4386e8
call fcn.00405446
add esp, 0xc
mov dword [esi + 0x5f4], 1
push 0x2710
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x614], eax
jmp 0x4109f2
mov eax, dword [esi + 0x614]
lea edi, [esi + 0x614]
cmp eax, ebx
je 0x4109f2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [edi], ebx
mov dword [esi + 0x5f4], ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x414514
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push str.C:cppSCZ_SCwinvncwinvnc_vncencoder.cpp_:_remote_palette_data_requested_n
mov ebx, 0x4386e8
push 9
mov esi, ecx
push ebx
call fcn.00405446
add esp, 0xc
cmp byte [esi + 0x13], 0
jne 0x414549
mov ecx, esi
call fcn.0041469c
test eax, eax
je 0x414629
cmp byte [esi + 0x23], 0
jne 0x414629
cmp byte [esi + 0x13], 0
je 0x41462d
push str.C:cppSCZ_SCwinvncwinvnc_vncencoder.cpp_:_generating_BGR233_palette_data_n
push 9
push ebx
call fcn.00405446
mov cl, byte [esi + 0x30]
add esp, 0xc
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
push 1
pop ebx
shl ebx, cl
test eax, eax
mov dword [ebp - 8], ebx
je 0x41458a
push eax
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov eax, ebx
shl eax, 2
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [edi], eax
je 0x41460f
and dword [ebp - 4], 0
test ebx, ebx
jle 0x41460f
lea ebx, [eax + 1]
mov eax, dword [ebp - 4]
mov cl, byte [esi + 0x3c]
movzx edx, word [esi + 0x38]
sar eax, cl
movzx ecx, word [esi + 0x38]
and eax, edx
imul eax, eax, 0xff
cdq
idiv ecx
mov byte [ebx - 1], al
mov eax, dword [ebp - 4]
mov cl, byte [esi + 0x3a]
movzx edx, word [esi + 0x34]
sar eax, cl
movzx ecx, word [esi + 0x34]
and eax, edx
imul eax, eax, 0xff
cdq
idiv ecx
mov byte [ebx + 1], al
mov eax, dword [ebp - 4]
mov cl, byte [esi + 0x3b]
movzx edx, word [esi + 0x36]
sar eax, cl
movzx ecx, word [esi + 0x36]
and eax, edx
imul eax, eax, 0xff
cdq
idiv ecx
inc dword [ebp - 4]
mov byte [ebx], al
mov eax, dword [ebp - 4]
add ebx, 4
cmp eax, dword [ebp - 8]
jl 0x4145a8
mov ebx, 0x4386e8
mov edi, dword [edi]
test edi, edi
jne 0x41467f
push str.C:cppSCZ_SCwinvncwinvnc_vncencoder.cpp_:_failed_to_obtain_colour_map_data__n
push edi
push ebx
call fcn.00405446
add esp, 0xc
xor eax, eax
jmp 0x414695
push str.C:cppSCZ_SCwinvncwinvnc_vncencoder.cpp_:_generating_8_bit_palette_data_n
push 9
push ebx
call fcn.00405446
and byte [ebp - 0x16], 0
and byte [ebp - 0xc], 0
lea edi, [esi + 0xc]
lea eax, [ebp - 0x18]
add esi, 0x10
push eax
push esi
push edi
mov byte [ebp - 0x15], 1
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 0x18
mov word [ebp - 0x10], 0xff
mov word [ebp - 0x12], 0xff
mov word [ebp - 0x14], 0xff
mov byte [ebp - 0xe], 0x10
mov byte [ebp - 0xd], 8
call dword [0x431b94]
add esp, 0x18
jmp 0x414614
mov eax, dword [ebp + 0xc]
shl eax, 2
push eax
push edi
push dword [ebp + 8]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4169b4
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.WinVNC_Win32_SC_Instance_Mutex
push 0
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
pop esi
test eax, eax
jne 0x4169ce
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret
Function at 0x416a1e
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
jne 0x416a6d
mov eax, dword [esi + 4]
mov cl, byte [esi]
push 0
push eax
movzx eax, cl
push 0
push eax
mov byte [ebp - 4], cl
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_down_n
push 9
push 0x4386e8
call fcn.00405446
add esp, 0x10
mov byte [esi + 8], 1
pop esi
leave
ret

Function at 0x416a70
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x416ac1
mov eax, dword [esi + 4]
mov cl, byte [esi]
or al, 2
push 0
push eax
push 0
movzx eax, cl
push eax
mov byte [ebp - 4], cl
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_up_n
push 9
push 0x4386e8
call fcn.00405446
add esp, 0x10
mov byte [esi + 9], 1
pop esi
leave
ret

Function at 0x416ac4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor ecx, ecx
cmp byte [esi + 8], cl
je 0x416afc
mov eax, dword [esi + 4]
mov dl, byte [esi]
or al, 2
push ecx
push eax
push ecx
movzx eax, dl
push eax
mov byte [ebp - 4], dl
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_up_n
jmp 0x416b27
cmp byte [esi + 9], cl
je 0x416b36
mov eax, dword [esi + 4]
mov dl, byte [esi]
push ecx
push eax
movzx eax, dl
push ecx
push eax
mov byte [ebp - 4], dl
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi]
push str.fake__d_down_n
push 9
push 0x4386e8
call fcn.00405446
add esp, 0x10
pop esi
leave
ret
Function at 0x417488
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
movzx edi, byte [esp + 0x10]
push edi
call ebp
mov esi, dword [esp + 0x14]
shr eax, 0xf
and eax, 1
je 0x41751e
test esi, esi
jne 0x41751a
mov ecx, 0x43634c
test eax, eax
mov eax, str.down
jne 0x4174bc
mov eax, 0x43634c
push ebx
push ecx
push eax
push edi
push str.C:cppSCZ_SCwinvncwinvnc_vnckeymap.cpp_:_setshiftstate__d_____s___s__n
mov ebx, 0x4386e8
push 9
push ebx
call fcn.00405446
add esp, 0x18
neg esi
sbb esi, esi
push 0
and esi, 0xfffffffe
inc esi
inc esi
push esi
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_keybd_event]
push edi
call ebp
test ah, 0x80
mov eax, str.down
jne 0x417507
mov eax, 0x43634c
push eax
push edi
push str.C:cppSCZ_SCwinvncwinvnc_vnckeymap.cpp_:_new_state__d___s__n
push 9
push ebx
call fcn.00405446
add esp, 0x14
pop ebx
pop edi
pop esi
pop ebp
ret
test esi, esi
je 0x41751a
mov ecx, str.down
jmp 0x4174ae

Function at 0x4187d8
Capabilities:
Move file

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, ebx
jne 0x418800
push str.Error_opening_log_file_n
push ebx
push esi
mov byte [esi + 5], 1
mov byte [esi + 4], bl
call fcn.00405446
add esp, 0xc
jmp 0x4188aa
cmp byte [esi + 0x18], bl
push edi
mov byte [esi + 4], 1
jne 0x41884b
push eax
call sub.MSVCRT.dll_strlen
add eax, 5
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x41884b
push dword [esi + 0x14]
push edi
call sub.MSVCRT.dll_strcpy
push str..bak
push edi
call sub.MSVCRT.dll_strcat
add esp, 0x10
push 1
push edi
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, esi
call fcn.004188ad
push ebx
push 0x80
push 4
push ebx
push 1
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
pop edi
jne 0x41888d
push dword [esi + 0x14]
mov byte [esi + 5], 1
mov byte [esi + 4], bl
push str.Error_opening_log_file__s_n
push ebx
push esi
call fcn.00405446
add esp, 0x10
cmp byte [esi + 0x18], bl
je 0x4188a1
push 2
push ebx
push ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4188aa
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
pop ebx
ret