joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4205a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x430
mov dl, byte [ecx + 0x22]
push ebx
xor ebx, ebx
xor eax, eax
test dl, dl
push ebp
push esi
mov esi, dword [esp + 0x444]
push edi
setne al
mov dword [esp + 0x30], ecx
mov ebp, eax
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x40]
mov dword [esp + 0x20], ebx
rep stosd dword es:[edi], eax
xor edi, edi
cmp esi, ebx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
jle 0x42071a
jmp 0x4205f0
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x444]
cmp ebx, ecx
jge 0x42071a
mov eax, esi
xor edx, edx
sub eax, edi
mov dword [esp + 0x18], edx
test eax, eax
mov dword [esp + 0x28], eax
jle 0x4206e4
mov eax, ecx
sub eax, ebx
add eax, 0xfffffff9
mov dword [esp + 0x2c], eax
mov eax, edi
imul eax, ecx
mov dword [esp + 0x1c], eax
jmp 0x420633
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp edx, dword [esp + 0x2c]
jge 0x4206e4
add eax, edx
mov edx, dword [esp + 0x10]
xor ecx, ecx
lea esi, [eax + edx]
mov eax, dword [esp + 0x30]
mov edi, dword [eax + 0x197c]
lea eax, [edi + esi*4]
add eax, ebp
xor edx, edx
inc ecx
mov dl, byte [eax]
inc eax
mov dword [esp + ecx*4 + 0x30], edx
cmp ecx, 3
jl 0x420657
mov eax, dword [esp + 0x20]
lea ebx, [edi + esi*4 + 4]
add ebx, ebp
mov ebp, 7
add eax, ebp
mov dword [esp + 0x20], eax
xor ecx, ecx
mov edi, ebx
mov edx, dword [esp + ecx*4 + 0x34]
xor eax, eax
mov al, byte [edi]
mov esi, eax
sub eax, edx
cdq
xor eax, edx
mov dword [esp + ecx*4 + 0x34], esi
sub eax, edx
mov edx, dword [esp + eax*4 + 0x40]
inc edx
inc ecx
lea eax, [esp + eax*4 + 0x40]
inc edi
cmp ecx, 3
mov dword [eax], edx
jl 0x42067f
add ebx, 4
dec ebp
jne 0x42067b
mov ecx, dword [esp + 0x444]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x448]
add edx, ecx
mov ecx, dword [esp + 0x28]
inc eax
cmp eax, ecx
mov ecx, dword [esp + 0x444]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
jl 0x42062b
cmp ecx, esi
jle 0x4206fc
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], 0
add eax, esi
mov dword [esp + 0x10], eax
jmp 0x42070e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], 0
add eax, ecx
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x14]
cmp edi, esi
jl 0x4205ec
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x20]
mov eax, esi
shl eax, 5
add eax, esi
cdq
idiv edi
cmp eax, 0x5f
jl 0x420740
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x430
ret 8
xor eax, eax
mov ecx, 1
mov edx, dword [esp + ecx*4 + 0x40]
mov ebx, edx
imul ebx, ecx
imul ebx, ecx
add eax, ebx
test edx, edx
je 0x420731
mov ebx, dword [esp + ecx*4 + 0x3c]
add ebx, ebx
cmp edx, ebx
jg 0x420731
inc ecx
cmp ecx, 8
jl 0x420747
cmp ecx, 0x100
jge 0x420786
mov edx, dword [esp + ecx*4 + 0x40]
imul edx, ecx
imul edx, ecx
add eax, edx
inc ecx
cmp ecx, 0x100
jl 0x420771
lea ecx, [edi + edi*2]
pop edi
sub ecx, esi
xor edx, edx
pop esi
pop ebp
div ecx
pop ebx
add esp, 0x430
ret 8
Function at 0x427c20
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.WinVNC_Win32_Instance_Mutex
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
pop esi
test eax, eax
jne 0x427c3a
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret
Function at 0x428f50
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
mov edi, ebx
and edi, 0xff
push edi
call ebp
mov esi, dword [esp + 0x18]
shr eax, 0xf
and eax, 1
mov dword [esp + 0x14], eax
je 0x428f89
test esi, esi
jne 0x428ff3
mov ecx, 0x467e48
mov eax, str.down
jmp 0x428f97
test esi, esi
je 0x428ff3
mov ecx, str.down
mov eax, 0x467e48
push ecx
push eax
push edi
push str.S:UltraVNCwinvncwinvnc_vnckeymap.cpp_:_setshiftstate__d_____s___s__n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x18
neg esi
sbb esi, esi
push 0
and esi, 0xfffffffe
add esi, 2
push esi
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
push edi
call ebp
test ah, ah
mov eax, str.down
js 0x428fdd
mov eax, 0x467e48
push eax
push edi
push str.S:UltraVNCwinvncwinvnc_vnckeymap.cpp_:_new_state__d___s__n
push 9
push 0x46f3bc
call fcn.00405970
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x42ad20
Capabilities:
Move file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x14]
test edi, edi
jne 0x42ad45
push str.Error_opening_log_file_n
push edi
push esi
mov byte [esi + 5], 1
mov byte [esi + 4], 0
call fcn.00405970
add esp, 0xc
pop edi
pop esi
ret
mov al, byte [esi + 0x18]
push ebp
test al, al
mov byte [esi + 4], 1
jne 0x42adab
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 4
push ecx
call fcn.00449d10
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x42adab
mov ecx, dword [esi + 0x14]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x42ad71
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
mov eax, dword [str..bak]
dec edi
push ebp
mov dword [edi], eax
mov cl, byte [0x467e7c]
mov byte [edi + 4], cl
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push ebp
call fcn.00449d1e
add esp, 4
mov ecx, esi
call fcn.0042ae20
mov eax, dword [esi + 0x14]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
pop ebp
jne 0x42adf3
mov ecx, dword [esi + 0x14]
mov byte [esi + 5], 1
push ecx
push str.Error_opening_log_file__s_n
push 0
push esi
mov byte [esi + 4], 0
call fcn.00405970
add esp, 0x10
mov al, byte [esi + 0x18]
test al, al
je 0x42ae0d
mov edx, dword [esi + 0x10]
push 2
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
ret
Function at 0x42ae40
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0xc08
push ebx
push ebp
push esi
push edi
push 0
mov ebx, ecx
call fcn.00449d58
mov edx, dword [ebx + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea ecx, [ebx + 0x1c]
add esp, 4
cmp eax, edx
je 0x42aed2
push ecx
mov dword [ecx], eax
call fcn.0044be3b
mov esi, eax
mov al, byte [ebx + 5]
add esp, 4
test al, al
je 0x42ae81
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [ebx + 6]
test al, al
je 0x42aea8
lea eax, [esp + 0x10]
push 0
push eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call ebp
mov al, byte [ebx + 4]
test al, al
je 0x42aed2
mov edx, dword [ebx + 0x10]
test edx, edx
je 0x42aed2
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea edx, [esp + 0x81c]
push 0x400
push edx
push 0x400
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [esp + 0xc20]
mov ecx, dword [esp + 0xc1c]
push eax
push ecx
lea edx, [esp + 0x1c]
push 0x400
push edx
call fcn.0044bdeb
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
mov eax, dword [0x467e98]
or ecx, 0xffffffff
mov dword [edi - 1], eax
lea edi, [esp + 0x818]
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [ebx + 5]
mov ecx, edx
and ecx, 3
test al, al
rep movsb byte es:[edi], byte [esi]
je 0x42af7f
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [ebx + 6]
test al, al
je 0x42afac
lea ecx, [esp + 0x10]
push 0
push ecx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call ebp
mov al, byte [ebx + 4]
test al, al
je 0x42afdc
mov ebx, dword [ebx + 0x10]
test ebx, ebx
je 0x42afdc
lea eax, [esp + 0x10]
push 0
push eax
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret 8
Function at 0x42b790
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x10c
lea eax, [esp + 0xc]
push ebx
push ebp
push 0x100
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
je 0x42b7d2
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push ecx
push str.Host_name_unavailable
push edx
call fcn.0044abe0
add esp, 0xc
pop ebp
pop ebx
add esp, 0x10c
ret
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
jne 0x42b809
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push ecx
push str.IP_address_unavailable
push edx
call fcn.0044abe0
add esp, 0xc
pop ebp
pop ebx
add esp, 0x10c
ret
mov ebp, dword [esp + 0x118]
mov byte [ebp], 0
mov eax, dword [ebx + 0xc]
cmp dword [eax], 0
je 0x42b8dd
push esi
push edi
mov dword [esp + 0x10], 0
xor esi, esi
cmp word [ebx + 0xa], si
jle 0x42b87f
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + ecx]
xor ecx, ecx
lea edx, [esp + 0x14]
mov cl, byte [eax + esi]
push ecx
push 0x462fc0
push edx
call fcn.0044a04f
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x130]
not ecx
dec ecx
sub eax, ecx
lea ecx, [esp + 0x20]
dec eax
push eax
push ecx
push ebp
call fcn.0044ad20
movsx edx, word [ebx + 0xa]
add esp, 0x18
inc esi
cmp esi, edx
jl 0x42b832
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ecx + ebp - 1], al
mov eax, dword [ebx + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + eax + 4]
test edx, edx
je 0x42b8c3
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x124]
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, ecx
dec edx
push edx
push 0x462fbc
push ebp
call fcn.0044ad20
add esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 0xc]
add eax, 4
mov dword [esp + 0x10], eax
cmp dword [eax + ecx], 0
jne 0x42b82a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x42c8d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 0
mov esi, 4
push eax
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42c90f
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret
cmp dword [esp + 4], esi
je 0x42c91e
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret
mov eax, dword [esp + 8]
cmp eax, esi
mov eax, dword [esp + 0x18]
jne 0x42c92e
mov eax, dword [esp + 0x14]
pop esi
add esp, 8
ret
Function at 0x42c940
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
mov esi, 0x100
push edi
push ebx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
call ebp
test eax, eax
je 0x42c986
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [esp + 0x10], 3
je 0x42c997
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push esi
mov dword [esp + 0x18], esi
call fcn.00449d10
mov esi, eax
add esp, 4
test esi, esi
jne 0x42c9b2
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push esi
push eax
push 0
push edi
push ebx
call ebp
test eax, eax
je 0x42c9da
push esi
call fcn.00449d1e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [esp + 0x10], 3
je 0x42c9f4
push esi
call fcn.00449d1e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x42ca00
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x42ca20
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0xfe
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret
Function at 0x42e1d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458218
push 0x44be5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov esi, 4
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
push str.SoftwareORLWinVNC3
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e254
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x24]
push eax
push edi
push str.NewMSLogon
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42e254
cmp dword [ebp - 0x24], esi
jne 0x42e254
cmp dword [ebp - 0x28], esi
jne 0x42e254
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], 0xffffffff
call fcn.0042e276
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e290
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
dec eax
je 0x42e2f9
dec eax
je 0x42e2bc
xor eax, eax
add esp, 0x94
ret
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x42e2d7
mov eax, dword [esp + 8]
test eax, eax
mov eax, 1
add esp, 0x94
ret
cmp eax, 6
jne 0x42e2e8
mov eax, 1
add esp, 0x94
ret
cmp eax, 4
ja 0x42e2f9
mov eax, 3
add esp, 0x94
ret
mov eax, dword [esp + 8]
neg eax
sbb eax, eax
add eax, 5
add esp, 0x94
ret

Function at 0x4300e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ecx
push edx
push 0
push str.Password
push eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x18], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x430130
cmp dword [esp], 8
jg 0x430130
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
add esp, 0x10
ret 8
Function at 0x430140
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
mov esi, 1
push edi
push ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
call ebp
test eax, eax
je 0x430188
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
cmp dword [esp + 0x10], esi
je 0x43019a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
mov edx, dword [esp + 0x14]
push edx
call fcn.00449d10
mov esi, eax
add esp, 4
test esi, esi
jne 0x4301b7
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push esi
push ecx
push 0
push edi
push ebx
call ebp
test eax, eax
je 0x4301e1
push esi
call fcn.00449d1e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
cmp dword [esp + 0x10], 1
je 0x4301fd
push esi
call fcn.00449d1e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x430dc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
lea eax, [esp]
push esi
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x114]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
mov esi, 0x100
push str.DSMPlugin
push eax
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x430e1a
cmp dword [esp + 4], esi
jg 0x430e1a
push edi
mov edi, dword [esp + 0x118]
mov ecx, 0x40
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add esp, 0x108
ret 8
Function at 0x435f10
Capabilities:
Get session user name

Disassembly:
push ecx
mov eax, dword [0x480160]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x435ff9
call fcn.00436860
test eax, eax
je 0x435ff4
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
test eax, eax
je 0x43606e
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 4
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
call edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x435fb1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edi, 0x46f3a0
or ecx, 0xffffffff
xor eax, eax
mov dword [0x48016c], 0
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
cmp ecx, eax
jae 0x43606e
mov edx, dword [esp + 0x14]
mov eax, 0x46f3a0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x435f9d
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov eax, dword [0x48016c]
test eax, eax
jne 0x435ff4
mov edi, 0x46f3a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
cmp ecx, eax
jae 0x43606e
mov edx, dword [esp + 0x14]
mov eax, 0x46f3a0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x435fe0
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov eax, dword [0x480160]
test eax, eax
jbe 0x43606e
cmp eax, 2
ja 0x43606e
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x18]
mov dword [esp + 0x18], ebx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x43604d
call edi
cmp eax, 0x4dd
jne 0x436057
mov edi, 0x46f3a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jae 0x43606e
mov eax, 0x46f3a0
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x436043
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
call edi
push eax
push str.S:UltraVNCwinvncwinvnc_vncservice.cpp_:_getusername_error__d_n
push 0
push 0x46f3bc
call fcn.00405970
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x437440
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x108
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.winvnc
push 0
mov dword [0x480170], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
mov eax, dword [0x480170]
push eax
push str.winvnc
push str._s_error:__d
lea ecx, [esp + 0x18]
push 0x100
push ecx
call fcn.0044a8df
mov eax, dword [esp + 0x124]
add esp, 0x14
lea edx, [esp + 0xc]
mov dword [esp + 8], eax
test esi, esi
mov dword [esp + 4], edx
je 0x4374c3
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
lea ecx, [esp + 4]
push 0
push ecx
push 0
push 2
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 0x108
ret

Function at 0x437560
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 0
mov esi, 4
push eax
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4375a1
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret 0xc
cmp dword [esp + 4], esi
je 0x4375b2
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret 0xc
mov eax, dword [esp + 8]
cmp eax, esi
mov eax, dword [esp + 0x18]
jne 0x4375c2
mov eax, dword [esp + 0x14]
pop esi
add esp, 8
ret 0xc

Function at 0x4375d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
mov esi, 0x100
push edi
push ebx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
call ebp
test eax, eax
je 0x437618
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
cmp dword [esp + 0x10], 3
je 0x43762b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
push esi
mov dword [esp + 0x18], esi
call fcn.00449d10
mov esi, eax
add esp, 4
test esi, esi
jne 0x437648
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push esi
push eax
push 0
push edi
push ebx
call ebp
test eax, eax
je 0x437672
push esi
call fcn.00449d1e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
cmp dword [esp + 0x10], 3
je 0x43768e
push esi
call fcn.00449d1e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x4376a0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc

Function at 0x4376c0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0xfe
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc