joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479750
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55805e
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x118], eax
push 0x18
mov dword [ebp - 0x118], 0x5d1a60
mov dword [0x5d1a60], 0
mov dword [0x5d1a64], 0
call fcn.00524776
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [0x5d1a60], eax
mov dword [ebp - 4], 0
push 0x18
mov dword [0x5d1a68], 0
mov dword [0x5d1a6c], 0
call fcn.00524776
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [0x5d1a68], eax
mov byte [ebp - 4], 1
mov esi, 0x5c41c0
mov edi, 0x62
nop dword [eax + eax]
push esi
mov ecx, 0x5d1a60
call fcn.0047a840
movzx ecx, byte [esi + 4]
push esi
mov byte [eax], cl
mov ecx, 0x5d1a68
call fcn.0047a760
movzx ecx, byte [esi + 5]
add esi, 8
mov byte [eax], cl
sub edi, 1
jne 0x479810
push 0x100
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.00526a30
add esp, 0xc
xor esi, esi
movzx eax, byte [esi + 0x5c3c1c]
lea edi, [esi + 0x5c3c1c]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
movzx edx, ax
cmp dx, 0xffff
je 0x479913
mov ecx, edx
movzx ebx, dl
shr ecx, 8
mov al, cl
shl al, 7
mov byte [ebp - 0x100], al
mov al, cl
and al, 0xfe
and cl, 0xfc
shl al, 6
push 0
mov byte [ebp - 0xff], al
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
shl cl, 5
push eax
push 0
push ebx
mov byte [ebp - 0xfe], cl
call dword [sym.imp.USER32.dll_ToAscii]
test eax, eax
jns 0x479913
movzx eax, byte [edi]
push eax
push eax
push str.Found_dead_key_0x_x__c
push 8
push 0x5c3db0
call fcn.0041dde0
mov ecx, dword [0x5d1a74]
add esp, 0x14
cmp ecx, dword [0x5d1a78]
je 0x4798ee
mov al, byte [edi]
mov byte [ecx], al
inc dword [0x5d1a74]
jmp 0x4798fa
push edi
push ecx
mov ecx, 0x5d1a70
call fcn.004320e0
push 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
inc esi
cmp esi, 7
jb 0x479851
mov eax, 0x5d1a60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
Function at 0x47a6e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov bl, cl
movzx esi, bl
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test eax, 0x8000
je 0x47a75a
push 0x5b2afc
push str.down
push esi
push str.SetShiftState_:_setshiftstate__d_____s___s__n
push 9
push 0x5c3db0
call fcn.0041dde0
add esp, 0x14
push 2
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov cl, bl
call fcn.004384f0
add esp, 8
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test eax, 0x8000
mov ecx, 0x5b2afc
mov eax, str.down
cmove eax, ecx
push eax
push esi
push str.SetShiftState_:_new_state__d___s__n
push 9
push 0x5c3db0
call fcn.0041dde0
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x47c430
Capabilities:
Move file

Disassembly:
mov ecx, 0x5c3dc8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47c438
sub ecx, edx
jne 0x47c460
push str.Error_opening_log_file_n
push ecx
push 0x5c3db0
mov word [0x5c3db8], 0x100
call fcn.0041dde0
add esp, 0xc
ret
cmp byte [0x5c3fc8], 0
mov byte [0x5c3db8], 1
jne 0x47c4f6
mov ecx, 0x5c3dc8
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47c480
sub ecx, edx
push esi
lea eax, [ecx + 5]
push eax
call fcn.005247b4
mov esi, eax
add esp, 4
mov eax, 0x5c3dc8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47c4a0
sub eax, edx
push 0x5c3dc8
add eax, 5
push eax
push esi
call fcn.0052c1a3
mov ecx, 0x5c3dc8
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47c4c3
sub ecx, edx
push str..bak
lea eax, [ecx + 5]
push eax
push esi
call fcn.0052c1fd
add esp, 0xc
push 1
push esi
push 0x5c3dc8
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
call fcn.00524771
add esp, 4
pop esi
mov eax, dword [0x5c3dc4]
test eax, eax
je 0x47c510
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5c3dc4], 0
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push 0x5c3dc8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c3dc4], eax
cmp eax, 0xffffffff
jne 0x47c55e
push 0x5c3dc8
push str.Error_opening_log_file__s_n
push 0
push 0x5c3db0
mov word [0x5c3db8], 0x100
call fcn.0041dde0
mov eax, dword [0x5c3dc4]
add esp, 0x10
cmp byte [0x5c3fc8], 0
je 0x47c575
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
ret
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
ret
Function at 0x47fa20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [0x5d2010]
push str.RestoreDesktop_:_Restorewallpaper__i_n
push 8
push 0x5c3db0
call fcn.0041dde0
mov eax, dword [0x5d2010]
add esp, 0x10
test eax, eax
je 0x47faea
push dword [0x5d2014]
push eax
push str.RestoreDesktop_:_Restorewallpaper__i__i_n
push 8
push 0x5c3db0
call fcn.0041dde0
add esp, 0x14
cmp dword [0x5d2014], 0
je 0x47fa82
call fcn.00426d80
cmp eax, 0x40047
jb 0x47fa82
mov cl, 1
call fcn.00426e00
push 2
push 0x5d1c10
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47faea
mov ecx, 0x5d2018
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47fac0
sub ecx, edx
push ecx
push 0x5d2018
push 1
push 0
push str.WallpaperStyle
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5d2010], 0
mov esp, ebp
pop ebp
ret

Function at 0x480260
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x579be0
lea edx, [edi + 0x634]
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [esi]
jne 0x480292
test bl, bl
je 0x48028e
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x480292
add eax, 2
add esi, 2
test cl, cl
jne 0x480272
xor eax, eax
jmp 0x480297
sbb eax, eax
or eax, 1
test eax, eax
je 0x48032f
mov eax, str.SYSTEM
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x4802c4
test cl, cl
je 0x4802c0
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x4802c4
add edx, 2
add eax, 2
test cl, cl
jne 0x4802a4
xor eax, eax
jmp 0x4802c9
sbb eax, eax
or eax, 1
test eax, eax
je 0x48032f
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4802ee
inc dword [edi + 0x758]
mov byte [edi + 0x754], al
pop edi
pop esi
pop ebx
ret
cmp byte [edi + 0x754], 0
jne 0x4802fe
mov ecx, edi
call fcn.004803c0
mov ecx, edi
call fcn.00480920
lea eax, [edi + 0x75e]
push eax
lea eax, [edi + 0x270]
push 0x80
push eax
call fcn.00535a54
add esp, 0xc
lea eax, [edi + 0x258]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
pop edi
pop esi
pop ebx
ret
Function at 0x480f40
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0052c1a3
add esp, 0xc
mov dword [ebp - 0x118], 0
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
push 1
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsA]
test eax, eax
je 0x481162
mov edx, dword [ebp - 0x118]
xor edi, edi
mov esi, dword [ebp - 0x11c]
xor eax, eax
test edx, edx
je 0x480fdb
lea ecx, [esi + 8]
nop dword [eax]
cmp dword [ecx], edi
je 0x480fd5
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x480fb0
push esi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*2]
mov edi, dword [esi + eax*4]
push esi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test edi, edi
je 0x481162
lea eax, [ebp - 0x10c]
push eax
push edi
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x481162
push 1
push dword [ebp - 0x10c]
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 0
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x481156
lea eax, [ebp - 0x114]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push 4
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 1
push eax
push 0x1a
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
xor eax, eax
mov dword [ebp - 0x170], 0
mov word [ebp - 0x132], ax
xorps xmm0, xmm0
mov word [ebp - 0x144], ax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x174]
movlpd qword [ebp - 0x168], xmm0
push eax
push 0
push dword [ebp - 0x110]
lea eax, [ebp - 0x108]
movlpd qword [ebp - 0x160], xmm0
push 0x420
push 0
push 0
push 0
push eax
push 0
push dword [ebp - 0x114]
movlpd qword [ebp - 0x158], xmm0
movlpd qword [ebp - 0x150], xmm0
movlpd qword [ebp - 0x142], xmm0
movlpd qword [ebp - 0x13a], xmm0
movups xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x174], 0x44
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x16c], str.winsta0default
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x481128
push dword [ebp - 0x12c]
call esi
push dword [ebp - 0x130]
call esi
push dword [ebp - 0x110]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 0x10c]
call esi
push dword [ebp - 0x114]
call esi
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00524763
mov esp, ebp
pop ebp
ret
Function at 0x481180
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x288
mov eax, dword [0x5c3040]
xor eax, esp
mov dword [esp + 0x284], eax
push esi
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.00426780
test eax, eax
je 0x4811d8
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
push ecx
push 0x201eb
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x4811f0
mov byte [esp + 0x13], 0
jmp 0x4812e3
push 0x104
lea eax, [esp + 0x184]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x7c]
push 0x104
push eax
call fcn.0052c1a3
add esp, 0xc
lea eax, [esp + 0x78]
push str.__openhomepage
push 0x104
push eax
call fcn.0052c1fd
add esp, 0xc
lea eax, [esp + 0x30]
push 0x44
push 0
push eax
call fcn.00526a30
add esp, 0xc
mov dword [esp + 0x38], str.Winsta0Default
mov eax, 5
mov dword [esp + 0x30], 0x44
mov word [esp + 0x60], ax
xorps xmm0, xmm0
lea eax, [esp + 0x14]
movaps xmmword [esp + 0x20], xmm0
push 0
push esi
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
lea eax, [esp + 0x84]
je 0x4812a1
push dword [esp + 0x20]
push 0x408
jmp 0x4812a5
push 0
push 8
push 0
push 0
push 0
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4812c0
push eax
call edi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4812cb
push eax
call edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4812da
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4812f2
push eax
call edi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x4812f9
push esi
call edi
mov ecx, dword [esp + 0x28c]
mov al, byte [esp + 0x13]
pop edi
pop esi
xor ecx, esp
call fcn.00524763
mov esp, ebp
pop ebp
ret
Function at 0x484690
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x98], 0x94
push esi
lea eax, [ebp - 0x98]
push eax
mov dword [ebx], vtable.VNC_OSVersion.0
mov byte [ebx + 0x10], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0xb], 0
mov dword [ebx + 6], 0
mov byte [ebx + 0xa], 0
mov word [ebx + 4], 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1b0], 0
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinPE
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
sete al
mov byte [ebx + 0x11], al
mov eax, dword [ebp - 0x88]
sub eax, 1
je 0x4847a0
sub eax, 1
jne 0x4847a4
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
cmp eax, 6
jne 0x48474d
cmp ecx, 2
jae 0x48474f
jmp 0x484757
jbe 0x484755
mov byte [ebx + 6], 1
jmp 0x4847a4
jne 0x48476b
cmp ecx, 1
jne 0x484761
mov byte [ebx + 7], cl
jmp 0x4847a4
test ecx, ecx
jne 0x4847a0
mov byte [ebx + 8], 1
jmp 0x4847a4
cmp eax, 5
jne 0x4847a0
mov eax, dword [ebp - 0x90]
cmp eax, 2
jne 0x484785
mov byte [ebx + 9], 1
mov byte [ebx + 0xe], 1
jmp 0x4847a4
cmp eax, 1
jne 0x484792
mov byte [ebx + 9], al
mov byte [ebx + 0xe], al
jmp 0x4847a4
test eax, eax
jne 0x4847a0
mov byte [ebx + 0xa], 1
mov byte [ebx + 0xe], 1
jmp 0x4847a4
mov byte [ebx + 0xd], 1
cmp byte [ebx + 0xe], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sete al
cmp byte [ebx + 6], 0
mov byte [ebx + 0xf], al
je 0x48485a
push edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x484809
push str.RtlGetVersion
push eax
call esi
mov esi, eax
test esi, esi
je 0x484809
push 0x110
lea eax, [ebp - 0x1a8]
push 0
push eax
call fcn.00526a30
add esp, 0xc
mov dword [ebp - 0x1ac], 0x114
lea eax, [ebp - 0x1ac]
push eax
call esi
test eax, eax
je 0x48481f
push 0x114
lea eax, [ebp - 0x1ac]
push 0
push eax
call fcn.00526a30
add esp, 0xc
mov ecx, 0x45
lea edi, [ebp - 0x2c4]
lea esi, [ebp - 0x1ac]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x2c0], 0xa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop edi
jne 0x48485a
cmp dword [ebp - 0x2b8], 0x4a61
mov byte [ebx + 6], 0
mov byte [ebx + 4], 1
jb 0x48485a
mov byte [ebx + 5], 1
cmp dword [ebx + 0x14], 0
jne 0x48488a
push 0x5b3404
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebx + 0x14], eax
test eax, eax
je 0x48488a
push 0x5b343c
push eax
call esi
push str.DwmEnableComposition
push dword [ebx + 0x14]
mov dword [ebx + 0x18], eax
call esi
mov dword [ebx + 0x1c], eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00524763
mov esp, ebp
pop ebp
ret
Function at 0x48d2e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x2f4], 0
je 0x48d348
cmp byte [0x5c64d5], 0
jne 0x48d348
push str.vncServer::AutoConnectRetry_:_AutoConnectRetry__:_started_n
push 9
push 0x5c3db0
call fcn.0041dde0
mov eax, dword [esi + 0x70]
add esp, 0xc
test eax, eax
je 0x48d32a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48d348
push dword [esi + 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x5cf190]
push 0x48d2c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x70], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48e3a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x5c3040]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
lea eax, [esp + 8]
mov esi, ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x48e3e9
mov dword [esi], 0
mov eax, esi
pop esi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00524763
mov esp, ebp
pop ebp
ret
mov ax, word [esp + 8]
mov ecx, dword [esp + 0x19c]
mov word [0x5f2074], ax
mov eax, esi
mov dword [esi], 0xffffffff
pop esi
xor ecx, esp
call fcn.00524763
mov esp, ebp
pop ebp
ret

Function at 0x48e5c0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 1
cmp dword [esi + 8], 0xffffffff
je 0x48e5d9
call fcn.0048e620
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x48e614
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x48e614
mov ecx, esi
call fcn.0048e970
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48e700
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55985d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
mov edi, dword [ebp + 8]
je 0x48e7cb
xorps xmm0, xmm0
mov eax, 2
push edi
movlpd qword [ebp - 0x18], xmm0
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x48e772
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x48e7cb
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x48e7cb
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x20]
push 0x10
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x48e7bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x274d
jne 0x48e7cb
push eax
push str.VSocket::Connect_:_socket_communication_got__d_error_exit_vnc_process_n
push 9
push 0x5c3db0
call fcn.0041dde0
add esp, 0x10
call fcn.0042e0b0
test eax, eax
jne 0x48e7ea
jmp 0x48e7cb
mov ecx, esi
call fcn.0048e970
or eax, 0xffffffff
jmp 0x48e7cd
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret 8
push str.exited
lea ecx, [ebp - 0x38]
call fcn.0041e2b0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.0042e500
lea ecx, [ebp - 0x38]
call fcn.0041ca00
push 0
call fcn.0053b8b9
int3
Function at 0x48e820
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x48e8ca
lea ecx, [ebp - 4]
mov dword [ebp - 4], 4
push ecx
lea ecx, [ebp - 8]
push ecx
push 0x1001
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_getsockopt]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x8000
push eax
push 0x1001
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
cmp edi, 0xffffffff
je 0x48e8ca
push 0x23a4
call fcn.00524776
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, eax
call fcn.0048e420
mov esi, eax
test esi, esi
je 0x48e8ba
mov ecx, esi
mov dword [esi + 8], edi
call fcn.0048e970
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48e940
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x48e969
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x48e967
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x48e967
mov eax, dword [eax]
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x48ea40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x5f2074], 2
push esi
mov esi, ecx
jb 0x48ea96
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x48ea96
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
inc eax
neg eax
pop esi
sbb eax, eax
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x48eaa0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x5f2074], 2
push esi
mov esi, ecx
jae 0x48eab6
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x48eaaf
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
inc eax
neg eax
pop esi
sbb eax, eax
pop ebp
ret 4

Function at 0x48eb00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x5f2074], 2
push esi
mov esi, ecx
jae 0x48eb16
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x48eb0f
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
inc eax
neg eax
pop esi
sbb eax, eax
pop ebp
ret 4
Function at 0x48ec60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x239c]
add eax, edi
cmp eax, dword [esi + 0x23a0]
jb 0x48ed1a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x239c]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x23a0]
sub eax, ecx
push eax
lea eax, [ecx + 0x74]
add eax, esi
push ebx
push eax
call fcn.005264b0
mov ecx, dword [esi + 8]
lea edx, [esi + 0x74]
add esp, 8
push dword [esi + 0x23a0]
call fcn.0048f300
add esp, 8
test al, al
je 0x48ed42
mov ecx, dword [esi + 0x23a0]
mov eax, ecx
mov edi, dword [esi + 0x239c]
sub eax, edi
sub edi, ecx
mov dword [esi + 0x239c], 0
add edi, dword [ebp + 0xc]
add ebx, eax
cmp edi, ecx
jb 0x48ed1a
nop word [eax + eax]
push ecx
push ecx
mov ecx, dword [esi + 8]
mov edx, ebx
call fcn.0048f300
add esp, 8
test al, al
je 0x48ed42
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x23a0]
add ebx, ecx
sub edi, ecx
mov dword [esi + 0xc], eax
cmp edi, ecx
jae 0x48ecf0
mov ecx, dword [esi + 0x239c]
push edi
add ecx, 0x74
add ecx, esi
push ebx
push ecx
call fcn.005264b0
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x239c], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8