joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418f30
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x2a0
lea eax, [esp + 0x1a0]
push ebx
push ebp
push esi
mov ebp, dword [esp + 0x2b0]
mov esi, ecx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esp + 0x2b4]
push edi
push eax
mov edx, dword [ecx + 0x3c]
push edx
push 0x41e
push ebp
call ebx
push eax
mov ecx, esi
call fcn.00418cd0
mov edi, 0x443d40
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x2b8]
mov eax, dword [edi + 0x3c]
push eax
push 4
push 0x110a
push 0x41e
push ebp
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call esi
test eax, eax
je 0x419007
mov ecx, dword [edi + 0x3c]
push ecx
push 4
push 0x110a
push 0x41e
push ebp
call ebx
push eax
call esi
push eax
push 0
push 0x1101
push 0x41e
push ebp
call ebx
push eax
call esi
mov edx, dword [edi + 0x3c]
push edx
push 4
push 0x110a
push 0x41e
push ebp
call ebx
push eax
call esi
test eax, eax
jne 0x418fc4
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
lea eax, [esp + 0x70]
lea ecx, [esp + 0x1b0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
push 0
mov dword [esp + 0x14], edi
call esi
cmp edi, 0xffffffff
je 0x41913f
mov esi, 0x443d3c
lea eax, [esp + 0x9c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x419067
test cl, cl
je 0x419063
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x419067
add eax, 2
add esi, 2
test cl, cl
jne 0x419043
xor eax, eax
jmp 0x41906c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41911c
mov esi, 0x443d38
lea eax, [esp + 0x9c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4190a4
test cl, cl
je 0x4190a0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4190a4
add eax, 2
add esi, 2
test cl, cl
jne 0x419080
xor eax, eax
jmp 0x4190a9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41911c
test byte [esp + 0x70], 0x10
je 0x41911c
mov ecx, dword [esp + 0x2b8]
lea eax, [esp + 0x9c]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x14]
mov edx, dword [ecx + 0x3c]
push eax
push 0
mov ecx, 0xa
lea esi, [esp + 0x50]
lea edi, [esp + 0x24]
push 0x1100
mov dword [esp + 0x54], 1
mov dword [esp + 0x20], edx
push 0x41e
rep movsd dword es:[edi], dword [esi]
push ebp
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
push ecx
push 0
push 0x1100
push 0x41e
push ebp
call ebx
push eax
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419037
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret 8
Function at 0x41b4d0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x40c]
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x410]
push eax
push ecx
lea edx, [esp + 0x14]
push 0x3fe
push edx
call fcn.004316a2
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
mov byte [esp + 0x40a], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x41b534
cmp ecx, 0x3fe
ja 0x41b534
cmp byte [esp + ecx + 0xb], 0xa
jne 0x41b534
mov byte [esp + ecx + 0xb], 0xd
mov byte [esp + ecx + 0xc], 0xa
mov byte [esp + ecx + 0xd], 0
mov al, byte [esi + 5]
test al, al
je 0x41b546
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [esi + 6]
test al, al
je 0x41b577
lea ecx, [esp + 8]
push 0
push ecx
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x14]
push ecx
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov al, byte [esi + 4]
test al, al
je 0x41b5a7
mov edx, dword [esi + 0xc]
test edx, edx
je 0x41b5a7
lea eax, [esp + 8]
push 0
push eax
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
add esp, 0x404
ret 8

Function at 0x41b840
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
sub esp, 0x104
push ebx
mov ebx, ecx
push ebp
push esi
push edi
lea eax, [ebx + 0xc4]
push 0x44a200
push eax
mov dword [ebx], 0x43c75c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, 0x44a200
or ecx, 0xffffffff
xor eax, eax
lea ebp, [ebx + 4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call fcn.004317c0
add esp, 8
test eax, eax
jne 0x41b8e2
lea edx, [esp + 0x10]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x104
ret
mov byte [eax + 1], 0
mov cl, byte [esp + 0x10]
xor eax, eax
cmp cl, 0x22
sete al
or ecx, 0xffffffff
lea edi, [esp + eax + 0x10]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ebx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x41b970
Capabilities:
Read .ini file

Disassembly:
push ebp
push esi
push edi
mov ebp, dword [esp + 0x14]
mov edi, ecx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0xc4]
push eax
push 0x104
push ecx
push 0x44a200
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
jne 0x41b9db
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x20]
mov ecx, edi
push ebx
push ebp
push eax
call fcn.0041b950
test eax, eax
je 0x41b9c6
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebx
mov eax, esi
pop edi
pop esi
pop ebp
ret 0x10
mov eax, esi
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x41b9f0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov ebx, dword [esp + 0x34]
mov esi, ecx
mov ebp, dword [esp + 0x30]
lea ecx, [esp + 0xc]
lea eax, [esi + 0xc4]
push eax
push 0x20
push ecx
push 0x44a200
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x41ba35
lea edx, [esp + 0xc]
push edx
call fcn.00431872
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
push edi
mov edi, dword [esp + 0x3c]
push edi
push ebx
push ebp
mov ecx, esi
call fcn.0041ba50
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc

Function at 0x41bb90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
mov edx, ecx
or ecx, 0xffffffff
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [edx + 4]
lea ebx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add edx, 0x84
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.RTSUI.ini
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov eax, dword [esp + 0x120]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x11c]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x11c]
push 0x104
push esi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x5c
push esi
mov edi, eax
call fcn.00431220
add esp, 8
test eax, eax
je 0x41bc4e
mov dl, byte [eax + 1]
lea ecx, [eax + 1]
cmp dl, 0x6e
jne 0x41bc3f
mov byte [eax], 0xd
mov byte [ecx], 0xa
push 0x5c
push ecx
call fcn.00431220
add esp, 8
test eax, eax
jne 0x41bc2e
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 0xc
Function at 0x41dae0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
push str.options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret

Function at 0x41def0
Capabilities:
Persist via app paths registry key
Set registry value

Disassembly:
sub esp, 0x328
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push esi
push edi
push eax
push str..vnc
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41df3b
mov ecx, dword [esp + 0xc]
push 0
push str.VncViewer.Config
push 1
push 0
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call edi
jmp 0x41df4f
push str.Failed_to_register_.vnc_extension_n
push 0
push 0x44a470
call fcn.00406360
add esp, 0xc
lea eax, [esp + 0x14]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41df82
push str.Error_getting_vncviewer_filename_n
push eax
push 0x44a470
call fcn.00406360
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x328
ret
lea ecx, [esp + 0x14]
push ecx
push str.Viewer_is__s_n
push 2
push 0x44a470
call fcn.00406360
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push str.VncViewer.Config
push closesocket
call ebx
test eax, eax
jne 0x41e061
push eax
push str.VNCviewer_Config_File
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push str.DefaultIcon
push edx
call ebx
test eax, eax
jne 0x41e00f
lea eax, [esp + 0x14]
lea ecx, [esp + 0x118]
push eax
push str._s_0
push ecx
call fcn.00430f4e
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x118]
push 0
push edx
push 1
push 0
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push str.Shellopencommand
push eax
call ebx
test eax, eax
jne 0x41e05a
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
push str.__s___config____1_
push edx
call fcn.00430f4e
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x118]
push 0
push eax
push 1
push 0
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_vncviewer.exe
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x41e08d
lea edx, [esp + 0x14]
push eax
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call edi
pop edi
pop esi
pop ebx
add esp, 0x328
ret

Function at 0x420160
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
lea eax, [esp + 4]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x42019d
mov eax, dword [esp]
add esp, 8
ret 0xc
Function at 0x420450
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x50
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push ebx
push esi
push edi
mov edi, dword [esp + 0x64]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x443d48
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x60]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
add esp, 0x50
ret 8

Function at 0x4204f0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc
Function at 0x420510
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
lea eax, [esp + 4]
push ebx
push eax
push str.SoftwareORLRTSServerSettings
mov ebx, ecx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4206d9
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push edi
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.SkipFullScreenPrompt
push ecx
mov dword [esp + 0x2c], 4
call esi
test eax, eax
mov edi, 1
jne 0x420579
cmp dword [esp + 0xc], edi
sete dl
mov byte [ebx + 0x10d], dl
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.NoToolbar
push eax
call esi
test eax, eax
jne 0x4205a7
cmp dword [esp + 0xc], edi
sete cl
mov byte [ebx + 0x10c], cl
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.LogToFile
push edx
call esi
test eax, eax
jne 0x4205d5
cmp dword [esp + 0xc], edi
sete al
mov byte [ebx + 0x374], al
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.HistoryLimit
push ecx
call esi
test eax, eax
jne 0x420600
mov edx, dword [esp + 0xc]
mov dword [ebx + 0x110], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.LocalCursor
push eax
call esi
test eax, eax
jne 0x42062b
mov ecx, dword [esp + 0xc]
mov dword [ebx + 0x234], ecx
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.LogLevel
push edx
call esi
test eax, eax
jne 0x420656
mov eax, dword [esp + 0xc]
mov dword [ebx + 0x370], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.ListenPort
push ecx
call esi
test eax, eax
jne 0x42067e
mov edx, dword [esp + 0xc]
mov dword [ebx + 8], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.LogFileName
push eax
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
jne 0x4206cc
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 0x376]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x114
ret
Function at 0x4206f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push str.SoftwareORLRTSServerSettings
mov ebx, ecx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebx + 0x234]
push 4
push ecx
push 4
push 0
push str.LocalCursor
push edx
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [ebx + 0x110]
push 4
push eax
push 4
push 0
push str.HistoryLimit
push ecx
call ebp
mov eax, dword [esp + 0x10]
lea edx, [ebx + 0x370]
push 4
push edx
push 4
push 0
push str.LogLevel
push eax
call ebp
lea edi, [ebx + 0x376]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 1
push eax
push str.LogFileName
push edx
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [ebx + 8]
push 4
push eax
push 4
push 0
push str.ListenPort
push ecx
call ebp
mov al, byte [ebx + 0x374]
xor edx, edx
test al, al
setne dl
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 4
push eax
push 4
push 0
push str.LogToFile
push ecx
call ebp
mov al, byte [ebx + 0x10d]
mov ecx, dword [esp + 0x10]
xor edx, edx
push 4
test al, al
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.SkipFullScreenPrompt
setne dl
push ecx
mov dword [esp + 0x2c], edx
call ebp
mov al, byte [ebx + 0x10c]
mov ecx, dword [esp + 0x10]
xor edx, edx
push 4
test al, al
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.NoToolbar
setne dl
push ecx
mov dword [esp + 0x2c], edx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x420de0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x43babf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 4]
mov ecx, edi
call fcn.0041c9c0
lea ecx, [esi + 0x6a0]
mov dword [esp + 0x1a4], 0
call fcn.00421c40
mov ecx, dword [esp + 0x1b0]
mov eax, dword [esp + 0x1ac]
mov dword [esi], 0x43c76c
push ecx
mov dword [0x44a4a4], esi
mov ecx, edi
mov byte [esp + 0x1a8], 1
mov dword [esi + 0x49c], eax
call fcn.0041cec0
mov edx, dword [esi + 0x374]
mov ecx, 0x44a470
push edx
call fcn.0041b420
mov al, byte [esi + 0x379]
test al, al
je 0x420e86
mov eax, dword [0x43c748]
mov edx, dword [0x43c750]
or eax, edx
mov ecx, 0x44a470
push eax
call fcn.0041b3c0
mov al, byte [esi + 0x378]
test al, al
je 0x420ea3
lea ecx, [esi + 0x37a]
push 0
push ecx
mov ecx, 0x44a470
call fcn.0041b430
lea edx, [esp + 0xc]
lea edi, [esi + 0x4a0]
mov ecx, 0x80
xor eax, eax
push edx
push 2
rep stosd dword es:[edi], eax
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x420edf
push 0x10
push str.VNC_info
push str.Error_initialising_sockets_library
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [esp + 0xc]
and eax, 0xffff
push eax
push str.Started_and_Winsock__v__d__initialised_n
push 3
push 0x44a470
call fcn.00406360
mov ecx, dword [esp + 0x1ac]
add esp, 0x10
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x1a0
ret 8

Function at 0x421150
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x43bb64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x10], esi
call fcn.00420de0
lea edx, [esp + 0x20]
xor ebx, ebx
push edx
lea ecx, [esi + 0x6c0]
mov dword [esp + 0x18], ebx
call fcn.004219f0
lea ecx, [esi + 0x6cc]
mov byte [esp + 0x14], 1
call fcn.00421c40
mov al, byte [esi + 0x263]
mov byte [esp + 0x14], 2
cmp al, bl
mov dword [esi], fcn.004215c0
mov dword [esi + 0x6bc], ebx
mov dword [esi + 0x6b8], ebx
je 0x4211f3
lea eax, [esi + 0x25a]
push 0x19
push eax
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutA]
test eax, eax
jne 0x4211f3
push 0x10
push str.VNC_info
push str.Error_loading_specified_keyboard_layout
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.004319e4
cmp byte [esi + 8], bl
je 0x421225
push ebx
push str.VNCviewer_Daemon
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x421225
push str.In_listening_mode___staring_daemons_n
push 3
push 0x44a470
call fcn.00406360
add esp, 0xc
mov ecx, esi
call fcn.004215c0
jmp 0x421228
mov byte [esi + 8], bl
mov ecx, esi
call fcn.004216a0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4216a0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [str.VNCviewerBell]
sub esp, 0x104
lea ecx, [esp + 4]
push ebx
push esi
push edi
push eax
push str.AppEventsEventLabels_s
push ecx
call fcn.00430f4e
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
jne 0x42182b
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push eax
push str.Bell
push 1
push eax
push ecx
call edi
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
mov ecx, dword [str.AppEventsSchemesAppsVNCviewer]
lea eax, [esp + 0xc]
push eax
push ecx
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
jne 0x42182b
mov edx, dword [str.VNCviewerBell]
mov eax, dword [str.AppEventsSchemesAppsVNCviewer]
push ebp
push edx
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call fcn.00430f4e
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push reloc.WSOCK32.dll_accept
call esi
mov ecx, dword [esp + 0x10]
push 0
push str.Bell
push 1
push 0
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, dword [str.VNCviewerBell]
mov ecx, dword [str.AppEventsSchemesAppsVNCviewer]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_s.current
push edx
call fcn.00430f4e
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push reloc.WSOCK32.dll_accept
call ebp
test eax, eax
je 0x4217c5
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push reloc.WSOCK32.dll_accept
call esi
mov ecx, dword [esp + 0x10]
push 0
push str.ding.wav
push 1
push 0
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, dword [str.VNCviewerBell]
mov ecx, dword [str.AppEventsSchemesAppsVNCviewer]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_s.default
push edx
call fcn.00430f4e
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push reloc.WSOCK32.dll_accept
call ebp
test eax, eax
pop ebp
je 0x421824
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push reloc.WSOCK32.dll_accept
call esi
mov ecx, dword [esp + 0xc]
push 0
push str.ding.wav
push 1
push 0
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x421bdb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x421c33
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x44a200
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x421c26
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x421c35
xor eax, eax
pop esi
leave
ret 4