joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049ec0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov byte [rcx + 0x3b8], dl
test dl, dl
je 0x140049efd
mov rcx, qword [rcx + 0x3c0]
test rcx, rcx
je 0x140049ee9
call fcn.1400450d0
xor esi, esi
mov qword [rbp + 0x3c0], rsi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, gethostname
call fcn.140147b18
mov rdi, rax
mov qword [rsp + 0x60], rax
mov r14, qword [0x1402281b8]
mov byte [rax], 0
xor esi, esi
mov qword [rax + 4], rsi
mov qword [rax + 0xc], rsi
mov qword [rax + 0x30], r14
mov rbx, qword [0x14021f2c0]
test rbx, rbx
jne 0x140049f4a
lea ecx, [rsi + 0x58]
call fcn.140147b18
mov rbx, rax
mov qword [rsp + 0x70], rax
mov qword [0x14021f2c0], rax
cmp qword [0x14021f2b8], rsi
jne 0x140049fed
mov qword [0x14021f2b8], r14
mov edx, 0x42b
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx], rax
mov edx, 0x423
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 8], rax
mov edx, 0x424
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 0x10], rax
mov edx, 0x425
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 0x18], rax
mov edx, 0x426
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 0x20], rax
mov edx, 0x427
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 0x28], rax
mov edx, 0x428
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x48], esi
mov word [rbx + 0x4c], si
mov byte [rbx + 0x4e], sil
mov rbx, qword [0x14021f2c0]
test rbx, rbx
jne 0x14004a009
lea ecx, [rbx + 0x58]
call fcn.140147b18
mov rbx, rax
mov qword [rsp + 0x70], rax
mov qword [0x14021f2c0], rax
mov ecx, 1
mov eax, ecx
cmp byte [rbx + rax + 0x48], sil
je 0x14004a027
inc ecx
inc rax
cmp rax, 7
jl 0x14004a010
mov rax, rsi
jmp 0x14004a033
movsxd rax, ecx
mov byte [rax + rbx + 0x48], 1
mov rax, qword [rbx + rax*8]
mov qword [rdi + 0x18], rax
test rbx, rbx
jne 0x14004a053
lea ecx, [rbx + 0x58]
call fcn.140147b18
mov rbx, rax
mov qword [rsp + 0x60], rax
mov qword [0x14021f2c0], rax
mov rax, qword [rbx]
mov qword [rdi + 0x20], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x140023d80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov qword [rbp + 0x3c0], rdi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140051000
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor eax, eax
mov dword [rcx + 0xe9ec], eax
test edx, edx
jne 0x1400510e1
test r8d, r8d
jne 0x1400510ea
mov rcx, qword [0x14022a710]
cmp dword [rcx + 0xe3c], eax
jne 0x1400510c8
mov dword [rcx + 0xe3c], 1
mov dword [rbx + 0xe9e4], 1
mov dword [rbx + 0x8d0], eax
mov ecx, dword [rbx + 0xe9e8]
mov edx, 1
mov dword [rbx + 0xe9e8], edx
cmp ecx, edx
setne al
mov dword [rbx + 0xe9f0], eax
mov rax, qword [0x140227bc8]
test rax, rax
jne 0x140051094
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
cmp byte [rax + 0xc], 0
jne 0x14005116e
test rax, rax
jne 0x140051107
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
jmp 0x14005110a
mov dword [rbx + 0xe9e4], eax
mov dword [rbx + 0x8d0], eax
mov ecx, dword [rbx + 0xe9e8]
mov edx, eax
jmp 0x14005105a
test r8d, r8d
je 0x14005103f
mov dword [rcx + 0xe9e4], eax
mov dword [rcx + 0x8d0], 1
mov ecx, dword [rcx + 0xe9e8]
mov edx, eax
jmp 0x14005105a
mov rax, rcx
cmp byte [rax + 0xb], 0
jne 0x14005116e
test rcx, rcx
jne 0x140051139
mov ecx, gethostbyname
call fcn.140147b18
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
jmp 0x14005113c
mov rax, rcx
cmp byte [rax + 0xa], 0
jne 0x14005116e
test rcx, rcx
jne 0x140051168
mov ecx, gethostbyname
call fcn.140147b18
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.14007e8d0
mov rcx, rax
mov qword [0x140227bc8], rax
cmp byte [rcx + 8], 0
je 0x140051178
mov dword [rbx + 0xe9f0], 1
mov eax, dword [rbx + 0x8d0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 0xe9e4]
lea r8, str.vncDesktop::SethookMechanism_:_Sethook_restart_wanted_hook_d_driver_d__r_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
cmp dword [rbx + 0xe9f0], 0
je 0x1400511bc
lea r8, str.vncDesktop::SethookMechanism_:_Hookdll_status_changed__r_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0xe458]
cmp dword [rbx + 0x8d0], 0
je 0x14005120c
test rax, rax
je 0x1400511e2
cmp qword [rax + 0x20], 0
jne 0x140051206
mov dword [rbx + 0xe9f0], 1
mov dword [rbx + 0xe9ec], 1
lea r8, str.vncDesktop::SethookMechanism_:_Driver_Status_changed_r_n
xor edx, edx
lea rcx, vtable.VNCLog.0
add rsp, 0x30
pop rbx
jmp fcn.140018d00
add rsp, 0x30
pop rbx
ret
test rax, rax
je 0x140051206
cmp qword [rax + 0x20], 0
jne 0x1400511e2
mov dword [rbx + 0xe9ec], 1
mov dword [rbx + 0xe9f0], 1
add rsp, 0x30
pop rbx
ret
Function at 0x140051d70
Capabilities:
Print debug messages
Terminate thread
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0xea70], 0
mov rbx, rcx
mov byte [rcx + 0xea78], 1
mov edx, 9
lea rcx, vtable.VNCLog.0
mov dword [0x14021f634], 0
je 0x140051e56
lea r8, str.vncDesktop::StopInitWindowthread_:_vncDesktop::Tell_initwindowthread_to_close__n
call fcn.140018d00
mov ecx, dword [rbx + 0xe410]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov rcx, qword [rbx + 0xea70]
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
lea rcx, vtable.VNCLog.0
cmp eax, 0x102
jne 0x140051e2c
lea r8, str.vncDesktop::StopInitWindowthread_:_vncDesktop::ERROR:__messageloop_blocked__n
call fcn.140018d00
mov rcx, qword [rbx + 0xea70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0xea70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xe4b8], 0
mov qword [rbx + 0xea70], 0
add rsp, 0x20
pop rbx
ret
lea r8, str.vncDesktop::StopInitWindowthread_:_vncDesktop::_iniwindowthread_proper_closed__n
call fcn.140018d00
mov rcx, qword [rbx + 0xea70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xea70], 0
add rsp, 0x20
pop rbx
ret
lea r8, str.vncDesktop::StopInitWindowthread_:_initwindowthread_already_closed__n
add rsp, 0x20
pop rbx
jmp fcn.140018d00
Function at 0x140051e70
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread__n
mov byte [rdi + 0xea78], 0
mov edx, 9
lea rcx, vtable.VNCLog.0
mov rbx, rax
call fcn.140018d00
lea rax, [rsp + 0x30]
mov r9d, 0x100
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
je 0x140052041
xor ebx, ebx
lea rdx, [rsp + 0x40]
mov eax, ebx
lea r8, str.Default
nop dword [rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140052029
cmp rax, 8
jne 0x140051f00
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_default_desk_n
lea edx, [rax + 1]
lea rcx, vtable.VNCLog.0
call fcn.140018d00
cmp qword [rdi + 0xea70], rbx
jne 0x140052007
mov rcx, qword [rdi + 0xe408]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x14022a710]
cmp dword [rax + 0x788], ebx
je 0x140051f5c
call fcn.140030ab0
lea rax, [rdi + 0xe410]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x140052070]
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rdi + 0xe408]
mov edx, 0x2710
mov qword [rdi + 0xea70], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 9
lea rcx, vtable.VNCLog.0
cmp eax, 0x102
jne 0x140051ff1
lea r8, str.vncDesktop::StartInitWindowthread_:_ERROR:_initwindowthread_failed_to_start__n
call fcn.140018d00
mov rcx, qword [rdi + 0xea70]
test rcx, rcx
je 0x140051fe7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0xea70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0xe4b8], rbx
mov qword [rdi + 0xea70], rbx
xor al, al
mov byte [rdi + 0xea78], al
jmp 0x140052041
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_started_n
call fcn.140018d00
mov al, 1
mov byte [rdi + 0xea78], al
jmp 0x140052041
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_reactivate_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov al, 1
mov byte [rdi + 0xea78], al
jmp 0x140052041
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_no_default_desk_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140147af0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x14005a400
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
lea r8, str.vncEncoder::GetRemotePalette_:_remote_palette_data_requested_n
mov rdi, rcx
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
cmp word [rdi + 0x48], 0
je 0x14005a5c9
cmp word [rdi + 0x44], 0
je 0x14005a5c9
cmp word [rdi + 0x46], 0
je 0x14005a5c9
cmp byte [rdi + 0x23], 0
jne 0x14005a46b
mov rcx, rdi
call fcn.14005a640
test eax, eax
je 0x14005a5c9
cmp byte [rdi + 0x33], 0
jne 0x14005a5c9
cmp byte [rdi + 0x23], 0
lea rcx, vtable.VNCLog.0
mov qword [rsp + 0x70], rsi
mov edx, 9
mov qword [rsp + 0x40], r14
je 0x14005a55f
lea r8, str.vncEncoder::GetRemotePalette_:_generating_BGR233_palette_data_n
call fcn.140018d00
movzx ecx, byte [rdi + 0x40]
mov esi, 1
shl esi, cl
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14005a4ba
call fcn.14014e740
movsxd rsi, esi
lea rcx, [rsi*4]
call fcn.1401507f8
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14005a5a1
xor r9d, r9d
test rsi, rsi
jle 0x14005a5a1
lea r10, [rax + 1]
nop word [rax + rax]
movzx r8d, word [rdi + 0x48]
lea r10, [r10 + 4]
movzx ecx, byte [rdi + 0x4c]
xor edx, edx
mov eax, r9d
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
xor edx, edx
mov byte [r10 - 5], al
mov eax, r9d
movzx r8d, word [rdi + 0x44]
movzx ecx, byte [rdi + 0x4a]
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
xor edx, edx
mov byte [r10 - 3], al
mov eax, r9d
movzx r8d, word [rdi + 0x46]
inc r9d
movzx ecx, byte [rdi + 0x4b]
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
mov byte [r10 - 4], al
sub rsi, 1
jne 0x14005a4f0
jmp 0x14005a5a1
lea r8, str.vncEncoder::GetRemotePalette_:_generating_8_bit_palette_data_n
call fcn.140018d00
lea rdx, [rdi + 0x20]
mov dword [rsp + 0x22], 0xff0100
lea r8, [rsp + 0x20]
mov word [rsp + 0x20], 0x1820
lea rcx, [rdi + 0x18]
mov dword [rsp + 0x26], 0xff00ff
mov word [rsp + 0x2a], 0x810
mov byte [rsp + 0x2c], 0
call qword [0x1401ea808]
mov rax, qword [rdi + 0x18]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
test rax, rax
jne 0x14005a5df
lea r8, str.vncEncoder::GetRemotePalette_:_failed_to_obtain_colour_map_data__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x48
pop rdi
pop rbx
ret
mov ecx, 8
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rbx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x10], xmm1
sub rcx, 1
jne 0x14005a5e4
lea eax, [rcx + 1]
jmp 0x14005a5cb
Function at 0x14005b040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov edi, dword [rsp + 0xa0]
mov r10d, r9d
mov r15, rdx
mov r9, r8
mov rbp, rcx
lea eax, [r10 + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r14, eax
mov dword [rsp + 0x20], r14d
test edi, edi
jle 0x14005b0e0
movsxd rsi, dword [rsp + 0xa8]
xor r11d, r11d
xor r9d, r9d
mov ebx, edi
test r14d, r14d
jle 0x14005b0c4
mov r8, r11
lea rcx, [r9 + r15]
sub r8, r9
mov rdx, r14
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
lea rcx, [rcx + 1]
not al
mov byte [rcx - 1], al
sub rdx, 1
jne 0x14005b0b0
add r9, r14
add r11, rsi
sub rbx, 1
jne 0x14005b092
mov r10d, dword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
test r9, r9
jne 0x14005b158
mov eax, edi
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x14005b28d
mov ebx, r14d
mov ebp, eax
imul ebx, eax
mov rsi, r15
nop
test r14d, r14d
jle 0x14005b13f
mov r10d, ebx
mov r9, rsi
mov r11, r14
nop
movzx r8d, byte [r9]
lea r9, [r9 + 1]
movsxd rdx, r10d
inc r10d
movzx ecx, byte [rdx + r15]
movzx eax, cl
not al
or al, r8b
or r8b, cl
mov byte [r9 - 1], al
not r8b
or byte [rdx + r15], r8b
sub r11, 1
jne 0x14005b110
add ebx, r14d
add rsi, r14
sub rbp, 1
jne 0x14005b100
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx ebp, byte [rbp + 0x20]
shr ebp, 3
mov eax, ebp
imul eax, r10d
test al, 3
je 0x14005b176
nop dword [rax]
inc eax
test al, 3
jne 0x14005b170
test edi, edi
jle 0x14005b28d
mov ecx, dword [rsp + 0x20]
cdqe
mov qword [rsp + 0x28], rax
mov rax, rdi
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x80], r12
xor r12d, r12d
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov qword [rsp + 0x40], r13
nop dword [rax]
xor edi, edi
mov bl, 0x80
test r10d, r10d
jle 0x14005b26b
xor esi, esi
mov r13d, ebp
nop dword [rax]
nop word [rax + rax]
mov eax, edi
shr eax, 3
add eax, r12d
movsxd r11, eax
movzx r10d, byte [r11 + r15]
test bl, r10b
jne 0x14005b23a
xor edx, edx
test ebp, ebp
je 0x14005b23a
xor eax, eax
mov r8d, ebp
lea rcx, [r14 + rsi]
add r9, rcx
cmp byte [r9 + rax], 0
jne 0x14005b20a
inc edx
inc rax
cmp rax, r8
jl 0x14005b1f7
jmp 0x14005b232
xor r10b, bl
movsxd rax, edx
mov byte [r11 + r15], r10b
cmp rax, r8
jge 0x14005b232
lea rcx, [rax + r14]
sub r8, rax
add rcx, rsi
xor edx, edx
add rcx, qword [rsp + 0x90]
call fcn.14014a5c0
mov r9, qword [rsp + 0x90]
mov r10d, dword [rsp + 0x98]
mov eax, 0x80
shr bl, 1
movzx ebx, bl
cmove ebx, eax
inc edi
add rsi, r13
cmp edi, r10d
jl 0x14005b1d0
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add r14, rdx
add r12d, ecx
sub rax, 1
mov qword [rsp + 0x30], rax
jne 0x14005b1b0
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x80]
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140075280
Capabilities:
Set socket configuration

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
lea r8, str.vncHTTPConnectThread::run_undetached_:_started_HTTP_server_thread_n
lea rcx, vtable.VNCLog.0
mov edx, 9
call fcn.140018d00
cmp dword [rdi + 0x98], 0
jne 0x14007543e
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
xor esi, esi
nop word [rax + rax]
mov rcx, qword [rdi + 0xa8]
call fcn.14008a7e0
mov rbx, rax
test rax, rax
je 0x140075434
mov edx, 1
cmp dword [rdi + 0x98], esi
jne 0x14007542c
lea r8, str.vncHTTPConnectThread::run_undetached_:_HTTP_client_connected_n
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14026aca8], 2
jb 0x140075361
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x40], 0x3a98
mov r8d, 0x1006
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140075361
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1005
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x20]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0x10]
cmp rax, 0xffffffffffffffff
je 0x1400753f6
lea r8, str.VSocket::Shutdown_:_shutdown_socket_n
mov edx, 0xa
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0x10]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rbx + 0x10]
cmp rax, 0xffffffffffffffff
je 0x1400753f6
lea r8, str.VSocket::Close_:_closing_socket_n
mov edx, 0xa
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0x10]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x10], 0xffffffffffffffff
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140075411
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x28], rsi
mov qword [rbx + 8], rsi
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
cmp dword [rdi + 0x98], esi
je 0x1400752c0
jmp 0x140075434
mov rax, qword [rax]
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
lea r8, str.vncHTTPConnectThread::run_undetached_:_quitting_HTTP_server_thread_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140075940
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ecx, 0x401
movzx r12d, r8b
mov rsi, rdx
call fcn.140147b5c
mov r15, rax
xor ebp, ebp
mov r14, rax
nop
lea rdi, [rsp + 0x68]
mov ebx, 1
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x1400759a9
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1400759a7
movsxd rcx, eax
add rdi, rcx
sub ebx, eax
jmp 0x1400759b6
je 0x1400759e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140075a07
test ebx, ebx
jne 0x140075980
movzx eax, byte [rsp + 0x68]
cmp al, r12b
je 0x1400759fa
mov byte [r14], al
inc ebp
inc r14
cmp ebp, 0x3ff
jne 0x140075970
mov byte [r15 + 0x3ff], bl
mov rax, r15
jmp 0x140075a32
lea r8, str.VSocket::ReadExactHTTP_:_zero_bytes_read3_n
mov edx, 4
lea rcx, vtable.VNCLog.0
call fcn.140018d00
jmp 0x140075a28
movsxd rax, ebp
mov byte [rax + r15], 0
mov rax, r15
jmp 0x140075a32
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.VSocket::ReadExactHTTP_:_HTTP_socket_error:__d_n
mov edx, 4
mov r9d, eax
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, r15
call fcn.140147b10
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400760b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea r15, [0x14022a740]
mov qword [rsp + 0x38], r15
xor ebp, ebp
mov qword [0x14022a740], rbp
mov qword [0x14022a748], rbp
lea ecx, [rbp + 0x28]
call fcn.140147b18
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x14022a740], rax
lea r14, [0x14022a750]
mov qword [0x14022a750], rbp
mov qword [0x14022a758], rbp
lea ecx, [rbp + 0x28]
call fcn.140147b18
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x14022a750], rax
mov edi, ebp
lea rsi, [0x14021c4f5]
lea r12, [0x14021c4f0]
nop
movsxd rax, edi
lea rbx, [r12 + rax*8]
mov rdx, rbx
mov rcx, r15
call fcn.1400776d0
movzx ecx, byte [rsi - 1]
mov byte [rax], cl
mov rdx, rbx
mov rcx, r14
call fcn.1400775f0
movzx ecx, byte [rsi]
mov byte [rax], cl
inc edi
lea rsi, [rsi + 8]
cmp edi, 0x62
jb 0x140076170
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x50]
call fcn.14014a5c0
mov edi, ebp
lea rbx, [0x14021be3c]
nop
movzx ecx, byte [rbx]
call qword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
je 0x140076281
movsx rdx, ax
shr rdx, 8
movzx ecx, dl
shl cl, 7
mov byte [rsp + 0x60], cl
movzx ecx, dl
and cl, 0xfe
shl cl, 6
mov byte [rsp + 0x61], cl
and dl, 0xfc
shl dl, 5
mov byte [rsp + 0x62], dl
movzx esi, al
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_ToAscii]
test eax, eax
jns 0x140076281
movzx r9d, byte [rbx]
mov dword [rsp + 0x20], r9d
lea r8, str.Found_dead_key_0x_x__c
mov edx, 8
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rdx, qword [0x14022a768]
cmp rdx, qword [0x14022a770]
je 0x14007625a
movzx eax, byte [rbx]
mov byte [rdx], al
inc qword [0x14022a768]
jmp 0x140076269
mov r8, rbx
lea rcx, [0x14022a760]
call fcn.14004a760
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_ToAscii]
inc edi
inc rbx
cmp edi, 7
jb 0x1400761c0
mov rax, r15
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140147af0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140077530
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx esi, cl
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt eax, 0xf
jae 0x1400775e1
mov qword [rsp + 0x40], rbx
lea r8, str.SetShiftState_:_setshiftstate__d_____s___s__n
mov qword [rsp + 0x48], rbp
lea rbx, [0x1401fb344]
lea rbp, str.down
mov qword [rsp + 0x28], rbx
mov r9d, esi
mov qword [rsp + 0x20], rbp
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, 2
movzx ecx, sil
mov edx, eax
call fcn.140030680
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r9d, esi
lea r8, str.SetShiftState_:_new_state__d___s__n
bt eax, 0xf
lea rcx, vtable.VNCLog.0
mov edx, 9
cmovb rbx, rbp
mov qword [rsp + 0x20], rbx
call fcn.140018d00
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140078140
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x468
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, [rsp + 0x30]
call fcn.140022180
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x250]
lea r8, [0x1401e9c5c]
mov dword [rsp + 0x20], 0x200
lea rdx, str.path
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x250]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400781a7
test rax, rax
jne 0x1400781f3
mov r8d, 0x104
lea rdx, [rsp + 0x140]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400781e9
mov edx, 0x5c
lea rcx, [rsp + 0x140]
call fcn.140149b38
test rax, rax
je 0x14007820c
mov byte [rax], 0
lea r8, [rsp + 0x140]
jmp 0x1400781fb
lea r8, [rsp + 0x250]
mov edx, 0x104
lea rcx, [0x14021c202]
call fcn.140150800
lea r8, [0x14021c202]
mov edx, 0x200
lea rcx, [0x14021c000]
call fcn.140150800
lea r8, [0x1401ef4f8]
mov edx, 0x200
lea rcx, [0x14021c000]
call fcn.140150860
lea r8, str.WinVNC.log
mov edx, 0x200
lea rcx, [0x14021c000]
call fcn.140150860
cmp byte [0x14021bfe8], 0
mov byte [0x14021c200], 1
je 0x140078269
call fcn.140078290
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x468
ret