joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140047e30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
movzx ebp, r8b
mov rsi, rdx
mov rbx, rcx
cmp qword [rcx + 0x260], 0
jne 0x140047f68
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x5a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov edx, dword [rsi + 4]
mov r8d, edx
shl r8d, 0x10
mov ecx, edx
and ecx, 0xff00
or r8d, ecx
shl r8d, 8
mov eax, edx
and eax, 0xff0000
shr edx, 0x10
or eax, edx
shr eax, 8
or r8d, eax
cmp r8d, 1
sete al
mov byte [rbx + 0x828], al
mov ecx, dword [rsi + 8]
mov esi, ecx
shl esi, 0x10
mov eax, ecx
and eax, 0xff00
or esi, eax
shl esi, 8
mov eax, ecx
and eax, 0xff0000
shr ecx, 0x10
or eax, ecx
shr eax, 8
or esi, eax
xor edx, edx
mov r8d, 0x144
lea rcx, [rbx + 0x119]
call fcn.1401348e0
cmp esi, 0x142
ja 0x140047f5f
mov r8d, esi
lea rdx, [rbx + 0x119]
mov rcx, qword [rbx + 0x3b0]
call fcn.140087d80
test eax, eax
je 0x140047f5f
mov rax, qword [0x1401fef68]
cmp dword [rax + 0x790], 0
je 0x140047f5f
test bpl, bpl
je 0x140047f5f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x140047de0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x260], rax
mov eax, 1
jmp 0x140047f6a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400485c0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov byte [rcx + 0x3b8], dl
test dl, dl
je 0x1400485fd
mov rcx, qword [rcx + 0x3c0]
test rcx, rcx
je 0x1400485e9
call fcn.140043a20
xor esi, esi
mov qword [rbp + 0x3c0], rsi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, gethostname
call fcn.140131f18
mov rdi, rax
mov qword [rsp + 0x60], rax
mov r14, qword [0x1401fc848]
mov byte [rax], 0
xor esi, esi
mov qword [rax + 4], rsi
mov qword [rax + 0xc], rsi
mov qword [rax + 0x30], r14
mov rbx, qword [0x1401f3b20]
test rbx, rbx
jne 0x14004864a
lea ecx, [rsi + 0x58]
call fcn.140131f18
mov rbx, rax
mov qword [rsp + 0x70], rax
mov qword [0x1401f3b20], rax
cmp qword [0x1401f3b18], rsi
jne 0x1400486ed
mov qword [0x1401f3b18], r14
mov edx, 0x85
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx], rax
mov edx, 0x81
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 8], rax
mov edx, 0x82
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 0x10], rax
mov edx, 0x42e
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 0x18], rax
mov edx, 0x84
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 0x20], rax
mov edx, 0x86
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 0x28], rax
mov edx, 0x87
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x48], esi
mov word [rbx + 0x4c], si
mov byte [rbx + 0x4e], sil
mov rbx, qword [0x1401f3b20]
test rbx, rbx
jne 0x140048709
lea ecx, [rbx + 0x58]
call fcn.140131f18
mov rbx, rax
mov qword [rsp + 0x70], rax
mov qword [0x1401f3b20], rax
mov ecx, 1
mov eax, ecx
cmp byte [rbx + rax + 0x48], sil
je 0x140048727
inc ecx
inc rax
cmp rax, 7
jl 0x140048710
mov rax, rsi
jmp 0x140048733
movsxd rax, ecx
mov byte [rax + rbx + 0x48], 1
mov rax, qword [rbx + rax*8]
mov qword [rdi + 0x18], rax
test rbx, rbx
jne 0x140048753
lea ecx, [rbx + 0x58]
call fcn.140131f18
mov rbx, rax
mov qword [rsp + 0x60], rax
mov qword [0x1401f3b20], rax
mov rax, qword [rbx]
mov qword [rdi + 0x20], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x1400235e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov qword [rbp + 0x3c0], rdi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004f3e0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor eax, eax
mov dword [rcx + 0xe9ec], eax
test edx, edx
jne 0x14004f4c1
test r8d, r8d
jne 0x14004f4ca
mov rcx, qword [0x1401fef68]
cmp dword [rcx + 0xe3c], eax
jne 0x14004f4a8
mov dword [rcx + 0xe3c], 1
mov dword [rbx + 0xe9e4], 1
mov dword [rbx + 0x8d0], eax
mov ecx, dword [rbx + 0xe9e8]
mov edx, 1
mov dword [rbx + 0xe9e8], edx
cmp ecx, edx
setne al
mov dword [rbx + 0xe9f0], eax
mov rax, qword [0x1401fc428]
test rax, rax
jne 0x14004f474
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
cmp byte [rax + 0xc], 0
jne 0x14004f54e
test rax, rax
jne 0x14004f4e7
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
jmp 0x14004f4ea
mov dword [rbx + 0xe9e4], eax
mov dword [rbx + 0x8d0], eax
mov ecx, dword [rbx + 0xe9e8]
mov edx, eax
jmp 0x14004f43a
test r8d, r8d
je 0x14004f41f
mov dword [rcx + 0xe9e4], eax
mov dword [rcx + 0x8d0], 1
mov ecx, dword [rcx + 0xe9e8]
mov edx, eax
jmp 0x14004f43a
mov rax, rcx
cmp byte [rax + 0xb], 0
jne 0x14004f54e
test rcx, rcx
jne 0x14004f519
mov ecx, gethostbyname
call fcn.140131f18
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
jmp 0x14004f51c
mov rax, rcx
cmp byte [rax + 0xa], 0
jne 0x14004f54e
test rcx, rcx
jne 0x14004f548
mov ecx, gethostbyname
call fcn.140131f18
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.14007c180
mov rcx, rax
mov qword [0x1401fc428], rax
cmp byte [rcx + 8], 0
je 0x14004f558
mov dword [rbx + 0xe9f0], 1
mov eax, dword [rbx + 0x8d0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 0xe9e4]
lea r8, str.vncDesktop::SethookMechanism_:_Sethook_restart_wanted_hook_d_driver_d__r_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
cmp dword [rbx + 0xe9f0], 0
je 0x14004f59c
lea r8, str.vncDesktop::SethookMechanism_:_Hookdll_status_changed__r_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0xe458]
cmp dword [rbx + 0x8d0], 0
je 0x14004f5ec
test rax, rax
je 0x14004f5c2
cmp qword [rax + 0x20], 0
jne 0x14004f5e6
mov dword [rbx + 0xe9f0], 1
mov dword [rbx + 0xe9ec], 1
lea r8, str.vncDesktop::SethookMechanism_:_Driver_Status_changed_r_n
xor edx, edx
lea rcx, vtable.VNCLog.0
add rsp, 0x30
pop rbx
jmp fcn.140017a50
add rsp, 0x30
pop rbx
ret
test rax, rax
je 0x14004f5e6
cmp qword [rax + 0x20], 0
jne 0x14004f5c2
mov dword [rbx + 0xe9ec], 1
mov dword [rbx + 0xe9f0], 1
add rsp, 0x30
pop rbx
ret
Function at 0x140050170
Capabilities:
Print debug messages
Terminate thread
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0xea70], 0
mov rbx, rcx
mov byte [rcx + 0xea78], 1
mov edx, 9
lea rcx, vtable.VNCLog.0
mov dword [0x1401f3e94], 0
je 0x140050256
lea r8, str.vncDesktop::StopInitWindowthread_:_vncDesktop::Tell_initwindowthread_to_close__n
call fcn.140017a50
mov ecx, dword [rbx + 0xe410]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov rcx, qword [rbx + 0xea70]
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
lea rcx, vtable.VNCLog.0
cmp eax, 0x102
jne 0x14005022c
lea r8, str.vncDesktop::StopInitWindowthread_:_vncDesktop::ERROR:__messageloop_blocked__n
call fcn.140017a50
mov rcx, qword [rbx + 0xea70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0xea70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xe4b8], 0
mov qword [rbx + 0xea70], 0
add rsp, 0x20
pop rbx
ret
lea r8, str.vncDesktop::StopInitWindowthread_:_vncDesktop::_iniwindowthread_proper_closed__n
call fcn.140017a50
mov rcx, qword [rbx + 0xea70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xea70], 0
add rsp, 0x20
pop rbx
ret
lea r8, str.vncDesktop::StopInitWindowthread_:_initwindowthread_already_closed__n
add rsp, 0x20
pop rbx
jmp fcn.140017a50
Function at 0x140050270
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread__n
mov byte [rdi + 0xea78], 0
mov edx, 9
lea rcx, vtable.VNCLog.0
mov rbx, rax
call fcn.140017a50
lea rax, [rsp + 0x30]
mov r9d, 0x100
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
je 0x140050441
xor ebx, ebx
lea rdx, [rsp + 0x40]
mov eax, ebx
lea r8, str.Default
nop dword [rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140050429
cmp rax, 8
jne 0x140050300
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_default_desk_n
lea edx, [rax + 1]
lea rcx, vtable.VNCLog.0
call fcn.140017a50
cmp qword [rdi + 0xea70], rbx
jne 0x140050407
mov rcx, qword [rdi + 0xe408]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1401fef68]
cmp dword [rax + 0x788], ebx
je 0x14005035c
call fcn.14002fa50
lea rax, [rdi + 0xe410]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x140050470]
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rdi + 0xe408]
mov edx, 0x2710
mov qword [rdi + 0xea70], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 9
lea rcx, vtable.VNCLog.0
cmp eax, 0x102
jne 0x1400503f1
lea r8, str.vncDesktop::StartInitWindowthread_:_ERROR:_initwindowthread_failed_to_start__n
call fcn.140017a50
mov rcx, qword [rdi + 0xea70]
test rcx, rcx
je 0x1400503e7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0xea70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0xe4b8], rbx
mov qword [rdi + 0xea70], rbx
xor al, al
mov byte [rdi + 0xea78], al
jmp 0x140050441
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_started_n
call fcn.140017a50
mov al, 1
mov byte [rdi + 0xea78], al
jmp 0x140050441
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_reactivate_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov al, 1
mov byte [rdi + 0xea78], al
jmp 0x140050441
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_no_default_desk_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140131ef0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x140058770
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
lea r8, str.vncEncoder::GetRemotePalette_:_remote_palette_data_requested_n
mov rdi, rcx
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
cmp word [rdi + 0x48], 0
je 0x140058939
cmp word [rdi + 0x44], 0
je 0x140058939
cmp word [rdi + 0x46], 0
je 0x140058939
cmp byte [rdi + 0x23], 0
jne 0x1400587db
mov rcx, rdi
call fcn.1400589b0
test eax, eax
je 0x140058939
cmp byte [rdi + 0x33], 0
jne 0x140058939
cmp byte [rdi + 0x23], 0
lea rcx, vtable.VNCLog.0
mov qword [rsp + 0x70], rsi
mov edx, 9
mov qword [rsp + 0x40], r14
je 0x1400588cf
lea r8, str.vncEncoder::GetRemotePalette_:_generating_BGR233_palette_data_n
call fcn.140017a50
movzx ecx, byte [rdi + 0x40]
mov esi, 1
shl esi, cl
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14005882a
call fcn.140138b40
movsxd rsi, esi
lea rcx, [rsi*4]
call fcn.14013abf8
mov qword [rdi + 0x18], rax
test rax, rax
je 0x140058911
xor r9d, r9d
test rsi, rsi
jle 0x140058911
lea r10, [rax + 1]
nop word [rax + rax]
movzx r8d, word [rdi + 0x48]
lea r10, [r10 + 4]
movzx ecx, byte [rdi + 0x4c]
xor edx, edx
mov eax, r9d
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
xor edx, edx
mov byte [r10 - 5], al
mov eax, r9d
movzx r8d, word [rdi + 0x44]
movzx ecx, byte [rdi + 0x4a]
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
xor edx, edx
mov byte [r10 - 3], al
mov eax, r9d
movzx r8d, word [rdi + 0x46]
inc r9d
movzx ecx, byte [rdi + 0x4b]
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
mov byte [r10 - 4], al
sub rsi, 1
jne 0x140058860
jmp 0x140058911
lea r8, str.vncEncoder::GetRemotePalette_:_generating_8_bit_palette_data_n
call fcn.140017a50
lea rdx, [rdi + 0x20]
mov dword [rsp + 0x22], 0xff0100
lea r8, [rsp + 0x20]
mov word [rsp + 0x20], 0x1820
lea rcx, [rdi + 0x18]
mov dword [rsp + 0x26], 0xff00ff
mov word [rsp + 0x2a], 0x810
mov byte [rsp + 0x2c], 0
call qword [0x140196e28]
mov rax, qword [rdi + 0x18]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
test rax, rax
jne 0x14005894f
lea r8, str.vncEncoder::GetRemotePalette_:_failed_to_obtain_colour_map_data__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x48
pop rdi
pop rbx
ret
mov ecx, 8
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rbx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x10], xmm1
sub rcx, 1
jne 0x140058954
lea eax, [rcx + 1]
jmp 0x14005893b
Function at 0x1400593b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov edi, dword [rsp + 0xa0]
mov r10d, r9d
mov r15, rdx
mov r9, r8
mov rbp, rcx
lea eax, [r10 + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r14, eax
mov dword [rsp + 0x20], r14d
test edi, edi
jle 0x140059450
movsxd rsi, dword [rsp + 0xa8]
xor r11d, r11d
xor r9d, r9d
mov ebx, edi
test r14d, r14d
jle 0x140059434
mov r8, r11
lea rcx, [r9 + r15]
sub r8, r9
mov rdx, r14
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
lea rcx, [rcx + 1]
not al
mov byte [rcx - 1], al
sub rdx, 1
jne 0x140059420
add r9, r14
add r11, rsi
sub rbx, 1
jne 0x140059402
mov r10d, dword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
test r9, r9
jne 0x1400594c8
mov eax, edi
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x1400595fd
mov ebx, r14d
mov ebp, eax
imul ebx, eax
mov rsi, r15
nop
test r14d, r14d
jle 0x1400594af
mov r10d, ebx
mov r9, rsi
mov r11, r14
nop
movzx r8d, byte [r9]
lea r9, [r9 + 1]
movsxd rdx, r10d
inc r10d
movzx ecx, byte [rdx + r15]
movzx eax, cl
not al
or al, r8b
or r8b, cl
mov byte [r9 - 1], al
not r8b
or byte [rdx + r15], r8b
sub r11, 1
jne 0x140059480
add ebx, r14d
add rsi, r14
sub rbp, 1
jne 0x140059470
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx ebp, byte [rbp + 0x20]
shr ebp, 3
mov eax, ebp
imul eax, r10d
test al, 3
je 0x1400594e6
nop dword [rax]
inc eax
test al, 3
jne 0x1400594e0
test edi, edi
jle 0x1400595fd
mov ecx, dword [rsp + 0x20]
cdqe
mov qword [rsp + 0x28], rax
mov rax, rdi
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x80], r12
xor r12d, r12d
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov qword [rsp + 0x40], r13
nop dword [rax]
xor edi, edi
mov bl, 0x80
test r10d, r10d
jle 0x1400595db
xor esi, esi
mov r13d, ebp
nop dword [rax]
nop word [rax + rax]
mov eax, edi
shr eax, 3
add eax, r12d
movsxd r11, eax
movzx r10d, byte [r11 + r15]
test bl, r10b
jne 0x1400595aa
xor edx, edx
test ebp, ebp
je 0x1400595aa
xor eax, eax
mov r8d, ebp
lea rcx, [r14 + rsi]
add r9, rcx
cmp byte [r9 + rax], 0
jne 0x14005957a
inc edx
inc rax
cmp rax, r8
jl 0x140059567
jmp 0x1400595a2
xor r10b, bl
movsxd rax, edx
mov byte [r11 + r15], r10b
cmp rax, r8
jge 0x1400595a2
lea rcx, [rax + r14]
sub r8, rax
add rcx, rsi
xor edx, edx
add rcx, qword [rsp + 0x90]
call fcn.1401348e0
mov r9, qword [rsp + 0x90]
mov r10d, dword [rsp + 0x98]
mov eax, 0x80
shr bl, 1
movzx ebx, bl
cmove ebx, eax
inc edi
add rsi, r13
cmp edi, r10d
jl 0x140059540
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add r14, rdx
add r12d, ecx
sub rax, 1
mov qword [rsp + 0x30], rax
jne 0x140059520
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x80]
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140073860
Capabilities:
Set socket configuration

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
lea r8, str.vncHTTPConnectThread::run_undetached_:_started_HTTP_server_thread_n
lea rcx, vtable.VNCLog.0
mov edx, 9
call fcn.140017a50
cmp dword [rdi + 0xa8], 0
jne 0x140073a1e
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
xor esi, esi
nop word [rax + rax]
mov rcx, qword [rdi + 0xb8]
call fcn.140087410
mov rbx, rax
test rax, rax
je 0x140073a14
mov edx, 1
cmp dword [rdi + 0xa8], esi
jne 0x140073a0c
lea r8, str.vncHTTPConnectThread::run_undetached_:_HTTP_client_connected_n
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14023f4fc], 2
jb 0x140073941
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x40], 0x3a98
mov r8d, 0x1006
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140073941
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1005
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x20]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0x10]
cmp rax, 0xffffffffffffffff
je 0x1400739d6
lea r8, str.VSocket::Shutdown_:_shutdown_socket_n
mov edx, 0xa
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x10]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rbx + 0x10]
cmp rax, 0xffffffffffffffff
je 0x1400739d6
lea r8, str.VSocket::Close_:_closing_socket_n
mov edx, 0xa
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x10]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x10], 0xffffffffffffffff
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400739f1
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x28], rsi
mov qword [rbx + 8], rsi
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
cmp dword [rdi + 0xa8], esi
je 0x1400738a0
jmp 0x140073a14
mov rax, qword [rax]
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
lea r8, str.vncHTTPConnectThread::run_undetached_:_quitting_HTTP_server_thread_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400744f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea r15, [0x1401fef90]
mov qword [rsp + 0x38], r15
xor ebp, ebp
mov qword [0x1401fef90], rbp
mov qword [0x1401fef98], rbp
lea ecx, [rbp + 0x28]
call fcn.140131f18
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1401fef90], rax
lea r14, [0x1401fefa0]
mov qword [0x1401fefa0], rbp
mov qword [0x1401fefa8], rbp
lea ecx, [rbp + 0x28]
call fcn.140131f18
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1401fefa0], rax
mov edi, ebp
lea rsi, [0x1401f1415]
lea r12, [0x1401f1410]
nop
movsxd rax, edi
lea rbx, [r12 + rax*8]
mov rdx, rbx
mov rcx, r15
call fcn.140075ad0
movzx ecx, byte [rsi - 1]
mov byte [rax], cl
mov rdx, rbx
mov rcx, r14
call fcn.140075990
movzx ecx, byte [rsi]
mov byte [rax], cl
inc edi
lea rsi, [rsi + 8]
cmp edi, 0x62
jb 0x1400745b0
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x50]
call fcn.1401348e0
mov edi, ebp
lea rbx, [0x1401f0d5c]
nop
movzx ecx, byte [rbx]
call qword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
je 0x1400746c1
movsx rdx, ax
shr rdx, 8
movzx ecx, dl
shl cl, 7
mov byte [rsp + 0x60], cl
movzx ecx, dl
and cl, 0xfe
shl cl, 6
mov byte [rsp + 0x61], cl
and dl, 0xfc
shl dl, 5
mov byte [rsp + 0x62], dl
movzx esi, al
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_ToAscii]
test eax, eax
jns 0x1400746c1
movzx r9d, byte [rbx]
mov dword [rsp + 0x20], r9d
lea r8, str.Found_dead_key_0x_x__c
mov edx, 8
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rdx, qword [0x1401fefb8]
cmp rdx, qword [0x1401fefc0]
je 0x14007469a
movzx eax, byte [rbx]
mov byte [rdx], al
inc qword [0x1401fefb8]
jmp 0x1400746a9
mov r8, rbx
lea rcx, [0x1401fefb0]
call fcn.140048e30
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_ToAscii]
inc edi
inc rbx
cmp edi, 7
jb 0x140074600
mov rax, r15
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140131ef0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400758d0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx esi, cl
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt eax, 0xf
jae 0x140075981
mov qword [rsp + 0x40], rbx
lea r8, str.SetShiftState_:_setshiftstate__d_____s___s__n
mov qword [rsp + 0x48], rbp
lea rbx, [0x1401cf664]
lea rbp, str.down
mov qword [rsp + 0x28], rbx
mov r9d, esi
mov qword [rsp + 0x20], rbp
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, 2
movzx ecx, sil
mov edx, eax
call fcn.14002f620
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r9d, esi
lea r8, str.SetShiftState_:_new_state__d___s__n
bt eax, 0xf
lea rcx, vtable.VNCLog.0
mov edx, 9
cmovb rbx, rbp
mov qword [rsp + 0x20], rbx
call fcn.140017a50
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400765a0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x468
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, [rsp + 0x30]
call fcn.1400219e0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x250]
lea r8, [0x14019626c]
mov dword [rsp + 0x20], 0x200
lea rdx, str.path
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x250]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140076607
test rax, rax
jne 0x140076653
mov r8d, 0x104
lea rdx, [rsp + 0x140]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140076649
mov edx, 0x5c
lea rcx, [rsp + 0x140]
call fcn.140133e58
test rax, rax
je 0x14007666c
mov byte [rax], 0
lea r8, [rsp + 0x140]
jmp 0x14007665b
lea r8, [rsp + 0x250]
mov edx, 0x104
lea rcx, [0x1401f1122]
call fcn.14013ac00
lea r8, [0x1401f1122]
mov edx, 0x200
lea rcx, [0x1401f0f20]
call fcn.14013ac00
lea r8, [0x1401c3a08]
mov edx, 0x200
lea rcx, [0x1401f0f20]
call fcn.14013ac60
lea r8, str.WinVNC.log
mov edx, 0x200
lea rcx, [0x1401f0f20]
call fcn.14013ac60
cmp byte [0x1401f0f08], 0
mov byte [0x1401f1120], 1
je 0x1400766c9
call fcn.1400766f0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140131ef0
add rsp, 0x468
ret