joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058f50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
lea r8, str.vncEncoder::GetRemotePalette_:_remote_palette_data_requested_n
mov rdi, rcx
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
cmp word [rdi + 0x48], 0
je 0x140059119
cmp word [rdi + 0x44], 0
je 0x140059119
cmp word [rdi + 0x46], 0
je 0x140059119
cmp byte [rdi + 0x23], 0
jne 0x140058fbb
mov rcx, rdi
call fcn.140059190
test eax, eax
je 0x140059119
cmp byte [rdi + 0x33], 0
jne 0x140059119
cmp byte [rdi + 0x23], 0
lea rcx, vtable.VNCLog.0
mov qword [rsp + 0x70], rsi
mov edx, 9
mov qword [rsp + 0x40], r14
je 0x1400590af
lea r8, str.vncEncoder::GetRemotePalette_:_generating_BGR233_palette_data_n
call fcn.140018c00
movzx ecx, byte [rdi + 0x40]
mov esi, 1
shl esi, cl
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14005900a
call fcn.140139270
movsxd rsi, esi
lea rcx, [rsi*4]
call fcn.14013b328
mov qword [rdi + 0x18], rax
test rax, rax
je 0x1400590f1
xor r9d, r9d
test rsi, rsi
jle 0x1400590f1
lea r10, [rax + 1]
nop word [rax + rax]
movzx r8d, word [rdi + 0x48]
lea r10, [r10 + 4]
movzx ecx, byte [rdi + 0x4c]
xor edx, edx
mov eax, r9d
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
xor edx, edx
mov byte [r10 - 5], al
mov eax, r9d
movzx r8d, word [rdi + 0x44]
movzx ecx, byte [rdi + 0x4a]
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
xor edx, edx
mov byte [r10 - 3], al
mov eax, r9d
movzx r8d, word [rdi + 0x46]
inc r9d
movzx ecx, byte [rdi + 0x4b]
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
mov byte [r10 - 4], al
sub rsi, 1
jne 0x140059040
jmp 0x1400590f1
lea r8, str.vncEncoder::GetRemotePalette_:_generating_8_bit_palette_data_n
call fcn.140018c00
lea rdx, [rdi + 0x20]
mov dword [rsp + 0x22], 0xff0100
lea r8, [rsp + 0x20]
mov word [rsp + 0x20], 0x1820
lea rcx, [rdi + 0x18]
mov dword [rsp + 0x26], 0xff00ff
mov word [rsp + 0x2a], 0x810
mov byte [rsp + 0x2c], 0
call qword [0x140195e38]
mov rax, qword [rdi + 0x18]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
test rax, rax
jne 0x14005912f
lea r8, str.vncEncoder::GetRemotePalette_:_failed_to_obtain_colour_map_data__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140132620
add rsp, 0x48
pop rdi
pop rbx
ret
mov ecx, 8
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rbx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x10], xmm1
sub rcx, 1
jne 0x140059134
lea eax, [rcx + 1]
jmp 0x14005911b
Function at 0x140059b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov edi, dword [rsp + 0xa0]
mov r10d, r9d
mov r15, rdx
mov r9, r8
mov rbp, rcx
lea eax, [r10 + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r14, eax
mov dword [rsp + 0x20], r14d
test edi, edi
jle 0x140059c30
movsxd rsi, dword [rsp + 0xa8]
xor r11d, r11d
xor r9d, r9d
mov ebx, edi
test r14d, r14d
jle 0x140059c14
mov r8, r11
lea rcx, [r9 + r15]
sub r8, r9
mov rdx, r14
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
lea rcx, [rcx + 1]
not al
mov byte [rcx - 1], al
sub rdx, 1
jne 0x140059c00
add r9, r14
add r11, rsi
sub rbx, 1
jne 0x140059be2
mov r10d, dword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
test r9, r9
jne 0x140059ca8
mov eax, edi
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x140059ddd
mov ebx, r14d
mov ebp, eax
imul ebx, eax
mov rsi, r15
nop
test r14d, r14d
jle 0x140059c8f
mov r10d, ebx
mov r9, rsi
mov r11, r14
nop
movzx r8d, byte [r9]
lea r9, [r9 + 1]
movsxd rdx, r10d
inc r10d
movzx ecx, byte [rdx + r15]
movzx eax, cl
not al
or al, r8b
or r8b, cl
mov byte [r9 - 1], al
not r8b
or byte [rdx + r15], r8b
sub r11, 1
jne 0x140059c60
add ebx, r14d
add rsi, r14
sub rbp, 1
jne 0x140059c50
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx ebp, byte [rbp + 0x20]
shr ebp, 3
mov eax, ebp
imul eax, r10d
test al, 3
je 0x140059cc6
nop dword [rax]
inc eax
test al, 3
jne 0x140059cc0
test edi, edi
jle 0x140059ddd
mov ecx, dword [rsp + 0x20]
cdqe
mov qword [rsp + 0x28], rax
mov rax, rdi
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x80], r12
xor r12d, r12d
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov qword [rsp + 0x40], r13
nop dword [rax]
xor edi, edi
mov bl, 0x80
test r10d, r10d
jle 0x140059dbb
xor esi, esi
mov r13d, ebp
nop dword [rax]
nop word [rax + rax]
mov eax, edi
shr eax, 3
add eax, r12d
movsxd r11, eax
movzx r10d, byte [r11 + r15]
test bl, r10b
jne 0x140059d8a
xor edx, edx
test ebp, ebp
je 0x140059d8a
xor eax, eax
mov r8d, ebp
lea rcx, [r14 + rsi]
add r9, rcx
cmp byte [r9 + rax], 0
jne 0x140059d5a
inc edx
inc rax
cmp rax, r8
jl 0x140059d47
jmp 0x140059d82
xor r10b, bl
movsxd rax, edx
mov byte [r11 + r15], r10b
cmp rax, r8
jge 0x140059d82
lea rcx, [rax + r14]
sub r8, rax
add rcx, rsi
xor edx, edx
add rcx, qword [rsp + 0x90]
call fcn.140135010
mov r9, qword [rsp + 0x90]
mov r10d, dword [rsp + 0x98]
mov eax, 0x80
shr bl, 1
movzx ebx, bl
cmove ebx, eax
inc edi
add rsi, r13
cmp edi, r10d
jl 0x140059d20
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add r14, rdx
add r12d, ecx
sub rax, 1
mov qword [rsp + 0x30], rax
jne 0x140059d00
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x80]
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140074040
Capabilities:
Set socket configuration

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
lea r8, str.vncHTTPConnectThread::run_undetached_:_started_HTTP_server_thread_n
lea rcx, vtable.VNCLog.0
mov edx, 9
call fcn.140018c00
cmp dword [rdi + 0x98], 0
jne 0x1400741fe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
xor esi, esi
nop word [rax + rax]
mov rcx, qword [rdi + 0xa8]
call fcn.140087fc0
mov rbx, rax
test rax, rax
je 0x1400741f4
mov edx, 1
cmp dword [rdi + 0x98], esi
jne 0x1400741ec
lea r8, str.vncHTTPConnectThread::run_undetached_:_HTTP_client_connected_n
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14023e518], 2
jb 0x140074121
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x40], 0x3a98
mov r8d, 0x1006
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140074121
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1005
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x20]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0x10]
cmp rax, 0xffffffffffffffff
je 0x1400741b6
lea r8, str.VSocket::Shutdown_:_shutdown_socket_n
mov edx, 0xa
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rcx, qword [rbx + 0x10]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rbx + 0x10]
cmp rax, 0xffffffffffffffff
je 0x1400741b6
lea r8, str.VSocket::Close_:_closing_socket_n
mov edx, 0xa
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rcx, qword [rbx + 0x10]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x10], 0xffffffffffffffff
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400741d1
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x28], rsi
mov qword [rbx + 8], rsi
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
cmp dword [rdi + 0x98], esi
je 0x140074080
jmp 0x1400741f4
mov rax, qword [rax]
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
lea r8, str.vncHTTPConnectThread::run_undetached_:_quitting_HTTP_server_thread_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140074cd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea r15, [0x1401fdfb0]
mov qword [rsp + 0x38], r15
xor ebp, ebp
mov qword [0x1401fdfb0], rbp
mov qword [0x1401fdfb8], rbp
lea ecx, [rbp + 0x28]
call fcn.140132648
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1401fdfb0], rax
lea r14, [0x1401fdfc0]
mov qword [0x1401fdfc0], rbp
mov qword [0x1401fdfc8], rbp
lea ecx, [rbp + 0x28]
call fcn.140132648
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1401fdfc0], rax
mov edi, ebp
lea rsi, [0x1401f0415]
lea r12, [0x1401f0410]
nop
movsxd rax, edi
lea rbx, [r12 + rax*8]
mov rdx, rbx
mov rcx, r15
call fcn.1400762b0
movzx ecx, byte [rsi - 1]
mov byte [rax], cl
mov rdx, rbx
mov rcx, r14
call fcn.140076170
movzx ecx, byte [rsi]
mov byte [rax], cl
inc edi
lea rsi, [rsi + 8]
cmp edi, 0x62
jb 0x140074d90
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x50]
call fcn.140135010
mov edi, ebp
lea rbx, [0x1401efd5c]
nop
movzx ecx, byte [rbx]
call qword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
je 0x140074ea1
movsx rdx, ax
shr rdx, 8
movzx ecx, dl
shl cl, 7
mov byte [rsp + 0x60], cl
movzx ecx, dl
and cl, 0xfe
shl cl, 6
mov byte [rsp + 0x61], cl
and dl, 0xfc
shl dl, 5
mov byte [rsp + 0x62], dl
movzx esi, al
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_ToAscii]
test eax, eax
jns 0x140074ea1
movzx r9d, byte [rbx]
mov dword [rsp + 0x20], r9d
lea r8, str.Found_dead_key_0x_x__c
mov edx, 8
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rdx, qword [0x1401fdfd8]
cmp rdx, qword [0x1401fdfe0]
je 0x140074e7a
movzx eax, byte [rbx]
mov byte [rdx], al
inc qword [0x1401fdfd8]
jmp 0x140074e89
mov r8, rbx
lea rcx, [0x1401fdfd0]
call fcn.140049610
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_ToAscii]
inc edi
inc rbx
cmp edi, 7
jb 0x140074de0
mov rax, r15
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140132620
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400760b0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx esi, cl
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt eax, 0xf
jae 0x140076161
mov qword [rsp + 0x40], rbx
lea r8, str.SetShiftState_:_setshiftstate__d_____s___s__n
mov qword [rsp + 0x48], rbp
lea rbx, [0x1401cee34]
lea rbp, str.down
mov qword [rsp + 0x28], rbx
mov r9d, esi
mov qword [rsp + 0x20], rbp
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, 2
movzx ecx, sil
mov edx, eax
call fcn.14002fc90
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r9d, esi
lea r8, str.SetShiftState_:_new_state__d___s__n
bt eax, 0xf
lea rcx, vtable.VNCLog.0
mov edx, 9
cmovb rbx, rbp
mov qword [rsp + 0x20], rbx
call fcn.140018c00
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140076d80
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x468
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, [rsp + 0x30]
call fcn.140022050
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x250]
lea r8, [0x14019528c]
mov dword [rsp + 0x20], 0x200
lea rdx, str.path
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x250]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140076de7
test rax, rax
jne 0x140076e33
mov r8d, 0x104
lea rdx, [rsp + 0x140]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140076e29
mov edx, 0x5c
lea rcx, [rsp + 0x140]
call fcn.140134588
test rax, rax
je 0x140076e4c
mov byte [rax], 0
lea r8, [rsp + 0x140]
jmp 0x140076e3b
lea r8, [rsp + 0x250]
mov edx, 0x104
lea rcx, [0x1401f0122]
call fcn.14013b330
lea r8, [0x1401f0122]
mov edx, 0x200
lea rcx, [0x1401eff20]
call fcn.14013b330
lea r8, [0x1401c3148]
mov edx, 0x200
lea rcx, [0x1401eff20]
call fcn.14013b390
lea r8, str.WinVNC.log
mov edx, 0x200
lea rcx, [0x1401eff20]
call fcn.14013b390
cmp byte [0x1401eff08], 0
mov byte [0x1401f0120], 1
je 0x140076ea9
call fcn.140076ed0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140132620
add rsp, 0x468
ret
Function at 0x140076ed0
Capabilities:
Move file
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x40
mov rbx, 0xffffffffffffffff
lea rsi, [0x1401eff20]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140076ef0
test rax, rax
jne 0x140076f26
lea r8, str.Error_opening_log_file_n
mov word [0x1401eff08], 0x100
xor edx, edx
lea rcx, vtable.VNCLog.0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
jmp fcn.140018c00
cmp byte [0x1401f0120], 0
mov byte [0x1401eff08], 1
jne 0x140076fbd
mov qword [rsp + 0x50], rdi
mov rcx, rbx
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140076f42
add rcx, 5
call fcn.14013268c
mov rdi, rax
mov rdx, rbx
nop word [rax + rax]
inc rdx
cmp byte [rsi + rdx], 0
jne 0x140076f60
add rdx, 5
mov r8, rsi
mov rcx, rdi
call fcn.14013b330
nop dword [rax + rax]
cmp byte [rsi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140076f80
lea rdx, [rbx + 5]
mov rcx, rdi
lea r8, str..bak
call fcn.14013b390
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rcx, rdi
call fcn.140132640
mov rdi, qword [rsp + 0x50]
mov rcx, qword [0x1401eff18]
xor ebx, ebx
test rcx, rcx
je 0x140076fd8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401eff18], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1401eff18], rax
cmp rax, 0xffffffffffffffff
jne 0x140077037
mov r9, rsi
mov word [0x1401eff08], 0x100
lea r8, str.Error_opening_log_file__s_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [0x1401eff18]
cmp byte [0x1401f0120], bl
mov rcx, rax
je case.default.0x140077057
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetEndOfFile]

Function at 0x140077070
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
cmp byte [rcx + 9], 0
mov rsi, rdx
mov rbp, rcx
je 0x140077094
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [rbp + 0xa], 0
mov rbx, 0xffffffffffffffff
je 0x1400770e6
mov qword [rsp + 0x48], rdi
mov rdi, rbx
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400770b0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rdi, qword [rsp + 0x48]
cmp byte [rbp + 8], 0
je 0x140077118
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140077118
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400770f5
mov r8, rbx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x1400772a0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9d, dword [0x1401fe018]
lea r8, str.RestoreDesktop_:_Restorewallpaper__i_n
mov edx, 8
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov r9d, dword [0x1401fe018]
test r9d, r9d
je 0x14007739a
mov eax, dword [0x1401fe01c]
lea r8, str.RestoreDesktop_:_Restorewallpaper__i__i_n
mov edx, 8
mov dword [rsp + 0x20], eax
lea rcx, vtable.VNCLog.0
call fcn.140018c00
cmp dword [0x1401fe01c], 0
je 0x140077311
call fcn.140021c70
cmp eax, 0x40047
jb 0x140077311
mov cl, 1
call fcn.140021d10
xor edx, edx
lea r8, [0x1401fe0a0]
mov r9d, 2
lea ecx, [rdx + 0x14]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
lea rax, [rsp + 0x40]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Control_PanelDesktop
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14007739a
lea rcx, [0x1401fe4a0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140077362
mov dword [rsp + 0x28], eax
lea rdx, str.WallpaperStyle
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1401fe018], 0
add rsp, 0x38
ret

Function at 0x140077c60
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x698], 0
mov rbx, rcx
je 0x140077d0c
xor edx, edx
lea rcx, str.SYSTEM
nop
movzx eax, byte [rbx + rdx + 0x698]
inc rdx
cmp al, byte [rcx + rdx - 1]
jne 0x140077c9d
cmp rdx, 7
jne 0x140077c80
add rsp, 0x20
pop rbx
ret
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140077cc3
inc dword [rbx + 0x7c8]
mov byte [rbx + 0x7c4], al
add rsp, 0x20
pop rbx
ret
cmp byte [rbx + 0x7c4], 0
jne case.default.0x140077d05
mov rcx, rbx
call fcn.140077d80
mov rcx, rbx
call fcn.140078280
lea r8, [rbx + 0x7ce]
mov edx, 0x80
lea rcx, [rbx + 0x2b8]
call fcn.1401462c0
lea rdx, [rbx + 0x290]
mov ecx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
add rsp, 0x20
pop rbx
ret
Function at 0x140078b80
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rbp + 0x220], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
call fcn.140021560
test eax, eax
je 0x140078be0
mov r8d, eax
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, [rsp + 0x70]
mov edx, 0x201eb
mov rcx, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x340], rdi
test rbx, rbx
jne 0x140078bfa
xor dil, dil
jmp 0x140078d25
mov r8d, 0x104
lea rdx, [rbp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rbp + 0x110]
mov edx, 0x104
lea rcx, [rbp]
call fcn.14013b330
lea r8, str.__openhomepage
mov edx, 0x104
lea rcx, [rbp]
call fcn.14013b390
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
xor eax, eax
xor edi, edi
mov qword [rbp - 0x10], rax
xor r8d, r8d
mov qword [rbp - 0x78], rax
mov rdx, rbx
mov eax, 5
mov qword [rsp + 0x60], rdi
movups xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x30], ax
lea rax, str.Winsta0Default
movups xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x70], 0x68
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x60], rax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
xor r9d, r9d
lea r8, [rbp]
xor edx, edx
mov rcx, rbx
test eax, eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
je 0x140078cd2
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x408
jmp 0x140078cdf
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140078cfd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140078d0d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140078d1d
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rbx, qword [rsp + 0x70]
mov dil, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140078d3a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x140078d48
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rdi, qword [rsp + 0x340]
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140132620
mov rbx, qword [rsp + 0x348]
add rsp, 0x330
pop rbp
ret
Function at 0x140084900
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
lea rbp, [rcx + 0x548]
mov rbx, rcx
mov rcx, rbp
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x108]
test rcx, rcx
je 0x1400849cc
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400849c6
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1400849c6
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x30], rsi
mov rdx, rbx
inc rdx
cmp byte [rdi + rdx], 0
jne 0x140084963
inc rdx
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x1400849c1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400849c1
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne case.default.0x1400849de
lea rdx, [rbx + 1]
mov r8, rdi
mov rcx, rax
call fcn.14013b330
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rsi, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rbp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]