joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439540
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
lea eax, [esp]
push eax
call fcn.004043b0
lea ecx, [esp]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4395a4
mov eax, dword [0x4a671c]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x43958b
push eax
call esi
mov eax, dword [0x4a6720]
test eax, eax
je 0x439597
push eax
call esi
mov eax, dword [0x4a6718]
test eax, eax
je 0x4395a3
push eax
call esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret

Function at 0x4395c0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x114
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
mov ebp, dword [esp + 0x120]
push edi
mov edi, dword [0x4a671c]
lea eax, [esp + 0x18]
push eax
call fcn.004043b0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x18]
push ecx
push 0
push str.UseRegistry
push str.admin
call ebx
cmp eax, 1
jne 0x439678
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
mov ebx, 4
push edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x439650
pop edi
mov eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0045c77f
add esp, 0x114
ret
cmp dword [esp + 0x10], ebx
jne 0x439636
cmp dword [esp + 0xc], ebx
jne 0x439636
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0045c77f
add esp, 0x114
ret
lea edx, [esp + 0x18]
push edx
push ebp
push esi
push str.admin_auth
call ebx
mov ecx, dword [esp + 0x11c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045c77f
add esp, 0x114
ret
Function at 0x4396a0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x110
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x10c], eax
push edi
mov edi, dword [0x4a671c]
lea eax, [esp + 0xc]
push eax
call fcn.004043b0
lea ecx, [esp + 0xc]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x439783
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov ebx, 0x100
push edi
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x43974f
cmp dword [esp + 0xc], 3
jne 0x43974f
push ebx
mov dword [esp + 0x14], ebx
call fcn.0045c88a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x43974f
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x14]
push edx
push 0
push esi
push edi
call ebp
test eax, eax
jne 0x439746
cmp dword [esp + 0xc], 3
je 0x439769
push ebx
call fcn.0045c7c2
add esp, 4
pop ebp
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0045c77f
add esp, 0x110
ret
pop ebp
mov eax, ebx
pop ebx
pop edi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0045c77f
add esp, 0x110
ret
push 0x96
call fcn.0045c88a
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push eax
push 0x96
push edi
push 0x47a387
push esi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x110]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0045c77f
add esp, 0x110
ret

Function at 0x4397d0
Capabilities:
Read .ini file
Set registry value

Disassembly:
sub esp, 0x128
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x124], eax
push edi
mov edi, dword [0x4a671c]
lea eax, [esp + 4]
push eax
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x43983d
push 4
lea edx, [esp + 0x134]
push edx
push 4
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0045c77f
add esp, 0x128
ret
mov eax, dword [esp + 0x130]
push eax
lea ecx, [esp + 0x10c]
push 0x47a408
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10c]
push eax
push esi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x128]
pop edi
xor ecx, esp
call fcn.0045c77f
add esp, 0x128
ret
Function at 0x439890
Capabilities:
Read .ini file
Set registry value

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [0x4a671c]
lea eax, [esp + 4]
push eax
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4398f9
push 0xfe
push edi
push 3
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
lea edx, [esp + 4]
push edx
push edi
push esi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x108]
pop ebx
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret

Function at 0x439930
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, ecx
call fcn.004043b0
lea ecx, [esp + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4399a2
call fcn.00439490
cmp dword [0x4a671c], 0
je 0x439986
mov esi, str.group1
call fcn.00439890
call fcn.00439540
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
mov esi, str.group1
call fcn.00439890
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret

Function at 0x4399d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x439a43
xor esi, esi
call fcn.00439490
cmp dword [0x4a671c], esi
je 0x439a26
mov esi, str.group1
call fcn.004396a0
mov esi, eax
call fcn.00439540
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
mov esi, str.group1
call fcn.004396a0
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret

Function at 0x439a70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, ecx
call fcn.004043b0
lea ecx, [esp + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x439ae2
call fcn.00439490
cmp dword [0x4a671c], 0
je 0x439ac6
mov esi, str.group2
call fcn.00439890
call fcn.00439540
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
mov esi, str.group2
call fcn.00439890
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
Function at 0x439b10
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x439b83
xor esi, esi
call fcn.00439490
cmp dword [0x4a671c], esi
je 0x439b66
mov esi, str.group2
call fcn.004396a0
mov esi, eax
call fcn.00439540
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
mov esi, str.group2
call fcn.004396a0
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret

Function at 0x439bb0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, ecx
call fcn.004043b0
lea ecx, [esp + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x439c22
call fcn.00439490
cmp dword [0x4a671c], 0
je 0x439c06
mov esi, str.group3
call fcn.00439890
call fcn.00439540
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
mov esi, str.group3
call fcn.00439890
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret

Function at 0x439c50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x439cc3
xor esi, esi
call fcn.00439490
cmp dword [0x4a671c], esi
je 0x439ca6
mov esi, str.group3
call fcn.004396a0
mov esi, eax
call fcn.00439540
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
mov esi, str.group3
call fcn.004396a0
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret

Function at 0x439cf0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, 1
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, esi
jne 0x439d6a
call fcn.00439490
cmp dword [0x4a671c], 0
je 0x439d4d
push esi
mov esi, str.locdom1
call fcn.004395c0
add esp, 4
mov esi, eax
call fcn.00439540
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
push 1
mov esi, str.locdom1
call fcn.004395c0
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
Function at 0x439d90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x439e04
call fcn.00439490
cmp dword [0x4a671c], 0
je 0x439de9
push esi
mov esi, str.locdom1
call fcn.004397d0
add esp, 4
call fcn.00439540
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
push esi
mov esi, str.locdom1
call fcn.004397d0
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret

Function at 0x439e30
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push esi
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x439ea6
call fcn.00439490
cmp dword [0x4a671c], esi
je 0x439e89
push esi
mov esi, str.locdom2
call fcn.004395c0
add esp, 4
mov esi, eax
call fcn.00439540
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
push 0
mov esi, str.locdom2
call fcn.004395c0
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret

Function at 0x439ed0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x439f44
call fcn.00439490
cmp dword [0x4a671c], 0
je 0x439f29
push esi
mov esi, str.locdom2
call fcn.004397d0
add esp, 4
call fcn.00439540
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
push esi
mov esi, str.locdom2
call fcn.004397d0
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret

Function at 0x439f70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push esi
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x439fe6
call fcn.00439490
cmp dword [0x4a671c], esi
je 0x439fc9
push esi
mov esi, str.locdom3
call fcn.004395c0
add esp, 4
mov esi, eax
call fcn.00439540
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
push 0
mov esi, str.locdom3
call fcn.004395c0
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
Function at 0x43a010
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call fcn.004043b0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x43a084
call fcn.00439490
cmp dword [0x4a671c], 0
je 0x43a069
push esi
mov esi, str.locdom3
call fcn.004397d0
add esp, 4
call fcn.00439540
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
push esi
mov esi, str.locdom3
call fcn.004397d0
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x108
ret
Function at 0x43b740
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x118
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
lea eax, [esp + 0x18]
mov edi, 4
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
call fcn.004043b0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x18]
push ecx
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x43b829
lea edx, [esp + 8]
push edx
push eax
push 0
push str.SoftwareORLWinVNC3
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43b7cc
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0045c77f
add esp, 0x118
ret
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.NewMSLogon
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43b7b3
cmp dword [esp + 0x10], edi
jne 0x43b7b3
cmp dword [esp + 0xc], edi
jne 0x43b7b3
mov eax, dword [esp + 8]
mov esi, dword [esp + 0x14]
test eax, eax
je 0x43b810
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0045c77f
add esp, 0x118
ret
lea ecx, [esp + 0x18]
push ecx
push 0
push str.NewMSLogon
push str.admin
call esi
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x118
ret

Function at 0x43b860
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
sub eax, 1
je 0x43b908
sub eax, 1
jne 0x43b919
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x43b8c0
mov dword [0x48a140], 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045c77f
add esp, 0x98
ret
cmp eax, 6
jne 0x43b8e4
mov dword [0x48a140], 2
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045c77f
add esp, 0x98
ret
cmp eax, 4
ja 0x43b919
mov dword [0x48a140], 3
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045c77f
add esp, 0x98
ret
mov ecx, dword [esp + 8]
neg ecx
sbb ecx, ecx
add ecx, 5
mov dword [0x48a140], ecx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045c77f
add esp, 0x98
ret
Function at 0x43b960
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47135b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
mov eax, dword [0x489348]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
lea ecx, [edi + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
mov dword [edi + 0x10c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
add eax, 1
mov dword [edi + 4], eax
mov ecx, edi
je 0x43b9d8
push 1
call fcn.0043e070
jmp 0x43b9dd
call fcn.0043fb80
mov ecx, dword [edi + 0x10c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x110]
lea eax, [esp + 0x14]
push eax
call edx
push str.g:_vnc104rc_relultravnc_project_rootultravncwinvncwinvnc_vncPasswd.h_:_PASSWD_:_ToText_called_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
push 9
call fcn.0045d5ee
add esp, 4
push 1
mov ecx, 0x48aa6c
mov esi, eax
call fcn.00401630
add esp, 4
lea eax, [esp + 0x14]
call fcn.00401bf0
mov byte [esi + 8], 0
mov dword [esp + 0xc], esi
mov eax, esi
mov dword [esp + 0x138], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43ba45
sub eax, edx
jne 0x43bb4c
cmp dword [edi + 0x114], eax
je 0x43bb06
call fcn.00408130
test al, al
je 0x43bb06
mov ecx, dword [edi + 0x10c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x16c]
call edx
test eax, eax
je 0x43bb4c
lea eax, [esp + 0x1c]
call fcn.00448060
test eax, eax
jne 0x43baa2
lea edi, [esp + 0xc]
call fcn.00410d80
xor eax, eax
jmp 0x43bb77
mov edx, 0x47a387
lea ecx, [esp + 0x1c]
jmp 0x43bab0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x43bad0
test al, al
je 0x43bacc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x43bad0
add ecx, 2
add edx, 2
test al, al
jne 0x43bab0
xor eax, eax
jmp 0x43bad5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43bafc
push 0x30
push 0x4a5358
push 0x4a61b0
push eax
mov byte [edi], 1
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push edi
call fcn.0043bba0
mov byte [edi], 0
jmp 0x43bb4c
push 1
push edi
call fcn.0043bba0
jmp 0x43bb4c
mov ecx, dword [edi + 0x10c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x16c]
call edx
test eax, eax
je 0x43bb38
push 0x10
push 0x4a5358
push 0x4a6408
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x43bb4c
push 0x30
push 0x4a5358
push 0x4a5838
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43bb51
sub eax, edx
push eax
push 0
push esi
call fcn.00462100
add esp, 0xc
push esi
call fcn.0045d511
add esp, 4
mov byte [edi], 0
mov eax, 1
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0045c77f
mov esp, ebp
pop ebp
ret 4
Function at 0x43dd60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
push 0
push eax
mov esi, 4
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x43dd9f
mov eax, edi
pop esi
add esp, 8
ret 8
cmp dword [esp + 4], esi
jne 0x43dd96
mov eax, edi
cmp dword [esp + 8], esi
jne 0x43ddb1
mov eax, dword [esp + 0x14]
pop esi
add esp, 8
ret 8

Function at 0x43ddc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
lea ecx, [esp]
push ecx
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
push ecx
push 0
push str.Password
push eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x18], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43de15
cmp dword [esp], 8
jg 0x43de15
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0045c77f
add esp, 0x14
ret 4

Function at 0x43de30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push str.AuthHosts
push edi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0
call ebx
test eax, eax
je 0x43de6b
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [esp + 4], 1
jne 0x43de64
mov edx, dword [esp + 8]
push esi
push edx
call fcn.0045cadd
mov esi, eax
add esp, 4
test esi, esi
je 0x43deaf
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x10]
push ecx
push 0
push str.AuthHosts
push edi
call ebx
test eax, eax
jne 0x43dea6
cmp dword [esp + 8], 1
je 0x43deb7
push esi
call fcn.0045d506
add esp, 4
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x43f300
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x110]
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
push str.DSMPlugin
mov esi, 0x100
push eax
mov dword [esp + 0x24], 3
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43f362
cmp dword [esp + 8], esi
jg 0x43f362
mov ecx, 0x40
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
call fcn.0045c77f
add esp, 0x10c
ret 4
Function at 0x440af0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
mov dword [esi + 0x108], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
add eax, 1
mov dword [esi], eax
je 0x440b2b
push 1
mov ecx, esi
call fcn.00441720
mov eax, 1
pop esi
ret
call fcn.00442180
mov eax, 1
pop esi
ret

Function at 0x4414e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edi
mov edi, ecx
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
push 0
push str.SingleWindowName
push eax
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44153d
cmp dword [esp + 4], 0x100
jg 0x44153d
push esi
mov ecx, 8
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop esi
mov ecx, dword [esp + 0x2c]
pop edi
xor ecx, esp
call fcn.0045c77f
add esp, 0x2c
ret 4