joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4161e0
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x158
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
mov esi, ecx
je 0x4162fa
lea eax, [esp + 0x60]
push 0x104
push eax
push ebx
mov dword [esi + 0x630], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x41625d
lea ecx, [esp + 0x60]
push 0x5c
push ecx
call fcn.00447e30
add esp, 8
cmp eax, ebx
je 0x416318
mov byte [eax], bl
lea edi, [esp + 0x60]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [str.16bithlp.exe]
mov eax, dword [0x4685dc]
mov ecx, dword [0x4685e0]
dec edi
mov dword [edi], edx
mov dx, word [0x4685e4]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov word [edi + 0xc], dx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x60]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
push ebx
mov dword [esp + 0x44], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4162b7
push str.C:c_sourceforgeultravncwinvncwinvnc_vncdesktop.cpp_:_set_ddihooks_Failed_n
push ebx
push 0x4721bc
call fcn.004070e0
add esp, 0xc
mov dword [esi + 0x614], ebx
pop edi
pop esi
pop ebx
add esp, 0x158
ret 4
push str.C:c_sourceforgeultravncwinvncwinvnc_vncdesktop.cpp_:_set_ddihooks_OK_n
push ebx
push 0x4721bc
call fcn.004070e0
mov eax, dword [esp + 0x18]
add esp, 0xc
mov dword [esi + 0x614], 1
push 0x2710
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0xc]
pop edi
mov dword [esi + 0x630], ecx
pop esi
pop ebx
add esp, 0x158
ret 4
mov eax, dword [esi + 0x630]
cmp eax, ebx
je 0x416318
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0x630], ebx
mov dword [esi + 0x614], ebx
pop edi
pop esi
pop ebx
add esp, 0x158
ret 4
Function at 0x41f0e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x430
mov dl, byte [ecx + 0x22]
push ebx
xor ebx, ebx
xor eax, eax
test dl, dl
push ebp
push esi
mov esi, dword [esp + 0x444]
push edi
setne al
mov dword [esp + 0x30], ecx
mov ebp, eax
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x40]
mov dword [esp + 0x20], ebx
rep stosd dword es:[edi], eax
xor edi, edi
cmp esi, ebx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
jle 0x41f25a
jmp 0x41f130
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x444]
cmp ebx, ecx
jge 0x41f25a
mov eax, esi
xor edx, edx
sub eax, edi
mov dword [esp + 0x18], edx
test eax, eax
mov dword [esp + 0x28], eax
jle 0x41f224
mov eax, ecx
sub eax, ebx
add eax, 0xfffffff9
mov dword [esp + 0x2c], eax
mov eax, edi
imul eax, ecx
mov dword [esp + 0x1c], eax
jmp 0x41f173
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp edx, dword [esp + 0x2c]
jge 0x41f224
add eax, edx
mov edx, dword [esp + 0x10]
xor ecx, ecx
lea esi, [eax + edx]
mov eax, dword [esp + 0x30]
mov edi, dword [eax + 0x197c]
lea eax, [edi + esi*4]
add eax, ebp
xor edx, edx
inc ecx
mov dl, byte [eax]
inc eax
mov dword [esp + ecx*4 + 0x30], edx
cmp ecx, 3
jl 0x41f197
mov eax, dword [esp + 0x20]
lea ebx, [edi + esi*4 + 4]
add ebx, ebp
mov ebp, 7
add eax, ebp
mov dword [esp + 0x20], eax
xor ecx, ecx
mov edi, ebx
mov edx, dword [esp + ecx*4 + 0x34]
xor eax, eax
mov al, byte [edi]
mov esi, eax
sub eax, edx
cdq
xor eax, edx
mov dword [esp + ecx*4 + 0x34], esi
sub eax, edx
mov edx, dword [esp + eax*4 + 0x40]
inc edx
inc ecx
lea eax, [esp + eax*4 + 0x40]
inc edi
cmp ecx, 3
mov dword [eax], edx
jl 0x41f1bf
add ebx, 4
dec ebp
jne 0x41f1bb
mov ecx, dword [esp + 0x444]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x448]
add edx, ecx
mov ecx, dword [esp + 0x28]
inc eax
cmp eax, ecx
mov ecx, dword [esp + 0x444]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
jl 0x41f16b
cmp ecx, esi
jle 0x41f23c
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], 0
add eax, esi
mov dword [esp + 0x10], eax
jmp 0x41f24e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], 0
add eax, ecx
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x14]
cmp edi, esi
jl 0x41f12c
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x20]
mov eax, esi
shl eax, 5
add eax, esi
cdq
idiv edi
cmp eax, 0x5f
jl 0x41f280
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x430
ret 8
xor eax, eax
mov ecx, 1
mov edx, dword [esp + ecx*4 + 0x40]
mov ebx, edx
imul ebx, ecx
imul ebx, ecx
add eax, ebx
test edx, edx
je 0x41f271
mov ebx, dword [esp + ecx*4 + 0x3c]
add ebx, ebx
cmp edx, ebx
jg 0x41f271
inc ecx
cmp ecx, 8
jl 0x41f287
cmp ecx, 0x100
jge 0x41f2c6
mov edx, dword [esp + ecx*4 + 0x40]
imul edx, ecx
imul edx, ecx
add eax, edx
inc ecx
cmp ecx, 0x100
jl 0x41f2b1
lea ecx, [edi + edi*2]
pop edi
sub ecx, esi
xor edx, edx
pop esi
pop ebp
div ecx
pop ebx
add esp, 0x430
ret 8
Function at 0x426840
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.WinVNC_Win32_Instance_Mutex
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
pop esi
test eax, eax
jne 0x42685a
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret
Function at 0x427300
Capabilities:
Log keystrokes

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov al, byte [esi + 8]
test al, al
je 0x427352
mov cl, byte [esi]
mov eax, dword [esi + 4]
mov byte [esp + 8], cl
or al, 2
mov edi, dword [esp + 8]
push 0
mov edx, edi
push eax
and edx, 0xff
push 0
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push edi
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [esi]
push eax
push str.fake__d_up_n
push 9
push 0x4721bc
call fcn.004070e0
add esp, 0x10
pop edi
pop esi
pop ecx
ret
mov al, byte [esi + 9]
test al, al
je 0x427399
mov cl, byte [esi]
mov eax, dword [esi + 4]
mov byte [esp + 8], cl
push 0
mov edi, dword [esp + 0xc]
push eax
mov edx, edi
push 0
and edx, 0xff
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push edi
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [esi]
push eax
push str.fake__d_down_n
push 9
push 0x4721bc
call fcn.004070e0
add esp, 0x10
pop edi
pop esi
pop ecx
ret

Function at 0x4273a0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
mov edi, ebx
and edi, 0xff
push edi
call ebp
mov esi, dword [esp + 0x18]
shr eax, 0xf
and eax, 1
mov dword [esp + 0x14], eax
je 0x4273d9
test esi, esi
jne 0x427443
mov ecx, 0x46a5c8
mov eax, str.down
jmp 0x4273e7
test esi, esi
je 0x427443
mov ecx, str.down
mov eax, 0x46a5c8
push ecx
push eax
push edi
push str.C:c_sourceforgeultravncwinvncwinvnc_vnckeymap.cpp_:_setshiftstate__d_____s___s__n
push 9
push 0x4721bc
call fcn.004070e0
add esp, 0x18
neg esi
sbb esi, esi
push 0
and esi, 0xfffffffe
add esi, 2
push esi
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
push edi
call ebp
test ah, ah
mov eax, str.down
js 0x42742d
mov eax, 0x46a5c8
push eax
push edi
push str.C:c_sourceforgeultravncwinvncwinvnc_vnckeymap.cpp_:_new_state__d___s__n
push 9
push 0x4721bc
call fcn.004070e0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x429190
Capabilities:
Move file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x14]
test edi, edi
jne 0x4291b5
push str.Error_opening_log_file_n
push edi
push esi
mov byte [esi + 5], 1
mov byte [esi + 4], 0
call fcn.004070e0
add esp, 0xc
pop edi
pop esi
ret
mov al, byte [esi + 0x18]
push ebp
test al, al
mov byte [esi + 4], 1
jne 0x42921b
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 4
push ecx
call fcn.0044826c
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x42921b
mov ecx, dword [esi + 0x14]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4291e1
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
mov eax, dword [str..bak]
dec edi
push ebp
mov dword [edi], eax
mov cl, byte [0x46a5fc]
mov byte [edi + 4], cl
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push ebp
call fcn.00447e1a
add esp, 4
mov ecx, esi
call fcn.00429290
mov eax, dword [esi + 0x14]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
pop ebp
jne 0x429263
mov ecx, dword [esi + 0x14]
mov byte [esi + 5], 1
push ecx
push str.Error_opening_log_file__s_n
push 0
push esi
mov byte [esi + 4], 0
call fcn.004070e0
add esp, 0x10
mov al, byte [esi + 0x18]
test al, al
je 0x42927d
mov edx, dword [esi + 0x10]
push 2
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
ret
Function at 0x4292b0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0x404
push ebx
push ebp
push esi
push edi
push 0
mov esi, ecx
call fcn.004486fd
mov edx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea ecx, [esi + 0x1c]
add esp, 4
cmp eax, edx
je 0x429342
push ecx
mov dword [ecx], eax
call fcn.00449a0f
mov ebx, eax
mov al, byte [esi + 5]
add esp, 4
test al, al
je 0x4292f1
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [esi + 6]
test al, al
je 0x429318
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call ebp
mov al, byte [esi + 4]
test al, al
je 0x429342
mov edx, dword [esi + 0x10]
test edx, edx
je 0x429342
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x41c]
mov eax, dword [esp + 0x418]
push edx
push eax
lea ecx, [esp + 0x1c]
push 0x400
push ecx
call fcn.004499bf
mov al, byte [esi + 5]
add esp, 0x10
test al, al
je 0x429376
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [esi + 6]
test al, al
je 0x4293a3
lea eax, [esp + 0x10]
push 0
push eax
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call ebp
mov al, byte [esi + 4]
test al, al
je 0x4293d3
mov esi, dword [esi + 0x10]
test esi, esi
je 0x4293d3
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push edx
lea eax, [esp + 0x1c]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret 8
Function at 0x429820
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x10c
lea eax, [esp + 0xc]
push ebx
push ebp
push 0x100
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
je 0x429862
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push ecx
push str.Host_name_unavailable
push edx
call fcn.004485d0
add esp, 0xc
pop ebp
pop ebx
add esp, 0x10c
ret
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
jne 0x429899
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push ecx
push str.IP_address_unavailable
push edx
call fcn.004485d0
add esp, 0xc
pop ebp
pop ebx
add esp, 0x10c
ret
mov ebp, dword [esp + 0x118]
mov byte [ebp], 0
mov eax, dword [ebx + 0xc]
cmp dword [eax], 0
je 0x42996d
push esi
push edi
mov dword [esp + 0x10], 0
xor esi, esi
cmp word [ebx + 0xa], si
jle 0x42990f
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + ecx]
xor ecx, ecx
lea edx, [esp + 0x14]
mov cl, byte [eax + esi]
push ecx
push 0x465bfc
push edx
call fcn.004479d0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x130]
not ecx
dec ecx
sub eax, ecx
lea ecx, [esp + 0x20]
dec eax
push eax
push ecx
push ebp
call fcn.00448810
movsx edx, word [ebx + 0xa]
add esp, 0x18
inc esi
cmp esi, edx
jl 0x4298c2
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ecx + ebp - 1], al
mov eax, dword [ebx + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + eax + 4]
test edx, edx
je 0x429953
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x124]
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, ecx
dec edx
push edx
push 0x465bf8
push ebp
call fcn.00448810
add esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 0xc]
add eax, 4
mov dword [esp + 0x10], eax
cmp dword [eax + ecx], 0
jne 0x4298ba
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x42a5e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 0
mov esi, 4
push eax
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42a61f
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret
cmp dword [esp + 4], esi
je 0x42a62e
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret
mov eax, dword [esp + 8]
cmp eax, esi
mov eax, dword [esp + 0x18]
jne 0x42a63e
mov eax, dword [esp + 0x14]
pop esi
add esp, 8
ret
Function at 0x42a650
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
mov esi, 0x100
push edi
push ebx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
call ebp
test eax, eax
je 0x42a696
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [esp + 0x10], 3
je 0x42a6a7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push esi
mov dword [esp + 0x18], esi
call fcn.0044826c
mov esi, eax
add esp, 4
test esi, esi
jne 0x42a6c2
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push esi
push eax
push 0
push edi
push ebx
call ebp
test eax, eax
je 0x42a6ea
push esi
call fcn.00447e1a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [esp + 0x10], 3
je 0x42a704
push esi
call fcn.00447e1a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x42a710
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x42a730
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0xfe
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret
Function at 0x42bfd0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
dec eax
je 0x42c03e
dec eax
jne 0x42c053
cmp ecx, 5
jne 0x42c02d
mov eax, dword [esp + 8]
test eax, eax
jne 0x42c010
mov eax, 1
add esp, 0x94
ret
cmp eax, 1
jne 0x42c01c
add esp, 0x94
ret
cmp eax, 2
jne 0x42c053
mov eax, 1
add esp, 0x94
ret
cmp ecx, 4
ja 0x42c053
mov eax, 3
add esp, 0x94
ret
cmp ecx, 4
jne 0x42c053
cmp dword [esp + 8], 5
jne 0x42c053
mov eax, ecx
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x42daf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 0
mov esi, 4
push eax
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42db31
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret 0xc
cmp dword [esp + 4], esi
je 0x42db42
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret 0xc
mov eax, dword [esp + 8]
cmp eax, esi
mov eax, dword [esp + 0x18]
jne 0x42db52
mov eax, dword [esp + 0x14]
pop esi
add esp, 8
ret 0xc

Function at 0x42db60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ecx
push edx
push 0
push str.Password
push eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x18], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42dbb0
cmp dword [esp], 8
jg 0x42dbb0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
add esp, 0x10
ret 8

Function at 0x42dbc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
mov esi, 1
push edi
push ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
call ebp
test eax, eax
je 0x42dc08
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
cmp dword [esp + 0x10], esi
je 0x42dc1a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
mov edx, dword [esp + 0x14]
push edx
call fcn.0044826c
mov esi, eax
add esp, 4
test esi, esi
jne 0x42dc37
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push esi
push ecx
push 0
push edi
push ebx
call ebp
test eax, eax
je 0x42dc61
push esi
call fcn.00447e1a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
cmp dword [esp + 0x10], 1
je 0x42dc7d
push esi
call fcn.00447e1a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x42e630
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc

Function at 0x42e6a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
lea eax, [esp]
push esi
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x114]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
mov esi, 0x100
push str.DSMPlugin
push eax
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42e6fa
cmp dword [esp + 4], esi
jg 0x42e6fa
push edi
mov edi, dword [esp + 0x118]
mov ecx, 0x40
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add esp, 0x108
ret 8
Function at 0x432540
Capabilities:
Get session user name

Disassembly:
push ecx
mov eax, dword [0x482f28]
push ebx
push esi
cmp eax, 2
push edi
jne 0x432619
call fcn.00432d90
test eax, eax
je 0x432614
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
test eax, eax
je 0x432694
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 4
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4325d1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edi, 0x4721e0
or ecx, 0xffffffff
xor eax, eax
mov dword [0x482f34], 0
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
cmp ecx, eax
jae 0x432694
mov edx, dword [esp + 0x14]
mov eax, 0x4721e0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4325bd
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov eax, dword [0x482f34]
test eax, eax
jne 0x432614
mov edi, 0x4721e0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
cmp ecx, eax
jae 0x432694
mov edx, dword [esp + 0x14]
mov eax, 0x4721e0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x432600
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov eax, dword [0x482f28]
test eax, eax
jbe 0x432694
cmp eax, 2
ja 0x432694
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x18]
mov dword [esp + 0x18], ebx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x432673
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x4dd
jne 0x43267d
mov edi, 0x4721e0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jae 0x432694
mov eax, 0x4721e0
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x432669
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
call edi
push eax
push str.C:c_sourceforgeultravncwinvncwinvnc_vncservice.cpp_:_getusername_error__d_n
push 0
push 0x4721bc
call fcn.004070e0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret