joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov edi, dword [rsp + 0xa0]
mov r10d, r9d
mov r15, rdx
mov r9, r8
mov rbp, rcx
lea eax, [r10 + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r14, eax
mov dword [rsp + 0x20], r14d
test edi, edi
jle 0x1400595b0
movsxd rsi, dword [rsp + 0xa8]
xor r11d, r11d
xor r9d, r9d
mov ebx, edi
test r14d, r14d
jle 0x140059594
mov r8, r11
lea rcx, [r9 + r15]
sub r8, r9
mov rdx, r14
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
lea rcx, [rcx + 1]
not al
mov byte [rcx - 1], al
sub rdx, 1
jne 0x140059580
add r9, r14
add r11, rsi
sub rbx, 1
jne 0x140059562
mov r10d, dword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
test r9, r9
jne 0x140059628
mov eax, edi
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x14005975d
mov ebx, r14d
mov ebp, eax
imul ebx, eax
mov rsi, r15
nop
test r14d, r14d
jle 0x14005960f
mov r10d, ebx
mov r9, rsi
mov r11, r14
nop
movzx r8d, byte [r9]
lea r9, [r9 + 1]
movsxd rdx, r10d
inc r10d
movzx ecx, byte [rdx + r15]
movzx eax, cl
not al
or al, r8b
or r8b, cl
mov byte [r9 - 1], al
not r8b
or byte [rdx + r15], r8b
sub r11, 1
jne 0x1400595e0
add ebx, r14d
add rsi, r14
sub rbp, 1
jne 0x1400595d0
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx ebp, byte [rbp + 0x20]
shr ebp, 3
mov eax, ebp
imul eax, r10d
test al, 3
je 0x140059646
nop dword [rax]
inc eax
test al, 3
jne 0x140059640
test edi, edi
jle 0x14005975d
mov ecx, dword [rsp + 0x20]
cdqe
mov qword [rsp + 0x28], rax
mov rax, rdi
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x80], r12
xor r12d, r12d
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov qword [rsp + 0x40], r13
nop dword [rax]
xor edi, edi
mov bl, 0x80
test r10d, r10d
jle 0x14005973b
xor esi, esi
mov r13d, ebp
nop dword [rax]
nop word [rax + rax]
mov eax, edi
shr eax, 3
add eax, r12d
movsxd r11, eax
movzx r10d, byte [r11 + r15]
test bl, r10b
jne 0x14005970a
xor edx, edx
test ebp, ebp
je 0x14005970a
xor eax, eax
mov r8d, ebp
lea rcx, [r14 + rsi]
add r9, rcx
cmp byte [r9 + rax], 0
jne 0x1400596da
inc edx
inc rax
cmp rax, r8
jl 0x1400596c7
jmp 0x140059702
xor r10b, bl
movsxd rax, edx
mov byte [r11 + r15], r10b
cmp rax, r8
jge 0x140059702
lea rcx, [rax + r14]
sub r8, rax
add rcx, rsi
xor edx, edx
add rcx, qword [rsp + 0x90]
call fcn.140133cd0
mov r9, qword [rsp + 0x90]
mov r10d, dword [rsp + 0x98]
mov eax, 0x80
shr bl, 1
movzx ebx, bl
cmove ebx, eax
inc edi
add rsi, r13
cmp edi, r10d
jl 0x1400596a0
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add r14, rdx
add r12d, ecx
sub rax, 1
mov qword [rsp + 0x30], rax
jne 0x140059680
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x80]
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140074650
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea r15, [0x1401fdf88]
mov qword [rsp + 0x38], r15
xor ebp, ebp
mov qword [0x1401fdf88], rbp
mov qword [0x1401fdf90], rbp
lea ecx, [rbp + 0x28]
call fcn.140131308
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1401fdf88], rax
lea r14, [0x1401fdf98]
mov qword [0x1401fdf98], rbp
mov qword [0x1401fdfa0], rbp
lea ecx, [rbp + 0x28]
call fcn.140131308
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1401fdf98], rax
mov edi, ebp
lea rsi, [0x1401f0415]
lea r12, [0x1401f0410]
nop
movsxd rax, edi
lea rbx, [r12 + rax*8]
mov rdx, rbx
mov rcx, r15
call fcn.140075c30
movzx ecx, byte [rsi - 1]
mov byte [rax], cl
mov rdx, rbx
mov rcx, r14
call fcn.140075af0
movzx ecx, byte [rsi]
mov byte [rax], cl
inc edi
lea rsi, [rsi + 8]
cmp edi, 0x62
jb 0x140074710
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x50]
call fcn.140133cd0
mov edi, ebp
lea rbx, [0x1401efd5c]
nop
movzx ecx, byte [rbx]
call qword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
je 0x140074821
movsx rdx, ax
shr rdx, 8
movzx ecx, dl
shl cl, 7
mov byte [rsp + 0x60], cl
movzx ecx, dl
and cl, 0xfe
shl cl, 6
mov byte [rsp + 0x61], cl
and dl, 0xfc
shl dl, 5
mov byte [rsp + 0x62], dl
movzx esi, al
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_ToAscii]
test eax, eax
jns 0x140074821
movzx r9d, byte [rbx]
mov dword [rsp + 0x20], r9d
lea r8, str.Found_dead_key_0x_x__c
mov edx, 8
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rdx, qword [0x1401fdfb0]
cmp rdx, qword [0x1401fdfb8]
je 0x1400747fa
movzx eax, byte [rbx]
mov byte [rdx], al
inc qword [0x1401fdfb0]
jmp 0x140074809
mov r8, rbx
lea rcx, [0x1401fdfa8]
call fcn.140048f90
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_ToAscii]
inc edi
inc rbx
cmp edi, 7
jb 0x140074760
mov rax, r15
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401312e0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140075a30
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx esi, cl
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt eax, 0xf
jae 0x140075ae1
mov qword [rsp + 0x40], rbx
lea r8, str.SetShiftState_:_setshiftstate__d_____s___s__n
mov qword [rsp + 0x48], rbp
lea rbx, [0x1401cede4]
lea rbp, str.down
mov qword [rsp + 0x28], rbx
mov r9d, esi
mov qword [rsp + 0x20], rbp
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, 2
movzx ecx, sil
mov edx, eax
call fcn.14002f680
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r9d, esi
lea r8, str.SetShiftState_:_new_state__d___s__n
bt eax, 0xf
lea rcx, vtable.VNCLog.0
mov edx, 9
cmovb rbx, rbp
mov qword [rsp + 0x20], rbx
call fcn.140017a50
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140076700
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x468
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, [rsp + 0x30]
call fcn.140021a40
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x250]
lea r8, [0x14019526c]
mov dword [rsp + 0x20], 0x200
lea rdx, str.path
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x250]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140076767
test rax, rax
jne 0x1400767b3
mov r8d, 0x104
lea rdx, [rsp + 0x140]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400767a9
mov edx, 0x5c
lea rcx, [rsp + 0x140]
call fcn.140133248
test rax, rax
je 0x1400767cc
mov byte [rax], 0
lea r8, [rsp + 0x140]
jmp 0x1400767bb
lea r8, [rsp + 0x250]
mov edx, 0x104
lea rcx, [0x1401f0122]
call fcn.140139ff0
lea r8, [0x1401f0122]
mov edx, 0x200
lea rcx, [0x1401eff20]
call fcn.140139ff0
lea r8, [0x1401c3128]
mov edx, 0x200
lea rcx, [0x1401eff20]
call fcn.14013a050
lea r8, str.WinVNC.log
mov edx, 0x200
lea rcx, [0x1401eff20]
call fcn.14013a050
cmp byte [0x1401eff08], 0
mov byte [0x1401f0120], 1
je 0x140076829
call fcn.140076850
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1401312e0
add rsp, 0x468
ret
Function at 0x140076850
Capabilities:
Move file
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x40
mov rbx, 0xffffffffffffffff
lea rsi, [0x1401eff20]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140076870
test rax, rax
jne 0x1400768a6
lea r8, str.Error_opening_log_file_n
mov word [0x1401eff08], 0x100
xor edx, edx
lea rcx, vtable.VNCLog.0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
jmp fcn.140017a50
cmp byte [0x1401f0120], 0
mov byte [0x1401eff08], 1
jne 0x14007693d
mov qword [rsp + 0x50], rdi
mov rcx, rbx
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400768c2
add rcx, 5
call fcn.14013134c
mov rdi, rax
mov rdx, rbx
nop word [rax + rax]
inc rdx
cmp byte [rsi + rdx], 0
jne 0x1400768e0
add rdx, 5
mov r8, rsi
mov rcx, rdi
call fcn.140139ff0
nop dword [rax + rax]
cmp byte [rsi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140076900
lea rdx, [rbx + 5]
mov rcx, rdi
lea r8, str..bak
call fcn.14013a050
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rcx, rdi
call fcn.140131300
mov rdi, qword [rsp + 0x50]
mov rcx, qword [0x1401eff18]
xor ebx, ebx
test rcx, rcx
je 0x140076958
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401eff18], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1401eff18], rax
cmp rax, 0xffffffffffffffff
jne 0x1400769b7
mov r9, rsi
mov word [0x1401eff08], 0x100
lea r8, str.Error_opening_log_file__s_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [0x1401eff18]
cmp byte [0x1401f0120], bl
mov rcx, rax
je case.default.0x1400769d7
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetEndOfFile]

Function at 0x1400769f0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
cmp byte [rcx + 9], 0
mov rsi, rdx
mov rbp, rcx
je 0x140076a14
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [rbp + 0xa], 0
mov rbx, 0xffffffffffffffff
je 0x140076a66
mov qword [rsp + 0x48], rdi
mov rdi, rbx
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140076a30
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rdi, qword [rsp + 0x48]
cmp byte [rbp + 8], 0
je 0x140076a98
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140076a98
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140076a75
mov r8, rbx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x140076c20
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9d, dword [0x1401fdfcc]
lea r8, str.RestoreDesktop_:_Restorewallpaper__i_n
mov edx, 8
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov r9d, dword [0x1401fdfcc]
test r9d, r9d
je 0x140076d1a
mov eax, dword [0x1401fdff8]
lea r8, str.RestoreDesktop_:_Restorewallpaper__i__i_n
mov edx, 8
mov dword [rsp + 0x20], eax
lea rcx, vtable.VNCLog.0
call fcn.140017a50
cmp dword [0x1401fdff8], 0
je 0x140076c91
call fcn.140021660
cmp eax, 0x40047
jb 0x140076c91
mov cl, 1
call fcn.140021700
xor edx, edx
lea r8, [0x1401fe080]
mov r9d, 2
lea ecx, [rdx + 0x14]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
lea rax, [rsp + 0x40]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Control_PanelDesktop
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140076d1a
lea rcx, [0x1401fe480]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140076ce2
mov dword [rsp + 0x28], eax
lea rdx, str.WallpaperStyle
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1401fdfcc], 0
add rsp, 0x38
ret

Function at 0x1400775d0
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x690], 0
mov rbx, rcx
je 0x14007767c
xor edx, edx
lea rcx, str.SYSTEM
nop
movzx eax, byte [rbx + rdx + 0x690]
inc rdx
cmp al, byte [rcx + rdx - 1]
jne 0x14007760d
cmp rdx, 7
jne 0x1400775f0
add rsp, 0x20
pop rbx
ret
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140077633
inc dword [rbx + 0x7c0]
mov byte [rbx + 0x7bc], al
add rsp, 0x20
pop rbx
ret
cmp byte [rbx + 0x7bc], 0
jne case.default.0x140077675
mov rcx, rbx
call fcn.1400776f0
mov rcx, rbx
call fcn.140077bf0
lea r8, [rbx + 0x7c6]
mov edx, 0x80
lea rcx, [rbx + 0x2b0]
call fcn.14014a500
lea rdx, [rbx + 0x288]
mov ecx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
add rsp, 0x20
pop rbx
ret
Function at 0x1400784f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rbp + 0x220], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
call fcn.140020f50
test eax, eax
je 0x140078550
mov r8d, eax
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, [rsp + 0x70]
mov edx, 0x201eb
mov rcx, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x340], rdi
test rbx, rbx
jne 0x14007856a
xor dil, dil
jmp 0x140078695
mov r8d, 0x104
lea rdx, [rbp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rbp + 0x110]
mov edx, 0x104
lea rcx, [rbp]
call fcn.140139ff0
lea r8, str.__openhomepage
mov edx, 0x104
lea rcx, [rbp]
call fcn.14013a050
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
xor eax, eax
xor edi, edi
mov qword [rbp - 0x10], rax
xor r8d, r8d
mov qword [rbp - 0x78], rax
mov rdx, rbx
mov eax, 5
mov qword [rsp + 0x60], rdi
movups xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x30], ax
lea rax, str.Winsta0Default
movups xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x70], 0x68
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x60], rax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
xor r9d, r9d
lea r8, [rbp]
xor edx, edx
mov rcx, rbx
test eax, eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
je 0x140078642
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x408
jmp 0x14007864f
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14007866d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14007867d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14007868d
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rbx, qword [rsp + 0x70]
mov dil, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400786aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x1400786b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rdi, qword [rsp + 0x340]
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1401312e0
mov rbx, qword [rsp + 0x348]
add rsp, 0x330
pop rbp
ret
Function at 0x140083ec0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
lea rbp, [rcx + 0x548]
mov rbx, rcx
mov rcx, rbp
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x108]
test rcx, rcx
je 0x140083f8c
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140083f86
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x140083f86
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x30], rsi
mov rdx, rbx
inc rdx
cmp byte [rdi + rdx], 0
jne 0x140083f23
inc rdx
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x140083f81
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140083f81
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne case.default.0x140083f9e
lea rdx, [rbx + 1]
mov r8, rdi
mov rcx, rax
call fcn.140139ff0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rsi, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rbp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400849f0
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov qword [rsp + 0x60], r9
mov r14, r8
mov qword [rsp + 0x58], r8
mov r13, rdx
mov rbx, rcx
lea r12, [rcx + 0x548]
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], gethostname
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x108]
test rax, rax
jne 0x140084bd3
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
test rax, rax
jne 0x140084a98
lea r8, str.vncServer::GetScreenInfo_:_Failed_rootdc__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor ebx, ebx
movzx edi, bx
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x44], bl
jmp 0x140084be4
mov edx, 8
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
mov word [rsp + 0x40], di
mov edx, 0xa
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov word [rsp + 0x42], ax
movzx r8d, ax
movzx edx, di
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r15, rax
test rax, rax
jne 0x140084af5
xor ebx, ebx
movzx edi, bx
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x44], bl
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x140084be4
xor edx, edx
mov r8d, 0x430
lea rcx, [rsp + 0x70]
call fcn.140133cd0
mov dword [rsp + 0x74], 0x28
xor ebx, ebx
mov word [rbp - 0x7e], bx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r14, rax
test rax, rax
jne 0x140084b36
movzx edi, bx
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x44], bl
jmp 0x140084bb8
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x140084ba4
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x140084ba4
movzx eax, byte [rbp - 0x7e]
mov ecx, eax
mov edx, 0x20
cmp al, 0x18
cmove ecx, edx
mov byte [rsp + 0x44], cl
jmp 0x140084baf
movzx edi, bx
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x44], bl
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r14, qword [rsp + 0x58]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x140084be4
movups xmm0, xmmword [rax + 0xe460]
movups xmmword [rsp + 0x40], xmm0
movzx edi, word [rsp + 0x40]
movzx eax, di
mov dword [r13], eax
mov rdx, qword [rsp + 0x40]
mov rax, rdx
shr rax, 0x10
movzx eax, ax
mov dword [r14], eax
shr rdx, 0x20
movzx eax, dl
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1401312e0
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140085c20
Capabilities:
Print debug messages
Set socket configuration
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
cmp dword [rcx + 0x594], 0
mov rbx, rcx
je 0x140085e82
mov qword [rsp + 0x80], rsi
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x58], rdi
lea rdi, [rcx + 0x5a0]
mov qword [rsp + 0x50], r14
xor r14d, r14d
nop dword [rax]
mov rax, rsi
inc rax
cmp byte [rdi + rax], r14b
jne 0x140085c63
test rax, rax
je 0x140085e70
cmp byte [0x1401f32c3], r14b
jne 0x140085e70
lea r8, str.vncServer::actualRetryThread_:_Attempting_AutoReconnect...._n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov ecx, 0x23f8
call fcn.140131308
mov rcx, rax
mov qword [rsp + 0x70], rax
call fcn.1400871b0
mov qword [rbx + 0xc8], rax
test rax, rax
je 0x140085d48
mov rcx, rax
call fcn.140087350
mov r8d, dword [rbx + 0x59c]
mov rdx, rdi
mov rcx, qword [rbx + 0xc8]
call fcn.1400874b0
test eax, eax
jne 0x140085d5a
lea r8, str.vncServer::actualRetryThread_:_connect_failed__waitin_5_sec_to_retry...._n
lea edx, [rax + 9]
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0xc8]
test rcx, rcx
je 0x140085d0f
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0xc8], r14
cmp dword [rbx + 0x594], r14d
je 0x140085e70
mov rax, rsi
inc rax
cmp byte [rdi + rax], r14b
jne 0x140085d26
test rax, rax
je 0x140085d48
cmp byte [0x1401f32c3], r14b
jne 0x140085d48
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbx + 0x594], r14d
jne 0x140085c60
jmp 0x140085e70
mov qword [rsp + 0x78], rbp
lea rbp, [rbx + 0x69f]
inc rsi
cmp byte [rsi + rbp], r14b
jne 0x140085d66
test rsi, rsi
je 0x140085e1a
mov rcx, qword [rbx + 0xc8]
mov r8d, 0xfa
mov rdx, rbp
call fcn.1400878f0
cmp byte [0x14023e4f4], 2
mov rsi, qword [rbx + 0xc8]
jb 0x140085deb
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x70]
mov edx, 0xffff
mov dword [rsp + 0x70], r14d
mov r8d, 0x1006
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140085deb
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x70]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1005
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [0x1401fdf60]
mov r8d, r14d
mov dword [rsp + 0x48], 1
cmp dword [rax + 0xa64], r14d
mov eax, dword [rbx + 0x59c]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rbp
jmp 0x140085e47
mov rax, qword [0x1401fdf60]
mov r8d, r14d
mov dword [rsp + 0x48], 1
cmp dword [rax + 0xa64], r14d
mov eax, dword [rbx + 0x59c]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
mov r10, qword [rbx]
mov r9d, 1
mov rdx, qword [rbx + 0xc8]
sete r8b
mov qword [rsp + 0x28], r14
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [r10]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
lea r8, str.vncServer::actualRetryThread_:_leaving_reconnectThread...._n
mov edx, 9
lea rcx, vtable.VNCLog.0
add rsp, 0x60
pop rbx
jmp fcn.140017a50