joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400502d0
Capabilities:
Print debug messages
Terminate thread
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0xea70], 0
mov rbx, rcx
mov byte [rcx + 0xea78], 1
mov edx, 9
lea rcx, vtable.VNCLog.0
mov dword [0x1401f2e94], 0
je 0x1400503b6
lea r8, str.vncDesktop::StopInitWindowthread_:_vncDesktop::Tell_initwindowthread_to_close__n
call fcn.140017a50
mov ecx, dword [rbx + 0xe410]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov rcx, qword [rbx + 0xea70]
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
lea rcx, vtable.VNCLog.0
cmp eax, 0x102
jne 0x14005038c
lea r8, str.vncDesktop::StopInitWindowthread_:_vncDesktop::ERROR:__messageloop_blocked__n
call fcn.140017a50
mov rcx, qword [rbx + 0xea70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0xea70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xe4b8], 0
mov qword [rbx + 0xea70], 0
add rsp, 0x20
pop rbx
ret
lea r8, str.vncDesktop::StopInitWindowthread_:_vncDesktop::_iniwindowthread_proper_closed__n
call fcn.140017a50
mov rcx, qword [rbx + 0xea70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xea70], 0
add rsp, 0x20
pop rbx
ret
lea r8, str.vncDesktop::StopInitWindowthread_:_initwindowthread_already_closed__n
add rsp, 0x20
pop rbx
jmp fcn.140017a50
Function at 0x1400503d0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread__n
mov byte [rdi + 0xea78], 0
mov edx, 9
lea rcx, vtable.VNCLog.0
mov rbx, rax
call fcn.140017a50
lea rax, [rsp + 0x30]
mov r9d, 0x100
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
je 0x1400505a1
xor ebx, ebx
lea rdx, [rsp + 0x40]
mov eax, ebx
lea r8, str.Default
nop dword [rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140050589
cmp rax, 8
jne 0x140050460
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_default_desk_n
lea edx, [rax + 1]
lea rcx, vtable.VNCLog.0
call fcn.140017a50
cmp qword [rdi + 0xea70], rbx
jne 0x140050567
mov rcx, qword [rdi + 0xe408]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1401fdf60]
cmp dword [rax + 0x788], ebx
je 0x1400504bc
call fcn.14002fab0
lea rax, [rdi + 0xe410]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1400505d0]
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rdi + 0xe408]
mov edx, 0x2710
mov qword [rdi + 0xea70], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 9
lea rcx, vtable.VNCLog.0
cmp eax, 0x102
jne 0x140050551
lea r8, str.vncDesktop::StartInitWindowthread_:_ERROR:_initwindowthread_failed_to_start__n
call fcn.140017a50
mov rcx, qword [rdi + 0xea70]
test rcx, rcx
je 0x140050547
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0xea70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0xe4b8], rbx
mov qword [rdi + 0xea70], rbx
xor al, al
mov byte [rdi + 0xea78], al
jmp 0x1400505a1
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_started_n
call fcn.140017a50
mov al, 1
mov byte [rdi + 0xea78], al
jmp 0x1400505a1
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_reactivate_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov al, 1
mov byte [rdi + 0xea78], al
jmp 0x1400505a1
lea r8, str.vncDesktop::StartInitWindowthread_:_StartInitWindowthread_no_default_desk_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401312c0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x1400588d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
lea r8, str.vncEncoder::GetRemotePalette_:_remote_palette_data_requested_n
mov rdi, rcx
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
cmp word [rdi + 0x48], 0
je 0x140058a99
cmp word [rdi + 0x44], 0
je 0x140058a99
cmp word [rdi + 0x46], 0
je 0x140058a99
cmp byte [rdi + 0x23], 0
jne 0x14005893b
mov rcx, rdi
call fcn.140058b10
test eax, eax
je 0x140058a99
cmp byte [rdi + 0x33], 0
jne 0x140058a99
cmp byte [rdi + 0x23], 0
lea rcx, vtable.VNCLog.0
mov qword [rsp + 0x70], rsi
mov edx, 9
mov qword [rsp + 0x40], r14
je 0x140058a2f
lea r8, str.vncEncoder::GetRemotePalette_:_generating_BGR233_palette_data_n
call fcn.140017a50
movzx ecx, byte [rdi + 0x40]
mov esi, 1
shl esi, cl
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14005898a
call fcn.140137f10
movsxd rsi, esi
lea rcx, [rsi*4]
call fcn.140139fc8
mov qword [rdi + 0x18], rax
test rax, rax
je 0x140058a71
xor r9d, r9d
test rsi, rsi
jle 0x140058a71
lea r10, [rax + 1]
nop word [rax + rax]
movzx r8d, word [rdi + 0x48]
lea r10, [r10 + 4]
movzx ecx, byte [rdi + 0x4c]
xor edx, edx
mov eax, r9d
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
xor edx, edx
mov byte [r10 - 5], al
mov eax, r9d
movzx r8d, word [rdi + 0x44]
movzx ecx, byte [rdi + 0x4a]
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
xor edx, edx
mov byte [r10 - 3], al
mov eax, r9d
movzx r8d, word [rdi + 0x46]
inc r9d
movzx ecx, byte [rdi + 0x4b]
sar eax, cl
and eax, r8d
imul eax, eax, 0xff
div r8d
mov byte [r10 - 4], al
sub rsi, 1
jne 0x1400589c0
jmp 0x140058a71
lea r8, str.vncEncoder::GetRemotePalette_:_generating_8_bit_palette_data_n
call fcn.140017a50
lea rdx, [rdi + 0x20]
mov dword [rsp + 0x22], 0xff0100
lea r8, [rsp + 0x20]
mov word [rsp + 0x20], 0x1820
lea rcx, [rdi + 0x18]
mov dword [rsp + 0x26], 0xff00ff
mov word [rsp + 0x2a], 0x810
mov byte [rsp + 0x2c], 0
call qword [0x140195e18]
mov rax, qword [rdi + 0x18]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
test rax, rax
jne 0x140058aaf
lea r8, str.vncEncoder::GetRemotePalette_:_failed_to_obtain_colour_map_data__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0x48
pop rdi
pop rbx
ret
mov ecx, 8
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rbx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x10], xmm1
sub rcx, 1
jne 0x140058ab4
lea eax, [rcx + 1]
jmp 0x140058a9b
Function at 0x140059510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov edi, dword [rsp + 0xa0]
mov r10d, r9d
mov r15, rdx
mov r9, r8
mov rbp, rcx
lea eax, [r10 + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r14, eax
mov dword [rsp + 0x20], r14d
test edi, edi
jle 0x1400595b0
movsxd rsi, dword [rsp + 0xa8]
xor r11d, r11d
xor r9d, r9d
mov ebx, edi
test r14d, r14d
jle 0x140059594
mov r8, r11
lea rcx, [r9 + r15]
sub r8, r9
mov rdx, r14
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
lea rcx, [rcx + 1]
not al
mov byte [rcx - 1], al
sub rdx, 1
jne 0x140059580
add r9, r14
add r11, rsi
sub rbx, 1
jne 0x140059562
mov r10d, dword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
test r9, r9
jne 0x140059628
mov eax, edi
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x14005975d
mov ebx, r14d
mov ebp, eax
imul ebx, eax
mov rsi, r15
nop
test r14d, r14d
jle 0x14005960f
mov r10d, ebx
mov r9, rsi
mov r11, r14
nop
movzx r8d, byte [r9]
lea r9, [r9 + 1]
movsxd rdx, r10d
inc r10d
movzx ecx, byte [rdx + r15]
movzx eax, cl
not al
or al, r8b
or r8b, cl
mov byte [r9 - 1], al
not r8b
or byte [rdx + r15], r8b
sub r11, 1
jne 0x1400595e0
add ebx, r14d
add rsi, r14
sub rbp, 1
jne 0x1400595d0
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx ebp, byte [rbp + 0x20]
shr ebp, 3
mov eax, ebp
imul eax, r10d
test al, 3
je 0x140059646
nop dword [rax]
inc eax
test al, 3
jne 0x140059640
test edi, edi
jle 0x14005975d
mov ecx, dword [rsp + 0x20]
cdqe
mov qword [rsp + 0x28], rax
mov rax, rdi
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x80], r12
xor r12d, r12d
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov qword [rsp + 0x40], r13
nop dword [rax]
xor edi, edi
mov bl, 0x80
test r10d, r10d
jle 0x14005973b
xor esi, esi
mov r13d, ebp
nop dword [rax]
nop word [rax + rax]
mov eax, edi
shr eax, 3
add eax, r12d
movsxd r11, eax
movzx r10d, byte [r11 + r15]
test bl, r10b
jne 0x14005970a
xor edx, edx
test ebp, ebp
je 0x14005970a
xor eax, eax
mov r8d, ebp
lea rcx, [r14 + rsi]
add r9, rcx
cmp byte [r9 + rax], 0
jne 0x1400596da
inc edx
inc rax
cmp rax, r8
jl 0x1400596c7
jmp 0x140059702
xor r10b, bl
movsxd rax, edx
mov byte [r11 + r15], r10b
cmp rax, r8
jge 0x140059702
lea rcx, [rax + r14]
sub r8, rax
add rcx, rsi
xor edx, edx
add rcx, qword [rsp + 0x90]
call fcn.140133cb0
mov r9, qword [rsp + 0x90]
mov r10d, dword [rsp + 0x98]
mov eax, 0x80
shr bl, 1
movzx ebx, bl
cmove ebx, eax
inc edi
add rsi, r13
cmp edi, r10d
jl 0x1400596a0
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add r14, rdx
add r12d, ecx
sub rax, 1
mov qword [rsp + 0x30], rax
jne 0x140059680
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x80]
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400739c0
Capabilities:
Set socket configuration

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
lea r8, str.vncHTTPConnectThread::run_undetached_:_started_HTTP_server_thread_n
lea rcx, vtable.VNCLog.0
mov edx, 9
call fcn.140017a50
cmp dword [rdi + 0xa8], 0
jne 0x140073b7e
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
xor esi, esi
nop word [rax + rax]
mov rcx, qword [rdi + 0xb8]
call fcn.140087570
mov rbx, rax
test rax, rax
je 0x140073b74
mov edx, 1
cmp dword [rdi + 0xa8], esi
jne 0x140073b6c
lea r8, str.vncHTTPConnectThread::run_undetached_:_HTTP_client_connected_n
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14023e4f4], 2
jb 0x140073aa1
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x40], 0x3a98
mov r8d, 0x1006
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140073aa1
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1005
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x20]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0x10]
cmp rax, 0xffffffffffffffff
je 0x140073b36
lea r8, str.VSocket::Shutdown_:_shutdown_socket_n
mov edx, 0xa
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x10]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rbx + 0x10]
cmp rax, 0xffffffffffffffff
je 0x140073b36
lea r8, str.VSocket::Close_:_closing_socket_n
mov edx, 0xa
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x10]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x10], 0xffffffffffffffff
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140073b51
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x28], rsi
mov qword [rbx + 8], rsi
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
cmp dword [rdi + 0xa8], esi
je 0x140073a00
jmp 0x140073b74
mov rax, qword [rax]
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
lea r8, str.vncHTTPConnectThread::run_undetached_:_quitting_HTTP_server_thread_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140074650
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea r15, [0x1401fdf88]
mov qword [rsp + 0x38], r15
xor ebp, ebp
mov qword [0x1401fdf88], rbp
mov qword [0x1401fdf90], rbp
lea ecx, [rbp + 0x28]
call fcn.1401312e8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1401fdf88], rax
lea r14, [0x1401fdf98]
mov qword [0x1401fdf98], rbp
mov qword [0x1401fdfa0], rbp
lea ecx, [rbp + 0x28]
call fcn.1401312e8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1401fdf98], rax
mov edi, ebp
lea rsi, [0x1401f0415]
lea r12, [0x1401f0410]
nop
movsxd rax, edi
lea rbx, [r12 + rax*8]
mov rdx, rbx
mov rcx, r15
call fcn.140075c30
movzx ecx, byte [rsi - 1]
mov byte [rax], cl
mov rdx, rbx
mov rcx, r14
call fcn.140075af0
movzx ecx, byte [rsi]
mov byte [rax], cl
inc edi
lea rsi, [rsi + 8]
cmp edi, 0x62
jb 0x140074710
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x50]
call fcn.140133cb0
mov edi, ebp
lea rbx, [0x1401efd5c]
nop
movzx ecx, byte [rbx]
call qword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
je 0x140074821
movsx rdx, ax
shr rdx, 8
movzx ecx, dl
shl cl, 7
mov byte [rsp + 0x60], cl
movzx ecx, dl
and cl, 0xfe
shl cl, 6
mov byte [rsp + 0x61], cl
and dl, 0xfc
shl dl, 5
mov byte [rsp + 0x62], dl
movzx esi, al
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_ToAscii]
test eax, eax
jns 0x140074821
movzx r9d, byte [rbx]
mov dword [rsp + 0x20], r9d
lea r8, str.Found_dead_key_0x_x__c
mov edx, 8
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rdx, qword [0x1401fdfb0]
cmp rdx, qword [0x1401fdfb8]
je 0x1400747fa
movzx eax, byte [rbx]
mov byte [rdx], al
inc qword [0x1401fdfb0]
jmp 0x140074809
mov r8, rbx
lea rcx, [0x1401fdfa8]
call fcn.140048f90
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_ToAscii]
inc edi
inc rbx
cmp edi, 7
jb 0x140074760
mov rax, r15
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401312c0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140075a30
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx esi, cl
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt eax, 0xf
jae 0x140075ae1
mov qword [rsp + 0x40], rbx
lea r8, str.SetShiftState_:_setshiftstate__d_____s___s__n
mov qword [rsp + 0x48], rbp
lea rbx, [0x1401cede4]
lea rbp, str.down
mov qword [rsp + 0x28], rbx
mov r9d, esi
mov qword [rsp + 0x20], rbp
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, 2
movzx ecx, sil
mov edx, eax
call fcn.14002f680
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r9d, esi
lea r8, str.SetShiftState_:_new_state__d___s__n
bt eax, 0xf
lea rcx, vtable.VNCLog.0
mov edx, 9
cmovb rbx, rbp
mov qword [rsp + 0x20], rbx
call fcn.140017a50
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140076700
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x468
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, [rsp + 0x30]
call fcn.140021a40
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x250]
lea r8, [0x14019526c]
mov dword [rsp + 0x20], 0x200
lea rdx, str.path
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x250]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140076767
test rax, rax
jne 0x1400767b3
mov r8d, 0x104
lea rdx, [rsp + 0x140]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400767a9
mov edx, 0x5c
lea rcx, [rsp + 0x140]
call fcn.140133228
test rax, rax
je 0x1400767cc
mov byte [rax], 0
lea r8, [rsp + 0x140]
jmp 0x1400767bb
lea r8, [rsp + 0x250]
mov edx, 0x104
lea rcx, [0x1401f0122]
call fcn.140139fd0
lea r8, [0x1401f0122]
mov edx, 0x200
lea rcx, [0x1401eff20]
call fcn.140139fd0
lea r8, [0x1401c3128]
mov edx, 0x200
lea rcx, [0x1401eff20]
call fcn.14013a030
lea r8, str.WinVNC.log
mov edx, 0x200
lea rcx, [0x1401eff20]
call fcn.14013a030
cmp byte [0x1401eff08], 0
mov byte [0x1401f0120], 1
je 0x140076829
call fcn.140076850
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0x468
ret
Function at 0x140076850
Capabilities:
Move file
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x40
mov rbx, 0xffffffffffffffff
lea rsi, [0x1401eff20]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140076870
test rax, rax
jne 0x1400768a6
lea r8, str.Error_opening_log_file_n
mov word [0x1401eff08], 0x100
xor edx, edx
lea rcx, vtable.VNCLog.0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
jmp fcn.140017a50
cmp byte [0x1401f0120], 0
mov byte [0x1401eff08], 1
jne 0x14007693d
mov qword [rsp + 0x50], rdi
mov rcx, rbx
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400768c2
add rcx, 5
call fcn.14013132c
mov rdi, rax
mov rdx, rbx
nop word [rax + rax]
inc rdx
cmp byte [rsi + rdx], 0
jne 0x1400768e0
add rdx, 5
mov r8, rsi
mov rcx, rdi
call fcn.140139fd0
nop dword [rax + rax]
cmp byte [rsi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140076900
lea rdx, [rbx + 5]
mov rcx, rdi
lea r8, str..bak
call fcn.14013a030
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rcx, rdi
call fcn.1401312e0
mov rdi, qword [rsp + 0x50]
mov rcx, qword [0x1401eff18]
xor ebx, ebx
test rcx, rcx
je 0x140076958
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401eff18], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1401eff18], rax
cmp rax, 0xffffffffffffffff
jne 0x1400769b7
mov r9, rsi
mov word [0x1401eff08], 0x100
lea r8, str.Error_opening_log_file__s_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [0x1401eff18]
cmp byte [0x1401f0120], bl
mov rcx, rax
je 0x1400769de
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetEndOfFile]

Function at 0x1400769f0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
cmp byte [rcx + 9], 0
mov rsi, rdx
mov rbp, rcx
je 0x140076a14
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [rbp + 0xa], 0
mov rbx, 0xffffffffffffffff
je 0x140076a66
mov qword [rsp + 0x48], rdi
mov rdi, rbx
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140076a30
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rdi, qword [rsp + 0x48]
cmp byte [rbp + 8], 0
je 0x140076a98
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140076a98
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140076a75
mov r8, rbx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x140076c20
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9d, dword [0x1401fdfcc]
lea r8, str.RestoreDesktop_:_Restorewallpaper__i_n
mov edx, 8
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov r9d, dword [0x1401fdfcc]
test r9d, r9d
je 0x140076d1a
mov eax, dword [0x1401fdff8]
lea r8, str.RestoreDesktop_:_Restorewallpaper__i__i_n
mov edx, 8
mov dword [rsp + 0x20], eax
lea rcx, vtable.VNCLog.0
call fcn.140017a50
cmp dword [0x1401fdff8], 0
je 0x140076c91
call fcn.140021660
cmp eax, 0x40047
jb 0x140076c91
mov cl, 1
call fcn.140021700
xor edx, edx
lea r8, [0x1401fe080]
mov r9d, 2
lea ecx, [rdx + 0x14]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
lea rax, [rsp + 0x40]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Control_PanelDesktop
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140076d1a
lea rcx, [0x1401fe480]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140076ce2
mov dword [rsp + 0x28], eax
lea rdx, str.WallpaperStyle
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1401fdfcc], 0
add rsp, 0x38
ret

Function at 0x1400775d0
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x690], 0
mov rbx, rcx
je 0x14007767c
xor edx, edx
lea rcx, str.SYSTEM
nop
movzx eax, byte [rbx + rdx + 0x690]
inc rdx
cmp al, byte [rcx + rdx - 1]
jne 0x14007760d
cmp rdx, 7
jne 0x1400775f0
add rsp, 0x20
pop rbx
ret
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140077633
inc dword [rbx + 0x7c0]
mov byte [rbx + 0x7bc], al
add rsp, 0x20
pop rbx
ret
cmp byte [rbx + 0x7bc], 0
jne 0x140077644
mov rcx, rbx
call fcn.1400776f0
mov rcx, rbx
call fcn.140077bf0
lea r8, [rbx + 0x7c6]
mov edx, 0x80
lea rcx, [rbx + 0x2b0]
call fcn.14014a4e0
lea rdx, [rbx + 0x288]
mov ecx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
add rsp, 0x20
pop rbx
ret