joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43aad0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
call fcn.00404eb0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x43ab43
xor esi, esi
call fcn.0043a450
cmp dword [0x4a7814], esi
je 0x43ab26
mov esi, str.group2
call fcn.0043a660
mov esi, eax
call fcn.0043a500
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
mov esi, str.group2
call fcn.0043a660
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret

Function at 0x43ab70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, ecx
call fcn.00404eb0
lea ecx, [esp + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x43abe2
call fcn.0043a450
cmp dword [0x4a7814], 0
je 0x43abc6
mov esi, str.group3
call fcn.0043a850
call fcn.0043a500
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
mov esi, str.group3
call fcn.0043a850
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret

Function at 0x43ac10
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
call fcn.00404eb0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x43ac83
xor esi, esi
call fcn.0043a450
cmp dword [0x4a7814], esi
je 0x43ac66
mov esi, str.group3
call fcn.0043a660
mov esi, eax
call fcn.0043a500
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
mov esi, str.group3
call fcn.0043a660
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret

Function at 0x43acb0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, 1
call fcn.00404eb0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, esi
jne 0x43ad2a
call fcn.0043a450
cmp dword [0x4a7814], 0
je 0x43ad0d
push esi
mov esi, str.locdom1
call fcn.0043a580
add esp, 4
mov esi, eax
call fcn.0043a500
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
push 1
mov esi, str.locdom1
call fcn.0043a580
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
Function at 0x43ad50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call fcn.00404eb0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x43adc4
call fcn.0043a450
cmp dword [0x4a7814], 0
je 0x43ada9
push esi
mov esi, str.locdom1
call fcn.0043a790
add esp, 4
call fcn.0043a500
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
push esi
mov esi, str.locdom1
call fcn.0043a790
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret

Function at 0x43adf0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
call fcn.00404eb0
lea ecx, [esp + 4]
push ecx
push esi
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x43ae66
call fcn.0043a450
cmp dword [0x4a7814], esi
je 0x43ae49
push esi
mov esi, str.locdom2
call fcn.0043a580
add esp, 4
mov esi, eax
call fcn.0043a500
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
push 0
mov esi, str.locdom2
call fcn.0043a580
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret

Function at 0x43ae90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call fcn.00404eb0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x43af04
call fcn.0043a450
cmp dword [0x4a7814], 0
je 0x43aee9
push esi
mov esi, str.locdom2
call fcn.0043a790
add esp, 4
call fcn.0043a500
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
push esi
mov esi, str.locdom2
call fcn.0043a790
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret

Function at 0x43af30
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
call fcn.00404eb0
lea ecx, [esp + 4]
push ecx
push esi
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x43afa6
call fcn.0043a450
cmp dword [0x4a7814], esi
je 0x43af89
push esi
mov esi, str.locdom3
call fcn.0043a580
add esp, 4
mov esi, eax
call fcn.0043a500
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
push 0
mov esi, str.locdom3
call fcn.0043a580
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
Function at 0x43afd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call fcn.00404eb0
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x43b044
call fcn.0043a450
cmp dword [0x4a7814], 0
je 0x43b029
push esi
mov esi, str.locdom3
call fcn.0043a790
add esp, 4
call fcn.0043a500
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
push esi
mov esi, str.locdom3
call fcn.0043a790
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x108
ret
Function at 0x43c700
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x118
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
lea eax, [esp + 0x18]
mov edi, 4
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
call fcn.00404eb0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x18]
push ecx
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x43c7e9
lea edx, [esp + 8]
push edx
push eax
push 0
push str.SoftwareORLWinVNC3
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43c78c
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x118
ret
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.NewMSLogon
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43c773
cmp dword [esp + 0x10], edi
jne 0x43c773
cmp dword [esp + 0xc], edi
jne 0x43c773
mov eax, dword [esp + 8]
mov esi, dword [esp + 0x14]
test eax, eax
je 0x43c7d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x118
ret
lea ecx, [esp + 0x18]
push ecx
push 0
push str.NewMSLogon
push str.admin
call esi
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x118
ret

Function at 0x43c820
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
sub eax, 1
je 0x43c8c8
sub eax, 1
jne 0x43c8d9
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x43c880
mov dword [0x48b140], 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x98
ret
cmp eax, 6
jne 0x43c8a4
mov dword [0x48b140], 2
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x98
ret
cmp eax, 4
ja 0x43c8d9
mov dword [0x48b140], 3
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x98
ret
mov ecx, dword [esp + 8]
neg ecx
sbb ecx, ecx
add ecx, 5
mov dword [0x48b140], ecx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x98
ret
Function at 0x43c920
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4728bb
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
mov eax, dword [0x48a348]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
lea ecx, [edi + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
mov dword [edi + 0x10c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
add eax, 1
mov dword [edi + 4], eax
mov ecx, edi
je 0x43c998
push 1
call fcn.0043f050
jmp 0x43c99d
call fcn.00440b60
mov ecx, dword [edi + 0x10c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x110]
lea eax, [esp + 0x14]
push eax
call edx
push str.d:dataultravncultravnc_project_rootultravncwinvncwinvnc_vncPasswd.h_:_PASSWD_:_ToText_called_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
push 9
call fcn.0045edb3
add esp, 4
push 1
mov ecx, 0x48ba6c
mov esi, eax
call fcn.004016d0
add esp, 4
lea eax, [esp + 0x14]
call fcn.00401c90
mov byte [esi + 8], 0
mov dword [esp + 0xc], esi
mov eax, esi
mov dword [esp + 0x138], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43ca05
sub eax, edx
jne 0x43cb0c
cmp dword [edi + 0x114], eax
je 0x43cac6
call fcn.00408480
test al, al
je 0x43cac6
mov ecx, dword [edi + 0x10c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x16c]
call edx
test eax, eax
je 0x43cb0c
lea eax, [esp + 0x1c]
call fcn.00449210
test eax, eax
jne 0x43ca62
lea edi, [esp + 0xc]
call fcn.004111b0
xor eax, eax
jmp 0x43cb37
mov edx, 0x47b37f
lea ecx, [esp + 0x1c]
jmp 0x43ca70
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x43ca90
test al, al
je 0x43ca8c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x43ca90
add ecx, 2
add edx, 2
test al, al
jne 0x43ca70
xor eax, eax
jmp 0x43ca95
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43cabc
push 0x30
push 0x4a6450
push 0x4a72a8
push eax
mov byte [edi], 1
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push edi
call fcn.0043cb60
mov byte [edi], 0
jmp 0x43cb0c
push 1
push edi
call fcn.0043cb60
jmp 0x43cb0c
mov ecx, dword [edi + 0x10c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x16c]
call edx
test eax, eax
je 0x43caf8
push 0x10
push 0x4a6450
push 0x4a7500
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x43cb0c
push 0x30
push 0x4a6450
push 0x4a6930
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43cb11
sub eax, edx
push eax
push 0
push esi
call fcn.00463710
add esp, 0xc
push esi
call fcn.0045ecd6
add esp, 4
mov byte [edi], 0
mov eax, 1
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0045dc1f
mov esp, ebp
pop ebp
ret 4
Function at 0x43ed40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
push 0
push eax
mov esi, 4
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x43ed7f
mov eax, edi
pop esi
add esp, 8
ret 8
cmp dword [esp + 4], esi
jne 0x43ed76
mov eax, edi
cmp dword [esp + 8], esi
jne 0x43ed91
mov eax, dword [esp + 0x14]
pop esi
add esp, 8
ret 8

Function at 0x43eda0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
lea ecx, [esp]
push ecx
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
push ecx
push 0
push str.Password
push eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x18], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43edf5
cmp dword [esp], 8
jg 0x43edf5
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x14
ret 4

Function at 0x43ee10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push str.AuthHosts
push edi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0
call ebx
test eax, eax
je 0x43ee4b
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [esp + 4], 1
jne 0x43ee44
mov edx, dword [esp + 8]
push esi
push edx
call fcn.0045e0f8
mov esi, eax
add esp, 4
test esi, esi
je 0x43ee8f
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x10]
push ecx
push 0
push str.AuthHosts
push edi
call ebx
test eax, eax
jne 0x43ee86
cmp dword [esp + 8], 1
je 0x43ee97
push esi
call fcn.0045e501
add esp, 4
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4402e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x110]
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
push str.DSMPlugin
mov esi, pe_nt_image_headers32
push eax
mov dword [esp + 0x24], 3
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x440342
cmp dword [esp + 8], esi
jg 0x440342
mov ecx, 0x40
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x10c
ret 4
Function at 0x441b50
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
mov dword [esi + 0x108], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
add eax, 1
mov dword [esi], eax
je 0x441b8b
push 1
mov ecx, esi
call fcn.00442780
mov eax, 1
pop esi
ret
call fcn.004431e0
mov eax, 1
pop esi
ret

Function at 0x442540
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edi
mov edi, ecx
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
push 0
push str.SingleWindowName
push eax
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44259d
cmp dword [esp + 4], 0x100
jg 0x44259d
push esi
mov ecx, 8
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop esi
mov ecx, dword [esp + 0x2c]
pop edi
xor ecx, esp
call fcn.0045dc1f
add esp, 0x2c
ret 4
Function at 0x443260
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x118]
lea edi, [esi + 4]
push edi
push eax
push str.TurboMode
push str.poll
call ebx
push edi
mov dword [esi + 0x118], eax
mov eax, dword [esi + 0x11c]
push eax
push str.PollUnderCursor
push str.poll
call ebx
push edi
mov dword [esi + 0x11c], eax
mov eax, dword [esi + 0x120]
push eax
push str.PollForeground
push str.poll
call ebx
push edi
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0x124]
push eax
push str.PollFullScreen
push str.poll
call ebx
push edi
mov dword [esi + 0x124], eax
mov eax, dword [esi + 0x128]
push eax
push str.OnlyPollConsole
push str.poll
call ebx
push edi
mov dword [esi + 0x128], eax
mov eax, dword [esi + 0x12c]
push eax
push str.OnlyPollOnEvent
push str.poll
call ebx
push edi
mov dword [esi + 0x12c], eax
mov eax, dword [esi + 0x130]
push eax
push str.EnableDriver
push str.poll
call ebx
mov dword [esi + 0x130], eax
test eax, eax
je 0x44333b
push 0
call fcn.0040d220
movzx eax, al
add esp, 4
mov dword [esi + 0x130], eax
mov eax, dword [esi + 0x134]
push edi
push eax
push str.EnableHook
push str.poll
call ebx
push edi
mov dword [esi + 0x134], eax
mov eax, dword [esi + 0x138]
push eax
push str.EnableVirtual
push str.poll
call ebx
push edi
mov dword [esi + 0x138], eax
mov eax, dword [esi + 0x13c]
push eax
push str.SingleWindow
push str.poll
call ebx
push edi
push 0x20
mov dword [esi + 0x13c], eax
add esi, 0x140
push esi
push 0x47b37f
push str.SingleWindowName
push str.poll
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
pop ebx
ret
Function at 0x44710b
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x15c
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x160]
push esi
mov esi, ecx
mov dword [esi + 0x40], eax
test eax, eax
je 0x447206
cmp dword [esi + 0x30], 0
je 0x447206
cmp dword [esi + 0x38], 0
jne 0x44721d
push 0x104
lea eax, [esp + 0x5c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4471aa
lea ecx, [esp + 0x58]
push 0x5c
push ecx
call fcn.0045dc30
add esp, 8
test eax, eax
jne 0x44716e
pop esi
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x15c
ret 4
mov byte [eax], 0
lea eax, [esp + 0x58]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x447176
mov edx, dword [str.xdmcpxdmcp.exe]
mov ecx, dword [0x481c6c]
mov dword [eax], edx
mov edx, dword [0x481c70]
mov dword [eax + 4], ecx
mov ecx, dword [0x481c74]
mov dword [eax + 8], edx
mov dl, byte [0x481c78]
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], dl
push 0x44
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00463710
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push str..xdmcp
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x78]
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x447216
mov ecx, dword [esp + 4]
push 0x2710
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edx, dword [esp + 4]
mov dword [esi + 0x38], edx
jmp 0x44721d
mov eax, dword [esi + 0x38]
test eax, eax
je 0x44721d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0x38], 0
mov ecx, dword [esp + 0x15c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0045dc1f
add esp, 0x15c
ret 4
Function at 0x4472a0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x454
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x308]
push edi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x44741e
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [esp + 0x28], ebx
test ebx, ebx
jne 0x44730b
push str.._vncserver.cpp_:_Failed_rootdc__n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
xor esi, esi
xor eax, eax
add esp, 4
mov word [esp + 0xc], si
mov word [esp + 0xe], ax
mov ecx, dword [esp + 0xc]
xor bl, bl
jmp 0x447461
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 8
push ebx
call edi
push 0xa
mov si, ax
push ebx
mov word [esp + 0x14], si
call edi
movzx ecx, ax
movzx edx, si
push ecx
push edx
push ebx
mov word [esp + 0x1a], ax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edi, eax
test edi, edi
jne 0x447350
xor esi, esi
mov word [esp + 0xc], si
mov word [esp + 0xe], ax
xor bl, bl
jmp 0x447407
push 0x430
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.00463710
add esp, 0xc
xor edx, edx
push ebx
mov dword [esp + 0x38], 0x28
mov word [esp + 0x46], dx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
mov dword [esp + 0x2c], ebx
test ebx, ebx
jne 0x447394
xor esi, esi
mov word [esp + 0xc], si
mov word [esp + 0xe], ax
xor bl, bl
jmp 0x447400
push 0
lea ecx, [esp + 0x38]
push ecx
push 0
push 1
push 0
push edi
push ebx
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x4473bf
xor esi, esi
xor edx, edx
mov word [esp + 0xc], si
mov word [esp + 0xe], dx
xor bl, bl
jmp 0x4473f5
push 0
lea eax, [esp + 0x38]
push eax
push 0
push 1
push 0
push edi
push ebx
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x4473ea
xor esi, esi
xor ecx, ecx
mov word [esp + 0xc], si
mov word [esp + 0xe], cx
xor bl, bl
jmp 0x4473f5
mov bl, byte [esp + 0x42]
cmp bl, 0x18
jne 0x4473f5
mov bl, 0x20
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x28]
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x24]
jmp 0x447461
mov edx, dword [eax + 0xe050]
mov ecx, dword [eax + 0xe04c]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xe054]
mov bl, byte [esp + 0x10]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0xe058]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 0xe05c]
mov eax, dword [eax + 0xe060]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov si, cx
mov eax, dword [ebp + 8]
movzx edx, si
mov dword [eax], edx
mov edx, dword [ebp + 0xc]
shr ecx, 0x10
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
movzx eax, bl
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc