joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412fa0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov edx, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [ecx]
mov ecx, eax
shr ecx, 4
xor ecx, edx
and ecx, 0xf0f0f0f
xor edx, ecx
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, edx
and ecx, 0xffff
xor edx, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, edx
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
shl ecx, 2
xor edx, ecx
mov ecx, edx
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor edx, ecx
mov ecx, edx
add edx, edx
shr ecx, 0x1f
or ecx, edx
mov edx, ecx
xor edx, eax
and edx, 0xaaaaaaaa
xor eax, edx
xor ecx, edx
mov edx, eax
shr edx, 0x1f
add eax, eax
or edx, eax
mov dword [esp + 0x10], 8
mov ebx, dword [edi]
mov eax, ecx
shl eax, 0x1c
mov esi, ecx
shr esi, 4
or eax, esi
xor eax, ebx
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
mov ebp, dword [ebx*4 + 0x443538]
mov esi, eax
shr esi, 0x18
and esi, 0x3f
mov esi, dword [esi*4 + 0x443338]
or esi, ebp
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or esi, dword [ebx*4 + 0x443738]
and eax, 0x3f
mov ebx, dword [eax*4 + 0x443938]
mov eax, dword [edi + 4]
or esi, ebx
xor eax, ecx
add edi, 4
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x443438]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x443638]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x443838]
and eax, 0x3f
or ebx, dword [eax*4 + 0x443a38]
or ebx, esi
xor edx, ebx
mov ebx, dword [edi + 4]
add edi, 4
mov eax, edx
shl eax, 0x1c
mov esi, edx
shr esi, 4
or eax, esi
xor eax, ebx
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
mov ebp, dword [ebx*4 + 0x443538]
mov esi, eax
shr esi, 0x18
and esi, 0x3f
mov esi, dword [esi*4 + 0x443338]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or esi, ebp
mov ebp, dword [ebx*4 + 0x443738]
and eax, 0x3f
mov ebx, dword [eax*4 + 0x443938]
mov eax, dword [edi + 4]
add edi, 4
or esi, ebp
or esi, ebx
xor eax, edx
mov ebx, eax
shr ebx, 0x18
mov ebp, eax
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x443438]
shr ebp, 0x10
and ebp, 0x3f
add edi, 4
or ebx, dword [ebp*4 + 0x443638]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x443838]
and eax, 0x3f
mov ebp, dword [eax*4 + 0x443a38]
mov eax, dword [esp + 0x10]
or ebx, ebp
or ebx, esi
xor ecx, ebx
dec eax
mov dword [esp + 0x10], eax
jne 0x413028
mov eax, ecx
shr ecx, 1
shl eax, 0x1f
or eax, ecx
mov ecx, eax
xor ecx, edx
and ecx, 0xaaaaaaaa
xor edx, ecx
xor eax, ecx
mov ecx, edx
shr edx, 1
shl ecx, 0x1f
or ecx, edx
mov edx, ecx
shr edx, 8
xor edx, eax
and edx, 0xff00ff
xor eax, edx
shl edx, 8
xor ecx, edx
mov edx, ecx
shr edx, 2
xor edx, eax
and edx, 0x33333333
xor eax, edx
shl edx, 2
xor ecx, edx
mov edx, eax
shr edx, 0x10
xor edx, ecx
and edx, 0xffff
xor ecx, edx
shl edx, 0x10
xor eax, edx
mov edx, eax
shr edx, 4
xor edx, ecx
and edx, 0xf0f0f0f
mov esi, edx
shl esi, 4
xor esi, eax
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
xor edx, ecx
pop ebp
mov dword [eax + 4], edx
pop ebx
pop ecx
ret
Function at 0x4137a0
Capabilities:
Inspect load icon resource

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
push edi
mov dword [esi + 0x18], eax
lea edi, [esi + 0x14]
mov dword [edi], 0x58
mov dword [esi + 0x1c], 0x65
mov ecx, dword [0x445ee4]
mov edx, dword [ecx + 0x59c]
push 0x65
push edx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esi + 0x28], eax
push 0x40
lea eax, [esi + 0x2c]
push eax
mov dword [esi + 0x20], 3
mov dword [esi + 0x24], 0x402
mov byte [eax], 0
mov eax, dword [0x445ee4]
mov ecx, dword [eax + 0x59c]
push 0x65
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x413805
or dword [esi + 0x20], 4
mov edx, dword [esp + 0xc]
push edi
push edx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
test eax, eax
pop edi
setne al
pop esi
ret 4

Function at 0x414060
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x838]
test eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x414087
mov eax, dword [esi + 0x854]
push eax
mov dword [esi + 0x838], 0
call edi
mov eax, dword [esi + 0x83c]
test eax, eax
je 0x4140ca
mov ecx, dword [esi + 0x850]
or eax, 0xffffffff
push ecx
mov dword [esi + 0x83c], 0
mov dword [esi + 0x84c], 1
mov dword [esi + 0x810], eax
mov dword [esi + 0x80c], eax
call edi
add esi, 0x6f9
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
ret
Function at 0x414fa0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x2a0
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
mov ebp, dword [esp + 0x2ac]
push esi
mov esi, dword [esp + 0x2b4]
push edi
lea eax, [esp + 0x1b0]
push eax
mov edi, ecx
mov ecx, dword [esi + 0x3c]
push ecx
push 0x41e
push ebp
call ebx
push eax
mov ecx, edi
call fcn.00414de0
lea edi, [esp + 0x1b0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x414fe4
mov ecx, dword [esi + 0x3c]
mov dx, word [0x43bec8]
mov al, byte [0x43beca]
push ecx
push 4
push 0x110a
push 0x41e
mov word [edi], dx
push ebp
mov byte [edi + 2], al
call ebx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call edi
test eax, eax
je 0x415063
mov edi, edi
mov edx, dword [esi + 0x3c]
push edx
push 4
push 0x110a
push 0x41e
push ebp
call ebx
push eax
call edi
push eax
push 0
push 0x1101
push 0x41e
push ebp
call ebx
push eax
call edi
mov eax, dword [esi + 0x3c]
push eax
push 4
push 0x110a
push 0x41e
push ebp
call ebx
push eax
call edi
test eax, eax
jne 0x415020
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x1b4]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
push 0
mov dword [esp + 0x14], edi
call esi
cmp edi, 0xffffffff
je 0x415157
mov edi, 0x43bec4
lea esi, [esp + 0x9c]
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x415134
mov edi, 0x43bec0
lea esi, [esp + 0x9c]
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x415134
test byte [esp + 0x70], 0x10
je 0x415134
mov ecx, dword [esp + 0x2b8]
mov edx, dword [ecx + 0x3c]
lea eax, [esp + 0x9c]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x1100
push 0x41e
mov dword [esp + 0x24], edx
mov ecx, 0xa
lea esi, [esp + 0x58]
lea edi, [esp + 0x2c]
mov dword [esp + 0x58], 1
push ebp
rep movsd dword es:[edi], dword [esi]
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x1100
push 0x41e
push ebp
mov dword [esp + 0x28], eax
call ebx
push eax
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x415093
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret 8
Function at 0x417ca0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x40c]
push esi
push eax
mov esi, ecx
mov ecx, dword [esp + 0x410]
push ecx
lea edx, [esp + 0x10]
push 0x3fe
push edx
call fcn.0042e373
lea eax, [esp + 0x18]
add esp, 0x10
mov byte [esp + 0x406], 0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417ce0
sub eax, edx
test eax, eax
jle 0x417d0a
cmp eax, 0x3fe
ja 0x417d0a
cmp byte [esp + eax + 7], 0xa
jne 0x417d0a
mov byte [esp + eax + 7], 0xd
mov byte [esp + eax + 8], 0xa
mov byte [esp + eax + 9], 0
mov al, byte [esi + 5]
test al, al
je 0x417d1c
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [esi + 6]
test al, al
je 0x417d55
lea eax, [esp + 8]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417d30
push 0
lea ecx, [esp + 8]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x14]
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov al, byte [esi + 4]
test al, al
je 0x417d8d
mov edx, dword [esi + 0xc]
test edx, edx
je 0x417d8d
lea eax, [esp + 8]
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417d70
push 0
lea ecx, [esp + 8]
push ecx
sub eax, esi
push eax
lea eax, [esp + 0x14]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
add esp, 0x404
ret 8

Function at 0x418400
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov esi, ecx
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1c]
cmp eax, 1
je 0x418437
cmp eax, 2
je 0x418437
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov byte [esp + 0xc], al
push 0x4410e8
lea eax, [esp + 0x10]
push eax
call fcn.0042d8be
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x445e84]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp esi, eax
jne 0x418464
push 0x4410e8
lea edx, [esp + 0x10]
xor al, al
push edx
mov byte [esp + 0x14], al
call fcn.0042d8be
mov eax, dword [esi + 0x34]
test eax, eax
je 0x418480
xor al, al
mov byte [esp + 0xc], al
push 0x4410e8
lea eax, [esp + 0x10]
push eax
call fcn.0042d8be
mov ecx, dword [esi + 0x38]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4184a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x441090
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], eax
call fcn.0042d8be
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4184b6
mov ecx, dword [esi + 0x40]
mov dword [eax], ecx
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
pop edi
pop esi
ret 4
Function at 0x4184d0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x445e84]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x418521
push edi
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov dword [esi + 0x1c], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x34]
test eax, eax
pop edi
je 0x41851a
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
pop esi
mov dword [esp + 4], 0
jmp fcn.0042e4bb
mov eax, dword [esp + 8]
mov dword [esi + 0x40], eax
pop esi
mov dword [esp + 4], 0
jmp fcn.0042e4bb

Function at 0x418730
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x438b78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
lea edi, [esi + 4]
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1c]
test eax, eax
mov dword [esp + 0x20], 0
je 0x41877e
xor al, al
mov byte [esp + 0xb], al
push 0x4410e8
lea eax, [esp + 0xf]
push eax
call fcn.0042d8be
lea ecx, [esp + 0xc]
push ecx
push 4
push esi
push 0x4186a0
push 0
push 0
call fcn.0042e581
mov edx, dword [esp + 0x24]
add esp, 0x18
test eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
jne 0x4187be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
push 0x441090
lea eax, [esp + 0x14]
push eax
call fcn.0042d8be
mov ecx, dword [esi + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x4187e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x441090
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], eax
call fcn.0042d8be
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x41880e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x441090
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], eax
call fcn.0042d8be
push edi
mov dword [esi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x41a140
Capabilities:
Persist via app paths registry key
Set registry value

Disassembly:
sub esp, 0x328
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 0x43b980
push connect
call ebx
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x41a18b
mov ecx, dword [esp + 0xc]
push 0
push str.VncViewer.Config
push 1
push 0
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call edi
jmp 0x41a19f
push str.Failed_to_register_.vnc_extension_n
push 0
push 0x445ec8
call fcn.00403360
add esp, 0xc
push 0x104
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41a1d2
push str.Error_getting_vncviewer_filename_n
push eax
push 0x445ec8
call fcn.00403360
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x328
ret
lea ecx, [esp + 0x14]
push ecx
push str.Viewer_is__s_n
push 2
push 0x445ec8
call fcn.00403360
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push str.VncViewer.Config
push connect
call ebx
test eax, eax
jne 0x41a2b1
push eax
push str.VNCviewer_Config_File
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push str.DefaultIcon
push edx
call ebx
test eax, eax
jne 0x41a25f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x11c]
push str._s_0
push ecx
call fcn.0042da36
mov eax, dword [esp + 0x1c]
add esp, 0xc
push 0
lea edx, [esp + 0x11c]
push edx
push 1
push 0
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push str.Shellopencommand
push eax
call ebx
test eax, eax
jne 0x41a2aa
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x11c]
push str.__s___config____1_
push edx
call fcn.0042da36
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0
lea eax, [esp + 0x11c]
push eax
push 1
push 0
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_vncviewer.exe
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x41a2dd
push eax
lea edx, [esp + 0x18]
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call edi
pop edi
pop esi
pop ebx
add esp, 0x328
ret
Function at 0x41a4c0
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [esp + 8]
lea edx, [esp - 0x50]
sub esp, 0x50
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41a4d0
push esi
push edi
lea edi, [esp + 8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41a4e1
mov ax, word [0x43bed0]
mov word [edi], ax
mov eax, dword [esp + 0x5c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a4f8
lea edi, [esp + 8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x41a506
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
push ecx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
add esp, 0x50
ret 8
Function at 0x41a540
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
push edi
lea eax, [esp + 8]
push eax
push str.SoftwareORLVNCviewerSettings
push reloc.WSOCK32.dll_accept
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41a6f8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.SkipFullScreenPrompt
push ecx
mov dword [esp + 0x28], 4
call esi
test eax, eax
jne 0x41a5a4
cmp dword [esp + 8], 1
sete dl
mov byte [edi + 0x10d], dl
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push str.NoToolbar
push eax
call esi
test eax, eax
jne 0x41a5d3
cmp dword [esp + 8], 1
sete cl
mov byte [edi + 0x10c], cl
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.LogToFile
push edx
call esi
test eax, eax
jne 0x41a602
cmp dword [esp + 8], 1
sete al
mov byte [edi + 0x474], al
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.HistoryLimit
push ecx
call esi
test eax, eax
jne 0x41a62d
mov edx, dword [esp + 8]
mov dword [edi + 0x110], edx
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push str.LocalCursor
push eax
call esi
test eax, eax
jne 0x41a658
mov ecx, dword [esp + 8]
mov dword [edi + 0x234], ecx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.LogLevel
push edx
call esi
test eax, eax
jne 0x41a683
mov eax, dword [esp + 8]
mov dword [edi + 0x470], eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.ListenPort
push ecx
call esi
test eax, eax
jne 0x41a6ab
mov edx, dword [esp + 8]
mov dword [edi + 8], edx
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push str.LogFileName
push eax
mov dword [esp + 0x28], 0x104
call esi
test eax, eax
pop esi
jne 0x41a6ed
lea eax, [esp + 0x14]
lea edx, [edi + 0x476]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41a6e3
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x114
ret
Function at 0x41a700
Capabilities:
Set registry value

Disassembly:
sub esp, 0x58
push esi
push edi
lea eax, [esp + 8]
push eax
push str.SoftwareORLVNCviewerSettings
push reloc.WSOCK32.dll_accept
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [esi + 0x234]
push ecx
push 4
push 0
push str.LocalCursor
push edx
call edi
mov ecx, dword [esp + 8]
push 4
lea eax, [esi + 0x110]
push eax
push 4
push 0
push str.HistoryLimit
push ecx
call edi
mov eax, dword [esp + 8]
push 4
lea edx, [esi + 0x470]
push edx
push 4
push 0
push str.LogLevel
push eax
call edi
lea eax, [esi + 0x476]
lea edx, [esp + 0x10]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41a780
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a791
sub eax, edx
mov edx, dword [esp + 8]
inc eax
push eax
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push str.LogFileName
push edx
call edi
mov ecx, dword [esp + 8]
push 4
lea eax, [esi + 8]
push eax
push 4
push 0
push str.ListenPort
push ecx
call edi
mov al, byte [esi + 0x474]
mov ecx, dword [esp + 8]
xor edx, edx
push 4
test al, al
lea eax, [esp + 0x10]
push eax
push 4
setne dl
push 0
push str.LogToFile
push ecx
mov dword [esp + 0x24], edx
call edi
mov al, byte [esi + 0x10d]
mov ecx, dword [esp + 8]
xor edx, edx
push 4
test al, al
lea eax, [esp + 0x10]
push eax
push 4
setne dl
push 0
push str.SkipFullScreenPrompt
push ecx
mov dword [esp + 0x24], edx
call edi
mov al, byte [esi + 0x10c]
mov ecx, dword [esp + 8]
xor edx, edx
push 4
test al, al
lea eax, [esp + 0x10]
push eax
push 4
setne dl
push 0
push str.NoToolbar
push ecx
mov dword [esp + 0x24], edx
call edi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x58
ret
Function at 0x41e040
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x438bcf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x43cdb8
call fcn.0041a990
lea ecx, [esi + 0x7a0]
mov dword [esp + 0x1a4], 0
call fcn.00418180
mov ecx, dword [esp + 0x1b0]
mov eax, dword [esp + 0x1ac]
push ecx
mov dword [0x445ee4], esi
mov ecx, edi
mov byte [esp + 0x1a8], 1
mov dword [esi + 0x59c], eax
call fcn.0041ccc0
mov edx, dword [esi + 0x474]
push edx
mov ecx, 0x445ec8
call fcn.00417c90
mov al, byte [esi + 0x479]
test al, al
je 0x41e0e4
mov eax, dword [0x43c4e4]
or eax, dword [0x43c4ec]
push eax
mov ecx, 0x445ec8
call fcn.00417e00
mov al, byte [esi + 0x478]
test al, al
je 0x41e101
push 0
lea ecx, [esi + 0x47a]
push ecx
mov ecx, 0x445ec8
call fcn.00417e60
lea edx, [esp + 0xc]
push edx
xor eax, eax
lea edi, [esi + 0x5a0]
mov ecx, 0x80
push 2
rep stosd dword es:[edi], eax
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x41e13e
mov eax, dword [0x443c18]
push 0x10
push eax
push str.Error_initialising_sockets_library
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
movzx ecx, word [esp + 0xc]
push ecx
push str.Started_and_Winsock__v__d__initialised_n
push 3
push 0x445ec8
call fcn.00403360
mov ecx, dword [esp + 0x1ac]
add esp, 0x10
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a0
ret 8
Function at 0x41e7e0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [str.VNCviewerBell]
sub esp, 0x104
push esi
push eax
lea ecx, [esp + 0xc]
push str.AppEventsEventLabels_s
push ecx
call fcn.0042da36
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
jne 0x41e96d
mov ecx, dword [esp + 4]
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push eax
push str.Bell
push 1
push eax
push ecx
call edi
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
mov ecx, dword [str.AppEventsSchemesAppsVNCviewer]
lea eax, [esp + 0xc]
push eax
push ecx
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
jne 0x41e96b
mov edx, dword [str.VNCviewerBell]
mov eax, dword [str.AppEventsSchemesAppsVNCviewer]
push ebp
push edx
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call fcn.0042da36
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push reloc.WSOCK32.dll_accept
call esi
mov ecx, dword [esp + 0x10]
push 0
push str.Bell
push 1
push 0
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, dword [str.VNCviewerBell]
mov ecx, dword [str.AppEventsSchemesAppsVNCviewer]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_s.current
push edx
call fcn.0042da36
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push reloc.WSOCK32.dll_accept
call ebp
test eax, eax
je 0x41e905
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push reloc.WSOCK32.dll_accept
call esi
mov ecx, dword [esp + 0x10]
push 0
push str.ding.wav
push 1
push 0
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, dword [str.VNCviewerBell]
mov ecx, dword [str.AppEventsSchemesAppsVNCviewer]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_s.default
push edx
call fcn.0042da36
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push reloc.WSOCK32.dll_accept
call ebp
test eax, eax
pop ebp
je 0x41e964
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push reloc.WSOCK32.dll_accept
call esi
mov ecx, dword [esp + 0xc]
push 0
push str.ding.wav
push 1
push 0
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
pop edi
pop ebx
pop esi
add esp, 0x104
ret