joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401640
Capabilities:
Copy file
Delete file
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
push esi
push edi
mov esi, ecx
je 0x4016e1
lea edi, [ebp - 0xc4]
mov dword [ebp + 0xc], 1
sub edi, 4
push dword [ebp + 8]
lea eax, [ebp - 0xc4]
push eax
call sub.MSVCRT.dll_strcpy
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov byte [eax + edi], bl
mov eax, dword [ebp + 0xc]
inc dword [ebp + 0xc]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xc4]
push str._s_tmp.d_d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x1c
lea eax, [ebp - 0xc4]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
setne al
cmp dword [ebp + 0xc], 0x63
jg 0x4016c6
cmp al, bl
je 0x401669
lea eax, [ebp - 0xc4]
lea edi, [esi + 0x1c8]
push eax
push edi
mov dword [ebp + 0xc], edi
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push edi
jmp 0x4016fe
lea edi, [esi + 0x1c8]
push edi
mov dword [ebp + 0xc], edi
call sub.MSVCRT.dll_strlen
push eax
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0x1c4], eax
je 0x40181d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Description
push eax
call edi
push str.Startup
mov dword [esi + 0x28c], eax
push dword [esi + 0x1c4]
call edi
push str.Shutdown
mov dword [esi + 0x294], eax
push dword [esi + 0x1c4]
call edi
push str.SetParams
mov dword [esi + 0x290], eax
push dword [esi + 0x1c4]
call edi
push str.GetParams
mov dword [esi + 0x298], eax
push dword [esi + 0x1c4]
call edi
push str.TransformBuffer
mov dword [esi + 0x29c], eax
push dword [esi + 0x1c4]
call edi
push str.RestoreBuffer
mov dword [esi + 0x2a0], eax
push dword [esi + 0x1c4]
call edi
push str.FreeBuffer
mov dword [esi + 0x2a4], eax
push dword [esi + 0x1c4]
call edi
push str.Reset
mov dword [esi + 0x2a8], eax
push dword [esi + 0x1c4]
call edi
cmp dword [esi + 0x294], ebx
mov dword [esi + 0x2ac], eax
je 0x401803
cmp dword [esi + 0x290], ebx
je 0x401803
cmp dword [esi + 0x298], ebx
je 0x401803
cmp dword [esi + 0x29c], ebx
je 0x401803
cmp dword [esi + 0x2a0], ebx
je 0x401803
cmp dword [esi + 0x2a4], ebx
je 0x401803
cmp dword [esi + 0x2a8], ebx
je 0x401803
push 1
mov ecx, esi
call fcn.0040158e
mov al, 1
jmp 0x40181f
push dword [esi + 0x1c4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0xc]
cmp byte [eax], bl
je 0x40181d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401f77
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x98], 5
jne 0x402023
xor ebx, ebx
cmp dword [esi + 0x9c], ebx
je 0x402023
cmp word [esi + 0x128], 1
jne 0x402023
lea eax, [ebp + 8]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40201a
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x400
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push str.SubVersionNumber
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40201a
lea eax, [ebp - 0x404]
push 0x430240
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x40201a
cmp dword [ebp + 0xc], ebx
mov word [esi + 0x12a], 1
je 0x40201a
mov word [esi + 0x96], 1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret 8

Function at 0x402029
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push 1
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402102
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x400
push eax
lea eax, [ebp - 0x408]
push eax
push esi
push esi
push str.CurrentType
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402102
mov esi, dword [sym.imp.MSVCRT.dll__mbsicmp]
lea eax, [ebp - 0x408]
push str.Uniprocessor_Free
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x4020a4
mov eax, dword [ebp + 8]
or byte [eax + 0x12d], 4
jmp 0x402102
lea eax, [ebp - 0x408]
push str.Uniprocessor_Checked
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x4020c4
mov eax, dword [ebp + 8]
or byte [eax + 0x12d], 8
jmp 0x402102
lea eax, [ebp - 0x408]
push str.Multiprocessor_Free
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x4020e4
mov eax, dword [ebp + 8]
or byte [eax + 0x12d], 0x10
jmp 0x402102
lea eax, [ebp - 0x408]
push str.Multiprocessor_Checked
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x402102
mov eax, dword [ebp + 8]
or byte [eax + 0x12d], 0x20
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4
Function at 0x402110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
lea eax, [ebp - 4]
push edi
push eax
xor edi, edi
push 0x20019
push edi
push str.SystemCurrentControlSetControlProductOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40223b
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x408]
push eax
push edi
push edi
push str.ProductType
push dword [ebp - 4]
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402231
mov esi, dword [sym.imp.MSVCRT.dll__mbsicmp]
lea eax, [ebp - 0x408]
push str.LANMANNT
push eax
call esi
cmp dword [ebp + 0xc], edi
pop ecx
pop ecx
je 0x4021bb
test eax, eax
jne 0x402197
mov eax, dword [ebp + 8]
or dword [eax + 0x12c], 4
jmp 0x402231
lea eax, [ebp - 0x408]
push str.LANSECNT
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x402231
mov eax, dword [ebp + 8]
or dword [eax + 0x12c], 8
jmp 0x402231
test eax, eax
jne 0x4021ce
mov eax, dword [ebp + 8]
mov dword [eax + 0x130], 2
jmp 0x40218b
lea eax, [ebp - 0x408]
push str.SERVERNT
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x4021f1
mov eax, dword [ebp + 8]
mov dword [eax + 0x130], 1
jmp 0x402231
lea eax, [ebp - 0x408]
push str.LANSECNT
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x402214
mov eax, dword [ebp + 8]
mov dword [eax + 0x130], 2
jmp 0x4021b2
lea eax, [ebp - 0x408]
push str.WinNT
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x402231
mov eax, dword [ebp + 8]
mov dword [eax + 0x130], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
leave
ret 8

Function at 0x4024ba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402543
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x80
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push str.CSDVersion
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40253a
cmp dword [ebp - 8], 1
jne 0x402528
lea eax, [ebp - 0x8c]
mov ecx, edi
push eax
call fcn.00402478
mov esi, eax
jmp 0x40253a
cmp dword [ebp - 8], 4
jne 0x40253a
xor eax, eax
mov al, byte [ebp - 0x8b]
movzx si, al
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, si
pop edi
pop esi
leave
ret
Function at 0x40254a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlTerminal_Server
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4025b9
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 1
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.TSAppCompat
mov dword [ebp - 0xc], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4025b0
cmp dword [ebp - 8], eax
jne 0x4025b0
mov eax, dword [ebp + 8]
or byte [eax + 0x12d], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 4

Function at 0x4025bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.SystemWPAMediaCenter
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402628
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.Installed
mov dword [ebp - 0xc], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40261f
cmp dword [ebp - 8], esi
je 0x40261f
mov eax, dword [ebp + 8]
or byte [eax + 0x12d], 0x40
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4
Function at 0x40262d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SystemCurrentControlSetControlProductOptions
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40275e
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
mov edi, str.ProductSuite
push ebx
push edi
mov dword [ebp - 0xc], ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x402755
cmp dword [ebp - 8], ebx
je 0x402755
push dword [ebp - 8]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
pop ecx
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
push 0
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x40274e
cmp dword [ebp - 0xc], 7
jne 0x40274e
cmp byte [ebx], al
mov esi, ebx
je 0x40274e
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll__mbsicmp]
push str.Terminal_Server
push esi
call edi
pop ecx
test eax, eax
pop ecx
jne 0x4026ea
or dword [ebx + 0x12c], 0x10
jmp 0x40273b
push 0x43041c
push esi
call edi
pop ecx
test eax, eax
pop ecx
je 0x402734
push str.Small_Business
push esi
call edi
pop ecx
test eax, eax
pop ecx
je 0x402734
push str.Enterprise
push esi
call edi
pop ecx
test eax, eax
pop ecx
jne 0x40271d
or dword [ebx + 0x12c], 2
jmp 0x40273b
push str.Personal
push esi
call edi
pop ecx
test eax, eax
pop ecx
jne 0x40273b
or dword [ebx + 0x12c], 0x40
jmp 0x40273b
or dword [ebx + 0x12c], 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x4026d3
mov ebx, dword [ebp - 0x10]
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402cdc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov byte [ebp - 1], bl
cmp dword [esi + 4], ebx
jne 0x402d00
push dword [0x42850c]
push ebx
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x402d27
push ebx
push ebx
push ebx
push 6
push eax
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [esi + 0xc], eax
jne 0x402d21
mov byte [ebp - 1], bl
mov dword [esi + 0x109b4], eax
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret
Function at 0x404580
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov edi, 0x2000
xor ebx, ebx
push edi
and byte [esi + 0x10], bl
and byte [esi + 0x30], bl
mov dword [esi], 0x428560
mov dword [esi + 0xc], ebx
mov dword [esi + 4], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
push ebx
push eax
mov dword [esi + 0x14], eax
call sub.MSVCRT.dll_memset
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
push ebx
push eax
mov dword [esi + 0x18], eax
call sub.MSVCRT.dll_memset
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
push ebx
push eax
mov dword [esi + 0x1c], eax
call sub.MSVCRT.dll_memset
mov ebx, 0x80
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push ebx
push 0
push eax
mov dword [esi + 0x20], eax
call sub.MSVCRT.dll_memset
add esp, 0x40
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push ebx
push 0
push eax
mov dword [esi + 0x24], eax
call sub.MSVCRT.dll_memset
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
push 0
push eax
mov dword [esi + 0x28], eax
call sub.MSVCRT.dll_memset
add esp, 0x20
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x40464d
cmp dword [ebp + 8], ebx
jb 0x40464d
mov eax, dword [esi + 0x24]
mov byte [eax + 0x7c], 0x2e
mov eax, dword [esi + 0x24]
mov byte [eax + 0x7d], 0x2e
mov eax, dword [esi + 0x24]
mov byte [eax + 0x7e], 0x2e
mov eax, dword [esi + 0x24]
and byte [eax + 0x7f], 0
push str.RICHED32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x404672
push 0x30
push 0x438248
push 0x438408
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x404b96
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push ecx
push 0x404b72
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop ecx
ret
Function at 0x40d088
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, 0x2000
push edi
xor ebx, ebx
push esi
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40d11f
lea eax, [ebp - 8]
push ebx
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x40d0cd
cmp dword [ebp - 8], ebx
je 0x40d0d2
mov byte [ebp - 1], 1
jmp 0x40d0d2
cmp dword [ebp - 8], ebx
je 0x40d107
push ebx
push ebx
push ebx
call fcn.004220a6
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
push edi
push eax
call fcn.004220a6
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push 4
push eax
mov eax, dword [ebp + 0xc]
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0x24
add dword [ebp - 0xc], 4
jmp 0x40d0ae
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
cmp byte [ebp - 1], bl
pop ecx
je 0x40d124
or eax, 0xffffffff
jmp 0x40d127
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40d17b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x2c1], 0
je 0x40d298
cmp byte [esi + 0x2c0], 0
jne 0x40d27d
cmp dword [ebp + 8], 0x2000
jg 0x40d298
xor edi, edi
mov byte [ebp - 1], 1
inc edi
cmp dword [ebp + 0xc], 2
sete al
test al, al
je 0x40d1df
push edi
push 0
push dword [ebp + 8]
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40d276
mov eax, dword [ebp + 8]
jmp 0x40d28c
push dword [ebp + 8]
mov ecx, dword [esi + 0xc8]
push dword [esi + 0x2a0]
call fcn.0041e15c
test eax, eax
je 0x40d264
cmp dword [ebp + 0xc], 0
jne 0x40d201
and byte [ebp - 1], 0
cmp byte [ebp - 1], 0
mov dword [ebp + 0xc], 0x2000
je 0x40d232
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push dword [esi + 0x2a0]
push eax
push dword [esi + 0x2a4]
call fcn.004221bf
add esp, 0x10
test eax, eax
jne 0x40d276
mov ecx, dword [ebp + 0xc]
jmp 0x40d235
mov ecx, dword [ebp + 8]
cmp byte [ebp - 1], 0
je 0x40d243
mov eax, dword [esi + 0x2a4]
jmp 0x40d249
mov eax, dword [esi + 0x2a0]
lea edx, [esi + 0x2b8]
push 0
push edx
push ecx
push eax
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
jmp 0x40d272
mov ecx, esi
mov byte [esi + 0x2c0], 1
call fcn.0040d29e
test edi, edi
jne 0x40d286
mov byte [esi + 0x2c0], 1
mov ecx, esi
call fcn.0040d29e
jmp 0x40d298
mov eax, dword [esi + 0x2b8]
add dword [esi + 0x2bc], eax
inc dword [esi + 0x2b4]
pop edi
pop esi
leave
ret 8
Function at 0x40d29e
Capabilities:
Clear file content
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
lea eax, [esi + 0x2c1]
cmp byte [eax], 0
je 0x40d394
and byte [eax], 0
push edi
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea edi, [esi + 0x28c]
push edi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x40d357
push edi
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
call edi
mov word [ebp - 0x16], ax
lea eax, [esi + 0x28f]
push eax
call edi
mov word [ebp - 0x12], ax
lea eax, [esi + 0x292]
push eax
call edi
mov word [ebp - 0x18], ax
lea eax, [esi + 0x297]
push eax
call edi
mov word [ebp - 0x10], ax
lea eax, [esi + 0x29a]
push eax
call edi
and word [ebp - 0xa], 0
and word [ebp - 0xc], 0
add esp, 0x14
mov word [ebp - 0xe], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [esi + 0x2a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x148]
mov ecx, esi
push eax
call fcn.0040d912
mov eax, dword [esi + 0x2a4]
pop edi
test eax, eax
je 0x40d383
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov esi, dword [esi + 0x2a0]
test esi, esi
je 0x40d394
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop esi
leave
ret
Function at 0x40d619
Capabilities:
Delete file

Disassembly:
mov eax, 0x4271cc
call fcn.004268b0
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x24]
mov edi, eax
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x41e]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [eax], bl
jne 0x40d654
push edi
jmp 0x40d6f2
cmp byte [esi + 0x41d], bl
mov ecx, dword [esi + 0xc8]
mov byte [eax], bl
lea eax, [ebp - 0x20]
push 7
push 0xc
mov byte [ebp - 0x20], 7
push eax
mov byte [ebp - 0x1f], 6
je 0x40d678
mov byte [ebp - 0x1f], 7
call fcn.0041e017
push dword [esi + 0x408]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x2a0]
cmp eax, ebx
je 0x40d69a
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, dword [esi + 0x2a4]
cmp eax, ebx
je 0x40d6ab
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
lea edi, [esi + 0x2c2]
mov esi, str._UVNCDIR_
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strrchr]
push 0x5c
push edi
call esi
pop ecx
inc eax
pop ecx
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x40d6ef
push 0x2c
push edi
call esi
pop ecx
cmp eax, ebx
pop ecx
je 0x40d6e8
mov byte [eax], bl
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40d912
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
cmp byte [ecx + 0x2c0], 0
push ebx
push esi
mov dword [ebp - 4], ecx
jne 0x40d9d8
mov esi, str._UVNCDIR_
push esi
call sub.MSVCRT.dll_strlen
mov ebx, dword [ebp + 8]
pop ecx
push eax
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strrchr]
push 0x5c
push ebx
call esi
pop ecx
inc eax
pop ecx
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x40d9d8
push edi
lea eax, [ebp - 0x310]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x310]
push 0x5c
push eax
call esi
mov edi, eax
push 0x2d
inc edi
push edi
call dword [sym.imp.MSVCRT.dll_strchr]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x108]
push 0x2e
push eax
call esi
and byte [eax], 0
add esp, 0x28
test edi, edi
je 0x40d9a5
and byte [edi], 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x310]
pop ecx
push ebx
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x144]
call fcn.0042018e
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x40f253
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
xor ebx, ebx
cmp word [0x437918], bx
push esi
push edi
mov esi, ecx
mov edi, str.WinVNC_desktop_sink
jne 0x40f2c2
mov eax, dword [0x437ff8]
push ebx
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0x40fc59
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ebx
call dword [sym.imp.USER32.dll_RegisterClassExA]
cmp ax, bx
mov word [0x437918], ax
jne 0x40f2c2
push str.C:DATASCZ_SCwinvncwinvnc_vncdesktop.cpp_:_failed_to_register_window_class_n
jmp 0x40f2fd
push ebx
mov eax, 0x80000000
push dword [0x437ff8]
push ebx
push ebx
push 0xc8
push 0x190
push eax
push eax
push 0xcf0000
push str.WinVNC
push edi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [esi + 0xf0], eax
jne 0x40f30f
push str.C:DATASCZ_SCwinvncwinvnc_vncdesktop.cpp_:_failed_to_create_hook_window_n
push ebx
push 0x4378c8
call fcn.004053a7
add esp, 0xc
xor eax, eax
jmp 0x40f35e
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push dword [esi + 0xf0]
call dword [sym.imp.USER32.dll_SetClipboardViewer]
mov ecx, esi
mov dword [esi + 0xf8], eax
mov byte [esi + 0xb8], bl
call fcn.00410207
test eax, eax
je 0x40f35b
lea eax, [ebp - 4]
push eax
push ebx
push dword [esi + 0xf0]
push 0x40f1bf
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40f855
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov ebx, eax
lea eax, [ebx + ebx + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor esi, esi
pop ecx
mov edi, eax
xor ecx, ecx
test ebx, ebx
jle 0x40f899
mov eax, dword [ebp + 8]
add eax, ecx
cmp byte [eax], 0xa
jne 0x40f88e
mov byte [esi + edi], 0xd
inc esi
mov al, byte [eax]
mov byte [esi + edi], al
inc esi
inc ecx
cmp ecx, ebx
jl 0x40f87f
mov eax, dword [ebp - 4]
and byte [esi + edi], 0
push dword [eax + 0xf0]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40f8ed
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40f8ed
inc esi
push esi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40f8ed
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
leave
ret 4