joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dfe0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea ebx, [ebp - 0x108]
mov esi, ecx
call fcn.0040c260
mov eax, ebx
push eax
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x44e04d
call fcn.0044d780
cmp dword [0x54478c], 0
je 0x44e038
push esi
mov esi, str.locdom1
call fcn.0044dab0
add esp, 4
call fcn.0044d820
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push esi
mov esi, str.locdom1
call fcn.0044dab0
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret

Function at 0x44e070
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea ebx, [ebp - 0x108]
xor esi, esi
call fcn.0040c260
mov eax, ebx
push eax
push esi
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x44e0df
call fcn.0044d780
cmp dword [0x54478c], esi
je 0x44e0c8
push esi
mov esi, str.locdom2
call fcn.0044d8a0
add esp, 4
mov esi, eax
call fcn.0044d820
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push 0
mov esi, str.locdom2
call fcn.0044d8a0
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret

Function at 0x44e100
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea ebx, [ebp - 0x108]
mov esi, ecx
call fcn.0040c260
mov eax, ebx
push eax
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x44e16d
call fcn.0044d780
cmp dword [0x54478c], 0
je 0x44e158
push esi
mov esi, str.locdom2
call fcn.0044dab0
add esp, 4
call fcn.0044d820
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push esi
mov esi, str.locdom2
call fcn.0044dab0
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret

Function at 0x44e190
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea ebx, [ebp - 0x108]
xor esi, esi
call fcn.0040c260
mov eax, ebx
push eax
push esi
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x44e1ff
call fcn.0044d780
cmp dword [0x54478c], esi
je 0x44e1e8
push esi
mov esi, str.locdom3
call fcn.0044d8a0
add esp, 4
mov esi, eax
call fcn.0044d820
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push 0
mov esi, str.locdom3
call fcn.0044d8a0
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
Function at 0x44e220
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea ebx, [ebp - 0x108]
mov esi, ecx
call fcn.0040c260
mov eax, ebx
push eax
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x44e28d
call fcn.0044d780
cmp dword [0x54478c], 0
je 0x44e278
push esi
mov esi, str.locdom3
call fcn.0044dab0
add esp, 4
call fcn.0044d820
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push esi
mov esi, str.locdom3
call fcn.0044dab0
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
Function at 0x44fb20
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 4
lea ebx, [ebp - 0x108]
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x110], edi
call fcn.0040c260
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, ebx
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x44fc14
lea ecx, [ebp - 0x10c]
push ecx
push eax
push 0
push str.SoftwareORLWinVNC3
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44fbad
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x110]
push edx
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push str.NewMSLogon
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44fb9a
cmp dword [ebp - 0x114], edi
jne 0x44fb9a
cmp dword [ebp - 0x110], edi
jne 0x44fb9a
mov eax, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x118]
test eax, eax
je 0x44fc01
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push eax
push 0
push str.NewMSLogon
push str.admin
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret

Function at 0x44fc40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x98]
push eax
mov dword [0x544938], 0x4dd32c
mov dword [0x54494c], ebx
mov dword [0x544950], ebx
mov dword [0x544948], ebx
mov dword [0x54493c], ebx
mov byte [0x544940], bl
mov dword [0x544941], ebx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x88]
mov ecx, 1
sub eax, ecx
je 0x44fd14
sub eax, ecx
jne 0x44fd1a
mov eax, dword [ebp - 0x94]
cmp eax, 6
jne 0x44fce4
mov eax, dword [ebp - 0x90]
cmp eax, 2
jb 0x44fccc
mov byte [0x54493c], cl
jmp 0x44fd1a
cmp eax, ecx
jne 0x44fcd8
mov byte [0x54493d], cl
jmp 0x44fd1a
cmp eax, ebx
jne 0x44fd14
mov byte [0x54493e], cl
jmp 0x44fd1a
cmp eax, 5
jne 0x44fd14
mov eax, dword [ebp - 0x90]
cmp eax, 2
jne 0x44fcfc
mov byte [0x54493f], cl
jmp 0x44fd1a
cmp eax, ecx
jne 0x44fd08
mov byte [0x54493f], cl
jmp 0x44fd1a
cmp eax, ebx
jne 0x44fd14
mov byte [0x544940], cl
jmp 0x44fd1a
mov byte [0x544943], cl
cmp dword [0x544948], ebx
jne 0x44fd5e
push str.dwmapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x544948], eax
cmp eax, ebx
je 0x44fd5e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DwmIsCompositionEnabled
push eax
call esi
mov ecx, dword [0x544948]
push str.DwmEnableComposition
push ecx
mov dword [0x54494c], eax
call esi
mov dword [0x544950], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x544938
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
Function at 0x450020
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6ccb
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
lea ecx, [edi + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
mov dword [edi + 0x10c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [edi + 4], eax
mov ecx, edi
je 0x450084
push 1
call fcn.00452930
jmp 0x450089
call fcn.00454740
mov ecx, dword [edi + 0x10c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x12c]
lea eax, [ebp - 0x18]
push eax
call edx
push str.l:ultravnc_installer_otherultravncultravnc_project_rootultravncwinvncwinvnc_vncpasswd.h_:_PASSWD_:_ToText_called_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
push 9
call fcn.004aa188
push 1
mov ecx, 0x4ebecc
mov esi, eax
call fcn.004040e0
add esp, 0xc
lea eax, [ebp - 0x18]
call fcn.00404650
mov byte [esi + 8], 0
mov dword [ebp - 0x120], esi
mov eax, esi
mov dword [ebp - 4], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4500e7
sub eax, edx
jne 0x4501e2
cmp dword [edi + 0x114], eax
je 0x4501af
call fcn.0040f3a0
test al, al
je 0x4501af
mov ecx, dword [edi + 0x10c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x18c]
call edx
test eax, eax
je 0x4501e2
lea eax, [ebp - 0x11c]
call fcn.0045dd00
test eax, eax
jne 0x450148
lea edi, [ebp - 0x120]
call fcn.0041aed0
xor eax, eax
jmp 0x45020a
mov edx, 0x4ce44c
lea ecx, [ebp - 0x11c]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x450173
test al, al
je 0x45016f
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x450173
add ecx, 2
add edx, 2
test al, al
jne 0x450153
xor eax, eax
jmp 0x450178
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4501a4
push 0x517b58
push 0x5189b0
mov eax, 0x30
mov byte [edi], 1
call fcn.00409310
add esp, 8
push 0
mov ecx, edi
call fcn.00450230
mov byte [edi], 0
jmp 0x4501e2
push 1
mov ecx, edi
call fcn.00450230
jmp 0x4501e2
mov ecx, dword [edi + 0x10c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x18c]
call edx
test eax, eax
je 0x4501e2
push 0x517b58
push 0x518c08
mov eax, 0x10
call fcn.00409310
add esp, 8
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4501e7
sub eax, edx
push eax
push 0
push esi
call fcn.004b2d10
push esi
call fcn.004aa14e
add esp, 0x10
mov byte [edi], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret 4
Function at 0x4526d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
push eax
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push edi
mov esi, 1
push ebx
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x452735
cmp dword [ebp - 4], esi
jne 0x452735
mov edx, dword [ebp - 8]
push edx
call fcn.004a8a24
mov esi, eax
add esp, 4
test esi, esi
je 0x452735
lea eax, [ebp - 8]
push eax
push esi
lea ecx, [ebp - 4]
push ecx
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x45273c
push esi
call fcn.004a9011
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], 1
jne 0x45272c
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x455d10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x108]
mov esi, ecx
call fcn.0045dd00
test eax, eax
jne 0x455d5b
push str.vncproperties.cpp_:__DBG___NO_current_user_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov edx, 0x4ce44c
lea ecx, [ebp - 0x108]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x455d86
test al, al
je 0x455d82
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x455d86
add ecx, 2
add edx, 2
test al, al
jne 0x455d66
xor eax, eax
jmp 0x455d8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x455dcb
push str.vncproperties.cpp_:__DBG___Force_USER_SYSTEM_2_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
mov eax, dword [str.SYSTEM]
mov cx, word [0x4d59d0]
mov dl, byte [0x4d59d2]
add esp, 4
mov dword [ebp - 0x108], eax
mov word [ebp - 0x104], cx
mov byte [ebp - 0x102], dl
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esi, 8
push esi
push 0
push str.DebugMode
push str.admin
call edi
mov ebx, eax
call fcn.00449940
push esi
push 0
push str.DebugLevel
push str.admin
call edi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
xor ecx, ebp
mov dword [0x4ecb10], eax
pop esi
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
Function at 0x455e20
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x21c], 0
call fcn.0045d8f0
test eax, eax
je 0x455ffc
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x455ffc
lea eax, [ebp - 0x21c]
push eax
push 0x201eb
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x455e92
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
jmp 0x455eb0
mov cl, byte [ebp + eax - 0x218]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x455eb0
lea eax, [ebp - 0x110]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x455ed0
mov edx, dword [str.__dsmpluginhelper]
mov ecx, dword [0x4ddbdc]
mov dword [eax], edx
mov edx, dword [0x4ddbe0]
mov dword [eax + 4], ecx
mov ecx, dword [0x4ddbe4]
mov dword [eax + 8], edx
mov dx, word [0x4ddbe8]
mov dword [eax + 0xc], ecx
mov cl, byte [0x4ddbea]
mov word [eax + 0x10], dx
mov byte [eax + 0x12], cl
mov eax, ebx
mov ecx, ebx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x455f13
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x455f25
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x44
mov ecx, eax
lea edx, [ebp - 0x278]
and ecx, 3
push 0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.004b2d10
add esp, 0xc
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, dword [ebp - 0x21c]
lea edx, [ebp - 0x278]
push edx
push 0
push 0
xor eax, eax
push 8
push 0
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
push 0
mov eax, 5
push 0
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x110]
push eax
push 0
push ecx
mov dword [ebp - 0x270], str.Winsta0Default
mov dword [ebp - 0x278], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x522
jne 0x455fdc
mov ecx, ebx
call fcn.00456120
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x455fef
push eax
call esi
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x455ffc
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
Function at 0x456010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x4ddbf0]
mov ecx, dword [str.__dsmplugininstance]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x104], edx
mov edx, dword [0x4ddbf8]
mov dword [ebp - 0x108], ecx
mov ecx, dword [0x4ddbf4]
push ebx
mov dword [ebp - 0xfc], edx
mov dl, byte [0x4ddc00]
mov dword [ebp - 0x100], ecx
mov ecx, dword [0x4ddbfc]
push esi
mov byte [ebp - 0xf4], dl
push edi
mov dword [ebp - 0xf8], ecx
mov edx, eax
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x456075
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x456085
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x244], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x248]
lea ecx, [ebp - 0x20c]
lea edx, [ebp - 0x108]
push eax
mov dword [ebp - 0x23c], str.runas
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
Function at 0x457d40
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x118]
lea edi, [esi + 4]
push edi
push eax
push str.TurboMode
push str.poll
call ebx
push edi
mov dword [esi + 0x118], eax
mov eax, dword [esi + 0x11c]
push eax
push str.PollUnderCursor
push str.poll
call ebx
push edi
mov dword [esi + 0x11c], eax
mov eax, dword [esi + 0x120]
push eax
push str.PollForeground
push str.poll
call ebx
push edi
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0x124]
push eax
push str.PollFullScreen
push str.poll
call ebx
push edi
mov dword [esi + 0x124], eax
mov eax, dword [esi + 0x128]
push eax
push str.OnlyPollConsole
push str.poll
call ebx
push edi
mov dword [esi + 0x128], eax
mov eax, dword [esi + 0x12c]
push eax
push str.OnlyPollOnEvent
push str.poll
call ebx
push edi
mov dword [esi + 0x12c], eax
mov eax, dword [esi + 0x130]
push eax
push str.MaxCpu
push str.poll
call ebx
mov dword [esi + 0x130], eax
test eax, eax
jne 0x457e12
mov dword [esi + 0x130], 0x64
mov eax, dword [esi + 0x134]
push edi
push eax
push str.EnableDriver
push str.poll
call ebx
mov dword [esi + 0x134], eax
test eax, eax
je 0x457e43
push 0
call fcn.00416ed0
movzx eax, al
add esp, 4
mov dword [esi + 0x134], eax
mov eax, dword [esi + 0x138]
push edi
push eax
push str.EnableHook
push str.poll
call ebx
push edi
mov dword [esi + 0x138], eax
mov eax, dword [esi + 0x13c]
push eax
push str.EnableVirtual
push str.poll
call ebx
push edi
mov dword [esi + 0x13c], eax
mov eax, dword [esi + 0x140]
push eax
push str.SingleWindow
push str.poll
call ebx
push edi
push 0x20
mov dword [esi + 0x140], eax
add esi, 0x144
push esi
push 0x4ce44c
push str.SingleWindowName
push str.poll
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
pop ebx
ret
Function at 0x45d8f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x4ea5e0]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push esi
push edi
xor esi, esi
push str.kernel32.dll
mov dword [esp + 0x14], esi
mov dword [0x54479c], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, esi
je 0x45d953
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSGetActiveConsoleSessionId
push edi
call ebx
push str.ProcessIdToSessionId
push edi
mov esi, eax
call ebx
mov dword [0x54479c], eax
test esi, esi
je 0x45d953
call esi
mov dword [esp + 0xc], eax
jmp 0x45d95b
mov dword [esp + 0xc], 0
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x45d995
cmp dword [0x54479c], 0
je 0x45d995
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x14], 0xffffffff
call dword [0x54479c]
mov edx, dword [esp + 0xc]
mov dword [esp + 0xc], edx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x45d9c5
lea eax, [esp + 0x18]
push eax
push esi
mov dword [esp + 0x20], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x45d9e7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x45d9d0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
lea ecx, [ecx]
lea ecx, [esp + 0x3c]
push str.explorer.exe
push ecx
call fcn.004aab8d
add esp, 8
test eax, eax
jne 0x45da68
mov dword [esp + 0x14], eax
mov eax, dword [0x54479c]
test eax, eax
je 0x45da60
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push ecx
call eax
test eax, eax
je 0x45da68
mov edx, dword [esp + 0xc]
cmp dword [esp + 0x14], edx
jne 0x45da68
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x45da47
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x144]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x18]
push ecx
push esi
call ebx
test eax, eax
jne 0x45d9f0
jmp 0x45da35
Function at 0x45dba0
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x544798]
push edi
test eax, eax
je 0x45dbb8
mov dword [0x544794], 1
cmp dword [0x513790], 2
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x45dc63
test eax, eax
je 0x45dc63
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
test eax, eax
jne 0x45dbe7
push str.vncservice.cpp_:_______________GetCurrentUser___ERROR_:_No_window_station__n
jmp 0x45dce2
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 4
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
call edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 4], 0
jne 0x45dc39
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push str.vncservice.cpp_:_______________GetCurrentUser___Error:_Usersize_0_n
xor eax, eax
mov ecx, 0x4ecb00
mov dword [0x544794], 0
mov byte [esi], 0
call fcn.00403230
add esp, 4
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [0x544794], 0
jne 0x45dc63
push str.vncservice.cpp_:_______________GetCurrentUser___Error:_NOT_impersonating_user__n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
mov byte [esi], 0
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [0x513790]
dec edx
cmp edx, 1
ja 0x45dcdd
mov ecx, esi
mov dword [ebp - 4], 0x101
call fcn.0045da80
test al, al
jne 0x45dcbe
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x45dcbe
call edi
cmp eax, 0x4dd
jne 0x45dca0
push str.vncservice.cpp_:_______________GetCurrentUser___Error:_No_user_logged_on__n
jmp 0x45dc47
call edi
push eax
push str.vncservice.cpp_:_getusername_error__d_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 8
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
push str.vncservice.cpp_:_______________GetCurrentUser___UserNAme_found:__s__n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 8
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
push str.vncservice.cpp_:_______________GetCurrentUser___Error:_Unknown_OS__n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x45e9d0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [eax + 0x42c], 0
je 0x45ea25
push esi
lea eax, [ebp - 8]
push eax
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push ecx
mov ecx, dword [ebp + 8]
mov esi, 4
push ecx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45ea12
cmp dword [ebp - 4], esi
jne 0x45ea12
cmp dword [ebp - 8], esi
je 0x45ea1b
mov eax, edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
add eax, 0x430
push eax
push edi
push ecx
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esp, ebp
pop ebp
ret 4