joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db60
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
push ebp
je 0x40dc1b
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x40dc1b
push edi
lea eax, [esp + 0x10]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x40db96
pop edi
pop ebp
pop ebx
add esp, 8
ret
push esi
push edi
call fcn.0045c2ef
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push str.StringFileInfo040904b0ProductVersion
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40dbde
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
push str.StringFileInfo000004b0ProductVersion
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40dc04
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
push edx
push eax
push ebp
call fcn.0045d150
push esi
call fcn.0045c39e
add esp, 0x10
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push esi
mov byte [ebp], 0
call fcn.0045c39e
add esp, 4
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x40eb90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push edi
push 1
push ebp
call fcn.00402430
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
add eax, 0xfffffff8
add esp, 8
test eax, eax
jle 0x40ec0b
push ebx
lea ebx, [eax - 1]
shr ebx, 3
push esi
lea esi, [eax + edi]
add ebx, 1
mov edi, edi
push esi
push esi
call fcn.00402400
movzx eax, byte [esi - 8]
movzx ecx, byte [esi - 7]
xor byte [esi], al
xor byte [esi + 1], cl
movzx edx, byte [esi - 6]
movzx eax, byte [esi - 5]
movzx ecx, byte [esi - 4]
xor byte [esi + 2], dl
xor byte [esi + 3], al
xor byte [esi + 4], cl
movzx edx, byte [esi - 3]
movzx eax, byte [esi - 2]
movzx ecx, byte [esi - 1]
xor byte [esi + 5], dl
xor byte [esi + 6], al
xor byte [esi + 7], cl
add esp, 8
add esi, 0xfffffff8
sub ebx, 1
jne 0x40ebc0
pop esi
pop ebx
push edi
push edi
call fcn.00402400
movzx edx, byte [ebp]
xor byte [edi], dl
movzx eax, byte [ebp + 1]
xor byte [edi + 1], al
movzx ecx, byte [ebp + 2]
xor byte [edi + 2], cl
movzx edx, byte [ebp + 3]
xor byte [edi + 3], dl
movzx eax, byte [ebp + 4]
xor byte [edi + 4], al
movzx ecx, byte [ebp + 5]
xor byte [edi + 5], cl
movzx edx, byte [ebp + 6]
xor byte [edi + 6], dl
movzx eax, byte [ebp + 7]
xor byte [edi + 7], al
add esp, 8
pop edi
pop ebp
ret
Function at 0x410f00
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x12c
mov eax, dword [0x48ea40]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
mov esi, dword [esp + 0x134]
push 0x105
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0045c220
push 0x104
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.0045e2fe
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0x38], ax
add esp, 0x18
lea eax, [esp + 4]
lea edx, [esp + 0x24]
push eax
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], edx
mov word [esp + 0x18], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ecx, dword [esp + 0x12c]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
add eax, 1
call fcn.0045c20d
add esp, 0x12c
ret

Function at 0x410fb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x38
mov eax, dword [0x48ea40]
xor eax, esp
mov dword [esp + 0x34], eax
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareAnyPC
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x28
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41100c
mov eax, dword [esp]
test eax, eax
je 0x410ffb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0045c20d
add esp, 0x38
ret
push esi
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push str.AdminNodePass
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x411053
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x411046
sub eax, edx
jne 0x411065
mov al, 1
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0045c20d
add esp, 0x38
ret
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x4110d0
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x411072
sub eax, esi
je 0x4110d0
lea eax, [esp + 0x10]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4110b6
test dl, dl
je 0x41109f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4110b6
add eax, 2
add ecx, 2
test dl, dl
jne 0x411083
xor eax, eax
test eax, eax
sete al
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0045c20d
add esp, 0x38
ret
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0045c20d
add esp, 0x38
ret
mov ecx, dword [esp + 0x38]
pop esi
xor ecx, esp
xor al, al
call fcn.0045c20d
add esp, 0x38
ret
Function at 0x4110f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push 0x44
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0045c220
add esp, 0xc
cmp dword [esp + 0x5c], 0
mov dword [esp + 0x10], 0x44
je 0x41111e
mov word [esp + 0x40], 1
xor eax, eax
jmp 0x41112a
mov word [esp + 0x40], 0
mov eax, 0x8000000
lea ecx, [esp]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0
push eax
mov eax, dword [esp + 0x6c]
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x411155
xor al, al
add esp, 0x54
ret
mov ecx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 4]
push edx
call esi
mov al, 1
pop esi
add esp, 0x54
ret
Function at 0x412820
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov eax, dword [0x48ea40]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
lea eax, [esp + 4]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ebx, dword [esp + 0x10c]
movzx ecx, bl
test byte [esp + ecx + 4], 1
je 0x41286b
push esi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 1
push 0
push ebx
call esi
push 0
push 3
push 0
push ebx
call esi
pop esi
mov ecx, dword [esp + 0x104]
pop ebx
xor ecx, esp
call fcn.0045c20d
add esp, 0x104
ret

Function at 0x413150
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push edi
xor edi, edi
push 0x2000
mov byte [esp + 0xf], 0
mov dword [esp + 0x10], edi
call fcn.0045cd98
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x41317e
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret 0xc
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x18]
push eax
push 0x2000
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4131ad
cmp dword [esp + 0x14], eax
je 0x4131b4
mov byte [esp + 0x13], 1
jmp 0x4131b4
cmp dword [esp + 0x14], 0
je 0x4131d6
push 0
push 0
push 0
call fcn.00454550
mov ecx, dword [esp + 0x20]
push ecx
push esi
push eax
call fcn.00454550
add esp, 0x18
mov dword [edi + ebx], eax
add edi, 4
jmp 0x413188
push 0
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call fcn.0045d145
add esp, 4
cmp byte [esp + 0x13], 0
pop ebp
pop ebx
jne 0x413173
mov eax, edi
pop edi
pop esi
add esp, 8
ret 0xc
Function at 0x413290
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x471068
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x48ea40]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
call edx
mov edi, eax
push edi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esi + 0x456], 0
mov dword [esp + 0x24], 0
je 0x4133b1
mov ecx, dword [esi + 0xec]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1b8]
call edx
imul eax, eax, 0x3e8
mov ecx, dword [esi + 0xf0]
push eax
call fcn.00449af0
cmp byte [esi + 0x455], 0
mov eax, 7
push eax
mov byte [esi + 0x456], 0
mov byte [esp + 0x14], al
push 0xc
jne 0x41332a
lea eax, [esp + 0x18]
mov byte [esp + 0x19], 6
push eax
jmp 0x413333
lea ecx, [esp + 0x18]
mov byte [esp + 0x19], al
push ecx
mov ecx, dword [esi + 0xf0]
call fcn.0044a1f0
lea edx, [esi + 0x440]
push edx
call fcn.0044a2c0
mov eax, dword [esi + 0x2d8]
add esp, 4
test eax, eax
je 0x413360
push eax
call fcn.0045d145
add esp, 4
mov eax, dword [esi + 0x2dc]
test eax, eax
je 0x413373
push eax
call fcn.0045d145
add esp, 4
add esi, 0x2fc
push 0x5c
push esi
call fcn.0045e20a
push 9
add eax, 1
push str._UVNCDIR_
push eax
call fcn.0045e71d
add esp, 0x14
test eax, eax
jne 0x4133b1
push 0x2c
push esi
call fcn.0045e20a
add esp, 8
test eax, eax
je 0x4133aa
mov byte [eax], 0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x4133d0
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push ebx
lea eax, [esp + 8]
push eax
xor bl, bl
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jge 0x4133ee
xor al, al
pop ebx
add esp, 8
ret 8
mov edx, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x41342a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov ecx, dword [esp + 4]
test eax, eax
mov eax, dword [esp + 8]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
setne bl
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov al, bl
pop ebx
add esp, 8
ret 8
Function at 0x413440
Capabilities:
Delete file

Disassembly:
sub esp, 0x310
mov eax, dword [0x48ea40]
xor eax, esp
mov dword [esp + 0x30c], eax
push ebx
mov ebx, dword [esp + 0x318]
push ebp
mov ebp, ecx
cmp byte [ebp + 0x2f8], 0
jne 0x413551
push 0x5c
push ebx
call fcn.0045e20a
push 9
add eax, 1
push str._UVNCDIR_
push eax
call fcn.0045e71d
add esp, 0x14
test eax, eax
jne 0x413551
lea edx, [esp + 0x10c]
mov eax, ebx
sub edx, ebx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4134a0
push esi
push edi
lea eax, [esp + 0x114]
push 0x5c
push eax
call fcn.0045e20a
mov esi, eax
add esi, 1
push 0x2d
push esi
call fcn.0045e137
add eax, 1
lea edx, [esp + 0x20]
add esp, 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4134d6
lea ecx, [esp + 0x10]
push 0x2e
push ecx
call fcn.0045e20a
add esp, 8
test esi, esi
mov byte [eax], 0
je 0x4134fb
mov byte [esi], 0
lea eax, [esp + 0x10]
mov edx, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x413501
lea edi, [esp + 0x114]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x413516
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
lea edx, [esp + 0x118]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x17c]
push edx
call fcn.0044bb80
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
mov al, 1
pop esi
jmp 0x413553
xor al, al
mov ecx, dword [esp + 0x314]
pop ebp
pop ebx
xor ecx, esp
call fcn.0045c20d
add esp, 0x310
ret 4
Function at 0x415a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x471418
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x48ea40]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0xc], ebx
push 9
push ebx
push str._UVNCPFT_
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], ebx
call fcn.00404b30
cmp eax, 0xffffffff
je 0x415ac3
push 9
push eax
lea ecx, [esp + 0x2c]
call fcn.00404c20
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x2c]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00404ea0
cmp dword [esp + 0x3c], 0x10
jb 0x415af3
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0045c39e
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4163f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x2f9], 0
mov byte [esp + 7], 1
je 0x416410
cmp byte [esi + 0x2f8], 0
je 0x416417
call fcn.00415e80
mov al, 1
pop esi
pop ecx
ret 8
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0x2000
jle 0x41642c
pop edi
mov al, 1
pop esi
pop ecx
ret 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
cmp ebp, 2
sete al
test al, al
mov bl, 1
je 0x416472
mov eax, dword [esi + 0x2e0]
push 1
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x416517
mov ecx, esi
mov byte [esi + 0x2f8], bl
call fcn.00415e80
mov al, byte [esp + 0x13]
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 8
mov ecx, dword [esi + 0x2d8]
push edi
push ecx
mov ecx, dword [esi + 0xf0]
call fcn.00449e10
cmp eax, 0xffffffff
sete al
test al, al
mov byte [esp + 0x13], al
je 0x416530
test ebp, ebp
jne 0x41649d
xor bl, bl
test bl, bl
mov dword [esp + 0x18], 0x2000
je 0x4164ef
mov edx, dword [esi + 0x2d8]
mov ecx, dword [esi + 0x2dc]
push edi
push edx
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.004548a0
add esp, 0x10
test eax, eax
je 0x4164e3
mov ecx, esi
mov byte [esi + 0x2f8], 1
call fcn.00415e80
mov al, byte [esp + 0x13]
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 8
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x2dc]
jmp 0x4164f5
mov eax, dword [esi + 0x2d8]
push 0
lea edx, [esi + 0x2f0]
push edx
push edi
push eax
mov eax, dword [esi + 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4164c9
mov edi, dword [esi + 0x2f0]
add dword [esi + 0x2f4], edi
add dword [esi + 0x2ec], 1
mov al, byte [esp + 0x13]
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 8
mov ecx, esi
mov byte [esi + 0x2f8], 1
call fcn.00415e80
jmp 0x416511
Function at 0x41a1e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x471683
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x48ea40]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x41c2d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov eax, ebp
push edi
mov dword [esp + 0x10], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41c2e2
sub eax, edx
mov edi, eax
lea eax, [edi + edi + 1]
push eax
call fcn.0045cd98
mov ebx, eax
add esp, 4
xor esi, esi
xor eax, eax
test edi, edi
jle 0x41c323
cmp byte [eax + ebp], 0xa
jne 0x41c313
mov byte [esi + ebx], 0xd
add esi, 1
mov cl, byte [eax + ebp]
mov byte [esi + ebx], cl
add eax, 1
add esi, 1
cmp eax, edi
jl 0x41c306
mov edx, dword [esp + 0x10]
mov byte [esi + ebx], 0
mov eax, dword [edx + 0xdbb8]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41c382
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x41c382
add esi, 1
push esi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x41c382
push edi
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov cl, byte [esi]
mov byte [eax], cl
add esi, 1
add eax, 1
test cl, cl
jne 0x41c364
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push ebx
call fcn.0045d145
add esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x41d240
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x15c
mov eax, dword [0x48ea40]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
xor ebx, ebx
cmp dword [esp + 0x164], ebx
push esi
mov esi, ecx
je 0x41d357
push 0x104
lea eax, [esp + 0x60]
push eax
push ebx
mov dword [esi + 0xe0f8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x41d2d1
lea ecx, [esp + 0x5c]
push 0x5c
push ecx
call fcn.0045c1e0
add esp, 8
cmp eax, ebx
je 0x41d375
mov byte [eax], bl
lea eax, [esp + 0x5c]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x41d2a2
mov edx, dword [str.16bithlp.exe]
mov ecx, dword [0x4791c8]
mov dword [eax], edx
mov edx, dword [0x4791cc]
mov dword [eax + 4], ecx
mov cx, word [0x4791d0]
mov dword [eax + 8], edx
mov word [eax + 0xc], cx
push 0x44
lea edx, [esp + 0x1c]
push ebx
push edx
call fcn.0045c220
add esp, 0xc
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x7c]
push edx
push ebx
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41d31e
push str.._vncdesktop.cpp_:_set_ddihooks_Failed_n
push ebx
push 0x490660
call fcn.00401810
add esp, 0xc
jmp 0x41d36f
push str.._vncdesktop.cpp_:_set_ddihooks_OK_n
push ebx
push 0x490660
call fcn.00401810
mov eax, dword [esp + 0x14]
add esp, 0xc
push 0x2710
push eax
mov dword [esi + 0xe0d8], 1
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 8]
mov dword [esi + 0xe0f8], ecx
jmp 0x41d375
mov eax, dword [esi + 0xe0f8]
cmp eax, ebx
je 0x41d375
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0xe0f8], ebx
mov dword [esi + 0xe0d8], ebx
mov ecx, dword [esp + 0x160]
pop esi
pop ebx
xor ecx, esp
call fcn.0045c20d
add esp, 0x15c
ret 4
Function at 0x41dde0
Capabilities:
Create thread

Disassembly:
sub esp, 0x34
push ebx
xor ebx, ebx
cmp word [0x490ac8], bx
push esi
mov esi, ecx
jne 0x41de6b
mov eax, dword [0x4a9634]
push ebx
mov dword [esp + 0x10], 0x30
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x41c7b0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], str.WinVNC_desktop_sink
mov dword [esp + 0x3c], ebx
call dword [sym.imp.USER32.dll_RegisterClassExA]
cmp ax, bx
mov word [0x490ac8], ax
jne 0x41de6b
push str.._vncdesktop.cpp_:_failed_to_register_window_class_n
push ebx
push 0x490660
call fcn.00401810
add esp, 0xc
pop esi
xor eax, eax
pop ebx
add esp, 0x34
ret
mov edx, dword [0x4a9634]
push ebx
push edx
push ebx
push ebx
push 0xc8
push 0x190
push closesocket
push closesocket
push 0xcf0000
push 0x478710
push str.WinVNC_desktop_sink
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [esi + 0xdbb8], eax
jne 0x41deb0
push str.._vncdesktop.cpp_:_failed_to_create_hook_window_n
jmp 0x41de55
push esi
push eax
call fcn.0044a270
mov eax, dword [esi + 0xdbb8]
add esp, 8
push eax
call dword [sym.imp.USER32.dll_SetClipboardViewer]
mov ecx, esi
mov dword [esi + 0xdbc0], eax
mov byte [esi + 0xb8], bl
call fcn.0041cf00
test eax, eax
je 0x41deff
mov edx, dword [esi + 0xdbb8]
lea ecx, [esp + 8]
push ecx
push ebx
push edx
push 0x41be40
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop ebx
add esp, 0x34
ret
Function at 0x41e140
Capabilities:
Create thread
Power down monitor

Disassembly:
push ebx
push esi
push str.user32
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x41e171
mov ecx, dword [esi + 0xdbb0]
mov eax, dword [ecx]
mov edx, dword [eax + 0x278]
push 0
call edx
mov ecx, dword [esi + 0xdbb0]
mov eax, dword [ecx]
mov edx, dword [eax + 0x27c]
call edx
test eax, eax
mov ecx, str.true
jne 0x41e18f
mov ecx, str.false
mov bl, byte [esp + 0xc]
test bl, bl
mov eax, 0x4795bc
jne 0x41e1a1
mov eax, 0x4795b8
push ecx
push eax
push str.._vncdesktop.cpp_:_SetBlankMonitor:_monitor__s__using_alpha__s_n
push 9
push 0x490660
call fcn.00401810
mov ecx, dword [esi + 0xdbb0]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1e0]
add esp, 0x14
call edx
test eax, eax
je 0x41e32f
mov ecx, dword [esi + 0xdbb0]
mov eax, dword [ecx]
mov edx, dword [eax + 0x27c]
push edi
call edx
test bl, bl
je 0x41e282
test eax, eax
je 0x41e1f7
mov ecx, esi
call fcn.0041cf00
test eax, eax
je 0x41e256
call fcn.0043c700
cmp eax, 2
je 0x41e256
push 0
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [esi + 0xe0dc]
push eax
push 0
push 0x50
call edi
push 0
push 0
push 0x64
push 0x52
call edi
push 0
push 0
push 1
push 0x56
call edi
mov ecx, dword [esi + 0xdbb8]
push 2
push 0xf170
push 0x112
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
ret 4
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x401dd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov byte [esi + 0xe0e0], 1
pop esi
pop ebx
ret 4
test eax, eax
je 0x41e291
mov ecx, esi
call fcn.0041cf00
test eax, eax
je 0x41e309
call fcn.0043c700
cmp eax, 2
je 0x41e309
mov eax, dword [esi + 0xe0dc]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
je 0x41e2b4
push 0
push 0
push eax
push 0x52
call edi
push 0
push 0
push 0
push 0x56
call edi
mov eax, dword [esi + 0xdbb8]
test eax, eax
je 0x41e2db
push 0xffffffffffffffff
push 0xf170
push 0x112
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push str.blackscreen
mov dword [esi + 0xe0dc], 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x41e32e
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
ret 4
push 0
push str.blackscreen
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x41e327
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [esi + 0xe0e0], 0
pop edi
pop esi
pop ebx
ret 4
Function at 0x423080
Capabilities:
Terminate process

Disassembly:
push ebx
xor edx, edx
xor bl, bl
cmp eax, 8
push ebp
mov ebp, dword [esp + 0xc]
je 0x4230c2
cmp eax, 0x10
jne 0x42309a
movzx eax, word [esi]
pop ebp
pop ebx
ret
cmp eax, 0x20
jne 0x4230a4
mov eax, dword [esi]
pop ebp
pop ebx
ret
push eax
push str.getBgColour:_bpp__d__n
call fcn.0045f2e6
add eax, 0x40
push eax
call fcn.0045f197
add esp, 0xc
push 1
call fcn.0045f10b
push edi
xor eax, eax
mov ecx, pe_nt_image_headers32
mov edi, 0x490af0
rep stosd dword es:[edi], eax
xor ecx, ecx
test ebp, ebp
jle 0x423108
lea edi, [eax + 1]
lea ebx, [ebx]
movzx eax, byte [ecx + esi]
cmp eax, 0x100
jge 0x42310f
add dword [eax*4 + 0x490af0], edi
mov eax, dword [eax*4 + 0x490af0]
cmp eax, edx
jle 0x423102
mov bl, byte [ecx + esi]
mov edx, eax
add ecx, edi
cmp ecx, ebp
jl 0x4230e0
pop edi
pop ebp
movzx eax, bl
pop ebx
ret
push eax
push str.getBgColour
push str._s:_unusual_colour___d_n
call fcn.0045f2e6
add eax, 0x40
push eax
call fcn.0045f197
add esp, 0x10
push edi
call fcn.0045f10b
int3