joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43eaa0
Capabilities:
Find taskbar

Disassembly:
push ecx
push esi
mov esi, eax
push edi
lea edi, [esi + 0xf00]
push edi
push str.._vncmenu.cpp_:__vncMenu::AddTrayIcon___UserName___s_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 8
mov ecx, 0x4a3fbe
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43eae7
test dl, dl
je 0x43eae3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43eae7
add eax, 2
add ecx, 2
test dl, dl
jne 0x43eac7
xor eax, eax
jmp 0x43eaec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43ec15
mov ecx, str.SYSTEM
mov eax, edi
jmp 0x43eb00
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43eb20
test dl, dl
je 0x43eb1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43eb20
add eax, 2
add ecx, 2
test dl, dl
jne 0x43eb00
xor eax, eax
jmp 0x43eb25
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43ec15
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
xor ecx, ecx
test eax, eax
jne 0x43eb70
mov byte [esi + 0x1024], al
mov eax, dword [esi + 0x1028]
push eax
push str.._vncmenu.cpp_:__vncMenu::AddTrayIcon___User_exists__traywnd_is_not_found_reset_when_counter_reach__i20_n
mov eax, 0x4bc990
call fcn.00401110
inc dword [esi + 0x1028]
mov esi, dword [esi]
add esp, 8
call fcn.00450590
pop edi
pop esi
pop ecx
ret
push str.._vncmenu.cpp_:__vncMenu::AddTrayIcon___ADD_Tray_Icon_call_n
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
cmp dword [esi + 0x103c], 2
jne 0x43ebb7
cmp dword [esi + 0x1034], 0
jne 0x43ebb7
cmp dword [esi + 0x1030], 5
jne 0x43ebb7
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 0x164]
call eax
test eax, eax
jne 0x43ebde
movzx ecx, byte [esi + 0x1024]
push ecx
jmp 0x43ebbf
movzx edx, byte [esi + 0x1024]
push edx
push str.._vncmenu.cpp_:__Shell_TrayWnd_found__i_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 8
push 0
push 0
mov ecx, esi
call fcn.0043ee10
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
test eax, eax
je 0x43ec15
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1dc]
call edx
test eax, eax
je 0x43ec00
call fcn.0043e400
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1e4]
call edx
test eax, eax
je 0x43ec15
call fcn.0043e300
pop edi
pop esi
pop ecx
ret
Function at 0x43ec20
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x110
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x10c], eax
cmp byte [0x4f375f], 0
push edi
mov edi, ecx
je 0x43ec67
mov eax, 0x4ede88
sub edi, eax
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x43ec47
pop edi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x110
ret
push 0x100
lea eax, [esp + 0x14]
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
je 0x43eca6
mov ecx, dword [esp + 0x118]
push ecx
push str.Host_name_unavailable
push edi
call fcn.0047ce10
add esp, 0xc
pop edi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x110
ret
push ebp
lea edx, [esp + 0x14]
push edx
call sub.WSOCK32.dll_gethostbyname
mov ebp, eax
test ebp, ebp
jne 0x43ecca
mov eax, dword [esp + 0x11c]
push eax
push str.IP_address_unavailable
push edi
jmp 0x43ede3
mov byte [edi], 0
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
mov dword [esp + 8], 0
je 0x43eda1
push ebx
push esi
xor ebx, ebx
xor edx, edx
xor esi, esi
cmp dx, word [ebp + 0xa]
jge 0x43ed3d
nop
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + ebx]
movzx edx, byte [ecx + esi]
push edx
lea eax, [esp + 0x18]
push 0x4ab604
push eax
call fcn.0047c59e
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43ed12
mov ecx, dword [esp + 0x124]
sub eax, edx
sub ecx, eax
dec ecx
push ecx
lea edx, [esp + 0x18]
push edx
push edi
call fcn.0047de20
movsx eax, word [ebp + 0xa]
inc esi
add esp, 0xc
cmp esi, eax
jl 0x43ecf0
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43ed42
sub eax, edx
mov byte [edi + eax - 1], cl
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + ebx + 4], 0
je 0x43ed82
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43ed60
sub eax, edx
mov edx, dword [esp + 0x124]
sub edx, eax
dec edx
push edx
push 0x4ab608
push edi
call fcn.0047de20
add esp, 0xc
mov eax, dword [esp + 0x10]
inc eax
lea ebx, [eax*4]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
cmp dword [ebx + eax], 0
jne 0x43ece5
pop esi
pop ebx
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43eda6
sub eax, edx
cmp eax, 0x200
jae 0x43edeb
mov eax, edi
lea edx, [eax + 1]
jmp 0x43edc0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43edc0
sub eax, edx
mov byte [0x4f375f], al
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43edd3
sub eax, edx
push eax
push edi
push 0x4ede88
call fcn.0047ce10
add esp, 0xc
mov ecx, dword [esp + 0x114]
pop ebp
pop edi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x110
ret
Function at 0x440e00
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x108], eax
lea eax, [esp + 4]
push eax
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x440e8e
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [esp + 4]
push edx
push 0x4f3780
push 0
push 0x20019
push 0
push 0
push 0
push str.SoftwareUltraVnc
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
jne 0x440e8d
mov ecx, dword [0x4f3780]
lea eax, [esp + 4]
push eax
push 0x4f3784
push 0
push 0x2001f
push 0
push 0
push 0
push str.mslogon
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x10c
ret

Function at 0x440eb0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
lea eax, [esp]
push eax
call fcn.00407a90
lea ecx, [esp]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x440f14
mov eax, dword [0x4f3784]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x440efb
push eax
call esi
mov eax, dword [0x4f3788]
test eax, eax
je 0x440f07
push eax
call esi
mov eax, dword [0x4f3780]
test eax, eax
je 0x440f13
push eax
call esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret

Function at 0x440f30
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x114
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
mov ebp, dword [esp + 0x120]
push edi
mov edi, dword [0x4f3784]
lea eax, [esp + 0x18]
push eax
call fcn.00407a90
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x18]
push ecx
push 0
push str.UseRegistry
push str.admin
call ebx
cmp eax, 1
jne 0x440fe8
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
mov ebx, 4
push edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x440fc0
pop edi
mov eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x114
ret
cmp dword [esp + 0x10], ebx
jne 0x440fa6
cmp dword [esp + 0xc], ebx
jne 0x440fa6
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x114
ret
lea edx, [esp + 0x18]
push edx
push ebp
push esi
push str.admin_auth
call ebx
mov ecx, dword [esp + 0x11c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047c3ff
add esp, 0x114
ret
Function at 0x441010
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x110
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x10c], eax
push edi
mov edi, dword [0x4f3784]
lea eax, [esp + 0xc]
push eax
call fcn.00407a90
lea ecx, [esp + 0xc]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4410f3
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov ebx, 0x100
push edi
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x4410bf
cmp dword [esp + 0xc], 3
jne 0x4410bf
push ebx
mov dword [esp + 0x14], ebx
call fcn.0047c463
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4410bf
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x14]
push edx
push 0
push esi
push edi
call ebp
test eax, eax
jne 0x4410b6
cmp dword [esp + 0xc], 3
je 0x4410d9
push ebx
call fcn.0047c43d
add esp, 4
pop ebp
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x110
ret
pop ebp
mov eax, ebx
pop ebx
pop edi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x110
ret
push 0x96
call fcn.0047c463
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push eax
push 0x96
push edi
push 0x4a3fbe
push esi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x110]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x110
ret

Function at 0x441140
Capabilities:
Read .ini file
Set registry value

Disassembly:
sub esp, 0x128
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x124], eax
push edi
mov edi, dword [0x4f3784]
lea eax, [esp + 4]
push eax
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4411ad
push 4
lea edx, [esp + 0x134]
push edx
push 4
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x128
ret
mov eax, dword [esp + 0x130]
push eax
lea ecx, [esp + 0x10c]
push 0x4a99bc
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10c]
push eax
push esi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x128]
pop edi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x128
ret
Function at 0x441200
Capabilities:
Read .ini file
Set registry value

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [0x4f3784]
lea eax, [esp + 4]
push eax
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x441269
push 0xfe
push edi
push 3
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
lea edx, [esp + 4]
push edx
push edi
push esi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x108]
pop ebx
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret

Function at 0x4412a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, ecx
call fcn.00407a90
lea ecx, [esp + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x441312
call fcn.00440e00
cmp dword [0x4f3784], 0
je 0x4412f6
mov esi, str.group1
call fcn.00441200
call fcn.00440eb0
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
mov esi, str.group1
call fcn.00441200
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret

Function at 0x441340
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4413b3
xor esi, esi
call fcn.00440e00
cmp dword [0x4f3784], esi
je 0x441396
mov esi, str.group1
call fcn.00441010
mov esi, eax
call fcn.00440eb0
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
mov esi, str.group1
call fcn.00441010
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret

Function at 0x4413e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, ecx
call fcn.00407a90
lea ecx, [esp + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x441452
call fcn.00440e00
cmp dword [0x4f3784], 0
je 0x441436
mov esi, str.group2
call fcn.00441200
call fcn.00440eb0
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
mov esi, str.group2
call fcn.00441200
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
Function at 0x441480
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4414f3
xor esi, esi
call fcn.00440e00
cmp dword [0x4f3784], esi
je 0x4414d6
mov esi, str.group2
call fcn.00441010
mov esi, eax
call fcn.00440eb0
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
mov esi, str.group2
call fcn.00441010
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret

Function at 0x441520
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, ecx
call fcn.00407a90
lea ecx, [esp + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x441592
call fcn.00440e00
cmp dword [0x4f3784], 0
je 0x441576
mov esi, str.group3
call fcn.00441200
call fcn.00440eb0
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
mov esi, str.group3
call fcn.00441200
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret

Function at 0x4415c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x441633
xor esi, esi
call fcn.00440e00
cmp dword [0x4f3784], esi
je 0x441616
mov esi, str.group3
call fcn.00441010
mov esi, eax
call fcn.00440eb0
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
mov esi, str.group3
call fcn.00441010
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret

Function at 0x441660
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, 1
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, esi
jne 0x4416da
call fcn.00440e00
cmp dword [0x4f3784], 0
je 0x4416bd
push esi
mov esi, str.locdom1
call fcn.00440f30
add esp, 4
mov esi, eax
call fcn.00440eb0
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
push 1
mov esi, str.locdom1
call fcn.00440f30
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
Function at 0x441700
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x441774
call fcn.00440e00
cmp dword [0x4f3784], 0
je 0x441759
push esi
mov esi, str.locdom1
call fcn.00441140
add esp, 4
call fcn.00440eb0
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
push esi
mov esi, str.locdom1
call fcn.00441140
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret

Function at 0x4417a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push esi
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x441816
call fcn.00440e00
cmp dword [0x4f3784], esi
je 0x4417f9
push esi
mov esi, str.locdom2
call fcn.00440f30
add esp, 4
mov esi, eax
call fcn.00440eb0
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
push 0
mov esi, str.locdom2
call fcn.00440f30
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret

Function at 0x441840
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4418b4
call fcn.00440e00
cmp dword [0x4f3784], 0
je 0x441899
push esi
mov esi, str.locdom2
call fcn.00441140
add esp, 4
call fcn.00440eb0
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
push esi
mov esi, str.locdom2
call fcn.00441140
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret

Function at 0x4418e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push esi
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x441956
call fcn.00440e00
cmp dword [0x4f3784], esi
je 0x441939
push esi
mov esi, str.locdom3
call fcn.00440f30
add esp, 4
mov esi, eax
call fcn.00440eb0
mov eax, esi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
push 0
mov esi, str.locdom3
call fcn.00440f30
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
Function at 0x441980
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call fcn.00407a90
lea ecx, [esp + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4419f4
call fcn.00440e00
cmp dword [0x4f3784], 0
je 0x4419d9
push esi
mov esi, str.locdom3
call fcn.00441140
add esp, 4
call fcn.00440eb0
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
push esi
mov esi, str.locdom3
call fcn.00441140
mov ecx, dword [esp + 0x10c]
add esp, 4
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x108
ret
Function at 0x4430b0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x118
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
lea eax, [esp + 0x18]
mov edi, 4
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
call fcn.00407a90
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x18]
push ecx
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x443199
lea edx, [esp + 8]
push edx
push eax
push 0
push str.SoftwareORLWinVNC3
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44313c
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x118
ret
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.NewMSLogon
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x443123
cmp dword [esp + 0x10], edi
jne 0x443123
cmp dword [esp + 0xc], edi
jne 0x443123
mov eax, dword [esp + 8]
mov esi, dword [esp + 0x14]
test eax, eax
je 0x443180
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x118
ret
lea ecx, [esp + 0x18]
push ecx
push 0
push str.NewMSLogon
push str.admin
call esi
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x118
ret

Function at 0x4431d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
sub eax, 1
je 0x443278
sub eax, 1
jne 0x443289
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x443230
mov dword [0x4bb5d4], 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x98
ret
cmp eax, 6
jne 0x443254
mov dword [0x4bb5d4], 2
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x98
ret
cmp eax, 4
ja 0x443289
mov dword [0x4bb5d4], 3
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x98
ret
mov ecx, dword [esp + 8]
neg ecx
sbb ecx, ecx
add ecx, 5
mov dword [0x4bb5d4], ecx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x98
ret