joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd020
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4bd08b
cmp byte [ebx + 0xd3], 0
jne 0x4bd08b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406a58
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4bd078
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4bd098
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406cb0
jmp 0x4bd098
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406cb0
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4be860
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4be8ce
mov eax, esi
call fcn.0047cbc0
test al, al
je 0x4be8ce
mov eax, dword [ebx + 0x84]
call fcn.0047c814
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4be8ce
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4be8c2
push 0
mov eax, dword [ebx + 0x84]
call fcn.0047c814
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00473790
jmp 0x4be8ce
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004be698
pop esi
pop ebx
ret
Function at 0x4c2fc4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c2ff2
mov eax, ebx
call fcn.004c3a78
cmp dword [ebx + 0x40], 0
je 0x4c2feb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c3063
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c3055
cmp dword [ebx + 8], 0
je 0x4c3014
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c3026
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c3055
cmp dword [ebx + 8], 0
je 0x4c3007
cmp eax, 3
je 0x4c3039
dec eax
jne 0x4c3007
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c3007
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c3007
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c3081
cmp dword [ebx + 0x14], 0xcc
je 0x4c3081
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c308c
pop ebx
ret
Function at 0x1001224e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1001225d
pop dword [ebp - 0x3c]
mov eax, 0x7b298627
sub eax, 0x6b2863ca
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x56dc88c8
sub dword [ebp - 0x4c], 0x88a437d
mov dword [ebp - 0x48], 0x16153fdc
add dword [ebp - 0x48], 0x1c1e0c69
mov dword [ebp - 0x44], 0x5c61f8e4
add dword [ebp - 0x44], 0xefea4b4a
mov dword [ebp - 0x40], 0x1d244bba
add dword [ebp - 0x40], 0xe2dbb446
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x21bd9902
add eax, 0xee43b796
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x8c9c1482
sub dword [ebp - 0x4c], 0x1829ab2c
mov dword [ebp - 0x48], 0xde445e9d
add dword [ebp - 0x48], 0x632802d8
mov dword [ebp - 0x44], 0xdb153c9d
add dword [ebp - 0x44], 0x885a2fcf
mov dword [ebp - 0x40], 0xbf7fb932
sub dword [ebp - 0x40], 0xbf7fb932
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a5d2
push 0
call eax
mov ecx, 0x5e22cc2
sub ecx, 0x5e1dd9c
mov ebx, eax
mov esi, 0x10041c00
add esi, dword [ebp - 0x3c]
mov edx, 0x75e8be95
sub edx, 0xd418a1fa
add dword [ebp - 8], edi
mov edi, dword [esi]
xor dword [ebp - 0x10], 0x9e4b04f8
sub edi, edx
xor dword [ebp - 0x30], 0x9670fe09
mov dword [ebx], edi
add dword [ebp - 4], edi
add ebx, 4
add esi, 4
loop 0x10012374
add eax, 0x12f6b
mov ebx, eax
add eax, 0xafba4e0b
add eax, 0x5045b1fa
mov ecx, 0x3a09e7bb
sub ecx, 0x2a09e7bb
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x406ae0
Capabilities:
Get file size

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov ecx, dword [0x4c2010]
xor ecx, esp
mov dword [esp + 0x10], ecx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x406bb7
mov edi, eax
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x2c]
push 0
push 4
push 1
call fcn.004143e0
add esp, 0xc
mov esi, eax
mov dword [eax], edi
test ebx, ebx
je 0x406b4b
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 8]
mov dword [ebx + 4], ecx
mov dword [ebx], eax
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
or eax, ebp
je 0x406bab
mov eax, esp
lea ecx, [esp + 8]
push eax
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test ebp, ebp
je 0x406b88
push 0
push 0x989680
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.0046ea90
add eax, 0x49ef6f00
mov dword [ebp], eax
mov edi, dword [esp + 0x30]
test edi, edi
je 0x406bab
push 0
push 0x989680
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0046ea90
add eax, 0x49ef6f00
mov dword [edi], eax
test ebx, ebx
je 0x406bb9
mov dword [ebx], 0xffffffff
jmp 0x406bb9
xor esi, esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0046ea50
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp

Function at 0x406bd0
Capabilities:
Read file on windows

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov esi, dword [0x4c2010]
xor esi, esp
mov dword [esp + 4], esi
mov esi, esp
push 0
push esi
push edx
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
sbb esi, esi
or esi, dword [esp]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046ea50
mov eax, esi
add esp, 8
pop esi

Function at 0x406c80
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov esi, dword [0x4c2010]
xor esi, esp
mov dword [esp + 4], esi
mov esi, esp
push 0
push esi
push edx
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [esp]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046ea50
mov eax, esi
add esp, 8
pop esi
ret

Function at 0x406d50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
and ecx, 0x10
cmp ecx, 1
mov edx, 2
sbb edx, 0
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, edx
mov eax, ecx
ret
Function at 0x406f20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push esi
sub esp, 0x144
mov edi, dword [esp + 0x150]
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x140], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, 1
cmp eax, 0xffffffff
jne 0x406f6d
mov eax, esp
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x406f6b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 2
jmp 0x406f6d
xor esi, esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0046ea50
mov eax, esi
add esp, 0x144
pop esi
pop edi
ret

Function at 0x4072b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x114
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x110], eax
cmp dword [0x4c2d28], 0
je 0x407317
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0
lea eax, [esp + 0xc]
push eax
push 0x407270
push 0x407290
call fcn.00417240
add esp, 0xc
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0046ea50
mov eax, esi
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.00417630
mov esi, 0xffffffff
cmp eax, 0xffffffff
je 0x4072fc
mov edi, eax
push eax
call fcn.00411f40
add esp, 4
test al, al
je 0x407348
push 2
push edi
call fcn.004118c0
add esp, 8
lea ebp, [esp + 8]
lea esi, [esp + 0xc]
push ebp
push ebx
call fcn.00417860
add esp, 8
mov ecx, 0
test al, al
je 0x4073a9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 8]
mov edx, ecx
sub ecx, eax
sub eax, ebx
sub edx, ebx
cmp eax, edx
mov eax, 0
cmova ecx, eax
mov eax, ecx
mov edx, 0x10624dd3
imul edx
mov eax, edx
shr eax, 0x1f
sar edx, 6
add edx, eax
mov dword [esp], edx
imul eax, edx, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [esp + 4], eax
mov ecx, esp
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 1
push ecx
push 0
push 0
push esi
push 1
call dword [0x4c2d2c]
test eax, eax
js 0x4073cf
jne 0x4073d9
mov ebx, dword [esp + 8]
jmp 0x407350
mov esi, 0xffffffff
jmp 0x4072fc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 1
push edi
call fcn.004118c0
add esp, 8
xor esi, esi
jmp 0x4072fc
Function at 0x415440
Capabilities:
Get session user name

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 4], eax
cmp byte [0x4c3404], 0
je 0x415468
mov ecx, dword [0x4c3400]
test ecx, ecx
jne 0x4154ab
jmp 0x4154f8
push str.secur32.dll
call fcn.004327c0
add esp, 4
mov esi, eax
push str.sspicli.dll
call fcn.004327c0
add esp, 4
test esi, esi
je 0x415498
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x41549a
xor ecx, ecx
mov dword [0x4c3400], ecx
mov byte [0x4c3404], 1
test ecx, ecx
je 0x4154f8
mov dword [esp], 0
mov edi, esp
push edi
push 0
push 8
call ecx
push 0
push 1
push dword [esp + 8]
call fcn.004143e0
add esp, 0xc
mov esi, eax
push edi
push eax
push 8
call dword [0x4c3400]
test al, al
je 0x4154ef
push 0x40
push esi
call fcn.004718e0
add esp, 8
test eax, eax
je 0x415545
mov byte [eax], 0
jmp 0x415545
push esi
call fcn.00414470
add esp, 4
mov dword [esp], 0
mov edi, esp
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x415513
mov eax, dword [esp]
jmp 0x41551f
mov dword [esp], 0x100
mov eax, 0x100
push 0
push 1
push eax
call fcn.004143e0
add esp, 0xc
mov esi, eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x415545
push esi
call fcn.00414470
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046ea50
mov eax, esi
add esp, 8
pop esi
pop edi
ret
Function at 0x417860
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push edi
push esi
cmp dword [0x4c3420], 0
jne 0x41789b
push 0x4179b0
call fcn.004158c0
add esp, 4
mov dword [0x4c3420], eax
push 0x417a10
call fcn.004158c0
add esp, 4
mov dword [0x4c3424], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c341c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c341c], eax
push 0
push dword [0x4c3420]
call fcn.00416050
add esp, 8
test eax, eax
je 0x417949
mov esi, eax
mov edi, dword [esp + 0x14]
jmp 0x4178ff
push 0
push dword [0x4c3420]
call fcn.00416660
add esp, 8
push esi
call fcn.00414470
add esp, 4
push 0
push dword [0x4c3420]
call fcn.00416050
add esp, 8
mov esi, eax
test eax, eax
je 0x417949
push 0
push dword [esi + 4]
push dword [0x4c3424]
call fcn.00416620
add esp, 0xc
test eax, eax
je 0x4178d0
mov ecx, dword [0x4c341c]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
add edx, 0xfffffff6
sub ecx, edx
mov ebx, eax
sub ebx, edx
cmp ecx, ebx
jbe 0x41794d
push 0
push dword [0x4c3420]
call fcn.00416660
add esp, 8
push dword [esi + 8]
push dword [esi + 4]
call dword [esi]
jmp 0x4178dd
xor eax, eax
jmp 0x417951
mov dword [edi], eax
mov al, 1
pop esi
pop edi
pop ebx
ret

Function at 0x417b00
Capabilities:
Link many functions at runtime

Disassembly:
cmp byte [0x4c3428], 1
jne 0x417b0f
mov al, byte [0x4c3429]
ret
mov byte [0x4c3428], 1
push str.advapi32.dll
call fcn.004327c0
add esp, 4
mov dword [0x4c342c], eax
test eax, eax
je 0x417c57
push str.GetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c3430], eax
test eax, eax
je 0x417c57
mov eax, dword [0x4c342c]
test eax, eax
je 0x417c1d
push str.SetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c3434], eax
test eax, eax
je 0x417c57
mov eax, dword [0x4c342c]
test eax, eax
je 0x417c29
push str.OpenProcessToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c3438], eax
test eax, eax
je 0x417c57
mov eax, dword [0x4c342c]
test eax, eax
je 0x417c35
push str.GetTokenInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c343c], eax
test eax, eax
je 0x417c57
mov eax, dword [0x4c342c]
test eax, eax
je 0x417c41
push 0x4a8d09
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c3440], eax
test eax, eax
je 0x417c57
mov eax, dword [0x4c342c]
test eax, eax
je 0x417c4d
push 0x4a8fdb
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x4c3444], eax
xor eax, eax
test ecx, ecx
je 0x417c59
mov ecx, dword [0x4c342c]
test ecx, ecx
je 0x417c11
push str.SetEntriesInAclA
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c3448], eax
test eax, eax
setne al
jmp 0x417c59
mov dword [0x4c3434], 0
jmp 0x417c57
mov dword [0x4c3438], 0
jmp 0x417c57
mov dword [0x4c343c], 0
jmp 0x417c57
mov dword [0x4c3440], 0
jmp 0x417c57
mov dword [0x4c3444], 0
xor eax, eax
mov byte [0x4c3429], al
ret
Function at 0x418ae0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x408
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x404], eax
mov ecx, 1
call fcn.00418b90
cmp eax, 0xffffffff
je 0x418b69
mov esi, eax
mov eax, esp
lea ebx, [esp + 4]
push 0
push eax
push 0x400
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418b62
mov eax, dword [esp]
test eax, eax
je 0x418b62
mov ebp, dword [esp + 0x41c]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
push ebx
call ebp
add esp, 8
push 0
lea eax, [esp + 4]
push eax
push 0x400
push ebx
push esi
call edi
test eax, eax
je 0x418b62
mov eax, dword [esp]
test eax, eax
jne 0x418b40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0046ea50
add esp, 0x408
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418b90
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, ecx
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x210], eax
push 0
push str.SoftwareSimonTathamPuTTY
push 0x80000001
push 0
push 0
call fcn.00432d70
add esp, 0x14
test eax, eax
je 0x418c07
mov ebx, eax
push str.RandSeedFile
push eax
call fcn.00432f50
add esp, 8
mov edi, eax
push ebx
call fcn.00432e40
add esp, 4
test edi, edi
je 0x418c07
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00418e40
add esp, 4
mov ebx, eax
push edi
call fcn.00414470
add esp, 4
test bl, bl
jne 0x418dbd
cmp byte [0x4c3464], 0
je 0x418c1f
mov ecx, dword [0x4c346c]
test ecx, ecx
jne 0x418c5c
jmp 0x418ced
push str.shell32.dll
call fcn.004327c0
add esp, 4
mov dword [0x4c3468], eax
test eax, eax
je 0x418c45
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x418c47
xor ecx, ecx
mov dword [0x4c346c], ecx
mov byte [0x4c3464], 1
test ecx, ecx
je 0x418ced
lea ebp, [esp + 0x10b]
push ebp
push 0
push 0
push 0x1c
push 0
call ecx
test eax, eax
js 0x418ca6
push 0
push str.PUTTY.RND
push ebp
call fcn.00413890
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00418e40
add esp, 4
mov ebx, eax
push edi
call fcn.00414470
add esp, 4
test bl, bl
jne 0x418dbd
push ebp
push 0
push 0
push 0x1a
push 0
call dword [0x4c346c]
test eax, eax
js 0x418ced
push 0
push str.PUTTY.RND
push ebp
call fcn.00413890
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00418e40
add esp, 4
mov ebx, eax
push edi
call fcn.00414470
add esp, 4
test bl, bl
jne 0x418dbd
lea eax, [esp + 0x10b]
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
push eax
push str.HOMEDRIVE
call ebp
mov edi, eax
lea ebx, [esp + 7]
push 0x104
push ebx
push str.HOMEPATH
call ebp
test edi, edi
jne 0x418d26
mov byte [esp + 0x10b], 0
cmp edi, 0x103
ja 0x418d73
cmp eax, 0x103
ja 0x418d73
test eax, eax
je 0x418d73
push 0
push str.PUTTY.RND
push ebx
lea ebp, [esp + 0x117]
push ebp
call fcn.00413890
add esp, 0x10
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00418e40
add esp, 4
mov ebx, eax
push edi
call fcn.00414470
add esp, 4
test bl, bl
jne 0x418dbd
jmp 0x418d7a
lea ebp, [esp + 0x10b]
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 0x104
jae 0x418dc2
push 0
push str.PUTTY.RND
push ebp
call fcn.00413890
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00418e40
add esp, 4
mov ebx, eax
push edi
call fcn.00414470
add esp, 4
test bl, bl
je 0x418dc2
mov esi, dword [esp]
jmp 0x418dc7
mov esi, 0xffffffff
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0046ea50
mov eax, esi
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418df0
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 8
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 4], eax
mov ecx, 2
call fcn.00418b90
cmp eax, 0xffffffff
je 0x418e2b
mov esi, eax
mov eax, esp
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046ea50
add esp, 8
pop esi
ret

Function at 0x418e40
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [esp + 0x10]
test edx, edx
je 0x418e8b
xor ecx, ecx
xor eax, eax
cmp edx, 2
setne cl
sete al
lea ecx, [ecx + ecx*2]
mov ebx, 0x40000000
mov edx, 0x80000000
cmove edx, ebx
mov ebx, eax
shl ebx, 7
xor eax, 3
push 0
push ebx
push eax
push 0
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi], eax
cmp eax, 0xffffffff
setne al
jmp 0x418ec7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418ebf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x418ebf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00417110
add esp, 4
push eax
push esi
push str.Unable_to_delete__s:__s
call fcn.004076a0
add esp, 0xc
mov dword [edi], 0xffffffff
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x431c00
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x270
mov edi, dword [esp + 0x284]
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x26c], eax
lea esi, [esp + 0x25]
push 0x107
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.00482c50
add esp, 4
mov word [esp + eax + 0x25], 0x2a5c
mov byte [esp + eax + 0x27], 0
lea ebx, [esp + 0x12c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x431c7a
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x140
push ebx
call edi
add esp, 8
push ebx
push esi
call ebp
test eax, eax
jne 0x431c60
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], eax
mov eax, esp
push 4
push eax
call edi
add esp, 8
lea esi, [esp + 5]
push 0x20
push esi
call fcn.00431af0
add esp, 8
test al, al
je 0x431cb3
push 0x20
push esi
call edi
add esp, 8
push 0x20
push esi
call fcn.00432100
add esp, 8
push edi
call fcn.00418ae0
add esp, 4
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.0046ea50
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x431ce0
Capabilities:
Get memory capacity

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x2c], eax
lea esi, [esp + 0x2c]
push 4
push esi
push 9
call fcn.00409d70
add esp, 0xc
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [esp + 0x2c], eax
push 4
push esi
push 0xa
call fcn.00409d70
add esp, 0xc
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov dword [esp + 0x2c], eax
push 4
push esi
push 0xb
call fcn.00409d70
add esp, 0xc
push 0x1cbf
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push 4
push eax
push 0xc
call fcn.00409d70
add esp, 0xc
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
push esi
push 0xd
call fcn.00409d70
add esp, 0xc
mov esi, esp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x20
push esi
push 6
call fcn.00409d70
add esp, 0xc
lea ebp, [esp + 0x48]
lea ebx, [esp + 0x40]
lea edi, [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea esi, [esp + 0x30]
push ebp
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0x20
push esi
push 0xe
call fcn.00409d70
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebp
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0x20
push esi
push 0xf
call fcn.00409d70
add esp, 0xc
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0046ea50
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret