joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424770
Capabilities:
Hide graphical window

Disassembly:
push ebx
push edi
push esi
sub esp, 0x174
mov eax, dword [0x500034]
xor eax, esp
mov dword [esp + 0x170], eax
cmp byte [0x502b00], 0
je 0x424931
mov ebx, dword [esp + 0x18c]
mov esi, dword [esp + 0x188]
cmp dword [0x502b04], 0
jne 0x424876
cmp word [0x502b08], 0
jne 0x42481b
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0x424950
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov eax, dword [0x500be8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], str.SizeTipClass
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov word [0x502b08], ax
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0x18
call edi
mov dword [0x502b0c], eax
push 0x17
call edi
mov dword [0x502b10], eax
lea eax, [esp + 0x1c]
push 0x154
push 0
push eax
call fcn.004a10a0
add esp, 0xc
mov dword [esp + 0x18], 0x158
lea eax, [esp + 0x18]
push 0
push eax
push 0x158
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [0x502b14], eax
lea edi, [esp + 0x18]
push ebx
push esi
push str._dx_d
push edi
call fcn.00401000
add esp, 0x10
mov eax, dword [0x502b04]
test eax, eax
je 0x4248a0
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x424931
mov ebx, dword [esp + 0x184]
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push edi
call fcn.004b19c0
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push eax
push edi
push esi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, esp
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
cmp eax, 0x11
mov edx, 0x10
cmovl eax, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
cmp ecx, 0x11
cmovl ecx, edx
movzx edx, word [0x502b08]
push 0
push dword [0x500be8]
push 0
push 0
push esi
push dword [esp + 0x24]
push ecx
push eax
push 0x80000000
push edi
push edx
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x502b04], eax
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.0049e340
add esp, 0x174
pop esi
pop edi
pop ebx
ret
Function at 0x425bc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push edi
push esi
cmp dword [0x502b44], 0
jne 0x425bfb
push 0x425d10
call fcn.0043a460
add esp, 4
mov dword [0x502b44], eax
push 0x425d70
call fcn.0043a460
add esp, 4
mov dword [0x502b48], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x502b40], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x502b40], eax
push 0
push dword [0x502b44]
call fcn.0043ac20
add esp, 8
test eax, eax
je 0x425ca9
mov esi, eax
mov edi, dword [esp + 0x14]
jmp 0x425c5f
push 0
push dword [0x502b44]
call fcn.0043b230
add esp, 8
push esi
call fcn.00439350
add esp, 4
push 0
push dword [0x502b44]
call fcn.0043ac20
add esp, 8
mov esi, eax
test eax, eax
je 0x425ca9
push 0
push dword [esi + 4]
push dword [0x502b48]
call fcn.0043b1f0
add esp, 0xc
test eax, eax
je 0x425c30
mov ecx, dword [0x502b40]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
add edx, 0xfffffff6
sub ecx, edx
mov ebx, eax
sub ebx, edx
cmp ecx, ebx
jbe 0x425cad
push 0
push dword [0x502b44]
call fcn.0043b230
add esp, 8
push dword [esi + 8]
push dword [esi + 4]
call dword [esi]
jmp 0x425c3d
xor eax, eax
jmp 0x425cb1
mov dword [edi], eax
mov al, 1
pop esi
pop edi
pop ebx
ret
Function at 0x4345e0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x408
mov eax, dword [0x500034]
xor eax, esp
mov dword [esp + 0x404], eax
mov ecx, 1
call fcn.00434690
cmp eax, 0xffffffff
je 0x434669
mov esi, eax
mov eax, esp
lea ebx, [esp + 4]
push 0
push eax
push 0x400
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x434662
mov eax, dword [esp]
test eax, eax
je 0x434662
mov ebp, dword [esp + 0x41c]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
push ebx
call ebp
add esp, 8
push 0
lea eax, [esp + 4]
push eax
push 0x400
push ebx
push esi
call edi
test eax, eax
je 0x434662
mov eax, dword [esp]
test eax, eax
jne 0x434640
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0049e340
add esp, 0x408
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434690
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, ecx
mov eax, dword [0x500034]
xor eax, esp
mov dword [esp + 0x210], eax
push 0
push str.SoftwareSimonTathamPuTTY
push 0x80000001
push 0
call fcn.0043bc00
add esp, 0x10
test eax, eax
je 0x434705
mov ebx, eax
push str.RandSeedFile
push eax
call fcn.0043be40
add esp, 8
mov edi, eax
push ebx
call fcn.0043bce0
add esp, 4
test edi, edi
je 0x434705
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00434d10
add esp, 4
mov ebx, eax
push edi
call fcn.00439350
add esp, 4
test bl, bl
jne 0x4348bb
cmp byte [0x502bb0], 0
je 0x43471d
mov ecx, dword [0x502bb8]
test ecx, ecx
jne 0x43475a
jmp 0x4347eb
push str.shell32.dll
call fcn.0043baa0
add esp, 4
mov dword [0x502bb4], eax
test eax, eax
je 0x434743
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x434745
xor ecx, ecx
mov dword [0x502bb8], ecx
mov byte [0x502bb0], 1
test ecx, ecx
je 0x4347eb
lea ebp, [esp + 0x10b]
push ebp
push 0
push 0
push 0x1c
push 0
call ecx
test eax, eax
js 0x4347a4
push 0
push str.PUTTY.RND
push ebp
call fcn.00438670
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00434d10
add esp, 4
mov ebx, eax
push edi
call fcn.00439350
add esp, 4
test bl, bl
jne 0x4348bb
push ebp
push 0
push 0
push 0x1a
push 0
call dword [0x502bb8]
test eax, eax
js 0x4347eb
push 0
push str.PUTTY.RND
push ebp
call fcn.00438670
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00434d10
add esp, 4
mov ebx, eax
push edi
call fcn.00439350
add esp, 4
test bl, bl
jne 0x4348bb
lea eax, [esp + 0x10b]
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
push eax
push str.HOMEDRIVE
call ebp
mov edi, eax
lea ebx, [esp + 7]
push 0x104
push ebx
push str.HOMEPATH
call ebp
test edi, edi
jne 0x434824
mov byte [esp + 0x10b], 0
cmp edi, 0x103
ja 0x434871
cmp eax, 0x103
ja 0x434871
test eax, eax
je 0x434871
push 0
push str.PUTTY.RND
push ebx
lea ebp, [esp + 0x117]
push ebp
call fcn.00438670
add esp, 0x10
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00434d10
add esp, 4
mov ebx, eax
push edi
call fcn.00439350
add esp, 4
test bl, bl
jne 0x4348bb
jmp 0x434878
lea ebp, [esp + 0x10b]
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 0x104
jae 0x4348c0
push 0
push str.PUTTY.RND
push ebp
call fcn.00438670
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00434d10
add esp, 4
mov ebx, eax
push edi
call fcn.00439350
add esp, 4
test bl, bl
je 0x4348c0
mov esi, dword [esp]
jmp 0x4348c5
mov esi, 0xffffffff
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0049e340
mov eax, esi
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4348e0
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 8
mov eax, dword [0x500034]
xor eax, esp
mov dword [esp + 4], eax
mov ecx, 2
call fcn.00434690
cmp eax, 0xffffffff
je 0x43491b
mov esi, eax
mov eax, esp
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0049e340
add esp, 8
pop esi
ret

Function at 0x434d10
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [esp + 0x10]
test edx, edx
je 0x434d5b
xor ecx, ecx
xor eax, eax
cmp edx, 2
setne cl
sete al
lea ecx, [ecx + ecx*2]
mov ebx, 0x40000000
mov edx, 0x80000000
cmove edx, ebx
mov ebx, eax
shl ebx, 7
xor eax, 3
push 0
push ebx
push eax
push 0
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi], eax
cmp eax, 0xffffffff
setne al
jmp 0x434d97
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x434d8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x434d8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043cee0
add esp, 4
push eax
push esi
push str.Unable_to_delete__s:__s
call fcn.00406290
add esp, 0xc
mov dword [edi], 0xffffffff
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x43bd00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x500034]
xor eax, esp
mov dword [esp + 4], eax
mov dword [esp], 0x105
mov ebx, 0x105
push 0
push 1
push 0x105
call fcn.004392c0
add esp, 0xc
mov esi, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, esp
nop
nop
nop
nop
nop
nop
nop
push ebx
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
call ebp
cmp eax, 0xea
jne 0x43bd6e
push 0
push 1
push dword [esp + 8]
push 1
push edi
push esi
call fcn.00439360
add esp, 0x18
mov esi, eax
mov ebx, dword [esp]
jmp 0x43bd40
test eax, eax
je 0x43bd7d
push esi
call fcn.00439350
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0049e340
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43bda0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, dword [0x500034]
xor esi, esp
mov dword [esp + 8], esi
mov dword [esp], 4
mov esi, esp
lea edi, [esp + 4]
push esi
push edx
push edi
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
xor ecx, 4
or ecx, eax
mov eax, dword [esp + 4]
xor eax, 4
or eax, ecx
sete bl
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0049e340
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
ret

Function at 0x43be00
Capabilities:
Set registry value

Disassembly:
push ebx
push eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [0x500034]
xor edx, esp
mov dword [esp], edx
lea edx, [esp + 0x14]
push 4
push edx
push 4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov ecx, dword [esp]
xor ecx, esp
call fcn.0049e340
mov eax, ebx
add esp, 4
pop ebx
ret

Function at 0x43be40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
mov eax, dword [0x500034]
xor eax, esp
mov dword [esp + 8], eax
mov ebx, esp
lea eax, [esp + 4]
push ebx
push 0
push eax
push 0
push dword [esp + 0x34]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x43bedf
cmp dword [esp + 4], 1
jne 0x43bedf
mov ebp, dword [esp]
add ebp, 1
push 0
push 1
push ebp
call fcn.004392c0
add esp, 0xc
mov ecx, edi
mov edi, eax
push ebx
push eax
lea eax, [esp + 0xc]
push eax
push 0
push dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43bed6
cmp dword [esp + 4], 1
jne 0x43bed6
mov eax, dword [esp]
cmp eax, ebp
jb 0x43bece
push 0x6c
push str._home_simon_mem_.build_workdirs_bob_fffbk9my_putty_windows_utils_registry.c
push str.size___allocsize
call fcn.004adb03
add esp, 0xc
mov eax, dword [esp]
mov byte [edi + eax], 0
mov esi, edi
jmp 0x43bedf
push edi
call fcn.00439350
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0049e340
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bf00
Capabilities:
Set registry value

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push ebx
call fcn.004b19c0
add esp, 4
add eax, 1
push eax
push ebx
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
pop esi
pop edi
pop ebx
ret

Function at 0x43bf40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x500034]
xor eax, esp
mov dword [esp + 8], eax
mov ebp, esp
lea ebx, [esp + 4]
push ebp
push 0
push ebx
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x43bfec
cmp dword [esp + 4], 7
jne 0x43bfec
call fcn.00439880
mov edi, eax
mov eax, dword [esp]
add eax, 2
push eax
push edi
call fcn.004397a0
add esp, 8
push ebp
push eax
push ebx
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43bfe3
cmp dword [esp + 4], 7
jne 0x43bfe3
push dword [esp]
push edi
call fcn.004397e0
add esp, 8
nop
nop
nop
nop
nop
nop
push 0
push edi
call fcn.00439850
add esp, 8
test al, al
jne 0x43bfc0
mov eax, edi
add eax, 0xc
push 0
push eax
call fcn.00438b00
add esp, 8
mov esi, edi
jmp 0x43bfec
push edi
call fcn.00439940
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0049e340
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43c010
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 8]
add ecx, 1
push ecx
push dword [eax]
push 7
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
ret
Function at 0x43c420
Capabilities:
Link many functions at runtime

Disassembly:
cmp byte [0x5032c4], 1
jne 0x43c42f
mov al, byte [0x5032c5]
ret
mov byte [0x5032c4], 1
push str.advapi32.dll
call fcn.0043baa0
add esp, 4
mov dword [0x5032c8], eax
test eax, eax
je 0x43c577
push str.GetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5032cc], eax
test eax, eax
je 0x43c577
mov eax, dword [0x5032c8]
test eax, eax
je 0x43c53d
push str.SetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5032d0], eax
test eax, eax
je 0x43c577
mov eax, dword [0x5032c8]
test eax, eax
je 0x43c549
push str.OpenProcessToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5032d4], eax
test eax, eax
je 0x43c577
mov eax, dword [0x5032c8]
test eax, eax
je 0x43c555
push str.GetTokenInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5032d8], eax
test eax, eax
je 0x43c577
mov eax, dword [0x5032c8]
test eax, eax
je 0x43c561
push 0x4e153b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5032dc], eax
test eax, eax
je 0x43c577
mov eax, dword [0x5032c8]
test eax, eax
je 0x43c56d
push 0x4e186b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x5032e0], eax
xor eax, eax
test ecx, ecx
je 0x43c579
mov ecx, dword [0x5032c8]
test ecx, ecx
je 0x43c531
push str.SetEntriesInAclA
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5032e4], eax
test eax, eax
setne al
jmp 0x43c579
mov dword [0x5032d0], 0
jmp 0x43c577
mov dword [0x5032d4], 0
jmp 0x43c577
mov dword [0x5032d8], 0
jmp 0x43c577
mov dword [0x5032dc], 0
jmp 0x43c577
mov dword [0x5032e0], 0
xor eax, eax
mov byte [0x5032c5], al
ret

Function at 0x43f100
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push esi
cmp byte [0x503370], 0
jne 0x43f1ee
push str.winspool.drv
call fcn.0043baa0
add esp, 4
mov esi, eax
push str.spoolss.dll
call fcn.0043baa0
add esp, 4
test esi, esi
je 0x43f19a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumPrintersA
push esi
call edi
mov dword [0x50336c], eax
push str.OpenPrinterA
push esi
call edi
mov dword [0x503350], eax
push str.ClosePrinter
push esi
call edi
mov dword [0x503364], eax
push str.StartDocPrinterA
push esi
call edi
mov dword [0x503354], eax
push str.EndDocPrinter
push esi
call edi
mov dword [0x503360], eax
push str.StartPagePrinter
push esi
call edi
mov dword [0x503358], eax
push str.EndPagePrinter
push esi
call edi
mov dword [0x50335c], eax
push str.WritePrinter
push esi
call edi
jmp 0x43f1e2
mov dword [0x50336c], 0
mov dword [0x503350], 0
mov dword [0x503364], 0
mov dword [0x503354], 0
mov dword [0x503360], 0
mov dword [0x503358], 0
mov dword [0x50335c], 0
xor eax, eax
mov dword [0x503368], eax
mov byte [0x503370], 1
pop esi
pop edi
ret
Function at 0x4499e0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov esi, dword [esp + 0x120]
mov edi, dword [esp + 0x11c]
mov al, byte [esp + 0x124]
mov ecx, dword [0x500034]
xor ecx, esp
mov dword [esp + 0x104], ecx
xor ebp, ebp
mov ebx, 0
test al, al
je 0x449a32
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xffffffff
cmp eax, 0x103
setb bl
mov al, byte [esp + 0x128]
mov dword [esi], 0x4c
test edi, edi
je 0x449a4b
xor ebp, ebp
cmp byte [edi], 0
cmovne ebp, edi
mov dword [esi + 0x2c], ebp
test al, al
je 0x449a5b
push esi
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x449a62
push esi
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov esi, eax
test edi, edi
je 0x449a83
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xfffffefc
cmp eax, 0xfffffefc
ja 0x449a83
mov byte [edi], 0
test bl, bl
je 0x449a90
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test esi, esi
setne bl
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0049e340
mov eax, ebx
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44d2c0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [esp + 0xc]
lea eax, [ecx - 1]
cmp eax, 0x15
jae 0x44d2da
mov edx, 0x18007f
bt edx, eax
jb 0x44d436
mov edx, dword [esp + 4]
cmp edx, 1
jne 0x44d2ee
mov eax, str.SSH2_MSG_KEXDH_INIT
cmp ecx, 0x1e
jne 0x44d2ee
ret
cmp edx, 1
jne 0x44d2fd
mov eax, str.SSH2_MSG_KEXDH_REPLY
cmp ecx, 0x1f
je 0x44d2ed
cmp edx, 2
jne 0x44d30c
mov eax, str.SSH2_MSG_KEX_DH_GEX_REQUEST_OLD
cmp ecx, 0x1e
je 0x44d2ed
cmp edx, 2
jne 0x44d31b
mov eax, str.SSH2_MSG_KEX_DH_GEX_REQUEST
cmp ecx, 0x22
je 0x44d2ed
cmp edx, 2
jne 0x44d32a
mov eax, str.SSH2_MSG_KEX_DH_GEX_GROUP
cmp ecx, 0x1f
je 0x44d2ed
cmp edx, 2
jne 0x44d339
mov eax, str.SSH2_MSG_KEX_DH_GEX_INIT
cmp ecx, 0x20
je 0x44d2ed
cmp edx, 2
jne 0x44d348
mov eax, str.SSH2_MSG_KEX_DH_GEX_REPLY
cmp ecx, 0x21
je 0x44d2ed
cmp edx, 4
jne 0x44d357
mov eax, str.SSH2_MSG_KEXGSS_INIT
cmp ecx, 0x1e
je 0x44d2ed
cmp edx, 4
jne 0x44d366
mov eax, str.SSH2_MSG_KEXGSS_CONTINUE
cmp ecx, 0x1f
je 0x44d2ed
cmp edx, 4
jne 0x44d379
mov eax, str.SSH2_MSG_KEXGSS_COMPLETE
cmp ecx, 0x20
je 0x44d2ed
cmp edx, 4
jne 0x44d38c
mov eax, str.SSH2_MSG_KEXGSS_HOSTKEY
cmp ecx, 0x21
je 0x44d2ed
cmp edx, 4
jne 0x44d39f
mov eax, str.SSH2_MSG_KEXGSS_ERROR
cmp ecx, 0x22
je 0x44d2ed
cmp edx, 4
jne 0x44d3b2
mov eax, str.SSH2_MSG_KEXGSS_GROUPREQ
cmp ecx, 0x28
je 0x44d2ed
cmp edx, 4
jne 0x44d3c5
mov eax, str.SSH2_MSG_KEXGSS_GROUP
cmp ecx, 0x29
je 0x44d2ed
cmp edx, 5
jne 0x44d3d8
mov eax, str.SSH2_MSG_KEXRSA_PUBKEY
cmp ecx, 0x1e
je 0x44d2ed
cmp edx, 5
jne 0x44d3eb
mov eax, str.SSH2_MSG_KEXRSA_SECRET
cmp ecx, 0x1f
je 0x44d2ed
cmp edx, 5
jne 0x44d3fe
mov eax, str.SSH2_MSG_KEXRSA_DONE
cmp ecx, 0x20
je 0x44d2ed
cmp edx, 3
jne 0x44d411
mov eax, str.SSH2_MSG_KEX_ECDH_INIT
cmp ecx, 0x1e
je 0x44d2ed
cmp edx, 3
jne 0x44d424
mov eax, str.SSH2_MSG_KEX_ECDH_REPLY
cmp ecx, 0x1f
je 0x44d2ed
lea eax, [ecx - 0x32]
cmp eax, 4
jae 0x44d440
lea eax, [eax*4 + 0x4d40d0]
mov eax, dword [eax]
ret
lea eax, [eax*4 + 0x4d407c]
mov eax, dword [eax]
ret
mov edx, dword [esp + 8]
cmp edx, 1
jne 0x44d457
mov eax, str.SSH2_MSG_USERAUTH_PK_OK
cmp ecx, 0x3c
je 0x44d2ed
cmp edx, 2
jne 0x44d46a
mov eax, str.SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ
cmp ecx, 0x3c
je 0x44d2ed
cmp edx, 4
jne 0x44d47d
mov eax, str.SSH2_MSG_USERAUTH_INFO_REQUEST
cmp ecx, 0x3c
je 0x44d2ed
cmp edx, 4
jne 0x44d490
mov eax, str.SSH2_MSG_USERAUTH_INFO_RESPONSE
cmp ecx, 0x3d
je 0x44d2ed
cmp edx, 3
jne 0x44d4a3
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_RESPONSE
cmp ecx, 0x3c
je 0x44d2ed
cmp edx, 3
jne 0x44d4b6
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_TOKEN
cmp ecx, 0x3d
je 0x44d2ed
cmp edx, 3
jne 0x44d4c9
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE
cmp ecx, 0x3f
je 0x44d2ed
cmp edx, 3
jne 0x44d4dc
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_ERROR
cmp ecx, 0x40
je 0x44d2ed
cmp edx, 3
jne 0x44d4ef
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_ERRTOK
cmp ecx, 0x41
je 0x44d2ed
cmp edx, 3
jne 0x44d502
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_MIC
cmp ecx, 0x42
je 0x44d2ed
add ecx, 0xffffffb0
mov eax, str.unknown
cmp ecx, 0x15
jae 0x44d2ed
lea eax, [ecx*4 + 0x4d40e0]
mov eax, dword [eax]
ret
Function at 0x45d600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ecx, dword [esp + 0x38]
mov eax, dword [0x500034]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 8]
push 0
push eax
push eax
call dword [eax + 0x18]
add esp, 0xc
test eax, eax
je 0x45d7b0
lea ebp, [esp + 0x10]
jmp 0x45d6a7
add eax, 0x18
push eax
mov edi, eax
call fcn.00438f10
add esp, 4
push edi
call fcn.00439010
add esp, 4
mov ebx, eax
push edx
call fcn.004656e0
add esp, 4
push ebx
push eax
push str.Remote_debug_message:__.s
call fcn.00438880
add esp, 0xc
push eax
mov eax, dword [esp + 0x3c]
push dword [eax + 0x20]
call fcn.004251c0
add esp, 8
mov edi, dword [esp + 0x38]
mov eax, dword [edi + 8]
push 1
push eax
push eax
call dword [eax + 0x18]
add esp, 0xc
mov eax, dword [edi + 8]
push 0
push eax
push eax
call dword [eax + 0x18]
add esp, 0xc
test eax, eax
je 0x45d7b0
mov ecx, dword [eax]
xor ebx, ebx
add ecx, 0xffffffff
cmp ecx, 6
ja case.0x45d6b7.2
jmp dword [ecx*4 + 0x4d4718]
lea ecx, [eax + 0x18]
mov dword [esp + 8], ecx
push ecx
mov dword [esp + 4], eax
call fcn.00438f80
mov ecx, dword [esp + 4]
add esp, 4
mov dword [esp + 4], eax
test eax, eax
je case.0x45d6b7.1
xor edi, edi
jmp 0x45d6fc
add edi, 1
cmp edi, dword [esp + 4]
mov ecx, dword [esp]
je case.0x45d6b7.1
cmp dword [ecx + 0x24], 0
jne case.0x45d6b7.1
mov ebx, dword [esp + 8]
push ebx
call fcn.00439010
add esp, 4
mov dword [esp + 0xc], eax
mov esi, ebp
mov ebp, edx
push ebx
call fcn.00439010
add esp, 4
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
push str.server_sig_algs
push ebp
mov ebp, esi
lea esi, [esp + 0x20]
push dword [esp + 0x14]
call fcn.004394d0
add esp, 0xc
test al, al
je 0x45d6f0
push ebp
push esi
call fcn.0044d200
add esp, 8
test al, al
mov ebx, dword [esp + 0x38]
jne 0x45d76e
jmp 0x45d6f0
push ebp
push esi
call fcn.0044d200
add esp, 8
test al, al
je 0x45d6f0
push str.rsa_sha2_256
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.004394d0
add esp, 0xc
test al, al
je 0x45d78e
mov eax, dword [ebx + 4]
mov byte [eax + 0x70], 1
push str.rsa_sha2_512
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.004394d0
add esp, 0xc
test al, al
je 0x45d760
mov eax, dword [ebx + 4]
mov byte [eax + 0x71], 1
jmp 0x45d760
xor ebx, ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0049e340
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
add eax, 0x18
push eax
mov esi, eax
call fcn.00438f80
add esp, 4
mov ebx, eax
push esi
call fcn.00439010
add esp, 4
mov esi, eax
push edx
call fcn.004656e0
add esp, 4
lea edx, [ebx - 1]
mov ecx, str.unknown
cmp edx, 0xe
ja 0x45d7ff
mov ecx, dword [ebx*4 + 0x4d4674]
push esi
push eax
push ecx
push ebx
push str.Remote_side_sent_disconnect_message_ntype__d___s_:_n__.s_
mov eax, dword [esp + 0x4c]
push dword [eax + 0x2c]
call fcn.004260b0
add esp, 0x18
mov bl, 1
jmp case.0x45d6b7.2